Detection methods, devices, equipment, and storage media for excessive exposure of sensitive data

Abstract

The present application proposes a method, apparatus, device, and storage medium for detecting excessive exposure of sensitive data. The method comprises: performing traffic detection on a target interface, performing sensitive data detection on each detected first response message to be detected, and obtaining a first data volume of sensitive data contained in each first response message; and determining whether a target response message in the first response message whose first data volume exceeds a data volume threshold has a risk of excessive exposure of sensitive data. The present application can effectively detect whether there is a risk of sensitive data exposure in API traffic, and reduce the losses caused by sensitive data exposure.

Description

Technical Field

[0001] The present application relates to the field of network security technology, and in particular to a method, apparatus, device, and storage medium for detecting excessive exposure of sensitive data. Background Art

[0002] With the rapid development of big data technology, the widespread adoption of the REST standard and the need for API reuse have led to various logical flaws in the design and implementation of API interfaces. These flaws can lead to malicious exploitation of API interfaces, such as through horizontal privilege escalation and parameter tampering, leading to excessive exposure of sensitive data. Excessive exposure of sensitive data poses a significant threat to data and business security.

[0003] Since API interfaces are open to callers with different needs, the return values ​​of requests from different callers are also different. In terms of request direction, the requests initiated by abnormal users calling the API interface may have no obvious characteristic differences from the requests initiated by normal users. Therefore, traditional API security products cannot effectively detect the exposure of sensitive data. Summary of the Invention

[0004] In order to solve the technical problem that the existing technology cannot effectively detect whether there is sensitive data exposure in API interface traffic. This application provides a detection method, device, equipment and storage medium for excessive exposure of sensitive data, the main purpose of which is to effectively detect whether there is a risk of sensitive data exposure in API traffic and reduce the losses caused by sensitive data exposure.

[0005] To achieve the above objectives, the present application provides a method for detecting excessive exposure of sensitive data, the method comprising:

[0006] Performing traffic detection on the target interface, performing sensitive data detection on each detected first response message to be detected, and obtaining a first data volume of sensitive data contained in each first response message;

[0007] It is determined that in the first response message, the target response message in which the first data volume exceeds the data volume threshold has a risk of excessive exposure of sensitive data.

[0008] To achieve the above objectives, the present application provides a method for detecting excessive exposure of sensitive data, the method comprising:

[0009] Performing traffic detection on the target interface, performing sensitive data detection on each detected first response message to be detected, and obtaining a first data volume of sensitive data contained in each first response message and a type of sensitive data contained therein;

[0010] Based on the first data volume and the type of sensitive data contained therein, it is determined that the target response message in the first response message has a risk of excessive exposure of sensitive data, wherein the target response message is a response message in which the first data volume exceeds the data volume threshold and / or the type of sensitive data contained therein does not all belong to common sensitive data types.

[0011] In addition, to achieve the above-mentioned purpose, the present application also provides a device for detecting excessive exposure of sensitive data, the device comprising:

[0012] a first data detection module, configured to perform traffic detection on a target interface, perform sensitive data detection on each detected first response message to be detected, and obtain a first data volume of sensitive data contained in each first response message;

[0013] The first judgment module is used to determine that there is a risk of excessive exposure of sensitive data in the target response message in which the first data volume exceeds the data volume threshold in the first response message.

[0014] In addition, to achieve the above-mentioned purpose, the present application also provides a device for detecting excessive exposure of sensitive data, the device comprising:

[0015] a second data detection module, configured to perform traffic detection on the target interface, perform sensitive data detection on each detected first response message to be detected, and obtain a first data volume of sensitive data and a type of sensitive data contained in each first response message;

[0016] The second judgment module is used to determine, based on the first data volume and the type of sensitive data contained therein, whether a target response message in the first response message is at risk of excessive exposure of sensitive data, wherein the target response message is a response message in which the first data volume exceeds a data volume threshold and / or the type of sensitive data contained therein does not all belong to common sensitive data types.

[0017] To achieve the above-mentioned objectives, the present application also provides a computer device, comprising a memory, a processor, and computer-readable instructions stored in the memory and executable on the processor. When the processor executes the computer-readable instructions, the processor performs the steps of the method for detecting excessive exposure of sensitive data as described in any of the foregoing items.

[0018] To achieve the above-mentioned purpose, the present application also provides a computer-readable storage medium, on which computer-readable instructions are stored. When the computer-readable instructions are executed by a processor, the processor executes the steps of the method for detecting excessive exposure of sensitive data as described in any of the above items.

[0019] The detection method, apparatus, device and storage medium for excessive exposure of sensitive data proposed in the present application judge whether the first data volume of the sensitive data contained in the first response message exceeds the data volume threshold according to the data volume threshold, thereby judging that the corresponding first response message has the risk of excessive exposure of sensitive data when the first data volume exceeds the data volume threshold. The present application judges whether sensitive data is excessively exposed by the data volume of the sensitive data contained in the response message, and can effectively detect whether there is a risk of sensitive data exposure in API traffic, reduce the losses caused by sensitive data exposure, and improve API security detection and protection capabilities. The present application can be applied to scenarios such as API traffic detection, and applied to products such as WAF firewalls and security situation awareness. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] Figure 1 Schematic diagram of a flow chart of a method for detecting excessive exposure of sensitive data in one embodiment of the present application;

[0021] Figure 2 This is a flow chart of a method for detecting excessive exposure of sensitive data in another embodiment of the present application;

[0022] Figure 3 This is a structural block diagram of a device for detecting excessive exposure of sensitive data in one embodiment of the present application;

[0023] Figure 4 This is a structural block diagram of a device for detecting excessive exposure of sensitive data in another embodiment of the present application;

[0024] Figure 5 This is a block diagram of the internal structure of a computer device in one embodiment of the present application.

[0025] The realization of the objectives, functional features and advantages of this application will be further explained in conjunction with embodiments and with reference to the accompanying drawings. DETAILED DESCRIPTION

[0026] In order to make the purpose, technical solutions and advantages of the embodiments of the present application clearer, the technical solutions in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of this application. It should be understood that the specific embodiments described here are only used to explain the present application and are not used to limit the present application.

[0027] Figure 1 This is a flow chart of a method for detecting excessive exposure of sensitive data in an embodiment of the present application; Figure 1 The method for detecting excessive exposure of sensitive data includes the following steps S110-S120.

[0028] S110: Perform traffic detection on the target interface, perform sensitive data detection on each detected first response message to be detected, and obtain a first data volume of sensitive data included in each first response message.

[0029] Specifically, the target interface is a sensitive API (Application Programming Interface), meaning that the traffic corresponding to the target interface contains sensitive data. Sensitive data specifically refers to data containing sensitive fields or sensitive data values. For example, name, address, and contact information are sensitive fields, while phone number and address values ​​are sensitive data values.

[0030] An API is a computing interface used for interactive communication between applications, defining calling rules and data format-related information. The API mentioned in this application may include a Web API. A Web API is a network application programming interface that encompasses a wide range of functions. Through an API, network applications can implement capabilities such as storage services, messaging services, and computing services. These capabilities can be used to develop powerful web applications.

[0031] A system includes multiple API interfaces. If a certain API interface does not contain sensitive data during traffic detection, it will not be selected as the target interface. If sensitive data is detected in the traffic of the API interface, the API interface will be selected as the target interface.

[0032] A sensitive data detection method is used to perform sensitive data detection on each first response message in the target interface to obtain a first data volume of sensitive data contained in each first response message.

[0033] Among them, the sensitive data detection can specifically detect whether there are sensitive fields and / or sensitive data values ​​in the first response message, and locate the position of the sensitive fields or sensitive data values ​​in the first response message. If there are sensitive fields or sensitive data values, it is determined that the first response message contains sensitive data, and the response data containing the sensitive fields or sensitive data values ​​in the response body of the first response message is regarded as sensitive data. Among them, the response data is located in the response body, and a response message may include multiple response data. For example,

[0034] A response body includes the following response data:

[0035] {

[0036] "status":"1","iphone":"021-2982981","username":"bojack"

[0037] }

[0038] {

[0039] "status":"1","iphone":"021-2982982","username":"livira"

[0040] }........

[0041] If iPhone is a sensitive field or sensitive word, then {"status":"1","iphone":"021-2982981","username":"bojack"} in the response body is a sensitive data item; {“status":"1","iphone":"021-2982982","username":"livira"} is also a sensitive data item.

[0042] In addition, different API interfaces can define different sensitive fields. For example, fields such as User_name and Address represent names and addresses. These fields are sensitive in some API interfaces, but non-sensitive in other API interfaces.

[0043] In addition, a first response message may not contain sensitive data, or it may contain one or more sensitive data. The first data volume of sensitive data contained in different first response messages is not necessarily the same. The same target interface may have multiple first response messages within a time period. These first response messages include the response packets returned by the target interface to the normal user when a normal user sends a first request message to the target interface to call the target interface. These first response messages may also include the response packets returned by the target interface to the abnormal user when an abnormal user sends a first request message to the target interface to call the target interface.

[0044] S120: Determine that there is a risk of excessive exposure of sensitive data in the target response message in which the first data volume exceeds the data volume threshold in the first response message.

[0045] Specifically, if the first data volume of sensitive data contained in any first response message exceeds the data volume threshold, it is determined that the first response message has the risk of excessive exposure of sensitive data.

[0046] First response messages that pose a risk of excessive exposure of sensitive data can be intercepted and abnormal alarms can be issued to prompt R&D personnel to perform corresponding risk investigation and prevention.

[0047] This embodiment determines whether the first data volume of the sensitive data contained in the first response message exceeds the data volume threshold according to the data volume threshold, thereby determining that the corresponding first response message has the risk of excessive exposure of sensitive data when the first data volume exceeds the data volume threshold. This application determines whether sensitive data is excessively exposed by the data volume of the sensitive data contained in the response message, and can effectively detect whether there is a risk of sensitive data exposure in API traffic, reduce the losses caused by sensitive data exposure, and improve API security detection and protection capabilities. This application can be applied to scenarios such as API traffic detection, and applied to products such as WAF firewalls and security situation awareness.

[0048] In one embodiment, before step S110, the method further includes:

[0049] Performing sensitive data detection on the second response messages detected within a period to obtain a second data volume of the sensitive data contained in each second response message, wherein the second response message is the traffic corresponding to the target interface and generated before the first response message;

[0050] The data volume threshold is obtained based on the data distribution of the second data volume corresponding to all second response messages within a cycle. Specifically, after using the same sensitive data detection method to learn the second data volume of sensitive data contained in the second response message of the target interface within a cycle, it can be used to detect the risk of excessive exposure of sensitive data in subsequent traffic of the target interface.

[0051] The sensitive data of the second response message detected by the target interface within a subsequent cycle is detected to count the second data volume of the sensitive data contained in each second response message. In this embodiment, the traffic of the same target interface within a cycle is detected.

[0052] Multiple second response messages are collected in one cycle, so the data distribution is calculated based on the second data volume of sensitive data contained in all second response messages. The data distribution is used to indicate the numerical distribution of the number of sensitive data items.

[0053] The data volume threshold can be obtained by the three sigma criterion. Specifically, the standard deviation σ and mean μ are calculated based on the second data volume of the sensitive data contained in all second response messages, and the numerical distribution is calculated according to the 3σ criterion. The first probability of the numerical distribution in (μ-σ, μ+σ) is calculated, the second probability of the numerical distribution in (μ-2σ, μ+2σ) is calculated, and the third probability of the numerical distribution in (μ-3σ, μ+3σ) is calculated. The third probability is greater than the first probability and the second probability, and the vast majority of the second data volume is distributed in the interval (μ-3σ, μ+3σ). μ+3σ can be taken as the data volume threshold. Of course, appropriate compensation can be made based on μ+3σ to obtain a value as the data volume threshold, which can be appropriately adjusted according to the data distribution of the sensitive data contained in (μ+3σ, +∞).

[0054] This embodiment analyzes the traffic of the target API interface through statistical methods to obtain the second data volume of the second response message in the learning phase of one cycle, obtains the data volume threshold value based on the second data volume of all second response messages, and judges whether the first data volume of the sensitive data contained in the subsequent first response message exceeds the data volume threshold value, so as to determine that the corresponding first response message has the risk of excessive exposure of sensitive data when the first data volume exceeds the data volume threshold value. This application judges whether sensitive data is excessively exposed by the data volume of sensitive data contained in the response message, and can effectively detect whether there is a risk of sensitive data exposure in API traffic, reduce the losses caused by sensitive data exposure, and improve API security detection and protection capabilities. This application can be applied to scenarios such as API traffic detection, and applied to products such as WAF firewalls and security situation awareness.

[0055] In one embodiment, before step S120, the method further includes:

[0056] Obtain the request attribute information of the second request message corresponding to the second response message,

[0057] Learning the correspondence between the sensitive data contained in all second response messages and the request attribute information of the corresponding second request messages to obtain a correspondence distribution;

[0058] Step S120 includes:

[0059] Obtaining request attribute information of the first request message corresponding to the target response message, wherein the target response message is a response message in the first response message whose first data volume exceeds the data volume threshold,

[0060] Based on the corresponding relationship distribution, determine whether the sensitive data included in the target response message corresponds to the request attribute information of the corresponding first request message,

[0061] If there is no correspondence, it is determined that the target response message has the risk of excessive exposure of sensitive data.

[0062] Specifically, each second response message is the return data generated by the target interface based on the corresponding second request message. A response message is a response message or response packet from the server to the client, including a response line, a response header, and a response body. A request message is a request message or request packet from the client to the server, including a request line, a request header, and a request body.

[0063] The request attribute information is used to indicate the data attributes of the corresponding request message. The request attribute information may include, but is not limited to, parameter names, parameter values, and request header structures contained in the request body of the corresponding request message.

[0064] The target interface request direction contains characteristic parameter names or key parameter values ​​that may affect the return of sensitive data in the response direction. The amount of data returned is controlled by the request direction. An attacker can maliciously tamper with the request message and cause a large amount of data to be returned. In some cases, an interface originally only returns a small amount of data, but an attacker constructs a malicious request packet to cause the interface to return a large amount of sensitive data.

[0065] Therefore, the second amount of sensitive data contained in the response message is related to the request body of the corresponding request message. Based on this, this embodiment studies the correspondence between the request attribute information of all second request messages within a cycle of the target interface and the sensitive data contained in the corresponding second response messages, and can obtain the distribution of the correspondence between the request attribute information and the sensitive data.

[0066] To ensure the accuracy of the judgment, the correspondence distribution can be obtained by removing the sensitive data with less distribution from the entire correspondence distribution.

[0067] The learned correspondence distribution can be used to assess whether the sensitive data contained in any first response message corresponds to or has a corresponding relationship with the request attribute information of the corresponding first request message. If a corresponding relationship exists, the sensitive data appearing in the response message is either requested in the corresponding request message or also appears in the majority of second response messages in the corresponding relationship distribution. If no corresponding relationship exists, the sensitive data appearing in the response message is not requested in the corresponding request message and does not appear in the corresponding relationship distribution.

[0068] Of course, machine learning can also be used to train the corresponding relationship model by taking the sensitive data contained in each second response message and the request attribute information of the corresponding second request message as a training sample.

[0069] The request attribute information in the first request message corresponding to the first response message is used as input to the trained correspondence model, and the trained correspondence model is used to estimate the sensitive data in the first response message. If the estimated sensitive data differs from the actual sensitive data in the first response message, for example, the actual sensitive data exceeds the estimated sensitive data or the actual sensitive data does not entirely fall within the estimated sensitive data, then it is determined that the sensitive data contained in the first response message does not correspond to the request attribute information in the corresponding first request message.

[0070] Alternatively, the actual sensitive data of the first response message is used as input to the trained correspondence model, and the trained correspondence model is used to estimate the request attribute information of the first request message corresponding to the first response message. If there is a difference between the estimated request attribute information and the actual request attribute information of the first request message, for example, if the parameter names in the estimated request attributes do not all belong to the estimated request attribute information and / or the corresponding parameter value types of the two are different and / or the request body structures of the two are different, then it is determined that the sensitive data contained in the first response message does not correspond to the request attribute information of the corresponding first request message.

[0071] If the first data volume of sensitive data contained in a first response request exceeds the data volume threshold and the sensitive data contained in the first response message does not correspond to the request attribute information of the corresponding first request message, it is determined that the first response message has a risk of excessive exposure of sensitive data.

[0072] This embodiment will continue to determine whether there is a corresponding relationship between the sensitive data and the request attribute information when the first data volume of the sensitive data contained in the first response request exceeds the data volume threshold. Through dual evaluation, it will accurately determine whether the first response request excessively exposes sensitive data, reduce the possibility of misjudgment, and improve the accuracy of the judgment.

[0073] In one embodiment, before step S120, the method further includes:

[0074] Obtain parameter attribute information of the second request message corresponding to the second response message,

[0075] Learning parameter attribute information of the second request messages corresponding to all second response messages to obtain a parameter attribute distribution;

[0076] Step S120 includes:

[0077] Obtain parameter attribute information of the first request message corresponding to the target response message, wherein the target response message is a response message in the first response message whose first data volume exceeds the data volume threshold,

[0078] Based on the parameter attribute distribution, determine whether the parameter attribute information of the first request message corresponding to the target response message is abnormal,

[0079] If there is an abnormality in the parameter attribute information of the first request message corresponding to the target response message, it is determined that there is a risk of excessive exposure of sensitive data in the target response message.

[0080] Specifically, the parameter attribute information includes first attribute information of the parameter name in at least one dimension and / or second attribute information of the parameter value in at least one dimension. The at least one dimension includes at least one of type, length, and character distribution.

[0081] By learning the parameter attribute information of all second request messages, a parameter attribute distribution can be obtained. If the parameter attribute information of the first request message does not completely conform to the parameter attribute distribution, it is determined that the parameter attribute information of the first request message is abnormal, that is, deviates from the parameter attribute distribution.

[0082] In order to ensure the accuracy of judgment, the parameter attribute distribution can be the distribution after eliminating the data with less distribution in the overall parameter attribute distribution.

[0083] This embodiment will continue to determine whether there is any abnormality in the parameter attribute information of the first request message when the first data volume of sensitive data contained in the first response request exceeds the data volume threshold. Through double evaluation, it will accurately determine whether the first response request excessively exposes sensitive data, reduce the possibility of misjudgment, and improve the accuracy of the judgment.

[0084] Figure 2 This is a flow chart of a method for detecting excessive exposure of sensitive data in another embodiment of the present application; Figure 2 The method for detecting excessive exposure of sensitive data includes the following steps S210-S220.

[0085] S210: Perform traffic detection on the target interface, perform sensitive data detection on each detected first response message to be detected, and obtain a first data volume of sensitive data and a type of sensitive data contained in each first response message.

[0086] Specifically, the sensitive data detection specifically detects whether sensitive fields and / or sensitive data values ​​exist in the first response message, and locates the position of the sensitive fields or sensitive data values ​​in the first response message. If sensitive fields or sensitive data values ​​exist, the first response message is determined to contain sensitive data, and the response data containing the sensitive fields or sensitive data values ​​in the response body of the first response message is treated as sensitive data. The response data is located in the response body, and a response message may include multiple pieces of response data.

[0087] In addition, a first response message may not contain sensitive data, or it may contain one or more sensitive data. The first data volume of sensitive data contained in different first response messages is not necessarily the same. The same target interface will have multiple first response messages in one cycle. These first response messages include the response packets returned by the target interface to the normal user when a normal user sends a first request message to the target interface to call the target interface. These first response messages may also include the response packets returned by the target interface to the abnormal user when an abnormal user sends a first request message to the target interface to call the target interface.

[0088] The presence of characteristic parameter names or key parameter values ​​in sensitive API request requests may affect the return of sensitive data types in the response. For example, a sensitive API might return new types of sensitive data. For example, an API that originally only returned names and email addresses might suddenly include information like mobile phone numbers and bank card numbers. Consequently, the API might return information that shouldn't be returned to the caller, potentially leaking sensitive information and compromising data security.

[0089] For example, if a user query API is provided, the user requests a username and address, but an attacker modifies the request parameters so that the interface returns the username, phone number, and address. The details are as follows:

[0090] Under normal circumstances:

[0091] The parameters for the request direction are: r = 1001 | 1002 | 1003; the response message for the response direction includes:

[0092] {"user_name":"Donald","Address":"4346Kinney Street"};

[0093] In abnormal circumstances:

[0094] The parameters of the request direction are: r=1001|1002|1003|2001|2002|2003; the response message of the response direction includes: {"user_name":"Donald","Phone":"413-538-5990","Address":"4346KinneyStreet"}.

[0095] In an abnormal situation, the request parameters contain the extra values ​​2001|2002|2003, and the corresponding response message contains the value "Phone":"413-538-5990". If the "phone" field matches a sensitive term in the sensitive word library, such as a phone number or mobile number, the field is considered sensitive. If the regular expression matches "413-538-5990", the value is considered sensitive.

[0096] Based on this, this embodiment also obtains the sensitive data type contained in the first response message. A piece of sensitive data may contain multiple sensitive fields or sensitive data values. A sensitive field corresponds to a sensitive data type, and a sensitive data value corresponds to a sensitive data type. The sensitive data types contained in the same piece of sensitive data can be different sensitive data types contained, and the same sensitive data type is counted once; or all sensitive data types contained, and the same sensitive data type can be counted repeatedly. Sensitive data types include, for example, a phone number as a data type, an email address as a data type, and a name as a data type.

[0097] S220: Determine, based on the first data volume and the type of sensitive data contained therein, whether the target response message in the first response message has a risk of excessive exposure of sensitive data, wherein the target response message is a response message in which the first data volume exceeds a data volume threshold and / or the type of sensitive data contained therein does not all belong to common sensitive data types.

[0098] Specifically, if the first data volume of sensitive data contained in any first response message exceeds the data volume threshold or the sensitive data types contained in the first response message do not all belong to common sensitive data types (that is, there are new sensitive data types), or the first data volume of sensitive data contained in the first response message exceeds the data volume threshold and the sensitive data types contained in the first response message do not all belong to common sensitive data types, then it is determined that the first response message is at risk of excessive exposure of sensitive data.

[0099] First response messages that pose a risk of excessive exposure of sensitive data can be intercepted and abnormal alarms can be issued to prompt R&D personnel to perform corresponding risk investigation and prevention.

[0100] This embodiment comprehensively judges whether the first response message has the risk of excessive exposure of sensitive data based on the first data amount of sensitive data present in the first response message and whether all the sensitive data types contained therein are common sensitive data types, thereby increasing the credibility and accuracy of the judgment.

[0101] In one embodiment, before step S210, the method further includes:

[0102] Perform sensitive data detection on the second response messages detected within a cycle to obtain a second data volume of sensitive data and a type of sensitive data contained in each second response message, wherein the second response message is traffic corresponding to the target interface and generated before the first response message;

[0103] Obtaining a data volume threshold according to data distribution of the second data volume corresponding to all second response messages within a period;

[0104] Statistics are performed on the sensitive data types contained in all second response messages, and uncommon sensitive data types are eliminated to obtain common sensitive data types, where the uncommon sensitive data types are types whose frequency of occurrence in the statistics is lower than the first threshold.

[0105] Specifically, the same sensitive data detection method is used to perform sensitive data detection on each second response message in the target interface to obtain the second data volume of the sensitive data contained in each second response message and the type of sensitive data contained. After learning the second data volume of the sensitive data contained in the second response message of the target interface within a cycle and the type of sensitive data contained, it can be used to detect the risk of excessive exposure of sensitive data in subsequent traffic of the target interface.

[0106] Multiple second response messages are collected in one cycle, so the data distribution is calculated based on the second data volume of sensitive data contained in all second response messages. The data distribution is used to indicate the numerical distribution of the number of sensitive data items.

[0107] The data volume threshold can be calculated using the three sigma criterion. Specifically, the standard deviation σ1 and mean μ1 are calculated based on the second data volume of the sensitive data contained in all second response messages, and the numerical distribution is calculated based on the 3σ1 criterion. The first probability of the numerical distribution in (μ1-σ1, μ1+σ1) is calculated, the second probability of the numerical distribution in (μ1-2σ1, μ1+2σ1) is calculated, and the third probability of the numerical distribution in (μ1-3σ1, μ1+3σ1) is calculated. The third probability is greater than the first probability and the second probability, and the vast majority of the first data volume is distributed in the interval (μ1-3σ1, μ1+3σ1). μ1+3σ1 can be taken as the data volume threshold. Of course, appropriate compensation can be made based on μ1+3σ1 to obtain a value as the data volume threshold, which can be appropriately adjusted based on the data distribution of the sensitive data contained in (μ1+3σ1, +∞).

[0108] Most of the second response messages are normal response messages, and a small number are abnormal response messages. Therefore, statistics are taken on sensitive data types, and in the obtained data type distribution, uncommon sensitive data types account for a small portion of the entire distribution.

[0109] The number of sensitive data types in each category can be counted, and the ratio of the number of each sensitive data type to the total number of all sensitive data types can be calculated. The ratio represents the frequency of occurrence. Sensitive data types with a ratio less than a first threshold are treated as uncommon sensitive data types and removed. The remaining sensitive data types are treated as common sensitive data types.

[0110] Of course, we can also use the Three Sigma criterion to calculate the number of sensitive data types to obtain the standard deviation σ2 and mean μ2. Using the standard deviation σ2 and mean μ2, we can determine the data type distribution and remove sensitive data types outside the target range as uncommon sensitive data types. For example, sensitive data types outside the range (μ2-3σ2, μ2+3σ2) can be considered uncommon sensitive data types. Sensitive data types within the range (μ2-3σ2, μ2+3σ2) can be considered common sensitive data types.

[0111] First response messages that pose a risk of excessive exposure of sensitive data can be intercepted and abnormal alarms can be issued to prompt R&D personnel to perform corresponding risk investigation and prevention.

[0112] This embodiment models the sensitive data type returned in the response body of the sensitive API interface, the second data volume of the sensitive data contained, and the parameters of the corresponding request direction, and learns the behavioral profile of the sensitive interface within a cycle to detect the subsequent traffic of the sensitive API interface. If a sensitive data type deviates from the model and the data volume of the sensitive data contained exceeds the data volume threshold, an abnormal alarm will be issued in the response message.

[0113] This embodiment comprehensively judges whether the first response message has the risk of excessive exposure of sensitive data based on the first data amount of sensitive data present in the first response message and whether all the sensitive data types contained therein are common sensitive data types, thereby increasing the credibility and accuracy of the judgment.

[0114] In one embodiment, before step S220, the method further includes:

[0115] Obtain the request attribute information of the second request message corresponding to the second response message,

[0116] Learning the correspondence between the sensitive data contained in all second response messages and the request attribute information of the corresponding second request messages to obtain a correspondence distribution;

[0117] Step S220 includes:

[0118] Obtaining request attribute information of the first request message corresponding to the target response message, wherein the target response message is a response message in the first response message, the first data volume exceeds the data volume threshold and / or the included sensitive data types do not all belong to common sensitive data types,

[0119] Based on the corresponding relationship distribution, determine whether the sensitive data included in the target response message corresponds to the request attribute information of the corresponding first request message,

[0120] If there is no correspondence, it is determined that the target response message has the risk of excessive exposure of sensitive data.

[0121] Specifically, the request attribute information is used to indicate data attributes of the corresponding request message. The request attribute information may include, but is not limited to, parameter names, parameter values, and request header structures contained in the request body of the corresponding request message.

[0122] The target interface request direction contains characteristic parameter names or key parameter values ​​that may affect the return of sensitive data in the response direction. The amount of data returned is controlled by the request direction. An attacker can maliciously tamper with the request message and cause a large amount of data to be returned. In some cases, an interface originally only returns a small amount of data, but an attacker constructs a malicious request packet to cause the interface to return a large amount of sensitive data.

[0123] Therefore, the second amount of sensitive data contained in the response message is related to the request body of the corresponding request message. Based on this, this embodiment studies the correspondence between the request attribute information of all second request messages within a cycle of the target interface and the sensitive data contained in the corresponding second response messages, thereby obtaining a distribution of correspondences between the request attribute information and the sensitive data. To evaluate the first response message using the correspondence distribution, the correspondence distribution is obtained by removing the less-distributed sensitive data from the entire correspondence distribution.

[0124] The learned correspondence distribution can be used to assess whether the sensitive data contained in any first response message corresponds to or has a corresponding relationship with the request attribute information of the corresponding first request message. If a corresponding relationship exists, the sensitive data appearing in the response message is either requested in the corresponding request message or also appears in the majority of second response messages in the corresponding relationship distribution. If no corresponding relationship exists, the sensitive data appearing in the response message is not requested in the corresponding request message and is not found in the corresponding relationship distribution.

[0125] Of course, machine learning can also be used to train the corresponding relationship model by taking the sensitive data contained in each second response message and the request attribute information of the corresponding second request message as a training sample.

[0126] The request attribute information in the first request message corresponding to the first response message is used as input to the trained correspondence model, and the trained correspondence model is used to estimate the sensitive data in the first response message. If the estimated sensitive data differs from the actual sensitive data in the first response message, for example, the actual sensitive data exceeds the estimated sensitive data or the actual sensitive data does not entirely fall within the estimated sensitive data, then it is determined that the sensitive data contained in the first response message does not correspond to the request attribute information in the corresponding first request message.

[0127] Alternatively, the actual sensitive data of the first response message is used as input to the trained correspondence model, and the trained correspondence model is used to estimate the request attribute information of the first request message corresponding to the first response message. If there is a difference between the estimated request attribute information and the actual request attribute information of the first request message, for example, if the parameter names in the estimated request attributes do not all belong to the estimated request attribute information and / or the corresponding parameter value types of the two are different and / or the request body structures of the two are different, then it is determined that the sensitive data contained in the first response message does not correspond to the request attribute information of the corresponding first request message.

[0128] If the first data volume of sensitive data contained in any first response message exceeds the data volume threshold and the sensitive data contained in the first response message does not correspond to the request attribute information of the corresponding first request message, or the sensitive data types contained in the first response message do not all belong to common sensitive data types (that is, there are new sensitive data types), and the sensitive data contained in the first response message does not correspond to the request attribute information of the corresponding first request message, or the first data volume of sensitive data contained in the first response message exceeds the data volume threshold, and the sensitive data types contained in the first response message do not all belong to common sensitive data types, and the sensitive data contained in the first response message does not correspond to the request attribute information of the corresponding first request message, then it is determined that the first response message has a risk of excessive exposure of sensitive data.

[0129] In this embodiment, when the first data volume of sensitive data contained in the first response request exceeds the data volume threshold and / or the sensitive data types contained in the first response message do not all belong to common sensitive data types, it will continue to determine whether there is a correspondence between the sensitive data and the request attribute information, and accurately determine whether the first response request excessively exposes sensitive data through multiple evaluations, thereby reducing the possibility of misjudgment and improving the accuracy of the judgment.

[0130] In one embodiment, before step S220, the method further includes:

[0131] Obtain parameter attribute information of the second request message corresponding to the second response message,

[0132] Learning parameter attribute information of the second request messages corresponding to all second response messages to obtain a parameter attribute distribution;

[0133] Step S220 includes:

[0134] Obtain parameter attribute information of the first request message corresponding to the target response message, wherein the target response message is a response message in the first response message, the first data volume exceeds the data volume threshold and / or the sensitive data types contained are not all common sensitive data types,

[0135] Based on the parameter attribute distribution, determine whether the parameter attribute information of the first request message corresponding to the target response message is abnormal,

[0136] If the parameter attribute information of the first request message corresponding to the target response message is abnormal, it is determined that the target response message has the risk of excessive exposure of sensitive data

[0137] Specifically, the parameter attribute information includes first attribute information of the parameter name in at least one dimension and / or second attribute information of the parameter value in at least one dimension. The at least one dimension includes at least one of type, length, and character distribution.

[0138] By learning the parameter attribute information of all second request messages, a parameter attribute distribution can be obtained. If the parameter attribute information of the second request message does not completely conform to the parameter attribute distribution, it is determined that the parameter attribute information of the second request message is abnormal, that is, deviates from the parameter attribute distribution.

[0139] To ensure accuracy, each dimension corresponds to a parameter attribute distribution. The parameter attribute distribution can be a distribution that removes data with a low distribution in the overall parameter attribute distribution. If at least one dimension in the parameter attribute information of the first request message does not conform to the corresponding parameter attribute distribution, that is, if at least one dimension deviates, then the parameter attribute information of the first request message is determined to be abnormal.

[0140] If the first data volume of sensitive data contained in any first response message exceeds the data volume threshold, and the parameter attribute information of the first request message is abnormal, or the sensitive data types contained in the first response message do not all belong to common sensitive data types (that is, there are new sensitive data types), and the parameter attribute information of the first request message is abnormal, or the first data volume of sensitive data contained in the first response message exceeds the data volume threshold, and the sensitive data types contained in the first response message do not all belong to common sensitive data types, and the parameter attribute information of the first request message is abnormal, then it is determined that the first response message has a risk of excessive exposure of sensitive data.

[0141] In this embodiment, when the first data volume of sensitive data contained in the first response request exceeds the data volume threshold and / or the sensitive data types contained in the corresponding first response message do not all belong to common sensitive data types, it will continue to determine whether there is any abnormality in the parameter attribute information of the first request message, and accurately determine whether the first response request excessively exposes sensitive data through multiple evaluations, thereby reducing the possibility of misjudgment and improving the accuracy of the judgment.

[0142] In one embodiment, before step S220, the method further includes:

[0143] Obtain the request attribute information of the second request message corresponding to the second response message,

[0144] Learning the correspondence between the sensitive data contained in all second response messages and the request attribute information of the corresponding second request messages to obtain a correspondence distribution;

[0145] Obtain parameter attribute information of the second request message corresponding to the second response message,

[0146] Learning parameter attribute information of the second request messages corresponding to all second response messages to obtain a parameter attribute distribution;

[0147] Step S220 includes:

[0148] Obtaining request attribute information and parameter attribute information of the first request message corresponding to the target response message, wherein the target response message is a response message in the first response message, the first data volume exceeds the data volume threshold and / or the sensitive data types contained are not all common sensitive data types,

[0149] Based on the corresponding relationship distribution, determine whether the sensitive data included in the target response message corresponds to the request attribute information of the corresponding first request message,

[0150] Based on the parameter attribute distribution, determine whether the parameter attribute information of the first request message corresponding to the target response message is abnormal,

[0151] If the sensitive data contained in the target response message does not correspond to the request attribute information of the corresponding first request message and there is an abnormality in the parameter attribute information of the corresponding first request message, it is determined that the target response message has a risk of excessive exposure of sensitive data.

[0152] In one embodiment, before step S110 or S210, the method further includes:

[0153] Detect the traffic of each API interface in the system, obtain the response message of each API interface, and perform sensitive data detection on the response message;

[0154] The API interface corresponding to the response message containing sensitive data is determined as the target interface.

[0155] Specifically, a system corresponds to multiple API interfaces, and sensitive data detection is performed on the traffic of each API interface. If no sensitive data appears in the traffic of an API interface, the API interface is temporarily designated as a non-target interface. If sensitive data begins to appear in the traffic of an API interface, the API interface is designated as the target interface, and sensitive data detection is performed on the second response message of the target interface within a cycle.

[0156] This embodiment determines whether to focus on sensitive data detection and statistics for the target interface where sensitive data appears based on whether sensitive data begins to appear in the traffic. Statistics of the first data volume in the cycle can be temporarily not performed on non-target interfaces, reducing statistical and computational overhead.

[0157] In one embodiment, the sensitive data detection of any of the above items specifically includes:

[0158] Parse the response body of the response message, extract the fields carried in the response body as the fields to be detected, match the fields to be detected with the sensitive keywords preset in the sensitive vocabulary, and determine the fields to be detected that have matching sensitive keywords as sensitive fields;

[0159] And / or, parsing the response body of the response message, extracting the field values ​​of the fields carried in the response body, calling corresponding regular matching rules to perform regular matching on the field values ​​according to the data type of the field values, and determining the field values ​​that meet the corresponding regular matching rules as sensitive data values;

[0160] And / or, performing word segmentation processing on the response body of the response message to obtain multiple word segments, performing regular matching on the multiple word segments based on preset regular matching rules, and determining the word segments that meet any regular matching rule as sensitive word segments;

[0161] Response data containing at least one of a sensitive field, a sensitive data value, and a sensitive word in a response message is determined as sensitive data, wherein the response message is a first response message or a second response message.

[0162] Specifically, sensitive data refers to data that may cause serious harm to society or individuals after leakage, including personal privacy data such as name, ID number, address, telephone number, bank account number, email address, password, medical information, educational background, etc.; it also includes data that is not suitable for enterprises or social organizations to disclose, such as the company's operating conditions, the company's network structure, IP address list, etc., but not limited to these.

[0163] Therefore, whether a field in the response body is a sensitive field can be determined based on whether it contains sensitive keywords in the sensitive vocabulary. Whether a field value is a sensitive data value can be determined based on the field value and the corresponding regular expression matching rule. For example, mobile phone numbers, ID numbers, and email addresses can be determined using regular expression matching rules. The purpose of segmenting the response body is to find sensitive fields or sensitive data values ​​that cannot be found using the previous two methods. Furthermore, if a field is determined to be sensitive, its corresponding field value is also determined to be sensitive data value. These fields are counted together and only once when sensitive data types are counted. Even if a field cannot be determined to be sensitive, if its field value can be determined to be sensitive data value, it can still be counted as a sensitive data type. Even if a field is determined to be sensitive, if its field value cannot be determined to be sensitive data value or if the field value is empty, it can still be counted as a sensitive data type.

[0164] This embodiment identifies sensitive data by combining multiple methods, thereby reducing omissions of sensitive data and accurately identifying sensitive data.

[0165] This application learns and models the amount of sensitive data returned in the target interface response body, the type of sensitive data, and the relevant request information and attribute information of the request body, and calls different functions of the established model to effectively detect abnormally returned sensitive information. For response messages with excessive exposure of sensitive data, that is, the amount of sensitive data returned in the response direction deviates from the normal baseline, and / or uncommon data types appear, and / or the sensitive data does not correspond to the request attribute information, and / or the parameter attribute information contains abnormalities, abnormal alarms are issued, which can effectively detect abnormal traffic in the API interface and improve the API security detection and protection capabilities.

[0166] It should be understood that the size of the serial numbers of the steps in the above embodiments does not mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of this application.

[0167] Figure 3 This is a structural block diagram of a detection device for excessive exposure of sensitive data in one embodiment of the present application; Figure 3 , the device comprises:

[0168] The first data detection module 110 is configured to perform traffic detection on the target interface, perform sensitive data detection on each detected first response message to be detected, and obtain a first data volume of sensitive data contained in each first response message;

[0169] The first judgment module 120 is configured to determine that a target response message in the first response message, in which the first data volume exceeds a data volume threshold, has a risk of excessive exposure of sensitive data.

[0170] In one embodiment, the apparatus further comprises:

[0171] The first data detection module 110 is further configured to perform sensitive data detection on the second response messages detected within a period to obtain a second amount of sensitive data contained in each second response message, wherein the second response message is traffic corresponding to the target interface and generated before the first response message;

[0172] The first calculation module is configured to obtain a data volume threshold according to data distribution of a second data volume corresponding to all second response messages within a period.

[0173] In one embodiment, the apparatus further comprises:

[0174] The first information acquisition module is configured to acquire request attribute information of the second request message corresponding to the second response message.

[0175] A first distribution acquisition module is used to learn the correspondence between the sensitive data contained in all second response messages and the request attribute information of the corresponding second request messages to obtain a correspondence distribution;

[0176] The first judgment module 120 specifically includes:

[0177] The second information acquisition module is configured to acquire request attribute information of the first request message corresponding to the target response message, wherein the target response message is a response message in the first response message whose first data volume exceeds the data volume threshold,

[0178] A correspondence judgment module is used to determine whether the sensitive data contained in the target response message corresponds to the request attribute information of the corresponding first request message based on the correspondence distribution.

[0179] The first risk determination module is used to determine that the target response message has a risk of excessive exposure of sensitive data if there is no correspondence.

[0180] In one embodiment, the apparatus further comprises:

[0181] The third information acquisition module is used to obtain parameter attribute information of the second request message corresponding to the second response message,

[0182] A second distribution acquisition module is used to learn parameter attribute information of the second request messages corresponding to all second response messages to obtain parameter attribute distribution;

[0183] The first judgment module 120 specifically includes:

[0184] The fourth information acquisition module is used to obtain parameter attribute information of the first request message corresponding to the target response message, wherein the target response message is a response message in the first response message whose first data volume exceeds the data volume threshold,

[0185] The abnormality judgment module is used to determine whether the parameter attribute information of the first request message corresponding to the target response message is abnormal based on the parameter attribute distribution.

[0186] The second risk determination module is used to determine that the target response message has a risk of excessive exposure of sensitive data if there is an abnormality in the parameter attribute information of the first request message corresponding to the target response message.

[0187] Figure 4 This is a structural block diagram of a detection device for excessive exposure of sensitive data in another embodiment of the present application; Figure 4 , the device comprises:

[0188] The second data detection module 210 is configured to perform traffic detection on the target interface, perform sensitive data detection on each detected first response message to be detected, and obtain a first data volume of sensitive data and a type of sensitive data contained in each first response message;

[0189] The second judgment module 220 is used to determine, based on the first data volume and the type of sensitive data contained therein, whether a target response message in the first response message has a risk of excessive exposure of sensitive data, wherein the target response message is a response message in which the first data volume exceeds a data volume threshold and / or the type of sensitive data contained therein does not all belong to common sensitive data types.

[0190] In one embodiment, the apparatus further comprises:

[0191] The second data detection module 210 is further configured to perform sensitive data detection on the second response messages detected within a period to obtain a second data volume of sensitive data and a type of sensitive data contained in each second response message, wherein the second response message is the traffic corresponding to the target interface and generated before the first response message;

[0192] A second calculation module is used to obtain a data volume threshold according to a data distribution of a second data volume corresponding to all second response messages within a period;

[0193] The elimination module is used to count the sensitive data types contained in all second response messages, eliminate uncommon sensitive data types, and obtain common sensitive data types, wherein the uncommon sensitive data types are types whose frequency of occurrence in the statistics is lower than the first threshold.

[0194] In one embodiment, the apparatus further comprises:

[0195] The first information acquisition module is configured to acquire request attribute information of the second request message corresponding to the second response message.

[0196] A first distribution acquisition module is used to learn the correspondence between the sensitive data contained in all second response messages and the request attribute information of the corresponding second request messages to obtain a correspondence distribution;

[0197] The second judgment module 220 specifically includes:

[0198] The second information acquisition module is configured to obtain request attribute information of the first request message corresponding to the target response message, wherein the target response message is a response message in the first response message, the first data volume exceeds the data volume threshold and / or the sensitive data types contained are not all common sensitive data types,

[0199] A correspondence judgment module is used to determine whether the sensitive data contained in the target response message corresponds to the request attribute information of the corresponding first request message based on the correspondence distribution.

[0200] The first risk determination module is used to determine that the target response message has a risk of excessive exposure of sensitive data if there is no correspondence.

[0201] In one embodiment, the apparatus further comprises:

[0202] The third information acquisition module is used to obtain parameter attribute information of the second request message corresponding to the second response message,

[0203] A second distribution acquisition module is used to learn parameter attribute information of the second request messages corresponding to all second response messages to obtain parameter attribute distribution;

[0204] The second judgment module 220 specifically includes:

[0205] a fourth information acquisition module, configured to obtain parameter attribute information of the first request message corresponding to a target response message, wherein the target response message is a response message in the first response message, the first data volume exceeds the data volume threshold and / or the included sensitive data types do not all belong to common sensitive data types,

[0206] The abnormality judgment module is used to determine whether the parameter attribute information of the first request message corresponding to the target response message is abnormal based on the parameter attribute distribution.

[0207] The second risk determination module is used to determine that the target response message has a risk of excessive exposure of sensitive data if there is an abnormality in the parameter attribute information of the first request message corresponding to the target response message.

[0208] In one embodiment, the first data detection module 110 and the second data detection module 210 are further configured to detect the traffic of each API interface in the system, obtain the response message of each API interface, and perform sensitive data detection on the response message;

[0209] The device also includes: a target interface determination module, which is used to determine the API interface corresponding to the response message containing sensitive data as the target interface.

[0210] In one embodiment, the first data detection module 110 and the second data detection module 210 both specifically include:

[0211] A first detection module is configured to parse the response body of the response message, extract fields carried in the response body as fields to be detected, match the fields to be detected with sensitive keywords preset in the sensitive vocabulary, and determine the fields to be detected that contain matching sensitive keywords as sensitive fields;

[0212] and / or, a second detection module, configured to parse the response body of the response message, extract the field values ​​of the fields carried in the response body, perform regular expression matching on the field values ​​based on the data types of the field values ​​by calling corresponding regular expression matching rules, and determine the field values ​​that satisfy the corresponding regular expression matching rules as sensitive data values;

[0213] and / or, a third detection module, configured to perform word segmentation processing on the response body of the response message to obtain a plurality of word segments, perform regular expression matching on the plurality of word segments based on a preset regular expression matching rule, and determine a word segmentation satisfying any regular expression matching rule as a sensitive word segmentation;

[0214] A sensitive data determination module is used to determine response data containing at least one of a sensitive field, a sensitive data value and a sensitive word in a response message as sensitive data, wherein the response message is a first response message or a second response message.

[0215] The meaning of "first" and "second" in the above modules / units is only to distinguish different modules / units, and is not used to limit which module / unit has a higher priority or other limiting meanings. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions. For example, a process, method, system, product or device that includes a series of steps or modules is not necessarily limited to those steps or modules clearly listed, but may include other steps or modules that are not clearly listed or inherent to these processes, methods, products or devices. The division of modules in this application is merely a logical division, and other division methods may be used in actual applications.

[0216] For the specific definition of the detection device for excessive exposure of sensitive data, please refer to the definition of the detection method for excessive exposure of sensitive data above, which will not be repeated here. The various modules in the above-mentioned detection device for excessive exposure of sensitive data can be implemented in whole or in part by software, hardware and their combination. The above-mentioned modules can be embedded in or independent of the processor in the computer device in the form of hardware, or can be stored in the memory of the computer device in the form of software, so that the processor can call and execute the operations corresponding to the above modules.

[0217] Figure 5 This is a block diagram of the internal structure of a computer device in one embodiment of the present application. Figure 5 As shown, the computer device includes a processor, memory, a network interface, an input device, and a display screen connected via a system bus. The processor of the computer device is used to provide computing and control capabilities. The memory includes a storage medium and internal memory. The storage medium can be either non-volatile or volatile. The storage medium stores an operating system and may also store computer-readable instructions. When executed by the processor, the computer-readable instructions enable the processor to implement a method for detecting excessive exposure of sensitive data. The internal memory provides an environment for the operation of the operating system and computer-readable instructions in the storage medium. The internal memory may also store computer-readable instructions. When executed by the processor, the computer-readable instructions enable the processor to implement the method for detecting excessive exposure of sensitive data. The network interface of the computer device is used to communicate with an external server via a network connection. The display screen of the computer device can be a liquid crystal display or an electronic ink display. The input device of the computer device can be a touchscreen covering the display screen, buttons, a trackball, or a touchpad provided on the computer device housing, or an external keyboard, touchpad, or mouse.

[0218] In one embodiment, a computer device is provided, including a memory, a processor, and computer-readable instructions (e.g., a computer program) stored in the memory and executable on the processor. When the processor executes the computer-readable instructions, the steps of the method for detecting excessive exposure of sensitive data in the above embodiment are implemented, such as Figure 1 Steps S110 to S120 shown and other extensions of the method and related steps. Or, for example Figure 2 Alternatively, when the processor executes the computer-readable instructions, the functions of the modules / units of the sensitive data overexposure detection device in the above embodiment are realized, for example, Figure 3 The functions of the modules 110 to 120 shown, or, for example Figure 4 The functions of modules 210 to 220 are shown in FIG.

[0219] The processor can be a central processing unit (CPU), other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA), other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor can be a microprocessor or any conventional processor. The processor is the control center of the computer device and connects the various parts of the entire computer device using various interfaces and lines.

[0220] The memory can be used to store computer-readable instructions and / or modules. The processor implements various functions of the computer device by running or executing the computer-readable instructions and / or modules stored in the memory, and calling data stored in the memory. The memory can mainly include a program storage area and a data storage area. The program storage area can store an operating system and at least one application required for a function (such as a sound playback function, an image playback function, etc.); the data storage area can store data created based on the use of the mobile phone (such as audio data, video data, etc.).

[0221] The memory may be integrated into the processor or provided separately from the processor.

[0222] Those skilled in the art will understand that Figure 5 The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than shown in the figure, or combine certain components, or have a different component arrangement.

[0223] In one embodiment, a computer-readable storage medium is provided on which computer-readable instructions are stored. When the computer-readable instructions are executed by a processor, the steps of the method for detecting excessive exposure of sensitive data in the above embodiment are implemented, such as Figure 1 The steps S110 to S120 shown and other extensions of the method and related steps are extended, or, for example Figure 2 The steps S210 to S220 shown and other extensions of the method and related steps, or the computer-readable instructions, when executed by a processor, implement the functions of the modules / units of the sensitive data overexposure detection device in the above embodiment, for example Figure 3The functions of the modules 110 to 120 shown, or, for example Figure 4 The functions of modules 210 to 220 are shown in FIG.

[0224] Those skilled in the art will appreciate that all or part of the processes in the above-mentioned embodiment methods can be implemented by instructing the relevant hardware to perform the processes through computer-readable instructions. The computer-readable instructions can be stored in a computer-readable storage medium. When the computer-readable instructions are executed, they can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to memory, storage, database or other media used in the embodiments provided in this application can include non-volatile and / or volatile memory. Non-volatile memory can include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM) or flash memory. Volatile memory can include random access memory (RAM) or external cache memory. By way of illustration and not limitation, RAM is available in various forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), synchronous link (Synchlink) DRAM (SLDRAM), memory bus (Rambus) direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM).

[0225] It should be noted that, in this document, the terms "comprises," "includes," or any other variations thereof are intended to encompass non-exclusive inclusion, such that a process, apparatus, article, or method comprising a series of elements includes not only those elements but also other elements not explicitly listed, or elements inherent to such process, apparatus, article, or method. In the absence of further limitations, an element defined by the phrase "comprising a ..." does not exclude the presence of other identical elements in the process, apparatus, article, or method comprising the element.

[0226] The serial numbers of the embodiments of the present application are for description only and do not represent the advantages and disadvantages of the embodiments. Through the description of the above implementation modes, those skilled in the art can clearly understand that the above-mentioned embodiment methods can be implemented by means of software plus a necessary general hardware platform. Of course, they can also be implemented by hardware, but in many cases the former is a better implementation method. Based on such an understanding, the technical solution of the present application is essentially or the part that contributes to the prior art can be embodied in the form of a software product, which is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk) as described above, including a number of instructions to enable a terminal device (which can be a mobile phone, computer, server, or network device, etc.) to execute the methods described in each embodiment of the present application.

[0227] The above are only preferred embodiments of the present application and do not limit the patent scope of the present application. Any equivalent structure or equivalent process transformation made using the contents of the present application specification and drawings, or directly or indirectly applied in other related technical fields, are also included in the patent protection scope of the present application.

Claims

1. A method for detecting excessive exposure of sensitive data, characterized in that: The method comprises: Performing traffic detection on the target interface, performing sensitive data detection on each detected first response message to be detected, and obtaining a first data volume of sensitive data contained in each first response message; Obtaining request attribute information of a first request message corresponding to a target response message, wherein the target response message is a response message in the first response message whose first data volume exceeds a data volume threshold; Determining, based on a correspondence distribution, whether the sensitive data included in the target response message corresponds to the request attribute information of the corresponding first request message, wherein the correspondence distribution is obtained by learning the correspondence between the sensitive data included in all second response messages and the request attribute information of the corresponding second request messages, where the second response message is traffic corresponding to the target interface and generated before the first response message; If not, it is determined that the target response message has a risk of excessive exposure of sensitive data.

2. The method according to claim 1, characterized in that Before performing traffic detection on the target interface, the method further includes: Performing sensitive data detection on the second response messages detected within a period to obtain a second data volume of sensitive data contained in each second response message; The data volume threshold is obtained according to data distribution of the second data volume corresponding to all second response messages within a period.

3. The method according to claim 2, characterized in that The method further comprises: Obtaining request attribute information of the second request message corresponding to the second response message, The correspondence between the sensitive data included in all second response messages and the request attribute information of the corresponding second request messages is learned to obtain a correspondence distribution.

4. The method according to claim 2, characterized in that The method further comprises: Obtain parameter attribute information of the second request message corresponding to the second response message, Learning parameter attribute information of the second request messages corresponding to all second response messages to obtain a parameter attribute distribution; Obtain parameter attribute information of the first request message corresponding to the target response message; Based on the parameter attribute distribution, determining whether there is an abnormality in the parameter attribute information of the first request message corresponding to the target response message; If there is an abnormality in the parameter attribute information of the first request message corresponding to the target response message, it is determined that there is a risk of excessive exposure of sensitive data in the target response message.

5. The method according to claim 2, characterized in that Before performing sensitive data detection on the second response message detected within a cycle, the method further includes: Detect the traffic of each API interface in the system, obtain the response message of each API interface, and perform sensitive data detection on the response message; The API interface corresponding to the response message containing sensitive data is determined as the target interface.

6. The method according to any one of claims 1 to 4, characterized in that: Sensitive data detection specifically includes: Parse the response body of the response message, extract the fields carried in the response body as the fields to be detected, match the fields to be detected with the sensitive keywords preset in the sensitive word library, and determine the fields to be detected with matching sensitive keywords as sensitive fields; and / or, parsing the response body of the response message, extracting the field values ​​of the fields carried in the response body, performing regular expression matching on the field values ​​based on the data types of the field values ​​by calling corresponding regular expression matching rules, and determining the field values ​​that satisfy the corresponding regular expression matching rules as sensitive data values; And / or, performing word segmentation processing on the response body of the response message to obtain multiple word segments, performing regular matching on the multiple word segments based on preset regular matching rules, and determining the word segments that meet any regular matching rule as sensitive word segments; Response data containing at least one of a sensitive field, a sensitive data value, and a sensitive word in a response message is determined as sensitive data, wherein the response message is the first response message or the second response message.

7. A method for detecting excessive exposure of sensitive data, characterized in that: The method comprises: Performing traffic detection on the target interface, performing sensitive data detection on each detected first response message to be detected, and obtaining a first data volume of sensitive data contained in each first response message and a type of sensitive data contained therein; Obtaining request attribute information of a first request message corresponding to a target response message, wherein the target response message is a response message in the first response message, in which the first data volume exceeds the data volume threshold and / or the included sensitive data types do not all belong to common sensitive data types; Determining, based on a correspondence distribution, whether the sensitive data included in the target response message corresponds to the request attribute information of the corresponding first request message, wherein the correspondence distribution is obtained by learning the correspondence between the sensitive data included in all second response messages and the request attribute information of the corresponding second request messages, where the second response message is traffic corresponding to the target interface and generated before the first response message; If not, it is determined that the target response message has a risk of excessive exposure of sensitive data.

8. The method according to claim 7, characterized in that The method further comprises: Performing sensitive data detection on the second response messages detected within a cycle to obtain a second data volume of sensitive data contained in each second response message and a type of sensitive data contained therein; Obtaining a data volume threshold according to data distribution of the second data volume corresponding to all second response messages within a period; Statistics are performed on the sensitive data types contained in all second response messages, and uncommon sensitive data types are eliminated to obtain common sensitive data types, wherein the uncommon sensitive data types are types whose frequency of appearance in the statistics is lower than a first threshold.

9. The method according to claim 8, characterized in that The method further comprises: Obtaining request attribute information of the second request message corresponding to the second response message; The correspondence between the sensitive data included in all second response messages and the request attribute information of the corresponding second request messages is learned to obtain a correspondence distribution.

10. The method according to claim 8, characterized in that The method further comprises: Obtain parameter attribute information of the second request message corresponding to the second response message, Learning parameter attribute information of the second request messages corresponding to all second response messages to obtain a parameter attribute distribution; Obtain parameter attribute information of the first request message corresponding to the target response message; Based on the parameter attribute distribution, determining whether there is an abnormality in the parameter attribute information of the first request message corresponding to the target response message; If there is an abnormality in the parameter attribute information of the first request message corresponding to the target response message, it is determined that there is a risk of excessive exposure of sensitive data in the target response message.

11. The method according to claim 8, characterized in that Before performing sensitive data detection on the second response message detected within a cycle, the method further includes: Detect the traffic of each API interface in the system, obtain the response message of each API interface, and perform sensitive data detection on the response message; The API interface corresponding to the response message containing sensitive data is determined as the target interface.

12. The method according to any one of claims 7 to 10, characterized in that: Sensitive data detection specifically includes: Parse the response body of the response message, extract the fields carried in the response body as the fields to be detected, match the fields to be detected with the sensitive keywords preset in the sensitive word library, and determine the fields to be detected with matching sensitive keywords as sensitive fields; and / or, parsing the response body of the response message, extracting the field values ​​of the fields carried in the response body, performing regular expression matching on the field values ​​based on the data types of the field values ​​by calling corresponding regular expression matching rules, and determining the field values ​​that satisfy the corresponding regular expression matching rules as sensitive data values; And / or, performing word segmentation processing on the response body of the response message to obtain multiple word segments, performing regular matching on the multiple word segments based on preset regular matching rules, and determining the word segments that meet any regular matching rule as sensitive word segments; Response data containing at least one of a sensitive field, a sensitive data value, and a sensitive word in a response message is determined as sensitive data, wherein the response message is the first response message or the second response message.

13. A device for detecting excessive exposure of sensitive data, characterized in that: The device comprises: a first data detection module, configured to perform traffic detection on a target interface, perform sensitive data detection on each detected first response message to be detected, and obtain a first data volume of sensitive data contained in each first response message; A second information acquisition module is configured to acquire request attribute information of a first request message corresponding to a target response message, wherein the target response message is a response message in the first response message whose first data volume exceeds a data volume threshold; a correspondence determination module, configured to determine, based on a correspondence distribution, whether the sensitive data included in the target response message corresponds to the request attribute information of the corresponding first request message, wherein the correspondence distribution is obtained by learning the correspondence between the sensitive data included in all second response messages and the request attribute information of the corresponding second request messages, where the second response message is the traffic corresponding to the target interface and generated before the first response message; The first risk determination module is used to determine that the target response message has a risk of excessive exposure of sensitive data if there is no correspondence.

14. A device for detecting excessive exposure of sensitive data, characterized in that: The device comprises: a second data detection module, configured to perform traffic detection on the target interface, perform sensitive data detection on each detected first response message to be detected, and obtain a first data volume of sensitive data and a type of sensitive data contained in each first response message; a second information acquisition module, configured to obtain request attribute information of the first request message corresponding to a target response message, wherein the target response message is a response message in the first response message, the first data volume of which exceeds a data volume threshold and / or the sensitive data types included do not all belong to common sensitive data types; a correspondence determination module, configured to determine, based on a correspondence distribution, whether the sensitive data included in the target response message corresponds to the request attribute information of the corresponding first request message, wherein the correspondence distribution is obtained by learning the correspondence between the sensitive data included in all second response messages and the request attribute information of the corresponding second request messages, where the second response message is the traffic corresponding to the target interface and generated before the first response message; The first risk determination module is used to determine that the target response message has a risk of excessive exposure of sensitive data if there is no correspondence.

15. A computer device comprising a memory, a processor, and computer-readable instructions stored in the memory and executable on the processor, wherein: When the processor executes the computer-readable instructions, it performs the steps of the method for detecting excessive exposure of sensitive data as described in any one of claims 1-4, 5-6, or when the processor executes the computer-readable instructions, it performs the steps of the method for detecting excessive exposure of sensitive data as described in any one of claims 7-10, 11-12.

16. A computer-readable storage medium having computer-readable instructions stored thereon, characterized in that: When the computer-readable instructions are executed by a processor, the processor executes the steps of the method for detecting excessive exposure of sensitive data as described in any one of claims 1-4, 5-6, or the processor executes the steps of the method for detecting excessive exposure of sensitive data as described in any one of claims 7-10, 11-12.

Images