Methods, apparatus, devices, and computer storage media for detecting sensitive information leakage on GitHub based on federated learning.

Abstract

This application discloses a method, apparatus, device, and computer storage medium for detecting sensitive information leakage on GitHub based on federated learning. The detection method includes: receiving scan results of pre-allocated test repository data from multiple electronic devices participating in federated learning; performing convolutional hashing on the scan results of each electronic device to obtain a scan result fingerprint; using a trained classification model to perform sensitive category analysis on the scan result fingerprint to obtain the sensitive category membership degree corresponding to the scan result of each electronic device; detecting whether sensitive information leakage exists in the test repository data scanned by the corresponding electronic device based on the sensitive category membership degree and a preset threshold, and sending the detection result to the corresponding electronic device. This embodiment can improve the efficiency of sensitive information leakage detection while protecting the privacy of each host and resisting other security threats.

Description

Technical Field

[0001] This application belongs to the field of cybersecurity, and in particular relates to a method, apparatus, device and computer storage medium for detecting the leakage of sensitive information on GitHub based on federated learning. Background Technology

[0002] With the development of the internet, open source has become mainstream, bringing many learning opportunities to everyone. However, risks have also come with it. Some open source code may contain sensitive internal company information, such as core technology code, server information, database accounts and passwords, private key information for interfaces, etc. The leakage of this sensitive information may cause great harm to the company.

[0003] Current technologies primarily utilize third-party tools to scan code repositories on GitHub to detect the leakage of sensitive information. Examples include TruffleHog, GitGuardian, and Repo-Supervisor. However, these tools are time-consuming to scan GitHub repositories, potentially leading to inefficiencies for larger repositories or complex code structures. Furthermore, using third-party tools may raise concerns about code leakage and privacy, adding to the risks for businesses. Summary of the Invention

[0004] This application provides a method, apparatus, device, and computer storage medium for detecting sensitive information leakage on GitHub based on federated learning, which can improve the efficiency of sensitive information leakage detection, while protecting the privacy of each host and resisting other security threats.

[0005] On the one hand, embodiments of this application provide a method for detecting the leakage of sensitive information on GitHub based on federated learning, applied to a server. This method includes:

[0006] Receive scan results of pre-assigned test warehouse data from multiple electronic devices participating in federated learning;

[0007] The scanning results of each electronic device are subjected to convolutional hashing to obtain the fingerprint of the scanning result;

[0008] The trained classification model is used to perform sensitive category analysis on the fingerprint of the scan results to obtain the sensitive category membership degree corresponding to the scan results of each electronic device;

[0009] Based on the membership degree of sensitive categories and preset thresholds, the system detects whether sensitive information is leaked in the warehouse data scanned by the corresponding electronic device, and sends the detection results to the corresponding electronic device.

[0010] In one feasible implementation, the scanning results of each electronic device are subjected to convolutional hashing to obtain a scanning result fingerprint, including: segmenting the scanning results of each electronic device to obtain multiple keywords; hashing each keyword to obtain a hash feature vector; weighting the hash feature vector to obtain a weighted feature vector; constructing a weighted feature matrix of the scanning results based on the weighted feature vectors of the multiple keywords in the scanning results; and convolving the weighted feature matrix of the scanning results to obtain the scanning result fingerprint.

[0011] In one feasible implementation, before performing sensitive category analysis on the scan result fingerprint using the trained classification model to obtain the sensitive category membership degree corresponding to the scan result of each electronic device, the method further includes: reading multiple sets of sensitive words corresponding to each category from the local sensitive information database of the server; performing convolutional hashing on the sensitive word set corresponding to each category to obtain the sensitive information fingerprint corresponding to each category; and training a pre-established classification model on the sensitive information fingerprint corresponding to each category to obtain a trained classification model.

[0012] In one feasible implementation, before reading the sensitive word sets corresponding to multiple categories from the server's local sensitive information database, the method further includes: performing word segmentation on the sensitive information statistics of each category to obtain multiple keywords; calculating the TF-IDF value of each keyword in the sensitive information statistics of the corresponding category; selecting multiple keywords with larger TF-IDF values ​​to form the sensitive word set corresponding to the category; and storing the set in the server's local sensitive information database.

[0013] In one feasible implementation, before reading the sensitive word sets corresponding to multiple categories from the server's local sensitive information database, the method further includes: detecting the update status of the server's local sensitive information database; if the update status is updated, calculating the TF-IDF value of each sensitive word in the sensitive information statistics data of the corresponding category in the updated local sensitive information database, and reselecting multiple keywords with larger TF-IDF values ​​as the sensitive word set corresponding to that category.

[0014] In one feasible implementation, convolutional hashing is performed on the sensitive word set corresponding to each category to obtain the sensitive information fingerprint corresponding to each category. This includes: hashing each word in the sensitive word set corresponding to each category to obtain a hash feature vector; weighting the hash feature vector to obtain a weighted feature vector; constructing a weighted feature matrix corresponding to each category based on the weighted feature vectors of all words in the sensitive word set corresponding to each category; and performing convolution processing on the weighted feature matrix of each category to obtain the sensitive information fingerprint corresponding to that category.

[0015] In one feasible implementation, based on the membership degree of a sensitive category and a preset threshold, it is determined whether sensitive information is leaked in the warehouse data scanned by the corresponding electronic device. This includes: if the membership degree of a sensitive category is greater than or equal to the preset threshold, it is determined that sensitive information is leaked in the warehouse data scanned by the corresponding electronic device; if the membership degree of a sensitive category is less than the preset threshold, it is determined that sensitive information is not leaked in the warehouse data scanned by the corresponding electronic device.

[0016] In one feasible implementation, sending the detection result to the corresponding electronic device includes: if it is determined that there is sensitive information leakage in the warehouse data scanned by the corresponding electronic device, generating an alarm message indicating that there is sensitive information leakage in the warehouse data scanned by the corresponding electronic device, and sending the alarm message to the corresponding electronic device.

[0017] Secondly, embodiments of this application provide a method for detecting the leakage of sensitive information from GitHub based on federated learning, applied to electronic devices. The method includes:

[0018] Scan the pre-assigned warehouse data to be tested and send the scan results to the server;

[0019] If the detection result sent by the server indicates that the electronic device has leaked sensitive information in the warehouse data being scanned, then the leaked sensitive information segment is identified.

[0020] Extract several sensitive words with large TF-IDF values ​​from the leaked sensitive information segments and send them to the server to update the server's local sensitive information database.

[0021] In one feasible implementation, the pre-allocated repository data to be tested is determined by the communication between multiple electronic devices participating in federated learning and GitHub.

[0022] Thirdly, embodiments of this application provide a GitHub sensitive information leakage detection device based on federated learning, applied to a server, the device comprising:

[0023] The first receiving unit is used to receive the scanning results of the pre-allocated test warehouse data from multiple electronic devices participating in federated learning.

[0024] The processing unit is used to perform convolutional hashing on the scanning results of each electronic device to obtain the fingerprint of the scanning result;

[0025] The classification unit is used to perform sensitive category analysis on the fingerprint of the scanned results using a trained classification model, and obtain the sensitive category membership degree corresponding to the scanned results of each electronic device;

[0026] The detection unit is used to detect whether sensitive information is leaked in the warehouse data scanned by the corresponding electronic device, based on the membership degree of the sensitive category and the preset threshold.

[0027] The first transmitting unit is used to send the detection results to the corresponding electronic device.

[0028] Fourthly, embodiments of this application provide a GitHub sensitive information leakage detection device based on federated learning, applied to electronic devices, the device comprising:

[0029] The scanning unit is used to scan the pre-assigned warehouse data to be tested;

[0030] The second sending unit is used to send the scan results to the server;

[0031] The second receiving unit is used to receive the comparison results sent by the server;

[0032] The identification unit is used to identify the leaked sensitive information segment if the comparison result determines that the data of the warehouse under test scanned by the electronic device has been leaked.

[0033] The extraction unit is used to extract multiple sensitive words with large TF-IDF values ​​from the leaked sensitive information segment and send them to the server to update the server's local sensitive information database.

[0034] Fifthly, embodiments of this application provide a terminal device, including: a processor and a memory storing computer program instructions; the processor reads and executes the computer program instructions to implement the federated learning-based GitHub sensitive information leakage detection method as described above.

[0035] Sixthly, embodiments of this application provide a computer-readable storage medium, characterized in that the computer-readable storage medium stores computer program instructions, which, when executed by a processor, implement the GitHub sensitive information leakage detection method based on federated learning as described above.

[0036] The federated learning-based method for detecting sensitive information leakage on GitHub provided in this application involves multiple electronic devices participating in federated learning performing a distributed scanning task on GitHub and uploading the scan results to a server. The server receives the scan results of the multiple electronic devices on pre-assigned test repository data and performs convolutional hashing on the scan results of each electronic device to obtain a scan result fingerprint. A trained classification model is then used to perform sensitive category analysis on the scan result fingerprint to obtain the sensitive category membership degree corresponding to the scan result of each electronic device. Finally, the sensitive category membership degree is compared with a preset threshold, and the comparison result determines whether there is sensitive information leakage in the test repository data scanned by the corresponding electronic device.

[0037] On the one hand, by establishing scanning tasks on various distributed devices, multiple electronic devices can jointly perform distributed scanning tasks on GitHub, improving the scanning efficiency of the repositories under test. Even for large repositories or complex code structures, scanning tasks can be completed quickly. On the other hand, based on the federated learning framework, the server processes the scanning results uniformly, obtains sensitive information detection results based on the trained model, and transmits the detection results to the corresponding electronic devices. The parameter transmission process between the server and participating devices is encrypted using encryption algorithms (such as differential privacy, homomorphic encryption, etc.) before transmission. Only the detection results are transmitted, without transmitting model data, further eliminating the possibility of secondary leakage of sensitive information. At the same time, it strictly ensures that model parameters will not be leaked. Therefore, it can protect the privacy of each participating device, further enhancing the practicality and robustness of the detection device, thereby resisting other security threats. Attached Figure Description

[0038] To more clearly illustrate the technical solutions of the embodiments of this application, the accompanying drawings used in the embodiments of this application will be briefly introduced below. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0039] Figure 1 A schematic diagram of the federated learning framework provided for embodiments of this application;

[0040] Figure 2 A flowchart of a GitHub sensitive information leakage detection method based on federated learning provided in one embodiment of this application;

[0041] Figure 3 A flowchart of a GitHub sensitive information leakage detection method based on federated learning provided in another embodiment of this application;

[0042] Figure 4 This is a schematic diagram of a text segment containing sensitive information provided in an embodiment of this application;

[0043] Figure 5 This is a schematic diagram of the structure of a convolutional neural network provided in an embodiment of this application;

[0044] Figure 6 A flowchart of a GitHub sensitive information leakage detection method based on federated learning provided in another embodiment of this application;

[0045] Figure 7 A flowchart of a GitHub sensitive information leakage detection method based on federated learning provided in another embodiment of this application;

[0046] Figure 8A modeling logic block diagram of the federated learning method for detecting sensitive information leakage on GitHub provided in the embodiments of this application;

[0047] Figure 9 A flowchart of a GitHub sensitive information leakage detection method based on federated learning provided in another embodiment of this application;

[0048] Figure 10 A schematic diagram of the structure of a GitHub sensitive information leakage detection device based on federated learning provided in one embodiment of this application;

[0049] Figure 11 A schematic diagram of the structure of a GitHub sensitive information leakage detection device based on federated learning, provided as another embodiment of this application;

[0050] Figure 12 This is a schematic diagram of the hardware structure of the terminal device provided in the embodiments of this application. Detailed Implementation

[0051] The features and exemplary embodiments of various aspects of this application will be described in detail below. To make the objectives, technical solutions, and advantages of this application clearer, the application will be further described in detail below with reference to the accompanying drawings and specific embodiments. It should be understood that the specific embodiments described herein are only intended to explain this application and not to limit it. For those skilled in the art, this application can be implemented without some of these specific details. The following description of the embodiments is merely to provide a better understanding of this application by illustrating examples.

[0052] It should be noted that, in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or electronic device that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or electronic device. Without further limitations, an element defined by the phrase "comprising..." does not exclude the presence of other identical elements in the process, method, article, or electronic device that includes said element.

[0053] To address the problems of existing technologies, embodiments of this application provide a method, apparatus, device, and computer storage medium for detecting the leakage of sensitive information from GitHub using federated learning. The following first illustrates a federated learning framework from which the detection method provided in this application can be applied.

[0054] Federated learning is a privacy-preserving distributed machine learning approach that avoids centralizing user data and exposing it to a central training server. Participants simply train their local models repeatedly, sending the model parameters obtained from each round of training to the central training server until the central server determines that the model has converged, thus completing one training cycle. In other words, the federated learning mechanism only transmits parameters, not real data, and the modeling parameters are also transmitted in encrypted form, enhancing the security of the detection device.

[0055] like Figure 1 As shown, this federated learning framework can include servers and electronic devices. These electronic devices can be, for example, mobile terminals, personal computers, or wearable electronic devices, etc., without specific limitations here.

[0056] Electronic devices can have communication modules, such as 5G, 4G, or WiFi modules, to enable communication between the electronic device and the server. For example, the electronic device can send its own hardware and software data to the server. The server can receive the data sent by the electronic device and process it.

[0057] from Figure 1 As can be seen, the server is connected to multiple electronic devices, presenting a "one-to-many" structure, and the overall testing process is completed through division of labor and cooperation.

[0058] Figure 2 This application illustrates a method for detecting sensitive information leakage on GitHub based on federated learning, according to an embodiment of the present application. This detection method can be applied to servers, such as… Figure 2 As shown, the detection method includes steps S201-S204.

[0059] Step S201: Receive the scan results of the pre-allocated test warehouse data from multiple electronic devices participating in federated learning.

[0060] As mentioned above, electronic devices can be local hosts.

[0061] In some embodiments, the scanning task can be manually configured to monitor communication between the local host and GitHub to collect target repository addresses. Specific statistics are shown in Table 1.

[0062] Table 1

[0063] Host address port number warehouse address Access time Number of visits IP1 Prot1 URL1 16:31-17:00 3 IP2 Prot1 URL2 16:31-17:00 5 ... ... ... ... ...

[0064] In this embodiment of the application, all detection targets can be distinguished according to Table 1 and distributed to different scanning hosts for execution, thereby improving execution efficiency.

[0065] In one example, the overall scan task can be obtained by summarizing the communication between each local host and GitHub. The overall scan task can then be divided into distributed scan tasks, and a portion of the scan task can be assigned to each local host. Each local host only needs to execute the assigned scan task, thereby improving the overall scanning efficiency of the GitHub repository.

[0066] In another example, the pre-allocated test repository data for each local host can be associated only with its own communication data with GitHub, without involving the communication data between other hosts and GitHub. In this way, even if the corresponding test repository data is leaked, the leaked repository data is limited to the corresponding electronic device, reducing the risk of spread.

[0067] According to the embodiments of this application, after determining the scanning task list for each local host, a suitable scanning engine can be selected. Considering that the scanning engines on the market are relatively mature, this application does not involve designing a scanning engine. Commonly selected engines include TruffleHog, GitGuardian, and Repo-Supervisor. Specific keywords such as the company name "ChinaMobile" or the English name of the business can be used to design keywords for detection. The scanning results of the scanner on GitHub are recorded, as shown in Table 2, and uploaded to the server.

[0068] Table 2

[0069] Scan hit words URL address Warehouse data China Mobile https: / / github.com / xxxxx 1.zip China Mobile https: / / github.com / xxxxx 2.zip China Mobile https: / / github.com / xxxxx 3.zip ... ... ...

[0070] Step S202: Perform convolutional hashing on the scanning results of each electronic device to obtain the scanning result fingerprint (see below for details).

[0071] Step S203: Use the trained classification model to perform sensitive category analysis on the fingerprint of the scan results to obtain the sensitive category membership degree corresponding to the scan results of each electronic device.

[0072] In one example, sensitive information can be classified into 8 categories according to the sensitive information classification and grading standard, with category numbers A and H. The classification model will then output the probabilities of sensitive information for each of the 8 categories. The model processing results are shown in Table 3.

[0073] Table 3

[0074] Host Number Host IP Information segment name Category Number Sensitive category membership 02342 10.5.23.123 code1 A 63.2％ 00631 10.5.5.21 text1 A 51.8％ 16232 10.5.6.10 code2 B 23.1％

[0075] Step S204: Based on the sensitive category membership degree and preset threshold, detect whether there is sensitive information leakage in the warehouse data scanned by the corresponding electronic device, and send the detection result to the corresponding electronic device.

[0076] In this step, if the membership degree of the sensitive category is greater than or equal to the preset threshold, it is determined that the warehouse data scanned by the corresponding electronic device has sensitive information leakage; if the membership degree of the sensitive category is less than the preset threshold, it is determined that the warehouse data scanned by the corresponding electronic device does not have sensitive information leakage.

[0077] For example, filtering conditions can be set, with a preset threshold of 50%. For information segments with a sensitivity category membership greater than 50%, it is determined that they contain sensitive information, and an alarm needs to be triggered on the corresponding host. For instance, if it is determined that sensitive information is leaked in the warehouse data scanned by the corresponding electronic device, an alarm message indicating that sensitive information is leaked in the warehouse data scanned by the corresponding electronic device is generated and sent to the corresponding electronic device.

[0078] It should be noted that the preset threshold can be set based on experience. For example, the preset threshold can be adjusted to be less than 50% to increase the amount of sensitive information detected and improve the error tolerance of the detection results, or it can be made greater than 50% to increase the amount of sensitive information detected and make the detection results more accurate. There is no limitation here.

[0079] It is worth mentioning that the embodiments of this application avoid simply using the two labels of "hitting sensitive results" and "not hitting sensitive results" to evaluate the scanning results. Instead, it refines the ability to describe the relevance of sensitive information, sets the variable value of sensitive category membership, and makes different judgments based on different membership degrees.

[0080] As described above, the GitHub sensitive information leakage detection method based on federated learning provided in this application involves multiple electronic devices participating in federated learning performing a distributed scanning task on GitHub and uploading the scanning results to a server. The server receives the scanning results of the pre-allocated test repository data from the multiple electronic devices, performs convolutional hashing on the scanning results of each electronic device to obtain a scanning result fingerprint, and uses a trained classification model to perform sensitive category analysis on the scanning result fingerprint to obtain the sensitive category membership degree corresponding to the scanning result of each electronic device. Finally, the sensitive category membership degree is compared with a preset threshold, and the comparison result determines whether there is sensitive information leakage in the test repository data scanned by the corresponding electronic device.

[0081] On the one hand, by establishing scanning tasks on various distributed devices, multiple electronic devices can jointly perform distributed scanning tasks on GitHub, improving the scanning efficiency of the repositories under test. Even for large repositories or complex code structures, scanning tasks can be completed quickly. On the other hand, based on the federated learning framework, the server processes the scanning results uniformly, obtains sensitive information detection results based on the trained model, and transmits the detection results to the corresponding electronic devices. The parameter transmission process between the server and participating devices is encrypted using encryption algorithms (such as differential privacy, homomorphic encryption, etc.) before transmission. Only the detection results are transmitted, without transmitting model data, further eliminating the possibility of secondary leakage of sensitive information. At the same time, it strictly ensures that model parameters will not be leaked. Therefore, it can protect the privacy of each participating device, further enhancing the practicality and robustness of the detection device, thereby resisting other security threats.

[0082] In some embodiments, such as Figure 3 As shown, before step S203, the GitHub sensitive information leakage detection method based on federated learning provided in this application embodiment further includes the following steps S205-S207, used to train the classification model:

[0083] Step S205: Read the set of sensitive words corresponding to multiple categories from the local sensitive information database of the server.

[0084] In this step, the server's local sensitive information database pre-stores the input data for training. The training of the classification model can be completed by the server, and it can be directly read from the local sensitive information database during training.

[0085] In some embodiments, the sensitive information statistics of each category can be segmented first to obtain multiple keywords. Then, the TF-IDF value of each keyword in the sensitive information statistics of the corresponding category can be calculated. Multiple keywords with larger TF-IDF values ​​are selected to form a sensitive word set corresponding to the category and stored in the local sensitive information database of the server for model training.

[0086] Generally, the statistical work on sensitive information can be completed by the user of the detection device. See Table 4 for details, which shows statistical data on sensitive information under multiple categories. For example, the statistical data on sensitive information may include routine backend maintenance information, usernames, passwords, session information, etc.

[0087] Table 4

[0088]

[0089] In practical applications, word segmentation tools can be used to divide the text into segments and remove stop words. For example, Figure 4The text segment containing sensitive information is shown. By segmenting it, we can obtain the "variable name" and its corresponding "variable value". Then, the TF-IDF algorithm is used to calculate the importance of the variable in the sensitive information database.

[0090] TF-IDF (Term Frequency-Inverse Document Frequency) is a weighting technique commonly used in text mining to evaluate the importance of a word to a document within a set of documents or a corpus. A word's importance increases proportionally to its frequency in the document and decreases inversely proportionally to its frequency in the corpus.

[0091] The core idea is that if a variable has a high frequency of occurrence (TF) in a certain sensitive information segment and rarely appears in other sensitive information segments, then this word, phrase, or variable name is considered to have a good ability to distinguish categories and is suitable for distinguishing various sensitive information segments.

[0092] The calculation method is to count the frequency of the variable name in the sensitive information segment, and use it as TF.

[0093] Next, calculate the reverse file frequency (IDF) of this variable in other sensitive information segments. The formula for IDF is as follows:

[0094]

[0095] In the above formula, N represents the total number of sensitive information segments, and N(x) represents the number of other information segments containing the variable. Both the numerator and denominator are increased by 1 to smooth the result and prevent the denominator from being 0.

[0096] By organizing the data, we obtain the TF-IDF values ​​of all words and then sort them from largest to smallest. In one example, we can select the 10,000 most representative sensitive information items, that is, the top 10,000 words with the largest TF-IDF values, to form the sensitive word set corresponding to this category, and store them in the local sensitive information database on the server for use in model training.

[0097] Step S206: Perform convolutional hashing on the sensitive word set corresponding to each category to obtain the sensitive information fingerprint corresponding to each category.

[0098] In this step, the convolutional hashing of the sensitive word set is performed on the server.

[0099] Specifically, step S206 may include the following sub-steps:

[0100] (1) Hash each word in the sensitive word set corresponding to each category to obtain a hash feature vector;

[0101] (2) Weight the hash feature vectors to obtain weighted feature vectors;

[0102] (3) Construct the weighted feature matrix corresponding to each category based on the weighted feature vectors of all words in the sensitive word set corresponding to each category;

[0103] (4) Perform convolution on the weighted feature matrix of each category to obtain the sensitive information fingerprint corresponding to that category.

[0104] To facilitate understanding by those skilled in the art, the implementation of step S206 will be explained in detail below:

[0105] First, a hash function can be used to calculate the vector value of each sensitive word. The hash value is an n-bit signature composed of binary 0s and 1s. Each sensitive word corresponds to a unique hash signature. For example, the hash value of "public_key" is 110110, and the hash value of "private_key" is 110001. The process of determining the hash value is random; it only requires a one-to-one correspondence. In the previous step, we selected the 10,000 most representative sensitive words, and similarly, we can obtain 10,000 hash signatures. In this way, each sensitive word becomes a corresponding binary number.

[0106] Currently, hash methods are quite mature. Their main purpose is to generate a unique, fixed-length string from an input of arbitrary length through hash calculation. The word hashing process can directly call a hash function; commonly used hash functions include MD5, SHA-1, and SHA-2.

[0107] Then, based on the hash value, all vectors can be weighted. Table 4 also shows the sensitivity level and weight of each piece of information. The higher the sensitivity level, the higher the weight.

[0108] The revised data calculation formula is as follows:

[0109] Value = Hash(x) × Weight (2)

[0110] Since hash values ​​are binary, during weighted calculations, if the corresponding bit is 1, the calculation proceeds normally. If the corresponding bit is 0, the weight is multiplied by -1. That is, if the hash value of "public_key" is 110110 and its weight is 5, the calculated value will be (5, -5, 5, 5, -5). Similarly, weighted vectors for other sensitive information can be calculated.

[0111] Next, we can select 10,000 keywords to describe a text. Since each keyword has an n-bit weighted vector, the vector dimension after text conversion is n0,000, which is quite complicated to calculate. Therefore, we designed a method based on convolutional neural networks to compress and reduce the dimension of the vector.

[0112] Specifically, the i-th element of each sensitive word's weighted vector can be extracted. Since the vector has n dimensions, this results in n 100*100 matrices. For example, the matrix a0 representing the first dimension of each word's vector can be extracted as follows:

[0113]

[0114] Among them, a 0,0 Let a represent the first dimension of the first word vector. 0,99 a represents the first dimension of the 100th word vector. 0,9999 This represents the first dimension of the 10000th word vector.

[0115] Similarly, we can obtain a1, a2 to a n-1 A weighted vector matrix of sensitive words with n dimensions is generated, and then input into a convolutional neural network for convolution to achieve dimensionality reduction.

[0116] Figure 5 The structure of the convolutional neural network provided in the embodiments of this application is shown.

[0117] Table 5 provides detailed information. Figure 5 The arrangement order and parameter settings of each layer of the neural network.

[0118] As can be seen, there are 2 convolutional layers, each 5×5 in size, with ReLU as the activation function; 2 pooling layers, each 2×2 in size; and 2 fully connected layers. The number of neurons is set according to the input of the previous network structure, which is 64 and 8 respectively.

[0119] exist Figure 5 In the model, the result obtained from the second-to-last fully connected layer with the ReLU function is the ConvHash fingerprint. The last fully connected layer with the Softmax function processes the ConvHash fingerprint to build a classification model.

[0120] Table 5

[0121] order Network layer type shape Activation function 1 Convolutional layer (5,5,1) relu 2 Pooling layer (2,2,1) 3 Convolutional layer (5,5,1) relu 4 Pooling layer (2,2,1) 5 Fully connected layer (64,1) relu 6 Fully connected layer (8,1) softmax

[0122] Step S207: Based on the sensitive information fingerprint corresponding to each category, train the pre-established classification model to obtain the trained classification model.

[0123] In this step, the sensitive information fingerprint corresponding to each category can be obtained using the statistically analyzed sensitive data, and then used to train the model to obtain a trained classification model based on softmax.

[0124] It should be noted that, in this embodiment of the application, sensitive information in the local sensitive information database and data scanned by the tool need to be converted into ConvHash fingerprints and compared.

[0125] The convolutional hashing of the scan results is also performed on the server. Specifically, step S202 may include the following sub-steps:

[0126] (1) The scanning results of each electronic device are segmented into words to obtain multiple keywords;

[0127] Given a piece of code or text in the scan results, first perform word segmentation.

[0128] Given a text:

[0129] “

[0130] public_key:

[0131] "3ifmP1hP41e9otZ9EnFT6NENuYzaErc1U974tNNLNPNFVASG4xVhCN7AYNnpJpbE",

[0132] private_key:

[0133] "FaJmCctZMKmDgdZGSMF3FndDymi10UV5NOGuZ65Bm1TZHdQOYgYLAIMizgV9Hff",

[0134] xxtestxx_oa_url_openapi:"https: / / proxy.xxtestxx.com / openapi",

[0135] xxtestxx_oa_client_secret:"abc1234567890",

[0136] xxtestxx_oa_client_access_key:"xyz0987654321"

[0137] "

[0138] After word segmentation, its keywords are: "public_key" and "private_key".

[0139] "xxtestxx_oa_url_openapi", "xxtestxx_oa_client_secret",

[0140] "xxtestxx_oa_client_access_key",

[0141] (2) Hash each keyword to obtain a hash feature vector;

[0142] (3) Weight the hash feature vectors to obtain weighted feature vectors;

[0143] (4) Construct a weighted feature matrix of the scanning results based on the weighted feature vectors of multiple keywords in the scanning results;

[0144] (5) Perform convolution processing on the weighted feature matrix of the scanning results to obtain the fingerprint of the scanning results.

[0145] It should be noted that the implementation process of sub-steps (2)-(5) after word segmentation of the above scanning results can refer to steps S205-S207 above. Both undergo hashing, weighting, construction of weighted feature matrix and generation of Convhash fingerprint. The difference is that steps S205-S207 obtain the Convhash fingerprint of sensitive information corresponding to each category, while step S202 obtains the Convhash fingerprint of the scanning result.

[0146] In some embodiments, such as Figure 6 As shown, before step S205, the GitHub sensitive information leakage detection method based on federated learning also includes steps S208 and S209, which are used to realize the dynamic updating of sensitive information.

[0147] Step S208: Check the update status of the server's local sensitive information database;

[0148] In this step, the establishment of a local sensitive information database on the server can provide users with an update channel while dynamically updating sensitive information.

[0149] In a specific application example, after receiving the detection results sent by the server, the distributed device can make a judgment. If the detection results indicate that the data of the warehouse to be tested scanned by the electronic device has sensitive information leakage, it is necessary to identify the leaked sensitive information segment. Then, from the leaked sensitive information segment, extract multiple sensitive words with large TF-IDF and send them to the server to update the server's local sensitive information database.

[0150] Generally, the update process of the server's local sensitive information database is executed every time a leak is detected. Furthermore, in order to obtain the optimal modeling parameters, before performing convolutional hashing on the scan results of each electronic device, the server can first check the update status of its own local sensitive information database to see if any new sensitive information has appeared. If so, it needs to extract the keywords with higher TF-IDF values ​​and update the subsequent data hashing method.

[0151] Step S209: If the update status is updated, calculate the TF-IDF value of each sensitive word in the corresponding category of the sensitive information statistics in the updated local sensitive information database, and reselect multiple keywords with larger TF-IDF values ​​as the sensitive word set corresponding to that category.

[0152] The embodiments of this application have a dynamic adjustment mechanism for modeling parameters based on the results of sensitive information leakage detection, which updates key sensitive information in real time, continuously optimizes the detection results of the model, and further improves the quality of sensitive information leakage detection.

[0153] This application also provides a method for detecting the leakage of sensitive information from GitHub based on federated learning, applicable to electronic devices, such as... Figure 7 As shown, the method includes steps S701-S703.

[0154] Step S701: Scan the pre-allocated warehouse data to be tested and send the scan results to the server;

[0155] In this step, the scanning task is mainly set up manually, and the communication between the local host and GitHub is monitored to collect target repository addresses. Specific statistics are shown in Table 1. Then, all detection targets are differentiated and distributed across different scanning hosts to improve execution efficiency. The pre-allocated repository data is determined by the communication between the multiple electronic devices participating in federated learning and GitHub.

[0156] The task list for scanning the host can then be determined, and the selected scanning engine can be chosen. Specific keywords such as the company name "China Mobile" or the English name of the business can be used to design keywords for detection. The scan results from the scanner on GitHub are recorded (see Table 2) and then uploaded to the server.

[0157] Step S702: Receive the detection result sent by the server. If the detection result indicates that the data of the warehouse to be tested scanned by the electronic device contains sensitive information leakage, then identify the leaked sensitive information segment.

[0158] Step S703: Extract multiple sensitive words with large TF-IDF values ​​from the leaked sensitive information segment and send them to the server to update the server's local sensitive information database.

[0159] In other words, the distributed device in this embodiment can process the original text based on the judgment result of sensitive information to obtain new key information and update it in the modeling process in a timely manner. This dynamic adjustment mechanism of modeling parameters based on the sensitive information leakage detection result can update key sensitive information in real time, continuously optimize the detection results of the model, and further improve the quality of sensitive information leakage detection.

[0160] Figure 8 This paper illustrates the modeling approach of the GitHub sensitive information leakage detection method based on federated learning, as described in this application. The core idea is to perform necessary sensitive information data processing (including federated modeling and model training) on ​​the server, while simultaneously establishing scanning tasks on various distributed devices. The scanning results are then transmitted to the server for CovHash conversion, and the membership degree of sensitive categories is determined in the neural network to obtain the sensitive information detection results. These results are then transmitted back to the devices, which identify the leaked sensitive information and dynamically update the sensitive information database.

[0161] For the convenience of those skilled in the art, please refer to [link / reference needed]. Figure 9 , Figure 9 From the perspective of interaction between the local host and the server, the flowchart of the GitHub sensitive information leakage detection method based on federated learning in this application is illustrated with an example.

[0162] exist Figure 9 In the specific example, the local host mainly includes two modules: the local task initialization module and the local task execution module. The local task initialization module mainly executes steps a1-a3, responsible for local task scheduling and initializing scan parameters. The local task execution module mainly executes steps a4-a8, responsible for executing the scan task, transmitting the GitHub repository scan results to the server, and then analyzing the server's results, extracting and updating representative information.

[0163] exist Figure 9 In the specific example, the server mainly consists of two modules: a federated task initialization module and a federated task execution module. The federated task initialization module mainly executes steps b1 and b2, responsible for federated task scheduling and updating and verifying the sensitive information database. The federated task execution module mainly executes steps b3-b7, responsible for calculating convolutional hashes (CovHash) and processing with the neural network classification model, and updating the sensitive information database.

[0164] It should be noted that steps a1-a3 and steps b1-b3 are not in any particular order and are executed within their respective devices.

[0165] a1. Target address organization refers to the collection and organization of scanning targets, which can usually be obtained from the communication between the local machine and GitHub;

[0166] a2. Determining the local task refers to dividing the overall scanning task into distributed scanning tasks;

[0167] a3. Selecting a scanning tool refers to choosing a scanner, such as TruffleHog, GitGuardian, Repo-Supervisor, etc.

[0168] b1. Sensitive data processing refers to the collection and processing of sensitive information;

[0169] b2. Checking the update status of the sensitive information database refers to checking whether the existing sensitive information database has been updated and whether new sensitive information has appeared. If no new sensitive information has appeared, prepare for data hashing directly. If new sensitive information has appeared, it is necessary to extract keywords with higher TF-IDF and update the subsequent data hashing method.

[0170] b3. The sensitive information data is processed using the ConvHash algorithm proposed in the embodiments of this application to obtain the sensitive data ConvHash fingerprint, and then modeled using a softmax network.

[0171] The overall testing steps are performed sequentially, starting from A4:

[0172] a4. Scan the GitHub repository and obtain the scan results;

[0173] a5. Send the scan results to the server;

[0174] b4. Process the scanning results using the CovnHash algorithm proposed in the embodiments of this application to obtain the scan result ConvHash fingerprint;

[0175] b5. Process the similarity of the scanned ConvHash fingerprints in the neural network classification model to obtain the comparison results, and present them in the form of sensitive class membership.

[0176] b6. Send the test results back to the local host;

[0177] a6. Confirm the leakage of sensitive information;

[0178] a7. Identify leaked sensitive information and extract and update sensitive keywords;

[0179] a8. Send the updated sensitive words to the server;

[0180] b7. Update the sensitive information database.

[0181] It should be noted that, Figure 9 The steps in the example have been simplified. The detailed process of each step can be found in the text above, and will not be repeated here.

[0182] As can be seen from the above application examples, this application employs a distributed federated scanning detection method. Parallel scanning processing across multiple hosts increases the detection efficiency of the target repository. Furthermore, a sensitive information database and a dynamic update mechanism are established. This database provides users with an update channel while dynamically updating sensitive information, setting information weights, and extracting highly representative information from code blocks or text with high similarity to sensitive information as new sensitive information, thus dynamically updating the database. In addition, a federated learning mechanism is established. Only parameters are transmitted, not actual data, and the modeling parameters are also transmitted encrypted, further enhancing the security of the detection device.

[0183] like Figure 10 As shown, this application also provides a federated learning-based GitHub sensitive information leakage detection device, applied to a server, including:

[0184] The first receiving unit 1001 is used to receive the scanning results of the pre-allocated test warehouse data from multiple electronic devices participating in federated learning.

[0185] The processing unit 1002 is used to perform convolutional hashing on the scanning results of each electronic device to obtain the scanning result fingerprint;

[0186] Classification unit 1003 is used to perform sensitive category analysis on the fingerprint of the scanned result using a trained classification model to obtain the sensitive category membership degree corresponding to the scanned result of each electronic device;

[0187] The detection unit 1004 is used to detect whether sensitive information is leaked in the warehouse data scanned by the corresponding electronic device, based on the sensitive category membership degree and preset threshold.

[0188] The first transmitting unit 1005 is used to transmit the detection result to the corresponding electronic device.

[0189] It should be noted that the federated learning-based GitHub sensitive information leakage detection device is the same as the detection method applied to the server described above. All implementation methods in the above method embodiments are applicable to the embodiments of this device and can achieve the same technical effect.

[0190] like Figure 11As shown in the illustration, this application also provides a GitHub sensitive information leakage detection device based on federated learning, applied to electronic devices, including:

[0191] The scanning unit 1101 is used to scan the pre-allocated warehouse data to be tested;

[0192] The second sending unit 1102 is used to send the scan results to the server;

[0193] The second receiving unit 1103 is used to receive the comparison results sent by the server;

[0194] The identification unit 1104 is used to identify the leaked sensitive information segment if the comparison result determines that the data of the warehouse under test scanned by the electronic device has been leaked.

[0195] Extraction unit 1105 is used to extract multiple sensitive words with large TF-IDF from the leaked sensitive information segment and send them to the server to update the server's local sensitive information database.

[0196] It should be noted that the federated learning-based GitHub sensitive information leakage detection device is the same device as the detection method applied to electronic devices described above. All implementation methods in the above method embodiments are applicable to the embodiments of this device and can achieve the same technical effect.

[0197] Figure 12 A schematic diagram of the hardware structure of the terminal device provided in an embodiment of this application is shown.

[0198] The terminal device may include a processor 1201 and a memory 1202 storing computer program instructions.

[0199] Specifically, the processor 1201 may include a central processing unit (CPU), an application-specific integrated circuit (ASIC), or one or more integrated circuits that can be configured to implement the embodiments of this application.

[0200] Memory 1202 may include mass storage for data or instructions. For example, and not limitingly, memory 1202 may include a hard disk drive (HDD), floppy disk drive, flash memory, optical disk, magneto-optical disk, magnetic tape, or Universal Serial Bus (USB) drive, or a combination of two or more of these. Where appropriate, memory 1202 may include removable or non-removable (or fixed) media. Where appropriate, memory 1202 may be internal or external to the integrated gateway disaster recovery electronics. In a particular embodiment, memory 1202 is non-volatile solid-state memory.

[0201] In a particular embodiment, memory 1202 includes read-only memory (ROM). Where appropriate, the ROM may be a mask-programmed ROM, a programmable ROM (PROM), an erasable PROM (EPROM), an electrically erasable PROM (EEPROM), an electrically rewritable ROM (EAROM), or flash memory, or a combination of two or more of these.

[0202] Memory may include read-only memory (ROM), random access memory (RAM), disk storage media electronics, optical storage media electronics, flash memory electronics, and electrical, optical, or other physical / tangible memory storage electronics. Therefore, typically, memory includes one or more tangible (non-transitory) computer-readable storage media (e.g., memory electronics) encoded with software including computer-executable instructions, and when the software is executed (e.g., by one or more processors), it is operable to perform the operations described with reference to the method according to one aspect of this disclosure.

[0203] The processor 1201 reads and executes computer program instructions stored in the memory 1202 to implement any of the federated learning-based GitHub sensitive information leakage detection methods in the above embodiments.

[0204] In one example, the terminal device may also include a communication interface 1203 and a bus 1210. Wherein, for example... Figure 12 As shown, the processor 1201, memory 1202, and communication interface 1203 are connected through bus 1210 and complete communication with each other.

[0205] The communication interface 1203 is mainly used to realize communication between various modules, devices, units and / or electronic devices in the embodiments of this application.

[0206] Bus 1210 includes hardware, software, or both, that couples components of an online data traffic metering electronics device together. For example, and not limitingly, the bus may include an Accelerated Graphics Port (AGP) or other graphics bus, an Enhanced Industry Standard Architecture (EISA) bus, a Front Side Bus (FSB), HyperTransport (HT) interconnect, an Industry Standard Architecture (ISA) bus, an Infinite Bandwidth Interconnect, a Low Pin Count (LPC) bus, a memory bus, a Microchannel Architecture (MCA) bus, a Peripheral Component Interconnect (PCI) bus, a PCI-Express (PCI-X) bus, a Serial Advanced Technology Attachment (SATA) bus, a Video Electronics Standards Association Local (VLB) bus, or other suitable buses, or combinations of two or more of these. Where appropriate, bus 1210 may include one or more buses. Although specific buses are described and illustrated in embodiments of this application, any suitable bus or interconnect is contemplated herein.

[0207] Furthermore, in conjunction with the federated learning-based GitHub sensitive information leakage detection method in the above embodiments, this application embodiment can provide a computer storage medium for implementation. This computer storage medium stores computer program instructions; when these computer program instructions are executed by a processor, they implement any of the federated learning-based GitHub sensitive information leakage detection methods in the above embodiments.

[0208] It should be clarified that this application is not limited to the specific configurations and processes described above and shown in the figures. For the sake of brevity, detailed descriptions of known methods are omitted here. In the above embodiments, several specific steps are described and shown as examples. However, the method process of this application is not limited to the specific steps described and shown. Those skilled in the art can make various changes, modifications, and additions, or change the order of steps, after understanding the spirit of this application.

[0209] The functional blocks shown in the above-described structural diagram can be implemented as hardware, software, firmware, or a combination thereof. When implemented in hardware, they can be, for example, electronic circuits, application-specific integrated circuits (ASICs), appropriate firmware, plug-ins, function cards, etc. When implemented in software, the elements of this application are programs or code segments used to perform the required tasks. Programs or code segments can be stored on a machine-readable medium or transmitted over a transmission medium or communication link via data signals carried on a carrier wave. "Machine-readable medium" can include any medium capable of storing or transmitting information. Examples of machine-readable media include electronic circuits, semiconductor memory electronics, ROM, flash memory, erasable ROM (EROM), floppy disks, CD-ROMs, optical disks, hard disks, fiber optic media, radio frequency (RF) links, etc. Code segments can be downloaded via computer networks such as the Internet, intranets, etc.

[0210] It should also be noted that the exemplary embodiments mentioned in this application describe methods or systems based on a series of steps or apparatus. However, this application is not limited to the order of the above steps; that is, the steps can be performed in the order mentioned in the embodiments, or in a different order, or several steps can be performed simultaneously.

[0211] The aspects of this disclosure have been described above with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this disclosure. It should be understood that each block in the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing apparatus to produce a machine such that these instructions, executable via the processor of the computer or other programmable data processing apparatus, enable the implementation of the functions / actions specified in one or more blocks of the flowchart illustrations and / or block diagrams. Such a processor can be, but is not limited to, a general-purpose processor, a special-purpose processor, a special application processor, or a field-programmable logic circuit. It is also understood that each block in the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, can also be implemented by special-purpose hardware performing the specified functions or actions, or can be implemented by a combination of special-purpose hardware and computer instructions.

[0212] The above description is merely a specific implementation of this application. Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the specific working processes of the systems, modules, and units described above can be referred to the corresponding processes in the foregoing method embodiments, and will not be repeated here. It should be understood that the protection scope of this application is not limited thereto. Any person skilled in the art can easily conceive of various equivalent modifications or substitutions within the technical scope disclosed in this application, and these modifications or substitutions should all be covered within the protection scope of this application.

Claims

1. A method for detecting the leakage of sensitive information on GitHub based on federated learning, applied to servers, characterized in that, The method includes: It receives scan results of pre-assigned test repository data from multiple electronic devices participating in federated learning. The pre-assigned test repository data of each electronic device is only associated with its own communication data with GitHub. The scanning results of each electronic device are processed by convolutional hashing to obtain the fingerprint of the scanning result; The trained classification model is used to perform sensitive category analysis on the fingerprint of the scan results to obtain the sensitive category membership degree corresponding to the scan results of each electronic device; Based on the membership degree of the sensitive category and the preset threshold, the system detects whether there is any leakage of sensitive information in the warehouse data scanned by the corresponding electronic device, and sends the detection result to the corresponding electronic device.

2. The detection method according to claim 1, characterized in that, The process of performing convolutional hashing on the scanning results of each electronic device to obtain a scanning result fingerprint includes: The scanning results of each electronic device are segmented into words to obtain multiple keywords; Each keyword is hashed to obtain a hash feature vector; The hash feature vector is weighted to obtain a weighted feature vector; Based on the weighted feature vectors of multiple keywords in the scan results, a weighted feature matrix of the scan results is constructed; The weighted feature matrix of the scan result is convolved to obtain the fingerprint of the scan result.

3. The detection method according to claim 1, characterized in that, Before performing sensitivity category analysis on the scanned fingerprint using the trained classification model to obtain the sensitivity category membership degree corresponding to the scanned result of each electronic device, the method further includes: Read sets of sensitive words corresponding to multiple categories from the local sensitive information database of the server; Perform convolutional hashing on the sensitive word set corresponding to each category to obtain the sensitive information fingerprint for each category; Based on the sensitive information fingerprint corresponding to each category, the pre-established classification model is trained to obtain the trained classification model.

4. The detection method according to claim 3, characterized in that, Before reading the set of sensitive words corresponding to multiple categories from the local sensitive information database of the server, the method further includes: The statistical data of sensitive information in each category are segmented into words to obtain multiple keywords; Calculate the TF-IDF (Term Frequency-Inverse Document Frequency) value of each keyword in the sensitive information statistics of the corresponding category, select multiple keywords with larger TF-IDF values ​​to form a sensitive word set corresponding to the category, and store it in the local sensitive information database of the server.

5. The detection method according to claim 3, characterized in that, Before reading the set of sensitive words corresponding to multiple categories from the local sensitive information database of the server, the method further includes: Detect the update status of the server's local sensitive information database; If the update status is "updated", then calculate the TF-IDF value of each sensitive word in the corresponding category of the sensitive information statistics in the updated local sensitive information database, and reselect multiple keywords with larger TF-IDF values ​​as the sensitive word set corresponding to that category.

6. The detection method according to claim 3, characterized in that, The process of performing convolutional hashing on the sensitive word set corresponding to each category to obtain the sensitive information fingerprint corresponding to each category includes: Each word in the sensitive word set corresponding to each category is hashed to obtain a hash feature vector; The hash feature vector is weighted to obtain a weighted feature vector; Based on the weighted feature vectors of all words in the sensitive word set corresponding to each category, construct the weighted feature matrix corresponding to that category; The weighted feature matrix of each category is convolved to obtain the sensitive information fingerprint corresponding to that category.

7. The detection method according to claim 1, characterized in that, The step of detecting whether sensitive information is leaked in the warehouse data scanned by the corresponding electronic device based on the sensitive category membership degree and preset threshold includes: If the membership degree of the sensitive category is greater than or equal to the preset threshold, it is determined that the warehouse data scanned by the corresponding electronic device contains sensitive information leakage. If the membership degree of the sensitive category is less than the preset threshold, it is determined that the warehouse data scanned by the corresponding electronic device does not contain any sensitive information leakage.

8. The detection method according to claim 7, characterized in that, Sending the detection results to the corresponding electronic device includes: If it is determined that sensitive information has been leaked in the warehouse data scanned by the corresponding electronic device, an alarm message indicating that sensitive information has been leaked in the warehouse data scanned by the corresponding electronic device is generated and sent to the corresponding electronic device.

9. A method for detecting the leakage of sensitive information from GitHub based on federated learning, applied to electronic devices, characterized in that... The method includes: The pre-allocated test repository data is scanned, and the scan results are sent to the server. The pre-allocated test repository data is only associated with the communication data between the electronic device and GitHub. Receive the detection result sent by the server. If the detection result indicates that the data of the warehouse to be tested scanned by the electronic device contains sensitive information leakage, then identify the leaked sensitive information segment. From the leaked sensitive information segment, extract multiple sensitive words with large TF-IDF values ​​and send them to the server to update the server's local sensitive information database.

10. The detection method according to claim 9, characterized in that, The pre-allocated test repository data is determined by the communication between multiple electronic devices participating in federated learning and GitHub.

11. A GitHub sensitive information leakage detection device based on federated learning, applied to a server, characterized in that, include: The first receiving unit is used to receive the scanning results of the pre-allocated test repository data from multiple electronic devices participating in federated learning. The pre-allocated test repository data of each electronic device is only associated with its own communication data with GitHub. The processing unit is used to perform convolutional hashing on the scanning results of each electronic device to obtain the fingerprint of the scanning result; The classification unit is used to perform sensitive category analysis on the scanned fingerprint using a trained classification model to obtain the sensitive category membership degree corresponding to the scanned result of each electronic device. The detection unit is used to detect whether sensitive information is leaked in the warehouse data scanned by the corresponding electronic device based on the sensitive category membership degree and the preset threshold. The first transmitting unit is used to send the detection results to the corresponding electronic device.

12. A GitHub sensitive information leakage detection device based on federated learning, applied to electronic devices, characterized in that, include: A scanning unit is used to scan pre-allocated test repository data, which is only associated with the communication data between the electronic device and GitHub; The second sending unit is used to send the scan results to the server; The second receiving unit is used to receive the comparison results sent by the server; The identification unit is used to identify the leaked sensitive information segment if the comparison result determines that the data of the warehouse to be tested scanned by the electronic device has sensitive information leakage. The extraction unit is used to extract multiple sensitive words with large TF-IDF values ​​from the leaked sensitive information segment and send them to the server to update the server's local sensitive information database.

13. A terminal device, characterized in that, include: Processor, and memory storing computer program instructions; The processor reads and executes the computer program instructions to implement the GitHub sensitive information leakage detection method based on federated learning as described in any one of claims 1-8, or the GitHub sensitive information leakage detection method based on federated learning as described in claim 9 or 10.

14. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer program instructions, which, when executed by a processor, implement the GitHub sensitive information leakage detection method based on federated learning as described in any one of claims 1-8, or the GitHub sensitive information leakage detection method based on federated learning as described in claim 9 or 10.

Images