Information leakage risk identification method and device, equipment and medium

Abstract

The invention provides an information leakage risk identification method and device, equipment and a medium, and the method comprises the steps: determining a corresponding target key field name according to a to-be-identified sensitive information type; determining a target information leakage identification rule according to the target key field name and the sensitive information type; according to the sensitive information type, screening the plurality of transaction interface traffic data of the current date to obtain target sensitive traffic data; extracting at least one target segment value matched with the target key field segment name from each target sensitive traffic data according to the target key field segment name; for any target segment value, analyzing the target sensitive traffic data containing the target segment value to determine whether the target segment value satisfies a target information leakage identification rule; and when the target segment value satisfies a target information leakage identification rule, determining sensitive information matched with the sensitive information type in the target sensitive traffic data containing the target segment value as information having an information leakage risk in the current date.

Description

Technical Field

[0001] The present disclosure relates to the field of computer technology, and in particular to an information leakage risk identification method, device, equipment and medium. Background Art

[0002] With the development of the Internet, all walks of life have retained a large amount of user information in Internet application services. User information is related to the healthy development of the data economy and the Internet industry, personal privacy and data security, business integrity and fair competition, social trust and harmony and stability, and many other aspects.

[0003] In related industries (such as the banking industry), due to the large number of users and the characteristics of involving important information such as financial transactions, protecting the information security of user information, especially the security of sensitive information, to prevent information leakage has always been the core concern of related industries. However, how to identify the risk of information leakage of sensitive information is extremely important. Summary of the invention

[0004] The present invention provides an information leakage risk identification method, device, equipment and medium.

[0005] According to a first aspect of an embodiment of the present disclosure, a method for identifying information leakage risks is provided, the method comprising:

[0006] Determine the corresponding target key fields based on the type of sensitive information to be identified;

[0007] Determining target information leakage identification rules according to the target key fields and the sensitive information type;

[0008] According to the sensitive information type, multiple transaction interface traffic data of the current date are screened to obtain at least one target sensitive traffic data;

[0009] According to the target key field, extract at least one target segment value matching the target key field from each of the target sensitive traffic data;

[0010] For any of the target segment values, analyzing the target sensitive traffic data containing the target segment value to determine whether the target segment value satisfies the target information leakage identification rule;

[0011] In response to the target segment value satisfying the target information leakage identification rule, sensitive information matching the sensitive information type in the target sensitive traffic data containing the target segment value is determined as information with information leakage risk on the current date.

[0012] According to a second aspect of an embodiment of the present disclosure, there is provided an information leakage risk identification device, the device comprising:

[0013] A first determination module is used to determine the corresponding target key field segment name according to the type of sensitive information to be identified;

[0014] A second determination module is used to determine a target information leakage identification rule according to the target key field segment name and the sensitive information type;

[0015] A screening module, used to screen multiple transaction interface flow data of the current date according to the sensitive information type to obtain at least one target sensitive flow data;

[0016] An extraction module, configured to extract at least one target segment value matching the target key field segment name from each target sensitive traffic data according to the target key field segment name;

[0017] An analysis module, for analyzing, for any of the target segment values, target sensitive traffic data containing the target segment value to determine whether the target segment value satisfies the target information leakage identification rule;

[0018] The third determination module is used to determine the sensitive information matching the sensitive information type in the target sensitive traffic data containing the target segment value as information with information leakage risk on the current date in response to the target segment value satisfying the target information leakage identification rule.

[0019] According to the third aspect of an embodiment of the present disclosure, an electronic device is provided, comprising: a processor, and a memory communicatively connected to the processor; the memory stores computer-executable instructions; the processor executes the computer-executable instructions stored in the memory to implement the information leakage risk identification method disclosed in the embodiment of the first aspect of the present disclosure.

[0020] According to a fourth aspect of an embodiment of the present disclosure, a computer-readable medium is provided, in which computer-executable instructions are stored. When the computer-executable instructions are executed by a processor, they are used to implement the information leakage risk identification method disclosed in the embodiment of the first aspect of the present disclosure.

[0021] According to a fifth aspect of an embodiment of the present disclosure, the present disclosure provides a computer program product, including a computer program, which, when executed by a processor, implements the information leakage risk identification method disclosed in the embodiment of the first aspect of the present disclosure.

[0022] The technical solution provided by the embodiments of the present disclosure brings at least the following beneficial effects:

[0023] According to the type of sensitive information to be identified, the corresponding target key field segment name is determined; according to the target key field segment name and the sensitive information type, the target information leakage identification rule is determined; according to the sensitive information type, multiple transaction interface traffic data of the current date are screened to obtain at least one target sensitive traffic data; according to the target key field segment name, at least one target segment value matching the target key field is extracted from each target sensitive traffic data; for any target segment value, the target sensitive traffic data containing the target segment value is analyzed to determine whether the target segment value satisfies the target information leakage identification rule; in response to the target segment value satisfying the target information leakage identification rule, the sensitive information matching the sensitive information type in the target sensitive traffic data containing the target segment value is determined as the information with information leakage risk in the current date. Thus, the target key field to be identified in the transaction interface traffic data can be automatically determined based on the sensitive information type, and then the required target information leakage identification rule can be automatically determined based on the target key field segment name and the sensitive information type, thereby automatically determining whether there is information with information leakage risk and matching the sensitive information type in the transaction interface traffic data of the current date, without consuming a lot of human resources and time costs.

[0024] It is to be understood that the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the present disclosure. BRIEF DESCRIPTION OF THE DRAWINGS

[0025] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present disclosure and, together with the description, serve to explain the principles of the present disclosure.

[0026] Figure 1 is a flowchart of the information leakage risk identification method shown in the first embodiment of the present disclosure;

[0027] Figure 2 is a flowchart of an information leakage risk identification method shown in the second embodiment of the present disclosure;

[0028] Figure 3 is a flowchart of an information leakage risk identification method shown in the third embodiment of the present disclosure;

[0029] Figure 4 is a flowchart of an information leakage risk identification method shown in the fourth embodiment of the present disclosure;

[0030] Figure 5 is a structural diagram of an information leakage risk identification device shown in the fifth embodiment of the present disclosure;

[0031] Figure 6 It is a schematic structural diagram of an electronic device shown in an exemplary embodiment of the present disclosure.

[0032] The above drawings show clear embodiments of the present disclosure, which will be described in more detail below. These drawings and text descriptions are not intended to limit the scope of the present disclosure in any way, but to illustrate the concepts of the present disclosure to those skilled in the art by referring to specific embodiments. DETAILED DESCRIPTION

[0033] Exemplary embodiments will be described in detail herein, examples of which are shown in the accompanying drawings. When the following description refers to the drawings, the same numbers in different drawings represent the same or similar elements unless otherwise indicated. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with the present disclosure. Instead, they are merely examples of devices and methods consistent with some aspects of the present disclosure as detailed in the appended claims.

[0034] It should be noted that the acquisition, storage, use, and processing of data in the technical solution disclosed in this disclosure are in compliance with the relevant provisions of national laws and regulations.

[0035] The following describes the information leakage risk identification method, device, equipment and medium of the embodiments of the present disclosure with reference to the accompanying drawings.

[0036] Figure 1 It is a flowchart of the information leakage risk identification method shown in the first embodiment of the present disclosure.

[0037] It should be noted that the executor of the information leakage risk identification method provided in the embodiment of the present disclosure is an information leakage risk identification device, which can be implemented by software and / or hardware. The information leakage risk identification device in this embodiment can be an electronic device, or can be configured in an electronic device.

[0038] The electronic device in the embodiment of the present disclosure may include a terminal device, a server, etc. For example, the terminal device may be a mobile phone, a tablet computer, a personal digital assistant, or other hardware device with various operating systems, a touch screen, and / or a display screen. The embodiment does not specifically limit the electronic device. In this example, the electronic device is a server as an example for exemplary description.

[0039] like Figure 1 As shown, the information leakage risk identification method may include the following steps S101-S106.

[0040] Step S101, determining the corresponding target key field segment name according to the type of sensitive information to be identified.

[0041] In the embodiments of the present disclosure, sensitive information types may include, for example, identity card number, bank card number, mobile phone number, etc., and the present disclosure does not impose any restrictions on this.

[0042] Among them, it should be noted that the above-mentioned acquisition, storage, use, and processing of data are in compliance with the relevant provisions of relevant laws and regulations.

[0043] The target key field segment name may correspond to the type of sensitive information to be identified. It should be noted that the target key field segment name corresponding to the type of sensitive information to be identified may be one or more, or may be one or more groups, etc., and the present disclosure does not limit this.

[0044] As an example, assuming that the sensitive information type is an identification card number, the target key field segment name corresponding to the sensitive information type may include, for example, a key field segment name group consisting of a channel, a transaction code, a sensitive information type, etc., or may also include a key field segment name group consisting of a device identifier, a device unique identifier, a device ID (Identity document), etc., wherein the device identifier, the device unique identifier, and the device ID are all used to uniquely identify the corresponding device; for another example, the target key field segment name corresponding to the sensitive information type may also include any one of a device identifier, an IP (Internet Protocol), a session ID (Identity document), and a transaction account.

[0045] It should be noted that the above examples of target key field segment names corresponding to sensitive information types are merely exemplary and may be other in actual applications, which is not limited in the present disclosure.

[0046] In the disclosed embodiment, the corresponding target key field segment name may be determined according to the type of sensitive information to be identified.

[0047] As an example, the correspondence between the sensitive information type and the key field segment name can be established in advance and saved. Then, when obtaining the sensitive information type to be identified, the corresponding target key field segment name can be determined according to the sensitive information type to be identified. The correspondence between the sensitive information type and the key field segment name is shown in Table 1:

[0048] Table 1 Correspondence between sensitive information types and key field segment names

[0049]

[0050] It should also be noted that the target key field segment names corresponding to different sensitive information types may be the same or different, and the present disclosure does not impose any restrictions on this.

[0051] Step S102, determining target information leakage identification rules according to the target key field segment name and sensitive information type.

[0052] It is understandable that the target information leakage identification rules can be determined based on the target key field segment name and sensitive information type.

[0053] As an example, a correspondence between the target key field segment name and sensitive information type and the target information leakage identification rule can be established in advance, so that in subsequent applications, the above correspondence can be queried based on the target key field segment name and sensitive information type to determine the target information leakage identification rule.

[0054] Step S103, screening multiple transaction interface traffic data of the current date according to the sensitive information type to obtain at least one target sensitive traffic data.

[0055] The transaction interface traffic data may be data generated due to transactions on the current date.

[0056] Among them, the target sensitive traffic data is used to indicate transaction interface traffic data containing sensitive information of sensitive information types.

[0057] As an example, the method of the present disclosure is applied to the banking industry for illustration. In a very short period of time close to 24:00:00 on the current date, the bank's multiple transaction interface traffic data on the current date can be screened based on the sensitive information type to filter out the target sensitive traffic data.

[0058] Step S104: extract at least one target segment value matching the target key field segment name from each target sensitive traffic data according to the target key field segment name.

[0059] It should be noted that the target segment value may be one or more, and the present disclosure does not impose any limitation on this.

[0060] In the disclosed embodiment, at least one target segment value matching the target key field segment name can be extracted from each target sensitive traffic data according to the target key field segment name.

[0061] As an example, assuming that the target key field segment name is IP, the target segment values ​​matching the target key field segment name are extracted from each target sensitive traffic data, including IP address 1, IP address 2, and IP address 3.

[0062] Step S105: for any target segment value, the target sensitive traffic data containing the target segment value is analyzed to determine whether the target segment value satisfies the target information leakage identification rule.

[0063] It should be noted that, for any target segment value, the number of target sensitive traffic data containing the target segment value may be one or more, and the present disclosure does not impose any restrictions on this.

[0064] Still using the above example for explanation, assuming that the target key field segment name is IP, and for the target segment value IP address 1, the target sensitive traffic data containing IP address 1 can be analyzed to determine whether the target segment value meets the target information leakage identification rules.

[0065] Step S106, in response to the target segment value satisfying the target information leakage identification rule, the sensitive information matching the sensitive information type in the target sensitive traffic data containing the target segment value is determined as information with information leakage risk on the current date.

[0066] Still using the above example for explanation, assuming that the target key field segment name is IP, and the sensitive information type to be identified is the ID number, for the target segment value IP address 1, assuming that the target segment value meets the target information leakage identification rules, the ID number in the target sensitive traffic data containing the target segment value will be determined as information that has an information leakage risk on the current date.

[0067] The information leakage risk identification method of the embodiment of the present disclosure determines the corresponding target key field segment name according to the sensitive information type to be identified; determines the target information leakage identification rule according to the target key field segment name and the sensitive information type; screens multiple transaction interface traffic data of the current date according to the sensitive information type to obtain at least one target sensitive traffic data; extracts at least one target segment value matching the target key field segment name from any target sensitive traffic data according to the target key field segment name; for any target segment value, analyzes the target sensitive traffic data containing the target segment value to determine whether the target segment value satisfies the target information leakage identification rule; in response to the target segment value satisfying the target information leakage identification rule, determines the sensitive information matching the sensitive information type in the target sensitive traffic data containing the target segment value as information with information leakage risk on the current date. In this way, the target key fields that need to be identified in the transaction interface traffic data can be quickly and automatically determined based on the sensitive information type, and then the required target information leakage identification rules can be automatically determined based on the target key field segment name and the sensitive information type. In this way, it is automatically determined whether there is information leakage risk and information matching the sensitive information type in the transaction interface traffic data of the current date, without consuming a lot of human resources and time costs, and with comprehensive coverage.

[0068] When the target key fields include a key field segment name group consisting of channel, transaction code, and sensitive information type, in order to clearly illustrate in the previous embodiment of the present disclosure, for any target segment value, how the target sensitive traffic data containing the target segment value is analyzed to determine whether the target segment value meets the target information leakage identification rules, the present disclosure also proposes an information leakage risk identification method.

[0069] Figure 2 It is a flowchart of the information leakage risk identification method shown in the second embodiment of the present disclosure.

[0070] like Figure 2 As shown, based on the previous embodiment of the present disclosure, the information leakage risk identification method may further include the following steps S201-S204.

[0071] Step S201, for any group of target segment values ​​corresponding to the key field segment name group, obtain historical sensitive traffic data containing the target segment value.

[0072] Among them, the historical sensitive traffic data can be historical transaction interface traffic data within a set time period before the current date and containing sensitive information of the sensitive information type to be identified. Among them, the present disclosure does not impose any restrictions on the set time period, such as two months, 20 days, 5 weeks, etc.

[0073] In an embodiment of the present disclosure, for any group of target segment values ​​corresponding to a key field segment name group, historical sensitive traffic data containing the target segment values ​​is obtained, wherein the historical sensitive traffic data includes segment values ​​that match any field segment name in the channel, transaction code, and sensitive information type.

[0074] Step S202: Perform a first statistical analysis on the historical sensitive traffic data to obtain corresponding first transaction information.

[0075] The first transaction information may include, for example, the average daily transaction volume, the maximum daily transaction volume, the transaction volume on a set date before the current date (referred to as the target transaction volume in this disclosure), etc., and this disclosure does not impose any restrictions on this;

[0076] The set date may be the same time of the previous statistical period before the current date, such as the same day last week, the same day last month, etc., and the present disclosure does not impose any restrictions on this.

[0077] As an example, assuming that the historical sensitive traffic data is the traffic data for the two months before the current date, a first statistical analysis can be performed on the historical sensitive traffic data for the two months to obtain the corresponding average daily transaction volume, maximum daily transaction volume, target transaction volume on the same day last week, etc.

[0078] Step S203: Perform a second statistical analysis on the target sensitive traffic data containing the target segment value to obtain corresponding second transaction information.

[0079] The second transaction information may include, for example, the transaction volume on the current date (referred to as the first transaction volume in this disclosure) and the like.

[0080] Step S204: compare the first transaction information and the second transaction information to determine whether the target segment value satisfies the target information leakage identification rule.

[0081] It is understandable that whether the target segment value satisfies the target information leakage identification rule can be determined by comparing the first transaction information and the second transaction information.

[0082] Optionally, when the target key field includes a key field segment name group consisting of a channel, a transaction code, and a sensitive information type, and the first transaction information includes an average daily transaction volume, a maximum daily transaction volume, and a target transaction volume on a set date before the current date, and the second transaction information includes the first transaction volume on the current date, the target information leakage identification rule corresponding to the target key field and the sensitive information type may include at least one of the following conditions:

[0083] The first transaction volume is greater than the first set multiple of the average daily transaction volume;

[0084] The first transaction volume is greater than a first set threshold;

[0085] The first transaction volume is greater than the maximum daily transaction volume by the second set multiple;

[0086] The first transaction volume is greater than the target transaction volume by a third set multiple.

[0087] It should be noted that the present disclosure does not limit the values ​​of the first set multiple, the first set threshold, the second set multiple and the third device multiple.

[0088] As an example, assuming that the first set multiple is 2, the first set threshold is 50, the second set multiple is 1.5, and the private order setting multiple is 2.5, the target information leakage identification rule is that the first transaction volume is greater than 2 times the average daily transaction volume, the first transaction volume is greater than 50, and the first transaction volume is greater than 1.5 times the maximum daily transaction volume, or the first transaction volume is greater than 2 times the average daily transaction volume, the first transaction volume is greater than 50, and the first transaction volume is greater than 2.5 times the target transaction volume.

[0089] In this way, the target information leakage identification rules are effectively constructed, which can realize the screening of target segment values.

[0090] The information leakage risk identification method of the disclosed embodiment obtains historical sensitive traffic data containing the target segment value for any group of target segment values ​​corresponding to the key field segment name group; performs a first statistical analysis on the historical sensitive traffic data to obtain the corresponding first transaction information; performs a second statistical analysis on the target sensitive traffic data containing the target segment value to obtain the corresponding second transaction information; and compares the first transaction information and the second transaction information to determine whether the target segment value meets the target information leakage identification rule. Thus, in combination with the historical sensitive traffic data, an accurate judgment on whether the target segment value meets the target information leakage identification rule is achieved.

[0091] In order to clearly illustrate how, in any of the above embodiments of the present disclosure, multiple transaction interface traffic data of the current date are screened according to the type of sensitive information to obtain at least one target sensitive traffic data, the present disclosure also proposes an information leakage risk identification method.

[0092] Figure 3 It is a flowchart of the information leakage risk identification method shown in the third embodiment of the present disclosure.

[0093] like Figure 3 As shown, based on the previous embodiment of the present disclosure, the information leakage risk identification method may further include the following steps S301-S308.

[0094] Step S301, determining the corresponding target key field segment name according to the type of sensitive information to be identified.

[0095] Step S302, determining target information leakage identification rules according to the target key field segment name and sensitive information type.

[0096] It should be noted that the execution process of step S301 to step S302 can refer to the execution process of any embodiment of the present disclosure and is not limited here.

[0097] Step S303: Determine the corresponding sensitive information identification rule according to the sensitive information type.

[0098] It is understandable that corresponding sensitive information identification rules can be set in advance for sensitive information types.

[0099] As an example, assuming that the sensitive information type is an ID card number, the corresponding sensitive information identification rules include the regular expression of the ID card number, for example, the regular expression of the ID card number is [0-9]{6}19[0-9]{10}|[0-9]{6}200[0-9]{9}; assuming that the sensitive information type is a bank card number, the corresponding sensitive information identification rules include the regular expression of the bank card number, for example, the regular expression of the ID card number is 62[0-9]{13}|62[0-9]{17}.

[0100] Step S304: for any transaction interface traffic data, match the transaction interface traffic data with the sensitive information identification rule to determine whether the transaction interface traffic data includes sensitive information corresponding to the sensitive information type.

[0101] Optionally, for any transaction interface traffic data, the request message and / or response message in the transaction interface traffic data is detected according to the sensitive information identification rule to obtain a detection result; when the detection result indicates that the request message and / or response message in the transaction interface traffic data includes sensitive information that matches the sensitive information type, the transaction interface traffic data is determined to be the target sensitive traffic data; when the detection result indicates that the total request message and / or response message of the transaction interface traffic data does not include sensitive information that matches the sensitive information type, it is determined that the transaction interface traffic data is not the target sensitive traffic data. Thus, with the help of the detection result of the message, it is accurately determined whether the transaction interface traffic data is the target sensitive traffic data.

[0102] Step S305, in response to the transaction interface traffic data including sensitive information corresponding to the sensitive information type, determining that the transaction interface traffic data is target sensitive traffic data.

[0103] Step S306: extract at least one target segment value matching the target key field segment name from each target sensitive traffic data according to the target key field segment name.

[0104] Step S307: for any target segment value, analyze the target sensitive traffic data containing the target segment value to determine whether the target segment value satisfies the target information leakage identification rule.

[0105] It should be noted that the execution process of step S307 may refer to the execution process of any embodiment of the present disclosure and is not limited here.

[0106] Optionally, for any target segment value, target sensitive information corresponding to the sensitive information type is extracted from the target sensitive traffic data containing the target segment value, and the target sensitive information is deduplicated; based on the deduplicated target sensitive information, it is determined whether the target segment value meets the target information leakage identification rules.

[0107] As an example, it is possible to determine whether the target segment value satisfies the target information leakage identification rule based on the target number of the target sensitive information after deduplication, where the target information leakage identification rule is:

[0108] The target quantity is greater than the first set value.

[0109] Among them, the first setting value is pre-set, and the present disclosure does not limit its value.

[0110] As an example, when the sensitive information type is an ID card number, assuming that the target key field segment name is device ID, the first setting value is 5. For any target segment value that matches the target key field segment name device ID, the ID card number is extracted from the target sensitive traffic data containing the target segment value, and the ID card number is deduplicated. When the target number of deduplicated ID card numbers is greater than 5, the target segment value is determined, that is, the device ID meets the target information leakage identification rule; assuming that the target key field segment name is session ID, the first setting value is 2. For any target segment value that matches the session ID, that is, for any session ID, the ID card number is extracted from the target sensitive traffic data containing the target segment value. The ID card number is extracted from the target sensitive traffic data of the segment value, and the ID card number is deduplicated. When the target number of deduplicated ID card numbers is greater than 2, the target segment value is determined, that is, the device ID meets the target information leakage identification rule; assuming that the target key field segment name is transaction account, the first setting value is 2, for any target segment value matching the transaction account, that is, for any transaction account, the ID card number is extracted from the target sensitive traffic data containing the target segment value, and the ID card number is deduplicated. When the target number of deduplicated ID card numbers is greater than 2, the target segment value is determined, that is, the transaction account meets the target information leakage identification rule.

[0111] As another example, the number of target interfaces involved in the target segment value may be determined based on the target sensitive traffic data containing the target segment value, and whether the target segment value satisfies the target information leakage identification rule may be determined based on the number of target interfaces and the target number of target sensitive information after deduplication, wherein the target information leakage identification rule is:

[0112] The target quantity is greater than the first set value, and the target interface quantity is greater than the second set value.

[0113] Among them, the second setting value is pre-set, and the present disclosure does not limit its value.

[0114] As an example, when the sensitive information type is an ID card number, assuming that the target key field is IP, the first setting value is 5 and the second setting value is 50. For any target segment value that matches the target key field segment name IP, the ID card number is extracted from the target sensitive traffic data containing the target segment value, and the ID card number is deduplicated. Based on the target sensitive traffic data containing the target segment value, the number of target interfaces involved in the target segment value is determined. When the target number of deduplicated ID card numbers is greater than 50 and the number of target interfaces is greater than 5, it is determined that the IP meets the target information leakage identification rules.

[0115] It should be noted that the above examples of the first setting value and the second setting value are only exemplary, and in practical applications, they may be other.

[0116] In this way, sensitive information is effectively extracted from the target sensitive traffic data, and in order to avoid duplicate counting or false alarms, the obtained sensitive information is deduplicated, making subsequent judgments more accurate.

[0117] Step S308, in response to the target segment value satisfying the target information leakage identification rule, the sensitive information matching the sensitive information type in the target sensitive traffic data containing the target segment value is determined as information with information leakage risk on the current date.

[0118] It should be noted that the execution process of step S306 and step S308 can refer to the execution process of any embodiment of the present disclosure and is not limited here.

[0119] The information leakage risk identification method of the disclosed embodiment determines the corresponding sensitive information identification rules according to the sensitive information type; matches the transaction interface flow data with the sensitive information identification rules for any transaction interface flow data to determine whether the transaction interface flow data includes sensitive information corresponding to the sensitive information type; in response to the transaction interface flow data including sensitive information corresponding to the sensitive information type, determines the transaction interface flow data as target sensitive flow data. Thus, the transaction interface flow data is screened by relying on the sensitive information identification rules.

[0120] In order to clearly explain how to determine the target information leakage identification rules according to the target key fields and sensitive information types in any of the above embodiments of the present disclosure, the present disclosure also proposes an information leakage risk identification method.

[0121] Figure 4 It is a flowchart of the information leakage risk identification method shown in the fourth embodiment of the present disclosure.

[0122] like Figure 4 As shown, based on the previous embodiment of the present disclosure, the information leakage risk identification method may further include the following steps S401-S403.

[0123] Step S401, obtaining the first information leakage identification rule used before the current date according to the target key field segment name and sensitive information type.

[0124] It is understandable that before the current date, the first information leakage identification rule can be adopted.

[0125] For example, in the date before the current date, the corresponding information leakage identification rule is determined and adopted according to the target key field and the sensitive information type, and the information leakage identification rule is determined as the first information leakage identification rule.

[0126] Step S402: Obtain the false alarm rate and the rejection rate of the first information leakage identification rule.

[0127] As an example, a first annotation can be made to information with information leakage risk identified by the first information leakage identification rule manually or by using a trained risk information annotation model, wherein the first annotation can indicate whether it is a false alarm, and a second annotation can be made to information with information leakage risk not identified by the first information leakage identification rule, thereby determining the false alarm rate based on the first annotation, and determining the rejection rate based on the second annotation.

[0128] Step S403: updating the first information leakage identification rule according to at least one of the false alarm rate, the rejection rate and the current date to obtain the target information leakage identification rule.

[0129] It is understandable that similar transaction volumes may be generated on the same day in two statistical periods. For example, similar transaction peaks may be generated on the xx festival every year. Therefore, in the present disclosure, the first information leakage identification rule can be updated according to at least one of the false alarm rate, the rejection rate and the current date, thereby obtaining the target information leakage identification rule.

[0130] As an example, according to the false alarm rate, the first information leakage identification rule is updated to obtain the target information leakage identification rule. For example, assuming that the false alarm rate is greater than the second set threshold (for example, 30%), and the false alarm rate is less than 50%, indicating that the error rate is high, the first information leakage identification rule is: the transaction volume on the current date is greater than 2 times the historical average daily transaction volume, and the transaction volume on the current date is greater than 30, and the transaction volume on the current date is greater than the transaction volume on the same day last week, the first information leakage identification rule is updated, and the first information leakage identification rule is updated to: the transaction volume on the current date is greater than 2.5 times the historical average daily transaction volume, and the transaction volume on the current date is greater than 50, and the transaction volume on the current date is greater than 2 times the transaction volume on the same day last week.

[0131] The information leakage risk identification method of the disclosed embodiment obtains the first information leakage identification rule used before the current date according to the target key field segment name and sensitive information type; obtains the false alarm rate and rejection rate of the first information leakage identification rule; updates the first information leakage identification rule according to at least one of the false alarm rate, the rejection rate and the current date to obtain the target information leakage identification rule. Thus, based on at least one of the false alarm rate, the rejection rate and the current date, the first information leakage identification rule is updated, the target information leakage identification rule is effectively obtained, and the required target information leakage identification rule is constructed by effectively combining business needs and historical experience.

[0132] With the above Figures 1 to 4Corresponding to the information leakage risk identification method provided in the embodiment, the present disclosure also provides an information leakage risk identification device. Figures 1 to 4 The information leakage risk identification method provided in the embodiment corresponds to the information leakage risk identification method, so the implementation method of the information leakage risk identification method is also applicable to the information leakage risk identification device provided in the embodiment of the present disclosure, and will not be described in detail in the embodiment of the present disclosure.

[0133] Figure 5 It is a structural diagram of an information leakage risk identification device shown in the fifth embodiment of the present disclosure.

[0134] Reference Figure 5 The information leakage risk identification device 500 may include: a first determination module 501, a second determination module 502, a screening module 503, an extraction module 504, an analysis module 505, and a third determination module 506.

[0135] Among them, the first determination module 501 is used to determine the corresponding target key field segment name according to the type of sensitive information to be identified.

[0136] The second determination module 502 is used to determine the target information leakage identification rule according to the target key field segment name and the sensitive information type.

[0137] The screening module 503 is used to screen multiple transaction interface traffic data of the current date according to the sensitive information type to obtain at least one target sensitive traffic data.

[0138] The extraction module 504 is used to extract at least one target segment value matching the target key field segment name from each target sensitive traffic data according to the target key field segment name.

[0139] The analysis module 505 is used to analyze the target sensitive traffic data containing the target segment value for any target segment value to determine whether the target segment value satisfies the target information leakage identification rule.

[0140] The third determination module 506 is used to determine the sensitive information matching the sensitive information type in the target sensitive traffic data containing the target segment value as information with information leakage risk in the current date in response to the target segment value satisfying the target information leakage identification rule.

[0141] In a possible implementation of the embodiment of the present disclosure, the target key field segment name includes a key field segment name group consisting of a channel, a transaction code, and a sensitive information type; the analysis module 505 is used to: for any group of target segment values ​​corresponding to the key field segment name group, obtain historical sensitive traffic data containing the target segment value; perform a first statistical analysis on the historical sensitive traffic data to obtain corresponding first transaction information; perform a second statistical analysis on the target sensitive traffic data containing the target segment value to obtain corresponding second transaction information; compare the first transaction information and the second transaction information to determine whether the target segment value meets the target information leakage identification rule.

[0142] In a possible implementation of the embodiment of the present disclosure, the first transaction information includes the average daily transaction volume, the maximum daily transaction volume, and the target transaction volume on a set date before the current date, and the second transaction information includes the first transaction volume on the current date; the target information leakage identification rule includes at least one of the following conditions:

[0143] The first transaction volume is greater than the first set multiple of the average daily transaction volume;

[0144] The first transaction volume is greater than a first set threshold;

[0145] The first transaction volume is greater than the maximum daily transaction volume by the second set multiple;

[0146] The first transaction volume is greater than the target transaction volume by a third set multiple.

[0147] In a possible implementation of the embodiment of the present disclosure, the analysis module 505 is used to: for any target segment value, extract the target sensitive information corresponding to the sensitive information type from the target sensitive traffic data containing the target segment value, and deduplicate the target sensitive information; based on the deduplicated target sensitive information, determine whether the target segment value meets the target information leakage identification rules.

[0148] In a possible implementation of the embodiment of the present disclosure, the screening module 503 is used to: determine the corresponding sensitive information identification rule according to the sensitive information type; for any transaction interface traffic data, match the transaction interface traffic data with the sensitive information identification rule to determine whether the transaction interface traffic data includes sensitive information corresponding to the sensitive information type; in response to the transaction interface traffic data including sensitive information corresponding to the sensitive information type, determine that the transaction interface traffic data is target sensitive traffic data.

[0149] In a possible implementation of the embodiment of the present disclosure, the screening module 503 is used to: for any transaction interface traffic data, detect the request message and / or response message in the transaction interface traffic data according to the sensitive information identification rule to obtain a detection result; in response to the detection result indicating that the request message and / or response message in the transaction interface traffic data includes sensitive information matching the sensitive information type, determine that the transaction interface traffic data is target sensitive traffic data.

[0150] In a possible implementation of the embodiment of the present disclosure, the second determination module 502 is used to: obtain the first information leakage identification rule adopted before the current date according to the target key field segment name and sensitive information type; obtain the false alarm rate and rejection rate of the first information leakage identification rule; update the first information leakage identification rule according to at least one of the false alarm rate, the rejection rate and the current date to obtain the target information leakage identification rule.

[0151] The information leakage risk identification device of the disclosed embodiment determines the corresponding target key field segment name according to the sensitive information type to be identified; determines the target information leakage identification rule according to the target key field segment name and the sensitive information type; screens multiple transaction interface flow data of the current date according to the sensitive information type to obtain at least one target sensitive flow data; extracts at least one target segment value matching the target key field from each target sensitive flow data according to the target key field segment name; for any target segment value, analyzes the target sensitive flow data containing the target segment value to determine whether the target segment value satisfies the target information leakage identification rule; in response to the target segment value satisfying the target information leakage identification rule, the sensitive information matching the sensitive information type in the target sensitive flow data containing the target segment value is determined as the information with information leakage risk in the current date. Thus, the target key field to be identified in the transaction interface flow data can be automatically determined based on the sensitive information type, and then the required target information leakage identification rule can be automatically determined based on the target key field segment name and the sensitive information type, so as to automatically determine whether there is information with information leakage risk and matching the sensitive information type in the transaction interface flow data of the current date, without consuming a lot of human resources and time costs.

[0152] In an exemplary embodiment, an electronic device is also provided.

[0153] Among them, electronic equipment includes:

[0154] processor;

[0155] a memory for storing processor-executable instructions;

[0156] Among them, the processor is configured to execute instructions to implement the information leakage risk identification method proposed in the aforementioned first aspect embodiment.

[0157] As an example, Figure 6 is a schematic diagram of the structure of an electronic device 600 shown in an exemplary embodiment of the present disclosure, such as Figure 6 As shown, the electronic device 600 may further include:

[0158] The memory 610 and the processor 620, a bus 630 connecting different components (including the memory 610 and the processor 620), the memory 610 stores a computer program, and when the processor 620 executes the program, the information leakage risk identification method described in the embodiment of the first aspect of the present disclosure is implemented.

[0159] Bus 630 represents one or more of several types of bus structures, including a memory bus or memory controller, a peripheral bus, an accelerated graphics port, a processor or a local bus using any of a variety of bus architectures. By way of example, these architectures include, but are not limited to, an Industry Standard Architecture (ISA) bus, a Micro Channel Architecture (MAC) bus, an Enhanced ISA bus, a Video Electronics Standards Association (VESA) local bus, and a Peripheral Component Interconnect (PCI) bus.

[0160] The electronic device 600 typically includes a variety of electronic device readable media. These media can be any available media that can be accessed by the electronic device 600, including volatile and non-volatile media, removable and non-removable media.

[0161] The memory 610 may also include computer system readable media in the form of volatile memory, such as random access memory (RAM) 640 and / or cache memory 650. The server 600 may further include other removable / non-removable, volatile / non-volatile computer system storage media. By way of example only, the storage system 660 may be used to read and write non-removable, non-volatile magnetic media ( Figure 6 not shown, usually called a "hard drive"). Although Figure 6 Not shown, a disk drive for reading and writing to a removable non-volatile disk (e.g., a "floppy disk"), and an optical disk drive for reading and writing to a removable non-volatile optical disk (e.g., a CD-ROM, a DVD-ROM, or other optical media) may be provided. In these cases, each drive may be connected to the bus 630 via one or more data medium interfaces. The memory 610 may include at least one program product having a set (e.g., at least one) of program modules that are configured to perform the functions of the various embodiments of the present disclosure.

[0162] A program / utility 680 having a set (at least one) of program modules 670 may be stored, for example, in the memory 610, such program modules 670 including, but not limited to, an operating system, one or more application programs, other program modules, and program data, each of which or some combination may include an implementation of a network environment. The program modules 670 generally perform the functions and / or methods of the embodiments described in the present disclosure.

[0163] The electronic device 600 may also communicate with one or more external devices 690 (e.g., keyboard, pointing device, display 691, etc.), may also communicate with one or more devices that enable a user to interact with the electronic device 600, and / or communicate with any device that enables the electronic device 600 to communicate with one or more other computing devices (e.g., network card, modem, etc.). Such communication may be performed via an input / output (I / O) interface 692. Furthermore, the electronic device 600 may also communicate with one or more networks (e.g., local area network (LAN), wide area network (WAN) and / or public network, such as the Internet) via a network adapter 693. As shown, the network adapter 693 communicates with other modules of the electronic device 600 via a bus 630. It should be understood that, although not shown in the figure, other hardware and / or software modules may be used in conjunction with the electronic device 600, including but not limited to: microcode, device drivers, redundant processing units, external disk drive arrays, RAID systems, tape drives, and data backup storage systems.

[0164] The processor 620 executes various functional applications and data processing by running the programs stored in the memory 610 .

[0165] It should be noted that the implementation process and technical principles of the electronic device of this embodiment refer to the aforementioned explanation of the information leakage risk identification method of the first aspect of the present disclosure, and will not be repeated here.

[0166] In an exemplary embodiment, a computer-readable storage medium including instructions is also provided, such as a memory including instructions, and the above instructions can be executed by a processor of an electronic device to complete the method proposed in any of the above embodiments. Optionally, the computer-readable storage medium can be a ROM, a random access memory (RAM), a CD-ROM, a magnetic tape, a floppy disk, an optical data storage device, etc.

[0167] In an exemplary embodiment, a computer program product is also provided, including a computer program / instruction, wherein the computer program / instruction implements the method proposed in any of the above embodiments when executed by a processor.

[0168] Those skilled in the art will readily appreciate other embodiments of the present disclosure after considering the specification and practicing the invention disclosed herein. The present disclosure is intended to cover any variations, uses or adaptations of the present disclosure that follow the general principles of the present disclosure and include common knowledge or customary techniques in the art that are not disclosed in the present disclosure. The description and examples are to be considered exemplary only, and the true scope and spirit of the present disclosure are indicated by the following claims.

[0169] It should be understood that the present disclosure is not limited to the exact structures that have been described above and shown in the drawings, and that various modifications and changes may be made without departing from the scope thereof. The scope of the present disclosure is limited only by the appended claims.

Claims

1. A method for identifying information leakage risks, characterized in that: The method comprises: Determine the corresponding target key field segment name according to the type of sensitive information to be identified; Determining target information leakage identification rules according to the target key field segment name and the sensitive information type; According to the sensitive information type, multiple transaction interface traffic data of the current date are screened to obtain at least one target sensitive traffic data; According to the target key field segment name, extract at least one target segment value matching the target key field segment name from each target sensitive traffic data; For any of the target segment values, analyzing the target sensitive traffic data containing the target segment value to determine whether the target segment value satisfies the target information leakage identification rule; In response to the target segment value satisfying the target information leakage identification rule, sensitive information matching the sensitive information type in the target sensitive traffic data containing the target segment value is determined as information with information leakage risk on the current date.

2. The method according to claim 1, characterized in that The target key field segment name includes a key field segment name group consisting of channel, transaction code, and sensitive information type; For any of the target segment values, analyzing the target sensitive traffic data containing the target segment value to determine whether the target segment value satisfies the target information leakage identification rule includes: For any group of the target segment values ​​corresponding to the key field segment name group, obtaining historical sensitive traffic data containing the target segment value; Performing a first statistical analysis on the historical sensitive traffic data to obtain corresponding first transaction information; Performing a second statistical analysis on the target sensitive traffic data including the target segment value to obtain corresponding second transaction information; The first transaction information and the second transaction information are compared to determine whether the target segment value satisfies the target information leakage identification rule.

3. The method according to claim 2, characterized in that The first transaction information includes the average daily transaction volume, the maximum daily transaction volume, and the target transaction volume on a set date before the current date; the second transaction information includes the first transaction volume on the current date; and the target information leakage identification rule includes at least one of the following conditions: The first transaction volume is greater than the average daily transaction volume by a first set multiple; The first transaction volume is greater than a first set threshold; The first transaction volume is greater than the maximum single-day transaction volume by a second set multiple; The first transaction volume is greater than the target transaction volume by a third set multiple.

4. The method according to claim 1, characterized in that: For any of the target segment values, analyzing the target sensitive traffic data containing the target segment value to determine whether the target segment value satisfies the target information leakage identification rule includes: For any of the target segment values, extract target sensitive information corresponding to the sensitive information type from the target sensitive traffic data containing the target segment value, and perform deduplication processing on the target sensitive information; Based on the deduplicated target sensitive information, determine whether the target segment value satisfies the target information leakage identification rule.

5. The method according to claim 1, characterized in that The filtering of multiple transaction interface flow data of the current date according to the sensitive information type to obtain at least one target sensitive flow data includes: Determine corresponding sensitive information identification rules according to the sensitive information type; For any of the transaction interface traffic data, matching the transaction interface traffic data with the sensitive information identification rule to determine whether the transaction interface traffic data includes sensitive information corresponding to the sensitive information type; In response to the transaction interface traffic data including sensitive information corresponding to the sensitive information type, the transaction interface traffic data is determined to be the target sensitive traffic data.

6. The method according to claim 5, characterized in that The step of matching any of the transaction interface traffic data with the sensitive information identification rule to determine whether the transaction interface traffic data includes sensitive information corresponding to the sensitive information type includes: For any of the transaction interface traffic data, detecting the request message and / or the response message in the transaction interface traffic data according to the sensitive information identification rule to obtain a detection result; In response to the detection result indicating that the request message and / or the response message in the transaction interface traffic data includes sensitive information matching the sensitive information type, the transaction interface traffic data is determined to be the target sensitive traffic data.

7. The method according to any one of claims 1 to 6, characterized in that: The determining of target information leakage identification rules according to the target key field segment name and the sensitive information type includes: According to the target key field segment name and the sensitive information type, obtaining a first information leakage identification rule used before the current date; Obtaining a false alarm rate and a rejection rate of the first information leakage identification rule; The first information leakage identification rule is updated according to at least one of the false alarm rate, the rejection rate and the current date to obtain the target information leakage identification rule.

8. An information leakage risk identification device, characterized in that: The device comprises: A first determination module is used to determine the corresponding target key field segment name according to the type of sensitive information to be identified; A second determination module is used to determine a target information leakage identification rule according to the target key field segment name and the sensitive information type; A screening module, used to screen multiple transaction interface flow data of the current date according to the sensitive information type to obtain at least one target sensitive flow data; An extraction module, configured to extract at least one target segment value matching the target key field segment name from each target sensitive traffic data according to the target key field segment name; An analysis module, for analyzing, for any of the target segment values, target sensitive traffic data containing the target segment value to determine whether the target segment value satisfies the target information leakage identification rule; The third determination module is used to determine the sensitive information matching the sensitive information type in the target sensitive traffic data containing the target segment value as information with information leakage risk on the current date in response to the target segment value satisfying the target information leakage identification rule.

9. The device according to claim 8, characterized in that The target key field segment name includes a key field segment name group consisting of channel, transaction code, and sensitive information type; the analysis module is used to: For any group of the target segment values ​​corresponding to the key field segment name group, obtaining historical sensitive traffic data containing the target segment value; Performing a first statistical analysis on the historical sensitive traffic data to obtain corresponding first transaction information; Performing a second statistical analysis on the target sensitive traffic data including the target segment value to obtain corresponding second transaction information; The first transaction information and the second transaction information are compared to determine whether the target segment value satisfies the target information leakage identification rule.

10. The device according to claim 9, characterized in that The first transaction information includes the average daily transaction volume, the maximum daily transaction volume, and the target transaction volume on a set date before the current date; the second transaction information includes the first transaction volume on the current date; and the target information leakage identification rule includes at least one of the following conditions: The first transaction volume is greater than the average daily transaction volume by a first set multiple; The first transaction volume is greater than a first set threshold; The first transaction volume is greater than the maximum single-day transaction volume by a second set multiple; The first transaction volume is greater than the target transaction volume by a third set multiple.

11. The device according to claim 8, characterized in that The analysis module is used to: For any of the target segment values, extract target sensitive information corresponding to the sensitive information type from the target sensitive traffic data containing the target segment value, and perform deduplication processing on the target sensitive information; Based on the deduplicated target sensitive information, determine whether the target segment value satisfies the target information leakage identification rule.

12. The device according to claim 8, characterized in that The screening module is used to: Determine corresponding sensitive information identification rules according to the sensitive information type; For any of the transaction interface traffic data, matching the transaction interface traffic data with the sensitive information identification rule to determine whether the transaction interface traffic data includes sensitive information corresponding to the sensitive information type; In response to the transaction interface traffic data including sensitive information corresponding to the sensitive information type, the transaction interface traffic data is determined to be the target sensitive traffic data.

13. The device according to claim 12, characterized in that The screening module is used to: For any of the transaction interface traffic data, detecting the request message and / or the response message in the transaction interface traffic data according to the sensitive information identification rule to obtain a detection result; In response to the detection result indicating that the request message and / or the response message in the transaction interface traffic data includes sensitive information matching the sensitive information type, the transaction interface traffic data is determined to be the target sensitive traffic data.

14. The device according to any one of claims 8 to 13, characterized in that: The second determining module is used to: According to the target key field segment name and the sensitive information type, obtaining a first information leakage identification rule used before the current date; Obtaining a false alarm rate and a rejection rate of the first information leakage identification rule; The first information leakage identification rule is updated according to at least one of the false alarm rate, the rejection rate and the current date to obtain the target information leakage identification rule.

15. An electronic device, characterized in that: include: A processor, and a memory communicatively connected to the processor; The memory stores computer-executable instructions; The processor executes the computer-executable instructions stored in the memory to implement the method according to any one of claims 1 to 7.

16. A computer readable medium, characterized in that The computer-readable medium stores computer-executable instructions, which are used to implement the method according to any one of claims 1 to 7 when executed by a processor.

17. A computer program product, characterized in that The invention comprises a computer program, which implements the method according to any one of claims 1 to 7 when being executed by a processor.

Images