Data leakage prevention method, computer program product and electronic equipment

Abstract

The invention provides a data leakage prevention method, a computer program product and electronic equipment, and the method comprises the steps: before a target program is started, starting an interceptor, intercepting function call in the target program by using a Hook technology, and obtaining corresponding call information; in the running process of the target program, monitoring a call chain intercepted by the Hook technology according to the call information, and obtaining all functions on the call chain; according to the function, whether a suspicious behavior exists or not is determined, and the suspicious behavior comprises at least one of a behavior representing triggering data leakage, a behavior representing violation of data security and a behavior representing violation of privacy protection regulations; and under the condition that the suspicious behavior exists, intercepting and replacing the suspicious behavior. According to the method and the device, the problem that a data leakage prevention technology in the prior art depends on single access control and conventional storage encryption and has many influences on systematization, generalization and non-sensibility is solved.

Description

Technical Field

[0001] The present application relates to the technical field of data leakage prevention, and in particular to a data leakage prevention method, a computer-readable storage medium, a computer program product, and an electronic device. Background Art

[0002] With the continuous improvement of Internet technology and the degree of informatization, the risk of data leakage and privacy infringement is increasing. In order to prevent data leakage and information security problems, it is necessary to comprehensively supervise and control sensitive data and program behaviors. Existing data security protection and anti-leakage technologies mainly rely on single access control and conventional storage encryption technologies, which have many impacts on systematization, generalization and insensitivity.

[0003] With the development of informatization, data has become an important asset. The confidentiality, integrity and availability of data are related to the survival and competitiveness of enterprises. Data leakage prevention is a particularly prominent issue at present. While technologies such as email, instant messaging and mobile office improve work efficiency, they also inevitably expand the channels for data leakage, especially the active leakage behavior of users is even more difficult to control. Under this severe situation, various data leakage protection solutions have also been launched. The commonly used data leakage prevention technology is based on dynamic encryption and decryption technology, which is divided into two methods: document-level dynamic encryption and decryption and disk-level dynamic encryption and decryption.

[0004] Document-based dynamic encryption and decryption technology is that in different operating systems, when applications access data on storage devices, they generally call the file system through the API (Application Programming Interface) provided by the operating system, and then the file system accesses the specific storage medium through the storage medium driver. Disk-level dynamic encryption and decryption technology is to decrypt hard disk data in real time when the system starts. Whatever data the system reads, it directly decrypts the data in the memory, and then submits the decrypted data to the operating system.

[0005] Among existing methods, document-level dynamic encryption and decryption technology has great limitations. It performs encryption and decryption based on the file system and processes all files uniformly, which makes it difficult to meet personalized needs, such as automatically encrypting files of specified types. The disadvantage of disk-level dynamic encryption and decryption technology is that the efficiency of encryption and decryption is directly affected by system performance, which in turn will have an adverse impact on the rapid operation of normal applications. Summary of the invention

[0006] The main purpose of this application is to provide a data leakage prevention method, a computer-readable storage medium, a computer program product and an electronic device, so as to at least solve the problem that the data leakage prevention technology in the prior art relies on a single access control and conventional storage encryption, which has many impacts on systematization, generalization and insensitivity.

[0007] In order to achieve the above-mentioned purpose, according to one aspect of the present application, a data leakage prevention method is provided, comprising: before the target program is started, starting an interceptor, and using Hook technology to intercept function calls in the target program, and obtaining corresponding call information; during the operation of the target program, according to the call information, monitoring the call chain intercepted by the Hook technology, and at least obtaining all functions on the call chain; at least based on the function, determining whether there is suspicious behavior, the suspicious behavior including at least one of the following: behavior that characterizes data leakage, behavior that characterizes data security violations, and behavior that characterizes privacy protection violations; in the presence of the suspicious behavior, intercepting and replacing the suspicious behavior.

[0008] Optionally, at least all functions on the call chain are obtained, including: obtaining all the functions on the call chain and function parameter information corresponding to the functions; at least based on the functions, determining whether suspicious behavior exists, including: determining whether the suspicious behavior exists based on the functions and the function parameter information.

[0009] Optionally, determining whether suspicious behavior exists at least based on the function includes: utilizing a blacklist mechanism to determine whether the suspicious behavior exists at least based on the function.

[0010] Optionally, obtaining all the functions on the call chain and function parameter information corresponding to the functions includes: obtaining all the functions on the call chain and obtaining function parameters corresponding to the functions; parsing the function parameters to obtain the function parameter information, wherein the function parameter information is information characterizing the data type, size and content of the function parameters.

[0011] Optionally, determining whether the suspicious behavior exists based on the function and the function parameter information includes: determining that the suspicious behavior exists when it is detected that the function parameter information includes sensitive data, or the function is a sensitive function, and the sensitive function is a function that characterizes access to the sensitive data or causes leakage of the sensitive data.

[0012] Optionally, intercepting and replacing the suspicious behavior includes: intercepting and replacing the suspicious behavior using intrusion prevention means, wherein the intrusion prevention means includes encrypting the sensitive data and / or transmitting the sensitive data through a secure channel.

[0013] Optionally, in the case where the suspicious behavior exists, an alarm signal is issued, and the alarm signal is a signal indicating that the target program has the suspicious behavior.

[0014] According to another aspect of the present application, a computer-readable storage medium is provided, wherein the computer-readable storage medium includes a stored program, wherein when the program is executed, the device where the computer-readable storage medium is located is controlled to execute any one of the data leakage prevention methods.

[0015] According to another aspect of the present application, a computer program product is provided, comprising computer instructions, wherein when the computer instructions are executed by a processor, any one of the data leakage prevention methods is implemented.

[0016] According to another aspect of the present application, an electronic device is provided, comprising: one or more processors, a memory, and one or more programs, wherein the one or more programs are stored in the memory and are configured to be executed by the one or more processors, and the one or more programs include means for executing any one of the data leakage prevention methods.

[0017] Applying the technical solution of the present application, first before the target program is started, the interceptor is started, and the Hook technology is used to intercept the function call of the target program and obtain the corresponding call information, then during the operation of the target program, according to the call information, the call chain intercepted by the Hook technology is monitored, and at least all the functions on the call chain are obtained, and then at least according to the function, it is determined whether there is suspicious behavior, and finally in the case of suspicious behavior, the suspicious behavior is intercepted and replaced. Compared with the data leakage prevention technology in the prior art that relies on a single access control and conventional storage encryption, and has many problems in systematization, generalization and insensitivity, the present application monitors and intercepts the client application (target program) through the Hook technology, automatically detects, intercepts and replaces during the operation of the target program, monitors the call chain intercepted by the Hook technology and the functions on the call chain, and intercepts and replaces suspicious behaviors to ensure the security and privacy of the data, has universality, can be applied to various different applications, and ensures high efficiency and reliability in data leakage prevention and privacy protection. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] The drawings constituting part of the present application are used to provide a further understanding of the present application. The exemplary embodiments and descriptions of the present application are used to explain the present application and do not constitute an improper limitation on the present application. In the drawings:

[0019] Figure 1 A hardware structure block diagram of a mobile terminal for executing a data leakage prevention method provided in an embodiment of the present application is shown;

[0020] Figure 2 A schematic diagram of a data leakage prevention method according to an embodiment of the present application is shown;

[0021] Figure 3 A schematic diagram of a specific data leakage prevention device provided according to an embodiment of the present application is shown.

[0022] The above drawings include the following reference numerals:

[0023] 102, processor; 104, memory; 106, transmission device; 108, input and output devices. DETAILED DESCRIPTION

[0024] It should be noted that, in the absence of conflict, the embodiments and features in the embodiments of the present application can be combined with each other. The present application will be described in detail below with reference to the accompanying drawings and in combination with the embodiments.

[0025] In order to enable those skilled in the art to better understand the solution of the present application, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present application.

[0026] It should be noted that the terms "first", "second", etc. in the specification and claims of the present application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequential order. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present application described here. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device comprising a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0027] As introduced in the background technology, the data leakage prevention technology in the prior art relies on single access control and conventional storage encryption, which has many impacts on systematization, generalization and insensitivity. To solve the above problems, the embodiments of the present application provide a data leakage prevention method, a computer-readable storage medium, a computer program product and an electronic device.

[0028] The technical solutions in the embodiments of the present invention will be described clearly and completely below in conjunction with the accompanying drawings in the embodiments of the present invention.

[0029] The method embodiments provided in the embodiments of the present application can be executed in a mobile terminal, a computer terminal or a similar computing device. Taking running on a mobile terminal as an example, Figure 1 FIG. 1 is a hardware structure diagram of a mobile terminal of a data leakage prevention method according to an embodiment of the present invention. Figure 1 As shown, the mobile terminal may include one or more ( Figure 1 Only one is shown in the figure) a processor 102 (the processor 102 may include but is not limited to a processing device such as a microprocessor MCU or a programmable logic device FPGA) and a memory 104 for storing data, wherein the mobile terminal may also include a transmission device 106 and an input / output device 108 for communication functions. It can be understood by those skilled in the art that Figure 1 The structure shown is only for illustration and does not limit the structure of the mobile terminal. Figure 1 More or fewer components as shown, or with Figure 1 Different configurations shown.

[0030] The memory 104 can be used to store computer programs, for example, software programs and modules of application software, such as the computer program corresponding to the data leakage prevention method in the embodiment of the present invention. The processor 102 executes various functional applications and data processing by running the computer program stored in the memory 104, that is, the above method is implemented. The memory 104 may include a high-speed random access memory, and may also include a non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some examples, the memory 104 may further include a memory remotely arranged relative to the processor 102, and these remote memories can be connected to the mobile terminal via a network. Examples of the above-mentioned network include but are not limited to the Internet, an intranet, a local area network, a mobile communication network, and a combination thereof. The transmission device 106 is used to receive or send data via a network. The above-mentioned specific examples of the network may include a wireless network provided by a communication provider of the mobile terminal. In one example, the transmission device 106 includes a network adapter (Network Interface Controller, referred to as NIC), which can be connected to other network devices through a base station so as to communicate with the Internet. In one example, the transmission device 106 may be a radio frequency (RF) module, which is used to communicate with the Internet wirelessly.

[0031] In this embodiment, a data leakage prevention method running on a mobile terminal, a computer terminal or a similar computing device is provided. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and although a logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0032] Figure 2 is a flow chart of a data leakage prevention method according to an embodiment of the present application. Figure 2 As shown, the method comprises the following steps:

[0033] Step S201, before the target program is started, the interceptor is started, and the Hook technology is used to intercept the function call in the target program and obtain the corresponding call information;

[0034] Step S202, during the running of the target program, monitoring the call chain intercepted by the Hook technology according to the call information, and obtaining at least all functions on the call chain;

[0035] Step S203, determining whether there is any suspicious behavior based at least on the above function, wherein the suspicious behavior includes at least one of the following: behavior that indicates a data leak, behavior that indicates a violation of data security, and behavior that indicates a violation of privacy protection regulations;

[0036] Step S204: if the above suspicious behavior exists, intercept and replace the above suspicious behavior.

[0037] Through the above embodiments, first before the target program is started, the interceptor is started, and the Hook technology is used to intercept the function call of the target program and obtain the corresponding call information. Then, during the operation of the target program, the call chain intercepted by the Hook technology is monitored according to the call information, and at least all the functions on the call chain are obtained. Then, at least according to the function, it is determined whether there is suspicious behavior. Finally, in the case of suspicious behavior, the suspicious behavior is intercepted and replaced. Compared with the data leakage prevention technology in the prior art that relies on a single access control and conventional storage encryption, and has many problems in systematization, generalization and insensitivity, the present application monitors and intercepts the client application (target program) through the Hook technology, automatically detects, intercepts and replaces during the operation of the target program, monitors the call chain intercepted by the Hook technology and the functions on the call chain, and intercepts and replaces suspicious behaviors to ensure the security and privacy of data. It has universality and can be applied to various different applications, ensuring high efficiency and reliability in data leakage prevention and privacy protection.

[0038] Specifically, after starting the interceptor, the Hook technology can be used to intercept related calls of the target program and obtain call information.

[0039] Specifically, Hook: In computer programming, Hook is a technology that allows programs to intercept and modify the behavior of other programs. It can be understood as a listener on the target function. There are two common Hook technologies: one is the system-level Hook, called the system Hook; the other is the program-level Hook, called the application Hook. Through Hook technology, we can intervene in some system or program behaviors and change their default behaviors, such as modifying the size and position of the window, blocking a message, recording keyboard input, modifying the input parameters and return values ​​of the API, etc. Common application scenarios of Hook technology include system monitoring, security protection, enhancing system functions, and assisting program development and debugging.

[0040] In an optional solution, at least all functions on the above-mentioned call chain are obtained, including: obtaining all the above-mentioned functions on the above-mentioned call chain and the function parameter information corresponding to the above-mentioned functions; at least based on the above-mentioned functions, determining whether there is suspicious behavior, including: determining whether there is the above-mentioned suspicious behavior based on the above-mentioned functions and the above-mentioned function parameter information. In this embodiment, the functions on the call chain and the corresponding function parameter information are obtained, and based on the functions and function parameter information, it is determined whether there is suspicious behavior, which ensures that the detection of suspicious behavior is relatively comprehensive and accurate, thereby further ensuring that the reliability of data leakage prevention is high.

[0041] In other embodiments, determining whether suspicious behavior exists at least according to the above function includes: using a blacklist mechanism to determine whether the above suspicious behavior exists at least according to the above function. In this embodiment, using a blacklist mechanism to detect suspicious behavior further ensures that the detection of suspicious behavior is more accurate, thereby further ensuring that the reliability of data leakage prevention is higher.

[0042] In some other optional solutions, obtaining all the above functions on the above call chain and the function parameter information corresponding to the above functions includes: obtaining all the above functions on the above call chain and obtaining the function parameters corresponding to the above functions; parsing the above function parameters to obtain the above function parameter information, the above function parameter information is information characterizing the data type, size and content of the above function parameters. In this embodiment, parsing the function parameters to obtain the function parameter information further ensures that the subsequent detection of suspicious behaviors is more comprehensive and accurate, thereby further ensuring that the reliability of data leakage prevention is high.

[0043] Specifically, by parsing the function parameters, information such as the parameter data type, size, and content is obtained to help detect suspicious behavior.

[0044] In some further optional schemes, determining whether the above-mentioned suspicious behavior exists based on the above-mentioned function and the above-mentioned function parameter information includes: determining the existence of the above-mentioned suspicious behavior when it is detected that the above-mentioned function parameter information includes sensitive data, or the above-mentioned function is a sensitive function, and the above-mentioned sensitive function is a function that characterizes access to the above-mentioned sensitive data or causes leakage of the above-mentioned sensitive data. In this embodiment, determining the existence of suspicious behavior when it is detected that the function parameter information includes sensitive data, or the function is a sensitive function, further ensures that the detection of suspicious behavior is relatively accurate, thereby further ensuring that the reliability of data leakage prevention is high.

[0045] Specifically, real-time detection of suspicious behaviors: Analyze the parameters of each function and detect suspicious behaviors in real time, such as parameters containing sensitive data or calling functions that may cause data leakage. A blacklist mechanism can be used to detect whether there are suspicious parameters or function calls. The blacklist contains some commonly used sensitive functions or parameters. If these contents are detected, they are considered suspicious behaviors.

[0046] In some exemplary embodiments, intercepting and replacing the suspicious behavior includes: using intrusion prevention means to intercept and replace the suspicious behavior, and the intrusion prevention means includes encrypting the sensitive data and / or transmitting the sensitive data through a secure channel. In this embodiment, using intrusion prevention means to intercept and replace suspicious behaviors further ensures that the efficiency and reliability of data leakage prevention are high.

[0047] In other exemplary embodiments, in the case of the existence of the above-mentioned suspicious behavior, an alarm signal is issued, and the above-mentioned alarm signal is a signal that characterizes the existence of the above-mentioned suspicious behavior in the above-mentioned target program. In this embodiment, in the case of the existence of suspicious behavior, an alarm signal is issued to notify the system administrator or security team, informing them that there may be a security threat or data leakage risk, so that measures can be taken quickly, further ensuring that the efficiency and reliability of data leakage prevention are high.

[0048] Specifically, the current data leakage prevention technology is mostly to dynamically encrypt and decrypt data at the storage level, which is a single function and faces the risk of data leakage once the key is cracked. The data leakage prevention method proposed in the present invention monitors and intercepts the client application through the Hook technology, detects data reading and writing operations in real time, prevents the relevant application from unauthorized access to sensitive data and privacy information through the interception and replacement of application calls, and controls network communication behavior to enhance data security and protection capabilities. The method realizes the function of data leakage prevention at the behavior level, opens a secure closed space for data that needs to be retained and solidified through redirection technology, and performs secure encrypted storage, which has the advantages of non-intrusiveness, high efficiency, scalability and universality, making it suitable for Internet client security protection needs in various application scenarios. The data leakage prevention method based on Hook technology can detect the behavior of the application in real time without intrusion, and can prevent the relevant application from unauthorized access to sensitive data and leaking information through interception and replacement of application calls, and control network communication behavior, thereby achieving the purpose of data security and protection. This method has the characteristics of non-intrusiveness, universality, and rigorous data control, and can be generalized to adapt to various application scenarios.

[0049] Specifically, there are many technologies for preventing data leakage, which can be intervened in data storage, transmission, and application behavior control. The present invention exerts control on application behavior control, intercepts and controls some behaviors that touch data leakage, and this interception behavior is achieved through the hooking technology at the operating system level. This has universality and can also be controlled at the application level in scenarios where universality requirements are not high. The data leakage prevention method proposed in the present invention can flexibly configure the hooked application process according to user needs, and provide a safe and independent virtual operating environment for the operation of these processes, thereby ensuring that the running process data is redirected and saved in the virtual environment, and then uniformly released and cleared when the application ends its operation, thereby ensuring that the data is not landed or landed safely. The purpose of the present invention is to effectively solve the problems of data leakage and data protection in the prior art according to specific flexible configuration without modifying the source code of the target program and without affecting the operation of the target program.

[0050] In order to enable those skilled in the art to more clearly understand the technical solution of the present application, the implementation process of the data leakage prevention method of the present application will be described in detail below in combination with specific embodiments.

[0051] This embodiment relates to a specific data leakage prevention method, such as Figure 3 As shown, the following steps are included:

[0052] Step S1: Start the interceptor: before the target program is started, start the interceptor, use the Hook technology to intercept the function call of the target program, and obtain the corresponding call information intercepted by the Hook technology;

[0053] Step S2: Monitor the call chain intercepted by the Hook technology: During the running of the target program, monitor the call chain intercepted by the Hook technology and obtain all functions and function parameter information on the call chain.

[0054] Step S3: Real-time detection of suspicious behaviors: Analyze the parameters of each function and detect suspicious behaviors in real time, such as parameters containing sensitive data or calling functions that may cause data leakage;

[0055] Step S4: Determine whether there is any suspicious behavior. If there is no suspicious behavior, the Hook verification passes and proceeds to the next step;

[0056] Step S5: intercept and replace suspicious behavior: once suspicious behavior is detected, intercept and replace the behavior to avoid data leakage;

[0057] Step S6: using intrusion prevention means to intercept and replace suspicious behaviors;

[0058] Step S7: Use a blacklist mechanism to detect whether there are suspicious parameters or function calls.

[0059] It should be noted that the steps shown in the flowcharts of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and that, although a logical order is shown in the flowcharts, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0060] An embodiment of the present invention provides a computer-readable storage medium, wherein the computer-readable storage medium includes a stored program, wherein when the program is executed, the device where the computer-readable storage medium is located is controlled to execute the data leakage prevention method.

[0061] Specifically, data leakage prevention methods include:

[0062] Step S201, before the target program is started, the interceptor is started, and the Hook technology is used to intercept the function call in the target program and obtain the corresponding call information;

[0063] Step S202, during the running of the target program, monitoring the call chain intercepted by the Hook technology according to the call information, and obtaining at least all functions on the call chain;

[0064] Step S203, determining whether there is any suspicious behavior based at least on the above function, wherein the suspicious behavior includes at least one of the following: behavior that indicates a data leak, behavior that indicates a violation of data security, and behavior that indicates a violation of privacy protection regulations;

[0065] Step S204: if the above suspicious behavior exists, intercept and replace the above suspicious behavior.

[0066] Optionally, at least all functions on the above-mentioned call chain are obtained, including: obtaining all the above-mentioned functions on the above-mentioned call chain and function parameter information corresponding to the above-mentioned functions; at least based on the above-mentioned functions, determine whether there is suspicious behavior, including: based on the above-mentioned functions and the above-mentioned function parameter information, determine whether there is the above-mentioned suspicious behavior.

[0067] Optionally, determining whether there is suspicious behavior at least based on the above function includes: using a blacklist mechanism to determine whether there is the above suspicious behavior at least based on the above function.

[0068] Optionally, obtaining all of the above-mentioned functions on the above-mentioned call chain and function parameter information corresponding to the above-mentioned functions includes: obtaining all of the above-mentioned functions on the above-mentioned call chain, and obtaining function parameters corresponding to the above-mentioned functions; parsing the above-mentioned function parameters to obtain the above-mentioned function parameter information, and the above-mentioned function parameter information is information characterizing the data type, size and content of the above-mentioned function parameters.

[0069] Optionally, determining whether the above-mentioned suspicious behavior exists based on the above-mentioned function and the above-mentioned function parameter information includes: when it is detected that the above-mentioned function parameter information includes sensitive data, or the above-mentioned function is a sensitive function, determining that the above-mentioned suspicious behavior exists, and the above-mentioned sensitive function is a function that characterizes access to the above-mentioned sensitive data or causes leakage of the above-mentioned sensitive data.

[0070] Optionally, intercepting and replacing the suspicious behavior includes: intercepting and replacing the suspicious behavior using intrusion prevention means, wherein the intrusion prevention means includes encrypting the sensitive data and / or transmitting the sensitive data through a secure channel.

[0071] Optionally, in the case where the above-mentioned suspicious behavior exists, an alarm signal is issued, and the above-mentioned alarm signal is a signal indicating that the above-mentioned suspicious behavior exists in the above-mentioned target program.

[0072] The present application also provides a computer program product, including computer instructions, which, when executed by a processor, implement at least the following method steps: step S201, before the target program is started, start the interceptor, and use the Hook technology to intercept the function call in the target program, and obtain the corresponding call information; step S202, during the operation of the target program, monitor the call chain intercepted by the Hook technology according to the call information, and at least obtain all the functions on the call chain; step S203, at least based on the function, determine whether there is suspicious behavior, the suspicious behavior includes at least one of the following: behavior that indicates data leakage, behavior that indicates data security violation, and behavior that indicates privacy protection violation; step S204, in the case of the existence of the suspicious behavior, intercept and replace the suspicious behavior.

[0073] Optionally, at least all functions on the above-mentioned call chain are obtained, including: obtaining all the above-mentioned functions on the above-mentioned call chain and function parameter information corresponding to the above-mentioned functions; at least based on the above-mentioned functions, determine whether there is suspicious behavior, including: based on the above-mentioned functions and the above-mentioned function parameter information, determine whether there is the above-mentioned suspicious behavior.

[0074] Optionally, determining whether there is suspicious behavior at least based on the above function includes: using a blacklist mechanism to determine whether there is the above suspicious behavior at least based on the above function.

[0075] Optionally, obtaining all of the above-mentioned functions on the above-mentioned call chain and function parameter information corresponding to the above-mentioned functions includes: obtaining all of the above-mentioned functions on the above-mentioned call chain, and obtaining function parameters corresponding to the above-mentioned functions; parsing the above-mentioned function parameters to obtain the above-mentioned function parameter information, and the above-mentioned function parameter information is information characterizing the data type, size and content of the above-mentioned function parameters.

[0076] Optionally, determining whether the above-mentioned suspicious behavior exists based on the above-mentioned function and the above-mentioned function parameter information includes: when it is detected that the above-mentioned function parameter information includes sensitive data, or the above-mentioned function is a sensitive function, determining that the above-mentioned suspicious behavior exists, and the above-mentioned sensitive function is a function that characterizes access to the above-mentioned sensitive data or causes leakage of the above-mentioned sensitive data.

[0077] Optionally, intercepting and replacing the suspicious behavior includes: intercepting and replacing the suspicious behavior using intrusion prevention means, wherein the intrusion prevention means includes encrypting the sensitive data and / or transmitting the sensitive data through a secure channel.

[0078] Optionally, in the case where the above-mentioned suspicious behavior exists, an alarm signal is issued, and the above-mentioned alarm signal is a signal indicating that the above-mentioned suspicious behavior exists in the above-mentioned target program.

[0079] An embodiment of the present application also provides an electronic device, comprising: one or more processors, a memory, and one or more programs, wherein the one or more programs are stored in the memory and are configured to be executed by the one or more processors, and the one or more programs include a method for executing any one of the above-mentioned data leakage prevention methods.

[0080] Obviously, those skilled in the art should understand that the above modules or steps of the present invention can be implemented by a general computing device, they can be concentrated on a single computing device, or distributed on a network composed of multiple computing devices, they can be implemented by a program code executable by a computing device, so that they can be stored in a storage device and executed by the computing device, and in some cases, the steps shown or described can be executed in a different order than here, or they can be made into individual integrated circuit modules, or multiple modules or steps therein can be made into a single integrated circuit module for implementation. Thus, the present invention is not limited to any specific combination of hardware and software.

[0081] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented in one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that include computer-usable program code.

[0082] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0083] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0084] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process in the computer or other programmable device. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0085] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0086] The memory may include non-permanent memory in a computer-readable medium, random access memory (RAM) and / or non-volatile memory in the form of read-only memory (ROM) or flash RAM. The memory is an example of a computer-readable medium.

[0087] Computer readable media include permanent and non-permanent, removable and non-removable media that can be implemented by any method or technology to store information. Information can be computer readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disk read-only memory (CD-ROM), digital versatile disk (DVD) or other optical storage, magnetic cassettes, magnetic disk storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device. As defined herein, computer readable media does not include temporary computer readable media (transitory media), such as modulated data signals and carrier waves.

[0088] It should also be noted that the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, commodity or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, commodity or device. In the absence of more restrictions, the elements defined by the sentence "comprises a ..." do not exclude the existence of other identical elements in the process, method, commodity or device including the elements.

[0089] From the above description, it can be seen that the above embodiments of the present application achieve the following technical effects:

[0090] In the data leakage prevention method of the present application, first before the target program is started, the interceptor is started, and the Hook technology is used to intercept the function call of the target program and obtain the corresponding call information, then during the operation of the target program, according to the call information, the call chain intercepted by the Hook technology is monitored, and at least all the functions on the call chain are obtained, and then at least according to the function, it is determined whether there is suspicious behavior, and finally in the case of suspicious behavior, the suspicious behavior is intercepted and replaced. Compared with the data leakage prevention technology in the prior art that relies on a single access control and conventional storage encryption, and has many problems in systematization, generalization and insensitivity, the present application monitors and intercepts the client application (target program) through the Hook technology, automatically detects, intercepts and replaces during the operation of the target program, monitors the call chain intercepted by the Hook technology and the functions on the call chain, and intercepts and replaces suspicious behaviors to ensure the security and privacy of the data, has universality, can be applied to various different applications, and ensures high efficiency and reliability in data leakage prevention and privacy protection.

[0091] The above description is only the preferred embodiment of the present application and is not intended to limit the present application. For those skilled in the art, the present application may have various modifications and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application shall be included in the protection scope of the present application.

Claims

1. A data leakage prevention method, characterized in that: include: Before the target program is started, the interceptor is started, and the Hook technology is used to intercept the function call in the target program and obtain the corresponding call information; During the running of the target program, according to the call information, the call chain intercepted by the Hook technology is monitored, and at least all functions on the call chain are obtained; At least according to the function, determining whether there is suspicious behavior, wherein the suspicious behavior includes at least one of the following: behavior that indicates a data leak, behavior that indicates a data security violation, and behavior that indicates a privacy protection violation; In the event that the suspicious behavior exists, intercept and replace the suspicious behavior.

2. The data leakage prevention method according to claim 1, characterized in that: At least obtaining all functions on the call chain, including: obtaining all the functions on the call chain and function parameter information corresponding to the functions; At least according to the function, determining whether there is suspicious behavior includes: determining whether there is the suspicious behavior according to the function and the function parameter information.

3. The data leakage prevention method according to claim 1, characterized in that: Determining whether suspicious behavior exists based on at least the function includes: Using a blacklist mechanism, it is determined whether the suspicious behavior exists at least according to the function.

4. The data leakage prevention method according to claim 2, characterized in that: Obtaining all the functions on the call chain and function parameter information corresponding to the functions, including: Obtain all the functions on the call chain, and obtain function parameters corresponding to the functions; The function parameters are parsed to obtain the function parameter information, where the function parameter information is information representing the data type, size, and content of the function parameters.

5. The data leakage prevention method according to claim 2, characterized in that: Determining whether the suspicious behavior exists according to the function and the function parameter information includes: When it is detected that the function parameter information includes sensitive data, or the function is a sensitive function, it is determined that the suspicious behavior exists, and the sensitive function is a function that characterizes access to the sensitive data or causes leakage of the sensitive data.

6. The data leakage prevention method according to claim 5, characterized in that: Intercept and replace the suspicious behavior, including: The suspicious behavior is intercepted and replaced by intrusion prevention means, wherein the intrusion prevention means includes encrypting the sensitive data and / or transmitting the sensitive data through a secure channel.

7. The data leakage prevention method according to claim 1, characterized in that: The method further comprises: In the case where the suspicious behavior exists, an alarm signal is issued, wherein the alarm signal is a signal indicating that the target program has the suspicious behavior.

8. A computer-readable storage medium, characterized in that: The computer-readable storage medium includes a stored program, wherein when the program is executed, the device where the computer-readable storage medium is located is controlled to execute the data leakage prevention method according to any one of claims 1 to 7.

9. A computer program product comprising computer instructions, characterized in that When the computer instructions are executed by a processor, the data leakage prevention method described in any one of claims 1 to 7 is implemented.

10. An electronic device, characterized in that: include: One or more processors, a memory, and one or more programs, wherein the one or more programs are stored in the memory and are configured to be executed by the one or more processors, and the one or more programs include a method for executing the data leakage prevention method described in any one of claims 1 to 7.

Images