Data outgoing control method and device, computer equipment and storage medium

Abstract

The invention relates to a data outgoing control method and device, computer equipment and a storage medium. The data outgoing control method comprises the steps of obtaining an outgoing text according to log data to be outgoing; matching the outgoing text with a plurality of pieces of text data in a database, configuring a corresponding risk level for each piece of text data in the database, and determining the risk level of the outgoing text based on the risk level of the matched text data; based on the risk level of the outgoing text, an outgoing strategy is determined through a safety arrangement automation and response system, if the risk level is a high risk level or a medium risk level, the outgoing strategy is a blocking outgoing strategy, if the risk level is a low risk level, the outgoing strategy is a reminding strategy, and if the risk level is a risk-free level, the outgoing strategy is a reminding strategy. If yes, the outgoing strategy is a direct outgoing strategy; and performing data outgoing control on the outgoing text based on the outgoing strategy. According to the method, the identification rule of the sensitive information does not need to be set in advance, the risk of the outgoing file is automatically analyzed by dynamically matching the text data, and the accuracy is higher.

Description

Technical Field

[0001] The present application relates to the field of data processing technology, and in particular to a data outbound control method, device, computer equipment and storage medium. Background Art

[0002] The traditional way of detecting and handling sensitive information leakage in enterprises is: when an outbound behavior occurs on the terminal, it is compared with the preset rules to determine the high, medium and low levels of the outbound file scenario risk. For example, whether the outbound file contains keywords, whether the outbound address is sensitive. At the same time, some specific outbound rules are set, and finally the relevant events are manually reviewed for follow-up tracking.

[0003] The data generated in an enterprise is changing all the time. Traditional processing methods have fixed rules for identifying sensitive information, making it difficult to effectively identify sensitive data in outbound files. Summary of the invention

[0004] Based on this, it is necessary to provide a data outbound control method, device, computer equipment and storage medium to address the above technical problems. There is no need to set sensitive information identification rules in advance. The risk of outbound files can be automatically analyzed by dynamically matching text data, which is more accurate.

[0005] A data outbound control method comprises: receiving log data to be outbound, obtaining an outbound text according to the log data to be outbound; matching the outbound text with a plurality of text data in a database, wherein each text data in the database is configured with a corresponding risk level, and determining the risk level of the outbound text based on the risk level of the matched text data; determining an outbound strategy based on the risk level of the outbound text and through a security orchestration automation and response system, wherein if the risk level is a high risk level or a medium risk level, the outbound strategy is a blocking outbound strategy, if the risk level is a low risk level, the outbound strategy is a reminder strategy, and if the risk level is a no risk level, the outbound strategy is a direct outbound strategy; and performing data outbound control on the outbound text based on the outbound strategy.

[0006] In one of the embodiments, the log data to be sent out contains user information, the address of the outgoing terminal, the outgoing channel and the storage path of the outgoing file; obtaining the outgoing text based on the log data to be sent out includes: obtaining the storage path of the outgoing file from the log data to be sent out; obtaining the outgoing file based on the storage path of the outgoing file.

[0007] In one of the embodiments, when the outbound policy is a reminder policy, data outbound control is performed on the outbound text based on the outbound policy, including: obtaining user information from the log data to be outbound; sending reminder information to the user of the outbound text based on the user information through the security orchestration automation and response system to remind the user to pay attention to information protection.

[0008] In one of the embodiments, when the outbound policy is a blocking outbound policy, data outbound control is performed on the outbound text based on the outbound policy, including: obtaining user information from the log data to be outbound, and obtaining the superior information of the user of the log data to be outbound from the personnel information maintained by the security orchestration automation and response system according to the user information; generating approval chain data according to the user information, the address of the outbound terminal, the outbound channel, and the outbound file; determining the account information of the superior user based on the superior information, and sending the approval chain data to the superior user based on the account information of the superior user; upon receiving the approval information of the superior user, determining the release policy through the security orchestration automation and response system; and outbounding the outbound file based on the release policy and based on the address of the outbound terminal.

[0009] In one of the embodiments, an outgoing text is matched with multiple text data in a database, including: using the same vectorization model to vectorize the outgoing text and each text data in the database to obtain a first vector of the outgoing text and each second vector corresponding to each text data in the database; respectively calculating the similarity of the first vector and each second vector; and using the text data of the second vector whose similarity meets the set requirements as the matched text data.

[0010] In one embodiment, the multiple text data in the database include first text data, second text data and third text data, the first text data is configured with a high risk level, the second text data is configured with a medium risk level, and the third text data is configured with a low risk level; the first text data contains data of a high-risk field, and the first text data also contains data of a medium-risk field and data of a low-risk field, or does not contain any one of the data; the second text data contains data of a medium-risk field and does not contain data of a high-risk field, and the second text data also contains data of a low-risk field or does not contain data of a low-risk field; the third text data contains data of a low-risk field and does not contain data of a high-risk field and data of a medium-risk field.

[0011] In one of the embodiments, after the step of determining the risk level of the outgoing text based on the risk level of the matched text data, the step further includes: storing the outgoing text with the configured risk level in a database as text data with the configured risk level in the database.

[0012] A data outbound control device comprises: an acquisition module, which is used to receive log data to be outbound, and acquire an outbound text according to the log data to be outbound; a matching module, which is used to match the outbound text with multiple text data in a database, wherein each text data in the database is configured with a corresponding risk level, and the risk level of the outbound text is determined based on the risk level of the matched text data; a determination module, which is used to determine an outbound strategy based on the risk level of the outbound text and through a security orchestration automation and response system, if the risk level is a high risk level or a medium risk level, the outbound strategy is a blocking outbound strategy, if the risk level is a low risk level, the outbound strategy is a reminder strategy, and if the risk level is a no risk level, the outbound strategy is a direct outbound strategy; an outbound control module, which is used to control the outbound data outbound of the outbound text based on the outbound strategy.

[0013] A computer device includes a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, the steps of any of the above-mentioned embodiments are implemented.

[0014] A computer-readable storage medium stores a computer program, which implements the steps of any of the above-mentioned method embodiments when the computer program is executed by a processor.

[0015] The above-mentioned data outbound control method, device, computer equipment and storage medium receive log data to be outbound, obtain an outbound text according to the log data to be outbound; match the outbound text with multiple text data in a database, wherein each text data in the database is configured with a corresponding risk level, and determine the risk level of the outbound text based on the risk level of the matched text data; determine the outbound strategy based on the risk level of the outbound text and through a security orchestration automation and response system, if the risk level is a high risk level or a medium risk level, the outbound strategy is a blocking outbound strategy, if the risk level is a low risk level, the outbound strategy is a reminder strategy, and if the risk level is a no risk level, the outbound strategy is a direct outbound strategy; and control the outbound data outbound based on the outbound strategy.

[0016] Therefore, there is no need to set up sensitive information identification rules in advance. The risk of outbound files can be automatically analyzed by dynamically matching text data, which is more accurate. In addition, by determining the outbound strategy through the security orchestration automation and response system, it can quickly connect to the company's internal system, realize more abundant disposal methods, and meet the actual needs of the company. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] Figure 1 An application environment diagram of a data outbound control method in an embodiment;

[0018] Figure 2A schematic diagram of a flow chart of a data outbound control method in an embodiment;

[0019] Figure 3 It is a flowchart of a method for controlling data outbound transmission in a specific embodiment;

[0020] Figure 4 It is a structural block diagram of a data outbound control device in one embodiment;

[0021] Figure 5 FIG. 4 is a diagram showing the internal structure of a computer device in one embodiment. DETAILED DESCRIPTION

[0022] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0023] The present application provides a data outbound control method, which is applied to Figure 1 In the application environment shown. Figure 1 As shown, the data outbound control platform 100 is used to execute a data outbound control method of the present application. Specifically, a data processing system 101 and a security orchestration automation and response system 102 are configured in the data outbound control platform 100. The data processing system 101 receives the log data to be outbound, obtains the outbound text according to the log data to be outbound, matches the outbound text with multiple text data in the database, wherein each text data in the database is configured with a corresponding risk level, and determines the risk level of the outbound text based on the risk level of the matched text data. The security orchestration automation and response system 102 determines the outbound strategy based on the risk level of the outbound text. If the risk level is a high risk level or a medium risk level, the outbound strategy is a blocking outbound strategy. If the risk level is a low risk level, the outbound strategy is a reminder strategy. If the risk level is no risk level, the outbound strategy is a direct outbound strategy; data outbound control is performed on the outbound text based on the outbound strategy.

[0024] In one embodiment, Figure 2 As shown, a data outbound control method is provided, which is applied to Figure 1 The data outbound control platform 100 in the example is used as an example to illustrate, and the following steps are included:

[0025] S202, receiving log data to be sent out, and obtaining an outgoing text according to the log data to be sent out.

[0026] In this embodiment, for the log application service of the access terminal's data outbound, the log application service receives the log data to be outbound. The log data to be outbound directly provides the outbound file or the acquisition method of the outbound file. The outbound file is acquired according to the log data to be outbound.

[0027] In one example, the log data to be outbound includes user information, the address of the outbound terminal, the outbound channel, and the storage path of the outbound file; the above-mentioned acquisition of the outbound text according to the log data to be outbound includes: acquiring the storage path of the outbound file from the log data to be outbound; acquiring the outbound file according to the storage path of the outbound file.

[0028] For example, a certain log data to be outbound is as follows:

[0029] <8>Sep 30 9:18:31, discovery time: 2024-09-03 09:18:11, current logged-in account: xxxx, user account: <user email>, file name: 0902.csv, organization: <organization name>, file size: 388255, number of files: 1, user name: <user name>, reporting time: 2024-09-03 09:18:31, device ID: <ID number>, terminal IP: <IP number>, storage path of the outbound file: C:\mediation\0902.csv, storage path of the file reporting: oss:\data\2024-09-03\mediation\0902.csv operation type: <type>, host name: <host name>, operating system: Windows 10, terminal MAC: <MAC code>, application: Edge browser medge.exe.

[0030] Specifically, from "storage path of the outbound file: oss:\data\2024-09-03\mediation\0902.csv", the outbound text "0902.csv" is acquired.

[0031] S204, match the outbound text with multiple text data in the database, where each text data in the database is configured with a corresponding risk level, and determine the risk level of the outbound text based on the risk level of the matched text data.

[0032] In this embodiment, multiple text data are pre-stored in the database, and each text data is pre-configured with a risk level for the data content. The risk levels include high risk level, medium risk level, and low risk level. Specifically, the outbound text is matched with each text data. If a text data in the database is matched, the risk level of the outbound text is determined based on the risk level of the matched text data. If the match fails, the risk level of the outbound text is determined to be risk-free.

[0033] In one example, an outgoing text is matched with multiple text data in a database, including: using the same vectorization model to vectorize the outgoing text and each text data in the database to obtain a first vector of the outgoing text and each second vector corresponding to each text data in the database; calculating the similarity of the first vector and each second vector respectively; and taking the text data of the second vector whose similarity meets the set requirements as the matched text data.

[0034] Among them, the multiple text data in the database include first text data, second text data and third text data, the first text data is configured with a high risk level, the second text data is configured with a medium risk level, and the third text data is configured with a low risk level; the first text data contains data of high-risk fields, and the first text data also contains any one or two of data of medium-risk fields and data of low-risk fields, or does not contain any one of them; the second text data contains data of medium-risk fields and does not contain data of high-risk fields, and the second text data also contains data of low-risk fields or does not contain data of low-risk fields; the third text data contains data of low-risk fields and does not contain data of high-risk fields and data of medium-risk fields.

[0035] In this example, the first text data contains data of a high-risk field and is configured as a high-risk level. In addition to the data of a high-risk field, the first text data may also contain data of a medium-risk field and / or data of a low-risk field, and of course may not contain data of a medium-risk field and / or data of a low-risk field. The second text data contains data of a medium-risk field and is configured as a medium-risk level. In addition to the data of a medium-risk field, the second text data may also contain or not contain data of a low-risk field, but not data of a high-risk field. The third text data contains data of a low-risk field, and does not contain data of a high-risk field or data of a medium-risk field. The third text data is configured with a low-risk level. For example, the first text data contains a mobile phone number and / or an ID card number, and / or a bank card number.

[0036] In this example, the same vectorized model is the mxbai-embed-large model, and the numpy module of Python is used to calculate the similarity of two vectors.

[0037] Specifically, by building a local large model with the help of the ollama framework and combining it with rag (Retrieval Augmented Generation), relevant information can be retrieved from a large amount of text data, and combined with the generation model to generate answers. After actual testing, using large language models such as llama3:8b and qwen2:7b can respond to needs relatively quickly and meet the usage scenarios.

[0038] Assume that there are three text data in the database that are classified as high risk, namely mobile phone number, ID card number, and bank card number. The two outgoing texts that need to determine the risk level are mobile phone number and email address. The details are as follows:

[0039] Mobile phone number: Content1 = [“15651904108,18962643093,17700100622”];

[0040] ID card number: Content2 = ["371482197710240918, 460107200801113278, 420981194505073795"];

[0041] Bank card number: Content3 = [“6217178880521887056, 6222029177162410387, 6226893315417495201”];

[0042] Outgoing text 1 to be determined: Question1 = ["15592756777"];

[0043] Outgoing text 2 to be determined: Question2 = ["LinXiang@sina.com"].

[0044] Use the mxbai-embed-large model to vectorize the text and questions, and calculate the similarity of the vectors through the numpy module of python. The larger the value of the calculation result, the higher the similarity between the two texts. Based on this, the risk level of the outgoing text can be determined.

[0045] In one example, after the step of determining the risk level of the outgoing text based on the risk level of the matched text data, the method further includes: storing the outgoing text with the configured risk level in a database as text data with the configured risk level in the database.

[0046] Specifically, for each outgoing document, a table can be created based on the calculated similarity, and vector calculation can be performed for matching the next outgoing text, thereby improving the accuracy of risk level identification for each outgoing text.

[0047] S206, based on the risk level of the outbound text and through the security orchestration automation and response system, determine the outbound strategy. If the risk level is a high risk level or a medium risk level, the outbound strategy is a blocking outbound strategy. If the risk level is a low risk level, the outbound strategy is a reminder strategy. If the risk level is no risk level, the outbound strategy is a direct outbound strategy.

[0048] In this embodiment, the Security Orchestration, Automation and Response (SOAR) system is security orchestration, automation and response, which usually realizes the connection between the programmable instructions and the actual system through the application program and the action mechanism. The outbound strategy corresponding to the high risk level or the medium risk level is pre-configured as the blocking outbound strategy, the outbound strategy corresponding to the low risk level is the reminder strategy, and the outbound strategy corresponding to the no risk level is the direct outbound strategy. Therefore, after determining the risk level of the outbound text, the outbound strategy of the outbound text can be determined through the SOAR system.

[0049] S208, controlling the outbound data transmission of the outbound text based on the outbound strategy.

[0050] In this embodiment, the outbound policy is output through the SOAR system to perform outbound control on the outbound text.

[0051] In one example, when the outbound policy is a reminder policy, data outbound control is performed on the outbound text based on the outbound policy, including: obtaining user information from the log data to be outbound; sending reminder information to the user of the outbound text based on the user information through the security orchestration automation and response system to remind the user to pay attention to information protection.

[0052] Specifically, as in the above example of log data, the log data contains user information. The corresponding user can be identified through the user information, and when the outbound policy is a reminder policy, a reminder message is sent to the user through the SOAR system to remind the user to pay attention to information protection.

[0053] In one example, when the outbound policy is a blocking outbound policy, data outbound control is performed on outbound text based on the outbound policy, including: obtaining user information from the log data to be outbound, and obtaining the superior information of the user of the log data to be outbound from the personnel information maintained by the security orchestration automation and response system based on the user information; generating approval chain data based on the user information, the address of the outbound terminal, the outbound channel, and the outbound file; determining the account information of the superior user based on the superior information, and sending the approval chain data to the superior user based on the account information of the superior user; upon receiving the approval information of the superior user, determining the release policy through the security orchestration automation and response system; and outbound files are outbound based on the release policy and based on the address of the outbound terminal.

[0054] In this example, if the detection result is that the outbound scenario is high or medium risk, the superior information corresponding to the end user is queried in the personnel information dynamically maintained by the SOAR system to obtain the approval chain data. At the same time, the work order approval is initiated, and after approval, it is returned to the SOAR system. The SOAR system issues the execution policy based on the returned approval notification.

[0055] Specifically, the superior information of the outgoing user can be obtained through the personnel information maintained by the SOAR system. Then, the approval chain is constructed from the log data through the user name field. Other fields will be filled in the approval chain, such as user information, the address of the outgoing terminal, the outgoing channel, and the outgoing file, such as "application", outgoing time, etc. Among them, the specific approval content in the approval chain can display the outgoing file to the superior for the superior to judge. After the superior approves it, it is transmitted back to the SOAR system and the issuance policy is automatically issued.

[0056] The above-mentioned data outbound control method receives log data to be outbound, obtains outbound text according to the log data to be outbound; matches the outbound text with multiple text data in the database, wherein each text data in the database is configured with a corresponding risk level, and determines the risk level of the outbound text based on the risk level of the matched text data; determines the outbound strategy based on the risk level of the outbound text and through the security orchestration automation and response system, if the risk level is a high risk level or a medium risk level, the outbound strategy is a blocking outbound strategy, if the risk level is a low risk level, the outbound strategy is a reminder strategy, if the risk level is a no risk level, the outbound strategy is a direct outbound strategy; and controls the outbound data outbound based on the outbound strategy. Therefore, there is no need to set the identification rules of sensitive information in advance, and the risk of outbound files can be automatically analyzed by dynamically matching text data, which is more accurate. In addition, by determining the outbound strategy through the security orchestration automation and response system, the internal system of the enterprise can be quickly connected, and more abundant disposal methods can be realized to meet the actual needs of the enterprise.

[0057] Based on the data outbound control method provided in the above embodiments, a specific example is provided below. Figure 3 As shown:

[0058] Step 1: Through real-time monitoring of log data in sls (log service), discover the outbound behavior of log data;

[0059] Step 2: Call the local big model to classify the risk level of the data of the outgoing file. The local big model here refers to the local big model built with the help of the Ollama framework mentioned above;

[0060] Step 3: Evaluate the risk level of the outgoing file. If the risk level is high or medium, proceed to step 4. If the risk level is low, proceed to step 7.

[0061] Step 4: When the risk level of the outbound file is high / medium, the SOAR system automatically issues an outbound blocking command;

[0062] Step 5: Automatically generate work orders through the SOAR system based on the outsourced personnel information for approval;

[0063] Step 6: After approval, the release order is automatically issued through the SOAR system;

[0064] Step 7: When the risk level of the outgoing file is low, a notification is sent through the SOAR system to remind the user of the outgoing file status.

[0065] Step 8: Monitor data status.

[0066] Therefore, by issuing policies through the SOAR system and connecting with the enterprise work order system, terminal management system, etc., a variety of results can be achieved, such as connecting with the work order system for outbound approval and automatically releasing it after approval. If the data leak is caused by a Trojan program, the terminal can be urgently disconnected from the Internet.

[0067] Through the scenario-based processing of the SOAR system, most outbound scenarios can be covered, and manual audit scenarios will focus on scenarios that cannot be judged by large models.

[0068] It should be understood that, although the steps in the flowchart are displayed in sequence as indicated by the arrows, these steps are not necessarily executed in sequence in the order indicated by the arrows. Unless otherwise specified herein, there is no strict order restriction on the execution of these steps, and these steps can be executed in other orders. Moreover, at least a portion of the steps in the accompanying drawings may include multiple sub-steps or multiple stages, and these sub-steps or stages are not necessarily executed at the same time, but can be executed at different times, and the execution order of these sub-steps or stages is not necessarily sequential, but can be executed in turn or alternately with other steps or at least a portion of the sub-steps or stages of other steps.

[0069] The present application also provides a data outbound control device. Figure 4As shown, a data outbound control device includes an acquisition module 402, a matching module 404, a determination module 406, and an outbound control module 408. The acquisition module 402 is used to receive log data to be outbound, and acquire an outbound text according to the log data to be outbound; the matching module 404 is used to match the outbound text with multiple text data in the database, wherein each text data in the database is configured with a corresponding risk level, and the risk level of the outbound text is determined based on the risk level of the matched text data; the determination module 406 is used to determine the outbound strategy based on the risk level of the outbound text and through the security orchestration automation and response system, if the risk level is a high risk level or a medium risk level, the outbound strategy is a blocking outbound strategy, if the risk level is a low risk level, the outbound strategy is a reminder strategy, and if the risk level is no risk level, the outbound strategy is a direct outbound strategy; the outbound control module 408 is used to control the outbound data outbound based on the outbound strategy.

[0070] In one of the embodiments, the log data to be sent out contains user information, the address of the outgoing terminal, the outgoing channel and the storage path of the outgoing file; obtaining the outgoing text based on the log data to be sent out includes: obtaining the storage path of the outgoing file from the log data to be sent out; obtaining the outgoing file based on the storage path of the outgoing file.

[0071] In one of the embodiments, when the outbound policy is a reminder policy, data outbound control is performed on the outbound text based on the outbound policy, including: obtaining user information from the log data to be outbound; sending reminder information to the user of the outbound text based on the user information through the security orchestration automation and response system to remind the user to pay attention to information protection.

[0072] In one of the embodiments, when the outbound policy is a blocking outbound policy, data outbound control is performed on the outbound text based on the outbound policy, including: obtaining user information from the log data to be outbound, and obtaining the superior information of the user of the log data to be outbound from the personnel information maintained by the security orchestration automation and response system according to the user information; generating approval chain data according to the user information, the address of the outbound terminal, the outbound channel, and the outbound file; determining the account information of the superior user based on the superior information, and sending the approval chain data to the superior user based on the account information of the superior user; upon receiving the approval information of the superior user, determining the release policy through the security orchestration automation and response system; and outbounding the outbound file based on the release policy and based on the address of the outbound terminal.

[0073] In one of the embodiments, an outgoing text is matched with multiple text data in a database, including: using the same vectorization model to vectorize the outgoing text and each text data in the database to obtain a first vector of the outgoing text and each second vector corresponding to each text data in the database; respectively calculating the similarity of the first vector and each second vector; and using the text data of the second vector whose similarity meets the set requirements as the matched text data.

[0074] In one embodiment, the multiple text data in the database include first text data, second text data and third text data, the first text data is configured with a high risk level, the second text data is configured with a medium risk level, and the third text data is configured with a low risk level; the first text data contains data of a high-risk field, and the first text data also contains data of a medium-risk field and data of a low-risk field, or does not contain any one of the data; the second text data contains data of a medium-risk field and does not contain data of a high-risk field, and the second text data also contains data of a low-risk field or does not contain data of a low-risk field; the third text data contains data of a low-risk field and does not contain data of a high-risk field and data of a medium-risk field.

[0075] In one of the embodiments, after determining the risk level of the outgoing text based on the risk level of the matched text data, the method further includes: storing the outgoing text with the configured risk level in a database as text data with the configured risk level in the database.

[0076] For the specific definition of a data outbound control device, please refer to the definition of a data outbound control method above, which will not be repeated here. Each module in the above-mentioned data outbound control device can be implemented in whole or in part by software, hardware and a combination thereof. The above-mentioned modules can be embedded in or independent of the processor in the computer device in the form of hardware, or can be stored in the memory of the computer device in the form of software, so that the processor can call and execute the operations corresponding to the above modules.

[0077] In one embodiment, a computer device is provided. The computer device may be a server supporting the operation of the data outbound control platform 100. The internal structure diagram thereof may be as shown in FIG. Figure 5As shown. The computer device includes a processor, a memory, a network interface and a database connected via a system bus. Among them, the processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program and a database. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The network interface of the computer device is used to receive log data to be sent out, etc. When the computer program is executed by the processor, the above-mentioned data outbound control method is implemented.

[0078] Those skilled in the art will understand that Figure 5 The structure shown in the figure is only a block diagram of a part of the structure related to the scheme of the present application, and does not constitute a limitation on the computer device to which the scheme of the present application is applied. The specific computer device may include more or fewer components than shown in the figure, or combine certain components, or have a different arrangement of components.

[0079] In one embodiment, a computer device is provided, including a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, the following steps are implemented: receiving log data to be sent out, and obtaining an outgoing text according to the log data to be sent out; matching the outgoing text with a plurality of text data in a database, wherein each text data in the database is configured with a corresponding risk level, and determining the risk level of the outgoing text based on the risk level of the matched text data; determining an outgoing policy based on the risk level of the outgoing text and through a security orchestration automation and response system, wherein if the risk level is a high risk level or a medium risk level, the outgoing policy is a blocking outgoing policy, if the risk level is a low risk level, the outgoing policy is a reminder policy, and if the risk level is a no risk level, the outgoing policy is a direct outgoing policy; and controlling the outgoing of data based on the outgoing policy.

[0080] In one of the embodiments, the log data to be sent out contains user information, the address of the outgoing terminal, the outgoing channel and the storage path of the outgoing file; when the processor executes the computer program to implement the above-mentioned step of obtaining the outgoing text according to the log data to be sent out, the following steps are specifically implemented: obtaining the storage path of the outgoing file from the log data to be sent out; obtaining the outgoing file according to the storage path of the outgoing file.

[0081] In one of the embodiments, when the outbound policy is a reminder policy, when the processor executes a computer program to implement the above-mentioned steps of controlling the outbound data of the outbound text based on the outbound policy, the following steps are specifically implemented: obtaining user information from the log data to be outbound; sending reminder information to the user of the outbound text based on the user information through the security orchestration automation and response system to remind the user to pay attention to information protection.

[0082] In one of the embodiments, when the outbound policy is a blocking outbound policy, when the processor executes a computer program to implement the above-mentioned step of controlling the outbound data of the outbound text based on the outbound policy, the following steps are specifically implemented: obtaining user information from the log data to be outbound, and obtaining the superior information of the user of the log data to be outbound from the personnel information maintained by the security orchestration automation and response system according to the user information; generating approval chain data according to the user information, the address of the outbound terminal, the outbound channel, and the outbound file; determining the account information of the superior user based on the superior information, and sending the approval chain data to the superior user based on the account information of the superior user; upon receiving the approval information of the superior user, determining the release policy through the security orchestration automation and response system; and outbounding the outbound file based on the release policy and based on the address of the outbound terminal.

[0083] In one of the embodiments, when the processor executes a computer program to implement the above-mentioned step of matching the outgoing text with multiple text data in the database, the following steps are specifically implemented: the outgoing text and each text data in the database are vectorized using the same vectorization model to obtain a first vector of the outgoing text and each second vector corresponding to each text data in the database; the similarity of the first vector and each second vector is calculated respectively; and the text data of the second vector whose similarity meets the set requirements is used as the matching text data.

[0084] In one embodiment, the multiple text data in the database include first text data, second text data and third text data, the first text data is configured with a high risk level, the second text data is configured with a medium risk level, and the third text data is configured with a low risk level; the first text data contains data of a high-risk field, and the first text data also contains data of a medium-risk field and data of a low-risk field, or does not contain any one of the data; the second text data contains data of a medium-risk field and does not contain data of a high-risk field, and the second text data also contains data of a low-risk field or does not contain data of a low-risk field; the third text data contains data of a low-risk field and does not contain data of a high-risk field and data of a medium-risk field.

[0085] In one of the embodiments, when the processor executes the computer program, the following steps are implemented: storing the outgoing text with the configured risk level in the database as text data with the configured risk level in the database.

[0086] In one embodiment, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the following steps are implemented: receiving log data to be sent out, and obtaining an outgoing text according to the log data to be sent out; matching the outgoing text with a plurality of text data in a database, wherein each text data in the database is configured with a corresponding risk level, and determining the risk level of the outgoing text based on the risk level of the matched text data; determining an outgoing policy based on the risk level of the outgoing text and through a security orchestration automation and response system, wherein if the risk level is a high risk level or a medium risk level, the outgoing policy is a blocking outgoing policy, if the risk level is a low risk level, the outgoing policy is a reminder policy, and if the risk level is no risk level, the outgoing policy is a direct outgoing policy; and controlling the outgoing of data based on the outgoing policy.

[0087] In one of the embodiments, the log data to be sent out contains user information, the address of the outgoing terminal, the outgoing channel and the storage path of the outgoing file; when the computer program is executed by the processor to implement the above-mentioned steps of obtaining the outgoing text based on the log data to be sent out, the following steps are specifically implemented: obtaining the storage path of the outgoing file from the log data to be sent out; obtaining the outgoing file according to the storage path of the outgoing file.

[0088] In one of the embodiments, when the outbound policy is a reminder policy, when the computer program is executed by the processor to implement the above-mentioned steps of controlling the outbound data of the outbound text based on the outbound policy, the following steps are specifically implemented: obtaining user information from the log data to be outbound; sending reminder information to the user of the outbound text based on the user information through the security orchestration automation and response system to remind the user to pay attention to information protection.

[0089] In one of the embodiments, when the outbound policy is a blocking outbound policy, when the computer program is executed by the processor to implement the above-mentioned steps of controlling the outbound data of the outbound text based on the outbound policy, the following steps are specifically implemented: obtaining user information from the log data to be outbound, and obtaining the superior information of the user of the log data to be outbound from the personnel information maintained by the security orchestration automation and response system according to the user information; generating approval chain data according to the user information, the address of the outbound terminal, the outbound channel, and the outbound file; determining the account information of the superior user based on the superior information, and sending the approval chain data to the superior user based on the account information of the superior user; when receiving the approval information of the superior user, determining the release policy through the security orchestration automation and response system; and outbounding the outbound file based on the release policy and based on the address of the outbound terminal.

[0090] In one of the embodiments, when the computer program is executed by the processor to implement the above-mentioned step of matching the outgoing text with multiple text data in the database, the following steps are specifically implemented: the outgoing text and the text data in the database are vectorized using the same vectorization model to obtain a first vector of the outgoing text and second vectors corresponding to the text data in the database; the similarity between the first vector and each second vector is calculated respectively; and the text data of the second vector whose similarity meets the set requirements is used as the matching text data.

[0091] In one embodiment, the multiple text data in the database include first text data, second text data and third text data, the first text data is configured with a high risk level, the second text data is configured with a medium risk level, and the third text data is configured with a low risk level; the first text data contains data of a high-risk field, and the first text data also contains data of a medium-risk field and data of a low-risk field, or does not contain any one of the data; the second text data contains data of a medium-risk field and does not contain data of a high-risk field, and the second text data also contains data of a low-risk field or does not contain data of a low-risk field; the third text data contains data of a low-risk field and does not contain data of a high-risk field and data of a medium-risk field.

[0092] In one of the embodiments, when the computer program is executed by a processor, the following steps are implemented: storing the outgoing text with the configured risk level in a database as text data with the configured risk level in the database.

[0093] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to memory, storage, database or other media used in the embodiments provided in this application can include non-volatile and / or volatile memory. Non-volatile memory can include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM) or flash memory. Volatile memory can include random access memory (RAM) or external cache memory. As an illustration and not limitation, RAM is available in many forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), synchronous link (Synchlink) DRAM (SLDRAM), memory bus (Rambus) direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM).

[0094] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0095] The above-mentioned embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the invention patent. It should be pointed out that, for a person of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the patent of the present application shall be subject to the attached claims.

Claims

1. A data outbound control method, characterized in that: The method comprises: Receiving log data to be sent out, and obtaining outgoing text according to the log data to be sent out; Matching the outgoing text with a plurality of text data in a database, wherein each text data in the database is configured with a corresponding risk level, and determining the risk level of the outgoing text based on the risk level of the matched text data; Based on the risk level of the outbound text, an outbound strategy is determined through a security orchestration automation and response system. If the risk level is a high risk level or a medium risk level, the outbound strategy is a blocking outbound strategy. If the risk level is a low risk level, the outbound strategy is a reminder strategy. If the risk level is a no risk level, the outbound strategy is a direct outbound strategy. The data outbound transmission of the outbound text is controlled based on the outbound transmission strategy.

2. The method according to claim 1, characterized in that The log data to be sent out includes user information, the address of the outgoing terminal, the outgoing channel and the storage path of the outgoing file; The step of obtaining the outgoing text according to the log data to be outgoing includes: Acquire the storage path of the outgoing file from the log data to be outgoing; The outgoing file is obtained according to the storage path of the outgoing file.

3. The method according to claim 2, characterized in that When the outbound policy is a reminder policy, the controlling the outbound data transmission of the outbound text based on the outbound policy includes: Acquiring user information from the log data to be sent out; A reminder message is sent to the user of the outgoing text based on the user information through the security orchestration automation and response system to remind the user to pay attention to information protection.

4. The method according to claim 2, characterized in that: When the outbound policy is a blocking outbound policy, the controlling the outbound data transmission of the outbound text based on the outbound policy includes: Acquire user information from the log data to be sent out, and acquire superior information of the user of the log data to be sent out from the personnel information maintained by the security orchestration automation and response system according to the user information; Generate approval chain data according to the user information, the address of the outgoing terminal, the outgoing channel, and the outgoing file; Determining the account information of the superior user based on the superior information, and sending the approval chain data to the superior user according to the account information of the superior user; Upon receiving the approval information from the superior user, determining a release strategy through the security orchestration automation and response system; The outgoing file is outsourced based on the release policy and based on the address of the outgoing terminal.

5. The method according to claim 1, characterized in that The step of matching the outgoing text with a plurality of text data in a database includes: The outgoing text and each text data in the database are vectorized by using the same vectorization model to obtain a first vector of the outgoing text and each second vector corresponding to each text data in the database; Calculating the similarity between the first vector and each second vector respectively; The text data of the second vector whose similarity meets the set requirement is used as the matched text data.

6. The method according to claim 5, characterized in that The plurality of text data in the database includes first text data, second text data and third text data, the first text data is configured with a high risk level, the second text data is configured with a medium risk level, and the third text data is configured with a low risk level; The first text data contains data of a high-risk field, and the first text data also contains any one or both of data of a medium-risk field and data of a low-risk field, or does not contain any one of the two; The second text data contains data of a medium-risk field and does not contain data of a high-risk field, and the second text data also contains data of a low-risk field or does not contain data of a low-risk field; The third text data includes data in a low-risk field but does not include data in a high-risk field or data in a medium-risk field.

7. The method according to claim 6, characterized in that After the step of determining the risk level of the outgoing text based on the risk level of the matched text data, the method further includes: The outgoing text configured with risk levels is stored in the database as text data configured with risk levels in the database.

8. A data outbound control device, characterized in that: The device comprises: An acquisition module, used for receiving log data to be sent out, and acquiring outgoing text according to the log data to be sent out; A matching module, used for matching the outgoing text with a plurality of text data in a database, wherein each text data in the database is configured with a corresponding risk level, and determining the risk level of the outgoing text based on the risk level of the matched text data; A determination module, configured to determine an outbound policy based on the risk level of the outbound text and through a security orchestration automation and response system, wherein if the risk level is a high risk level or a medium risk level, the outbound policy is a blocking outbound policy; if the risk level is a low risk level, the outbound policy is a reminder policy; and if the risk level is a no risk level, the outbound policy is a direct outbound policy; The outbound control module is used to control the outbound data of the outbound text based on the outbound strategy.

9. A computer device comprising a memory, a processor and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 7 are implemented.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 7 are implemented.

Images