A hierarchical data fingerprint audit tracing method in cross-network switching

Abstract

This invention provides a hierarchical data fingerprint auditing and tracing method for cross-network exchange, comprising: fingerprint extraction: determining the type of exchanged files and extracting hierarchical data fingerprints based on file security level and importance, storing the hierarchical data fingerprints in a fingerprint database; wherein, the hierarchical data fingerprints include five levels of data fingerprints; auditing and tracing: extracting hierarchical data fingerprints from the files to be traced and comparing them with fingerprints in the fingerprint database to complete the tracing. This invention optimizes the data fingerprint extraction and auditing and tracing process, significantly saving system computing and storage resources while ensuring the accuracy of auditing and tracing exchange behavior, and has significant practical implications for the actual construction and operation of cross-network exchange systems. The proposed method can also be further extended to other similar scenarios.

Description

Technical Field

[0001] This invention relates to the field of cross-network switching, and in particular to a hierarchical data fingerprint auditing and tracing method for cross-network switching. Background Technology

[0002] With the rapid development of information technology, more and more data needs to be shared and exchanged securely and in a controllable manner between different networks, and cross-network exchange systems have emerged to meet this need.

[0003] Cross-network exchange systems can provide cross-network exchange services for various business systems. However, on the one hand, when providing services externally, these systems should not store log records that can be recovered to the original data to avoid information leakage. On the other hand, when exchanged data contains malicious code that spreads in the receiving network domain, or when files containing sensitive information are illegally transmitted across networks, it is necessary to trace the exchange behavior based on audit records so that administrators can understand the situation or hold those responsible accountable. Therefore, a data fingerprinting method is needed to record the characteristics of exchanged data, but it is not possible to recover the original information through data fingerprints. Traditional data fingerprint extraction methods in cross-network exchange calculate fingerprints for the entire file; if the file content is modified, the exchange behavior cannot be detected.

[0004] Patent 201610236750.8 describes a method and system for data leakage prevention. This patent involves segmenting a document to obtain a word sequence; for each word in the word sequence, calculating a feature value representing the importance of that word in the document, and selecting a first predetermined number of words from the word sequence based on the feature value; using the extracted data features to determine whether a first document and a second document are related; and determining whether a suspicious document contains sensitive content based on relevance. This method, used in the field of data leakage prevention, does not perform hierarchical processing of data files, resulting in a large number of non-sensitive files being segmented and fingerprinted. If this technology is used in the field of cross-network exchange, it will waste a significant amount of computing and storage resources and affect the efficiency of behavior audit reconstruction.

[0005] Patent 202211323606.X discloses a data traceability method and system for data exchange. Utilizing data fingerprinting technology, it addresses functions such as verifying the authenticity of business data, determining whether two data sets are identical, tracing the data exchange process, obtaining version information of business data, and acquiring the latest version of data in scenarios involving multiple exchange nodes. This patent is used to determine whether duplicate data is exchanged across networks and can trace the source of business data. However, its data fingerprint is calculated for the entire file; if the exchanged file is modified, it will be impossible to trace the exchange behavior based on its content. Summary of the Invention

[0006] To address the problems existing in the prior art, a hierarchical data fingerprint auditing and tracing method for cross-network switching is provided. This method classifies data based on its security level and importance, and uses fingerprint extraction methods of different granularities to extract data fingerprints from the exchanged data, thereby achieving efficient and accurate auditing and reconstruction capabilities for exchange behavior in cross-network switching systems.

[0007] The technical solution adopted in this invention is as follows: A hierarchical data fingerprint auditing and tracing method in cross-network switching, comprising:

[0008] Fingerprint extraction: The type of exchanged files is determined, and hierarchical data fingerprints are extracted based on the file's security level and importance. The hierarchical data fingerprints are then stored in the fingerprint database. The hierarchical data fingerprints include five levels of data fingerprints.

[0009] Audit tracing: The source of the audited documents is traced by extracting hierarchical data fingerprints and comparing them with fingerprints in the fingerprint database to complete the tracing.

[0010] Furthermore, the specific process of fingerprint extraction includes:

[0011] Step 1.1: Extract the primary data fingerprint from the exchange file;

[0012] Step 1.2: Determine if the exchanged file is an office file. If yes, proceed to Step 1.3; otherwise, proceed to Step 1.6.

[0013] Step 1.3: Extract the secondary data fingerprint of the exchanged file.

[0014] Step 1.4: Based on the hierarchical data fingerprint extraction principle, determine the required data fingerprint level and proceed to Step 1.5; if no extraction is required, proceed to Step 1.6.

[0015] Step 1.5: Extract the corresponding level 3, 4, or 5 data fingerprints;

[0016] Step 1.6: Store the extracted fingerprint data in the fingerprint database.

[0017] Furthermore, the hierarchical data fingerprint extraction principle is based on the correspondence between file security level, importance, and data fingerprint level; wherein,

[0018] Document security classification includes four levels: unclassified, internal, secret, and confidential and above; document importance is divided into two types: general and important; the corresponding relationship is as follows: all documents need to be extracted with level 1 data fingerprints, unclassified office documents need to be extracted with level 2 data fingerprints, general internal office documents need to be extracted with level 3 data fingerprints, important internal office documents and general secret office documents need to be extracted with level 4 data fingerprints, and important secret office documents and confidential and above office documents need to be extracted with level 5 data fingerprints.

[0019] Furthermore, the specific process of audit tracing includes:

[0020] Step 2.1: Extract the primary data fingerprint of the file to be traced and compare it with the primary data fingerprint in the fingerprint database. If a match is found, an alarm will be triggered to end the tracing process.

[0021] Step 2.2: Determine the file type. If it is an office document, extract the secondary data fingerprint of the document and compare it with the secondary data fingerprint in the fingerprint database. If a match is found, an alarm will be triggered to end the tracing process. If it is not an office document, the tracing process will end directly.

[0022] Step 2.3: Determine the security classification and importance of the document. If it is a non-classified office document, the tracing process ends directly; otherwise, proceed to step 2.4.

[0023] Step 2.4: According to the hierarchical data fingerprint extraction principle, extract all levels of data fingerprints required for the file, and compare them sequentially with the corresponding level data fingerprints in the fingerprint database. If any level data fingerprint is matched, an alarm will be triggered to end the tracing process; otherwise, the tracing process will end directly.

[0024] Furthermore, the first-level data fingerprint extraction process is as follows: data fingerprint extraction is performed on the entire exchange file, and the result is the data fingerprint of the entire file.

[0025] Furthermore, the secondary data fingerprint extraction process is as follows: extract the file content, then perform data denoising, and finally extract the data fingerprint from the denoised data content.

[0026] Furthermore, the three-level data fingerprint extraction process is as follows: extract the file content, divide it into segments according to natural paragraphs, denoise each natural paragraph, and finally extract the data fingerprint from the denoised data content; each natural paragraph corresponds to a three-level data fingerprint.

[0027] Furthermore, the fourth-level data fingerprint extraction process is as follows: extract the file content, divide it according to sentences, denoise each sentence, and finally extract the data fingerprint from the denoised data content; each sentence corresponds to a fourth-level data fingerprint.

[0028] Furthermore, the five-level data fingerprint extraction process is as follows: the file content is extracted and divided into natural segments, and each natural segment is segmented using intelligent natural language semantic analysis; after segmentation, duplicates are removed and weights are assigned, and finally, data fingerprints are extracted from the remaining segments and the weights of the data fingerprints are recorded; multiple sets of five-level data fingerprints with data weights are extracted from each file.

[0029] Furthermore, during the audit tracing process, when comparing data fingerprints, if a single data fingerprint is equal to the fingerprint value in the data fingerprint / data fingerprint group to be compared, it indicates that the data fingerprint has been matched; if it is not equal to any of the data fingerprints / data fingerprint groups to be compared, it indicates that the data fingerprint has not been matched. Specifically, for level 3 and level 4 data fingerprints, the percentage of matched data fingerprints to the total number of data fingerprints needs to be calculated. If the percentage exceeds a set threshold, it indicates that the file has been matched. For level 5 fingerprints, comparison is performed according to data fingerprint groups. During the matching process of each group of data fingerprints, if the percentage exceeds a set threshold, the group is considered to have been matched. All groups are then used to calculate the hit rate. If the hit rate exceeds a set threshold, the level 5 data fingerprint of the file is considered to have been matched.

[0030] Compared with existing technologies, the beneficial effects of adopting the above technical solution are as follows: This invention addresses the need for auditing and tracing the source of exchanged data content in the cross-network exchange field. It proposes an auditing and tracing method based on multi-level data fingerprints, optimizing the data fingerprint extraction and auditing and tracing process. While ensuring the accuracy of auditing and tracing exchange behavior, it significantly saves the system's computing and storage resources, which has important practical significance for the actual construction and operation of cross-network exchange systems. This proposed method can also be further extended to other similar scenarios. Attached Figure Description

[0031] Figure 1 This is a flowchart of the cross-network file data fingerprint extraction process proposed in this invention.

[0032] Figure 2 This is a flowchart of the behavior audit tracing process based on data content proposed in this invention.

[0033] Figure 3 This is a flowchart of the hierarchical data fingerprint extraction method proposed in this invention. Detailed Implementation

[0034] The embodiments of this application are described in detail below, examples of which are illustrated in the accompanying drawings, wherein the same or similar reference numerals denote the same or similar modules or modules having the same or similar functions throughout. The embodiments described below with reference to the accompanying drawings are exemplary and are only used to explain this application, and should not be construed as limiting this application. Rather, the embodiments of this application include all variations, modifications, and equivalents falling within the spirit and scope of the appended claims.

[0035] This invention addresses the need for content-based auditing and backtracking of cross-network data exchange without preserving the original data. It proposes a multi-level data fingerprint-based auditing and tracing method. This method can determine the type of exchanged files and classify them based on their security level and importance. Different data fingerprinting methods are used to calculate the fingerprints of the exchanged data, providing an efficient and accurate content-based auditing and tracing process. This method reduces the system's demand for computing and storage resources and has significant practical implications for improving the construction of cross-network systems. The specific solution is as follows:

[0036] A hierarchical data fingerprint auditing and tracing method for cross-network switching includes:

[0037] Fingerprint extraction: The type of exchanged files is determined, and hierarchical data fingerprints are extracted based on the file's security level and importance. The hierarchical data fingerprints are then stored in the fingerprint database. The hierarchical data fingerprints include five levels of data fingerprints.

[0038] Audit tracing: The source of the audited documents is traced by extracting hierarchical data fingerprints and comparing them with fingerprints in the fingerprint database to complete the tracing.

[0039] Please refer to Figure 1 This embodiment presents a specific fingerprint extraction process, including:

[0040] Step 1.1: Extract the primary data fingerprint from the exchange file;

[0041] Step 1.2: Determine if the exchanged file is an office file. If yes, proceed to Step 1.3; otherwise, proceed to Step 1.6.

[0042] Step 1.3: Extract the secondary data fingerprint of the exchanged file.

[0043] Step 1.4: Based on the hierarchical data fingerprint extraction principle, determine the required data fingerprint level and proceed to Step 1.5; if no extraction is required, proceed to Step 1.6.

[0044] Step 1.5: Extract the corresponding level 3, 4, or 5 data fingerprints;

[0045] Step 1.6: Store the extracted fingerprint data in the fingerprint database.

[0046] Specifically, in this embodiment, the hierarchical data fingerprint extraction principle relies on the file's security classification and importance. The file security classification is divided into four levels: unclassified, internal, secret, and confidential or above. The importance of a file can be determined manually or by keywords, and is categorized into general and important. ① Manual determination involves the sending reviewer manually labeling the file. ② Keyword determination involves administrators designing keywords (such as technical solutions) based on the characteristics of the application system the cross-network system resides in; files containing these keywords are considered important.

[0047] Based on the file security level and importance, this embodiment establishes a correspondence between them and the data fingerprint level, as shown in the table below:

[0048]

[0049]

[0050] The table above shows only one principle for data fingerprint extraction, which can be adjusted according to needs in practical applications.

[0051] If malicious code is found to be spreading in the receiving network domain or files containing sensitive information are leaked, it is necessary to reconstruct and trace the exchange behavior based on the recorded data fingerprints. Therefore, based on the fingerprint database established through the above data fingerprint extraction process, this embodiment proposes a corresponding auditing and tracing method.

[0052] Please see Figure 2 The specific process of audit tracing is as follows:

[0053] Step 2.1: Extract the primary data fingerprint of the file to be traced and compare it with the primary data fingerprint in the fingerprint database. If a match is found, an alarm will be triggered to end the tracing process.

[0054] Step 2.2: Determine the file type. If it is an office document, extract the secondary data fingerprint of the document and compare it with the secondary data fingerprint in the fingerprint database. If a match is found, an alarm will be triggered to end the tracing process. If it is not an office document, the tracing process will end directly.

[0055] Step 2.3: Determine the security classification and importance of the document. If it is a non-classified office document, the tracing process ends directly; otherwise, proceed to step 2.4.

[0056] Step 2.4: According to the hierarchical data fingerprint extraction principle, extract all levels of data fingerprints required for the file, and compare them sequentially with the corresponding level data fingerprints in the fingerprint database. If any level data fingerprint is matched, an alarm will be triggered to end the tracing process; otherwise, the tracing process will end directly.

[0057] In fact, in step 2.4, for general internal office documents, it is also necessary to calculate the third-level data fingerprint of the document and compare it with the third-level data fingerprint in the fingerprint database; for important internal office documents and general secret office documents, it is necessary to calculate and compare the third-level data fingerprint and the actual data fingerprint of the document in turn; for important secret office documents and confidential or above office documents, it is necessary to calculate and compare the third-level data fingerprint, fourth-level data fingerprint and fifth-level data fingerprint of the document in turn.

[0058] During fingerprint comparison, if a single fingerprint matches the fingerprint value in the fingerprint(s) to be compared, the fingerprint is considered a match; if it does not match any of the fingerprint(s) to be compared, the fingerprint is considered a miss. Therefore, in this embodiment, an alarm is triggered when the matching success rate of Level 1 and Level 2 fingerprints is set to 100%, or when the matching success rate of Level 3, Level 4, and Level 5 fingerprints exceeds a set threshold.

[0059] In this embodiment, a threshold for the matching hit rate needs to be set when comparing level 3, level 4, and level 5 data fingerprints. When the threshold is exceeded, the file content is considered to be basically similar. The higher the matching hit rate, the more closely the content matches. Users can set the threshold according to their actual needs; generally, the level 3 data fingerprint hit rate threshold can be set to 20%; the level 4 data fingerprint hit rate threshold can be set to 35%; and the level 5 data fingerprint hit rate threshold can be set to 50%.

[0060] Specifically, for Level 3 and Level 4 fingerprints, the percentage of matched fingerprints to the total number of fingerprints needs to be calculated. If the percentage exceeds a threshold, the file is considered a match, indicating it is a previously transmitted file. For Level 5 fingerprints, comparisons are performed in groups. During each group's matching process, if the percentage exceeds a threshold, the group is considered a match. All groups are then compared to calculate the hit rate; if the hit rate exceeds a threshold, the Level 5 fingerprint is considered a match.

[0061] It should be noted that the data fingerprint calculation method in this embodiment uses a hash algorithm, but different levels of processing are used depending on the classification of the data file.

[0062] In this embodiment, data fingerprints are divided into five levels based on the granularity of extraction. Higher levels result in finer granularity and higher accuracy in content-based detection, but also consume more computing and storage resources; lower levels result in lower accuracy in content-based detection, but consume less computing and storage resources. Actual cross-network data exchange will be performed on a file-by-file basis (compressed files need to be decompressed into their original form) for data fingerprint calculation.

[0063] Please refer to Figure 3 The following illustrates the extraction process of data fingerprints at each level in this embodiment:

[0064] For Level 1 data fingerprints, the data fingerprint is extracted directly from the entire file, and the result is the data fingerprint of the entire file; each file corresponds to one Level 1 data fingerprint.

[0065] For secondary data fingerprints, the process first requires extracting the file content, then performing data denoising, and finally extracting the data fingerprint from the denoised data content; each file corresponds to one secondary data fingerprint.

[0066] For Level 3 data fingerprinting, the file content needs to be extracted and divided into segments according to natural paragraphs. Then, noise reduction is performed on each natural paragraph, and finally, data fingerprint extraction is performed on the noise-reduced data content. Each file will extract a set of Level 3 data fingerprints, and the number of Level 3 data fingerprints is equal to the number of natural paragraphs.

[0067] For Level 4 data fingerprinting, the file content needs to be extracted and divided according to sentences. Then, each sentence is denoised and deduplicated. Finally, data fingerprinting is extracted from the denoised data content. Each file will yield a set of Level 4 data fingerprints.

[0068] It is important to note that sentence segmentation is not based on word segmentation, but rather on punctuation marks such as periods, exclamation marks, question marks, and ellipses.

[0069] For Level 5 data fingerprinting, this level of data fingerprinting requires extracting the file content, then dividing it into natural segments. Each natural segment undergoes intelligent natural language semantic analysis to segment the data file content into words. After segmentation, unimportant modifiers are removed, duplicate segments are merged and weighted (based on frequency of occurrence). Finally, data fingerprints are extracted from the remaining segments, and the weights of the data fingerprints are recorded. Each file will yield multiple sets of Level 5 data fingerprints with data weights.

[0070] In one embodiment, noise reduction during fingerprint extraction includes: ① removing spaces from Chinese characters and separating English words with spaces; ② removing special characters such as punctuation marks; and ③ converting traditional Chinese characters to simplified Chinese characters.

[0071] The hierarchical data fingerprint auditing and tracing method proposed in this invention classifies data based on its security level and importance, and uses fingerprint extraction methods of different granularities to extract data fingerprints from exchanged data, thereby achieving efficient and accurate auditing and restoration capabilities for exchange behavior in cross-network exchange systems.

[0072] It should be noted that, in the description of the embodiments of the present invention, unless otherwise explicitly specified and limited, the terms "set" and "connection" should be interpreted broadly. For example, they can refer to a fixed connection, a detachable connection, or an integral connection; they can refer to a direct connection or an indirect connection through an intermediate medium. Those skilled in the art can understand the specific meaning of the above terms in the present invention based on the specific circumstances. The accompanying drawings in the embodiments are used to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, not all embodiments. The components of the embodiments of the present invention described and shown in the accompanying drawings can generally be arranged and designed in various different configurations.

[0073] Although embodiments of this application have been shown and described above, it is understood that the above embodiments are exemplary and should not be construed as limiting this application. Those skilled in the art can make changes, modifications, substitutions and variations to the above embodiments within the scope of this application.

Claims

1. A method for hierarchical data fingerprint audit tracing in cross-network switching, characterized in that, The method comprises the following steps: Fingerprint extraction: judging the exchange file type, and extracting classified data fingerprints according to the file classification and importance, and storing the classified data fingerprints in a fingerprint library; wherein the classified data fingerprints include five-level data fingerprints; Audit traceability: extracting classified data fingerprints from the file to be traced, and comparing the data fingerprints with the fingerprints in the fingerprint library to complete the traceability; The specific process of the fingerprint extraction comprises the following steps: Step 1.1: extracting one-level data fingerprints from the exchange file; Step 1.2: judging whether the exchange file is an office file, if yes, proceeding to step 1.3, otherwise, proceeding to step 1.6; Step 1.3: extracting two-level data fingerprints from the exchange file, Step 1.4: judging the level of the data fingerprints to be extracted according to the classified data fingerprint extraction principle, and proceeding to step 1.5; if no data fingerprint is to be extracted, proceeding to step 1.6; Step 1.5: extracting three-level, four-level or five-level data fingerprints; Step 1.6: storing the extracted data fingerprints in the fingerprint library; The classified data fingerprint extraction principle is the corresponding relationship between the file classification, importance and the level of the data fingerprints; wherein The file classification includes non-secret, internal, secret, confidential and above; the importance of the file is divided into two types: general and important; the corresponding relationship is that all files need to extract one-level data fingerprints, non-secret office files extract two-level data fingerprints, general internal office files extract three-level data fingerprints, important internal office files and general secret office files extract four-level data fingerprints, important secret office files, confidential and above office files extract five-level data fingerprints; The specific process of the audit traceability comprises the following steps: Step 2.1: extracting one-level data fingerprints from the file to be traced, and comparing the one-level data fingerprints with the one-level data fingerprints in the fingerprint library, if a hit is found, an alarm is given and the traceability is ended; Step 2.2: judging the file type, if it is an office file, extracting two-level data fingerprints from the file, and comparing the two-level data fingerprints with the two-level data fingerprints in the fingerprint library, if a hit is found, an alarm is given and the traceability is ended; if it is not an office file, the traceability is directly ended; Step 2.3: judging the file classification and importance, if it is a non-secret office file, the traceability is directly ended, otherwise, proceeding to step 2.4; Step 2.4: extracting all levels of data fingerprints required to be extracted from the file according to the classified data fingerprint extraction principle, and comparing the data fingerprints with the corresponding level data fingerprints in the fingerprint library, if a hit is found in any level data fingerprint, an alarm is given and the traceability is ended, otherwise, the traceability is directly ended.

2. The method of claim 1, wherein, The one-level data fingerprint extraction process is that data fingerprints are extracted from the entire exchange file, and the calculation result is the data fingerprint of the entire file.

3. The hierarchical data fingerprint audit trail method in cross-network switching of claim 2, wherein, The two-level data fingerprint extraction process is that the file content is extracted, and then data denoising is performed, and then data fingerprints are extracted from the denoised data content.

4. The method of hierarchical data fingerprint audit-trail in cross-network switching as claimed in claim 3 wherein, The three-level data fingerprint extraction process is that the file content is extracted, and then the content is segmented according to natural paragraphs, and then each natural paragraph is denoised, and finally data fingerprints are extracted from the denoised data content; each natural paragraph corresponds to one three-level data fingerprint.

5. The method of hierarchical data fingerprint audit-trail in cross-network switching of claim 4, wherein, The four-level data fingerprint extraction process is: extracting the file content, dividing according to the sentences, denoising each sentence, and finally extracting the data fingerprint of the denoised data content; each sentence corresponds to a four-level data fingerprint.

6. The method of hierarchical data fingerprint audit-trail in cross-network switching of claim 5, wherein, The five-level data fingerprint extraction process is: extracting the file content, dividing according to the natural paragraphs, and performing word segmentation processing on each natural paragraph by using intelligent-based natural language semantic analysis; after word segmentation, removing the repeated words and assigning weights, and finally extracting the data fingerprint of the remaining word segmentation and recording the weight of the data fingerprint; each file extracts multiple groups of five-level data fingerprints with data weights.

7. The method of claim 1, wherein, In the audit traceability process, when comparing data fingerprints, if a single data fingerprint is equal to the fingerprint value in the data fingerprint / data fingerprint group to be compared, it means that the data fingerprint is matched; if all are not equal, it means that the data fingerprint is not matched. For three-level data fingerprints and four-level fingerprints, the percentage of the number of matched data fingerprints to the total number of data fingerprints needs to be calculated, and if it exceeds the set threshold, it means that the file is matched. For five-level fingerprints, the data fingerprints are grouped for comparison. In the matching process of each group of data fingerprints, if it exceeds the set threshold, it is considered that the group is matched. The hit rate of all groups is calculated, and if it exceeds the set threshold, it is considered that the five-level data fingerprint of the file is matched.

Images