Data processing method and device, computer device and readable storage medium

Abstract

Embodiments of the present application disclose a data processing method and device, computer equipment and a readable storage medium, and relate to the technical field of cloud. The method comprises: determining a first process in an open state on a terminal device, and determining a second process with a file touch behavior from the first process; determining a sensitive process from the second process based on a touch file corresponding to the file touch behavior of the second process and a filtering rule; and determining a processing strategy for a file export behavior of a third process on the terminal device based on a matching result of the sensitive process and the third process when detecting that the third process has the file export behavior. The embodiments of the present application can reduce the risk of data leakage, improve data security, improve the accuracy of file export behavior identification, and improve user experience.

Description

Technical Field

[0001] This application relates to the field of cloud technology, and in particular to a data processing method, apparatus, computer equipment, and readable storage medium. Background Technology

[0002] File outbound behavior by processes on terminal devices may pose a risk. Secure management of this behavior can reduce the risk of data leakage. Currently, process control typically involves monitoring all processes that might connect to the network to send files. This is achieved by injecting data into these processes to detect their file outbound behavior. When it's determined that a process is sending files to external terminal devices, it's blocked. However, this monitoring method suffers from several drawbacks. Firstly, if the application has anti-injection logic, it can affect the normal operation of the application on the terminal device, leading to low accuracy in identifying file outbound behavior, increasing the risk of data leakage, and reducing data security. Secondly, blocking all identified outbound behavior from terminal devices can result in poor application performance and low accuracy in identifying file outbound behavior, thus degrading the user experience. Summary of the Invention

[0003] This application provides a data processing method, apparatus, computer equipment, and readable storage medium, which can reduce the risk of data leakage, improve data security, increase the accuracy of identifying file out-of-circuit behavior, and enhance user experience.

[0004] Firstly, this application provides a data processing method, including:

[0005] Identify the first process that is running on the terminal device, and from the first process, identify the second process that has file touching behavior;

[0006] Based on the file touching behavior of the second process and the corresponding touching files and filtering rules, sensitive processes are identified from the second process;

[0007] When a third process on the terminal device is detected to be sending files outside the device, a handling strategy for the file sending behavior of the third process is determined based on the matching result between the sensitive process and the third process.

[0008] In conjunction with the first aspect, in one possible implementation, based on the matching results between the sensitive process and the third process, and the sensitive file, a handling strategy for the file outgoing behavior of the third process is determined, including:

[0009] Obtain the target risk level corresponding to the file outgoing behavior of the third process. The target risk level is determined based on the sensitivity level of the third process and / or the sensitivity level of the files sent by the third process.

[0010] If the target risk level corresponding to the outbound behavior is greater than the target level, and the outbound behavior matches the reference outbound behavior in the high-risk outbound model, then the processing strategy for the file outbound behavior of the third process is determined to be the interception strategy.

[0011] If the target risk level corresponding to the outbound behavior is less than or equal to the target level and / or the outbound behavior does not match the reference outbound behavior in the high-risk outbound model, then the processing strategy for the file outbound behavior of the third process is determined to be the allow strategy, and the file outbound behavior is backed up and reported to the server.

[0012] Secondly, this application provides a data processing apparatus, comprising:

[0013] The status acquisition unit is used to acquire the first process that is in the open state on the terminal device, and to determine the second process with file touching behavior from the first process;

[0014] The process filtering unit is used to determine sensitive processes from the second process based on the touched files and filtering rules corresponding to the file touching behavior of the second process;

[0015] The strategy determination unit is used to determine the processing strategy for the file outreach behavior of the third process based on the matching result between the sensitive process and the third process when a third process on the terminal device is detected to have file outreach behavior.

[0016] Thirdly, this application provides a computer device, including: a processor, a memory, and a network interface;

[0017] The processor is connected to a memory and a network interface. The network interface is used to provide data communication functions, the memory is used to store computer programs, and the processor is used to call the computer programs so that the computer device containing the processor can execute the data processing method.

[0018] Fourthly, this application provides a computer-readable storage medium storing a computer program adapted to be loaded and executed by a processor, so that a computer device having the processor performs the above-described data processing method.

[0019] Fifthly, this application provides a computer program product or computer program including computer instructions stored in a computer-readable storage medium. A processor of a computer device reads the computer instructions from the computer-readable storage medium and executes the computer instructions, causing the computer device to perform the data processing methods provided in the various alternative embodiments of the first aspect of this application.

[0020] In this embodiment, by identifying a first process that is running on the terminal device, a second process with file-touching behavior can be determined from the first process. The second process can be determined by combining the process's running state and its file-touching behavior. Further, based on the touched files corresponding to the second process's file-touching behavior and filtering rules, sensitive processes can be identified from the second process. This allows for further filtering of the second process to identify sensitive processes. By judging the processes on the terminal device and identifying sensitive processes, it is easier to quickly determine whether a process is sensitive when it is subsequently detected to have file-outgoing behavior, and to take corresponding processing strategies. Furthermore, when a third process on the terminal device is detected to have file-outgoing behavior, a processing strategy for the third process's file-outgoing behavior can be determined based on the matching result between the sensitive process and the third process. This allows for the control of process outgoing behavior, reducing the risk of data leakage and improving data security; and it does not affect the normal operation of the application to which the process belongs, thus improving user experience. Attached Figure Description

[0021] To more clearly illustrate the technical solutions in the embodiments of this application, the drawings used in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0022] Figure 1 This is a schematic diagram of the architecture of a data processing system provided in an embodiment of this application;

[0023] Figure 2 This is a schematic diagram illustrating an application scenario of a data processing method provided in an embodiment of this application;

[0024] Figure 3 This is a flowchart illustrating a data processing method provided in an embodiment of this application;

[0025] Figure 4 This is a schematic diagram of a filtering process and files provided in an embodiment of this application;

[0026] Figure 5 This is a flowchart illustrating another data processing method provided in an embodiment of this application;

[0027] Figure 6 This is a schematic diagram illustrating a file filtering operation behavior provided in an embodiment of this application;

[0028] Figure 7 This is a schematic diagram of a zero-trust network architecture provided in an embodiment of this application;

[0029] Figure 8 This is a schematic diagram illustrating a configuration of a service access policy provided in an embodiment of this application;

[0030] Figure 9 This is a schematic diagram illustrating a resource access configuration strategy provided in an embodiment of this application;

[0031] Figure 10 This is a schematic diagram of the composition structure of a data processing device provided in an embodiment of this application;

[0032] Figure 11 This is a schematic diagram of the composition structure of a computer device provided in an embodiment of this application. Detailed Implementation

[0033] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0034] Cloud technology refers to a managed technology that unifies hardware, software, and network resources within a wide area network (WAN) or local area network (LAN) to enable data computation, storage, processing, and sharing. Cloud technology includes cloud applications, such as medical cloud, cloud IoT, cloud security, cloud computing education (CCEDU), and cloud social networking, among others.

[0035] Cloud security refers to the collective term for security software, hardware, users, organizations, and security cloud platforms based on cloud computing business models. Cloud security integrates emerging technologies and concepts such as parallel processing, grid computing, and unknown virus behavior detection. It uses a large network of clients to monitor abnormal software behavior on the network, obtain the latest information on Trojans and malware on the internet, and send it to the server for automatic analysis and processing. Solutions for viruses and Trojans are then distributed to each client. The main research directions of cloud security include: 1. Cloud computing security: This mainly studies how to ensure the security of the cloud itself and various applications on the cloud, including cloud computer system security, secure storage and isolation of user data, user access authentication, information transmission security, network attack protection, and compliance auditing; 2. Cloudification of security infrastructure: This mainly studies how to use cloud computing to build and integrate security infrastructure resources, optimize security protection mechanisms, including building a large-scale security event and information collection and processing platform through cloud computing technology to achieve the collection and correlation analysis of massive amounts of information, and improve the ability to control and manage network-wide security events; 3. Cloud security services: This mainly studies various security services provided to users based on cloud computing platforms, such as antivirus services.

[0036] In this application's embodiments, all user information-related data is data authorized by the user. This application relates to cloud technologies, such as medical cloud technology, cloud education technology, cloud conferencing technology, cloud social technology, etc. The process on the terminal device can refer to a medical-related application process, and the corresponding file can refer to a medical-related file; or, the process on the terminal device can refer to an education-related application process, and the corresponding file can refer to an education-related file, and so on. The technical solution of this application is applicable to scenarios where processes on a terminal device are judged to determine whether a process on the terminal device is a sensitive process, and then corresponding processing is performed on the file outgoing behavior of the process on the terminal device. The embodiments of this invention can also be applied to various scenarios, including but not limited to cloud technology, artificial intelligence, smart transportation, and assisted driving. In this application's embodiments, by determining a first process that is in an open state on the terminal device, a second process with file touching behavior can be determined from the first process. Furthermore, sensitive processes can be identified from the second process based on the files touched and the filtering rules corresponding to the file touching behavior of the second process. For example, a sensitive process can refer to a process with risks. When such a process on the terminal device is detected to have file outgoing behavior, such a process can be intercepted, thereby reducing the risk of data leakage, realizing secure data management, and improving data security.

[0037] Please see Figure 1 , Figure 1 This is a schematic diagram of the architecture of a data processing system provided in an embodiment of this application, such as... Figure 1As shown, the terminal device can interact with the server for data exchange. There can be one or more terminal devices. For example, when there are multiple terminal devices, they may include… Figure 1 The system includes terminal devices 101a, 101b, and 101c. Taking terminal device 101a as an example, terminal device 101a can identify a first process that is currently running, and then identify a second process from the first process that exhibits file access behavior. Further, based on the file access behavior of the second process and the corresponding accessed file and filtering rules, terminal device 101a can identify sensitive processes from the second process that match the filtering rules. Further, when terminal device 101a detects that a third process on terminal device 101a exhibits file outbound behavior, it can determine whether the third process matches a sensitive process. If the third process matches a sensitive process, the file outbound behavior of the third process can be intercepted. Optionally, terminal device 101a can also report the intercepted file outbound behavior to server 102, so that server 102 can further audit and process the file outbound behavior. By intercepting the file outbound behavior of sensitive processes, the risk of data leakage can be reduced, and data security can be increased. Because the interception targets file outgoing activities of sensitive processes, file outgoing activities of non-sensitive processes can proceed normally without affecting the normal operation of applications on the terminal device, thus improving the user experience.

[0038] It is understood that the server mentioned in the embodiments of this application can be an independent physical server, a server cluster or distributed system composed of multiple physical servers, or a cloud server providing basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communication, middleware services, domain name services, security services, vehicle-to-everything (V2X) communication, content delivery networks (CDNs), and big data and artificial intelligence platforms. The terminal device mentioned above can be an electronic device, including but not limited to mobile phones, tablets, desktop computers, laptops, PDAs, in-vehicle devices, intelligent voice interaction devices, augmented reality / virtual reality (AR / VR) devices, head-mounted displays, wearable devices, smart speakers, smart home appliances, aircraft, digital cameras, webcams, and other mobile internet devices (MIDs) with network access capabilities. The terminal device and the server can be directly or indirectly connected via wired or wireless communication, which is not limited herein.

[0039] Further, please see Figure 2 , Figure 2 This is a schematic diagram illustrating an application scenario of a data processing method provided in an embodiment of this application. For example... Figure 2 As shown, terminal device 20 can obtain the status information of all its processes, thereby determining the first process that is in the running state based on the process status information, and determining the second process with file touching behavior from the first process, which is equivalent to filtering the first process to determine the second process. Further, terminal device 20 can determine sensitive processes from the second process based on the touched files corresponding to the file touching behavior of the second process and the filtering rules. Further, when a third process on terminal device 20 is detected to have file outreach behavior, a processing strategy for the file outreach behavior of the third process can be determined based on the matching result between the sensitive process and the third process. For example, if the sensitive process matches the third process, i.e., the third process is a sensitive process, then the processing strategy for the file outreach behavior of the third process is determined to be an interception strategy, i.e., intercepting the file outreach behavior and reporting the file outreach behavior to server 21 so that server 21 can perform further auditing processing. If the sensitive process does not match the third process, that is, the third process is not a sensitive process, then the processing policy for the file outgoing behavior of the third process is determined to be the allow policy, that is, the file outgoing behavior of the third process is allowed, and the file is sent to the business terminal 22 so that the business terminal 22 can process the corresponding business.

[0040] Further, please see Figure 3 , Figure 3 This is a flowchart illustrating a data processing method provided in an embodiment of this application; as shown... Figure 3 As shown, this data processing method can be applied to the aforementioned terminal device, and the data processing method includes, but is not limited to, the following steps:

[0041] S101, determine the first process that is in the open state on the terminal device, and determine the second process with file touching behavior from the first process.

[0042] In this embodiment of the application, the terminal device can obtain the status information of all processes on the terminal device, thereby determining the first process that is in the open state based on the status information of all processes, and determining the second process with file touching behavior from the first process.

[0043] The process status information can be used to indicate whether a process is running or closed. File touch behavior can include, but is not limited to, actions such as reading, copying, renaming, moving, and deleting files. By identifying the first process that is running on the terminal device, and then identifying the second process that exhibits file touch behavior from within the first process, the file touch behavior of the second process can be used to further determine whether the second process is a sensitive process.

[0044] Optionally, the terminal device can monitor the creation and exit processes of all processes on the terminal device. When a new process is created, the terminal device can obtain the attribute characteristics information of the created process. The attribute characteristics information of the process can include the process's own attributes and the attribute characteristics information of associated processes. Associated processes can refer to at least one of the process's parent process, creator process, and child process. The process's attribute characteristics information may include, but is not limited to, the process name, process ID, process signature information, process copyright information, the MD5 hash of the executable file corresponding to the process, the last modification time of the executable file corresponding to the process, the command line information corresponding to the process (with a maximum length limit), parent process ID, creator process ID, child process ID, etc.

[0045] Optionally, the terminal device may include a kernel driver module, which can monitor the opening and closing of processes in the terminal device. When an open process is detected, the kernel driver module can obtain the attribute characteristics information of the open process.

[0046] In practical implementation, the terminal device can set callbacks at the Ring0 layer to receive notifications of the dynamic creation and exit of all processes on the terminal device. For example, it can monitor the creation and exit process by using the API function PsSetCreateProcessNotifyRoutineEx provided by WDK. When a new process is created, the callback function can obtain the process body of the new process, the ID of the new process, and the main information about the creation of the new process obtained by the callback function through the third parameter of type PPS_CREATE_NOTIFY_INFO, including the parent process ID of the new process, the creator process ID of the new process (CreatingThreadId->UniqueProcess), the thread ID of the process that created the new process (CreatingThreadId->UniqueThread), the file object of the new process's exe file, the absolute path of the exe file, the command-line arguments for the creation of the new process, and the status of the creation of the new process (which can control whether the new process is allowed to be created), etc.

[0047] When a process exits on a terminal device, the callback function can obtain the process ID (e.g., obtainable from the HANDLE parameter) and process body (e.g., obtainable from the PEPROCESS type parameter, representing a pointer to the process object of the process to be exited). When a process on the terminal device is about to be created or exit, specific process information is obtained from the callback function, and several doubly linked lists (using the Windows kernel's LIST_ENTRY doubly linked list structure) are constructed to store the current terminal device's dynamic process cache in the kernel's Ring 0 layer. Each node in the doubly linked list structure of the dynamic process cache represents information about processes currently created and not yet exited on the terminal device. When a process is created, the newly created process information node is added to the doubly linked list structure; when a process exits, the node is removed from the doubly linked list structure. The doubly linked list structure of the dynamic process cache can include process attribute characteristic information.

[0048] For example, the structure of a dynamic process cache can be as follows:

[0049] typedef struct_DEV_PROC_CACHE

[0050] {

[0051] LIST_ENTRY list; / /

[0052] LONG count; / / Number of nodes

[0053] KSPIN_LOCK lock; / / Spin lock

[0054] }DEV_PROC_CACHE,*PDEV_PROC_CACHE;

[0055] The doubly linked list structure of a dynamic process cache can be shown below:

[0056] typedef struct_DEV_PROC_ELEM

[0057] {

[0058] LIST_ENTRY list;

[0059] HANDLE SelfProcessId; / / The ID of the current process itself

[0060] HANDLE ParentProcessId; / / Parent process ID of the current process

[0061] HANDLE CreatorProcessId; / / The process ID of the current process's creator.

[0062] struct _FILE_OBJECT* FileObject; / / A pointer to the _FILE_OBJECT object, representing a file object.

[0063] UINT32 crcExePathHash; / / The full path CRC encoding value of the executable file corresponding to the process.

[0064] PUNICODE_STRING exeName; / / Process name

[0065] PUNICODE_STRING exeSignature; / / Process signature information

[0066] PUNICODE_STRING exeCopyright; / / Process copyright information

[0067] PUNICODE_STRING exeFileMd5; / / MD5 hash of the executable file corresponding to the process.

[0068] PUNICODE_STRING exeModifyTime; / / Last modified time of the executable file corresponding to the process.

[0069] PUNICODE_STRING CommandLine; / / Command line information corresponding to the process (maximum length limited)

[0070] }DEV_PROC_ELEM,*PDEV_PROC_ELEM;

[0071] Furthermore, when process creation is captured in the process's callback function, a node can be added to the doubly linked list structure, for example, adding a DEV_PROC_ELEM node to DEV_PROC_CACHE. When process exit is captured, the DEV_PROC_ELEM node matching the process ID is deleted from the doubly linked list structure (DEV_PROC_CACHE). When the terminal device driver service first starts, the dynamic process cache DEV_PROC_CACHE is empty. By dynamically adding and deleting nodes, information about all processes currently created and not yet exited on the device is stored.

[0072] The dynamic process cache DEV_PROC_CACHE asynchronously sends the corresponding process attribute information (such as process ID, process name, and converted absolute process path) to the user-space process in the Ring3 layer when synchronously adding (when a process is created) and synchronously deleting (when a process exits) linked list nodes. Upon receiving the attribute information of the newly created process, the Ring3 layer calculates the last modified time (updatetime) of the process executable file based on the process ID (i.e., process PID, used to uniquely identify a process, such as a randomly assigned process number) and the absolute path (procpath). It then obtains the process version number (filever), the description information of the process executable file (filedesc), the size of the process executable file (filesize), and the copyright information (copyright) based on the absolute path (procpath). Simultaneously, it calculates the process's MD5 hash, the signer's name (sign_issuer) in the digital signature of the process executable file, and the local signature verification result (sign_check_rst) in parallel based on the absolute path (procpath). Local signature verification results include: digital signature verification passed (SIGN_CHECK_PASS), digital signature verification failed (SIGN_CHECK_FAILED), digital signature verification timed out (SIGN_CHECK_TIMEOUT), and process without digital signature (PROC_NO_SIGN_INFO). After calculating this information, on the one hand, it sends the signature information, copyright information, and MD5 hash of each node in the dynamic process cache DEV_PROC_CACHE to the Ring0 layer to update them. On the other hand, it reports the process's attribute characteristics to the server. The server can form an application library based on the attribute characteristics of the processes reported by each enterprise terminal. Based on the copyright information and signature information of the processes corresponding to the applications, the applications are classified, such as office editing software, email clients, IM communication software, IDE categories, etc. On the terminal device, as processes are created and exited, the kernel layer and user layer of the terminal device communicate in real time, storing the characteristic information of all currently running processes in the dynamic process cache DEV_PROC_CACHE. In other words, by monitoring the creation and exit of all processes, the terminal device can identify the first process that is running, as well as the processes associated with the first process, which facilitates further judgment of the process by combining the process's file access behavior.

[0073] It's understandable that a process's parent process isn't necessarily its creator process. While the parent process typically creates child processes, in scenarios involving privilege escalation, the parent and creator processes are distinct. To precisely manage processes, it's necessary to consider both the current process's parent and creator processes (where other processes are either the current process's parent or creator), as well as processes created or child processes by the current process (where the current process is either the parent or creator of other processes). This prevents overlooking processes with relationships (such as hierarchical or creation relationships), thereby reducing the risk of data leaks and improving data security.

[0074] Optionally, the terminal device can monitor process file operations at the Ring 0 layer. For example, file system minifilter drivers can be used to monitor process read operations on files, primarily focusing on ReadFile (a Windows API representing reading file content or attributes). Further, to reduce the amount of monitoring data, read operations with an Offset of 0 can be filtered out using the FLT_IO_PARAMETER_BLOCK type parameter during I / O operations; that is, monitoring the process's first read of a block of file content. Since a process may perform numerous ReadFile operations (reading one block of file content each time and using pointers to indicate the read position) when reading a file, this method can effectively reduce the amount of monitoring data and improve the performance of monitoring process file access. In this way, process file operations can be monitored to identify processes with file access behavior, and ultimately, the files accessed based on this behavior (hereinafter referred to as accessed files).

[0075] Optionally, key applications on the terminal device can be pre-marked. When determining the first running process on the terminal device, this first running process can be identified from among these key applications. Alternatively, key processes on the terminal device can be pre-marked. When determining the first running process on the terminal device, this first running process can be identified from among these key processes. By pre-marking applications or processes, customized detection of certain specific applications or processes can be achieved, making the detection method more flexible. It eliminates the need to monitor all processes, saving resources and further improving data processing efficiency.

[0076] S102, Based on the touched files and filtering rules corresponding to the file touching behavior of the second process, determine the sensitive process from the second process.

[0077] In this embodiment, the server can send filtering rules to the terminal device. The terminal device can then identify sensitive processes from the second process based on the touched files corresponding to the file touching behavior of the second process and the filtering rules. To focus on identifying file outbound behavior of key processes and reduce the amount of audit data reported by the terminal device, the server can send filtering rules for processes or files of key concern. When the filtering rules are met, the terminal device then reports the data, which can reduce the amount of data and improve the efficiency of data processing.

[0078] Optionally, the filtering rules may include file filtering rules and process filtering rules. The terminal device can then combine these rules to filter the second process and identify sensitive processes from among them. Specifically, the terminal device can obtain a fourth process that matches the file filtering rules based on the file touch behavior of the second process; obtain the attribute feature information of the fourth process; and based on this information, obtain a fifth process that matches the process filtering rules, identifying sensitive processes from among the fifth processes. Optionally, the filtering rules may also include only one of file filtering rules or process filtering rules. In this case, the terminal device can combine either file filtering rules or process filtering rules to filter the second process and identify sensitive processes from among them.

[0079] File filtering rules can be used to filter files that do not conform to the rules. For example, they can be used to determine whether a file is a sensitive file (i.e., sending such a sensitive file by a process may cause a data leakage risk). If the file is not sensitive, sending such a file will not cause a data leakage risk, so it can be ignored. File filtering rules can include file name, file extension, file size, file directory, etc. In other words, if the file name, file extension, file size, or file directory of any file is the same as one or more of the file name, file extension, file size, or file directory included in the file filtering rules, then the file meets the file filtering rules. Process filtering rules can include process attribute characteristic information.

[0080] In specific implementation, when the terminal device obtains a touched file corresponding to the file touching behavior of the second process, it can determine whether the touched file conforms to the file filtering rules. If the touched file does not conform to the file filtering rules, it can be ignored. If there is a fourth process in the second process that conforms to the file filtering rules, the terminal device can obtain the attribute feature information of the fourth process and match it with the process filtering rules. If there is a fifth process in the fourth process that matches the process filtering rules, the fourth process can be further filtered to identify sensitive processes from the fifth process. It can be understood that the number of the first, second, fourth, and fifth processes can be one or more. If there are multiple processes, the above method can be used to filter multiple processes at different levels, eliminating processes that do not pose a risk of file outgoing, thereby identifying processes that pose a risk of file outgoing (i.e., sensitive processes), and then controlling the sensitive processes. If there is only one first process, it can be judged sequentially based on the above method. If it does not meet the conditions, it means that the first process is not a sensitive process and can be ignored.

[0081] Optionally, since the attribute characteristics of the fourth process include both the attribute characteristics of the fourth process itself and the attribute characteristics of its associated processes (including at least one of the parent process, child process, and creator process), when obtaining the fifth process matching the process filtering rules based on the attribute characteristics of the fourth process, the fifth process matching the process filtering rules can be obtained based on both the attribute characteristics of the fourth process and the attribute characteristics of its associated processes. In other words, the terminal device can combine the attribute characteristics of the fourth process and the attribute characteristics of its associated processes with the process filtering rules to determine the fifth process. Because the fourth process and associated processes are closely related, if the attribute characteristics of the associated process match the process filtering rules, the fourth process corresponding to the associated process can be identified as the fifth process. This prevents processes with hierarchical relationships to processes that meet the filtering rules from being missed, thereby improving the accuracy of identifying sensitive processes.

[0082] Optionally, if the touched file corresponding to the second process does not conform to the file filtering rules, it means that the touched file is not risky, and the processing of the touched file can be ignored. If all the touched files corresponding to the file touching behavior of a certain process do not conform to the file filtering rules, the processing of that process can be ignored, thereby improving data processing efficiency. Further, if the touched file conforms to the file filtering rules, the attribute feature information of the fourth process operating on the currently touched file can be obtained through PsGetCurrentProcess. For example, the attribute feature information of the fourth process can be obtained by querying the dynamic process cache, including the process name, copyright information, and signature of the fourth process. This information is then matched with the process filtering rules issued by the server. If the match is successful, it can be identified as the fifth process. The File System Minifilter Drivers report to the application layer of the terminal device, and the application layer of the terminal device performs further judgment to determine whether the fifth process is a sensitive process.

[0083] Since a process's file reading operation is not necessarily a file sent over the network, it may be reading a local file on the terminal device, or it may be that the application to which the process belongs needs to read some temporary files or result data. Therefore, the data corresponding to the file touch behavior of the fourth process reported by the terminal device's driver layer is basic data, which needs to be denoised to remove the file reading behavior that the application itself must perform, leaving the reading records of files that are unrelated to the application in the terminal environment.

[0084] Optionally, the method for determining sensitive processes from the fifth process in this application embodiment may include one or more of the following:

[0085] The first method involves the terminal device determining whether the file touched by the fifth process belongs to the application file of the application to which the fifth process belongs, and then identifying the sensitive process from the fifth process based on the application file. If the file touched by the fifth process belongs to the application file of the application to which the fifth process belongs, it can be considered a file of the application itself, and the touching behavior is a normal touching behavior, so it is ignored. If the file touched by the fifth process does not belong to the application file of the application to which the fifth process belongs, it can be considered not a file of the application itself, or it can be further judged by combining the methods described below to determine whether the fifth process is a sensitive process.

[0086] In practice, the terminal device can compare the file path of the file touched by the fifth process with the installation directory of the application to which the fifth process belongs. If the file path is in the installation directory and the file type is a PE file (portable executable file), the device can further compare whether the file signature is consistent with the signature information of the fifth process of the application. If they are consistent, the file is considered to be the application's own file and is ignored.

[0087] The second method involves the terminal device acquiring the frequency at which the fifth process reads files, and then identifying sensitive processes within the fifth process based on this frequency. Specifically, the terminal device can determine the sensitive processes based on the frequency at which the application to which the fifth process reads files. If files in a certain directory or path are read periodically, and the frequency exceeds a set value, they can be considered executable files or temporary files required for the process's own operation and ignored.

[0088] The third method involves the terminal device acquiring target process category data and identifying sensitive processes from the fifth process based on this data. The target process category data indicates whether the fifth process belongs to the whitelist. Specifically, the terminal device can obtain the process categories stored on the server, as well as historical statistics on the risk of outbound data transmission from these processes. Each process is then categorized, and processes with an outbound risk lower than the target number of occurrences, or specific processes, can be added to the whitelist. For example, for editing software and IDEs, the terminal device can make judgments based on whitelisting rules. If a process belongs to the whitelist, its file access behavior can be ignored, considered a local operation, and there is no risk of data leakage or a low risk of data leakage.

[0089] The fourth method involves the terminal device acquiring network access traffic data of the fifth process and identifying sensitive processes based on this data. Specifically, the terminal device can consider the process's network operations. If there is no network access traffic data for the fifth process within the target time period before and after it reads a file, it is assumed that the fifth process is reading the file locally and has no outbound activity, thus it can be ignored. Optionally, the terminal device can also compare the network access traffic data of the fifth process with a traffic threshold. If the network access traffic data of the fifth process is greater than the traffic threshold, the attribute characteristics of the fifth process can be reported to the server for processing; if the network access traffic data of the fifth process is less than or equal to the traffic threshold, it can be ignored. This allows for the decision to ignore the latter and report it to the server for auditing based on the magnitude of the network access traffic data.

[0090] Optionally, the terminal device can pre-configure specific policies for auditing file transfers by processes, including filtering the process names of processes sending files and the file extensions operated on by those processes, such as... Figure 4 As shown, Figure 4 This is a schematic diagram illustrating a filtering process and file method provided in an embodiment of this application. The process name to be filtered, i.e., the process name that does not need to be monitored, such as ioa.exe, can be selected. Furthermore, the file extension to be filtered can be selected, such as .txt. After selecting the process name and file extension, there is no need to process processes matching that process name or files matching that extension, thus reducing data volume and improving data processing efficiency.

[0091] S103, when a third process on the terminal device is detected to have file outgoing behavior, a processing strategy for the file outgoing behavior of the third process is determined based on the matching result between the sensitive process and the third process.

[0092] In one possible implementation, when a third process on a terminal device is detected to be making file outreach, the terminal device can determine a handling strategy for the third process's file outreach based on the matching result between the sensitive process and the third process. If the sensitive process and the third process do not match, the third process is determined not to be a sensitive process, and the handling strategy for the third process's file outreach is determined to be an allow strategy, i.e., allowing the third process to make file outreach. If the sensitive process and the third process match, the third process is determined to be a sensitive process, and the handling strategy for the third process's file outreach is determined to be an intercept strategy, i.e., intercepting the third process's file outreach. Optionally, the terminal device can also report the third process's file outreach to a server for auditing, so as to facilitate further processing of the third process's file outreach. It is understood that when matching the sensitive process with the third process, the matching can be based on the attribute feature information of the sensitive process and the attribute feature information of the third process. If any one or more of the attribute feature information of the third process matches the attribute feature information of the sensitive process, then the third process is determined to be a match with the sensitive process. In other words, if any one of the third process's name, process ID, signature information, or copyright information matches a sensitive process, then the third process can be identified as a sensitive process, which can improve data security.

[0093] In another possible implementation, when a third process on the terminal device is detected to be sending files out of the terminal, the terminal device can also combine one or more of the following methods to determine the processing strategy for the third process's file sending behavior: the matching result between the sensitive process and the third process, whether the sent file is a sensitive file, whether the third process's file sending behavior is an internal enterprise interaction, the target risk level corresponding to the third process's file sending behavior, and whether the sending behavior matches the high-risk sending model.

[0094] For example, a terminal device can obtain access control policies and determine, based on these policies, whether the file outgoing behavior of a third process constitutes internal interaction. If it is internal interaction and the third process is not a sensitive process, then the processing policy for the file outgoing behavior of the third process can be determined to be an allow policy. The access control policy can be used to indicate which sites are internal to the enterprise; that is, the terminal device's act of sending files to internal sites refers to data interaction between internal terminals, thus improving the accuracy of process identification.

[0095] In this embodiment, by determining a first process that is running on the terminal device, a second process with file-touching behavior can be identified from the first process. The second process can be identified by combining the process's running state and its file-touching behavior. Further, based on the touched files and filtering rules corresponding to the second process's file-touching behavior, sensitive processes can be identified from the second process. This allows for further filtering of the second process to determine sensitive processes. By judging the processes on the terminal device and identifying sensitive processes, it is easier to quickly determine whether a process is sensitive when it is subsequently detected to have file-outgoing behavior, and to take corresponding processing strategies. Further, when a third process on the terminal device is detected to have file-outgoing behavior, a processing strategy for the third process's file-outgoing behavior can be determined based on the matching result between the sensitive process and the third process. If the third process is a sensitive process, the processing strategy for its file-outgoing behavior can be determined as an interception strategy, thereby controlling the process's outgoing behavior, reducing the risk of data leakage, and improving data security. If the third process is not a sensitive process, the processing strategy for its file-outgoing behavior can be determined as an allow strategy, which will not affect the normal operation of the application to which the process belongs, and can improve the user experience.

[0096] Optional, please see Figure 5 , Figure 5 This is a flowchart illustrating another data processing method provided in an embodiment of this application. This data processing method can be applied to terminal devices; such as... Figure 5 As shown, this data processing method includes, but is not limited to, the following steps:

[0097] S201, determine the first process that is in the open state on the terminal device, and determine the second process that has file touching behavior from the first process.

[0098] S202, Based on the touched files and filtering rules corresponding to the file touching behavior of the second process, determine the sensitive process from the second process.

[0099] In this embodiment of the application, the specific implementation of steps S201 to S202 can refer to the implementation of steps S101 to S102 above, and will not be repeated here.

[0100] S203, Obtain the file change data on the terminal device within the target time period, and generate a file change history based on the change data.

[0101] In this embodiment, file change data on a terminal device within a target time period can be acquired, and the terminal device generates a file change history based on the change data. The target time period can refer to a period preceding the current moment, such as the previous 1 day, 2 days, 3 days, etc. Change data can include creation, copying, moving, renaming, writing, etc. Specifically, a file audit operation switch can be enabled, allowing the terminal device to continuously monitor various user operations on files through processes, such as creation, copying, moving, renaming, writing, etc. Based on this change data and the control granularity, and considering the upper limit of the amount of monitoring data that can be processed per unit time, the terminal device can set file operation behavior filtering conditions. For example, it can set which file operation behaviors to ignore, and can also set filtering conditions including file extensions, filenames, or other file attributes, thereby reducing the amount of monitoring data and achieving file change history determination from a file-centric perspective.

[0102] Please see Figure 6 , Figure 6 This is a schematic diagram illustrating a file filtering operation behavior provided in an embodiment of this application, such as... Figure 6 As shown, when the file auditing operation switch is turned on, you can select the file operation behaviors that need to be filtered. For example, if you select to filter file operation behaviors including creation and reading, then when there are read and creation operations on the file on the terminal device, it is not necessary to obtain the data, thereby reducing the amount of data.

[0103] Optionally, file operations on the terminal device can be continuously monitored, and the current file operation log can be stored in a set cache space to form a file change history. The file operation log records a single change to a file, and the file change history is formed by chaining together multiple related file operation records. For example, if file C is written, read by process P, and renamed to B by process E, then the file change history is C (source file) - P (action: read) - E (action: rename) - (current filename).

[0104] S204, retrieve the change history of the target file that matches the file change rule from the change history.

[0105] In this embodiment, the server can send file change rules to the terminal device, and the terminal device can then obtain the change history of the target file that matches the file change rules from the change history record. The target file can refer to a file whose change history matches the file change rules. File change rules can include, but are not limited to, configuration compressed files and generated files, files without any file extension, executable files with abnormally large sizes and no signature information, etc. For example, within a target time period, the operation of compression / decompression applications sequentially reading source files and then generating a target file is one of the key file operation patterns to focus on. That is, if the change history record of a file satisfies that within a target time period, compression / decompression applications sequentially read the source file and then generate a target file, then that file is determined to match the file change rules and is a file of key interest.

[0106] Optionally, while caching file operation logs, the terminal device can asynchronously report the file change history generated by the terminal device to the server. The server can then audit the change history reported by the terminal device based on file change rules. For change history records that the terminal device cannot process (e.g., due to limitations in data volume, memory cache size, and file operation history time span, the terminal device cannot generate corresponding change history records for all monitoring logs), the terminal device can asynchronously batch report such data to the server for auditing processing. Further, optionally, the server can expand upon the change history records reported by the terminal device to form a more complete change history record.

[0107] For example, the change history of a file uploaded by a terminal device might be C (source file) - P (action: read) - E (action: rename) - (current filename). If the monitoring data stream reported by the terminal device to the server shows that file B was read by process F and then deleted by process F, the file change history would be C (source file) - P (action: read) - E (action: rename) - B (current filename) - F (action: read) - F (action: delete). By expanding the file change history reported by the terminal device, the server can more accurately reflect the file changes. In other words, the server can receive file change rules uploaded by the terminal device, match the file change history with the file change rules, and determine the change history of the target file that matches the file change rules. Alternatively, the server can send file change rules to the terminal device, which can then match the file change history with the file change rules to determine the change history of the target file that matches the file change rules. This embodiment of the application does not limit this approach. When a terminal device matches a file's change history with the file change rules, the server can expand the change history reported by the terminal device and send the expanded change history to the terminal device so that the terminal device can make further judgments based on the expanded change history to determine whether the file is a sensitive file.

[0108] S205, matching the target file's change history with file filtering rules.

[0109] In this embodiment, the terminal device can match the target file's change history with file filtering rules. The target file refers to a file whose change history matches the file change rules. Since file filtering rules include, but are not limited to, one or more of the following: file name, file extension, file size, and identical file directory, and the target file's change history includes a series of changes to the target file, the change history of the target file can be matched with the file filtering rules to determine whether the change history matches the file filtering rules. For example, if the file filtering rules include file names, and the target file's change history consists of changes to the file name, such as C (source file) - P (action: rename) - B (file name) - E (action: rename) - D (current file name), then all file names in the change history can be matched with the file names in the file filtering rules. If any file name in the change history matches a file name in the file filtering rules, the target file is determined to be a sensitive file. If no file name in the change history matches a file name in the file filtering rules, the target file is determined not to be a sensitive file.

[0110] Understandably, if the file filtering rules include one or more of the following: filename, file extension, file size, and file directory, then multiple matches can be made between the filename, file extension, file size, and file directory and the target file's change history. If any one or more of the following match the target file's change history, the target file is determined to be a sensitive file. If none of the following match the target file's change history, the target file is determined not to be a sensitive file.

[0111] S206. If the change history of the target file matches the file filtering rules, the target file is identified as a sensitive file.

[0112] In this embodiment of the application, if the change history of the target file matches the file filtering rules, it indicates that the target file is a sensitive file. For example, for certain sensitive files, by modifying the file name or file extension and then performing file outgoing behavior, such sensitive files can be detected, thereby improving the accuracy of sensitive file detection.

[0113] S207: When a third process on the terminal device is detected to be sending files outside the terminal, a processing strategy for the file sending behavior of the third process is determined based on the matching result between the sensitive process and the third process, as well as the sensitive file.

[0114] In this embodiment, when a third process on a terminal device is detected to be sending files out of the terminal, it can be determined whether the third process is a sensitive process and whether the file sent by the third process is a sensitive file, thereby determining the processing strategy for the third process's file out-of-the-term behavior. For example, if the third process is a sensitive process and the file sent by the third process is determined to be a sensitive file, the processing strategy for the third process's file out-of-the-term behavior can be determined to be an interception strategy, thereby intercepting the third process's file out-of-the-term behavior, reducing the risk of data leakage, and improving data security. Alternatively, if the third process is not a sensitive process and the file sent by the third process is determined to be a non-sensitive file, the processing strategy for the third process's file out-of-the-term behavior can be determined to be an allow strategy, thereby allowing the third process's file out-of-the-term behavior, ensuring the normal operation of the process, and improving user experience. Optionally, if the third process is not a sensitive process but the file sent by the third process is a sensitive file, the processing strategy for the third process's file out-of-the-term behavior can also be determined to be an interception strategy. Alternatively, if the third process is a sensitive process but the file sent by the third process is not a sensitive file, the processing strategy for the third process's file out-of-the-term behavior can be determined to be an allow strategy. Alternatively, if the third process is a sensitive process, but the file sent by the third process is not a sensitive file, the handling strategy for the third process's file outgoing behavior can be determined to be an interception strategy. By reporting the third process's file outgoing behavior to the server, data security can be improved.

[0115] Optionally, the terminal device can obtain access control policies and determine the handling strategy for the file outgoing behavior of the third process based on the access control policies. Specifically, the terminal device can obtain access control policies and determine whether the file outgoing behavior of the third process is an internal interaction behavior based on the access control policies; if the file outgoing behavior of the third process is not an internal interaction behavior, and the file sent is a sensitive file, and the third process matches a sensitive process, then the handling strategy for the file outgoing behavior of the third process is determined to be an interception strategy.

[0116] The server can send access control policies to terminal devices. These policies may include, but are not limited to, internal site information, such as domain names or IP addresses, port identifiers, etc. Specifically, the terminal device can obtain the ID of the third process and the target site information corresponding to the third process's file outbound behavior. If the target site information matches the site information in the access control policy issued by the server, the third process's file outbound behavior is determined to be an internal interaction, meaning the third process is exchanging data with terminal devices within the enterprise. If the target site information does not match the site information in the access control policy issued by the server, the third process's file outbound behavior is determined to be a non-internal interaction, meaning the third process is exchanging data with terminal devices outside the enterprise.

[0117] In practice, if the access control policy issued by the server determines that all access sessions initiated by the third process within the current time interval are for enterprise resources and there are no non-enterprise resource accesses, then it is considered an internal enterprise interaction, i.e., data transmission between internal terminal devices, and is ignored. If the access control policy issued by the server determines that there are non-enterprise resource accesses among all access sessions initiated by the third process within the current time interval, then it is considered that non-enterprise internal interaction may occur, i.e., enterprise data outbound behavior. In this case, the terminal device can intercept the process's file outbound behavior and collect traffic characteristic data, such as target address, traffic size, process attribute characteristic data, etc. On the one hand, the collected traffic characteristic data can be sent to the server for auditing processing; on the other hand, the traffic characteristic data can be cached on the terminal device and periodically reported to the server for auditing.

[0118] Optionally, if the processing strategy for the file outbound behavior of the third process is an interception strategy, then the identifier of the target site associated with the file outbound behavior of the third process is obtained, and the identifier of the target site is matched with the identifier of the target sensitive site. The target site may include a target address. If the identifier of the target site matches the identifier of the target sensitive site, then when a network access request is initiated by the third process to the target site, the network access request is intercepted and reported to the server. Optionally, the server may send the identifier of the target sensitive site to the terminal device, and the terminal device may match the identifier of the target sensitive site with the identifier of the target site associated with the file outbound behavior of the third process to determine whether the target site associated with the file outbound behavior of the third process is a sensitive site. If it is a sensitive site, then when the terminal device subsequently obtains information that the third process reads a file and initiates a network access request to the sensitive site, the terminal device may intercept the network access request and report the network access request to the server. In other words, when it is determined that the target site associated with the file outgoing behavior of the third process is a sensitive site, it means that the target site has a high risk. Subsequently, when it is determined that the third process reads the file and initiates a network access request to the sensitive site, it means that the network access has a high risk. The process can then be intercepted and reported to the server for auditing.

[0119] Optionally, the terminal device can also obtain the target risk level corresponding to the file outbound behavior of the third process, and determine the processing strategy by combining the target risk level with the file outbound behavior of the third process. Specifically, the terminal device can obtain the target risk level corresponding to the file outbound behavior of the third process, which is determined based on the sensitivity level of the third process and / or the sensitivity level of the file sent by the third process; if the target risk level corresponding to the outbound behavior is greater than the target level, and the outbound behavior matches the reference outbound behavior in the high-risk outbound model, then the processing strategy for the file outbound behavior of the third process is determined to be an interception strategy; if the target risk level corresponding to the outbound behavior is less than or equal to the target level and / or the outbound behavior does not match the reference outbound behavior in the high-risk outbound model, then the processing strategy for the file outbound behavior of the third process is determined to be an allow strategy, and the file outbound behavior is backed up and reported to the server.

[0120] The terminal device can pre-set the sensitivity levels of each file and each process. When it detects file outbound behavior from a third process, it can determine the target risk level of the third process's file outbound behavior based on the sensitivity levels of the third process and the files it sends. If the target risk level of the outbound behavior is greater than the target level, and the outbound behavior matches a reference outbound behavior in the high-risk outbound model, it indicates that the third process's file outbound behavior has a high risk, and the processing strategy for the third process's file outbound behavior can be determined as an interception strategy. If the target risk level of the outbound behavior is less than or equal to the target level and / or the outbound behavior does not match a reference outbound behavior in the high-risk outbound model, it indicates that the third process's file outbound behavior has a low risk or no risk, and the processing strategy for the third process's file outbound behavior can be determined as an allow strategy. The high-risk outbound model includes multiple reference outbound behaviors; that is, if the third process's file outbound behavior matches any one of the reference outbound behaviors in the high-risk outbound model, then the third process's outbound behavior is determined to match the high-risk outbound model. Optionally, the reference outbound behaviors in the high-risk outbound model include, but are not limited to, compressing and sending sensitive files, archiving sensitive files as unsigned .exe files, and converting sensitive files into image files.

[0121] In practical implementation, the terminal device can provide an interface for a high-risk outbound model. If it is determined that the target risk level corresponding to the outbound behavior of a third-party file is greater than the target level, and the outbound behavior matches the reference outbound behavior in the high-risk outbound model, then blocking is immediately executed, interrupting the third terminal's file outbound behavior. Furthermore, abnormal information can be displayed on the terminal device's interface to alert the user to the abnormal operation, and the third terminal's file outbound behavior can be reported to the server for auditing. For other behaviors, such as when the target risk level corresponding to the outbound behavior is less than or equal to the target level and / or the outbound behavior does not match the reference outbound behavior in the high-risk outbound model, the third terminal's file outbound behavior can be allowed. Simultaneously, screenshot and backup operations can be performed on the third terminal's file outbound behavior, and the screenshots and backups can be reported to the server.

[0122] Optionally, the server can categorize applications that may be sending files out of the server based on their sensitivity. For applications with a sensitivity level greater than the sensitivity threshold (high sensitivity), such as IM software and cloud storage software, the restrictions on auditing and reporting to the server can be relaxed. Any file access action by the high-sensitivity application, its child processes, creator processes, or parent processes will be reported as a file outflow, since reading the application's file content itself constitutes information leakage for high-sensitivity applications. For applications with a sensitivity level less than or equal to the sensitivity threshold (low sensitivity), the restrictions on auditing and reporting to the server can be tightened. Reporting or blocking will only occur if certain rules (e.g., certain predefined conditions) are met. This improves the accuracy of identifying file outflows by processes and reduces the impact of frequent process interventions on user network access, thus enhancing the user experience.

[0123] Optionally, when a process on the terminal device is detected to be sending files out of the terminal, the terminal device can also perform automatic screenshot operation, and perform automatic backup and reporting to the server for files whose size is lower than a set threshold, for auditing and security incident backtracking.

[0124] The method described in this application is universal and covers a wide range of scenarios. It can monitor and audit the file sending behavior of commonly used application processes, including scenarios where users actively send files and applications delay sending files. Furthermore, this technical solution is non-intrusive to the application itself and does not require process injection operations. Therefore, it will not affect the availability of other applications on the terminal. It only performs synchronous blocking processing on files designated as sensitive, sensitive processes, and outgoing behaviors judged as high-risk. In other scenarios, it silently performs automatic screenshotting and file backup, and reports to the server for storage. This reduces the risk of data leakage, enhances security, and effectively improves the user experience for end users.

[0125] In some embodiments, the terminal device can obtain the file change history on the terminal device, match the file change history with file change rules to identify sensitive files on the terminal device, and then, when a third process on the terminal device is detected to be engaging in file outreach behavior, determine a processing strategy for the third process's file outreach behavior based on the sensitive files. Optionally, the terminal device can also identify sensitive processes and determine sensitive files by matching the file change history with file change rules, and when a third process on the terminal device is detected to be engaging in file outreach behavior, determine a processing strategy for the third process's file outreach behavior based on the matching result between the sensitive process and the third process, as well as the sensitive files. This embodiment of the application does not limit this approach.

[0126] Optionally, the technical solutions of this application embodiment can be implemented within a zero-trust network architecture. For example, the technical solutions of this application can be implemented based on a zero-trust security management system (Intelligent Office Automation, iOA), which can ensure an efficient and stable remote collaborative office experience and promote the application of zero-trust technology in the digital industry. Specifically, iOA can act as a zero-trust network security service provider, providing a unified entry point for access subjects to access resources of objects via network requests through a zero-trust access proxy and a smart gateway. iOA provides authentication operations for the unified entry point; only network requests that have passed authentication can be forwarded by the zero-trust access proxy to the smart gateway, which then proxies access to the actual business system. Please refer to [link to relevant documentation]. Figure 7 , Figure 7 This is a schematic diagram of a zero-trust network architecture provided in an embodiment of this application. Figure 7The main modules include the iOA client, iOA server, access proxy, and smart gateway. The iOA client, installed on the terminal devices used by enterprise users, is a security proxy responsible for verifying the trusted identity of users on these devices, the trustworthiness of the devices and applications, and requesting process checks from the server for unknown processes. The access proxy can be used to hijack terminal device traffic via TUN / TAP virtual network cards. After authentication by the iOA client, it forwards the request to the smart gateway; otherwise, it either connects directly or disconnects. The smart gateway can be deployed at the entry point of enterprise applications and data resources, responsible for verifying, authorizing, and forwarding each session request accessing enterprise resources. The iOA server is used to securely schedule business traffic by issuing policy rules, such as filtering rules, and authorizing at the person-device-software-application granularity. The iOA server can include an authentication module, a device trust module, and an application detection module. The authentication module verifies user identity, the device trust module verifies device hardware information and security status, and the application detection module detects the security of application processes, such as vulnerabilities and viruses / Trojans. The iOA server can periodically send files to the threat intelligence cloud service Anzhi or TAV for inspection. If a malicious process is identified, the iOA client will be notified to perform an asynchronous blocking operation.

[0127] Furthermore, such as Figure 7As shown, the accessing entity initiates a network request against the accessing object through the application. The iOA client intercepts the network request through the access proxy. The access proxy sends an authentication request to the iOA client (i.e., the access proxy requests credentials for the current network request from the iOA client). The request parameters include the source IP or domain name, source port, destination IP or domain name, destination port, and the process ID corresponding to the application. The iOA client collects the process's MD5 hash, process path, last modification time, copyright information, signature information, etc., using the process ID sent by the access proxy. Together with the source IP or domain name, source port, destination IP or domain name, and destination port of the network request transmitted by the access proxy, the iOA client requests a ticket from the iOA server. If the request is successful, the client sends the ticket, the maximum number of times the ticket can be used, and the ticket's validity period as a ticket response to the access proxy. The access proxy then sends an HTTPS request to the smart gateway, including the network request credentials (ticket) transmitted by the iOA client in the Authorization header field. After receiving a request from the access proxy, the smart gateway parses the ticket from the header fields and verifies the ticket with the iOA server. If the verification is successful, the smart gateway and the access proxy successfully establish a connection. The access proxy then sends the original network request to the smart gateway, which forwards it to the corresponding business server, proxying the actual application network access. If the ticket verification fails, the connection between the access proxy and the smart gateway is interrupted. Optionally, for traffic from applications outside the zero-trust policy accessing specific sites, a direct connection is established by initiating a network access request directly to the business server through the access proxy.

[0128] Understandably, the iOA client and access agent can work together to perform the aforementioned terminal device operations. For example, the iOA client can identify the first process that is running on the terminal device, and from the first process, identify the second process that has file access behavior. Based on the file access behavior of the second process and the corresponding accessed file and filtering rules, the sensitive process can be identified from the second process, and so on. The access agent can detect the file outbound behavior of the third process. The iOA client can request authentication for the file outbound behavior of the third process to determine whether the third process has outbound permission. For example, if the third process is not a sensitive process, it means it has outbound permission, and a connection is established between the access agent and the smart gateway, and the file is sent to the corresponding business server through the smart gateway. If the third process is a sensitive process, it means it does not have outbound permission, and the connection between the access agent and the smart gateway is interrupted, thereby intercepting the file outbound behavior of the third process.

[0129] Optionally, enterprise administrators can configure business access policies on the management terminal, distinguishing between access to sensitive and non-sensitive business systems. For sensitive business systems, they can configure corresponding access policies to deny or verify access; for non-sensitive business systems, they can configure corresponding access policies to allow access. For example... Figure 8 As shown, Figure 8 This is a schematic diagram illustrating a configuration of service access policies provided in an embodiment of this application. For the first type of user, if the access policy is for non-sensitive permissions, the policy type can be set to "Allow Access". For the second type of user, if the access policy is for highly sensitive permissions, the policy type can be set to "Deny Access". For the third type of user, if the access policy is for highly sensitive permissions, the policy type can be set to "Verify Access". Since the three types of users have different permissions, the specified policies are also different, and the service resources that the users can access are also different.

[0130] Furthermore, enterprise administrators can formulate resource access policies by combining the three elements of users, applications, and resources. For example, administrators can configure which users can access which resources, which users need authentication to access which resources, and which users are prohibited from accessing which resources. Optionally, administrators can configure dynamic factors, such as specified network locations or network location switching. Figure 9 As shown, Figure 9 This is a schematic diagram illustrating a resource access policy configuration provided in this application embodiment. After the enterprise administrator configures the policy rules, for example, the Human Resources group can access the Human Resources group website and OA site through a specified application based on a specified network location, while non-Human Resources groups cannot access the Human Resources group website and OA site. In one possible scenario, if a terminal device detects that a user from the Human Resources group has switched network locations (i.e., switched to a non-specified network location to access the Human Resources group website and OA site) after specifying a network location, it can report this to the server for auditing. Optionally, dynamic factors can also include webpage access frequency behavior; for example, when the access frequency of a certain webpage exceeds a frequency threshold, the terminal device can report this to the server for auditing. After configuring the resource access policy, the corresponding page can be accessed as follows... Figure 9 As shown, after configuring the resource access policy, when an access request from a user that conforms to the resource access policy is detected, resource access is granted; when an access request from a user that does not conform to the resource access policy is detected, it is reported to the server for auditing, thereby improving data security.

[0131] In this embodiment, by acquiring the file change history process on the terminal device and further judging the files in conjunction with file change rules, the accuracy of identifying sensitive files can be improved. Furthermore, by combining sensitive files and sensitive processes to judge the outward file behavior of processes—that is, judging the outward file behavior of processes from multiple dimensions—the accuracy of the judgment can be improved, thereby reducing the risk of data leakage and enhancing data security.

[0132] The methods of the embodiments of this application have been described above, and the apparatus of the embodiments of this application will be described below.

[0133] See Figure 10 , Figure 10 This is a schematic diagram of the structural composition of a data processing apparatus provided in an embodiment of this application. The data processing apparatus can be a computer program (including program code) running on a terminal device; the data processing apparatus can be used to execute corresponding steps in the data processing method provided in the embodiment of this application. For example, the data processing apparatus 100 includes:

[0134] The status acquisition unit 1001 is used to acquire the first process that is in the open state on the terminal device, and determine the second process with file touching behavior from the first process;

[0135] The process filtering unit 1002 is used to determine sensitive processes from the second process based on the touched files and filtering rules corresponding to the file touching behavior of the second process.

[0136] The strategy determination unit 1003 is used to determine a processing strategy for the file outsourcing behavior of the third process based on the matching result between the sensitive process and the third process when a third process on the terminal device is detected to have file outsourcing behavior.

[0137] Optionally, the filtering rules include file filtering rules and process filtering rules; the process filtering unit 1002 is specifically used for:

[0138] Based on the file touching behavior of the second process, obtain the fourth process that matches the file filtering rules;

[0139] Obtain the attribute feature information of the fourth process, obtain the fifth process that matches the filtering rules of the fourth process based on the attribute feature information of the fourth process, and determine the sensitive process from the fifth process.

[0140] Optionally, the attribute feature information of the fourth process includes the attribute feature information of the fourth process itself and the attribute feature information of the associated processes of the fourth process, wherein the associated processes include at least one of the parent process, child process, and creator process of the process; the process filtering unit 1002 is specifically used for:

[0141] Based on the attribute characteristics of the fourth process and the attribute characteristics of the associated process, a fifth process that matches the filtering rules of the process is obtained.

[0142] Optionally, the method for identifying sensitive processes from the fifth process includes one or more of the following:

[0143] Determine whether the file accessed by the fifth process belongs to the application file of the application to which the fifth process belongs, and identify the sensitive process from the fifth process based on the application file; or,

[0144] Obtain the frequency at which the fifth process reads files, and use this frequency to identify sensitive processes within the fifth process; or,

[0145] Obtain target process category data, and determine sensitive processes from the fifth process based on this target process category data. This target process category data is used to indicate whether the fifth process belongs to the whitelist; or...

[0146] Obtain network access traffic data of the fifth process, and identify sensitive processes from the fifth process based on the network access traffic data.

[0147] Optionally, the data processing apparatus 100 further includes: a file determination unit 1004, configured to:

[0148] Obtain the file change data on the terminal device within the target time period, and generate a file change history based on the change data;

[0149] Retrieve the change history of the target file that matches the file change rules from the change history;

[0150] Match the target file's change history with file filtering rules;

[0151] If the change history of the target file matches the file filtering rules, then the target file is identified as a sensitive file; this strategy determination unit 1003 is specifically used for:

[0152] When a third process on the terminal device is detected to be sending files outside the device, a processing strategy for the file sending behavior of the third process is determined based on the matching result between the sensitive process and the third process, as well as the sensitive file.

[0153] Optionally, the strategy determining unit 1003 is specifically used for:

[0154] Obtain the access control policy and determine, based on the access control policy, whether the third process’s file outgoing behavior is an internal interaction behavior.

[0155] If the file outgoing behavior of the third process is not an internal interaction behavior, and the file sent is the sensitive file, and the third process matches the sensitive process, then the processing strategy for the file outgoing behavior of the third process is determined to be an interception strategy.

[0156] Optionally, the data processing apparatus 100 further includes: a site matching unit 1005, for:

[0157] If the processing strategy for the file outgoing behavior of the third process is an interception strategy, then obtain the identifier of the target site associated with the file outgoing behavior of the third process, and match the identifier of the target site with the identifier of the target sensitive site.

[0158] If the identifier of the target site matches the identifier of the target sensitive site, then when the third process initiates a network access request for the target site, the network access request is intercepted and reported to the server.

[0159] Optionally, the strategy determining unit 1003 is specifically used for:

[0160] Obtain the target risk level corresponding to the file outgoing behavior of the third process. The target risk level is determined based on the sensitivity level of the third process and / or the sensitivity level of the files sent by the third process.

[0161] If the target risk level corresponding to the outbound behavior is greater than the target level, and the outbound behavior matches the reference outbound behavior in the high-risk outbound model, then the processing strategy for the file outbound behavior of the third process is determined to be the interception strategy.

[0162] If the target risk level corresponding to the outbound behavior is less than or equal to the target level and / or the outbound behavior does not match the reference outbound behavior in the high-risk outbound model, then the processing strategy for the file outbound behavior of the third process is determined to be the allow strategy, and the file outbound behavior is backed up and reported to the server.

[0163] Optionally, the strategy determining unit 1003 is specifically used for:

[0164] If the third process is not the sensitive process, then the policy for handling the file outgoing behavior of the third process is determined to be an allow policy;

[0165] If the third process is the sensitive process, then the handling strategy for the file outgoing behavior of the third process is determined to be an interception strategy.

[0166] It should be noted that, Figure 10 For any content not mentioned in the corresponding embodiments, please refer to the description of the method embodiments, which will not be repeated here.

[0167] In this embodiment, by determining a first process that is running on the terminal device, a second process with file-touching behavior can be identified from the first process. The second process can be identified by combining the process's running state and its file-touching behavior. Further, based on the touched files and filtering rules corresponding to the second process's file-touching behavior, sensitive processes can be identified from the second process. This allows for further filtering of the second process to determine sensitive processes. By judging the processes on the terminal device and identifying sensitive processes, it is easier to quickly determine whether a process is sensitive when it is subsequently detected to have file-outgoing behavior, and to take corresponding processing strategies. Further, when a third process on the terminal device is detected to have file-outgoing behavior, a processing strategy for the third process's file-outgoing behavior can be determined based on the matching result between the sensitive process and the third process. If the third process is a sensitive process, the processing strategy for its file-outgoing behavior can be determined as an interception strategy, thereby controlling the process's outgoing behavior, reducing the risk of data leakage, and improving data security. If the third process is not a sensitive process, the processing strategy for its file-outgoing behavior can be determined as an allow strategy, which will not affect the normal operation of the application to which the process belongs, and can improve the user experience.

[0168] See Figure 11 , Figure 11 This is a schematic diagram of the structural composition of a computer device provided in an embodiment of this application. For example... Figure 11 As shown, the computer device 110 may include a processor 1101, a memory 1102, and a network interface 1103. The processor 1101 is connected to the memory 1102 and the network interface 1103, for example, the processor 1101 can be connected to the memory 1102 and the network interface 1103 via a bus. The computer device can be a terminal device or a server.

[0169] Processor 1101 is configured to support the data processing device in performing the corresponding functions in the data processing method described above. Processor 1101 may be a Central Processing Unit (CPU), a Network Processor (NP), a hardware chip, or any combination thereof. The aforementioned hardware chip may be an Application-Specific Integrated Circuit (ASIC), a Programmable Logic Device (PLD), or a combination thereof. The aforementioned PLD may be a Complex Programmable Logic Device (CPLD), a Field-Programmable Gate Array (FPGA), a Generic Array Logic (GAL), or any combination thereof.

[0170] Memory 1102 is used to store program code, etc. Memory 1102 may include volatile memory (VM), such as random access memory (RAM); memory 1102 may also include non-volatile memory (NVM), such as read-only memory (ROM), flash memory, hard disk drive (HDD), or solid-state drive (SSD); memory 1102 may also include combinations of the above types of memory. In this embodiment of the invention, memory 1102 is used to store website security detection programs, interactive traffic data, etc.

[0171] Network interface 1103 is used to provide network communication functions.

[0172] Processor 1101 can call this program code to perform the following operations:

[0173] Identify the first process that is running on the terminal device, and identify the second process that has file touch behavior from the first process;

[0174] Based on the touched files and filtering rules corresponding to the file touching behavior of the second process, sensitive processes are identified from the second process;

[0175] When a third process on the terminal device is detected to be sending files outside the terminal, a processing strategy for the file sending behavior of the third process is determined based on the matching result between the sensitive process and the third process.

[0176] It should be understood that the computer device 110 described in the embodiments of this application can perform the foregoing... Figure 3 and Figure 5 The description of the data processing method in the corresponding embodiments can also be performed as described above. Figure 11 The description of the data processing apparatus in the corresponding embodiments will not be repeated here. Furthermore, the beneficial effects of using the same method will also not be repeated.

[0177] This application also provides a computer-readable storage medium storing a computer program. The computer program includes program instructions that, when executed by a computer, cause the computer to perform the methods described in the foregoing embodiments. The computer can be part of the aforementioned computer device, such as the processor 1101 described above. As an example, the program instructions can be deployed on a single computer device for execution, or deployed on multiple computer devices located in one location for execution, or executed on multiple computer devices distributed across multiple locations and interconnected via a communication network. These multiple computer devices distributed across multiple locations and interconnected via a communication network can form a blockchain network.

[0178] This application also provides a computer program product or computer program that includes computer instructions stored in a computer-readable storage medium. A processor of a computer device can read the computer instructions from the computer-readable storage medium and execute the computer instructions to cause the computer device to perform the steps described in the embodiments of the above methods.

[0179] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. This program can be stored in a computer-readable storage medium, and when executed, it can include the processes of the embodiments of the methods described above. The storage medium can be a magnetic disk, optical disk, read-only memory (ROM), or random access memory (RAM), etc.

[0180] The above-disclosed embodiments are merely preferred embodiments of this application and should not be construed as limiting the scope of this application. Therefore, any equivalent variations made in accordance with the claims of this application shall still fall within the scope of this application.

Claims

1. A data processing method, characterized in that, include: Identify the first process that is running on the terminal device, and identify the second process that has file touch behavior from the first process; Based on the touched files and filtering rules corresponding to the file touching behavior of the second process, sensitive processes are identified from the second process; Obtain change data of files on the terminal device within a target time period, and generate a change history record of the files based on the change data; Obtain the change history of the target file that matches the file change rules from the change history. Matching is performed based on the target file's change history and file filtering rules; If the change history of the target file matches the file filtering rules, then the target file is identified as a sensitive file; When a third process on the terminal device is detected to be sending files outside the terminal, a processing strategy for the file sending behavior of the third process is determined based on the matching result between the sensitive process and the third process, as well as the sensitive file.

2. The method according to claim 1, characterized in that, The filtering rules include file filtering rules and process filtering rules; The process of determining sensitive processes from the second process based on the touched files and filtering rules corresponding to the file touching behavior of the second process includes: Based on the file touching behavior of the second process, obtain the touched file that conforms to the file filtering rules; Obtain the attribute feature information of the fourth process, obtain the fifth process that matches the process filtering rule based on the attribute feature information of the fourth process, and determine the sensitive process from the fifth process.

3. The method according to claim 2, characterized in that, The attribute feature information of the fourth process includes the attribute feature information of the fourth process and the attribute feature information of the associated processes of the fourth process. The associated processes include at least one of the parent process, child process, and creator process of the process. The step of obtaining a fifth process that matches the process filtering rules based on the attribute feature information of the fourth process includes: Based on the attribute feature information of the fourth process and the attribute feature information of the associated process, a fifth process that matches the process filtering rule is obtained.

4. The method according to claim 2, characterized in that, The method for determining sensitive processes from the fifth process includes one or more of the following: Determine whether the file touched by the fifth process belongs to the application file of the application to which the fifth process belongs, and determine the sensitive process from the fifth process based on the application file; or, The frequency at which the fifth process reads files is obtained, and sensitive processes are identified from the fifth process based on the frequency. or, Obtain target process category data, and determine sensitive processes from the fifth process based on the target process category data, wherein the target process category data is used to indicate whether the fifth process belongs to the whitelist process; or... Obtain network access traffic data of the fifth process, and determine sensitive processes from the fifth process based on the network access traffic data.

5. The method according to claim 1, characterized in that, The step of determining a processing strategy for the file outgoing behavior of the third process based on the matching result between the sensitive process and the third process, and the sensitive file, includes: Obtain the access control policy, and determine whether the third process's file outgoing behavior is an internal interaction behavior based on the access control policy; If the file outgoing behavior of the third process is not an internal interaction behavior, and the file sent is the sensitive file, and the third process matches the sensitive process, then the processing strategy for the file outgoing behavior of the third process is determined to be an interception strategy.

6. The method according to claim 1, characterized in that, The method further includes: If the processing strategy for the file outgoing behavior of the third process is an interception strategy, then the identifier of the target site associated with the file outgoing behavior of the third process is obtained, and the identifier of the target site is matched with the identifier of the target sensitive site. If the identifier of the target site matches the identifier of the target sensitive site, then when the third process initiates a network access request for the target site, the network access request is intercepted and reported to the server.

7. The method according to claim 1, characterized in that, The step of determining the processing strategy for the file outgoing behavior of the third process based on the matching result between the sensitive process and the third process includes: If the third process is not a sensitive process, then the processing policy for the file outgoing behavior of the third process is determined to be an allow policy; If the third process is the sensitive process, then the processing strategy for the file outgoing behavior of the third process is determined to be an interception strategy.

8. A data processing apparatus, characterized in that, include: The status acquisition unit is used to determine the first process that is in the open state on the terminal device, and to determine the second process that has file touching behavior from the first process; A process filtering unit is used to determine sensitive processes from the second process based on the touched files and filtering rules corresponding to the file touching behavior of the second process; The file determination unit is configured to acquire change data of files on the terminal device within a target time period, generate a file change history based on the change data, acquire the change history of a target file that matches the file change rules from the change history, match the change history of the target file with the file filtering rules, and if the change history of the target file matches the file filtering rules, then determine the target file as a sensitive file. The strategy determination unit is used to determine a processing strategy for the file outsourcing behavior of the third process when a third process on the terminal device is detected to have file outsourcing behavior, based on the matching result between the sensitive process and the third process and the sensitive file.

9. A computer device, characterized in that, include: Processor, memory, and network interface; The processor is connected to the memory and the network interface, wherein the network interface is used to provide data communication functions, the memory is used to store program code, and the processor is used to call the program code so that the computer device executes the method according to any one of claims 1-7.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program adapted to be loaded and executed by a processor to cause a computer device having the processor to perform the method of any one of claims 1-7.

11. A computer program product, characterized in that, The computer program product includes computer instructions that are executed by a processor to implement the method of any one of claims 1-7.

Images