Sensitive data anomaly cross-border detection method and system based on flow analysis

Abstract

The invention relates to a sensitive data exception cross-border detection method and system based on flow analysis, and the method comprises the steps: obtaining a plurality of to-be-detected target flow sessions; analyzing each target flow session through a dynamic risk assessment model, and performing risk assessment based on the risk score of the report information, the risk score based on the historical behavior and a comprehensive risk assessment rule matched according to the current service scene to obtain a risk value; the dynamic risk assessment model is dynamically adjusted according to data flow behavior; and when it is detected that the risk value corresponding to the target stream session exceeds a preset risk threshold, triggering real-time early warning. Through application of the method and the device, the problem that sensitive data is misreported or misreported due to the fact that an existing detection method is difficult to dynamically adapt to the change of the data flow in a complex scene of cross-border data flow is solved, the change of the data flow is dynamically adapted to the complex scene of cross-border data flow, and the sensitive data is prevented from being misreported or misreported.

Description

Technical Field

[0001] The present application relates to the field of data security, and in particular to a method and system for cross-border detection of abnormalities in sensitive data based on traffic analysis. Background Art

[0002] The cross-border flow of data has become a major hub of global economic activities. A large amount of sensitive data such as personal information, location navigation, medical health, etc. is circulated with the development of cross-border business. Based on this, higher requirements are placed on the security of sensitive data going abroad.

[0003] In existing data detection methods, they usually rely on predefined rule bases to match specific data fields such as personal information and financial information, and determine whether to trigger an alert based on the rules. However, the above methods lack dynamic adaptability, that is, it is difficult to dynamically adapt to changes in data flows in complex scenarios of cross-border data flows, resulting in false positives and negatives of sensitive data.

[0004] Currently, no effective solution has been proposed to address the problem that existing detection methods in relevant technologies are difficult to dynamically adapt to changes in data flows in complex scenarios of cross-border data flow, resulting in false positives and omissions of sensitive data. Summary of the invention

[0005] In this embodiment, a method and system for detecting abnormal cross-border sensitive data based on traffic analysis are provided to solve the problem that the existing detection methods in the related art are difficult to dynamically adapt to the changes in data flow in complex scenarios of cross-border data flow, resulting in false positives and negative negatives of sensitive data. Among them, the key problem to be solved in this embodiment is to monitor the illegal cross-border transmission of sensitive data by the inbound and outbound traffic data packets at the outbound gateway, and to implement the risk assessment of multiple types of sensitive data outbound transmission violations, such as the active transmission of sensitive data by the domestic data provider to the overseas receiving terminal and the request of sensitive data by the overseas receiving terminal to the domestic data provider.

[0006] In a first aspect, a method for detecting abnormal cross-border sensitive data based on traffic analysis is provided in this embodiment, and the method includes: Acquire multiple target flow sessions to be detected; Performing real-time analysis on each target stream session through a dynamic risk assessment model to obtain a risk value corresponding to the target stream session; the dynamic risk assessment model is dynamically adjusted according to the data stream behavior; Among them, the real-time analysis process of the dynamic risk assessment model includes: obtaining the exit reporting information corresponding to the target stream session; determining the first risk score of the target stream session based on the multi-dimensional transmission risk characteristics in the exit reporting information and the risk assessment rules matching the target stream session; detecting whether the timing transmission behavior of the target stream session deviates from the historical behavior baseline based on the historical behavior baseline model matching the target stream session, and calculating the error between the real-time input data and the historical data based on the detection result to obtain the second risk score; based on the first risk score and the second risk score, performing risk assessment on the target stream session through the comprehensive risk assessment rules matching the target stream session to obtain the corresponding risk value; When it is detected that the risk value corresponding to the target stream session exceeds a preset risk threshold, a real-time warning is triggered.

[0007] In some embodiments, obtaining a real-time target streaming session includes: Get raw network traffic in real time; Based on a preset screening rule, screening out a first data flow in the original network traffic; The first data stream is processed to obtain a corresponding plurality of the target stream sessions.

[0008] In some embodiments, the processing of the first data stream to obtain the corresponding plurality of target stream sessions includes: Performing multi-layer protocol parsing on the first data stream to obtain parsing results corresponding to different data packets in the first data stream; According to the analysis result, determining a plurality of the data packets belonging to the same streaming session; Aggregate the data packets belonging to the same streaming session to obtain the corresponding target streaming session.

[0009] In some embodiments, the dynamic risk assessment model is dynamically adjusted according to the data flow behavior, including: Acquire data flow behavior; the data flow behavior includes data flow path and data flow characteristics; According to different data transmission modes and in combination with the data flow behavior, the risk assessment rules in the dynamic risk assessment model are dynamically adjusted.

[0010] In some of the embodiments, after performing real-time analysis on each target streaming session using a dynamic risk assessment model to obtain a risk value corresponding to the target streaming session, the method further includes: When it is detected that the risk value corresponding to the target streaming session exceeds the preset risk threshold, adding a risk mark to the target streaming session; According to the marking information of the risk marking, the corresponding internal routing strategy is called to perform flow control.

[0011] In some of the embodiments, after performing real-time analysis on each target streaming session using a dynamic risk assessment model to obtain a risk value corresponding to the target streaming session, the method further includes: Storing the risk value and traffic log information corresponding to each target flow session in a preset database; Based on the stored data in the preset database, a corresponding real-time traffic monitoring view is generated for visual display.

[0012] In a second aspect, a system for detecting abnormal cross-border sensitive data based on traffic analysis is provided in this embodiment, and the system includes: a risk collection module, a risk assessment module, and a risk warning module; The risk collection module is used to obtain multiple target flow sessions to be detected; The risk assessment module is used to perform real-time analysis on each target stream session through a dynamic risk assessment model to obtain a risk value corresponding to the target stream session; the dynamic risk assessment model is dynamically adjusted according to the data stream behavior; The risk assessment module is further used to obtain the exit reporting information corresponding to the target streaming session; determine the first risk score of the target streaming session based on the multi-dimensional transmission risk characteristics in the exit reporting information and the risk assessment rules matching the target streaming session; detect whether the timing transmission behavior of the target streaming session deviates from the historical behavior baseline based on the historical behavior baseline model matching the target streaming session, and calculate the error between the real-time input data and the historical data based on the detection result to obtain the second risk score; based on the first risk score and the second risk score, perform risk assessment on the target streaming session through the comprehensive risk assessment rules matching the target streaming session to obtain the corresponding risk value; The risk warning module is used to trigger a real-time warning when it is detected that the risk value corresponding to the target stream session exceeds a preset risk threshold.

[0013] In a third aspect, a computer device is provided in this embodiment, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the computer program, the method for detecting cross-border abnormalities of sensitive data based on traffic analysis as described in the first aspect above is implemented.

[0014] In a fourth aspect, a storage medium is provided in this embodiment, on which a computer program is stored, and when the program is executed by a processor, the method for detecting cross-border abnormalities of sensitive data based on traffic analysis as described in the first aspect above is implemented.

[0015] Compared with the related art, the abnormal cross-border detection method and system for sensitive data based on traffic analysis provided in this embodiment obtains multiple target flow sessions to be detected; performs real-time analysis on each target flow session through a dynamic risk assessment model to obtain a risk value corresponding to the target flow session; the dynamic risk assessment model is dynamically adjusted according to the data flow behavior; wherein the real-time analysis process of the dynamic risk assessment model includes: obtaining the outbound reporting information corresponding to the target flow session; determining the first risk score of the target flow session based on the multi-dimensional transmission risk characteristics in the outbound reporting information and the risk assessment rules matching the target flow session; detecting the target flow session according to the historical behavior baseline model matching the target flow session Whether the time transmission behavior of the session deviates from the historical behavior baseline, the error between the real-time input data and the historical data is calculated based on the detection result to obtain a second risk score; based on the first risk score and the second risk score, the target flow session is risk assessed through a comprehensive risk assessment rule that matches the target flow session to obtain a corresponding risk value; when it is detected that the risk value corresponding to the target flow session exceeds the preset risk threshold, a real-time warning is triggered, which solves the problem that the existing detection methods are difficult to dynamically adapt to changes in data flows in complex scenarios of cross-border data flow, resulting in false positives and negatives of sensitive data, and realizes dynamic adaptation to changes in data flows in complex scenarios of cross-border data flow, avoiding false positives and negatives of sensitive data.

[0016] Details of one or more embodiments of the present application are set forth in the following drawings and description to make other features, objects, and advantages of the present application more readily apparent. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] The drawings described herein are used to provide a further understanding of the present application and constitute a part of the present application. The illustrative embodiments of the present application and their descriptions are used to explain the present application and do not constitute an improper limitation on the present application. In the drawings: Figure 1 It is a hardware structure block diagram of a terminal device of a method for detecting abnormal cross-border sensitive data based on traffic analysis provided by an embodiment of the present application; Figure 2 It is a flow chart of a method for detecting abnormal cross-border sensitive data based on traffic analysis provided by an embodiment of the present application; Figure 3 is a flow chart of a method for detecting abnormal cross-border sensitive data based on traffic analysis provided by another embodiment of the present application; Figure 4 It is a flow chart of a method for detecting abnormal cross-border sensitive data based on traffic analysis provided by a preferred embodiment of the present application; Figure 5 This is a structural block diagram of a sensitive data anomaly cross-border detection system based on traffic analysis provided in one embodiment of the present application.

[0018] In the figure: 102, processor; 104, memory; 106, transmission equipment; 108, input and output equipment; 10, 100G network card; 20, risk collection module; 30, Kafka message queue; 40, risk assessment module; 50, P4 switch; 60, network bridge; 70, risk warning module; 80, data storage module; 90, visualization module. DETAILED DESCRIPTION

[0019] In order to more clearly understand the purpose, technical solutions and advantages of the present application, the present application is described and illustrated below in conjunction with the accompanying drawings and embodiments.

[0020] Unless otherwise defined, the technical terms or scientific terms involved in this application shall have the general meaning understood by people with general skills in the technical field to which this application belongs. The words "one", "a", "the", "these" and the like in this application do not indicate a quantitative limitation, and they may be singular or plural. The terms "include", "comprise", "have" and any variants thereof involved in this application are intended to cover non-exclusive inclusions; for example, a process, method and system, product or device comprising a series of steps or modules (units) is not limited to the listed steps or modules (units), but may include unlisted steps or modules (units), or may include other steps or modules (units) inherent to these processes, methods, products or devices. The words "connect", "connected", "coupled" and the like involved in this application are not limited to physical or mechanical connections, but may include electrical connections, whether direct or indirect. The "multiple" involved in this application refers to two or more. "And / or" describes the association relationship of associated objects, indicating that there may be three relationships, for example, "A and / or B" may mean: A exists alone, A and B exist at the same time, and B exists alone. Generally, the character " / " indicates that the objects associated with each other are in an "or" relationship. The terms "first", "second", "third", etc. in this application are only used to distinguish similar objects and do not represent a specific ordering of the objects.

[0021] The method embodiment provided in this embodiment can be executed in a terminal, a computer or a similar computing device. For example, running on a terminal, Figure 1 is a hardware structure block diagram of a terminal of the abnormal cross-border detection method of sensitive data based on traffic analysis in this embodiment. Figure 1 As shown, the terminal may include one or more ( Figure 1Only one is shown in the figure) a processor 102 and a memory 104 for storing data, wherein the processor 102 may include but is not limited to a processing device such as a microprocessor MCU or a programmable logic device FPGA. The above terminal may also include a transmission device 106 and an input and output device 108 for communication functions. It can be understood by those skilled in the art that Figure 1 The structure shown is only for illustration and does not limit the structure of the above terminal. Figure 1 More or fewer components as shown, or with Figure 1 Different configurations shown.

[0022] The memory 104 can be used to store computer programs, for example, software programs and modules of application software, such as the computer program corresponding to the abnormal cross-border detection method of sensitive data based on traffic analysis in this embodiment. The processor 102 executes various functional applications and data processing by running the computer program stored in the memory 104, that is, to implement the above method. The memory 104 may include a high-speed random access memory, and may also include a non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory 104 may further include a memory remotely arranged relative to the processor 102, and these remote memories may be connected to the terminal via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0023] The transmission device 106 is used to receive or send data via a network. The above network includes a wireless network provided by a communication provider of the terminal. In one example, the transmission device 106 includes a network adapter (Network Interface Controller, referred to as NIC), which can be connected to other network devices through a base station so as to communicate with the Internet. In one example, the transmission device 106 can be a radio frequency (Radio Frequency, referred to as RF) module, which is used to communicate with the Internet wirelessly.

[0024] In this embodiment, a method for detecting abnormal cross-border sensitive data based on traffic analysis is provided. Figure 2 is a flow chart of the abnormal cross-border detection method of sensitive data based on traffic analysis in this embodiment. Figure 2 As shown, the process includes the following steps: Step S210, obtaining multiple target flow sessions to be detected; Step S220, performing real-time analysis on each target stream session through a dynamic risk assessment model to obtain a risk value corresponding to the target stream session; the dynamic risk assessment model is dynamically adjusted according to the data flow behavior; wherein the real-time analysis process of the dynamic risk assessment model includes: obtaining the exit reporting information corresponding to the target stream session; determining a first risk score of the target stream session based on the multi-dimensional transmission risk characteristics in the exit reporting information and the risk assessment rules matching the target stream session; detecting whether the timing transmission behavior of the target stream session deviates from the historical behavior baseline based on the historical behavior baseline model matching the target stream session, and calculating the error between the real-time input data and the historical data based on the detection result to obtain a second risk score; based on the first risk score and the second risk score, performing risk assessment on the target stream session through the comprehensive risk assessment rules matching the target stream session to obtain a corresponding risk value; Step S230: When it is detected that the risk value corresponding to the target streaming session exceeds a preset risk threshold, a real-time warning is triggered.

[0025] Specifically, the preset network card is installed at the data access point to obtain the original network traffic in real time. The preset network card can be a 100G network card, etc. The network card is configured with preset screening rules for screening and processing the original network traffic, such as filtering based on the target IP and port number to obtain the first data stream, so as to filter out potential sensitive data streams according to the preset traffic characteristics, reduce the analysis process of irrelevant data, and reduce the subsequent processing load. Among them, the 100G network card has the ability to dynamically adjust the traffic screening rules and can give priority to high-frequency IP address traffic. Through the high-speed interface, the data stream fragments filtered by the network card are transmitted to the risk collection module.

[0026] The risk collection module uses the traffic analysis tool to perform multi-layer protocol analysis on the first data stream, obtains the analysis results corresponding to different data packets in the first data stream, and splits the data packets into structured data at the stream session level. The multi-layer protocol analysis includes parsing the protocol layer information such as the Transmission Control Protocol / Internet Protocol (TCP / IP) header and the Hypertext Transfer Protocol (HTTP) content. The analysis process can adopt mechanisms such as fragmentation reorganization or protocol stack decoding. According to the analysis results, multiple data packets belonging to the same stream session are determined, and the data packets belonging to the same stream session are aggregated and denoised to obtain the corresponding target stream session to form a traffic log that meets the preset format requirements. Each target stream session is pre-processed. The risk collection module performs preliminary data outbound business session screening on the target stream session according to preset sensitive data features such as behavioral pattern rules and overseas high-risk area IP lists, and pre-labels for subsequent data anomaly detection. The labels include traffic category, transmission direction, outbound method, and preliminary risk assessment value. The pre-processed traffic is transmitted in batches through the Kafka message queue or other distributed message queues. The risk collection module pushes the traffic to the Kafka message queue according to time sequence and label classification.

[0027] The risk assessment module reads data from the Kafka message queue to obtain multiple target stream sessions to be detected. The dynamic risk assessment model performs real-time analysis on each target stream session to obtain the risk value corresponding to the target stream session. The dynamic risk assessment model is dynamically adjusted based on different data transmission methods and combined with data flow behaviors. Data flow behavior refers to the characteristics and patterns exhibited in the process of data generation, transmission and processing, including data flow paths and data flow characteristics.

[0028] In the dynamic risk assessment model, according to the preset behavior pattern rules and data traffic characteristics, the target flow session is subjected to static rule matching processing to obtain the target data in the target flow session and the risk characteristics of the target data. It should be noted that the data traffic characteristics and the behavior pattern are used to calculate the abnormal risk through a mapping relationship, such as fitting a dynamic threshold based on the distribution of the transmission time interval, and dynamically generating an abnormal risk index in combination with the probability distribution of the historical behavior pattern, and the behavior pattern rule refers to the interactive mode of data transmission, which is composed of multi-dimensional features, including but not limited to the time characteristics and spatial characteristics of data transmission, such as the transmission time interval, the size distribution of data packets, the distribution of protocol types, the duration of the session, etc. Based on the risk characteristics of the target data, the abnormal behavior in the target data is marked by the deep learning model, and based on the marking results, the target data is risk assessed according to the current risk assessment rules to obtain the corresponding risk value, and the corresponding traffic is risk rated according to the size of the risk value, for example, marked as high risk, medium risk and low risk respectively. In this embodiment, a Bayesian scoring model or a Long Short-Term Memory (LSTM) model may be used to perform risk assessment on the target data. For example, the multi-dimensional flow characteristics of the target data may be integrated through the Bayesian scoring model to dynamically calculate the final risk value.

[0029] The above-mentioned deep learning models include a behavioral baseline model based on reported information and a baseline model based on historical behavior. Among them, the behavioral baseline model based on reported information specifically extracts key features of different transmission modes of data packets by performing layered and protocol analysis of the TCP / IP protocol stack on network data packets, thereby formulating different abnormal mode detection rules and obtaining a rule base; based on the rule base, customized regulatory technologies are proposed for different data outbound methods (such as different protocols, different business models, etc.); through a rule-based matching method, the business traffic data packets flowing through the gateway of the institution's main body are analyzed in real time, and the transmission data packets that do not meet the matching rules are screened out, so as to conduct risk warnings based on the reported information, and detect data outbound situations that are inconsistent with the outbound reporting of the institution's main body in terms of outbound methods, scope, type and scale. The baseline model based on historical behavior specifically divides the traffic data into time series segments according to time windows. Each time window contains data features of several moments (such as network packet size and transmission rate at each moment) to prepare the time series data training model; constructs an LSTM autoencoder model, including an encoder and a decoder. The encoder is used to learn the time series features of historical traffic data, and the decoder is used to reconstruct the low-dimensional representation back to the original time series data; the model is trained with the normal business traffic data of the institution to minimize the reconstruction error; the anomaly is judged by calculating the error between the real-time input data and the reconstructed data. If the error is large, it means that the data point deviates from the normal behavior pattern and is judged as abnormal. In this way, risk warnings based on historical behavior are carried out to detect data transmission situations that are inconsistent with the historical business situation of the institution in terms of outbound transmission behavior. In summary, through the two types of risk detection behavior baseline models, a variety of abnormal scenarios are covered, effectively supporting the functional requirements of the overall system for real-time monitoring based on traffic data.

[0030] Based on the behavioral baseline models of the above two risk detection types, more specifically, the real-time analysis process of the dynamic risk assessment model includes: obtaining the outbound reporting information corresponding to the target flow session, and determining the first risk score of the target flow session through the behavioral baseline model based on the reporting information, based on the multi-dimensional transmission risk characteristics in the outbound reporting information and the risk assessment rules matching the target flow session. According to the historical behavioral baseline model matching the target flow session, detect whether the timing transmission behavior of the target flow session deviates from the historical behavioral baseline, and calculate the error between the real-time input data and the historical data based on the detection result to obtain the second risk score. Afterwards, based on the first risk score and the second risk score, the target flow session is comprehensively assessed for risk through the comprehensive risk assessment rules matching the target flow session to obtain the corresponding risk value.

[0031] The risk value corresponding to the target stream session is compared with the preset risk threshold. When it is detected that the risk value corresponding to the target stream session exceeds the preset risk threshold, a corresponding risk tag is added to the target stream session. When the switch receives the risk tag, the corresponding internal routing policy is called to control the flow according to the tag information of the risk tag. Among them, through the customized routing rules, the transmission path of the flow is determined according to the risk level. For the flow marked as high risk, the blocking operation is performed first; the flow marked as medium risk will be rerouted to the isolated network for further analysis; the normal flow is re-encapsulated and passed to the network bridge, which ensures that the legal data is transparently and unimpededly transmitted during the cross-border process, and the abnormal flow will be blocked in real time. It should be noted that seamless data transmission is achieved between the switch and the network bridge, and the abnormal flow processing process is independent of the normal flow to prevent high-risk operations from affecting the overall performance of the system.

[0032] Furthermore, the risk markers are transmitted to the risk warning module, and a detailed security incident report is generated according to the preset template. The report includes traffic source, detection time, risk level, event description, etc. The event information is automatically archived, and a real-time warning is triggered for the traffic with risk markers. The real-time warning is pushed to the management platform or monitoring personnel, and a security incident tracking interface is provided for rapid response and data tracing.

[0033] Afterwards, each risk value and traffic log information are associated and stored in a preset database in the data storage module, where a data retention policy is pre-set, high-risk data is stored first, and low-risk data is archived regularly to save storage space. At the same time, the data storage module supports time series data query, provides a quick query interface, and supports real-time retrieval and historical traceability functions for each stored data, so that users can obtain detailed historical records and risk change trends of data flows. In addition, based on the stored data in the preset database, the corresponding real-time traffic monitoring view is generated for display to show the traffic dynamics, risk marker distribution and abnormal trends of each transmission path. Users can create custom views to observe specific traffic characteristics or risk markers, support multi-dimensional data analysis, and realize automatic monitoring through early warning configuration.

[0034] In existing data detection methods, they usually rely on predefined rule bases to match specific data fields such as personal information and financial information, and determine whether to trigger an alert based on the rules. However, the above methods lack dynamic adaptability, that is, it is difficult to dynamically adapt to changes in data flows in complex scenarios of cross-border data flows, resulting in false positives and negatives of sensitive data.

[0035] Compared with the prior art, the present application obtains multiple target flow sessions to be detected; performs real-time analysis on each target flow session through a dynamic risk assessment model to obtain the risk value corresponding to the target flow session; wherein the dynamic risk assessment model is dynamically adjusted according to the data flow behavior; and triggers a real-time warning when the risk value corresponding to the target flow session is detected to exceed the preset risk threshold. Based on this, the present application introduces an adaptive risk assessment mechanism, which can dynamically adjust the detection strategy according to the characteristics of data flow, thereby improving the flexibility and accuracy of detection, and performs risk assessment based on risk scores based on reporting information, risk scores based on historical behavior, and comprehensive risk assessment rules matched according to the current business scenario, solving the problem that the existing detection methods are difficult to dynamically adapt to changes in data flows in complex scenarios of cross-border data flow, resulting in false positives and negatives of sensitive data, and realizing dynamic adaptation to changes in data flows in complex scenarios of cross-border data flow, avoiding false positives and negatives of sensitive data, and effectively avoiding the high reliance on plaintext transmission of data, and performing risk assessment from the perspective of data transmission behavior, which can cover more scenarios of cross-border data transmission violations.

[0036] Moreover, in the current reality of massive data being transmitted using encryption, the abnormal cross-border detection method for sensitive data based on traffic analysis in this application innovatively proposes to conduct violation detection on the cross-border transmission and flow of traffic without relying on the plaintext content of the transmitted data. It conducts risk assessment from the perspectives of the reporting information and historical behavior corresponding to the session business, comprehensively covering various cross-border outbound violation scenarios such as inconsistencies with cross-border reporting business and inconsistencies with regular business behavior.

[0037] It should be further explained that, in this embodiment, through layered architecture design, dynamic risk assessment model and real-time traffic monitoring, systematic management of the entire process of sensitive data outbound travel is achieved. Compared with the existing technology, this technical solution not only has real-time monitoring and abnormal warning capabilities, but also introduces an adaptive risk assessment mechanism to improve the flexibility and accuracy of detection. At the same time, by building a complete system framework for data collection, analysis, detection, warning and recording, full-link visualization and precise control of data outbound travel behavior are achieved, overcoming the shortcomings of existing technologies in real-time, adaptability and systematicity, and providing a safer and more efficient technical guarantee for the cross-border flow of sensitive data.

[0038] In some of the embodiments, Figure 3 As shown, obtaining the real-time target stream session in step S210 includes the following steps: Step S211, obtaining the original network traffic input in real time; Step S212, filtering out the first data flow in the original network traffic based on a preset filtering rule; Step S213: Process the first data stream to obtain corresponding multiple target stream sessions.

[0039] Specifically, a 100G network card is installed at the data access point to obtain the original network traffic passing through in real time. The network card is configured with preset screening rules to screen and process the original network traffic to obtain the first data stream, so as to filter out potential sensitive data streams according to preset traffic characteristics, reduce irrelevant data for analysis process, and reduce subsequent processing load.

[0040] Furthermore, the data stream segments filtered by the network card are transmitted to the risk collection module through a high-speed interface. Each server in the risk collection module deploys a traffic capture and analysis tool to achieve real-time collection, analysis and preprocessing of traffic through a distributed architecture. Among them, the traffic capture and analysis tool is responsible for decapsulating the data packets in the first data stream and extracting the IP, TCP, HTTP and other protocol layer information, and through the traffic aggregation technology, merging multiple data packets of the same connection or session into a complete flow record to obtain the corresponding multiple target flow sessions. It should be noted that the risk collection module has a log storage buffer function, which can effectively cope with peak traffic.

[0041] Through this embodiment, the original network traffic input in real time is obtained, and based on the preset filtering rules, the first data stream in the original network traffic is filtered out, and the first data stream is processed to obtain the corresponding multiple target stream sessions, so as to obtain the traffic in real time and ensure the real-time performance of the system.

[0042] In some embodiments, the first data stream is processed in step S213 to obtain corresponding multiple target stream sessions, including the following steps: Perform multi-layer protocol parsing on the first data stream to obtain parsing results corresponding to different data packets in the first data stream; According to the parsing result, multiple data packets belonging to the same stream session are determined; Aggregate the data packets belonging to the same stream session to obtain the corresponding target stream session.

[0043] Specifically, the risk collection module performs multi-layer protocol analysis on the first data stream through the traffic analysis tool to obtain the analysis results corresponding to different data packets in the first data stream. The multi-layer protocol analysis includes parsing the protocol layer information such as the transmission control protocol / Internet protocol header and the hypertext transfer protocol content. According to the analysis results, multiple data packets of the same connection or session are determined, and the data packets of the same connection or session are aggregated to obtain the corresponding target flow session. Each target flow session is pre-processed, and the risk collection module performs preliminary screening of the target flow session according to preset sensitive data features such as behavioral pattern rules and IP blacklists, and pre-labels for subsequent data anomaly detection. The labels include traffic category, transmission direction, and preliminary risk assessment value.

[0044] Furthermore, the risk collection module pushes the traffic to the Kafka message queue according to time sequence and label classification, and transmits the pre-processed traffic in batches through the Kafka message queue. It should be noted that the Kafka message queue, as the middleware for data transmission, adopts a distributed storage and transmission mechanism to ensure the data transmission efficiency between the risk collection module and the risk assessment module, and the Kafka message queue divides the log data into multiple partitions, which are processed in parallel by multiple nodes, thereby supporting the stable operation of the system in a high-traffic environment, while providing redundant backup of data to ensure the reliability of data transmission.

[0045] Through this embodiment, multi-layer protocol parsing is performed on the first data stream to obtain parsing results corresponding to different data packets in the first data stream. Based on the parsing results, multiple data packets belonging to the same stream session are determined, and the data packets belonging to the same stream session are aggregated to obtain complete stream records, which helps to improve the accuracy of subsequent data analysis.

[0046] In some embodiments, the dynamic risk assessment model is dynamically adjusted according to the data flow behavior, including the following steps: Obtain data flow behavior; data flow behavior includes data flow path and data flow characteristics; According to different data transmission modes, the risk assessment rules in the dynamic risk assessment model are dynamically adjusted in combination with data flow behaviors.

[0047] Specifically, the latest data flow behavior is obtained, which refers to the characteristics and patterns exhibited in the process of data generation, transmission and processing, including data flow paths and data traffic characteristics, etc., and the risk assessment rules in the dynamic risk assessment model are dynamically adjusted in accordance with the data flow behavior for different data transmission methods.

[0048] The above dynamic risk assessment model dynamically weights the risk factors in the rule base based on historical traffic data and real-time feedback to achieve dynamic adjustment of the model. The dynamic risk assessment model extracts real-time traffic features during traffic transmission, such as traffic protocol type, data transmission rate, abnormal behavior frequency, etc., and generates updated risk assessment rules based on historical data.

[0049] It should be noted that the present embodiment introduces an adaptive risk assessment mechanism, which dynamically adjusts the detection strategy and risk threshold according to the changes in the data flow path and data traffic characteristics, so as to flexibly respond to the cross-border data transmission needs in different scenarios and ensure that a high level of anomaly recognition accuracy can be maintained in a variety of data transmission modes. Compared with the detection method based on static rule matching, the dynamic adaptability of the present embodiment significantly improves the flexibility and accuracy of detection, and effectively reduces underreporting and false alarms.

[0050] Through this embodiment, data flow behavior is obtained, which includes data flow path and data traffic characteristics. In response to different data transmission modes, the risk assessment rules in the dynamic risk assessment model are dynamically adjusted in combination with the data flow behavior, thereby improving the dynamic adaptability of data detection and helping to improve the flexibility and accuracy of detection.

[0051] In some of the embodiments, after performing real-time analysis on each target stream session through a dynamic risk assessment model to obtain a risk value corresponding to the target stream session, the following steps are further included: When it is detected that the risk value corresponding to the target streaming session exceeds a preset risk threshold, a risk mark is added to the target streaming session; According to the tag information of the risk tag, the corresponding internal routing strategy is called to perform traffic control.

[0052] Specifically, the risk value corresponding to the target flow session is compared with the preset risk threshold. When it is detected that the risk value corresponding to the target flow session exceeds the preset risk threshold, it indicates that there is an abnormality in the traffic, and a corresponding risk mark is generated. The mark information of the risk mark includes risk level, matching rules and behavior type, etc.

[0053] Furthermore, when the switch receives a risk tag, it calls the corresponding internal routing strategy to control the flow according to the tag information of the risk tag, that is, the switch determines the transmission path of the flow according to the risk level through the customized routing rules. Among them, for high-risk flow, the blocking operation is performed first; medium-risk flow will be rerouted to the isolated network for further analysis; low-risk flow selects the optimal transmission path through dynamic load balancing and transmits it through a network bridge. The network bridge ensures that legitimate data is transmitted transparently and unimpeded during the cross-border process, ensuring data integrity and transmission efficiency, and abnormal flow will be blocked in real time.

[0054] It should be noted that seamless data transmission is achieved between the switch and the network bridge, and the abnormal traffic processing process is independent of the normal traffic, preventing high-risk operations from affecting the overall performance of the system.

[0055] Through this embodiment, when it is detected that the risk value corresponding to the target flow session exceeds the preset risk threshold, a risk tag is added to the target flow session, and according to the tag information of the risk tag, the corresponding internal routing policy is called to perform traffic control, so as to timely block high-risk data flows according to the risk tag, redirect medium-risk data flows to the isolated network for review, and ensure the compliance and security of cross-border data.

[0056] In some of the embodiments, after performing real-time analysis on each target stream session through a dynamic risk assessment model to obtain a risk value corresponding to the target stream session, the following steps are further included: The risk value and traffic log information corresponding to each target flow session are stored in a preset database; Based on the stored data in the preset database, the corresponding real-time traffic monitoring view is generated for display.

[0057] Specifically, after evaluating the risk value corresponding to each target flow session, Prometheus stores each risk value, traffic log information, and warning information in layers in a preset database in the data storage module. Among them, a data retention policy is pre-set, high-risk data is stored first, and low-risk data is archived regularly to save storage space.

[0058] It should be noted that the data storage module supports time series data query, provides a quick query interface, and supports real-time retrieval and historical traceability functions for each stored data, so that users can obtain detailed historical records and risk change trends of data flows.

[0059] In addition, the interactive data visualization platform Grafana extracts the stored data in the preset database in real time and generates corresponding real-time traffic monitoring views for display, so as to show the traffic dynamics, risk marker distribution and abnormal trends of each transmission path, for example, to show the risk score curve, abnormal traffic distribution and cross-border path changes, etc. Users can create custom views to observe specific traffic characteristics or risk markers, support multi-dimensional data analysis to meet multi-dimensional monitoring needs, and realize automatic monitoring through early warning configuration.

[0060] Through this embodiment, the risk value and traffic log information corresponding to each target flow session are stored in a preset database. According to the stored data in the preset database, a corresponding real-time traffic monitoring view is generated for display, so as to display the data flow and warning status in real time. Users can track the traffic dynamics and take quick action by viewing the visual interface.

[0061] The present embodiment is described and illustrated below through preferred embodiments.

[0062] Figure 4 is a flow chart of the abnormal cross-border detection method of sensitive data based on traffic analysis in this preferred embodiment. Figure 4 As shown, the abnormal cross-border detection method of sensitive data based on traffic analysis includes the following steps: Step S410, obtaining the original network traffic input in real time, and filtering out the first data flow in the original network traffic based on a preset filtering rule; Step S420, performing multi-layer protocol parsing on the first data stream to obtain parsing results corresponding to different data packets in the first data stream, determining multiple data packets belonging to the same stream session according to the parsing results, and aggregating the data packets belonging to the same stream session to obtain a corresponding target stream session; Step S430, obtaining the exit reporting information corresponding to the target streaming session; determining the first risk score of the target streaming session based on the multi-dimensional transmission risk characteristics in the exit reporting information and the risk assessment rules matching the target streaming session; detecting whether the timing transmission behavior of the target streaming session deviates from the historical behavior baseline based on the historical behavior baseline model matching the target streaming session, and calculating the error between the real-time input data and the historical data based on the detection result to obtain the second risk score; performing risk assessment based on the first risk score and the second risk score through the comprehensive risk assessment rules matching the target streaming session to obtain the corresponding risk value; Step S440, when it is detected that the risk value corresponding to the target streaming session exceeds the preset risk threshold, a real-time warning is triggered, and a risk mark is added to the target streaming session, and the corresponding internal routing strategy is called according to the mark information of the risk mark to perform flow control.

[0063] Through this embodiment, the raw network traffic input in real time is obtained, and the first data stream in the raw network traffic is screened out based on the preset screening rules. The first data stream is subjected to multi-layer protocol parsing to obtain parsing results corresponding to different data packets in the first data stream, and multiple data packets belonging to the same stream session are determined according to the parsing results, and the data packets belonging to the same stream session are aggregated to obtain the corresponding target stream session.

[0064] Furthermore, the outbound reporting information corresponding to the target flow session is obtained; based on the multi-dimensional transmission risk characteristics in the outbound reporting information and the risk assessment rules matching the target flow session, the first risk score of the target flow session is determined; based on the historical behavior baseline model matching the target flow session, the timing transmission behavior of the target flow session is detected to see if it deviates from the historical behavior baseline, and the error between the real-time input data and the historical data is calculated based on the detection result to obtain the second risk score; based on the first risk score and the second risk score, a risk assessment is performed through the comprehensive risk assessment rules matching the target flow session to obtain the corresponding risk value. When it is detected that the risk value corresponding to the target flow session exceeds the preset risk threshold, a real-time warning is triggered, and a risk tag is added to the target flow session. According to the tag information of the risk tag, the corresponding internal routing strategy is called to control the flow, which solves the problem that the existing detection method is difficult to dynamically adapt to the changes in the data flow in the complex scenario of cross-border data flow, resulting in false alarms and omissions of sensitive data, and realizes dynamic adaptation to the changes in the data flow in the complex scenario of cross-border data flow, avoiding false alarms and omissions of sensitive data, while ensuring the compliance and security of cross-border data.

[0065] It should be noted that the steps shown in the above process or the flowchart in the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and although a logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0066] In this embodiment, a system for detecting abnormal cross-border sensitive data based on traffic analysis is also provided, which is used to implement the above embodiments and preferred implementations, and the descriptions that have been made are not repeated here. The terms "module", "unit", "sub-unit", etc. used below refer to a combination of software and / or hardware that can implement a predetermined function.

[0067] Figure 5 is a structural block diagram of the sensitive data cross-border abnormality detection system based on traffic analysis in this embodiment. Figure 5 As shown, the system includes: a risk collection module 20, a risk assessment module 40 and a risk warning module 70; The risk collection module 20 is used to obtain multiple target flow sessions to be detected; The risk assessment module 40 is used to analyze each target flow session in real time through a dynamic risk assessment model to obtain a risk value corresponding to the target flow session; the dynamic risk assessment model is dynamically adjusted according to the data flow behavior; The risk assessment module 40 is further used to obtain the exit reporting information corresponding to the target stream session; determine the first risk score of the target stream session based on the multi-dimensional transmission risk characteristics in the exit reporting information and the risk assessment rules matching the target stream session; detect whether the timing transmission behavior of the target stream session deviates from the historical behavior baseline based on the historical behavior baseline model matching the target stream session, and calculate the error between the real-time input data and the historical data based on the detection result to obtain a second risk score; based on the first risk score and the second risk score, perform risk assessment on the target stream session through the comprehensive risk assessment rules matching the target stream session to obtain a corresponding risk value; The risk warning module 70 is used to trigger a real-time warning when it is detected that the risk value corresponding to the target stream session exceeds a preset risk threshold.

[0068] Specifically, a 100G network card 10 is installed at a data access point to obtain the original network traffic in real time, and the original network traffic is filtered and processed according to the preset filtering rules configured by the network card to obtain the first data stream, so as to filter out potential sensitive data streams according to the preset traffic characteristics, reduce the analysis process of irrelevant data, and reduce the subsequent processing load. The data streams filtered by the network card are transmitted to the risk collection module 20 through a high-speed interface.

[0069] In the risk collection module 20, multi-layer protocol parsing is performed on the first data stream to obtain parsing results corresponding to different data packets in the first data stream. The multi-layer protocol parsing includes parsing out protocol layer information such as the transmission control protocol / Internet protocol header and the hypertext transfer protocol content. According to the parsing results, multiple data packets belonging to the same stream session are determined, and the data packets belonging to the same stream session are aggregated to obtain the corresponding target stream session. Each target stream session is pre-processed. The risk collection module 20 performs a preliminary screening of the target stream session according to preset sensitive data features such as behavioral pattern rules and IP blacklists, and pre-labels subsequent data anomaly detection. The labels include traffic category, transmission direction, and preliminary risk assessment value. The pre-processed traffic is batch-transmitted through the Kafka message queue 30.

[0070] The risk assessment module reads data from the Kafka message queue 30 to obtain multiple target stream sessions to be detected. Each target stream session is analyzed in real time through a dynamic risk assessment model to obtain a risk value corresponding to the target stream session. The dynamic risk assessment model is dynamically adjusted according to the data flow behavior. The data flow behavior refers to the characteristics and patterns exhibited in the process of data generation, transmission and processing. In the dynamic risk assessment model, the target stream session is matched and processed according to the preset behavior pattern rules and data flow characteristics to obtain the target data in the target stream session, and the abnormal behavior in the target data is marked. Based on the marking result, the target data is risk assessed according to the current risk assessment rules to obtain the corresponding risk value. The risk value corresponding to the target stream session is compared with the preset risk threshold. When it is detected that the risk value corresponding to the target stream session exceeds the preset risk threshold, a risk mark is added to the target stream session.

[0071] The risk tag is transmitted to the P4 switch 50. When the switch receives the risk tag, the corresponding internal routing strategy is called to control the flow according to the tag information of the risk tag. Among them, through the customized routing rules, the transmission path of the flow is determined according to the risk level. For high-risk flow, the blocking operation is performed first; medium-risk flow will be rerouted to the isolated network for further analysis; normal flow will be repackaged and transmitted to the network bridge 60, which ensures that legal data is transparently and unimpededly transmitted during the cross-border process, and abnormal flow will be blocked in real time. It should be noted that seamless data transmission is achieved between the switch and the network bridge 60, and the abnormal flow processing process is independent of normal flow to prevent high-risk operations from affecting the overall performance of the system.

[0072] Furthermore, the risk marker is transmitted to the risk warning module 70, and a detailed security incident report is generated according to a preset template. The report includes traffic source, detection time, risk level, event description, etc. The event information is automatically archived, and a real-time warning is triggered for traffic with risk markers. The real-time warning is pushed to the management platform or monitoring personnel, and a security incident tracking interface is provided for rapid response and data tracing.

[0073] Afterwards, each risk value and traffic log information are associated and stored in a preset database in the data storage module 80, wherein a data retention policy is preset, high-risk data is stored first, and low-risk data is archived regularly to save storage space. At the same time, the data storage module 80 supports time series data query, provides a quick query interface, and supports real-time retrieval and historical traceability functions for each stored data, so that users can obtain detailed historical records and risk change trends of data flows. In addition, in the visualization module 90, according to the stored data in the preset database, the corresponding real-time traffic monitoring view is generated for display to show the traffic dynamics, risk marker distribution and abnormal trends of each transmission path. Users can create custom views to observe specific traffic characteristics or risk markers, support multi-dimensional data analysis, and realize automatic monitoring through early warning configuration.

[0074] Through this embodiment, multiple target flow sessions to be detected are obtained; each target flow session is analyzed in real time through a dynamic risk assessment model, and risk assessment is performed based on a risk score based on reported information, a risk score based on historical behavior, and a comprehensive risk assessment rule matched according to the current business scenario to obtain a risk value; wherein the dynamic risk assessment model is dynamically adjusted according to the data flow behavior; when it is detected that the risk value corresponding to the target flow session exceeds a preset risk threshold, a real-time warning is triggered, which solves the problem that the existing detection methods are difficult to dynamically adapt to changes in data flows in complex scenarios of cross-border data flow, resulting in false positives and negatives of sensitive data, and realizes dynamic adaptation to changes in data flows in complex scenarios of cross-border data flow, avoiding false positives and negatives of sensitive data.

[0075] This embodiment also provides a computer device, including a memory and a processor, wherein the memory stores a computer program, and the processor is configured to run the computer program to execute the steps in any one of the above method embodiments.

[0076] Optionally, the computer device may further include a transmission device and an input / output device, wherein the transmission device is connected to the processor, and the input / output device is connected to the processor.

[0077] Optionally, in this embodiment, the processor may be configured to perform the following steps through a computer program: S1, obtaining multiple target flow sessions to be detected; S2, perform real-time analysis on each target stream session through a dynamic risk assessment model to obtain a risk value corresponding to the target stream session; the dynamic risk assessment model is dynamically adjusted according to the data flow behavior; wherein the real-time analysis process of the dynamic risk assessment model includes: obtaining the exit reporting information corresponding to the target stream session; determining the first risk score of the target stream session based on the multi-dimensional transmission risk characteristics in the exit reporting information and the risk assessment rules matching the target stream session; detecting whether the timing transmission behavior of the target stream session deviates from the historical behavior baseline based on the historical behavior baseline model matching the target stream session, and calculating the error between the real-time input data and the historical data based on the detection result to obtain a second risk score; based on the first risk score and the second risk score, perform risk assessment on the target stream session through the comprehensive risk assessment rules matching the target stream session to obtain the corresponding risk value; S3, when it is detected that the risk value corresponding to the target stream session exceeds a preset risk threshold, a real-time warning is triggered.

[0078] It should be noted that the specific examples in this embodiment can refer to the examples described in the above embodiments and optional implementation modes, and will not be repeated in this embodiment.

[0079] In addition, in combination with the abnormal cross-border detection method for sensitive data based on traffic analysis provided in the above embodiments, a storage medium can also be provided in this embodiment to implement. The storage medium stores a computer program; when the computer program is executed by the processor, any of the abnormal cross-border detection methods for sensitive data based on traffic analysis in the above embodiments is implemented.

[0080] It should be understood that the specific embodiments described herein are only used to explain the application, rather than to limit it. Based on the embodiments provided in this application, all other embodiments obtained by ordinary technicians in this field without creative work are within the protection scope of this application.

[0081] Obviously, the drawings are only some examples or embodiments of the present application. For ordinary technicians in the field, the present application can also be applied to other similar situations based on these drawings without creative work. In addition, it is understandable that although the work done in this development process may be complicated and lengthy, for ordinary technicians in the field, certain changes in design, manufacturing or production based on the technical content disclosed in this application are only conventional technical means and should not be regarded as insufficient content disclosed in this application.

[0082] The term "embodiment" in this application refers to a specific feature, structure or characteristic described in conjunction with the embodiment that can be included in at least one embodiment of the present application. The appearance of this phrase in various locations in the specification does not necessarily mean the same embodiment, nor does it mean that it is mutually exclusive with other embodiments and is independent or optional. It is clearly or implicitly understood by those of ordinary skill in the art that the embodiments described in this application can be combined with other embodiments without conflict.

[0083] The above-mentioned embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of patent protection. It should be pointed out that, for a person of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present application, and these all belong to the scope of protection of the present application. Therefore, the scope of protection of the present application shall be subject to the attached claims.

Claims

1. A method for detecting abnormal cross-border flow of sensitive data based on traffic analysis, characterized in that: The method comprises: Acquire multiple target flow sessions to be detected; Performing real-time analysis on each target stream session through a dynamic risk assessment model to obtain a risk value corresponding to the target stream session; the dynamic risk assessment model is dynamically adjusted according to the data stream behavior; Among them, the real-time analysis process of the dynamic risk assessment model includes: obtaining the exit reporting information corresponding to the target stream session; determining the first risk score of the target stream session based on the multi-dimensional transmission risk characteristics in the exit reporting information and the risk assessment rules matching the target stream session; detecting whether the timing transmission behavior of the target stream session deviates from the historical behavior baseline based on the historical behavior baseline model matching the target stream session, and calculating the error between the real-time input data and the historical data based on the detection result to obtain the second risk score; based on the first risk score and the second risk score, performing risk assessment on the target stream session through the comprehensive risk assessment rules matching the target stream session to obtain the corresponding risk value; When it is detected that the risk value corresponding to the target stream session exceeds a preset risk threshold, a real-time warning is triggered.

2. The method for detecting abnormal cross-border sensitive data based on traffic analysis according to claim 1 is characterized in that: The step of acquiring the real-time target stream session includes: Get raw network traffic in real time; Based on a preset screening rule, screening out a first data flow in the original network traffic; The first data stream is processed to obtain a corresponding plurality of the target stream sessions.

3. The method for detecting abnormal cross-border sensitive data based on traffic analysis according to claim 2 is characterized in that: The processing of the first data stream to obtain the corresponding plurality of target stream sessions includes: Performing multi-layer protocol parsing on the first data stream to obtain parsing results corresponding to different data packets in the first data stream; According to the analysis result, determining a plurality of the data packets belonging to the same streaming session; Aggregate the data packets belonging to the same streaming session to obtain the corresponding target streaming session.

4. The method for detecting abnormal cross-border sensitive data based on traffic analysis according to claim 1 is characterized in that: The dynamic risk assessment model is dynamically adjusted according to the data flow behavior, including: Acquire data flow behavior; the data flow behavior includes data flow path and data flow characteristics; According to different data transmission modes, the risk assessment rules in the dynamic risk assessment model are dynamically adjusted in combination with the data flow behavior.

5. The method for detecting abnormal cross-border sensitive data based on traffic analysis according to claim 1 is characterized in that: After performing real-time analysis on each target stream session through the dynamic risk assessment model to obtain a risk value corresponding to the target stream session, the method further includes: When it is detected that the risk value corresponding to the target streaming session exceeds the preset risk threshold, adding a risk mark to the target streaming session; According to the marking information of the risk marking, the corresponding internal routing strategy is called to perform flow control.

6. The method for detecting abnormal cross-border sensitive data based on traffic analysis according to claim 1 is characterized in that: After performing real-time analysis on each target stream session through the dynamic risk assessment model to obtain a risk value corresponding to the target stream session, the method further includes: Storing the risk value and traffic log information corresponding to each target flow session in a preset database; Based on the stored data in the preset database, a corresponding real-time traffic monitoring view is generated for display.

7. A sensitive data anomaly cross-border detection system based on traffic analysis, characterized in that: The system includes: a risk collection module, a risk assessment module and a risk early warning module; The risk collection module is used to obtain multiple target flow sessions to be detected; The risk assessment module is used to perform real-time analysis on each target stream session through a dynamic risk assessment model to obtain a risk value corresponding to the target stream session; the dynamic risk assessment model is dynamically adjusted according to the data stream behavior; The risk assessment module is further used to obtain the exit reporting information corresponding to the target streaming session; determine the first risk score of the target streaming session based on the multi-dimensional transmission risk characteristics in the exit reporting information and the risk assessment rules matching the target streaming session; detect whether the timing transmission behavior of the target streaming session deviates from the historical behavior baseline based on the historical behavior baseline model matching the target streaming session, and calculate the error between the real-time input data and the historical data based on the detection result to obtain the second risk score; based on the first risk score and the second risk score, perform risk assessment on the target streaming session through the comprehensive risk assessment rules matching the target streaming session to obtain the corresponding risk value; The risk warning module is used to trigger a real-time warning when it is detected that the risk value corresponding to the target stream session exceeds a preset risk threshold.

8. A computer device comprising a memory and a processor, characterized in that: A computer program is stored in the memory, and the processor is configured to run the computer program to execute the steps of the abnormal cross-border detection method for sensitive data based on traffic analysis as described in any one of claims 1 to 6.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the abnormal cross-border detection method of sensitive data based on traffic analysis described in any one of claims 1 to 6 are implemented.

Images