File management method, system and equipment and storage medium

Abstract

The embodiment of the invention discloses a file management method, system and device and a storage medium, and relates to the technical field of information security, and the method comprises the steps: carrying out burying point monitoring on a target monitoring interface, and obtaining burying point data; according to an operation behavior in the buried point data, determining operation information of a sensitive file operated by the target user; according to the operation information, abnormal operation behavior detection is carried out on the operation behavior of the target user, and the abnormal operation behavior comprises a behavior causing that the sensitive file is leaked or is about to be leaked; in the embodiment of the invention, under the condition that the operation behavior of the target user is detected to belong to the abnormal operation behavior, the file operation authority of the target user to the target monitoring interface is limited, so that the risk that the sensitive-related file is further leaked can be reduced in time, and the security of sensitive-related file management is improved.

Description

Technical Field

[0001] The present application relates to the field of information security technology, and in particular to a file management method, system, device and storage medium. Background Art

[0002] In the wave of digitalization and informatization, the importance of information security has become increasingly prominent, especially in the financial industry, such as banks, trust investment companies, financial asset management companies, and financial companies. These companies have a large number of sensitive files, which are their valuable digital assets. Once leaked, they may cause significant damage to the company's operations and reputation.

[0003] At present, enterprises in the industry mainly rely on preventive measures such as physical isolation, network isolation and manual supervision to manage sensitive files. Although these management methods have played a protective role to a certain extent, they are obviously insufficient in ensuring the security of files.

[0004] Application Contents

[0005] In view of this, one of the purposes of the present application is to provide a file management method, system, device and storage medium that can improve the security of sensitive file management.

[0006] To achieve the above purpose, the technical solution of this application is implemented as follows:

[0007] In a first aspect, an embodiment of the present application provides a file management method, including:

[0008] Perform tracking monitoring on the target monitoring interface to obtain tracking data, which is used to record the target user's operation behavior on the target monitoring interface;

[0009] Determine the operation information of sensitive files operated by the target user based on the operation behavior in the tracking data;

[0010] Based on the operation information, detect abnormal operation behaviors of the target user, where abnormal operation behaviors include behaviors that have caused sensitive files to be leaked or are about to be leaked;

[0011] When it is detected that the operation behavior of the target user is an abnormal operation behavior, the file operation authority of the target user on the target monitoring interface is restricted.

[0012] In a possible implementation, when it is detected that the operation behavior of the target user is an abnormal operation behavior, restricting the file operation authority of the target user on the target monitoring interface includes:

[0013] Obtaining an abnormal identification of the abnormal operation behavior, where the abnormal identification is used to mark the risk level of leakage of the abnormal operation behavior;

[0014] When the leakage risk level is determined through abnormal identification, the target user's file operation permissions on the target monitoring interface are restricted according to the leakage risk level.

[0015] In a possible implementation, the operation information includes the operation time period, the continuous operation duration, the operation frequency, the number of first files accessed and / or downloaded sensitive files within the operation time period, and the number of second files accessed and / or downloaded sensitive files within the continuous operation duration. According to the operation information, the operation behavior of the target user is detected for abnormal operation behavior, including:

[0016] Determine the operation behavior that meets the preset conditions as abnormal operation behavior;

[0017] The preset conditions include any of the following:

[0018] The operation time period is within the preset time period, and the number of first files is greater than a first preset threshold;

[0019] The continuous operation duration is greater than the preset operation duration, and the number of second files is greater than the second preset threshold;

[0020] The operating frequency is greater than the preset frequency.

[0021] In a possible implementation, before performing point-embedded monitoring on the target monitoring interface, the method further includes:

[0022] Get the preset security management level;

[0023] According to the preset security management level, the target monitoring interface is determined, wherein different preset security management levels correspond to different target monitoring interfaces.

[0024] In a possible implementation, the operation information includes the operation time period, the continuous operation duration, the operation frequency, the number of first files accessed and / or downloaded sensitive files within the operation time period, and the number of second files accessed and / or downloaded sensitive files within the continuous operation duration. According to the operation information, the operation behavior of the target user is detected for abnormal operation behavior, including:

[0025] Determine, according to a preset security management level, a first weight value of the operation time period, a second weight value of the continuous operation duration, and a third weight value of the operation frequency;

[0026] Determine a first target value according to the first file quantity and the first weight value;

[0027] Determine a second target value according to the second file quantity and the second weight value;

[0028] Determining a third target value according to the operating frequency and the third weight value;

[0029] Abnormal operation behavior is determined based on the first target value, the second target value, and the third target value.

[0030] In a possible implementation, determining the abnormal operation behavior according to the first target value, the second target value, and the third target value includes:

[0031] When the sum of the first target value, the second target value and the third target value is greater than the third preset threshold, it is determined that the operation behaviors corresponding to the first target value, the second target value and the third target value are abnormal operation behaviors.

[0032] In a possible implementation, the method of determining a sensitive file includes:

[0033] Files detected with unique serial numbers are regarded as sensitive files, and each sensitive file includes a unique serial number.

[0034] In a second aspect, an embodiment of the present application provides a file management system, the file management system comprising:

[0035] The monitoring module is used to perform tracking monitoring on the target monitoring interface and obtain tracking data, which is used to record the operation behavior of the target user on the target monitoring interface;

[0036] A determination module is used to determine the operation information of sensitive files operated by the target user based on the operation behavior in the buried data;

[0037] A detection module, used to detect abnormal operation behaviors of the target user based on the operation information, wherein the abnormal operation behaviors include behaviors that have caused the leakage of sensitive files or are about to cause the leakage of sensitive files;

[0038] The restriction module is used to restrict the target user's file operation authority on the target monitoring interface when it is detected that the target user's operation behavior is an abnormal operation behavior.

[0039] In a third aspect, an embodiment of the present application provides an electronic device, the electronic device comprising a memory and a processor, the memory storing a computer program, and when the computer program is executed by the processor, the file management method provided in the first aspect is implemented.

[0040] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by one or more processors, the file management method provided in the first aspect is implemented.

[0041] The embodiment of the present application provides a file management method, which can perform point-to-point monitoring on the target monitoring interface, obtain point-to-point data, and determine the operation information of the sensitive files operated by the target user based on the operation behavior in the point-to-point data. Then, based on the operation information, the operation behavior of the target user is detected for abnormal operation behavior, wherein the abnormal operation behavior includes the behavior that has caused the sensitive files to be leaked or is about to be leaked, and when it is detected that the operation behavior of the target user is an abnormal operation behavior, the target user's file operation authority on the target monitoring interface is restricted, which can timely reduce the risk of further leakage of sensitive files, thereby improving the security of sensitive file management. BRIEF DESCRIPTION OF THE DRAWINGS

[0042] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. It should be understood that the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0043] Figure 1 A flowchart of a file management method provided in an embodiment of the present application;

[0044] Figure 2 A flowchart of file operation permission restriction included in a file management method provided in an embodiment of the present application;

[0045] Figure 3 A target monitoring interface determination flow chart included in a file management method provided in an embodiment of the present application;

[0046] Figure 4 A detection flow chart included in a file management method provided in an embodiment of the present application;

[0047] Figure 5 A schematic diagram of the functional modules of a file management system provided in an embodiment of the present application;

[0048] Figure 6 A diagram of the internal structure of an electronic device provided in an embodiment of the present application.

[0049] Description of reference numerals:

[0050] File management system 500 , monitoring module 510 , determination module 520 , detection module 530 , and restriction module 540 . DETAILED DESCRIPTION

[0051] In order to make the purpose, technical solution and advantages of the embodiments of the present application clearer, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, rather than all the embodiments. The components of the embodiments of the present application described and shown in the drawings here can be arranged and designed in various different configurations.

[0052] Therefore, the following detailed description of the embodiments of the present application provided in the accompanying drawings is not intended to limit the scope of the present application for which protection is sought, but merely represents selected embodiments of the present application. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in the field without creative work are within the scope of protection of the present application.

[0053] It should be noted that similar reference numerals and letters denote similar items in the following drawings, and therefore, once an item is defined in one drawing, further definition and explanation thereof is not required in subsequent drawings.

[0054] In various embodiments of the present application, the expression "or" or "at least one of A or / and B" includes any combination or all combinations of the words listed at the same time. For example, the expression "A or B" or "at least one of A or / and B" may include A, may include B, or may include both A and B.

[0055] In the description of the present application, it should be noted that if the terms "upper", "lower", "inside", "outside", etc. appear to indicate an orientation or position relationship, it is based on the orientation or position relationship shown in the drawings, or is the orientation or position relationship in which the product of the invention is usually placed when used. It is only for the convenience of describing the present application and simplifying the description, and does not indicate or imply that the device or element referred to must have a specific orientation, be constructed and operated in a specific orientation, and therefore cannot be understood as a limitation on the present application.

[0056] In addition, the terms “first”, “second”, etc., if used, are merely used to distinguish between the descriptions and should not be understood as indicating or implying relative importance.

[0057] It should be noted that, in the absence of conflict, the features in the embodiments of the present application may be combined with each other.

[0058] Furthermore, in the embodiments of the present application, the term "connection" may refer to "electrical connection" or "direct connection". "Electrical connection" may refer to direct electrical connection between two components or electrical connection between two components via one or more normally open tubes or other components.

[0059] The present application can be used in many general or special computer system environments or configurations. For example: personal computers, server computers, handheld or portable devices, tablet devices, multiprocessor systems, microprocessor-based systems, set-top boxes, programmable consumer electronics, network PCs, minicomputers, mainframe computers, distributed computing environments including any of the above systems or devices, etc. The present application can be described in the general context of computer-executable instructions executed by a computer, such as program modules. Generally, program modules include routines, programs, objects, components, data structures, etc. that perform specific tasks or implement specific abstract data types. The present application can also be practiced in distributed computing environments, in which tasks are performed by remote processing devices connected through a communication network. In a distributed computing environment, program modules can be located in local and remote computer storage media including storage devices.

[0060] It should be noted that in each specific implementation of the present application, when it comes to the need to perform relevant processing based on data related to user identity or characteristics such as user information, user behavior data, user historical data, and user location information, the user's permission or consent will be obtained first, and the collection, use, and processing of these data will comply with relevant laws, regulations, and standards. In addition, when the embodiment of the present application needs to obtain the user's sensitive personal information, the user's separate permission or consent will be obtained through a pop-up window or by jumping to a confirmation page. After clearly obtaining the user's separate permission or consent, the necessary user-related data for the normal operation of the embodiment of the present application will be obtained.

[0061] To facilitate a better understanding of the solutions of the embodiments of the present application, the relevant technologies are first introduced below.

[0062] Artificial intelligence (AI) is a new technical science that studies and develops theories, methods, technologies and application systems for simulating, extending and expanding human intelligence. AI is a branch of computer science that attempts to understand the essence of intelligence and produce a new type of intelligent machine that can respond in a similar way to human intelligence. Research in this field includes robots, language recognition, image recognition, natural language processing and expert systems. AI can simulate the information process of human consciousness and thinking. AI is also a theory, method, technology and application system that uses digital computers or machines controlled by digital computers to simulate, extend and expand human intelligence, perceive the environment, acquire knowledge and use knowledge to obtain the best results.

[0063] Machine learning is the science of using computers to simulate or realize human learning activities. It is one of the most intelligent and cutting-edge research fields in artificial intelligence. The research directions of traditional machine learning mainly include decision trees, random forests, artificial neural networks, Bayesian learning, etc.

[0064] Deep learning is the process of learning the inherent laws and representation levels of sample data. The information obtained in the learning process is very helpful for interpreting data such as text, images, and sounds. Its ultimate goal is to enable machines to have analytical learning capabilities like humans and to recognize data such as text, images, and sounds. Deep learning is a complex machine learning algorithm that has achieved results in speech and image recognition and is a research direction in the field of machine learning.

[0065] Natural Language Processing (NLP): NLP uses computers to process, understand, and apply human languages ​​(such as Chinese and English). NLP is a branch of artificial intelligence and an interdisciplinary subject between computer science and linguistics. It is often referred to as computational linguistics. Natural language processing includes grammatical analysis, semantic analysis, and text understanding. Natural language processing is often used in technical fields such as machine translation, handwritten and printed character recognition, speech recognition and text-to-speech conversion, information intent recognition, information extraction and filtering, text classification and clustering, public opinion analysis, and opinion mining. It involves data mining related to language processing, machine learning, knowledge acquisition, knowledge engineering, artificial intelligence research, and linguistic research related to language computing.

[0066] Information Extraction: A text processing technology that extracts specified types of entity, relationship, event and other factual information from natural language text and forms structured data output. Information extraction is a technology that extracts specific information from text data. Text data is composed of some specific units, such as sentences, paragraphs, and chapters. Text information is composed of some small specific units, such as characters, words, phrases, sentences, paragraphs, or a combination of these specific units. Extracting noun phrases, names, place names, etc. from text data are all text information extraction. Of course, the information extracted by text information extraction technology can be various types of information.

[0067] Data collection point analysis is a commonly used data collection method for website analysis. It refers to attaching the data collection program code to the functional program code at the "operation node" where data needs to be collected, and capturing, processing and sending related technologies and their implementation process for user behaviors or events on the operation node.

[0068] In order to solve the technical problems in the background technology, the embodiments of the present application provide a file management method, system, device and storage medium. The file management method provided by the embodiments of the present application is first introduced below.

[0069] See also Figure 1 , Figure 1 A flowchart of a file management method provided in an embodiment of the present application, which can be applied to electronic devices or file management systems in the following embodiments, wherein the electronic devices include personal computers, servers, mobile devices, cloud computing platforms, and supercomputers, etc., and the application of electronic devices is used as an example. The file management method can specifically include the following steps:

[0070] Step 110, performing tracking monitoring on the target monitoring interface to obtain tracking data, wherein the tracking data is used to record the operation behavior of the target user on the target monitoring interface;

[0071] Step 120, determining the operation information of the sensitive file operated by the target user according to the operation behavior in the buried data;

[0072] Step 130, detecting abnormal operation behaviors of the target user's operation behaviors according to the operation information, wherein the abnormal operation behaviors include behaviors that have caused the sensitive files to be leaked or are about to be leaked;

[0073] Step 140: When it is detected that the operation behavior of the target user belongs to the abnormal operation behavior, the file operation authority of the target user on the target monitoring interface is restricted.

[0074] The embodiment of the present application provides a file management method, which can perform point-to-point monitoring on the target monitoring interface, obtain point-to-point data, and determine the operation information of the sensitive files operated by the target user based on the operation behavior in the point-to-point data. Then, based on the operation information, the operation behavior of the target user is detected for abnormal operation behavior, wherein the abnormal operation behavior includes the behavior that has caused the sensitive files to be leaked or is about to be leaked, and when it is detected that the operation behavior of the target user is an abnormal operation behavior, the target user's file operation authority on the target monitoring interface is restricted, which can timely reduce the risk of further leakage of sensitive files, thereby improving the security of sensitive file management.

[0075] The following will be Figure 1 Each step of the method is described in detail.

[0076] In step 110, the target monitoring interface can be understood as a file interface, which is a set of specifications or methods that allow users or applications to interact with the file system to access and operate computer files.

[0077] The target monitoring interface can generally be determined through electronic equipment, and in some other special scenarios it can also be determined through manual operations such as adding, deleting, modifying, and other active operations.

[0078] The target monitoring interface may include one or more, which may be determined according to the specific application scenario.

[0079] The operation behavior includes at least one of access, upload and download.

[0080] Taking the banking system as an example, the files stored in the banking system include not only the user's private data, but also the bank's internal financial data. Among them, the user's private data can be accessed by the corresponding user himself or the bank staff serving the user, and the bank's internal financial data can be accessed by all or some bank staff, both of which are sensitive information. The banking system can provide different target monitoring interfaces, such as interfaces exclusively accessible to bank users and interfaces exclusively accessible to internal bank staff.

[0081] The buried point monitoring can monitor the operation behaviors occurring on the above-mentioned target monitoring interface and form buried point data based on the monitoring records. The buried point data formed by the buried point monitoring can be uniformly stored in the database by the electronic device and can be used for buried point analysis.

[0082] The target user is the user corresponding to the operation behavior. In some embodiments, the target user can be represented by the operation account corresponding to the operation behavior, or by the operation source address corresponding to the operation behavior, or by the operation account and the operation source address together.

[0083] In some embodiments, the data type of the buried point data can be detected and determined, and a database for storing the buried point data can be determined based on the data type determined by the detection. For example, if the buried point data is detected to be semi-structured or unstructured data, the buried point data can be stored in a NoSQL database, which is a non-relational database.

[0084] In some embodiments, the tracking point monitoring does not belong to real-time monitoring, that is, the target monitoring interface is not monitored in real time. It can be monitored only when an operation occurs on the target monitoring interface, avoiding the situation where real-time monitoring wastes computing resources.

[0085] In step 120, sensitive files may refer to files that include sensitive information. In a banking system, personal information of bank users stored by the bank, such as name and contact information, as well as financial data that is not disclosed to the public within the bank, are all sensitive information. Generally, sensitive files containing such sensitive information also need to be kept strictly confidential and not disclosed to the public.

[0086] The operation information may include the operation time period, continuous operation duration, operation frequency, the number of first sensitive files accessed and / or downloaded during the operation time period, and the number of second sensitive files accessed and / or downloaded during the continuous operation duration. When the electronic device detects an operation behavior occurring on the target monitoring interface, it can track the sensitive files accessed, uploaded or downloaded through the operation behavior, and thus form the operation information.

[0087] Sensitive files can be identified by identifying sensitive files or other information associated with sensitive files. In some embodiments, each sensitive file has a built-in storage of a unique serial number, which is not present in non-sensitive files. The unique serial number is unique and non-repetitive, and can be stored in an area of ​​the sensitive file that does not affect the integrity of the sensitive file, is not likely to damage the integrity of the content of the sensitive file, and the electronic device can quickly identify the sensitive file through the unique serial number.

[0088] Taking the example of financial institutions such as banks, with the increasingly rapid economic development, an incalculable number of transactions occur every day. Banks need to analyze the huge amount of transaction information and keep the transaction information involving sensitive information strictly confidential, which involves the detection and judgment of the above-mentioned sensitive files.

[0089] In some embodiments, in the face of a large number of files, information in the files can be identified and detected through machine learning, deep learning or NLP and other technologies, and sensitive information therein can be determined. NLP can also be combined with information extraction to jointly identify and detect, and determine the sensitive information therein. After determining the sensitive information in the file, the sensitive information can be marked to form a sensitive label. For example, if the sensitive information is identified as a specific address of the user, the specific address of the user can be marked as a "communication address". For example, if the sensitive information is identified as a string of ID card numbers, the ID card numbers can be marked as "ID card".

[0090] Every time a document is entered into the bank system, it is necessary to check the sensitive information of the document to determine whether the document is a sensitive document.

[0091] In some embodiments, in the above embodiments, in the case where sensitive information in a file can be identified and marked to determine a sensitive file, a hash calculation can be performed on the sensitive file, and the hash value obtained by the hash calculation can be encrypted using blockchain technology to obtain a unique serial number corresponding to the sensitive file. Blockchain technology can securely store the unique serial number in an encrypted manner, ensuring that the unique serial number cannot be tampered with and its uniqueness, thereby improving the security of the unique serial number.

[0092] In some embodiments, the hash calculation may use the MD5 hash algorithm.

[0093] In some embodiments, after performing hash calculation on a sensitive file to form a hash value, an association relationship can be established between the hash value and the basic information, sensitive information, and operation information such as access, upload or download, and the operation object and operation time in the corresponding sensitive file, and the association relationship can be stored in a database. An association relationship can also be established between the hash value and the basic information, sensitive labels, and operation information such as access, upload or download of the corresponding sensitive file, and the determined association relationship can also be stored in the database, so that the electronic device can determine the basic information, sensitive information, and operation information of the corresponding sensitive file in the database through the hash value.

[0094] If a sensitive file is determined to have been leaked, the unique serial number of the leaked sensitive file can be obtained, and the corresponding hash value can be obtained by decrypting the unique serial number on the blockchain. Through the association of the hash values, not only can the sensitive information be quickly determined, but also the objects that accessed, uploaded or downloaded the sensitive files can be determined through the association, thereby achieving the tracking and tracing of the leaked sensitive files.

[0095] In some embodiments, during the operation of the target user, the electronic device needs to determine whether the file corresponding to the target user's operation behavior is a sensitive file. The electronic device can use asynchronous acquisition to obtain the file that the target user is operating, such as accessing, uploading or downloading, thereby avoiding affecting the normal operation process of the target user.

[0096] In step 130, the abnormal operation behavior includes the behavior that has caused the sensitive file to be leaked or is about to be leaked. The electronic device can analyze the operation information determined in the above embodiment to determine whether the operation behavior corresponding to the operation information is an abnormal operation behavior.

[0097] For example, when the operation information only includes the operation frequency, the operation frequency may be the operation frequency for sensitive files, such as the number of times a single sensitive file is accessed within one minute, or the number of times multiple sensitive files are accessed within one minute. The electronic device may detect the operation frequency, and if it detects that the operation frequency is too high, such as greater than or equal to a predetermined value such as 100, it may determine that the operation behavior corresponding to the operation information including the access frequency is an abnormal operation behavior.

[0098] Exemplarily, when the operation information only includes the operation time period and the operation frequency, the operation time period and the operation frequency can be combined to comprehensively determine whether the operation behavior corresponding to the operation information including the operation time period charge operation frequency is an abnormal operation behavior.

[0099] Specifically, if the operation time period occurs in an abnormal working time period such as 00:00 to 06:00, and the operation frequency can be expressed as 100, the number of accesses to multiple sensitive files within one minute, then it can be determined that the operation behavior corresponding to the operation information including the operation time period and the operation frequency is an abnormal operation behavior.

[0100] If the operation time period occurs in the normal working time period such as 06:01 to 18:00, and the operation frequency can be expressed as the number of accesses to multiple sensitive files within one minute as 100, then it can be determined that the operation behavior corresponding to the operation information including the operation time period and the operation frequency is a normal operation behavior and does not constitute an abnormal operation behavior.

[0101] In another case, if the operation time period occurs in the normal working time period such as 06:01 to 18:00, and the operation frequency can be expressed as the number of accesses to multiple sensitive files within one minute 200, then it can be determined that the operation behavior corresponding to the operation information including the operation time period and the operation frequency is an abnormal operation behavior.

[0102] The above embodiments show that it is possible to detect whether the operation behavior corresponding to the operation information is an abnormal operation behavior by using the operation information including a single type of data, or it is possible to detect whether the operation behavior corresponding to the operation information is an abnormal operation behavior by using the operation information including two types of data. Of course, it is also possible to detect abnormal operation behavior by using operation information of more types of data, which will not be described in detail here.

[0103] In step 140, the file operation permission may be the operation permission of the target user on the target monitoring interface.

[0104] Exemplarily, the operation permissions may include access permissions, upload permissions, and download permissions.

[0105] Exemplarily, if further subdivided, access rights may include accessible time periods and the total number of accessible confidential files, upload rights may include upload time periods and uploadable file types, and download rights may include downloadable time periods and the total number of downloadable sensitive files.

[0106] After the electronic device detects that the target user's operation behavior is abnormal, it can modify the target user's file operation permissions on the target monitoring interface, thereby restricting the target user's file operation permissions, and timely prevent the leakage of more sensitive files.

[0107] In some embodiments, when the electronic device detects that the target user's operating behavior is abnormal, it can directly restrict the target user's all file operation permissions on the target monitoring interface. After being restricted, the target user cannot access, upload, download, and other operations through the target monitoring interface.

[0108] In some embodiments, when the electronic device detects that the target user's operating behavior is abnormal, it can also partially restrict the target user's file operation permissions on the target monitoring interface. For example, after being partially restricted, the target user can only upload files through the target monitoring interface, but cannot perform operations such as access and downloading, thereby achieving protection of sensitive files.

[0109] In some embodiments, if the target user's file operation permissions on the target monitoring interface are restricted, the electronic device can also accept a recovery request from the target user. Specifically, the target user can submit a recovery request step by step. If each level is determined by the corresponding operator to be able to recover the request, the electronic device can restore the restriction on the target user's file operation permissions on the target monitoring interface based on the recovery request finally received.

[0110] See also Figure 2 , Figure 2 A flowchart of file operation permission restriction included in a file management method provided in an embodiment of the present application. In a possible implementation, step 140 restricts the target user's file operation permission on the target monitoring interface when it is detected that the target user's operation behavior is an abnormal operation behavior, which may include but is not limited to the following steps 1410 to 1420.

[0111] Step 1410, obtaining an abnormal identification of the abnormal operation behavior, where the abnormal identification is used to mark the leakage risk level of the abnormal operation behavior;

[0112] Step 1420: When the leakage risk level is determined by the abnormal identification, the target user's file operation authority on the target monitoring interface is restricted according to the leakage risk level.

[0113] This embodiment can determine the leakage risk level of abnormal operation behavior through abnormal identification, and can further implement accurate restriction of the file operation authority of the target user on the target monitoring interface based on the leakage risk level.

[0114] The abnormal identification can be used to mark the leakage risk level of the abnormal operation behavior. This embodiment does not limit the form of the abnormal identification. Any Arabic numerals and English characters that can be used as identification can be used as abnormal identification.

[0115] The leakage risk level can be used to indicate the risk that abnormal operation behavior may lead to leakage of sensitive documents. The leakage risk level may include level 1, level 2 and level 3, among which level 3 corresponds to the highest leakage risk level, and abnormal operation behavior with leakage risk level 3 may lead to the highest risk of leakage of sensitive documents. Conversely, abnormal operation behavior with leakage risk level 1 may lead to the lowest risk of leakage of sensitive documents.

[0116] In some embodiments, if the leakage risk level is level three, the electronic device may restrict all file operation permissions of the target user corresponding to the abnormal operation behavior to the target monitoring interface.

[0117] In some embodiments, if the leakage risk level is level 2, the electronic device may only limit the download permissions of the target user corresponding to the abnormal operation behavior to the target monitoring interface, and may not restrict the access permissions and upload permissions.

[0118] In some embodiments, if the leakage risk level is level one, the electronic device may not grant the target user corresponding to the abnormal operation behavior file operation permissions on the target monitoring interface.

[0119] In some embodiments, the abnormality mark can be represented by a single Arabic numeral. For example, the abnormality marks 1, 2, and 3 can represent the corresponding leakage risk levels of level 1, level 2, and level 3, respectively.

[0120] In a possible implementation, the operation information includes the operation time period, the continuous operation duration, the operation frequency, the number of first files accessed and / or downloaded sensitive files within the operation time period, and the number of second files accessed and / or downloaded sensitive files within the continuous operation duration. According to the operation information, the operation behavior of the target user is detected for abnormal operation behavior, including:

[0121] Determine the operation behavior that meets the preset conditions as abnormal operation behavior;

[0122] The preset conditions include any of the following:

[0123] The operation time period is within the preset time period, and the number of first files is greater than a first preset threshold;

[0124] The continuous operation duration is greater than the preset operation duration, and the number of second files is greater than the second preset threshold;

[0125] The operating frequency is greater than the preset frequency.

[0126] This embodiment can improve the accuracy and reliability of detecting whether the operation behavior corresponding to the operation information is an abnormal operation behavior by comparing the operation information with the preset conditions.

[0127] The first preset threshold, the second preset threshold and the preset frequency can be set and modified according to actual needs, and are not specifically limited in this embodiment.

[0128] The operation time period and the preset time period can refer to those in the above embodiments and will not be described in detail here.

[0129] Different from the operating frequency in the above example, in this embodiment, the operating frequency is directly determined by setting a preset frequency to determine whether the operating frequency is normal. When the operating frequency is greater than the preset frequency, the operating frequency can be determined to be abnormal, including that the operating behavior corresponding to the operating information of the operating frequency is an abnormal operating behavior.

[0130] The implementation methods corresponding to the operation time period and the continuous operation duration are similar to the examples of the abnormal working time period exemplified in the above embodiment, such as from 00:00 to 06:00, and accessing 100 multiple sensitive files. The specific implementation methods can refer to the above examples, and this embodiment will not be repeated here.

[0131] In some embodiments, the electronic device may determine the risk level of leakage of abnormal operation behavior by setting multiple upper limit values ​​and based on the analysis of operation information.

[0132] For example, the operation time period is within the preset time period from 06:00 to 18:00, and the number of first files is greater than the first preset threshold of 100.

[0133] If the first file quantity is 140, the first exceeding upper limit value is 50, the second exceeding upper limit value is 100, and the first file quantity 140 is less than the sum of the first preset threshold value 100 and the first exceeding upper limit value 50 (150), then it can be determined that the operation behavior corresponding to the operation information including the operation time period and the first file quantity is an abnormal operation behavior, and the leakage risk level of the abnormal operation behavior is level one, and its corresponding abnormal flag can be set to 1.

[0134] If the first file quantity is 180, the first exceeding upper limit value is 50, the second exceeding upper limit value is 100, the first file quantity 180 is greater than the sum of the first preset threshold value 100 and the first exceeding upper limit value 50 (150), and is less than the sum of the first preset threshold value 100 and the second exceeding upper limit value 100 (200), then it can be determined that the operation behavior corresponding to the operation information including the operation time period and the first file quantity is an abnormal operation behavior, and the leakage risk level of the abnormal operation behavior is level two, and its corresponding abnormal flag can be set to 2.

[0135] If the first file quantity is 220, the first exceeding upper limit value is 50, the second exceeding upper limit value is 100, and the first file quantity 220 is greater than the sum of the first preset threshold value 100 and the second exceeding upper limit value 100 (200), then it can be determined that the operation behavior corresponding to the operation information including the operation time period and the first file quantity is an abnormal operation behavior, and the leakage risk level of the abnormal operation behavior is level three, and its corresponding abnormal flag can be set to 3.

[0136] See also Figure 3 , Figure 3A flowchart for determining a target monitoring interface included in a file management method provided in an embodiment of the present application. In a possible implementation, before performing point-of-sight monitoring on the target monitoring interface, the method may also include but is not limited to the following steps 210 to 220:

[0137] Step 210, obtaining a preset security management level;

[0138] Step 220, determining a target monitoring interface according to a preset security management level, wherein different preset security management levels correspond to different target monitoring interfaces.

[0139] This embodiment can determine the target monitoring interface through preset security management registration, which can reduce the operation of manually determining the target monitoring interface, which not only improves the accuracy and reliability of determining the target monitoring interface, but also reduces labor costs.

[0140] The preset security management level can be set to two or more depending on the specific scenario.

[0141] In some embodiments, after determining the preset security management level, an association relationship between the preset security management level and the target monitoring interface can be suggested, and the preset security management level, the target monitoring interface, and the association relationship between the preset security management level and the target monitoring interface can be stored in a preset table. In this way, after obtaining the preset security management level, the electronic device can directly determine the target monitoring interface corresponding to the obtained preset security management level through the preset table quickly, accurately, and reliably.

[0142] See also Figure 4 , Figure 4 A detection flow chart included in a file management method provided in an embodiment of the present application. In a possible implementation, the operation information includes the operation time period, the continuous operation duration, the operation frequency, the number of first files accessed and / or downloaded sensitive files within the operation time period, and the number of second files accessed and / or downloaded sensitive files within the continuous operation duration. Step 130 detects abnormal operation behavior of the target user's operation behavior based on the operation information, which may include but is not limited to the following steps 1310 to 1350:

[0143] Step 1310, determining a first weight value of the operation time period, a second weight value of the continuous operation duration, and a third weight value of the operation frequency according to a preset security management level;

[0144] Step 1320, determining a first target value according to the first file quantity and the first weight value;

[0145] Step 1330, determining a second target value according to the second file quantity and the second weight value;

[0146] Step 1340, determining a third target value according to the operating frequency and the third weight value;

[0147] Step 1350, determining abnormal operation behavior according to the first target value, the second target value, and the third target value.

[0148] This embodiment determines different weight values ​​by presetting the security management level, and then can combine all types of data in the operation information to comprehensively realize the detection of abnormal operation behavior, which can avoid the detection error caused by using a single type of data to detect abnormal operation behavior, and thus improve the detection accuracy and reliability of abnormal operation behavior.

[0149] The calculation formulas of the first target data S1, the second target value S2 and the third target value S3 are as follows:

[0150] S1=C1*f1, (1)

[0151] S2=C2*f2, (2)

[0152] S3=C3*f3, (3)

[0153] Among them, C1 represents the number of first files, f1 represents the first weight value; C2 represents the number of second files, f2 represents the second weight value; C3 represents the number of third files, f3 represents the third weight value.

[0154] In some embodiments, if the preset security management level is level one, the first weight value is smaller than the second weight value, and the second weight value is smaller than the third weight value.

[0155] In some embodiments, if the preset security management level is level three, the first weight value is greater than the second weight value, and the second weight value is greater than the third weight value.

[0156] In some embodiments, the intercept may be added through a logistic regression algorithm to calculate the operation information in the above embodiments, so as to detect abnormal operation behaviors.

[0157] In a possible implementation, determining the abnormal operation behavior according to the first target value, the second target value, and the third target value includes:

[0158] When the sum of the first target value, the second target value and the third target value is greater than the third preset threshold, it is determined that the operation behaviors corresponding to the first target value, the second target value and the third target value are abnormal operation behaviors.

[0159] This embodiment detects abnormal operation behavior by calculating the sum of the first target value, the second target value, and the third target value, and comparing the sum with the third preset threshold.

[0160] The third preset threshold can be set according to actual needs and is not limited here.

[0161] In some embodiments, the abnormal operation behavior can be detected by calculating the average value of the first target value, the second target value and the third target value and comparing them with the third preset threshold.

[0162] In a possible implementation, the method of determining a sensitive file includes:

[0163] Files detected with unique serial numbers are regarded as sensitive files, and each sensitive file includes a unique serial number.

[0164] For the unique serial number in this embodiment, please refer to the introduction in the above embodiment and will not be repeated here.

[0165] In some embodiments, when the target user performs operations on the target monitoring interface, the electronic device also needs to verify the authority of the target user, and only after the verification is passed will the target user be allowed to perform operations on the target monitoring interface.

[0166] In some embodiments, the permission verification standards for different target monitoring interfaces are different, and the higher the preset security management level, the stricter the interface permission verification of the target monitoring interface.

[0167] Exemplarily, the target monitoring interface corresponding to the highest preset security management level security level requires biometric recognition such as facial recognition or fingerprint recognition.

[0168] In some embodiments, if a sensitive file contains multiple different types of sensitive information such as contact information, ID number, user name, the sensitive file may include multiple sensitive tags.

[0169] Corresponding to the above method embodiment, the present application embodiment also provides a file management system, see Figure 5 , Figure 5 A functional module diagram of a file management system provided in an embodiment of the present application, wherein the file management system 500 includes:

[0170] The monitoring module 510 is used to perform tracking monitoring on the target monitoring interface to obtain tracking data, which is used to record the operation behavior of the target user on the target monitoring interface;

[0171] The determination module 520 is used to determine the operation information of the sensitive file operated by the target user according to the operation behavior in the buried data;

[0172] The detection module 530 is used to detect abnormal operation behaviors of the target user's operation behaviors according to the operation information, wherein the abnormal operation behaviors include behaviors that have caused the leakage of sensitive files or are about to cause the leakage of sensitive files;

[0173] The restriction module 540 is used to restrict the target user's file operation authority on the target monitoring interface when it is detected that the target user's operation behavior is an abnormal operation behavior.

[0174] The file management system provided by the embodiment of the present application can perform point-of-sight monitoring on the target monitoring interface through the monitoring module to obtain point-of-sight data, and determine the operation information of the sensitive files operated by the target user according to the operation behavior in the point-of-sight data through the determination module. Then, the detection module detects abnormal operation behavior of the target user's operation behavior according to the operation information, wherein the abnormal operation behavior includes the behavior that has caused the sensitive files to be leaked or is about to be leaked, and the restriction module restricts the target user's file operation authority on the target monitoring interface when it is detected that the target user's operation behavior is an abnormal operation behavior, which can timely reduce the risk of further leakage of sensitive files, thereby improving the security of sensitive file management.

[0175] The file management system 500 can achieve Figure 1 The various processes implemented in the method embodiments can achieve similar or identical technical effects. In order to avoid repetition of the implementation process, they will not be repeated here.

[0176] In a possible implementation manner, the restriction module 540 is further specifically configured to:

[0177] Obtaining an abnormal identification of the abnormal operation behavior, where the abnormal identification is used to mark the risk level of leakage of the abnormal operation behavior;

[0178] When the leakage risk level is determined through abnormal identification, the target user's file operation permissions on the target monitoring interface are restricted according to the leakage risk level.

[0179] This embodiment can determine the leakage risk level of abnormal operation behavior through abnormal identification, and can further implement accurate restriction of the file operation authority of the target user on the target monitoring interface based on the leakage risk level.

[0180] The abnormal identification can be used to mark the leakage risk level of the abnormal operation behavior. This embodiment does not limit the form of the abnormal identification. Any Arabic numerals and English characters that can be used as identification can be used as abnormal identification.

[0181] The leakage risk level can be used to indicate the risk that abnormal operation behavior may lead to leakage of sensitive documents. The leakage risk level may include level 1, level 2 and level 3, among which level 3 corresponds to the highest leakage risk level, and abnormal operation behavior with leakage risk level 3 may lead to the highest risk of leakage of sensitive documents. Conversely, abnormal operation behavior with leakage risk level 1 may lead to the lowest risk of leakage of sensitive documents.

[0182] In a possible implementation, the operation information includes an operation time period, a continuous operation duration, an operation frequency, a first number of sensitive files accessed and / or downloaded during the operation time period, and a second number of sensitive files accessed and / or downloaded during the continuous operation duration. The detection module 530 is further specifically used to:

[0183] Determine the operation behavior that meets the preset conditions as abnormal operation behavior;

[0184] The preset conditions include any of the following:

[0185] The operation time period is within the preset time period, and the number of first files is greater than a first preset threshold;

[0186] The continuous operation duration is greater than the preset operation duration, and the number of second files is greater than the second preset threshold;

[0187] The operating frequency is greater than the preset frequency.

[0188] In a possible implementation, the file management system 500 further includes an acquisition module, which is specifically used to:

[0189] Get the preset security management level;

[0190] According to the preset security management level, the target monitoring interface is determined, wherein different preset security management levels correspond to different target monitoring interfaces.

[0191] In a possible implementation, the operation information includes an operation time period, a continuous operation duration, an operation frequency, a first number of sensitive files accessed and / or downloaded during the operation time period, and a second number of sensitive files accessed and / or downloaded during the continuous operation duration. The detection module 530 is further specifically used to:

[0192] Determine, according to a preset security management level, a first weight value of the operation time period, a second weight value of the continuous operation duration, and a third weight value of the operation frequency;

[0193] Determine a first target value according to the first file quantity and the first weight value;

[0194] Determine a second target value according to the second file quantity and the second weight value;

[0195] Determining a third target value according to the operating frequency and the third weight value;

[0196] Abnormal operation behavior is determined based on the first target value, the second target value, and the third target value.

[0197] In a possible implementation, the detection module 530 includes a detection submodule, and the detection submodule is specifically used to:

[0198] Determining abnormal operation behavior according to the first target value, the second target value, and the third target value includes:

[0199] When the sum of the first target value, the second target value and the third target value is greater than the third preset threshold, it is determined that the operation behaviors corresponding to the first target value, the second target value and the third target value are abnormal operation behaviors.

[0200] In a possible implementation, the file management system 500 further includes a sensitive module, which is specifically used to: treat files detected to have unique serial numbers as sensitive files, and each sensitive file includes a unique serial number.

[0201] The present application also provides an electronic device. The present application also provides an electronic device. Figure 6 , Figure 6 An internal structure diagram of an electronic device provided for an embodiment of the present application. The electronic device includes a processor, a memory, and a network interface connected via a system bus. The memory includes a non-volatile storage medium and an internal memory. The non-volatile storage medium of the electronic device stores an operating system and may also store a computer program, which, when executed by the processor, enables the processor to implement the file management method applied to the electronic device in the above embodiment. The internal memory may also store a computer program, which, when executed by the processor, enables the processor to execute the file management method. Those skilled in the art will appreciate that Figure 6 The structure shown in the figure is merely a block diagram of a partial structure related to the scheme of the present application, and does not constitute a limitation on the electronic device to which the scheme of the present application is applied. The specific electronic device may include more or fewer components than shown in the figure, or combine certain components, or have a different arrangement of components.

[0202] The embodiment of the present application further discloses a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the file management method in the method embodiment is implemented.

[0203] An embodiment of the present application provides a computer program product, which is stored in a storage medium. The program product is executed by at least one processor to implement the various processes of the embodiment of the above-mentioned file management method, and can achieve similar or identical technical effects. To avoid repetition, it will not be repeated here.

[0204] Those of ordinary skill in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing related hardware through a computer program, and the program can be stored in a non-volatile computer-readable storage medium. When the program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to memory, storage, database or other media used in the embodiments provided in this application may include non-volatile and / or volatile memory. Non-volatile memory may include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM) or flash memory. Volatile memory may include random access memory (RAM) or external cache memory. By way of illustration and not limitation, RAM is available in many forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), synchronous link DRAM (SLDRAM), RAMbus direct RAM (RDRAM), direct RAMbus dynamic RAM (DRDRAM), and RAMbus dynamic RAM (RDRAM), etc.

[0205] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

Claims

1. A file management method, characterized in that: include: Performing point-tracking monitoring on a target monitoring interface to obtain point-tracking data, wherein the point-tracking data is used to record the operation behavior of the target user on the target monitoring interface; Determine the operation information of the sensitive file operated by the target user according to the operation behavior in the tracking data; According to the operation information, detecting abnormal operation behaviors of the target user's operation behaviors, wherein the abnormal operation behaviors include behaviors that have caused the sensitive files to be leaked or are about to be leaked; In the case where it is detected that the operation behavior of the target user belongs to the abnormal operation behavior, the file operation authority of the target user on the target monitoring interface is restricted.

2. The method according to claim 1, characterized in that When it is detected that the operation behavior of the target user belongs to the abnormal operation behavior, limiting the file operation authority of the target user on the target monitoring interface includes: Acquire an abnormal identification of the abnormal operation behavior, where the abnormal identification is used to mark the leakage risk level of the abnormal operation behavior; In a case where the leakage risk level is determined by the abnormal identification, the file operation authority of the target user on the target monitoring interface is restricted according to the leakage risk level.

3. The method according to claim 1, characterized in that The operation information includes an operation time period, a continuous operation duration, an operation frequency, a first number of files accessed and / or downloaded from the sensitive file within the operation time period, and a second number of files accessed and / or downloaded from the sensitive file within the continuous operation duration. The detecting of abnormal operation behavior of the target user's operation behavior based on the operation information includes: Determining an operation behavior that meets a preset condition as the abnormal operation behavior; The preset condition includes any one of the following: The operation time period is within a preset time period, and the first file quantity is greater than a first preset threshold; The continuous operation duration is greater than a preset operation duration, and the number of the second files is greater than a second preset threshold; The operating frequency is greater than a preset frequency.

4. The method according to claim 1, characterized in that: Before performing buried point monitoring on the target monitoring interface, the method further includes: Get the preset security management level; The target monitoring interface is determined according to the preset security management level, wherein different preset security management levels correspond to different target monitoring interfaces.

5. The method according to claim 4, characterized in that The operation information includes an operation time period, a continuous operation duration, an operation frequency, a first number of files accessed and / or downloaded from the sensitive file within the operation time period, and a second number of files accessed and / or downloaded from the sensitive file within the continuous operation duration. The detecting of abnormal operation behavior of the target user's operation behavior based on the operation information includes: Determining, according to the preset security management level, a first weight value of the operation time period, a second weight value of the continuous operation duration, and a third weight value of the operation frequency; Determining a first target value according to the first file quantity and the first weight value; Determining a second target value according to the second file quantity and the second weight value; Determining a third target value according to the operating frequency and the third weight value; The abnormal operation behavior is determined according to the first target value, the second target value, and the third target value.

6. The method according to claim 3, characterized in that The determining the abnormal operation behavior according to the first target value, the second target value, and the third target value includes: When the sum of the first target value, the second target value and the third target value is greater than a third preset threshold, it is determined that the operation behaviors corresponding to the first target value, the second target value and the third target value are abnormal operation behaviors.

7. The method according to claim 1, characterized in that Methods for determining the sensitive documents include: Files detected with unique serial numbers are regarded as the sensitive files, and each of the sensitive files includes a unique serial number.

8. A file management system, characterized in that: The system comprises: A monitoring module, used to perform point-of-care monitoring on a target monitoring interface to obtain point-of-care data, wherein the point-of-care data is used to record the operation behavior of a target user on the target monitoring interface; A determination module, used to determine the operation information of the sensitive file operated by the target user according to the operation behavior in the buried data; A detection module, configured to detect abnormal operation behaviors of the target user's operation behaviors according to the operation information, wherein the abnormal operation behaviors include behaviors that have caused the sensitive files to be leaked or are about to be leaked; The restriction module is used to restrict the file operation authority of the target user on the target monitoring interface when it is detected that the operation behavior of the target user belongs to the abnormal operation behavior.

9. An electronic device, characterized in that: The electronic device comprises a memory and a processor, wherein a computer program is stored in the memory, and the computer program implements the method according to any one of claims 1 to 7 when executed by the processor.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by one or more processors, the method according to any one of claims 1 to 7 is implemented.

Images