Interface risk access source positioning method and device

Abstract

The application relates to the field of data security, and provides an interface risk access source positioning method and device. The method comprises the following steps: in the case that an access instruction for accessing a target interface is received, determining an IP address corresponding to the access instruction; acquiring the sensitivity of each data transmitted at the target interface, and calculating the average value of the sensitivity of all the data transmitted at the target interface to obtain the average value of the sensitivity of all the data; according to the access security degree of each IP address corresponding to the access instruction and the average value of the sensitivity, calculating the access risk value corresponding to each IP address; and positioning the risk access source of the target interface to the node corresponding to the IP address with the access risk value greater than a risk threshold. The interface risk access source positioning method provided in the application can determine the access risk value of the interface in real time, timely position the access source user of the unsafe access when the interface is accessed in an unsafe manner, effectively reduce the data leakage risk, and improve the security of data access.

Description

Technical Field

[0001] This application relates to the field of data security technology, specifically to a method and apparatus for locating the source of interface risk access. Background Technology

[0002] The development of digitalization has driven the application and flow of data within industries to become more widespread and frequent. The scenarios for data flow are also increasing, with various business systems providing convenient services to other business systems or external partners through open APIs (Application Programming Interfaces).

[0003] As data flows more openly across various scenarios, APIs also face numerous security challenges during this process. Insecure access to APIs increases the risk of data leakage, ultimately failing to provide security for data flow.

[0004] Therefore, how to assess the risks of API access and pinpoint the source of insecure access in order to reduce the risk of data leakage has become an urgent problem to be solved in the industry. Summary of the Invention

[0005] This application provides a method and apparatus for locating the source of API risk access, which addresses the technical problem that the risk of data leakage increases when there is insecure access risk to the API, making it impossible to provide security for data flow.

[0006] Firstly, embodiments of this application provide a method for locating the source of interface risk access, including:

[0007] Upon receiving an access instruction to access a target interface, the Internet Protocol (IP) address corresponding to the access instruction is determined; wherein, the IP address includes the IP addresses of all nodes from the initiator of the access instruction to the target interface;

[0008] The sensitivity of each data transmitted at the target interface is obtained, and the average sensitivity of all data transmitted at the target interface is calculated to obtain the average sensitivity of all data.

[0009] Based on the access security level of each IP address corresponding to the access instruction and the average sensitivity value, the access risk value corresponding to each IP address is calculated; wherein, the access security level of each IP address is used to characterize the security level of the node corresponding to each IP address accessing the target interface;

[0010] IP addresses with access risk values ​​greater than the risk threshold are used as IP addresses to be located, and the source of risky access to the target interface is located to the node corresponding to the IP address to be located.

[0011] In one embodiment, obtaining the sensitivity of each piece of data transmitted at the target interface includes:

[0012] Based on the data identifiers of each data transmitted at the target interface, the sensitivity of each data is searched in the blockchain;

[0013] In the absence of finding the sensitivity of each data point, obtain the content sensitivity and field sensitivity of each data point, as well as the security level of the target recipient of each data point; wherein, the content sensitivity and field sensitivity of each data point are used to characterize the sensitivity of the overall content of each data point, and the sensitivity of the fields contained in each data point, respectively.

[0014] Based on the content sensitivity, field sensitivity, and security level, obtain the sensitivity of each data item.

[0015] In one embodiment, obtaining the field sensitivity of each piece of data transmitted at the target interface includes:

[0016] Based on the annotation information of each data point, the fields of each data point are divided into a first field set and a second field set; the first field set contains unannotated fields, and the second field set contains fields that have been labeled as sensitive fields;

[0017] When the second field set is a non-empty set, the field sensitivity of each data is obtained based on the number of fields in the second field set, the total number of fields in each data, and the probability that any field in the first field set is a sensitive field when any field in the second field set is a sensitive field.

[0018] In one embodiment, obtaining the security level of the target recipient receiving each piece of data includes:

[0019] Obtain the target IP address and / or transmission path corresponding to each data item;

[0020] Based on the target IP address and / or transmission path corresponding to each data, the security level of the target recipient of each data is retrieved from the mapping table.

[0021] In one embodiment, after obtaining the sensitivity of each data point, the method further includes:

[0022] For each piece of data transmitted at the target interface, perform the following steps:

[0023] Send a request message to the blockchain, store the sensitivity of the current data in the target data block of the blockchain, and receive the data identifier of the current data and the data block identifier of the target data block returned by the blockchain according to the request message;

[0024] Store the data identifier and the blockchain address in the header file;

[0025] The current data is transmitted, and the transmission information of the current data and the data block identifier are sent to the blockchain; the blockchain is used to find the target data block according to the data block identifier and record the transmission information in the target node of the target data block.

[0026] In one embodiment, the blockchain is also used for:

[0027] After receiving the request information, locate the sub-chain corresponding to the request information;

[0028] If no subchain corresponding to the request information is found, a new subchain corresponding to the request information is created, and the attribute information of the sender of the request information and the total number of data blocks are stored in the head node of the new subchain.

[0029] Create the target data block after the head node, generate the data identifier of the current data and the data block identifier of the target data block according to the request information; store the data identifier and the sensitivity of the current data in the target data block, and return the data identifier and the data block identifier;

[0030] If a subchain corresponding to the requested information is found, a new target data block is created at the end of the subchain. The data identifier and the sensitivity of the current data are stored in the target data block, and the data identifier and the data block identifier are returned.

[0031] In one embodiment, it also includes:

[0032] If the access instruction carries target data transmitted at the target interface, the transmission information of the target data is retrieved from the blockchain based on the identification information of the target data;

[0033] If the access risk value corresponding to any IP address of the access instruction is greater than the risk threshold, the transmission path of the target data is determined based on the transmission information, and a warning is issued for each node in the transmission path.

[0034] Secondly, embodiments of this application provide an interface risk access source location device, comprising:

[0035] The determination module is configured to: upon receiving an access instruction to access a target interface, determine the Internet Protocol (IP) address corresponding to the access instruction; wherein the IP address includes the IP addresses of all nodes from the initiator of the access instruction to the target interface;

[0036] The first calculation module is used to: obtain the sensitivity of each data transmitted at the target interface, and calculate the average sensitivity of all data transmitted at the target interface to obtain the average sensitivity of all data;

[0037] The second calculation module is used to: calculate the access risk value corresponding to each IP address based on the access security level of each IP address corresponding to the access instruction and the average sensitivity value; wherein, the access security level of each IP address is used to characterize the security level of the node corresponding to each IP address accessing the target interface;

[0038] The positioning module is used to: identify IP addresses with access risk values ​​greater than the risk threshold as IP addresses to be located, and locate the source of risky access to the target interface to the node corresponding to the IP address to be located.

[0039] Thirdly, embodiments of this application provide an electronic device, including a processor and a memory storing a computer program, wherein the processor executes the program to implement the steps of the interface risk access source location method described in the first aspect.

[0040] Fourthly, embodiments of this application provide a computer program product, including a computer program that, when executed by a processor, implements the steps of the interface risk access source location method described in the first or second aspect.

[0041] The interface risk access source location method and apparatus provided in this application embodiment monitors the target interface in real time. When an access instruction to access the target interface is received, the source IP address corresponding to the access instruction is obtained in real time. Combined with the average sensitivity value of all data transmitted by the target interface and the source IP address, the access risk value of each source IP address is evaluated. When the access risk value corresponding to any source IP address is higher than the risk threshold, the risk access source of the target interface is automatically located to that source IP address, and an early warning is issued. This not only determines the access risk value of the target interface in real time, but also locates the risk access source user of the insecure access in a timely manner when there is insecure access to the target interface, so that users can perform data security maintenance in a timely manner, reduce the risk of data leakage, and improve the security of data access. Attached Figure Description

[0042] To more clearly illustrate the technical solutions in this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0043] Figure 1 This is a flowchart illustrating the method for locating the source of interface risk access provided in an embodiment of this application;

[0044] Figure 2 This is a schematic diagram of the interface risk access source location device provided in the embodiments of this application;

[0045] Figure 3 This is a schematic diagram of the structure of the electronic device provided in the embodiments of this application. Detailed Implementation

[0046] To make the objectives, technical solutions, and advantages of this application clearer, the technical solutions of this application will be clearly and completely described below with reference to the accompanying drawings of the embodiments. Obviously, the described embodiments are only some embodiments of this application, not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0047] It should be noted that the terms "first," "second," etc., used in this application are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of this application described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0048] Typically, digitalization drives the application and flow of data within industries to become more widespread and frequent. The scenarios for data flow are also increasing, with various business systems providing convenient services to other business systems or external partners through open API interfaces. As data flow becomes increasingly open across various scenarios, how to assess interface access risks and, when such risks exist, pinpoint the source users of those risks to monitor for potential leaks has become a pressing issue.

[0049] Based on this, this application provides a method for automatically locating the source user of a risky interface access. The method assesses the sensitivity of each piece of data from three dimensions: the overall sensitivity of the content, the sensitive fields included, and the security of the recipient, ultimately forming the data's sensitivity score. During data transmission, all transmission information is recorded via blockchain. For each access to the interface, the current access risk value is assessed based on the average sensitivity of all data involved in the access port and the current visitor's IP address. When the access risk value exceeds a risk threshold, the source user of the risky interface access is located at the visitor's IP address, and an alert is issued. Simultaneously, the transmission information of the accessed data is also obtained for source tracing.

[0050] Figure 1 This is one of the flowcharts illustrating the interface risk access source location method provided in this application embodiment. (Refer to...) Figure 1 This application provides a method for locating the source of interface risk access, which may include:

[0051] Step 101: Upon receiving an access instruction to access the target interface, determine the Internet Protocol (IP) address corresponding to the access instruction; wherein the IP address includes the IP addresses of all nodes from the initiator of the access instruction to the target interface.

[0052] It should be noted that the execution subject in this embodiment can be the electronic device where the target interface is located, which will be abbreviated as device X for ease of description. This electronic device can be a mobile electronic device or a non-mobile electronic device. For example, a mobile electronic device can be a mobile phone, tablet computer, laptop computer, PDA, in-vehicle electronic device, etc., while a non-mobile electronic device can be a server, network attached storage device, personal computer, etc. This invention does not impose specific limitations.

[0053] The target interface is the interface that is being accessed, and its specific type can be API, etc. This embodiment does not make specific limitations on this.

[0054] An access command is a command sent by a user when accessing a target interface; access commands can be sent directly by the user or forwarded by other devices, etc., and this embodiment does not specifically limit this.

[0055] Optionally, the executing entity monitors in real time whether any visitors send access instructions to the target interface. Upon receiving an access instruction to access the target interface, it determines the source IP (Internet Protocol) address of the access instruction, i.e., the IP address of all visitors who sent the access instruction, in order to obtain the Internet Protocol IP address corresponding to the access instruction.

[0056] It should be noted that at the same time, the executing entity can receive access instructions sent by one or more visitors simultaneously, and this embodiment does not specifically limit this.

[0057] The Internet Protocol (IP) address corresponding to the access command is not limited to the IP address of the previous hop node, but includes the IP addresses of all nodes from the initiator of the access command to the receiver (target interface).

[0058] For example, if access command 'a' is forwarded from node A to node B and then sent to the target interface by node B, then the IP address corresponding to access command 'a' includes the IP addresses of both node A and node B.

[0059] Step 102: Obtain the sensitivity of each data transmitted at the target interface, and calculate the average sensitivity of all data transmitted at the target interface to obtain the average sensitivity of all data.

[0060] The data transmitted at the target interface can be either uplink or downlink data; this embodiment does not specifically limit this.

[0061] Data sensitivity refers to the degree of insecurity of the data.

[0062] Uplink data includes two types: one is data generated by the device where the target interface is located (i.e., the execution subject, abbreviated as device X), that is, device X is the source sender of data transmission, and device X is a non-data forwarding node; the other is data that device X receives and forwards after being sent by other nodes, that is, device X is a data forwarding node.

[0063] Uplink data refers to the data received by device X;

[0064] Optionally, all uplink and downlink data transmitted at the target interface can be obtained from the logs, and the uplink or downlink data of the target interface can be selected as the source port or destination port to obtain the sensitivity of each data transmitted at the target interface.

[0065] The specific methods for obtaining sensitivity include: real-time calculation based on the attribute information of each data transmitted at the target interface, or searching in a blockchain that pre-stores data sensitivity, etc. This embodiment does not specifically limit this.

[0066] After obtaining the sensitivity of each data transmitted at the target interface, the mean sensitivity of all data transmitted at the target interface is calculated to obtain the mean sensitivity of all data.

[0067] Step 103: Calculate the access risk value corresponding to each IP address based on the access security level of each IP address corresponding to the access instruction and the average sensitivity value; wherein, the access security level of each IP address is used to characterize the security level of the node corresponding to each IP address accessing the target interface;

[0068] The access security level is used to characterize the security level of the node corresponding to each IP address when accessing the target interface, that is, the probability of the node being attacked by the network when accessing the target interface, including the probability of OOB (Out of Band) attack and DoS (Denial of Service) attack, etc., which can be determined according to the network attack detection method.

[0069] For example, it could detect the possibility that this interface access is using the TCP (Transmission Control Protocol) / IP protocol to send a data packet to that port (usually ports 137, 138, and 139) to launch an OOB attack.

[0070] And / or, detect the possibility that this interface access is being used to launch a DoS attack through this interface, etc.

[0071] The access risk value is the risk level of the access behavior. The higher the risk value, the worse the security of the access behavior.

[0072] The average sensitivity of all data transmitted at the target interface reflects the security level of that target interface.

[0073] If the average sensitivity is high, and the security level of each IP address corresponding to the access command is low, then the risk value is determined to be high, the risk of data leakage is higher, and the security of this data flow is poor.

[0074] For any IP address, the formula for calculating the access risk value corresponding to that IP address can be: Access risk value of this access behavior of the IP address = Average sensitivity / Access security level of this access of the IP address.

[0075] Optionally, if there is only one IP address corresponding to the access command, the access risk value of this access behavior can be calculated directly based on the average access security and sensitivity of the IP address according to the above-mentioned access risk value calculation formula.

[0076] When there are multiple IP addresses corresponding to the access command, the access risk value of each IP address is calculated based on the average access security and sensitivity of each IP address according to the above formula for calculating access risk value.

[0077] Step 104: The IP address with the access risk value greater than the risk threshold is taken as the IP address to be located, and the risk access source of the target interface is located to the node corresponding to the IP address to be located.

[0078] The specific risk threshold can be set according to actual needs.

[0079] Optionally, after obtaining the access risk value corresponding to each IP address, it can be determined whether the access risk value corresponding to each IP address is greater than the risk threshold. If the access risk value corresponding to any IP address is greater than the risk threshold, it indicates that the access behavior is insecure. It is necessary to locate the user of the risky access source of the target interface to the node where the IP address is located, and issue a warning to the node where the IP address is located to inform the user that the access command sent by the IP address has a security risk.

[0080] If the access risk value corresponding to all IP addresses is not greater than the risk threshold, it indicates that the access behavior is safe and the visitor is allowed to continue accessing the target interface.

[0081] This embodiment monitors the target interface in real time. Upon receiving an access command to access the target interface, it obtains the source IP address corresponding to the access command in real time. Combined with the average sensitivity value of all data transmitted by the target interface and the source IP address, it assesses the access risk value of each source IP address. If the access risk value corresponding to any source IP address is higher than the risk threshold, it automatically locates the source of the risky access to the target interface to that source IP address and issues an early warning. This not only determines the access risk value of the target interface in real time, but also promptly locates the user of the risky access source when there is insecure access to the target interface, allowing users to perform timely data security maintenance, reduce the risk of data leakage, and improve the security of data access.

[0082] Based on the above embodiments, the acquisition of the sensitivity of each data transmitted at the target interface in this embodiment includes: searching for the sensitivity of each data in the blockchain according to the data identifier of each data transmitted at the target interface; if the sensitivity of each data is not found, acquiring the content sensitivity and field sensitivity of each data, as well as the security level of the target recipient receiving each data; wherein, the content sensitivity and field sensitivity of each data are used to characterize the sensitivity of the overall content of each data, and the sensitivity of the fields contained in each data, respectively; and acquiring the sensitivity of each data according to the content sensitivity, field sensitivity, and security level.

[0083] Optionally, the specific steps for obtaining the sensitivity of each piece of data transmitted at the target interface in step 102 include:

[0084] First, the sensitivity of each piece of data can be directly searched in the blockchain based on its data identifier;

[0085] Additionally, there might be a situation where device X is a single data forwarding node, meaning that data is transmitted downlink to device X via the target interface and then uplink to the next node via the same target interface. In this case, there is data redundancy at the target interface. Therefore, to improve computational efficiency, data can be deduplicated based on data identifiers, and then the sensitivity of each piece of data can be read from the blockchain based on the deduplicated data identifiers.

[0086] Specific deduplication methods include: randomly deleting duplicate data; or deleting data with earlier transmission times, etc. This embodiment does not specifically limit these methods.

[0087] If the sensitivity of each piece of data is pre-stored in the blockchain, then the sensitivity of each piece of data can be found in the blockchain based on the data identifier of each piece of data. The average sensitivity of all data transmitted at the target interface can be calculated directly based on the sensitivity of each piece of data obtained from the search.

[0088] If the sensitivity of each piece of data is not pre-stored in the blockchain, then the variables that affect the sensitivity of the data are obtained first, specifically including content sensitivity, field sensitivity, and the security level of the target recipient of each piece of data.

[0089] Content sensitivity is used to characterize the sensitivity of the content involved in each data set as a whole.

[0090] For example, data containing information related to trade secrets is considered sensitive data. For instance, a core formula, taken individually, might not be a sensitive field, but when combined, it constitutes a trade secret. Therefore, as a whole, the data is considered sensitive.

[0091] Field sensitivity is used to characterize the sensitivity of the fields contained in each data set.

[0092] For example, student information data is not sensitive data in itself, and its included fields such as name and gender are not sensitive fields. However, if it includes an ID card number, then the ID card number is a sensitive field.

[0093] Regarding the security level of the target recipients of each data, since different recipients have different background knowledge and different levels of understanding of the same data, the same data may not be highly sensitive to some recipients; however, for other recipients, they can understand the true meaning of the data after interpreting it based on their background knowledge, and thus the data is sensitive to them.

[0094] For example, encrypted data is not very sensitive to ordinary recipients because they do not know the decryption method; however, if the correct recipient, or a recipient who has stolen the decryption method, can decrypt the data based on the known decryption method and thus obtain sensitive data, then the encrypted data is sensitive data to these recipients.

[0095] In summary, based on the above analysis, the sensitivity of each data point can be calculated from three aspects: content sensitivity, field sensitivity, and the security level of the target recipient of each data point.

[0096] Optionally, regarding content sensitivity, since the data producer is most familiar with the overall sensitivity of the data, the content sensitivity of each piece of data can be assessed by the data-sensitive party (producer) regarding the sensitivity of the overall content involved in the data, thus obtaining the assessment result of the content sensitivity of each piece of data, denoted as α1. Wherein, α1∈[0,1], the larger the value, the more sensitive the data.

[0097] Field sensitivity can be calculated based on the sensitivity of each field, or it can be calculated based on the proportion of sensitive fields in each data set. This embodiment does not impose any specific limitations on this.

[0098] Regarding the security level of the target recipient, the target recipient is the object to which the data producer wants to send the data.

[0099] For example, if device X sends an operation command to the server, then device X is the data producer and the server is the target receiver.

[0100] This is also because the data producer is most sensitive to the recipient it sends to. The data producer can assess the security level of the target recipient and obtain the assessment result of the security level of the target recipient, which is denoted as α3.

[0101] Here, α3 is a positive integer; the larger the value, the higher the security level. The specific value range of α3 can be configured according to actual needs, such as 1 to 5, or 1 to 10, etc.

[0102] After obtaining the content sensitivity, field sensitivity, and security level of each data point, the sensitivity of each data point can be calculated by combining these three factors. The specific formula for calculating the sensitivity of any given data point is as follows:

[0103]

[0104] Where α, α1, α2, and α3 represent the final sensitivity, content sensitivity, field sensitivity, and target recipient's security level for any given data, respectively; N t The total number of fields for any given data. This is a numerical fine-tuning of the decimal to prevent sensitivity calculation errors caused by a denominator of 0 when α2 is 0.

[0105] In this embodiment, without searching for the sensitivity of each data in the blockchain, the sensitivity of the content of each data, the sensitivity of the field, and the security level of the target recipient are combined to make the acquisition of the sensitivity of each data more accurate, thereby making the monitoring and positioning results of the target interface more effective and accurate.

[0106] Based on the above implementation, this embodiment obtains the field sensitivity of each data transmitted at the target interface by: dividing the fields of each data into a first field set and a second field set according to the annotation information of each data; wherein, the first field set contains unannotated fields, and the second field set contains fields that have been marked as sensitive fields; when the second field set is not empty, the field sensitivity of each data is obtained based on the number of fields in the second field set, the total number of fields in each data, and the probability that any field in the first field set is a sensitive field when any field in the second field set is a sensitive field.

[0107] Optionally, the data producer may mark each field as sensitive when generating data to facilitate subsequent security monitoring. Based on this, obtaining field sensitivity for each piece of data transmitted at the target interface includes the following steps:

[0108] Step 1) Confirm all fields included in the data to obtain the total number of fields N. t ;

[0109] Step 2) Based on the annotation information of each field, divide all fields into two sets: the first field set and the second field set.

[0110] The first set of fields consists of fields that are not marked as sensitive fields, and the second set of fields consists of fields that are marked as sensitive fields.

[0111] For ease of description later, the first set of fields consisting of those not marked as sensitive fields will be denoted as set A, and the second set of fields consisting of those marked as sensitive fields will be denoted as set B.

[0112] Step 3) Determine whether set B is an empty set. If set B is an empty set, then the field sensitivity α2 = 0.

[0113] If set B is a non-empty set, then by combining the number of fields in the second field set, the total number of fields in each data set, and the probability that any field in the first field set is a sensitive field if any field in the second field set is a sensitive field, the field sensitivity of each data set can be calculated. The specific calculation formula is as follows:

[0114]

[0115] Where α2 is the field sensitivity of any data; N b N represents the number of elements in set B, i.e., the number of fields. t Let represent the total number of fields in the data; i represents the element identifier in set A, i.e., the i-th field in set A; j represents the element identifier in set B, i.e., the j-th field in set B; P(i|j) is the probability that the i-th element in set A is also a sensitive field, given that the j-th element in set B is a sensitive field.

[0116] The value of P(i|j) is obtained through a large amount of sample data. The sample data can be existing data, data obtained from different channels, or data provided by users; this embodiment does not specifically limit this.

[0117] The value of P(i|j) can be calculated using the following formula:

[0118]

[0119] Wherein, P(ij) = the number of sample data that simultaneously contain the i-th element and the j-th element, and both the i-th element and the j-th element are sensitive fields / the total number of sample data that simultaneously contain the i-th element and the j-th element.

[0120] P(j) = Number of sample data containing the j-th element, where the j-th element is a sensitive field / Total number of sample data containing the j-th element.

[0121] This implementation first uses the annotation information of each data to quickly and easily divide the fields of each data into a first field set and a second field set; then, by combining the number of fields in the second field set, the total number of fields in each data, and the probability that any field in the first field set is a sensitive field if any field in the second field set is a sensitive field, the field sensitivity of each data can be automatically and accurately obtained.

[0122] Based on the above embodiments, this embodiment obtains the security level of the target receiver receiving each data, including: obtaining the target IP address and / or transmission path corresponding to each data; and searching in the mapping table to obtain the security level of the target receiver for each data according to the target IP address and / or transmission path corresponding to each data.

[0123] Optionally, the data producer for each data item can be either a user or a device. If it is a device, the target IP address of each data item will be determined when the data is sent, which is the IP address of the target receiver. The security level of the target receiver can be determined based on the target IP address.

[0124] Each target IP address corresponds one-to-one with each device; therefore, based on the target IP address, the type of device can be determined, and thus the security level of the target recipient can be determined. For example, confidential devices have a high security level, while internet cafe devices have a low security level.

[0125] And / or, when sending each piece of data, determine the transmission path for each piece of data, and determine the security level of the target receiver based on the transmission path. For example, sending data via a VPN (Virtual Private Network) has a relatively high security level; sending data via an IP link has a relatively low security level, and so on.

[0126] The mapping table pre-configures the mapping relationship between the target IP address and / or transmission path and the security level.

[0127] Optionally, firstly, the target IP address and / or transmission path corresponding to each data are obtained; wherein, the target IP address and / or transmission path are determined by the data producer when sending the data.

[0128] Based on the target IP address and / or transmission path corresponding to each data, the security level of the target recipient for each data is retrieved from the mapping table.

[0129] This embodiment can conveniently and accurately find the security level of the target recipient of each data in the mapping table based on the target IP address and / or transmission path corresponding to each data.

[0130] Based on the above embodiments, this embodiment, after obtaining the sensitivity of each data, further includes: for each data transmitted at the target interface, performing the following steps: sending a request message to the blockchain, storing the sensitivity of the current data in the target data block of the blockchain, and receiving the data identifier of the current data and the data block identifier of the target data block returned by the blockchain according to the request message; storing the data identifier and the address of the blockchain in a header file; transmitting the current data, and sending the transmission information of the current data and the data block identifier to the blockchain; the blockchain is used to find the target data block according to the data block identifier, and record the transmission information in the target node of the target data block.

[0131] The transmitted information includes, but is not limited to, one or more combinations of transmission time, transmission port, source port, destination port, source IP address, destination IP address, and data identifier. This implementation does not specifically limit this.

[0132] Given that the current data is upstream data and device X is the data sender, for each piece of data transmitted at the target interface, device X can request a dedicated block for that data from the blockchain and obtain the block's header address to store the transmission and attribute information of each piece of data. This allows for direct retrieval of the transmission and attribute information from the blockchain the next time it is needed, simplifying the retrieval process and improving efficiency. For the current data, the specific storage steps include:

[0133] Step 1: Device X sends a request to the blockchain to request a block, and carries the sensitivity α of the current data in the request; where the current data is one of the data transmitted at the target interface.

[0134] Step 2: After receiving the request information, the blockchain responds to it. Specifically, it stores the sensitivity of the current data in the target data block, generates a data identifier for the current data based on the request information, and returns the data identifier of the current data and the data block identifier of the target data block to device X.

[0135] Step 3: Device X stores the data identifier and blockchain address in the header file and transmits the current data;

[0136] Step 4: Device X uploads the transmission information to the blockchain according to the data block identifier; at this time, the transmission information may include the transmission time, transmission port and destination IP address, destination port and data block identifier.

[0137] Step 5: The blockchain adds a node after the linked list in the target data block corresponding to the data block identifier to record the transmission time, transmission port, destination IP and destination port.

[0138] Given that the current data is upstream data and device X is a data forwarding node, the specific storage steps for the current data are as follows:

[0139] Because device X records the data identifier and blockchain address in the header file of each piece of data it receives;

[0140] Therefore, after device X sends data, it can directly send the transmission information, namely the transmission time, its own IP address (i.e., the source IP), the transmission port and the destination IP, the destination port and the data identifier, to the blockchain via the blockchain address;

[0141] The blockchain identifies the corresponding target data block based on the data identifier and adds a new node after the target data block's linked list to record the transmission time, its own IP address, transmission port, and destination IP.

[0142] Given that the current data is downlink data, the specific storage steps for each data point are as follows:

[0143] Because the header file of each received data contains a data identifier and a blockchain address;

[0144] Therefore, after receiving the data, the transmission information, namely the receiving time, its own IP address (i.e., the destination IP), the receiving port and the source IP, the source port, and the data identifier, will be sent to the blockchain via the blockchain address.

[0145] The blockchain identifies the corresponding target data block based on the data identifier and adds a new node after the target data block's linked list to record the receiving time, its own IP address, receiving port, and source IP and source port.

[0146] This embodiment records the attribute information and transmission information of each data in the blockchain, so that when it is necessary to obtain the transmission information and attribute information of each data, it can be directly obtained from the blockchain, simplifying the acquisition process and improving the acquisition efficiency.

[0147] Based on the above embodiments, the blockchain in this embodiment is further used for: upon receiving request information, searching for the sub-chain corresponding to the request information; if the sub-chain corresponding to the request information is not found, creating a new sub-chain corresponding to the request information, and storing the attribute information of the sender of the request information and the total number of data blocks in the head node of the new sub-chain; creating the target data block after the head node, and generating a data identifier for the current data and a data block identifier for the target data block according to the request information; storing the data identifier and the sensitivity of the current data in the target data block, and returning the data identifier and the data block identifier; if the sub-chain corresponding to the request information is found, creating the target data block at the end of the sub-chain, storing the data identifier and the sensitivity of the current data in the target data block, and returning the data identifier and the data block identifier.

[0148] Optionally, when the current data is uplink data and device X is the data sender, after the blockchain receives the request information, it can find the subchain corresponding to the data sender of the current data, i.e. the subchain corresponding to the request information, based on the request information.

[0149] If the subchain corresponding to the data sender of the current data is not found, a new subchain corresponding to the request information is created. The header node of the new subchain records the attribute information of the data sender, such as the device's IP address, as well as the total number of data blocks in the subchain.

[0150] Create a new target data block after the head node, and generate the data identifier of the current data and the data block identifier of the target data block according to the request information. Record the data identifier and the sensitivity of the current data in the target data block, and return the data identifier and data block identifier to device X.

[0151] It should be noted that each sub-chain corresponds to each data sender, and each sub-chain consists of a head node and multiple data blocks. The head node records the attribute information of the data sender and the total number of data blocks. Each data block is used to record the data identifier, data sensitivity α, and data transmission information.

[0152] The data transmission information is a linked list structure, and each transmission (including sending and receiving) corresponds to a node in the sub-chain.

[0153] If the subchain corresponding to the requested information is found, a new target data block is created at the end of the subchain, and a corresponding data identifier is generated. The data identifier and the sensitivity of the current data are recorded in the target data block, and the data identifier and data block identifier are returned to device X.

[0154] This embodiment uses blockchain to quickly and accurately store the attribute information and transmission information of each data. After storage, the attribute information and transmission information of each data can be easily and quickly obtained based on the data identifier, avoiding the need to repeatedly calculate other attribute information such as data sensitivity or collect and obtain data transmission information, thereby improving positioning efficiency.

[0155] Based on the above embodiments, this embodiment further includes: when the access instruction carries target data transmitted at the target interface, searching for the transmission information of the target data from the blockchain based on the identification information of the target data; when the access risk value corresponding to any IP address of the access instruction is greater than the risk threshold, determining the transmission path of the target data according to the transmission information, and issuing warnings to each node in the transmission path.

[0156] Optionally, when locating the source user of risky access to the target interface, in addition to issuing warnings for IP addresses with access risk values ​​greater than the risk threshold, if the access involves data, i.e., the access command carries the target data transmitted at the target interface, all transmission information of the target data can be found in the blockchain based on the identification information of the target data.

[0157] If the access risk value of any IP address corresponding to the access command exceeds the risk threshold, the transmission path of the target data can be reconstructed by transmitting information, thereby issuing warnings to each node in the transmission path, further reducing the risk of data leakage and improving the security of data access.

[0158] The interface risk access source location device provided in the embodiments of this application is described below. The interface risk access source location device described below and the interface risk access source location method described above can be referred to in correspondence.

[0159] like Figure 2 As shown, this embodiment provides an interface risk access source location device, which includes a determination module 201, a first calculation module 202, a second calculation module 203, and a location module 204, wherein:

[0160] The determining module 201 is used to: upon receiving an access instruction to access a target interface, determine the Internet Protocol (IP) address corresponding to the access instruction; wherein the IP address includes the IP addresses of all nodes from the initiator of the access instruction to the target interface;

[0161] Optionally, the executing entity monitors in real time whether any visitors send access commands to the target interface. Upon receiving an access command to access the target interface, it determines the source IP address of the access command, i.e., the IP address of all visitors who sent the access command, in order to obtain the Internet Protocol IP address corresponding to the access command.

[0162] The first calculation module 202 is used to: obtain the sensitivity of each data transmitted at the target interface, and calculate the average sensitivity of all data transmitted at the target interface to obtain the average sensitivity of all data;

[0163] Optionally, all uplink and downlink data transmitted at the target interface can be obtained from the logs, and the uplink or downlink data of the target interface can be selected as the source port or destination port to obtain the sensitivity of each data transmitted at the target interface.

[0164] The specific methods for obtaining sensitivity include: real-time calculation based on the attribute information of each data transmitted at the target interface, or searching in a blockchain that pre-stores data sensitivity, etc. This embodiment does not specifically limit this.

[0165] After obtaining the sensitivity of each data transmitted at the target interface, the mean sensitivity of all data transmitted at the target interface is calculated to obtain the mean sensitivity of all data.

[0166] The second calculation module 203 is used to: calculate the access risk value corresponding to each IP address based on the access security level of each IP address corresponding to the access instruction and the average sensitivity value; wherein, the access security level of each IP address is used to characterize the security level of the node corresponding to each IP address accessing the target interface;

[0167] Optionally, if there is only one IP address corresponding to the access command, the access risk value of this access behavior can be calculated directly based on the average access security and sensitivity of the IP address according to the above-mentioned access risk value calculation formula.

[0168] When there are multiple IP addresses corresponding to the access command, the access risk value of each IP address is calculated based on the average access security and sensitivity of each IP address according to the above formula for calculating access risk value.

[0169] The positioning module 204 is used to: use the IP address whose access risk value is greater than the risk threshold as the IP address to be located, and locate the source of the risk access to the target interface to the node corresponding to the IP address to be located.

[0170] Optionally, after obtaining the access risk value corresponding to each IP address, it can be determined whether the access risk value corresponding to each IP address is greater than the risk threshold. If the access risk value corresponding to any IP address is greater than the risk threshold, it indicates that the access behavior is insecure. It is necessary to locate the user of the risky access source of the target interface to the node where the IP address is located, and issue a warning to the node where the IP address is located to inform the user that the access command sent by the IP address has a security risk.

[0171] If the access risk value corresponding to all IP addresses is not greater than the risk threshold, it indicates that the access behavior is safe and the visitor is allowed to continue accessing the target interface.

[0172] This embodiment monitors the target interface in real time. Upon receiving an access command to access the target interface, it obtains the source IP address corresponding to the access command in real time. Combined with the average sensitivity value of all data transmitted by the target interface and the source IP address, it assesses the access risk value of each source IP address. If the access risk value corresponding to any source IP address is higher than the risk threshold, it automatically locates the source of the risky access to the target interface to that source IP address and issues an early warning. This not only determines the access risk value of the target interface in real time, but also promptly locates the user of the risky access source when there is insecure access to the target interface, allowing users to perform timely data security maintenance, reduce the risk of data leakage, and improve the security of data access.

[0173] Based on the above embodiments, the first calculation module in this embodiment is specifically used for: searching for the sensitivity of each data in the blockchain according to the data identifier of each data transmitted at the target interface; if the sensitivity of each data is not found, obtaining the content sensitivity and field sensitivity of each data, as well as the security level of the target recipient receiving each data; obtaining the sensitivity of each data according to the content sensitivity, field sensitivity, and security level; wherein, the content sensitivity and field sensitivity of each data are used to characterize the sensitivity of the overall content of each data, and the sensitivity of the fields contained in each data, respectively.

[0174] Based on the above embodiments, the first calculation module in this embodiment is further configured to: divide the fields of each data into a first field set and a second field set according to the annotation information of each data; wherein, the first field set contains unannotated fields, and the second field set contains fields that have been annotated as sensitive fields; when the second field set is a non-empty set, obtain the field sensitivity of each data based on the number of fields in the second field set, the total number of fields in each data, and the probability that any field in the first field set is a sensitive field when any field in the second field set is a sensitive field.

[0175] Based on the above embodiments, the first calculation module in this embodiment is further configured to: obtain the target IP address and / or transmission path corresponding to each data; and search the mapping table to obtain the security level of the target receiver of each data according to the target IP address and / or transmission path corresponding to each data.

[0176] Based on the above embodiments, this embodiment further includes a storage module, configured to: for each piece of data transmitted at the target interface, perform the following steps: send a request message to the blockchain, store the sensitivity of the current data in the target data block of the blockchain, and receive the data identifier of the current data and the data block identifier of the target data block returned by the blockchain according to the request message; store the data identifier and the address of the blockchain in a header file; transmit the current data, and send the transmission information of the current data and the data block identifier to the blockchain; the blockchain is used to find the target data block according to the data block identifier, and record the transmission information in the target node of the target data block.

[0177] Based on the above embodiments, the blockchain in this embodiment is further used for: upon receiving request information, searching for the sub-chain corresponding to the request information; if the sub-chain corresponding to the request information is not found, creating a new sub-chain corresponding to the request information, and storing the attribute information of the sender of the request information and the total number of data blocks in the head node of the new sub-chain; creating the target data block after the head node, and generating a data identifier for the current data and a data block identifier for the target data block according to the request information; storing the data identifier and the sensitivity of the current data in the target data block, and returning the data identifier and the data block identifier; if the sub-chain corresponding to the request information is found, creating the target data block at the end of the sub-chain, storing the data identifier and the sensitivity of the current data in the target data block, and returning the data identifier and the data block identifier.

[0178] Based on the above embodiments, this embodiment also includes an early warning module, which is used to search for the transmission information of the target data in the blockchain based on the identification information of the target data when the access instruction carries the target data transmitted at the target interface; and to determine the transmission path of the target data according to the transmission information when the access risk value corresponding to any IP address of the access instruction is greater than the risk threshold, and to issue early warnings for each node in the transmission path when the access risk value corresponding to any IP address of the access instruction is greater than the risk threshold.

[0179] Figure 3 An example is a schematic diagram of the physical structure of an electronic device, such as... Figure 3As shown, the electronic device may include a processor 301, a communication interface 302, a memory 303, and a communication bus 304. The processor 301, communication interface 302, and memory 303 communicate with each other via the communication bus 304. The processor 301 can call a computer program in the memory 303 to execute an interface risk access source location method, which includes, for example, determining the Internet Protocol (IP) address corresponding to the access instruction upon receiving an access instruction to the target interface; wherein the IP address includes the IP addresses of all nodes from the initiator of the access instruction to the target interface; obtaining the sensitivity of each data transmitted at the target interface and calculating the average sensitivity of all data transmitted at the target interface to obtain the average sensitivity value of all data; calculating the access risk value corresponding to each IP address based on the access security of each IP address corresponding to the access instruction and the average sensitivity value; selecting IP addresses with access risk values ​​greater than a risk threshold as IP addresses to be located, and locating the risk access source of the target interface to the node corresponding to the IP address to be located.

[0180] Furthermore, the logical instructions in the aforementioned memory 303 can be implemented as software functional units and, when sold or used as independent products, can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or a part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0181] On the other hand, this application also provides a computer program product, which includes a computer program that can be stored on a non-transitory computer-readable storage medium. When the computer program is executed by a processor, the computer can execute the interface risk access source location method provided in the above embodiments, for example including: upon receiving an access instruction to access a target interface, determining the Internet Protocol IP address corresponding to the access instruction; wherein the IP address includes the IP addresses of all nodes from the initiator of the access instruction to the target interface; obtaining the sensitivity of each data transmitted at the target interface, and calculating the average sensitivity of all data transmitted at the target interface to obtain the average sensitivity value of all data; calculating the access risk value corresponding to each IP address based on the access security of each IP address corresponding to the access instruction and the average sensitivity value; taking the IP address with the access risk value greater than the risk threshold as the IP address to be located, and locating the risk access source of the target interface to the node corresponding to the IP address to be located.

[0182] On the other hand, embodiments of this application also provide a processor-readable storage medium storing a computer program. The computer program is used to cause a processor to execute the steps of the interface risk access source location method provided in the above embodiments. For example, it includes: upon receiving an access instruction to access a target interface, determining the Internet Protocol (IP) address corresponding to the access instruction; wherein the IP address includes the IP addresses of all nodes from the initiator of the access instruction to the target interface; obtaining the sensitivity of each data transmitted at the target interface, and calculating the average sensitivity of all data transmitted at the target interface to obtain the average sensitivity value of all data; calculating the access risk value corresponding to each IP address based on the access security level of each IP address corresponding to the access instruction and the average sensitivity value; using IP addresses with access risk values ​​greater than a risk threshold as IP addresses to be located, and locating the risk access source of the target interface to the node corresponding to the IP address to be located.

[0183] The processor-readable storage medium can be any available medium or data storage device that the processor can access, including but not limited to magnetic memory (e.g., floppy disk, hard disk, magnetic tape, magneto-optical disk (MO)), optical memory (e.g., CD, DVD, BD, HVD), and semiconductor memory (e.g., ROM, EPROM, EEPROM, non-volatile memory (NAND FLASH), solid-state drive (SSD)).

[0184] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs. Those skilled in the art can understand and implement this without any creative effort.

[0185] Through the above description of the embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus necessary general-purpose hardware platforms, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solutions, in essence or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the methods described in the various embodiments or some parts of the embodiments.

[0186] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of this application, and are not intended to limit them. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of this application.

Claims

1. A method for locating the source of interface risk access, characterized in that, include: Upon receiving an access instruction to access a target interface, the Internet Protocol (IP) address corresponding to the access instruction is determined; wherein, the IP address includes the IP addresses of all nodes from the initiator of the access instruction to the target interface; The sensitivity of each data transmitted at the target interface is obtained, and the average sensitivity of all data transmitted at the target interface is calculated to obtain the average sensitivity of all data. Based on the access security level of each IP address corresponding to the access instruction and the average sensitivity value, the access risk value corresponding to each IP address is calculated; wherein, the access security level of each IP address is used to characterize the security level of the node corresponding to each IP address accessing the target interface; The IP addresses with access risk values ​​greater than the risk threshold are used as the IP addresses to be located, and the risk access source of the target interface is located to the node corresponding to the IP address to be located. The sensitivity of obtaining each piece of data transmitted at the target interface includes: If the sensitivity of each data is not found in the blockchain based on the data identifier of each data transmitted at the target interface, the sensitivity of each data is obtained based on the content sensitivity and field sensitivity of each data, as well as the security level of the target recipient of each data. After obtaining the sensitivity of each data point, the process further includes: For each piece of data transmitted at the target interface, perform the following steps: Send a request message to the blockchain, store the sensitivity of the current data in the target data block of the blockchain, and receive the data identifier of the current data and the data block identifier of the target data block returned by the blockchain according to the request message; Store the data identifier and the blockchain address in the header file; The current data is transmitted, and the transmission information of the current data and the data block identifier are sent to the blockchain; the blockchain is used to find the target data block according to the data block identifier and record the transmission information in the target node of the target data block.

2. The method for locating the source of interface risk access according to claim 1, characterized in that, Content sensitivity and field sensitivity are used to characterize the overall content sensitivity of each data point and the sensitivity of the fields contained in each data point, respectively.

3. The method for locating the source of interface risk access according to claim 2, characterized in that, Obtain the field sensitivity of each data transmitted at the target interface, including: Based on the annotation information of each data point, the fields of each data point are divided into a first field set and a second field set; the first field set contains unannotated fields, and the second field set contains fields that have been labeled as sensitive fields; When the second field set is a non-empty set, the field sensitivity of each data is obtained based on the number of fields in the second field set, the total number of fields in each data, and the probability that any field in the first field set is a sensitive field when any field in the second field set is a sensitive field.

4. The method for locating the source of interface risk access according to claim 2, characterized in that, Obtain the security level of the target receiver for each data item, including: Obtain the target IP address and / or transmission path corresponding to each data item; Based on the target IP address and / or transmission path corresponding to each data, the security level of the target recipient of each data is retrieved from the mapping table.

5. The method for locating the source of interface risk access according to claim 1, characterized in that, The blockchain is also used for: After receiving the request information, find the sub-chain corresponding to the request information; If no subchain corresponding to the request information is found, a new subchain corresponding to the request information is created, and the attribute information of the sender of the request information and the total number of data blocks are stored in the head node of the new subchain. The target data block is created after the head node, and the data identifier of the current data and the data block identifier of the target data block are generated according to the request information. Store the data identifier and the sensitivity of the current data in the target data block, and return the data identifier and the data block identifier; If a subchain corresponding to the requested information is found, a new target data block is created at the end of the subchain, the data identifier and the sensitivity of the current data are stored in the target data block, and the data identifier and the data block identifier are returned.

6. The method for locating the source of interface risk access according to any one of claims 1-5, characterized in that, Also includes: If the access instruction carries target data transmitted at the target interface, the transmission information of the target data is retrieved from the blockchain based on the identification information of the target data; If the access risk value corresponding to any IP address of the access instruction is greater than the risk threshold, the transmission path of the target data is determined based on the transmission information, and a warning is issued for each node in the transmission path.

7. An interface access risk source localization device for implementing the interface risk access source localization method as described in claim 1, characterized in that, include: The determination module is configured to: upon receiving an access instruction to access a target interface, determine the Internet Protocol (IP) address corresponding to the access instruction; wherein the IP address includes the IP addresses of all nodes from the initiator of the access instruction to the target interface; The first calculation module is used to: obtain the sensitivity of each data transmitted at the target interface, and calculate the average sensitivity of all data transmitted at the target interface to obtain the average sensitivity of all data; The second calculation module is used to: calculate the access risk value corresponding to each IP address based on the access security level of each IP address corresponding to the access instruction and the average sensitivity value; wherein, the access security level of each IP address is used to characterize the security level of the node corresponding to each IP address accessing the target interface; The positioning module is used to: identify IP addresses with access risk values ​​greater than the risk threshold as IP addresses to be located, and locate the source of risky access to the target interface to the node corresponding to the IP address to be located.

8. An electronic device comprising a processor and a memory storing a computer program, characterized in that, When the processor executes the computer program, it implements the interface risk access source location method according to any one of claims 1 to 6.

9. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by the processor, it implements the interface risk access source location method according to any one of claims 1 to 6.

Images