Leakage event monitoring method and device, equipment and storage medium
By extracting and analyzing page data on the monitoring platform and calculating event similarity and matching, the problem of inaccurate monitoring in the prior art is solved and the accuracy of data breach incidents is improved.
Patent Information
- Application Number
- CN202411242477.0
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-09-05
- Publication Date
- 2025-01-07
AI Technical Summary
The prior art is prone to misreports and misreports when monitoring data leakage events, resulting in inaccurate monitoring.
By obtaining the page data of the monitored platform, extracting the events to be analyzed, and calculating their similarity to historical leaked events and the matching degree of preset keywords and user information, the cosine similarity algorithm and clustering algorithm are used to determine the nature of the event, and reducing the number of events The risk of misreport and false alarms.
It improves the accuracy of monitoring of data leakage incidents, effectively identifies historical leakage incidents, real leakage incidents and false leakage incidents, reduces missed and false alarms, and ensures the accuracy of monitoring.
Smart Images
Figure CN119271795A_ABST
Abstract
Description
Technical Field
[0001] The present application relates to the field of data security technology, and in particular to a leakage event monitoring method, device, equipment and storage medium. Background Art
[0002] With the development of the Internet, Internet security issues have become increasingly prominent. In recent years, data leakage incidents have brought serious security risks to individuals and enterprises.
[0003] At present, the known technology generally monitors the designated website in a hard-coded manner to implement the following process: extracting data from the website page, which includes the title and text content of the page. Further, matching the title and text content of the page with keywords to determine whether the corresponding page is involved in the data leakage incident of concern.
[0004] In the above process, there are defects that leakage events are easily misreported or missed, which is not conducive to accurately monitoring leakage events. Summary of the invention
[0005] The present application provides a leakage event monitoring method, device, equipment and storage medium to improve the accuracy of leakage event monitoring.
[0006] In a first aspect, the present application provides a leakage event monitoring method, the method comprising:
[0007] Obtain page data containing preset keywords on the monitored platform;
[0008] Extracting an event to be analyzed from the page data, and calculating the event similarity between the event to be analyzed and each historical leakage event; the event to be analyzed includes at least one preset keyword and a word feature corresponding to the preset keyword;
[0009] When it is determined according to the event similarity that the event to be analyzed is not the historical leakage event, calculating the matching degree between the word features corresponding to each of the preset keywords included in the event to be analyzed and the feature fields corresponding to the user information in the preset database;
[0010] According to the matching degree, it is determined whether the event to be analyzed is a real leakage event or a false leakage event.
[0011] In one possible design, the method further includes:
[0012] When there are multiple events to be analyzed, determine the events to be analyzed that belong to the same event according to any one of the preset algorithms, wherein the preset algorithms include a cosine similarity algorithm and a clustering algorithm;
[0013] For at least two events to be analyzed that belong to the same event, aggregate the event similarities between the at least two events to be analyzed and each historical leakage event to obtain an overall similarity;
[0014] If the overall similarity between the at least two events to be analyzed and any historical leakage event is greater than a first preset threshold, marking the at least two events to be analyzed as corresponding historical leakage events;
[0015] If the overall similarity between the at least two events to be analyzed and each of the historical leakage events is not greater than the first preset threshold, it is determined that the at least two events to be analyzed are not the historical leakage events.
[0016] In a possible design, the calculating the event similarity between the event to be analyzed and each historical leakage event includes:
[0017] Obtaining a first vector representation of the event to be analyzed and a second vector representation corresponding to each of the historical leakage events;
[0018] Cosine similarity calculation is performed on the first vector representation and each of the second vector representations to obtain event similarity between the event to be analyzed and the corresponding historical leakage event.
[0019] In a possible design, obtaining page data containing preset keywords in the monitored platform includes:
[0020] Acquiring dynamic configuration information, where the dynamic configuration information is used to indicate the monitored platform;
[0021] The page data of the monitored platform is obtained according to any one of the preset methods, wherein the preset method includes crawler technology.
[0022] In a possible design, extracting the event to be analyzed from the page data includes:
[0023] If the page data includes picture data, extracting the event to be analyzed from the picture data by using optical character recognition (OCR) technology;
[0024] If the page data includes file data, the file data is parsed to extract the event to be analyzed.
[0025] In one possible design, the method further includes:
[0026] The event to be analyzed and the marking information corresponding to the event to be analyzed are stored in a queue to be reviewed, and review reminder information is fed back to the user; the marking information is used to indicate that the event to be analyzed is one of the historical leakage event, the real leakage event, and the false leakage event.
[0027] In one possible design, the method further includes:
[0028] receiving the review result information fed back by the user, wherein the review result information is used to indicate whether the event to be analyzed is confirmed to be one of the historical leakage event, the real leakage event, and the false leakage event;
[0029] The historical leakage events are updated according to the review result information.
[0030] In a second aspect, the present application provides a leakage event monitoring device, comprising:
[0031] An acquisition module is used to acquire page data containing preset keywords in the monitored platform;
[0032] A calculation module, used to extract an event to be analyzed from the page data, and calculate the event similarity between the event to be analyzed and each historical leakage event; the event to be analyzed includes at least one preset keyword and a word feature corresponding to the preset keyword;
[0033] The calculation module is further configured to calculate the matching degree between the word features corresponding to each of the preset keywords included in the event to be analyzed and the feature fields corresponding to the user information in the preset database when it is determined that the event to be analyzed is not the historical leakage event according to the event similarity;
[0034] A determination module is used to determine whether the event to be analyzed is a real leakage event or a false leakage event according to the matching degree.
[0035] In a third aspect, an embodiment of the present application provides an electronic device, comprising: at least one processor and a memory; the memory stores computer-executable instructions; the at least one processor executes the computer-executable instructions stored in the memory, so that the at least one processor executes the method described in the first aspect and various possible designs of the first aspect.
[0036] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium, in which computer-executable instructions are stored. When a processor executes the computer-executable instructions, the method described in the first aspect and various possible designs of the first aspect are implemented.
[0037] In a fifth aspect, an embodiment of the present application provides a computer program product, including a computer program. When the computer program is executed by a processor, it implements the method described in the first aspect and various possible designs of the first aspect.
[0038] The disclosure event monitoring method, device, equipment and storage medium provided by the present application, in the present application, for the acquired page data of the monitored platform, firstly extract the event to be analyzed from the page data according to multiple preset keywords, and calculate the event similarity between the event to be analyzed and the recorded historical leakage events to determine whether the event to be analyzed is a historical leakage event. Further, when the event to be analyzed is not a historical leakage event, the word features of each preset keyword included in the event to be analyzed and the matching degree of the feature field corresponding to the user information in the preset database are calculated to determine whether the event to be analyzed is a real leakage event or a false leakage event. Through the method of the present application, for each monitored platform, when its page data contains preset keywords, the electronic device can analyze in turn whether the corresponding event to be analyzed is a historical leakage event, a real leakage event, or a false leakage event, that is, a more comprehensive analysis of the event to be analyzed is performed, thereby effectively reducing the underreporting and misreporting of leakage events, and improving the accuracy of monitoring leakage events. BRIEF DESCRIPTION OF THE DRAWINGS
[0039] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present application and, together with the description, serve to explain the principles of the present application.
[0040] Figure 1 This is an application scenario diagram of the leakage event monitoring method applicable to the embodiment of the present application;
[0041] Figure 2 Schematic diagram of the process of the leakage event monitoring method provided in the embodiment of the present application Figure 1 ;
[0042] Figure 3 Schematic diagram of the process of the leakage event monitoring method provided in the embodiment of the present application Figure 2 ;
[0043] Figure 4 Schematic diagram of the process of the leakage event monitoring method provided in the embodiment of the present application Figure 3 ;
[0044] Figure 5 A schematic diagram of a leakage event monitoring process provided by an embodiment of the present application;
[0045] Figure 6 A schematic diagram of the structure of a leakage event monitoring device provided in an embodiment of the present application;
[0046] Figure 7 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application.
[0047] The above drawings have shown clear embodiments of the present application, which will be described in more detail later. These drawings and text descriptions are not intended to limit the scope of the present application in any way, but to illustrate the concept of the present application to those skilled in the art by referring to specific embodiments. DETAILED DESCRIPTION
[0048] Exemplary embodiments will be described in detail herein, examples of which are shown in the accompanying drawings. When the following description refers to the drawings, the same numbers in different drawings represent the same or similar elements unless otherwise indicated. The implementations described in the following exemplary embodiments do not represent all implementations consistent with the present application. Instead, they are merely examples of devices and methods consistent with some aspects of the present application as detailed in the appended claims.
[0049] In the technical solution of this application, the collection, storage, use, processing, transmission, provision and disclosure of information such as financial data or user data involved shall comply with the provisions of relevant laws and regulations and shall not violate public order and good morals.
[0050] It should be noted that in the embodiments of the present application, certain software, components, models and other existing solutions in the industry may be mentioned, and they should be regarded as exemplary. Their purpose is only to illustrate the feasibility of implementing the technical solution of the present application, but it does not mean that the applicant has or will necessarily use the solution.
[0051] Data leakage incidents refer to incidents in which unauthorized individuals or entities access, obtain, leak, use, modify or destroy sensitive or confidential data. With the development of the Internet, the number of data leakage incidents through the Internet is increasing. Once a data leakage incident occurs, it will bring serious security risks to individuals or enterprises.
[0052] For example, as a financial institution, banks handle a large amount of sensitive information, including customers' personal information, financial data, transaction records, etc. It is particularly important for banks to monitor data leakage incidents.
[0053] At present, in the known technology, the designated website is generally monitored by hard coding. Specifically, the electronic device extracts the data in the page contained in the designated website, and matches the text content of the title and body contained in the page by keywords to obtain a matching result, so as to determine whether the page involves the data leakage incident of concern according to the matching result. It can be understood that the keywords are preset and related to the data leakage incident of concern.
[0054] In the above process, on the one hand, the electronic device can only determine whether it involves a data leakage incident based on the text content included in the page, while in actual applications, the page also involves other types of data, such as video data or sound data, etc., which makes the data used for analysis not comprehensive enough, which is not conducive to monitoring accuracy. On the other hand, the electronic device can only determine whether it is a data leakage incident of concern, but cannot identify unrecorded historical data leakage incidents or other possible leakage incidents, which will lead to underreporting and is not conducive to monitoring accuracy.
[0055] Therefore, the present application provides a leakage event monitoring method, device, electronic device and storage medium to solve the above-mentioned defects. Among them, the leakage event monitoring method of the present application is executed by any electronic device with computing power. The electronic device obtains the page data of each monitored platform, extracts the event to be analyzed from the page data according to multiple preset keywords, and first confirms whether the event to be analyzed is a historical leakage event by calculating the event similarity between the event to be analyzed and each historical leakage event. When the event to be analyzed is not a historical leakage event, the matching degree between the word features corresponding to the preset keywords included in the event to be analyzed and the feature fields of the preset user information is further calculated to determine whether the event to be analyzed is a real leakage event. Through the method of the present application, a more comprehensive analysis of the event to be analyzed can be performed, historical leakage events, real leakage events and false leakage events can be effectively identified, and the risk of underreporting or false reporting of leakage events can be reduced, thereby improving the accuracy of leakage monitoring.
[0056] It can be understood that the method of the present application is applicable to any scenario where data leakage incidents need to be monitored, and can be executed by any electronic device with computing power. For example, it is applicable to the scenario where a bank monitors whether user information has been leaked. It is executed by a bank server to monitor some public platforms and promptly discover whether these public platforms have leaked user information within the bank.
[0057] Figure 1 is an application scenario diagram of the leakage event monitoring method applicable to the embodiment of the present application, such as Figure 1 As shown, the bank server is internally configured with n public platforms that need to be monitored, i.e., n monitored platforms. Through the method of the present application, the bank server can obtain the page data of these monitored platforms through HTTP requests. Furthermore, the bank server extracts the events to be analyzed from these page data according to multiple preset keywords, and analyzes in turn whether the events to be analyzed are historical leakage events, real leakage events, or false leakage events, so that on the one hand, the leakage nature can be accurately determined, and on the other hand, a more comprehensive analysis of the events to be analyzed can be performed, thereby avoiding underreporting and false reporting, and ensuring the accuracy of monitoring.
[0058] The following specific embodiments are used to describe in detail the technical solution of the present application and how the technical solution of the present application solves the above-mentioned technical problems. The following specific embodiments can be combined with each other, and the same or similar concepts or processes may not be repeated in some embodiments. The embodiments of the present application will be described below in conjunction with the accompanying drawings. It is worth noting that the methods of the following embodiments are described by taking the application in a bank server as an example.
[0059] Figure 2 Schematic diagram of the process of the leakage event monitoring method provided in the embodiment of the present application Figure 1 .like Figure 2 As shown, the leakage event monitoring method includes:
[0060] S201, obtaining page data containing preset keywords in the monitored platform.
[0061] The monitored platform should be a public network platform, and the bank server can obtain the page data of the monitored platform.
[0062] In this embodiment, the bank server is configured to monitor the page data of the monitored platform, and the bank server is configured with preset keywords. The bank server monitors whether the preset keywords appear in the monitored platform, and obtains the page data when any page data contains the preset keywords. It can be understood that the preset keywords are words or sentences that the bank pays attention to. For example, it can be "bank card number", "credit card number", etc. The monitored platform can be a shopping software, forum, etc.
[0063] In this embodiment, for the monitored platform that needs to be monitored, the operator writes a relevant monitoring script and uploads it to the bank server, so that the bank server can monitor the monitored platform. It can be understood that in actual applications, when a new platform that needs to be monitored appears, such as a new data transaction channel, the bank server obtains dynamic configuration information and obtains page data containing preset keywords in the monitored platform according to any of the preset methods.
[0064] The dynamic configuration information is used to indicate the monitored platform, including the monitoring script about the monitored platform, uploaded by the operator. The preset methods include crawler technology, sending HTTP requests through application program interfaces, data export functions of the monitored platform, etc., which are not limited in this embodiment.
[0065] Through this setting, when a new public network platform needs to be monitored, it can be flexibly added as a monitored platform, thereby achieving the purpose of dynamically expanding the monitored platforms.
[0066] S202: extract the event to be analyzed from the page data, and calculate the event similarity between the event to be analyzed and each historical leakage event.
[0067] The event to be analyzed includes at least one preset keyword and a word feature corresponding to the preset keyword.
[0068] In this embodiment, the bank server extracts the events to be analyzed from the page data according to the preset keywords. Specifically, the bank server extracts the preset keywords contained in the page data and the word features corresponding to the preset keywords to obtain the events to be analyzed.
[0069] The bank server supports extracting events to be analyzed from page data of different formats. Specifically, if the page data includes data in text format, the events to be analyzed containing the preset keywords and their corresponding word features are directly extracted from the page data according to the preset keywords. If the page data includes image data in picture format, the events to be analyzed are extracted from the image data by optical character recognition (OCR) technology. If the page data includes file data in file format, the file data is parsed to extract the events to be analyzed. In this embodiment, the format of the page data from which the events to be analyzed can be extracted is not limited, as long as the events to be analyzed can be extracted from the page data by known technologies, for example, data in compressed package format can also be used.
[0070] Through this setting, the bank server can parse and extract data in different forms, with flexibility, and can adapt to changes in different types of events. Further, it can reduce the risk of underreporting of leakage events due to failure to identify and extract.
[0071] In this embodiment, the bank server pre-stores at least one historical leakage event, which is a historically recorded data leakage event. When the bank server extracts the event to be analyzed, it sequentially calculates the event similarity between the event to be analyzed and each historical leakage event to determine whether the event to be analyzed is a historical leakage event.
[0072] Specifically, the bank server can calculate the event similarity between the event to be analyzed and each historical leakage event by using the cosine similarity algorithm. In practical applications, the bank server can also be implemented by other algorithms for calculating the similarity between two text data, for example, the Jaccard similarity algorithm and the TF-IDF algorithm, which are not limited in this embodiment.
[0073] S203, when it is determined according to the event similarity that the event to be analyzed is not a historical leakage event, the matching degree between the word features corresponding to each preset keyword included in the event to be analyzed and the feature fields corresponding to the user information in the preset database is calculated.
[0074] S204: Determine whether the event to be analyzed is a real leakage event or a false leakage event according to the matching degree.
[0075] In this embodiment, when the bank server obtains the event similarity between the event to be analyzed and each historical leakage event, it further determines whether there is an event similarity greater than the first preset threshold. If so, it confirms that the event to be analyzed is a historical leakage event, and uses the historical leakage event corresponding to the event similarity as the historical leakage event corresponding to the event to be analyzed. It can be understood that the historical leakage events pre-stored in the bank server are different. When configuring the first preset threshold, it should be satisfied that if there is an event similarity greater than the first preset threshold, only one event similarity greater than the first preset threshold is allowed to exist. In short, the first preset threshold should be as large as possible, for example, it can be 0.99.
[0076] In this embodiment, when the bank server confirms that the event to be analyzed is not a historical leakage event, it further confirms whether the event to be analyzed is a real leakage event or a false leakage event.
[0077] Specifically, the bank server calculates the matching degree between the word features corresponding to each preset keyword included in the event to be analyzed and the feature fields corresponding to the user information in the preset database. The preset database is the user information database of the bank, which contains the user information in the bank, such as the user identity information and the user's asset information in the bank. The feature fields corresponding to the user identity information can be the user's name, gender, ID number, and mobile phone number. The feature fields corresponding to the asset information can be the user's bank card number, credit card number, etc. in the bank.
[0078] In this embodiment, the bank server first determines the user identity information based on the word features corresponding to the preset keywords used to represent the user information in the event to be analyzed. Secondly, the user information of the corresponding user is obtained from the preset database, and then the word features of each preset keyword are compared with the feature fields corresponding to the user information one by one to determine the matching degree. Furthermore, a second preset threshold is configured in the bank server, and when the matching degree is greater than the second preset threshold, the event to be analyzed is determined to be a real leakage event.
[0079] Exemplarily, for the event to be analyzed, when the preset keyword it contains is the ID card number, first, the corresponding word feature, that is, the ID card number field, can use the MOD 11-2 verification algorithm defined in the ISO 7064:1983 international standard to verify the legitimacy of the ID card. Secondly, the user information of the corresponding user is obtained from the preset database, and then the word features of each preset keyword and the feature fields corresponding to the user information are compared one by one to determine the degree of match.
[0080] It can be understood that in this embodiment, the bank server calculates the matching degree between the word features of each preset keyword included in the event to be analyzed and the feature fields corresponding to the user information in the preset database of the bank, and determines whether it is a real leakage event based on the matching degree, which is used to accurately identify events that have leaked the user information of the bank.
[0081] In the method of this embodiment, the bank server can monitor different monitored platforms and obtain page data containing preset keywords in each monitored platform. For the obtained page data, the bank server can extract the event to be analyzed from these page data and determine whether the event to be analyzed is a historical leakage event. If it is not a historical leakage event, the matching degree of the word features corresponding to each preset keyword included in the event to be analyzed and the feature field corresponding to the user information in the preset database is further calculated.
[0082] Through the method of this embodiment, the bank server can obtain page data containing preset keywords by regularly and frequently accessing the page data of each monitored platform, and promptly extract events to be analyzed from the page data, and confirm in turn whether they are historical leakage events, real leakage events or false leakage events, which can effectively prevent underreporting and false alarms, thereby ensuring monitoring accuracy.
[0083] In one possible design, Figure 3 Schematic diagram of the process of the leakage event monitoring method provided in the embodiment of the present application Figure 2 Based on the above-mentioned embodiments, this embodiment further describes in detail the method of determining whether the event to be analyzed is a historical leakage event. Figure 3 As shown, the method of this embodiment includes the following steps:
[0084] S301 . When there are multiple events to be analyzed, determine the events to be analyzed that belong to the same event according to any one of the preset algorithms.
[0085] Among them, the preset algorithms include cosine similarity algorithm and clustering algorithm.
[0086] It is understandable that there may be multiple events to be analyzed within the same analysis cycle. At this time, the bank server first determines the events to be analyzed that belong to the same event according to one of the preset algorithms.
[0087] Specifically, it can be determined according to the cosine similarity algorithm. The bank server first obtains the vector representation of each event to be analyzed, and further calculates the similarity between each two vector representations according to the calculation formula of the cosine similarity algorithm to determine the events to be analyzed that belong to the same event. It can also be determined according to the clustering algorithm. The bank server clusters the events to be analyzed to identify the events to be analyzed that belong to the same event. In practical applications, other algorithms can also be used to determine the events to be analyzed that belong to the same event, which is not limited in this embodiment.
[0088] S302: For at least two events to be analyzed that belong to the same event, aggregate the event similarities between the at least two events to be analyzed and each historical leakage event to obtain an overall similarity.
[0089] It can be understood that in this embodiment, when calculating the event similarity between each event to be analyzed and each historical leakage event, firstly, the first vector representation of the event to be analyzed and the second vector representation corresponding to each historical leakage event are obtained. Then, the cosine similarity is calculated for the first vector representation and each second vector representation respectively to obtain the event similarity between the event to be analyzed and the corresponding historical leakage event.
[0090] The event similarity between the event to be analyzed and the historical leakage event is calculated by cosine similarity. It only needs to be converted into the corresponding vector representation first, and then the vector representation is substituted into the calculation formula to obtain the settlement result. The calculation process is simple.
[0091] Further, for at least two events to be analyzed belonging to the same event, the bank server aggregates the event similarities between the events and each historical leakage event to obtain the overall similarity between the at least two events to be analyzed belonging to the same event and each historical leakage event. The aggregation may be an average value, a maximum value, or a mode, which is not limited in this embodiment.
[0092] S303: If the overall similarity between the at least two events to be analyzed and any historical leakage event is greater than a first preset threshold, the at least two events to be analyzed are marked as corresponding historical leakage events.
[0093] S304: If the overall similarity between the at least two events to be analyzed and each historical leakage event is not greater than a first preset threshold, determine that the at least two events to be analyzed are not historical leakage events.
[0094] In this embodiment, for at least two events to be analyzed that belong to the same event, the bank server determines whether the at least two events to be analyzed belong to one of the historical leakage events by comparing the overall similarities between the at least two events to be analyzed and each historical leakage event, as well as a first preset threshold.
[0095] Specifically, if there is an overall similarity greater than a first preset threshold, it is determined that at least two events to be analyzed are historical leakage events, and the historical leakage events corresponding to the overall similarity are used as the historical leakage events corresponding to the at least two events to be analyzed. If there is no overall similarity greater than the first preset threshold, it is determined that at least two events to be analyzed are not historical leakage events.
[0096] Through this setting, when there are at least two events to be analyzed belonging to the same event, when determining whether it is a historical leakage event by comparing the event similarity with the first preset threshold, it is only necessary to compare the overall similarity with the first preset threshold once, which effectively reduces the number of comparisons and can effectively save computing power, thereby helping to improve analysis efficiency and the performance of bank servers.
[0097] In one possible design, Figure 4 Schematic diagram of the process of the leakage event monitoring method provided in the embodiment of the present application Figure 3 Based on the above embodiments, this embodiment further defines the method for determining whether the event to be analyzed is a historical leakage event, a real leakage event, or a false leakage event. Figure 4 As shown, the following steps are included:
[0098] S401: Store the event to be analyzed and the marking information corresponding to the event to be analyzed in a queue to be reviewed, and feedback review reminder information to the user.
[0099] The marking information is used to indicate that the event to be analyzed is one of a historical leakage event, a real leakage event, and a false leakage event.
[0100] In this embodiment, when the bank server determines that the event to be analyzed is a historical leakage event, a real leakage event, or a false leakage event, it generates tag information corresponding to the event to be analyzed to indicate its event type. Further, the bank server stores the event to be analyzed and its corresponding tag information in the queue to be reviewed, and feeds back review reminder information to the user.
[0101] Specifically, the user can be a professional security team within the bank, and the bank server interacts with its corresponding user terminal. When there are new events to be analyzed in the review queue, review reminder information is fed back to the user through the user terminal to prompt the professional staff to review whether the event type is accurate.
[0102] Through this setting, users can be informed in time to conduct user review, which can improve the accuracy of analysis on the one hand, and help users take corresponding measures in time to reduce losses on the other hand.
[0103] S402: Receive review result information fed back by the user.
[0104] The review result information is used to indicate whether the event to be analyzed is confirmed to be one of a historical leakage event, a real leakage event, and a false leakage event.
[0105] S403. Update historical leakage events according to the review result information.
[0106] In this embodiment, the bank server receives the review result information fed back by the user indicating whether the marking information of the event to be analyzed is accurate, and is used to timely update the historical leakage events stored in the bank server, thereby facilitating subsequent analysis work.
[0107] Through this setting, historical leakage events in the bank server can be updated in a timely manner, so that when the same event occurs, users can directly solve the incident through the measures used for the corresponding historical leakage events, which is conducive to improving the efficiency of handling leakage events.
[0108] As an example, Figure 5 A schematic diagram of a leakage event monitoring process provided by an embodiment of the present application, such as Figure 5 As shown, the bank server crawls the page data including preset keywords in the monitored platform, and then extracts the events to be analyzed from these page data. If the extraction is successful, the event similarity between the event to be analyzed and each historical leakage event is further calculated.
[0109] When the event similarity is greater than the first preset threshold, the event to be analyzed is marked as the corresponding historical leakage event, and it is stored in the queue to be reviewed for manual review. When the event similarity is not greater than the first preset threshold, the matching degree between the word features corresponding to each preset keyword included in the event to be analyzed and the feature field of the user information in the preset database is further calculated, and then the matching degree is compared with the second preset threshold. If the matching degree is greater than the second preset threshold, the event to be analyzed is marked as a real leakage event, and it is stored in the queue to be reviewed for manual review. If the matching degree is not greater than the second preset threshold, the event to be analyzed is marked as a false leakage event, and it is stored in the queue to be reviewed for manual review.
[0110] Through the above process, it is possible to timely capture suspected leakage events to be analyzed, and further accurately confirm whether it is a leakage event and the event type.
[0111] Figure 6 This is a schematic diagram of the structure of the leakage event monitoring device provided in the embodiment of the present application. Figure 6 As shown, the leakage event monitoring device includes: an acquisition module 61, a calculation module 62 and a determination module 63;
[0112] The acquisition module 61 is used to acquire page data containing preset keywords in the monitored platform;
[0113] The calculation module 62 is used to extract the event to be analyzed from the page data according to multiple preset keywords, and calculate the event similarity between the event to be analyzed and each historical leakage event; the event to be analyzed includes at least one preset keyword and a word feature corresponding to the preset keyword;
[0114] The calculation module 62 is further used to calculate the matching degree between the word features corresponding to each preset keyword included in the event to be analyzed and the feature fields corresponding to the user information in the preset database when it is determined that the event to be analyzed is not a historical leakage event according to the event similarity;
[0115] The determination module 63 is used to determine whether the event to be analyzed is a real leakage event or a false leakage event according to the matching degree.
[0116] In some embodiments, the calculation module 62 is further configured to:
[0117] Determine the events to be analyzed that belong to the same event according to any one of the preset algorithms, the preset algorithms including the cosine similarity algorithm and the clustering algorithm;
[0118] For at least two events to be analyzed that belong to the same event, aggregate the event similarities between the at least two events to be analyzed and each historical leakage event to obtain an overall similarity;
[0119] If the overall similarity between at least two events to be analyzed and any historical leakage event is greater than a first preset threshold, marking the at least two events to be analyzed as corresponding historical leakage events;
[0120] If the overall similarities between the at least two events to be analyzed and the historical leakage events are not greater than the first preset threshold, it is determined that the at least two events to be analyzed are not historical leakage events.
[0121] In some embodiments, the calculation module 62 is specifically used to:
[0122] Obtain a first vector representation of the event to be analyzed and a second vector representation corresponding to each historical leakage event;
[0123] The cosine similarity is calculated for the first vector representation and each second vector representation, to obtain the event similarity between the event to be analyzed and the corresponding historical leakage event.
[0124] In some embodiments, the acquisition module 61 is specifically used for:
[0125] Acquire dynamic configuration information, where the dynamic configuration information is used to indicate the monitored platform;
[0126] The page data containing preset keywords on the monitored platform is obtained according to any one of the preset methods, and the preset methods include crawler technology.
[0127] In some embodiments, the calculation module 62 is specifically used to:
[0128] If the page data includes image data, the event to be analyzed is extracted from the image data by using optical character recognition (OCR) technology;
[0129] If the page data includes file data, the file data is parsed to extract the event to be analyzed.
[0130] In some embodiments, the apparatus further comprises:
[0131] The review module (not shown in the figure) is used to store the event to be analyzed and the marking information corresponding to the event to be analyzed in the queue to be reviewed, and to feedback the review reminder information to the user; the marking information is used to indicate that the event to be analyzed is one of the historical leakage event, the real leakage event, and the false leakage event.
[0132] In some embodiments, the review module is further configured to:
[0133] Receive the review result information fed back by the user, where the review result information is used to indicate whether the event to be analyzed is confirmed to be one of a historical leakage event, a real leakage event, and a false leakage event;
[0134] Update historical leakage events based on the review results.
[0135] The leakage event monitoring device provided in the embodiment of the present application can be used to implement the technical solution of the leakage event monitoring method in the above embodiment. Its implementation principle and technical effect are similar and will not be repeated here.
[0136] It should be noted that it should be understood that the division of the various modules of the above device is only a division of logical functions. In actual implementation, they can be fully or partially integrated into one physical entity, or they can be physically separated. And these modules can all be implemented in the form of software called by processing elements; they can also be all implemented in the form of hardware; some modules can also be implemented in the form of software called by processing elements, and some modules can be implemented in the form of hardware. For example, the calculation module 62 can be a separately established processing element, or it can be integrated in a chip of the above device. In addition, it can also be stored in the memory of the above device in the form of program code, and called and executed by a processing element of the above device. The function of the above calculation module 62. The implementation of other modules is similar. In addition, all or part of these modules can be integrated together, or they can be implemented independently. The processing element here can be an integrated circuit with signal processing capabilities. In the implementation process, each step of the above method or each module above can be completed by an integrated logic circuit of hardware in the processor element or instructions in the form of software.
[0137] Figure 7This is a schematic diagram of the structure of an electronic device provided in an embodiment of the present application. Figure 7 As shown, the electronic device may include: a transceiver 71 , a processor 72 , and a memory 73 .
[0138] The processor 72 executes the computer execution instructions stored in the memory, so that the processor 72 executes the scheme in the above embodiment. The processor 72 can be a general-purpose processor, including a central processing unit CPU, a network processor (NP), etc.; it can also be a digital signal processor DSP, an application-specific integrated circuit ASIC, a field programmable gate array FPGA or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components.
[0139] The memory 73 is connected to the processor 72 via a system bus and completes communication between them. The memory 73 is used to store computer program instructions.
[0140] The transceiver 71 may be used to obtain tasks to be executed and configuration information of the tasks to be executed.
[0141] The system bus can be a peripheral component interconnect (PCI) bus or an extended industry standard architecture (EISA) bus, etc. The system bus can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, only one thick line is used in the figure, but it does not mean that there is only one bus or one type of bus. The transceiver is used to realize the communication between the database access device and other computers (such as clients, read-write libraries, and read-only libraries). The memory may include random access memory (RAM) and may also include non-volatile memory.
[0142] An embodiment of the present application also provides a chip for running instructions, which is used to execute the technical solution of the leakage event monitoring method in the above embodiment.
[0143] An embodiment of the present application further provides a computer-readable storage medium, in which computer instructions are stored. When the computer instructions are executed on a computer, the computer executes the technical solution of the leakage event monitoring method of the above embodiment.
[0144] An embodiment of the present application also provides a computer program product, which includes a computer program stored in a computer-readable storage medium. At least one processor can read the computer program from the computer-readable storage medium. When at least one processor executes the computer program, the technical solution of the leakage event monitoring method in the above embodiment can be implemented.
[0145] In the several embodiments provided in the present application, it should be understood that the disclosed devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic, for example, the division of modules is only a logical function division, and there may be other division methods in actual implementation, such as multiple modules can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be an indirect coupling or communication connection through some interfaces, devices or modules, which can be electrical, mechanical or other forms.
[0146] The modules described as separate components may or may not be physically separated, and the components shown as modules may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the modules may be selected according to actual needs to implement the solution of this embodiment.
[0147] In addition, each functional module in each embodiment of the present application can be integrated into one processing unit, or each module can exist physically separately, or two or more modules can be integrated into one unit. The above-mentioned module-composed unit can be implemented in the form of hardware or in the form of hardware plus software functional units.
[0148] The above-mentioned integrated module implemented in the form of a software function module can be stored in a computer-readable storage medium. The above-mentioned software function module is stored in a storage medium, including a number of instructions for enabling a computer device (which can be a personal computer, a server, or a network device, etc.) or a processor to perform some steps of the methods of various embodiments of the present application.
[0149] It should be understood that the above processor can be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), etc. A general-purpose processor can be a microprocessor or any conventional processor. The steps of the method disclosed in the invention can be directly embodied as being executed by a hardware processor, or can be executed by a combination of hardware and software modules in the processor.
[0150] The memory may include a high-speed RAM memory, and may also include a non-volatile storage NVM, such as at least one disk memory, and may also be a USB flash drive, a mobile hard disk, a read-only memory, a magnetic disk or an optical disk, etc.
[0151] The bus can be an Industry Standard Architecture (ISA) bus, a Peripheral Component Interconnect (PCI) bus, or an Extended Industry Standard Architecture (EISA) bus, etc. The bus can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, the bus in the drawings of this application is not limited to only one bus or one type of bus.
[0152] The above storage medium can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic memory, flash memory, magnetic disk or optical disk. The storage medium can be any available medium that can be accessed by a general or special purpose computer.
[0153] An exemplary storage medium is coupled to a processor so that the processor can read information from the storage medium and write information to the storage medium. Of course, the storage medium can also be a component of the processor. The processor and the storage medium can be located in an application specific integrated circuit (ASIC). Of course, the processor and the storage medium can also exist as discrete components in an electronic control unit or a main control device.
[0154] Those skilled in the art can understand that all or part of the steps of implementing the above-mentioned method embodiments can be completed by hardware related to program instructions. The aforementioned program can be stored in a computer-readable storage medium. When the program is executed, the steps of the above-mentioned method embodiments are executed; and the aforementioned storage medium includes: ROM, RAM, disk or optical disk and other media that can store program codes.
[0155] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present application, rather than to limit it. Although the present application has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or replace some or all of the technical features therein with equivalents. However, these modifications or replacements do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of the present application.
Claims
1. A leakage event monitoring method, characterized in that: The method comprises: Obtain page data containing preset keywords on the monitored platform; Extracting an event to be analyzed from the page data, and calculating the event similarity between the event to be analyzed and each historical leakage event; the event to be analyzed includes at least one preset keyword and a word feature corresponding to the preset keyword; When it is determined according to the event similarity that the event to be analyzed is not the historical leakage event, calculating the matching degree between the word features corresponding to each of the preset keywords included in the event to be analyzed and the feature fields corresponding to the user information in the preset database; According to the matching degree, it is determined whether the event to be analyzed is a real leakage event or a false leakage event.
2. The method according to claim 1, characterized in that The method further comprises: When there are multiple events to be analyzed, determine the events to be analyzed that belong to the same event according to any one of the preset algorithms, wherein the preset algorithms include a cosine similarity algorithm and a clustering algorithm; For at least two events to be analyzed that belong to the same event, aggregate the event similarities between the at least two events to be analyzed and each historical leakage event to obtain an overall similarity; If the overall similarity between the at least two events to be analyzed and any historical leakage event is greater than a first preset threshold, marking the at least two events to be analyzed as corresponding historical leakage events; If the overall similarity between the at least two events to be analyzed and each of the historical leakage events is not greater than the first preset threshold, it is determined that the at least two events to be analyzed are not the historical leakage events.
3. The method according to claim 1 or 2, characterized in that: The calculating the event similarity between the event to be analyzed and each historical leakage event includes: Obtaining a first vector representation of the event to be analyzed and a second vector representation corresponding to each of the historical leakage events; Cosine similarity calculation is performed on the first vector representation and each of the second vector representations to obtain event similarity between the event to be analyzed and the corresponding historical leakage event.
4. The method according to claim 1 or 2, characterized in that: The step of obtaining page data containing preset keywords on the monitored platform includes: Acquiring dynamic configuration information, where the dynamic configuration information is used to indicate the monitored platform; The page data of the monitored platform is obtained according to any one of the preset methods, wherein the preset method includes crawler technology.
5. The method according to claim 1 or 2, characterized in that: The extracting the event to be analyzed from the page data includes: If the page data includes picture data, extracting the event to be analyzed from the picture data by using optical character recognition (OCR) technology; If the page data includes file data, the file data is parsed to extract the event to be analyzed.
6. The method according to claim 5, characterized in that The method further comprises: The event to be analyzed and the marking information corresponding to the event to be analyzed are stored in a queue to be reviewed, and review reminder information is fed back to the user; the marking information is used to indicate that the event to be analyzed is one of the historical leakage event, the real leakage event, and the false leakage event.
7. The method according to claim 6, characterized in that The method further comprises: receiving the review result information fed back by the user, wherein the review result information is used to indicate whether the event to be analyzed is confirmed to be one of the historical leakage event, the real leakage event, and the false leakage event; The historical leakage events are updated according to the review result information.
8. A leakage event monitoring device, characterized in that: The device comprises: An acquisition module is used to acquire page data containing preset keywords in the monitored platform; A calculation module, used to extract an event to be analyzed from the page data, and calculate the event similarity between the event to be analyzed and each historical leakage event; the event to be analyzed includes at least one preset keyword and a word feature corresponding to the preset keyword; The calculation module is further configured to calculate the matching degree between the word features corresponding to each of the preset keywords included in the event to be analyzed and the feature fields corresponding to the user information in the preset database when it is determined that the event to be analyzed is not the historical leakage event according to the event similarity; A determination module is used to determine whether the event to be analyzed is a real leakage event or a false leakage event according to the matching degree.
9. An electronic device, characterized in that: include: A processor, and a memory communicatively connected to the processor; The memory stores computer-executable instructions; The processor executes the computer-executable instructions stored in the memory to implement the method according to any one of claims 1 to 7.
10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer-executable instructions, which are used to implement the method according to any one of claims 1 to 7 when executed by a processor.
11. A computer program product, characterized in that The invention comprises a computer program, which implements the method according to any one of claims 1 to 7 when being executed by a processor.