Full-link data tracing method and device and electronic equipment

Abstract

The invention discloses a full-link data traceability method and device and electronic equipment, relates to the technical field of data processing, and is used for improving the data traceability speed and accuracy. The method comprises the following steps: dividing acquired network traffic data into a first network traffic data segment and a second network traffic data segment; then, respectively extracting feature data of a first window in the first network traffic data segment and feature data of a second window in the second network traffic data segment; further, constructing a network link record based on each piece of feature data in the first window and the second window, and storing the network link record in a data traceability database; and finally, based on the data traceability database, performing data traceability on the sensitive data to be traced to obtain a data traceability result. Through the method, detection of the link request repetition times based on the rolling time window by using the plurality of bloom filters is realized, and the method has the advantages of high matching speed and small storage space.

Description

Technical Field

[0001] The present application relates to the field of data processing technology, and in particular to a full-link data tracing method, device and electronic device. Background Art

[0002] With the rapid development of information technology, data has become one of the most important assets of enterprises and organizations. However, security issues such as data leakage and illegal access have followed. In these cases, it is crucial to trace the data efficiently and accurately.

[0003] In the related art, the access time, operation statement characteristics, accessed data content and other information of network traffic, log data, etc. are usually used for link association. However, in the microservice architecture, a service request may span multiple application layer network protocols. For example, user A accesses the web application through the HyperText Transfer Protocol (HTTP), and the web application accesses the MySQL database at the back end through the MySQL protocol. Protocols in the same protocol can be associated through the TCP layer request-response mechanism, while different application layer protocols cannot be associated through the TCP layer. Therefore, if the link association is performed by time sequence and data content relevance, the accuracy of data matching and tracing is low in cross-protocol and high-concurrency scenarios. Summary of the invention

[0004] The embodiments of the present application provide a full-link data tracing method, device and electronic device to implement data tracing and matching in high-concurrency and high-traffic scenarios, thereby improving the accuracy of data tracing and the matching speed.

[0005] In a first aspect, an embodiment of the present application provides a full-link data tracing method, the method comprising:

[0006] Dividing the acquired network traffic data into a first network traffic data segment and a second network traffic data segment; wherein the first network traffic data segment and the second network traffic data segment each have target identification information;

[0007] Extracting characteristic data of a first window in a first network traffic data segment and a second window in a second network traffic data segment respectively; wherein the characteristic data is used to characterize the operation behavior of the network traffic data segment;

[0008] Based on each characteristic data in the first window and the second window, a network link record is constructed, and the network link record is saved in the data traceability database; wherein the network link record represents the flow direction of the target network traffic data in the network node

[0009] Based on the data traceability database, data traceability is performed on the sensitive data to be traced to obtain data traceability results.

[0010] Through the above method, multiple Bloom filters are used to detect the number of duplicate network link records, with high tracing accuracy and fast matching speed, avoiding the problem of low matching accuracy in high-concurrency scenarios of traditional traffic fitting.

[0011] In an optional implementation, based on each feature data in the first window and the second window, a network link record is constructed, and the network link record is saved in a data tracing database, including:

[0012] According to the M feature data corresponding to the first window and the K feature data corresponding to the second window, cross-generate network link record identifiers in pairs;

[0013] According to the feature similarity and / or time correlation of each network link record identifier, the network link record is obtained and saved in the data tracing database.

[0014] Through the above method, hash operation is performed on the network link record identifier, and the number of occurrences of the network link record can be saved in each Bloom filter in sequence, thereby realizing the preservation of the network link record and facilitating data tracing.

[0015] In an optional implementation, based on the data tracing database, data tracing is performed on the sensitive data to be traced to obtain data tracing results, including:

[0016] According to the network link record identifier corresponding to the network traffic data to be traced, determine whether the number of occurrences of the network link record identifier is recorded by the target Bloom filter; wherein the target Bloom filter is determined according to the network link record matching probability;

[0017] If so, obtain the tracing result corresponding to the network traffic data to be traced, and output the network link record corresponding to the network traffic data to be traced;

[0018] If not, start from the first Bloom filter in turn to determine whether the number of occurrences of the network link record identifier is recorded, until the sum of the number of occurrences of the network traffic data to be traced in each Bloom filter is greater than the preset threshold, and output the network link record corresponding to the network traffic data to be traced.

[0019] Through the above method, according to the network link record matching probability, the network link record can be directly searched from the Bloom filter at the corresponding position, and when the network link record is not found, the network link record can be saved.

[0020] In an optional implementation, after obtaining the tracing result corresponding to the network traffic data to be traced, the method further includes:

[0021] Extract sensitive data from the network traffic data to be traced and obtain the amount of sensitive data;

[0022] Based on the amount of sensitive data and the number of different sensitive data items, an updated network link record matching probability is obtained.

[0023] Through the above method, network link records are matched according to sensitive data, and the network link record matching probability is updated, which further improves the accuracy of data tracing.

[0024] In an optional implementation, before extracting sensitive data from the network traffic data to be traced and obtaining the amount of sensitive data, the method further includes:

[0025] Establishing multiple Bloom filters respectively; wherein the multiple Bloom filters are used to manage different categories of sensitive data respectively;

[0026] Multiple Bloom filters are used to record the data identifiers corresponding to different sensitive data.

[0027] Through the above method, different Bloom filters are established to save different types of sensitive data.

[0028] In a second aspect, the present application provides a full-link data tracing device, the device comprising:

[0029] The processing module divides the acquired network traffic data into a first network traffic data segment and a second network traffic data segment; wherein the first network traffic data segment and the second network traffic data segment each have target identification information;

[0030] An extraction module is used to extract characteristic data of a first window in a first network flow data segment and a second window in a second network flow data segment respectively; wherein the characteristic data is used to characterize the operation behavior of the network flow data segment;

[0031] A construction module, used to construct a network link record based on each feature data in the first window and the second window, and save the network link record to a data tracing database, wherein the network link record represents the flow direction of the target network traffic data in the network node;

[0032] The traceability module is used to trace the sensitive data to be traced based on the data traceability database to obtain the data traceability results.

[0033] In an optional implementation, when a network link record is constructed based on each feature data in the first window and the second window, and the network link record is saved in the data tracing database, the construction module is specifically used to:

[0034] According to the M feature data corresponding to the first window and the K feature data corresponding to the second window, cross-generate network link record identifiers in pairs;

[0035] According to the feature similarity and / or time correlation of each network link record identifier, the network link record is obtained and saved in the data tracing database.

[0036] In an optional implementation, when tracing the sensitive data to be traced based on the data traceability database to obtain the data traceability result, the traceability module is specifically used to:

[0037] According to the network link record identifier corresponding to the network traffic data to be traced, determine whether the number of occurrences of the network link record identifier is recorded by the target Bloom filter; wherein the target Bloom filter is determined according to the network link record matching probability;

[0038] If so, obtain the tracing result corresponding to the network traffic data to be traced, and output the network link record corresponding to the network traffic data to be traced;

[0039] If not, start from the first Bloom filter in turn to determine whether the number of occurrences of the network link record identifier is recorded, until the sum of the number of occurrences of the network traffic data to be traced in each Bloom filter is greater than the preset threshold, and output the network link record corresponding to the network traffic data to be traced.

[0040] In an optional implementation, after obtaining the tracing result corresponding to the network traffic data to be traced, the tracing module is further used to:

[0041] Extract sensitive data from the network traffic data to be traced and obtain the amount of sensitive data;

[0042] Based on the amount of sensitive data and the number of different sensitive data items, an updated network link record matching probability is obtained.

[0043] In an optional implementation, before extracting sensitive data from the network traffic data to be traced and obtaining the amount of sensitive data, the construction module is further used to:

[0044] Establishing multiple Bloom filters respectively; wherein the multiple Bloom filters are used to manage different categories of sensitive data respectively;

[0045] Multiple Bloom filters are used to record the data identifiers corresponding to different sensitive data.

[0046] In a third aspect, the present application provides an electronic device comprising a processor and a memory, wherein the memory stores program code, and when the program code is executed by the processor, the processor executes the steps of the full-link data traceability method described in the first aspect above.

[0047] In a fourth aspect, the present application provides a computer-readable storage medium comprising a program code. When the program code is run on an electronic device, the program code is used to enable the electronic device to execute the steps of the full-link data traceability method described in the first aspect above.

[0048] In the fifth aspect, the present application provides a computer program product, which, when called by a computer, enables the computer to execute the steps of the full-link data traceability method as described in the first aspect.

[0049] In addition, other features and advantages of the present application will be described in the subsequent description, and partly become apparent from the description, or be understood by practicing the present application. The purpose and other advantages of the present application can be realized and obtained by the structures particularly pointed out in the written description, claims, and drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0050] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for describing the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative labor. In the drawings:

[0051] Figure 1 A schematic diagram of an application scenario provided for an embodiment of the present application;

[0052] Figure 2 A schematic diagram of an implementation flow of a full-link data tracing method provided in an embodiment of the present application;

[0053] Figure 3 A schematic diagram of the structure of a full-link data tracing device provided in an embodiment of the present application;

[0054] Figure 4 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0055] In order to make the purpose, technical solution and advantages of the embodiments of the present application clearer, the technical solution of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the technical solution of the present application, rather than all of the embodiments. Based on the embodiments recorded in the application documents, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the technical solution of the present application.

[0056] It should be noted that in the description of this application, "multiple" is understood as "at least two". "And / or" describes the association relationship of associated objects, indicating that three relationships may exist. For example, A and / or B can represent three situations: A exists alone, A and B exist at the same time, and B exists alone. A and B are connected, which can represent two situations: A and B are directly connected and A and B are connected through C. In addition, in the description of this application, words such as "first" and "second" are only used for the purpose of distinguishing descriptions, and cannot be understood as indicating or implying relative importance, nor can they be understood as indicating or implying order.

[0057] In addition, the collection, dissemination, and use of data in the technical solution of this application comply with the requirements of relevant national laws and regulations.

[0058] The following is a brief introduction to the design concept of the embodiment of the present application:

[0059] With the rapid development of information technology, data has become one of the most important assets of enterprises and organizations. However, security issues such as data leakage and illegal access have followed. In these cases, it is crucial to trace the data efficiently and accurately.

[0060] In the related art, the access time, operation statement characteristics, accessed data content and other information of network traffic, log data, etc. are usually used for link association. However, in the microservice architecture, a service request may span multiple application layer network protocols. For example, user A accesses the web application through the HyperText Transfer Protocol (HTTP), and the web application accesses the MySQL database at the back end through the MySQL protocol. Protocols in the same protocol can be associated through the TCP layer request-response mechanism, while different application layer protocols cannot be associated through the TCP layer. Therefore, if the link association is performed by time sequence and data content relevance, the accuracy of data matching and tracing is low in cross-protocol and high-concurrency scenarios.

[0061] In view of this, in order to realize data tracing in high concurrency and large traffic scenarios, the present application provides a full-link data tracing method, which includes: first, using a rolling time window mechanism to divide the network traffic data into a first network traffic data segment and a second network traffic data segment; then, extracting each feature data in the first network traffic data segment and the second network traffic data segment respectively; further, based on each feature data in the first network traffic data segment and the second network traffic data segment, constructing a network link record, and saving the network link to the corresponding Bloom filter; finally, tracing the data based on the preset Bloom filter to obtain the data tracing result. Through the above method, multiple Bloom filters are used to realize link request repetition detection and link matching based on a rolling time window, and the Bloom filter has a small storage space and can adapt to a large traffic and high concurrency network environment.

[0062] The following describes the full-link data tracing method provided by the exemplary embodiment of the present application with reference to the accompanying drawings.

[0063] See also Figure 1 , which is a schematic diagram of a possible application scenario in an embodiment of the present application. The application scenario diagram includes a server 11 and a terminal device 12 (including a terminal device 121, a terminal device 122 ... a terminal device 12n).

[0064] The server 11 may be an independent physical server, or a server cluster or distributed system composed of multiple physical servers, or a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, content delivery networks (CDN), and big data and artificial intelligence platforms. The terminal device 12 may be directly or indirectly connected to the server 11 via wired or wireless communication, which is not limited in this application.

[0065] The terminal device 120 includes but is not limited to mobile phones, tablet computers, laptop computers, desktop computers, electronic reading books, intelligent voice interaction devices, smart home appliances, car terminals and other devices; various software can be installed on the terminal device, such as applications and applets.

[0066] It should be noted that Figure 1 The figure is only an example. In fact, the number of terminal devices 12 and servers 11 is not limited and is not specifically limited in the embodiments of the present application.

[0067] See also Figure 1 As shown, it is a schematic diagram of an implementation process of a full-link data tracing method provided in an embodiment of the present application. The specific implementation process of the method is as follows:

[0068] S1: Divide the acquired network traffic data into a first network traffic data segment and a second network traffic data segment.

[0069] In the embodiment of the present application, the server can monitor the network flow data in real time using a network flow data monitoring tool, such as NetFlow, etc. The network flow monitoring tool can be deployed at key nodes such as routers and switches to obtain network flow data flowing through these devices.

[0070] Furthermore, the acquired network traffic data may include network traffic data flowing through both sides of the server, that is, uplink data sent from the client to the server, and downlink data sent from the server to the client.

[0071] Furthermore, in order to prevent the impact of request-response across time windows, a rolling time window mechanism can be used to obtain network traffic data, and the obtained network traffic data can be divided into a first network traffic data segment and a second network traffic data segment. Specifically, the overlap between windows can be controlled by a preset rolling step size to ensure data continuity and consistency, while reducing data loss or duplication caused by time window division.

[0072] Exemplarily, the first time period [T, T+△T] is used to obtain the first network traffic data segment, and the second time period [T+△S, T+△T+△S] is used to obtain the second network traffic data segment. Wherein, △S is the time offset between time windows. In addition, if a request time in the first time period is greater than T+β△T, the request and the request greater than T+β△T+△S in the second time period can be divided into the next time window to prevent two consecutive requests from crossing windows and not matching. Wherein, β is a preset threshold value, and β can be set in the range of 0-1 according to the actual application scenario.

[0073] It should be noted that each of the divided network traffic data segments has target identification information, which can be a universally unique identifier (UUID). The target identification information can allow all network traffic data segments to have unique identification information. Of course, the target identification information can also be other identifiers that can enable the network traffic data segments to have unique identification information.

[0074] Through the rolling time window mechanism, the acquired network traffic data is divided into two network traffic data segments that are connected end to end and have no overlap, so as to facilitate subsequent link association matching.

[0075] S2: Extracting characteristic data of the first window in the first network traffic data segment and the second window in the second network traffic data segment respectively.

[0076] In an embodiment of the present application, the server may extract various feature data of the first window in the first network traffic data segment and the second window in the second network traffic data segment.

[0077] It should be noted that the characteristic data can be used to identify the operational behavior of the network traffic data segment.

[0078] Specifically, when extracting feature data from the first network traffic data segment and the second network traffic data segment, it is also necessary to determine the data request type corresponding to the network traffic data segment, such as web request, database request, etc. For web requests, HTTP / HTTPS protocol data packets are usually used, so HTTP usually includes a Uniform Resource Locator (URL), a request method, a request header, and a request body. For database requests, the corresponding Structured Query Language (SQL) can be obtained.

[0079] When extracting feature data, the protocol used by the network traffic data can be parsed to identify the feature data in the request, such as the URL corresponding to the http request, the SQL statement and parameters in the mysql protocol, etc.

[0080] Therefore, different characteristic data can be obtained for different types of data requests, such as the URL of a web request, the SQL statement of a database request, etc.

[0081] S3: Based on each feature data in the first window and the second window, a network link record is constructed, and the network link record is saved in a data tracing database.

[0082] In the embodiment of the present application, when extracting the characteristic data corresponding to the first window and the second window, it is also necessary to establish a network link record. The network link record represents the flow direction of the target network traffic data in the network node, such as node A sending data to node B, and node B sending data to node C.

[0083] In an optional implementation, the first window corresponds to M feature data and the second window corresponds to K feature data. Therefore, the M feature data corresponding to the first window and the K feature data corresponding to the second window can be cross-linked to generate network link record identifiers, that is, MxK network link record identifiers can be obtained. In other words, each feature data in the first window will generate a network link record identifier together with each feature data in the second window. Exemplarily, when cross-linking the network link record identifiers in pairs, the feature data A and the feature data B can be spliced, for example, the network link record identifier is A+B. The network link record identifier corresponds one-to-one to the network link record.

[0084] Then, the network link record is obtained according to the feature similarity and / or time correlation of each network link record. Specifically, for example, a piece of data in the first window is close in time to a piece of data in the second window. For example, the time when node A in the first window sends data A to node B is 9:20:06, and the time when node B in the second window sends data B to node C is 9:20:07, which means that data A and data B have a high correlation, and the link relationship of node A, node B, and node C is obtained, and the corresponding network link record is saved in the data traceability database.

[0085] Furthermore, the Bloom filter maps the elements into a bit array through multiple preset hash functions, by mapping the elements to multiple different index positions and setting the values ​​at these index positions to 1. If the values ​​at the corresponding multiple index positions are all 1 during the query, the element is considered to exist in the set.

[0086] Therefore, for the Nth Bloom filter: using multiple preset hash functions corresponding to the Nth Bloom filter, hash operations are performed on each network link record identifier, and multiple hash operation results corresponding to each network link record identifier can be obtained. Further, based on the multiple hash operation results obtained, that is, the hash operation result corresponding to the network link record identifier, the position corresponding to the Nth Bloom filter is recorded as 1.

[0087] It should be noted that if the network link record identifier A+B appears for the first time, the network link record identifier A+B is hashed by multiple hash functions corresponding to the first Bloom filter, and the values ​​of the corresponding multiple index positions in the first Bloom filter are set to 1 according to the multiple hash operation results. If the network link record identifier A+B does not appear for the first time, after the network link record identifier A+B is hashed by multiple hash functions corresponding to the first Bloom filter, it can be determined that the value of the corresponding index position in the first Bloom filter has been set to 1, indicating that the network link record identifier A+B has been recorded in the first Bloom filter. Further, the network link record identifier A+B is hashed by multiple hash functions corresponding to the second Bloom filter, and it is determined whether the network link record identifier A+B has been saved in the second Bloom filter. If not, the network link record identifier is saved to the second Bloom filter. If so, the third Bloom filter is used for judgment by analogy.

[0088] Through the above method, relevant network link records are saved through multiple Bloom filters, which can realize judgment based on the repetition number threshold and achieve fast matching speed.

[0089] S4: Based on the data traceability database, perform data traceability on the sensitive data to be traced and obtain the data traceability results.

[0090] In the embodiment of the present application, when tracing the network traffic data to be traced, the network link record identifier corresponding to the network traffic data to be traced is first obtained, and then the target Bloom filter is determined according to the network link record matching probability.

[0091] For example, if the preset network link record matching probability is 50%, and there are 10 Bloom filters that store network link records, then the target Bloom filter is determined to be the fifth Bloom filter based on the network link record matching probability and the number of Bloom filters. Furthermore, multiple hash functions corresponding to the fifth Bloom filter are used to perform hash operations on the network link record identifiers corresponding to the network traffic data to be traced, and determine whether the network traffic data to be traced is stored in the fifth Bloom filter. If the network link record identifier corresponding to the network traffic data to be traced is stored in the fifth Bloom filter, the traceability is successful and the network link record corresponding to the network traffic data to be traced is output. When the network link corresponding to the network traffic data to be traced is matched, the link relationship of each network node in the network data to be traced and the target identification information are recorded and uploaded to the data traceability database.

[0092] If the tracing result corresponding to the network traffic data to be traced is not found in the fifth Bloom filter, the tracing result corresponding to the network traffic data to be traced is searched from the first Bloom filter. Specifically, the method of searching for the tracing result corresponding to the network traffic data to be traced in the first Bloom filter is the same as the method of searching for the tracing result corresponding to the network traffic data to be traced from the target Bloom filter. If there is no tracing result in the first Bloom filter, the network link record identifier corresponding to the network traffic data to be traced is hashed by the multiple preset hash functions corresponding to the first Bloom filter, and the value of the corresponding index position of the first Bloom filter is set to 1; if there is a tracing result corresponding to the network traffic data to be traced in the first Bloom filter, the corresponding search is further performed from the second Bloom filter. Similarly, if there is no tracing result in the second Bloom filter, the network link record identifier corresponding to the network traffic data to be traced is hashed by the multiple preset hash functions corresponding to the second Bloom filter, and the value of the corresponding index position of the second Bloom filter is set to 1. If there is a tracing result in the second Bloom filter, the search is performed through the third Bloom filter. Until the sum of the number of times the network traffic data to be traced appears in each Bloom filter is greater than the preset threshold. For example, if the network traffic data to be traced appears in the first Bloom filter to the fifth Bloom filter respectively, the corresponding tracing result is output.

[0093] Furthermore, in an optional implementation, a plurality of Bloom filters are usually separately provided to store sensitive data, so as to further improve the accuracy of data tracing by comparing sensitive data.

[0094] It should be noted that multiple Bloom filters can be established, and each of the multiple Bloom filters is used to store sensitive data of different categories; then, when saving sensitive data, the corresponding data type is determined according to the data identifiers corresponding to different sensitive data, and then the different sensitive data are saved in the corresponding Bloom filters. Through different Bloom filters, classification management of different types of sensitive data can be achieved.

[0095] Specifically, the collected sensitive data is first stored in a preset Bloom filter. When matching the sensitive data, the sensitive data is extracted from the network traffic data to be traced to obtain the number of sensitive data. Then, based on the number of sensitive data and the number of different sensitive data items, the updated network link matching probability is obtained.

[0096] For example, a sensitive data item is "ID number", the counted number of "ID number" is 50, and the other sensitive data items can be "name", "age", etc., and the number of different sensitive data items can be obtained. The updated network link matching probability is 50%*number of sensitive data / number of different sensitive data items + 50%.

[0097] Furthermore, the value of each sensitive data at the index position corresponding to the preset Bloom filter is calculated through a preset hash function and saved.

[0098] By screening and saving sensitive data, the accuracy of data tracing can be further improved when tracing the source.

[0099] For example, when tracing data, assume that there are M different feature data from node A to node B, and N different feature data from node B to node C in the first time window. The M feature data and the N feature data are crossed in pairs to generate MxN records, which are recorded as (Key A->B ,Key B->C )∈Smxn. Where S represents a string.

[0100] Then, for the collection (Key A->B ,Key B->C ) for each record in the , string concatenation is performed. Further, the Nth Bloom filter is used to operate to determine whether the string Key exists in the Nth Bloom filter. If so, (Key A->B ,Key B->C ) is recorded as the link relationship from node A to node B to node C. If it does not exist, an operation is performed in the first Bloom filter to determine whether the string Key exists. If it does not exist, the hash function corresponding to the first Bloom filter is used to calculate the index position corresponding to the string Key, and the corresponding position in the first Bloom filter is written to 1. This process is repeated until the N-1th Bloom filter.

[0101] Further, based on the same technical concept, the embodiment of the present application provides a full-link data tracing device, which is used to implement the above method flow of the embodiment of the present application. Figure 3 As shown, the device includes: a processing module 301, an extraction module 302, a construction module 303, and a tracing module 304, wherein:

[0102] The processing module 301 is used to divide the acquired network traffic data into a first network traffic data segment and a second network traffic data segment; wherein the first network traffic data segment and the second network traffic data segment each have target identification information;

[0103] An extraction module 302 is used to extract each characteristic data of the first window in the first network traffic data segment and the second window in the second network traffic data segment respectively; wherein the characteristic data is used to characterize the operation behavior of the network traffic data segment;

[0104] A construction module 303 is used to construct a network link record based on each feature data in the first window and the second window, and save the network link record to a data tracing database, wherein the network link record represents the flow direction of the target network traffic data in the network node;

[0105] The tracing module 304 is used to perform data tracing on the sensitive data to be traced based on the data tracing database to obtain data tracing results.

[0106] In an optional implementation, when constructing a network link record based on each feature data in the first window and the second window, and saving the network link record to the data tracing database, the construction module 303 is specifically used to:

[0107] According to the M feature data corresponding to the first window and the K feature data corresponding to the second window, cross-generate network link record identifiers in pairs;

[0108] According to the feature similarity and / or time correlation of each network link record identifier, the network link record is obtained and saved in the data tracing database.

[0109] In an optional implementation, when tracing the sensitive data to be traced based on the data traceability database to obtain the data traceability result, the traceability module 304 is specifically used to:

[0110] According to the network link record identifier corresponding to the network traffic data to be traced, determine whether the number of occurrences of the network link record identifier is recorded by the target Bloom filter; wherein the target Bloom filter is determined according to the network link record matching probability;

[0111] If so, obtain the tracing result corresponding to the network traffic data to be traced, and output the network link record corresponding to the network traffic data to be traced;

[0112] If not, start from the first Bloom filter in turn to determine whether the number of occurrences of the network link record identifier is recorded, until the sum of the number of occurrences of the network traffic data to be traced in each Bloom filter is greater than the preset threshold, and output the network link record corresponding to the network traffic data to be traced.

[0113] In an optional implementation, after obtaining the tracing result corresponding to the network traffic data to be traced, the tracing module 304 is further used to:

[0114] Extract sensitive data from the network traffic data to be traced and obtain the amount of sensitive data;

[0115] Based on the amount of sensitive data and the number of different sensitive data items, an updated network link record matching probability is obtained.

[0116] In an optional implementation, before extracting sensitive data from the network traffic data to be traced and obtaining the amount of sensitive data, the construction module 303 is further used to:

[0117] Establishing multiple Bloom filters respectively; wherein the multiple Bloom filters are used to manage different categories of sensitive data respectively;

[0118] Multiple Bloom filters are used to record the data identifiers corresponding to different sensitive data.

[0119] Based on the same technical concept, the embodiment of the present application also provides an electronic device, which can implement the full-link data tracing method process provided in the above embodiment of the present application. In one embodiment, the electronic device can be a server, or a terminal device or other electronic device. Figure 4 As shown, the electronic device may include:

[0120] At least one processor 401, and a memory 402 connected to the at least one processor 401. The specific connection medium between the processor 401 and the memory 402 is not limited in the embodiment of the present application. Figure 4 In the example, the processor 401 and the memory 402 are connected via the bus 400. The bus 400 is Figure 4 The connection between other components is shown by bold lines, and is not intended to be limiting. The bus 400 can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Figure 4 Only one thick line is used in the figure, but it does not mean that there is only one bus or one type of bus. Alternatively, the processor 401 can also be called a controller, and there is no limitation on the name.

[0121] In the embodiment of the present application, the memory 402 stores instructions that can be executed by at least one processor 401. At least one processor 401 can execute a full-link data tracing method discussed above by executing the instructions stored in the memory 402. The processor 401 can implement Figure 4 The functions of each module in the device shown.

[0122] Among them, the processor 401 is the control center of the device, and can use various interfaces and lines to connect the various parts of the entire control device. By running or executing instructions stored in the memory 402 and calling the data stored in the memory 402, the various functions of the device and process data, the device can be monitored as a whole.

[0123] In one possible design, the processor 401 may include one or more processing units, and the processor 401 may integrate an application processor and a modem processor, wherein the application processor mainly processes an operating system, a user interface, and application programs, and the modem processor mainly processes wireless communications. It is understandable that the modem processor may not be integrated into the processor 401. In some embodiments, the processor 401 and the memory 402 may be implemented on the same chip, and in some embodiments, they may also be implemented separately on separate chips.

[0124] Processor 401 can be a general-purpose processor, such as a CPU, a digital signal processor, an application-specific integrated circuit, a field programmable gate array or other programmable logic device, a discrete gate or transistor logic device, a discrete hardware component, and can implement or execute the methods, steps and logic block diagrams disclosed in the embodiments of this application. A general-purpose processor can be a microprocessor or any conventional processor, etc. The steps of a full-link data tracing method disclosed in conjunction with the embodiments of this application can be directly embodied as a hardware processor execution, or can be executed by a combination of hardware and software modules in the processor.

[0125] The memory 402 is a non-volatile computer-readable storage medium that can be used to store non-volatile software programs, non-volatile computer executable programs and modules. The memory 502 may include at least one type of storage medium, such as a flash memory, a hard disk, a multimedia card, a card-type memory, a random access memory (Random Access Memory, RAM), a static random access memory (Static Random Access Memory, SRAM), a programmable read-only memory (Programmable Read Only Memory, PROM), a read-only memory (Read Only Memory, ROM), an electrically erasable programmable read-only memory (Electrically Erasable Programmable Read-Only Memory, EEPROM), a magnetic memory, a disk, an optical disk, etc. The memory 402 is any other medium that can be used to carry or store a desired program code in the form of an instruction or data structure and can be accessed by a computer, but is not limited thereto. The memory 402 in the embodiment of the present application can also be a circuit or any other device that can realize a storage function, for storing program instructions and / or data.

[0126] By programming the processor 401, the code corresponding to the frequency offset estimation method described in the above embodiment can be fixed into the chip, so that the chip can execute the code when running. Figure 2 The steps of a full-link data tracing method in the embodiment shown. How to design and program the processor 401 is a technology well known to those skilled in the art and will not be described in detail here.

[0127] Based on the same inventive concept, an embodiment of the present application also provides a storage medium, which stores computer instructions. When the computer instructions are executed on a computer, the computer executes a full-link data tracing method discussed above.

[0128] In some possible implementations, the present application also provides various aspects of a full-link data traceability method that can also be implemented in the form of a program product, which includes program code. When the program product is running on the device, the program code is used to enable the control device to execute the steps of a full-link data traceability method described above in this specification according to various exemplary implementations of the present application.

[0129] It should be noted that, although several units or subunits of the device are mentioned in the above detailed description, this division is merely exemplary and not mandatory. In fact, according to the embodiments of the present application, the features and functions of two or more units described above can be embodied in one unit. Conversely, the features and functions of one unit described above can be further divided into multiple units to be embodied.

[0130] In addition, although the operations of the method of the present application are described in a specific order in the drawings, this does not require or imply that the operations must be performed in this specific order, or that all the operations shown must be performed to achieve the desired results. Additionally or alternatively, some steps may be omitted, multiple steps may be combined into one step, and / or one step may be decomposed into multiple steps.

[0131] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented in one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that include computer-usable program code.

[0132] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a server, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the process in the flowchart. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0133] Program code for performing the operations of the present application may be written using any combination of one or more programming languages, including object-oriented programming languages ​​such as Java, C++, etc., and conventional procedural programming languages ​​such as "C" or similar programming languages. The program code may be executed entirely on the user computing device, partially on the user device, as a stand-alone software package, partially on the user computing device and partially on a remote computing device, or entirely on a remote computing device or server.

[0134] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0135] Obviously, those skilled in the art can make various changes and modifications to the present application without departing from the spirit and scope of the present application. Thus, if these modifications and variations of the present application fall within the scope of the claims of the present application and their equivalents, the present application is also intended to include these modifications and variations.

Claims

1. A full-link data tracing method, characterized in that: The method comprises: Dividing the acquired network traffic data into a first network traffic data segment and a second network traffic data segment; wherein the first network traffic data segment and the second network traffic data segment each have target identification information; Extracting the characteristic data of the first window in the first network traffic data segment and the second window in the second network traffic data segment respectively; wherein the characteristic data is used to characterize the operation behavior of the network traffic data segment; Based on each characteristic data in the first window and the second window, a network link record is constructed, and the network link record is saved in a data tracing database; Based on the data traceability database, data traceability is performed on the sensitive data to be traced to obtain data traceability results.

2. The method according to claim 1, characterized in that The step of constructing a network link record based on each feature data in the first window and the second window, and saving the network link record to a data tracing database includes: Generate network link record identifiers by cross-checking the M feature data corresponding to the first window and the K feature data corresponding to the second window; According to the feature similarity and / or time correlation of each of the network link record identifiers, the network link record is obtained and saved in the data tracing database.

3. The method according to claim 1, characterized in that Based on the data tracing database, tracing the sensitive data to be traced to obtain the data tracing result includes: According to the network link record identifier corresponding to the network traffic data to be traced, determine whether the number of occurrences of the network link record identifier is recorded by the target Bloom filter; wherein the target Bloom filter is determined according to the network link record matching probability; If so, obtain the tracing result corresponding to the network traffic data to be traced, and output the network link record corresponding to the network traffic data to be traced; If not, start from the first Bloom filter in turn to determine whether the number of occurrences of the network link record identifier is recorded, until the sum of the number of occurrences of the network traffic data to be traced in each Bloom filter is greater than the preset threshold, and output the network link record corresponding to the network traffic data to be traced.

4. The method according to claim 3, characterized in that After obtaining the tracing result corresponding to the network traffic data to be traced, the method further includes: Extracting sensitive data from the network traffic data to be traced to obtain the amount of sensitive data; Based on the quantity of the sensitive data and the quantity of different sensitive data items, an updated network link record matching probability is obtained.

5. The method according to claim 4, characterized in that Before extracting sensitive data from the network traffic data to be traced and obtaining the amount of sensitive data, the method further includes: Establishing a plurality of Bloom filters respectively; wherein the plurality of Bloom filters are used to manage different categories of sensitive data respectively; The multiple Bloom filters are used to record data identifiers corresponding to different sensitive data.

6. A full-link data tracing device, characterized in that: The device comprises: A processing module, used to divide the acquired network traffic data into a first network traffic data segment and a second network traffic data segment; wherein the first network traffic data segment and the second network traffic data segment each have target identification information; An extraction module, used to extract the characteristic data of the first window in the first network traffic data segment and the second window in the second network traffic data segment respectively; wherein the characteristic data is used to characterize the operation behavior of the network traffic data segment A construction module, used to construct a network link record based on each feature data in the first window and the second window, and save the network link record to a data tracing database; The traceability module is used to trace the sensitive data to be traced based on the data traceability database to obtain data traceability results.

7. The device according to claim 6, characterized in that When a network link record is constructed based on each feature data in the first window and the second window, and the network link record is saved in a data tracing database, the construction module is specifically used for: Generate network link record identifiers by cross-checking the M feature data corresponding to the first window and the K feature data corresponding to the second window; According to the feature similarity and / or time correlation of each of the network link record identifiers, the network link record is obtained and saved in the data tracing database.

8. The device according to claim 6, characterized in that When tracing the sensitive data to be traced based on the data traceability database to obtain the data traceability result, the traceability module is specifically used to: According to the network link record identifier corresponding to the network traffic data to be traced, determine whether the number of occurrences of the network link record identifier is recorded by the target Bloom filter; wherein the target Bloom filter is determined according to the network link record matching probability; If so, obtain the tracing result corresponding to the network traffic data to be traced, and output the network link record corresponding to the network traffic data to be traced; If not, start from the first Bloom filter in turn to determine whether the number of occurrences of the network link record identifier is recorded, until the sum of the number of occurrences of the network traffic data to be traced in each Bloom filter is greater than the preset threshold, and output the network link record corresponding to the network traffic data to be traced.

9. An electronic device comprising a memory, a processor and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the computer program, the method according to any one of claims 1 to 5 is implemented.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the method according to any one of claims 1 to 5 is implemented.

Images