Sensitive information leakage detection method, device, equipment and medium based on full flow

Abstract

The present invention relates to a full-flow-based sensitive information leakage detection method, apparatus, device, and medium. The method comprises: obtaining the request direction of a data flow to be detected, and determining a message to be detected based on the request direction; detecting sensitive information in the message to be detected based on preset detection rules, and obtaining a detection result; judging the detection result based on preset judgment rules to determine whether sensitive information leakage occurs in the message to be detected; if sensitive information leakage occurs in the message to be detected, generating an alarm log based on the detection result. The present invention can accurately identify whether sensitive information has been leaked.

Description

Technical Field

[0001] The present invention relates to the field of data security detection technology, and in particular to a sensitive information leakage detection method, device, equipment and medium based on full flow. Background Art

[0002] With the development of Internet technology, accessing and storing user information on the Internet has become a common practice. For example, when a user browses a web page, the client makes requests to the server and receives the server's response. Due to improper handling, sensitive information involving user privacy or that needs to be kept confidential can easily be leaked.

[0003] In current network communication equipment, there are many ways to analyze network traffic, but there are few effective methods to analyze network data based on the full traffic dimension and combine it with actual scenarios to determine whether there is any sensitive information leakage.

[0004] Therefore, how to combine full-flow data analysis with actual security scenarios to more accurately identify whether sensitive information has been leaked is an urgent problem to be solved. Summary of the Invention

[0005] In view of this, it is necessary to provide a sensitive information leakage detection method, device, electronic device and storage medium based on full-flow sensitive information leakage detection method, device, equipment and medium, so as to solve the problem of more accurate identification of sensitive information leakage under full-flow data analysis and combined with actual security scenarios.

[0006] To achieve the above objectives, in a first aspect, the present invention provides a sensitive information leakage detection method based on full flow, comprising:

[0007] Obtaining a request direction of a data flow to be detected, and determining a message to be detected based on the request direction;

[0008] Detecting sensitive information in the message to be detected based on preset detection rules and obtaining a detection result;

[0009] Determine the detection result based on preset judgment rules to determine whether sensitive information leakage occurs in the message to be detected;

[0010] If sensitive information is leaked in the message to be detected, an alarm log is generated based on the detection result.

[0011] Further, the obtaining of the request direction of the data flow to be detected and determining the message to be detected based on the request direction includes:

[0012] If the request direction of the data flow to be detected is from the intranet to the extranet, the message to be detected includes a request message;

[0013] If the request direction of the data flow to be detected is from the external network to the internal network, the message to be detected includes a return message.

[0014] Furthermore, before detecting sensitive information of the message to be detected based on a preset detection rule, the method further includes:

[0015] Parsing the message to be detected into file and text information;

[0016] The detecting of sensitive information on the message to be detected based on a preset detection rule includes:

[0017] Based on the preset detection rules, the file is first detected for sensitive information, and then the text information is detected for sensitive information.

[0018] Furthermore, the sensitive information in the message to be detected includes sensitive content and sensitive words corresponding to the sensitive content.

[0019] Furthermore, the detecting of sensitive information of the message to be detected based on a preset detection rule includes:

[0020] Detecting the sensitive content in the message to be detected using a regular expression, and counting the first frequency of occurrence of each sensitive content;

[0021] The sensitive words in the message to be detected are detected using keywords, and the second frequency of occurrence of each sensitive word is counted.

[0022] Furthermore, the determination of the detection result based on a preset determination rule to determine whether sensitive information leakage occurs includes:

[0023] If the first frequency of occurrence of a certain sensitive content is not less than the single threshold corresponding to the sensitive content, the message to be detected has leaked sensitive information;

[0024] If the first frequency of a certain sensitive content is not zero and is less than the single item threshold corresponding to the sensitive content, and the second frequency of the sensitive word corresponding to the sensitive content is not zero, the message to be detected has leaked sensitive information;

[0025] If the first frequency of occurrence of each sensitive content is less than the single threshold corresponding to the sensitive content, but the sum of the first frequency of occurrence of each sensitive content is not less than the total threshold, sensitive information leakage occurs in the message to be detected.

[0026] Furthermore, generating an alarm log based on the detection result includes:

[0027] Displaying sensitive information leakage details in the alarm log, the sensitive information leakage details including the first frequency of occurrence of each sensitive content and the second frequency of occurrence of each sensitive word;

[0028] The sensitive content and sensitive words in the message to be detected are marked and displayed in the alarm log.

[0029] In a second aspect, the present invention further provides a sensitive information leakage detection device based on full flow, comprising:

[0030] A data flow acquisition module, configured to acquire a request direction of a data flow to be detected and determine a message to be detected based on the request direction;

[0031] A sensitive information detection module is used to detect sensitive information in the message to be detected based on preset detection rules and obtain a detection result;

[0032] A sensitive information determination module is used to determine the detection result based on preset determination rules to determine whether sensitive information leakage occurs in the message to be detected;

[0033] The alarm log generation module is used to generate an alarm log based on the detection result if sensitive information leakage occurs in the message to be detected.

[0034] In a third aspect, the present invention also provides an electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, the steps in the above-mentioned full-flow-based sensitive information leakage detection method are implemented.

[0035] In a fourth aspect, the present invention further provides a computer storage medium, wherein the computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps in the sensitive information leakage detection method based on full flow are implemented.

[0036] The beneficial effects of adopting the above embodiment are:

[0037] The present invention can detect traffic in a specified scenario, that is, traffic in a specified request direction, in the context of full traffic, making the detection more targeted and avoiding the detection of most invalid data flows; and for the message to be detected, sensitive information is detected based on preset detection rules, and then the detection result is judged based on preset judgment rules, that is, a comprehensive judgment is made based on multiple dimensions whether sensitive information leakage occurs, so as to accurately identify the leakage of sensitive information; finally, an alarm log is generated based on the detection result, so that the generated alarm information is more readable. BRIEF DESCRIPTION OF THE DRAWINGS

[0038] Figure 1A flowchart of an embodiment of a sensitive information leakage detection method based on full flow provided by the present invention;

[0039] Figure 2 A schematic structural diagram of an embodiment of a sensitive information leakage detection device based on full flow provided by the present invention;

[0040] Figure 3 This is a structural diagram of an embodiment of an electronic device provided by the present invention. DETAILED DESCRIPTION

[0041] The preferred embodiments of the present invention will be described in detail below in conjunction with the accompanying drawings, wherein the accompanying drawings constitute a part of this application and are used together with the embodiments of the present invention to illustrate the principles of the present invention, and are not used to limit the scope of the present invention.

[0042] In the description of the present invention, the terms "first" and "second" are used for descriptive purposes only and are not to be understood as indicating or implying relative importance or implicitly indicating the number of technical features indicated. Thus, features defined as "first" and "second" may explicitly or implicitly include at least one of such features. In addition, "multiple" means two or more, unless otherwise clearly and specifically defined. Reference to "embodiments" in this document means that the specific features, structures or characteristics described in conjunction with the embodiments may be included in at least one embodiment of the present invention. The appearance of this phrase in various places in the specification does not necessarily refer to the same embodiment, nor is it an independent or alternative embodiment that is mutually exclusive with other embodiments. It is explicitly and implicitly understood by those skilled in the art that the embodiments described herein may be combined with other embodiments.

[0043] The present invention provides a full-flow-based sensitive information leakage detection method, device, equipment, and medium. Based on full-flow data analysis and combined with actual security scenarios, it can more accurately identify whether there is a security issue of sensitive information leakage.

[0044] The specific embodiments are described in detail below:

[0045] See also Figure 1 , Figure 1 This is a flow chart of an embodiment of a sensitive information leakage detection method based on full flow provided by the present invention. A specific embodiment of the present invention discloses a sensitive information leakage detection method based on full flow, including:

[0046] Step S101: obtaining a request direction of a data flow to be detected, and determining a message to be detected based on the request direction;

[0047] Step S102: Detect sensitive information on the message to be detected based on preset detection rules and obtain a detection result;

[0048] Step S103: judging the detection result based on preset judgment rules to determine whether sensitive information leakage occurs in the message to be detected;

[0049] Step S104: If sensitive information leakage occurs in the message to be detected, an alarm log is generated based on the detection result.

[0050] It's understandable that data leakage typically occurs with traffic from an external network to an internal network, or from an internal network to an external network. However, data leakage doesn't occur with traffic from an internal network to an internal network, or from an external network to an external network. Therefore, it's possible to first determine the packets to be tested based on the request direction of the data flow being tested, and then perform testing on those packets to reduce the waste of testing resources.

[0051] The present invention can detect traffic in a specified scenario, that is, traffic in a specified request direction, in the context of full traffic, making the detection more targeted and avoiding the detection of most invalid data flows; and for the message to be detected, sensitive information is detected based on preset detection rules, and then the detection result is judged based on preset judgment rules, that is, a comprehensive judgment is made based on multiple dimensions whether sensitive information leakage occurs, so as to accurately identify the leakage of sensitive information; finally, an alarm log is generated based on the detection result, so that the generated alarm information is more readable.

[0052] In one embodiment of the present invention, obtaining a request direction of a data flow to be detected and determining a message to be detected based on the request direction includes:

[0053] If the request direction of the data flow to be detected is from the intranet to the extranet, the message to be detected includes the request message;

[0054] If the request direction of the data flow to be detected is from the external network to the internal network, the message to be detected includes a return message.

[0055] It is understandable that in terms of the scenario-based detection of data flows, data leakage will only occur in request messages with a request direction from the intranet to the extranet, and in return messages with a request direction from the extranet to the intranet. Therefore, the message to be detected can be determined based on the request direction of the data to be detected. Specifically, the request direction of the data to be detected can be determined based on the source IP and destination IP of the data to be detected. If the request direction of the data flow to be detected is from the intranet to the extranet, the message to be detected is a request message; if the request direction of the data flow to be detected is from the extranet to the intranet, the message to be detected is a return message. By determining the request direction of the data flow, a large part of the traffic can be skipped, which greatly reduces the detection load and allows for more targeted detection of valid data flows, i.e., messages to be detected.

[0056] In one embodiment of the present invention, before detecting sensitive information on the message to be detected based on the preset detection rules, the method further includes:

[0057] Parse the message to be detected into file and text information;

[0058] Detect sensitive information in the packets to be detected based on preset detection rules, including:

[0059] Based on the preset detection rules, the file is first detected for sensitive information, and then the text information is detected for sensitive information.

[0060] It is understandable that before detecting sensitive information in the message to be detected, the message to be detected can be parsed, and then the parsed files can be detected separately. By detecting from different dimensions, the accuracy of the detection can be further improved.

[0061] Specifically, in terms of the data object to be detected, the message to be detected can be parsed into files and text information, wherein the files include the file name and file content of the attachment file, and the text information can be the text information of the email.

[0062] It should be noted that the sensitive information detected is divided into built-in detection information and custom detection information. Among them, the built-in sensitive information includes ID card number, email address, bank card number, mobile phone number, etc. The custom sensitive information can be configured into the detection information according to needs.

[0063] In one embodiment of the present invention, the sensitive information in the message to be detected includes sensitive content and sensitive words corresponding to the sensitive content.

[0064] Detect sensitive information in the packets to be inspected based on preset detection rules, including:

[0065] Use regular expressions to detect sensitive content in the message to be detected, and count the first frequency of each sensitive content;

[0066] The sensitive words in the message to be detected are detected using keywords, and the second frequency of each sensitive word is counted.

[0067] It can be understood that in terms of the detection dimension, the sensitive information objects are divided into two dimensions for data monitoring and analysis: that is, for the sensitive information content, the corresponding regular expressions are used for matching, and for the keywords corresponding to the sensitive information, keyword matching is performed. For example, the keywords corresponding to the mobile phone number are "mobile phone number", "tel", and "phone number". By separately counting the frequencies and occurrences of the data in the two dimensions, that is, counting the first frequency of each sensitive content occurrence and the second frequency of each sensitive word occurrence, a comprehensive judgment is made on whether there is a leakage of sensitive information, improving the accuracy of sensitive detection.

[0068] In an embodiment of the present invention, based on a preset determination rule, the detection result is determined to judge whether there is a leakage of sensitive information, including:

[0069] If the first frequency of a certain sensitive content occurrence is not less than the single threshold corresponding to the sensitive content, the待检测报文 (to-be-detected message) has a leakage of sensitive information;

[0070] If the first frequency of a certain sensitive content occurrence is not zero and less than the single threshold corresponding to the sensitive content, and the second frequency of the sensitive word corresponding to the sensitive content is not zero, the待检测报文 (to-be-detected message) has a leakage of sensitive information;

[0071] If the first frequency of each sensitive content occurrence is less than the single threshold corresponding to the sensitive content, but the sum of the first frequencies of each sensitive content occurrence is not less than the total threshold, the待检测报文 (to-be-detected message) has a leakage of sensitive information.

[0072] It can be understood that in the process of determining whether there is a leakage of sensitive information, the occurrence times of sensitive content and the occurrence times of sensitive words can be comprehensively considered to determine whether there is a leakage of sensitive information.

[0073] Specifically, if the first frequency of a certain sensitive content occurrence is not zero and less than the single threshold corresponding to the sensitive content, and the second frequency of the sensitive word corresponding to the sensitive content is not zero, the待检测报文 (to-be-detected message) has a leakage of sensitive information. Among them, the default single threshold corresponding to each sensitive content is 10 times, and the threshold can also be changed through cross-sectional configuration to adjust the detection intensity.

[0074] If the first frequency of a certain sensitive content occurrence is not zero and less than the single threshold corresponding to the sensitive content, and the second frequency of the sensitive word corresponding to the sensitive content is not zero, the待检测报文 (to-be-detected message) has a leakage of sensitive information. For example, if the mobile phone number "1312099****" appears three times and the sensitive word "mobile phone number" appears at least once, the待检测报文 (to-be-detected message) has a leakage of sensitive information.

[0075] If the first occurrence frequency of each sensitive content item is less than the corresponding individual threshold, but the sum of the first occurrence frequencies of each sensitive content item is greater than the total threshold, the message to be detected has leaked sensitive information. This means that if no individual sensitive information item has reached the individual occurrence threshold, but the total number of sensitive information items detected has reached the total occurrence threshold, the message to be detected has leaked sensitive information. The total threshold is set to 10 times by default, but can be changed through section configuration to adjust the detection intensity.

[0076] In one embodiment of the present invention, generating an alarm log based on the detection result includes:

[0077] Display sensitive information leakage details in the alarm log, including the first frequency of each sensitive content and the second frequency of each sensitive word;

[0078] Mark sensitive content and sensitive words in the message to be detected and display them in the alarm log.

[0079] It's important to note that when a sensitive information leak is confirmed, data analysis is performed on the monitored file, first analyzing attachments and then the body of the message. Typically, only one alert log is generated for each message being detected. Understandably, since sensitive information detection is threat detection, a single log is sufficient to indicate a data leak. Once an alert log is generated, further data flow inspection is discontinued, significantly improving detection efficiency.

[0080] The alert log displays the criteria for sensitive information, such as which rules were matched and how many times they occurred, and which sensitive information was matched and how many times it occurred. Furthermore, the parsed original message is displayed on the original message information display interface, with sensitive information highlighted in red. This visually demonstrates leaked sensitive information and increases the readability of the alert log.

[0081] In order to understand the present invention more clearly, take the actual scenario that a user wants to monitor whether there is a mobile phone number information leaked from the intranet to the external network as an example. Uploading data from the intranet to the external network, or requesting the intranet to download data from the external network, will result in data leakage.

[0082] First, you need to configure the policy. In the built-in rule detection interface, click the Mobile Number option. This rule is the default built-in rule. You can also add a custom rule in the Custom Rule Detection interface. Name: Mobile Number, Regular Expression: (13[0-9]|14[01456879]|15[0-35-9]|16

[2567] |17[0-8]|18[0-9]|19[0-35-9])\d{8}, Enable: On, Sensitive Word List: ["Mobile Number", "Phone Number"], Single Detection Threshold: 10 (default, editable). If you create multiple rules, you also need to set the total detection threshold.

[0083] After the data flow enters the detection process, a CT session will be established based on the five-tuple, namely source IP, destination IP, source port, destination port and application layer protocol. Then, the direction of the data flow will be determined according to the source IP and destination IP of the request message. If the request direction is from the intranet to the external network, only the request message needs to be detected. If it is from the external network to the intranet, only the return message needs to be detected, which greatly improves the detection efficiency.

[0084] After the data stream enters the message parsing process, the attached files are restored and the body information is parsed into the msgbody data structure. The file, including the file name and content, can be checked first, followed by the body information. Specifically, the Hy.perscan technology can be used to match sensitive information content and sensitive words, and count the frequency of occurrence of these two dimensions.

[0085] The detected results are then determined to indicate a data leak based on pre-set criteria. Specifically, if the number of times a mobile phone number appears is greater than or equal to the single detection threshold (preset to 10), a data leak is identified. If the number of times a mobile phone number appears is greater than or equal to 1 but less than the single detection threshold (preset to 10), but the sensitive word "mobile phone number" or "phonenumber" appears at least once, a data leak is identified. Furthermore, if there are multiple rules, a total occurrence of sensitive information greater than or equal to the total detection threshold also constitutes a sensitive information leak.

[0086] Finally, once the threat determination criteria are met, a log is immediately generated and a log generation mark is added to the CT session, eliminating the need to inspect subsequent data flows, thus saving detection resources. This is because once a log is generated, the session has already been determined to have leaked sensitive information.

[0087] In order to better implement the sensitive information leakage detection method based on full flow in the embodiment of the present invention, on the basis of the sensitive information leakage detection method based on full flow, correspondingly, please refer to Figure 2 , Figure 2This is a schematic diagram of the structure of an embodiment of a sensitive information leakage detection device based on full flow provided by the present invention. This embodiment of the present invention provides a sensitive information leakage detection device 200 based on full flow, including:

[0088] The data flow acquisition module 201 is used to obtain the request direction of the data flow to be detected and determine the message to be detected based on the request direction;

[0089] Sensitive information detection module 202, configured to detect sensitive information in the message to be detected based on preset detection rules and obtain a detection result;

[0090] The sensitive information determination module 203 is configured to determine the detection result based on a preset determination rule to determine whether sensitive information leakage occurs in the message to be detected;

[0091] The alarm log generating module 204 is configured to generate an alarm log based on the detection result if sensitive information leakage occurs in the message to be detected.

[0092] It should be noted here that the device 200 provided in the above embodiment can implement the technical solutions described in the above method embodiments. The specific implementation principles of the above modules or units can be found in the corresponding contents in the above method embodiments, which will not be repeated here.

[0093] Based on the above-mentioned sensitive information leakage detection method based on full flow, an embodiment of the present invention also provides an electronic device, including: a processor and a memory, and a computer program stored in the memory and executable on the processor; when the processor executes the computer program, it implements the steps in the sensitive information leakage detection method based on full flow as in the above-mentioned embodiments.

[0094] Figure 3 3 shows a schematic diagram of the structure of an electronic device 300 suitable for implementing an embodiment of the present invention. The electronic devices in the embodiments of the present invention may include, but are not limited to, mobile terminals such as mobile phones, laptop computers, digital broadcast receivers, PDAs (personal digital assistants), PADs (tablet computers), PMPs (portable multimedia players), in-vehicle terminals (e.g., in-vehicle navigation terminals), and fixed terminals such as digital TVs and desktop computers. Figure 3 The electronic device shown is only an example and should not limit the functions and scope of use of the embodiments of the present invention.

[0095] The electronic device includes: a memory and a processor, wherein the processor here may be referred to as the processing device 301 below, and the memory may include at least one of the read-only memory (ROM) 302, the random access memory (RAM) 303, and the storage device 308 below, as shown below:

[0096] like Figure 3 As shown, the electronic device 300 may include a processing device (e.g., a central processing unit, a graphics processing unit, etc.) 301, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 302 or a program loaded from a storage device 308 into a random access memory (RAM) 303. Various programs and data required for the operation of the electronic device 300 are also stored in the RAM 303. The processing device 301, the ROM 302, and the RAM 303 are connected to each other via a bus 304. An input / output (I / O) interface 305 is also connected to the bus 304.

[0097] Typically, the following devices may be connected to the I / O interface 305: an input device 306 including, for example, a touch screen, a touchpad, a keyboard, a mouse, a camera, a microphone, an accelerometer, a gyroscope, etc.; an output device 307 including, for example, a liquid crystal display (LCD), a speaker, a vibrator, etc.; a storage device 308 including, for example, a magnetic tape, a hard disk, etc.; and a communication device 309. The communication device 309 may allow the electronic device 300 to communicate with other devices wirelessly or by wire to exchange data. Figure 3 The electronic device 300 is shown with various devices, but it should be understood that it is not required to implement or possess all of the devices shown. More or fewer devices may be implemented or possessed instead.

[0098] In particular, according to an embodiment of the present invention, the process described above with reference to the flowchart can be implemented as a computer software program. For example, an embodiment of the present invention includes a computer program product comprising a computer program carried on a non-transitory computer-readable medium, the computer program comprising program code for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from a network via the communication device 309, or installed from the storage device 308, or installed from the ROM 302. When the computer program is executed by the processing device 301, the above-mentioned functions defined in the method of the embodiment of the present invention are performed.

[0099] Based on the above-mentioned sensitive information leakage detection method based on full flow, an embodiment of the present invention also provides a computer-readable storage medium, which stores one or more programs, and the one or more programs can be executed by one or more processors to implement the steps in the sensitive information leakage detection method based on full flow in the above-mentioned embodiments.

[0100] Those skilled in the art will appreciate that all or part of the process steps of the above-described embodiments can be implemented by instructing related hardware through a computer program, and the program can be stored in a computer-readable storage medium, such as a magnetic disk, an optical disk, a read-only memory, or a random access memory.

[0101] The above description is only a preferred specific embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any changes or substitutions that can be easily thought of by any technician familiar with this technical field within the technical scope disclosed by the present invention should be covered by the scope of protection of the present invention.

Claims

1. A sensitive information leakage detection method based on full flow, characterized in that: include: Obtaining a request direction of a data stream to be detected, and determining a message to be detected based on the request direction, wherein the sensitive information in the message to be detected includes sensitive content and sensitive words corresponding to the sensitive content; Detecting the sensitive content in the message to be detected using a regular expression, and counting the first frequency of occurrence of each sensitive content; Using keywords to detect sensitive words in the message to be detected, and counting the second frequency of each sensitive word; If the first frequency of occurrence of a certain sensitive content is not less than the single threshold corresponding to the sensitive content, the message to be detected has leaked sensitive information; If the first frequency of a certain sensitive content is not zero and is less than the single item threshold corresponding to the sensitive content, and the second frequency of the sensitive word corresponding to the sensitive content is not zero, the message to be detected has leaked sensitive information; If the first frequency of occurrence of each sensitive content is less than the single threshold corresponding to the sensitive content, but the sum of the first frequency of occurrence of each sensitive content is not less than the total threshold, the message to be detected has leaked sensitive information; If sensitive information is leaked in the message to be detected, an alarm log is generated based on the detection result.

2. The sensitive information leakage detection method based on full flow according to claim 1 is characterized in that: The obtaining of the request direction of the data flow to be detected and determining the message to be detected based on the request direction includes: If the request direction of the data flow to be detected is from the intranet to the extranet, the message to be detected includes a request message; If the request direction of the data flow to be detected is from the external network to the internal network, the message to be detected includes a return message.

3. The sensitive information leakage detection method based on full flow according to claim 1 is characterized in that: Before detecting sensitive information of the message to be detected based on a preset detection rule, the method further includes: Parsing the message to be detected into file and text information; The detecting of sensitive information on the message to be detected based on a preset detection rule includes: Based on the preset detection rules, the file is first detected for sensitive information, and then the text information is detected for sensitive information.

4. The sensitive information leakage detection method based on full flow according to claim 1 is characterized in that: Generating an alarm log based on the detection result includes: Displaying sensitive information leakage details in the alarm log, the sensitive information leakage details including the first frequency of occurrence of each sensitive content and the second frequency of occurrence of each sensitive word; The sensitive content and sensitive words in the message to be detected are marked and displayed in the alarm log.

5. A sensitive information leakage detection device based on full flow, characterized in that: include: A data flow acquisition module is used to obtain the request direction of the data flow to be detected, and determine the message to be detected based on the request direction, wherein the sensitive information in the message to be detected includes sensitive content and sensitive words corresponding to the sensitive content; A sensitive information detection module, configured to detect sensitive content in the message to be detected using a regular expression, and to count the first frequency of occurrence of each sensitive content; Using keywords to detect sensitive words in the message to be detected, and counting the second frequency of each sensitive word; A sensitive information determination module, configured to determine that sensitive information leakage occurs in the message to be detected if a first frequency of occurrence of a certain sensitive content is not less than a single threshold corresponding to the sensitive content; If the first frequency of a certain sensitive content is not zero and is less than the single item threshold corresponding to the sensitive content, and the second frequency of the sensitive word corresponding to the sensitive content is not zero, the message to be detected has leaked sensitive information; If the first frequency of occurrence of each sensitive content is less than the single threshold corresponding to the sensitive content, but the sum of the first frequency of occurrence of each sensitive content is not less than the total threshold, the message to be detected has leaked sensitive information; The alarm log generation module is used to generate an alarm log based on the detection result if sensitive information leakage occurs in the message to be detected.

6. An electronic device, characterized in that: It includes a memory and a processor, wherein the memory is used to store programs; the processor is coupled to the memory and is used to execute the programs stored in the memory to implement the steps in the full-flow based sensitive information leakage detection method as described in any one of claims 1 to 4 above.

7. A computer-readable storage medium, characterized in that Used to store computer-readable programs or instructions, which, when executed by a processor, can implement the steps of the full-flow based sensitive information leakage detection method described in any one of claims 1 to 4 above.

Images