Data identification method and device, equipment, storage medium and program product

Abstract

The invention discloses a data identification method and device, equipment, a storage medium and a program product, relates to the technical field of communication, and is used for reducing computing power resources consumed when sensitive data identification is carried out on a data stream. The method comprises the following steps: acquiring data characteristics of a data stream under the condition that a protocol of the data stream is an encrypted transmission protocol; the data features comprise data volume and / or domain name; and determining whether the data stream is an abnormal data stream based on the data feature of the data stream and the abnormal feature corresponding to the data feature. The method and the device are applied to a scene for identifying the data.

Description

Technical Field

[0001] The present application relates to the field of communication technology, and in particular to a data identification method, device, equipment, storage medium and program product. Background Art

[0002] With the development and popularity of Internet technology, issues such as data privacy and security have become particularly prominent. As a channel for the dissemination of data information, the Internet has had a profound impact on many aspects of society and culture. In response to the increasingly serious problems of privacy data leakage, online rumor spreading, online fraud, and the dissemination of bad information, identifying and monitoring sensitive data (also known as sensitive words, sensitive information, etc.) in the data stream (also known as network traffic) on the Internet is one of the effective solutions. Currently, data in the data stream can be extracted into text, and sensitive words (such as privacy information, fraud information, etc.) in the text of the data stream can be matched or identified through artificially established sensitive word libraries or recognition models based on text features, so as to discover sensitive data in the data stream.

[0003] However, when extracting data from a data stream into text for sensitive word recognition, it is necessary to perform operations such as deserialization on the binary data packets in the data stream to extract the text, resulting in a high consumption of computing resources. Summary of the invention

[0004] The present application provides a data identification method, apparatus, device, storage medium and program product, which are used to solve the technical problem that when extracting data in a data stream into text for sensitive word identification, it is necessary to deserialize the binary data packets in the data stream to extract the text, resulting in a large consumption of computing resources.

[0005] In order to achieve the above purpose, this application adopts the following technical solutions:

[0006] In a first aspect, a data identification method is provided, the method comprising: when the protocol of the data stream is an encrypted transmission protocol, obtaining data features of the data stream; the data features include: data volume and / or domain name; based on the data features of the data stream and abnormal features corresponding to the data features, determining whether the data stream is an abnormal data stream.

[0007] In a possible implementation, the abnormal features include: multiple abnormal data volumes and multiple abnormal domain names; one abnormal domain name corresponds to at least one abnormal data volume; based on the data features of the data stream and the abnormal features corresponding to the data features, determining whether the data stream is an abnormal data stream includes: when the domain name is the same as the target domain name, determining the similarity between the data volume and the target data volume; the target domain name is any one of the multiple abnormal domain names; the target data volume is any one of the multiple abnormal data volumes and at least one abnormal data volume corresponding to the target domain name; when the similarity between the data volume and the target data volume is greater than a preset similarity, determining that the data stream is an abnormal data stream; or, when the similarity between the data volume and the target data volume is less than or equal to the preset similarity, determining that the data stream is a normal data stream.

[0008] In one possible implementation, the abnormal features include: the amount of abnormal data; based on the data features of the data stream and the abnormal features corresponding to the data features, determining whether the data stream is an abnormal data stream, including: when the similarity between the data volume and the abnormal data volume is greater than a preset similarity, determining that the data stream is an abnormal data stream; or, when the similarity between the data volume and the abnormal data volume is less than or equal to the preset similarity, determining that the data stream is a normal data stream.

[0009] In one possible implementation, the abnormal features include: an abnormal domain name; determining whether the data flow is an abnormal data flow based on the data features of the data flow and the abnormal features corresponding to the data features, including: when the domain name is the same as the abnormal domain name, determining that the data flow is an abnormal data flow; or, when the domain name is different from the abnormal domain name, determining that the data flow is a normal data flow.

[0010] In one possible implementation, the method also includes: when the protocol of the data stream is a non-encrypted transmission protocol, obtaining the URL of the data stream; when the URL is the same as the abnormal URL, determining that the data stream is an abnormal data stream; or, when the URL is different from the abnormal URL, determining that the data stream is a normal data stream.

[0011] In a possible implementation, when the URL is the same as the abnormal URL, after determining that the data flow is an abnormal data flow, the method further includes: determining information corresponding to the abnormal URL as sensitive information in the data flow.

[0012] In a possible implementation, when the protocol of the data stream is an encrypted transmission protocol, before obtaining the data volume of the data stream, the method further includes: collecting the data stream; and identifying whether the protocol of the data stream is an encrypted transmission protocol.

[0013] In one possible implementation, after determining whether the data flow is an abnormal data flow based on data features of the data flow and abnormal features corresponding to the data features, the method further includes: if the data flow is an abnormal data flow, determining information corresponding to the abnormal features as sensitive information in the data flow.

[0014] In a second aspect, a data identification device is provided, which includes: a transmission unit and a determination unit; the transmission unit is used to obtain data characteristics of the data stream when the protocol of the data stream is an encrypted transmission protocol; the data characteristics include: data volume and / or domain name; the determination unit is used to determine whether the data stream is an abnormal data stream based on the data characteristics of the data stream and abnormal characteristics corresponding to the data characteristics.

[0015] In a possible implementation, the abnormal features include: multiple abnormal data volumes and multiple abnormal domain names; one abnormal domain name corresponds to at least one abnormal data volume; the determination unit is further used to determine the similarity between the data volume and the target data volume when the domain name is the same as the target domain name; the target domain name is any one of the multiple abnormal domain names; the target data volume is any one of the at least one abnormal data volume corresponding to the target domain name among the multiple abnormal data volumes; the determination unit is further used to determine that the data flow is an abnormal data flow when the similarity between the data volume and the target data volume is greater than a preset similarity; the determination unit is further used to determine that the data flow is a normal data flow when the similarity between the data volume and the target data volume is less than or equal to a preset similarity.

[0016] In one possible implementation, the abnormal features include: the amount of abnormal data; a determination unit, further used to determine that the data flow is an abnormal data flow when the similarity between the data amount and the abnormal data amount is greater than a preset similarity; the determination unit, further used to determine that the data flow is a normal data flow when the similarity between the data amount and the abnormal data amount is less than or equal to a preset similarity.

[0017] In one possible implementation, the abnormal features include: an abnormal domain name; a determination unit, further used to determine that the data flow is an abnormal data flow when the domain name is the same as the abnormal domain name; and a determination unit, further used to determine that the data flow is a normal data flow when the domain name is different from the abnormal domain name.

[0018] In one possible implementation, the transmission unit is further used to obtain the URL of the data stream when the protocol of the data stream is a non-encrypted transmission protocol; the determination unit is further used to determine that the data stream is an abnormal data stream when the URL is the same as the abnormal URL; the determination unit is further used to determine that the data stream is a normal data stream when the URL is different from the abnormal URL.

[0019] In a possible implementation, the determination unit is further configured to determine information corresponding to the abnormal website address as sensitive information in the data stream.

[0020] In a possible implementation, the data identification device further includes: a processing unit; the processing unit is used to collect data streams; the processing unit is also used to identify whether the protocol of the data stream is an encrypted transmission protocol.

[0021] In a third aspect, an electronic device comprises: a processor and a memory; wherein the memory is used to store one or more programs, and the one or more programs include computer execution instructions. When the electronic device is running, the processor executes the computer execution instructions stored in the memory to enable the electronic device to perform a data recognition method as in the first aspect and the second aspect.

[0022] In a fourth aspect, a computer-readable storage medium storing one or more programs is provided. The one or more programs include instructions. When the instructions are executed by a computer, the computer executes a data identification method as described in the first aspect and the second aspect.

[0023] In a fifth aspect, a computer program product is provided. When the computer instructions are executed on an electronic device, the electronic device executes a data identification method as described in the first aspect and the second aspect.

[0024] The present application provides a data identification method, apparatus, device, storage medium and program product, which are applied to the scenario of data identification. In the case where the protocol of the data stream is an encrypted transmission protocol, the data features of the data stream including the data volume and / or domain name are obtained. Further, based on the data features of the data stream and the abnormal features corresponding to the data features, it is determined whether the data stream is an abnormal data stream. That is, when the data stream is encrypted and transmitted, the external data features of the data stream (i.e., the data volume and / or domain name) can be extracted to identify the data stream. If the external data features are abnormal, it means that the data stream is abnormal, and vice versa. If the data stream is abnormal, it means that sensitive data is included in the data stream. In this way, there is no need to extract the data in the data stream into text to identify whether the data stream includes sensitive data. Through the above method, it is possible to identify whether the data stream is an abnormal data stream based on the data volume and / or domain name of the encrypted transmitted data stream. Thereby, the technical problem that when extracting data in the data stream into text for sensitive word recognition, it is necessary to deserialize the binary data packets in the data stream and perform other operations to extract the text, resulting in a large consumption of computing power resources is solved. Thus, the computing power resources consumed when identifying sensitive data in the data stream are reduced. BRIEF DESCRIPTION OF THE DRAWINGS

[0025] Figure 1 A schematic diagram of the structure of a data identification system provided in an embodiment of the present application;

[0026] Figure 2 A schematic diagram of a data identification method provided in an embodiment of the present application Figure 1 ;

[0027] Figure 3 A schematic diagram of a data identification method provided in an embodiment of the present application Figure 2 ;

[0028] Figure 4 A schematic diagram of a data identification method provided in an embodiment of the present application Figure 3 ;

[0029] Figure 5 A schematic diagram of a data identification method provided in an embodiment of the present application Figure 4 ;

[0030] Figure 6 A schematic diagram of a data identification method provided in an embodiment of the present application Figure 5 ;

[0031] Figure 7 A schematic diagram of a data identification method provided in an embodiment of the present application Figure 6 ;

[0032] Figure 8 A schematic diagram of a data identification method provided in an embodiment of the present application Figure 7 ;

[0033] Fig. 9 A schematic diagram of a data identification method provided in an embodiment of the present application Figure 8 ;

[0034] Fig.10 A schematic diagram of a sensitive data identification process provided in an embodiment of the present application;

[0035] Fig.11 A schematic diagram of the structure of a data identification device provided in an embodiment of the present application;

[0036] Fig.12 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0037] The technical solutions in the embodiments of the present application will be described below in conjunction with the drawings in the embodiments of the present application.

[0038] In the description of this application, unless otherwise specified, " / " means "or", for example, A / B can mean A or B. "And / or" in this article is merely a description of the association relationship of associated objects, indicating that three relationships may exist. For example, A and / or B can mean: A exists alone, A and B exist at the same time, and B exists alone. In addition, "at least one" and "plurality" refer to two or more. The words "first", "second", etc. do not limit the quantity and execution order, and the words "first", "second", etc. do not limit them to be different.

[0039] At present, most mainstream websites use encrypted traffic protocols such as Hypertext Transfer Protocol Secure (HTTPS) to transmit data, which brings unprecedented challenges to network monitoring. Currently, data in the data stream can be extracted into text, and sensitive words can be matched or recognized in the text in the data stream through artificially established sensitive word libraries or recognition models based on text features, so as to discover sensitive data in the data stream.

[0040] However, when extracting data from a data stream into text for sensitive word recognition, it is necessary to perform operations such as deserialization on the binary data packets in the data stream to extract the text, resulting in a high consumption of computing resources.

[0041] To solve the above problems, the present application provides a data identification method, which can automatically crawl the original data of a web page, and identify the sensitive data in the original data of the web page through manual analysis or recognition models, and then establish two types of application layer protocols, namely, non-encrypted transmission protocols such as Hypertext Transfer Protocol (HTTP) and encrypted transmission protocols such as HTTPS. Sensitive data identification knowledge bases for two types of application layer protocols are established respectively. Furthermore, according to the corresponding features of the unencrypted data stream and the encrypted data stream, they are matched with the corresponding sensitive data identification knowledge base to realize the identification of sensitive data in the unencrypted data stream and the encrypted data stream.

[0042] A data identification method provided in an embodiment of the present application can be applicable to a data identification system. Figure 1 FIG. 1 shows a schematic diagram of the structure of a data recognition system. Figure 1 As shown, the data identification system 10 includes: a terminal device 11 and an electronic device 12. The terminal device 11 and the electronic device 12 may be connected in a wired manner or in a wireless manner, which is not limited in the embodiment of the present invention.

[0043] The electronic device 12 is used to obtain data features of the data stream, and determine whether the data stream is an abnormal data stream based on the data features of the data stream and abnormal features corresponding to the data features when the protocol of the data stream in the terminal device 11 is an encrypted transmission protocol.

[0044] The terminal device 11 and the electronic device 12 can be physical machines, for example, the electronic device 12 can be a base station device, a desktop computer, also known as a desktop computer, a server, or a server group composed of multiple servers. The terminal device 11 can be a mobile phone, a tablet computer, a notebook computer, an ultra-mobile personal computer (UMPC), a netbook, a personal digital assistant (PDA), and other terminal devices.

[0045] A data identification method provided by an embodiment of the present application is described below in conjunction with the accompanying drawings. Figure 2 As shown, a data identification method provided in an embodiment of the present application is applied to an electronic device, and the method includes S201-S204:

[0046] S201. When the protocol of the data stream is an encrypted transmission protocol, obtain data features of the data stream.

[0047] The data characteristics include: data volume and / or domain name.

[0048] It can be understood that when the protocol of the data stream is an encrypted transmission protocol, the electronic device can obtain the data characteristics of the data stream.

[0049] Optionally, the electronic device can collect data streams (also referred to as data traffic) of multiple web pages of multiple websites on the terminal device, and analyze and identify the data stream of each web page through manual analysis or a pre-established recognition model. If sensitive data is identified in a web page, a sensitive data identifier (such as an identifier (Identity, ID)) of the sensitive data is generated. Furthermore, if the protocol used by the web page is an encrypted transmission protocol, the web page is dialed and captured to access the data stream where the sensitive data is located, extract the explicit traffic feature information of the data stream where the sensitive data is located, and count the statistical feature information of the data stream where the sensitive data is located.

[0050] Furthermore, the explicit traffic feature information and statistical feature information (collectively referred to as data features) of the data stream containing the sensitive data are determined as abnormal explicit traffic feature information and abnormal statistical feature information, and these abnormal data features are updated to the pre-established sensitive data identification knowledge base of the encrypted transmission protocol. The explicit traffic feature information can be information such as the domain name and cipher suite. The statistical feature can be information indicating the amount of data such as the length of the data payload. The domain name is used to characterize the address information of the website where the web page corresponding to the data stream is located.

[0051] For example, sensitive data may be text data such as words and phrases related to user privacy, terrorism, politics, online rumor spreading, online fraud, etc. The encrypted transmission protocol may be an application layer protocol such as the HTTPS protocol. The domain name may be information representing the domain name such as the Server Name Indication (SNI).

[0052] An example of the structure of the knowledge base for identifying sensitive data in encrypted transmission protocols is shown in Table 1:

[0053] Table 1

[0054] Sensitive data identification Abnormal SNI Abnormal payload data packet length Similarity Threshold 00000003 abc.com 64，164，64 α 00000004 abc.com 152，132，40，33，4 α 00000005 cba.cn 55，24，55，66 α

[0055] Among them, the similarity threshold (also called preset similarity) in Table 1 is the similarity threshold corresponding to the abnormal load data message length. The similarity threshold corresponding to each abnormal load data message length can be the same or different and can be set as needed.

[0056] Optionally, the electronic device may include a network traffic collection device. The electronic device may collect traffic from the terminal device through the network traffic collection device to collect a complete data stream. The collected complete data stream may be a complete data stream of a web page of a website of the terminal device.

[0057] Furthermore, when the protocol of the data stream is an encrypted transmission protocol, the electronic device can extract data features of the data stream.

[0058] S202: Determine whether the data flow is an abnormal data flow based on data features of the data flow and abnormal features corresponding to the data features.

[0059] It can be understood that the electronic device can determine whether the data flow is an abnormal data flow based on the data characteristics of the data flow and the abnormal characteristics corresponding to the data characteristics.

[0060] Optionally, when the data feature of the data stream is the data volume, the abnormal feature corresponding to the data feature is the abnormal data volume. When the data feature of the data stream is the domain name, the abnormal feature corresponding to the data feature is the abnormal domain name. When the data feature of the data stream is the data volume and the domain name, the abnormal feature corresponding to the data feature is the abnormal data volume and the abnormal domain name.

[0061] The electronic device can determine whether the data flow is an abnormal data flow based on the data characteristics of the data flow and the abnormal characteristics corresponding to the data characteristics and according to the encryption transmission protocol sensitive data identification knowledge base.

[0062] For example, when the payload data message length of a data flow is 64, 164, 64, and the SNI is abc.com, it can be seen from Table 1 that the payload data message length of the data flow is an abnormal payload data message length, and the SNI is an abnormal SNI. The data flow includes sensitive data with a sensitive data identifier of 00000003, and it can be determined that the data flow is an abnormal data flow.

[0063] It should be noted that, in general, the URL of the data stream is more accurate in characterizing whether the data stream contains sensitive data. However, if the protocol of the data stream is an encrypted transmission protocol, the URL of the data stream cannot be extracted. In this case, the explicit traffic feature information and statistical feature information of the data stream can be extracted to identify whether the data stream contains sensitive data. The explicit traffic feature information and statistical feature information of the data stream are external features of the data stream and can be obtained without decrypting the data stream.

[0064] In one design, Figure 3 As shown, an embodiment of the present application provides a data identification method, wherein the abnormal features include: multiple abnormal data volumes and multiple abnormal domain names; one abnormal domain name corresponds to at least one abnormal data volume; the method in the above step S202 specifically includes S301-S302, or S301-S303:

[0065] S301: When the domain name is the same as the target domain name, determine the similarity between the data volume and the target data volume.

[0066] The target domain name is any one of the multiple abnormal domain names; the target data volume is any one of the at least one abnormal data volume corresponding to the target domain name among the multiple abnormal data volumes.

[0067] Optionally, the encrypted transmission protocol sensitive data identification knowledge base includes multiple abnormal domain names. The electronic device can first perform preliminary screening based on the domain name of the data stream. Specifically, the electronic device can first extract the domain name of the data stream and find out whether the domain name exists in the encrypted transmission protocol sensitive data identification knowledge base. If the domain name does not exist in the encrypted transmission protocol sensitive data identification knowledge base (that is, the domain name of the data stream is different from the target domain name), it means that the data stream does not include sensitive data, and the data stream is determined to be a normal data stream.

[0068] If the domain name exists in the encrypted transmission protocol sensitive data identification knowledge base (i.e., the domain name of the data stream is the same as the target domain name), a similarity algorithm is further used to calculate the similarity between the data volume of the data stream and the data volume corresponding to the domain name in the encrypted transmission protocol sensitive data identification knowledge base (i.e., the target data volume). The similarity algorithm can be a suitable algorithm such as the Euclidean distance algorithm, the Manhattan distance algorithm, the cosine similarity algorithm, etc.

[0069] It should be noted that under the same domain name, there may be multiple sensitive data with different data volumes. For example, in Table 1, the abnormal SNIs of sensitive data 00000003 and sensitive data 00000004 are both abc.com, but the abnormal payload data message lengths are 64, 164, 64 and 152, 132, 40, 33, 4 respectively.

[0070] For example, assuming that the SNI of the data flow is abc.com and the payload data message length is 64, 164, 64, then according to Table 1, it is necessary to calculate the similarity between the payload data message length of the data flow and the abnormal payload data message length 64, 164, 64, and the abnormal payload data message length 152, 132, 40, 33, 4. Then, it can be obtained that the similarity between the payload data message length 64, 164, 64 of the data flow and the abnormal payload data message length 64, 164, 64 is 100%. The similarity between the payload data message length 64, 164, 64 of the data flow and the abnormal payload data message length 152, 132, 40, 33, 4 is 0%.

[0071] S302: When the similarity between the data volume and the target data volume is greater than a preset similarity, determine that the data flow is an abnormal data flow.

[0072] Optionally, when the similarity between the data volume and the target data volume is greater than a preset similarity, the electronic device may determine that the data flow is an abnormal data flow. Further, the electronic device may generate a result log. The result log may include associated information such as the sensitive data identifier corresponding to the data flow, the original traffic metadata of the data flow, etc. The original traffic metadata may include SNI, source Internet Protocol Address (IP), source port, destination IP, destination port, etc.

[0073] Exemplarily, the preset similarity can be any reasonable value such as 80%, 90%, etc. The similarity between the payload data message length 64, 164, 64 of the data flow and the abnormal payload data message length 64, 164, 64 is 100%, that is, the similarity between the payload data message length 64, 164, 64 of the data flow and the abnormal payload data message length 64, 164, 64 is greater than the preset similarity, then the data flow includes sensitive data with the sensitive data identifier of 00000003, and the data flow is an abnormal data flow.

[0074] S303: When the similarity between the data volume and the target data volume is less than or equal to a preset similarity, determine that the data flow is a normal data flow.

[0075] Optionally, when the similarity between the data volume and the target data volume is less than or equal to a preset similarity, the electronic device may determine that the data flow is a normal data flow.

[0076] The present application can first screen whether a data stream is likely to be an abnormal data stream based on the domain name of the data stream, and when the data stream is likely to be an abnormal data stream, further screen whether the data stream is an abnormal data stream based on the data volume of the data stream. This can reduce the workload when identifying whether a data stream is an abnormal data stream, that is, only the data volume corresponding to the domain name that matches the domain name of the data stream needs to be matched, and there is no need to match the data stream with each data volume in the sensitive data identification knowledge base of the encrypted transmission protocol, which can improve the efficiency of identifying whether a data stream is an abnormal data stream. Moreover, through the two matches of the domain name and the data volume, the accuracy of identifying whether a data stream is an abnormal data stream can be improved.

[0077] In one design, Figure 4 As shown, in a data identification method provided in an embodiment of the present application, the abnormal characteristics include: the amount of abnormal data; the method in the above step S202 specifically includes S401 or S402:

[0078] S401: When the similarity between the data volume and the abnormal data volume is greater than a preset similarity, determine that the data flow is an abnormal data flow.

[0079] Optionally, when there is only abnormal data volume but no abnormal domain name in the encrypted transmission protocol sensitive data identification knowledge base, the electronic device can use a similarity algorithm to calculate the similarity between the data volume of the data stream and the abnormal data volume in the encrypted transmission protocol sensitive data identification knowledge base. Further, when the similarity between the data volume and any abnormal data volume is greater than a preset similarity, the electronic device can determine that the data stream is an abnormal data stream.

[0080] S402: When the similarity between the data volume and the abnormal data volume is less than or equal to a preset similarity, determine that the data flow is a normal data flow.

[0081] Optionally, when the similarity between the data volume and any abnormal data volume is less than or equal to a preset similarity, the electronic device may determine that the data flow is an abnormal data flow.

[0082] The present application can identify a data flow as an abnormal data flow based on the data volume of the data flow, thereby realizing the identification of whether the data flow includes sensitive data.

[0083] In one design, Figure 5 As shown, in a data identification method provided by an embodiment of the present application, the abnormal features include: abnormal domain names; the method in the above step S202 specifically includes S501 or S502:

[0084] S501: When the domain name is the same as the abnormal domain name, determine that the data flow is an abnormal data flow.

[0085] Optionally, when there is only an abnormal domain name in the encrypted transmission protocol sensitive data identification knowledge base, but no abnormal data volume, the electronic device can query whether the domain name of the data stream is the same as the abnormal domain name in the encrypted transmission protocol sensitive data identification knowledge base. Further, when the domain name of the data stream is the same as any abnormal domain name in the encrypted transmission protocol sensitive data identification knowledge base, the electronic device can determine that the data stream is an abnormal data stream.

[0086] S502: When the domain name is different from the abnormal domain name, determine that the data flow is a normal data flow.

[0087] Optionally, when the domain name of the data stream is different from each abnormal domain name in the encryption transmission protocol sensitive data identification knowledge base, the electronic device can determine that the data stream is a normal data stream.

[0088] The present application can identify a data flow as an abnormal data flow based on the domain name of the data flow, thereby realizing the identification of whether the data flow includes sensitive data.

[0089] In one design, Figure 6As shown, a data identification method provided in an embodiment of the present application further includes S601-S602, or S601-S603:

[0090] S601. When the protocol of the data stream is a non-encrypted transmission protocol, obtain the URL of the data stream.

[0091] Optionally, the electronic device can collect data streams of multiple web pages from multiple websites on the terminal device, and analyze and identify the data stream of each web page through manual analysis or a pre-established recognition model. If sensitive data is identified in a certain web page, a sensitive data identifier of the sensitive data is generated. Furthermore, if the protocol used by the web page is a non-encrypted transmission protocol, the web page is dialed and captured to access the data stream where the sensitive data is located, and the URL of the data stream where the sensitive data is located is extracted. Furthermore, the URL of the data stream where the sensitive data is located is determined as an abnormal URL, and these abnormal URLs are updated to a pre-established non-encrypted transmission protocol sensitive data identification knowledge base. The URL is used to characterize the address information of the web page corresponding to the data stream.

[0092] For example, the non-encrypted transmission protocol may be an application layer protocol such as HTTP protocol. The website address may be information such as a uniform resource locator (URL).

[0093] An example of the structure of the non-encrypted transmission protocol sensitive data identification knowledge base is shown in Table 2:

[0094] Table 2

[0095] Sensitive data identification Abnormal URL 00000001 http: / / www.abc.com / tex / 111 00000002 http: / / www.nc.co / x / qecc

[0096] Optionally, when the protocol of the data stream collected by the electronic device is an encrypted transmission protocol, the electronic device can extract the URL of the data stream and match the URL of the data stream with abnormal URLs in the non-encrypted transmission protocol sensitive data identification knowledge base.

[0097] S602: When the URL is the same as the abnormal URL, determine that the data flow is an abnormal data flow.

[0098] Optionally, when the URL of the data stream is the same as any abnormal URL in the non-encrypted transmission protocol sensitive data identification knowledge base, the electronic device can determine that the data stream is an abnormal data stream. Further, the electronic device can generate a result log. The result log may include related information such as the sensitive data identification corresponding to the data stream, the original traffic metadata of the data stream, etc. The original traffic metadata may include URL, source IP, source port, destination IP, destination port, etc.

[0099] When the URL of a data flow is http: / / www.abc.com / tex / 111, it can be seen from Table 2 that the URL of the data flow is an abnormal URL. The data flow includes sensitive data with a sensitive data identifier of 00000001, so it can be determined that the data flow is an abnormal data flow.

[0100] S603: When the URL is different from the abnormal URL, determine that the data flow is a normal data flow.

[0101] Optionally, when the URL of the data flow is different from each abnormal URL in the non-encrypted transmission protocol sensitive data identification knowledge base, the data flow is determined to be a normal data flow.

[0102] The present application can identify whether a data stream includes sensitive data by extracting the URL of the data stream when the protocol of the data stream is a non-encrypted transmission protocol, that is, compared with the explicit traffic characteristic information and statistical characteristic information of the data stream, the URL of the data stream is more accurate in characterizing whether the data stream includes sensitive data. Since the protocol of the data stream is a non-encrypted transmission protocol, the URL of the data stream can be directly extracted to identify whether the data stream includes sensitive data. This can improve the accuracy of identifying whether the data stream includes sensitive data.

[0103] In one design, Figure 7 As shown, a data identification method provided in an embodiment of the present application, after the above step S602, the method further includes S701:

[0104] S701. Determine the information corresponding to the abnormal website as sensitive information in the data stream.

[0105] Optionally, the electronic device may determine the information corresponding to the abnormal URL as sensitive information in the data stream based on a non-encrypted transmission protocol sensitive data identification knowledge base.

[0106] For example, when the URL of a data stream is an abnormal URL http: / / www.abc.com / tex / 111, according to Table 2, the sensitive data with the sensitive data identifier of 00000001 can be determined as the sensitive information in the data stream.

[0107] The present application can match the sensitive data identifier corresponding to the abnormal URL from the non-encrypted transmission protocol sensitive data identification knowledge base according to the abnormal URL of the data stream, thereby locating the sensitive data and realizing the identification of sensitive information in the data stream.

[0108] In one design, Figure 8 As shown, a data identification method provided in an embodiment of the present application, before the above step S201 and the above step S601, the method further includes S801-S802:

[0109] S801. Collect data stream.

[0110] S802: Identify whether the protocol of the data stream is an encrypted transmission protocol.

[0111] Optionally, the electronic device can collect traffic from the terminal device through a network traffic collection device, and when the complete data stream is collected, use a protocol identification method to identify the application layer protocol of the data stream. Further, the electronic device can determine whether the application layer protocol of the data stream is an encrypted transmission protocol. The protocol identification method can be a port number identification method, which is a method of determining the transmission protocol of a data stream by checking its destination port number.

[0112] The protocol identification method can also be viewed in the browser address bar method and the data stream content analysis method. Specifically, the browser address bar method means that when the browser accesses a website, if the address bar displays a lock icon, it means that the website uses an encrypted transmission protocol. If the address bar does not display a lock icon, it means that the website uses a non-encrypted transmission protocol. The data stream content analysis method means that for those who are familiar with network transmission protocol analysis, they can determine whether it is an encrypted transmission protocol by analyzing the content of the data stream.

[0113] For example, it is known that the default destination port used by HTTP is 80, and the default destination port used by HTTPS is 443. Then, according to the port number identification method, if the destination port number of the data flow is 80, the application layer protocol of the data flow is HTTP, and the protocol of the data flow is a non-encrypted transmission protocol. If the destination port number of the data flow is 443, the application layer protocol of the data flow is HTTPS, and the protocol of the data flow is an encrypted transmission protocol.

[0114] The present application can identify whether the protocol of a data stream is an encrypted transmission protocol, so as to facilitate the subsequent use of a corresponding sensitive data identification knowledge base to identify whether the data stream includes sensitive data according to different transmission protocols, thereby improving the efficiency and accuracy of identifying whether the data stream includes sensitive data.

[0115] In one design, Fig. 9 As shown, a data identification method provided in an embodiment of the present application, after the above step S202, the method further includes S901:

[0116] S901. When the data flow is an abnormal data flow, determine the information corresponding to the abnormal feature as sensitive information in the data flow.

[0117] Optionally, the electronic device may determine the information corresponding to the abnormal feature as sensitive information in the data stream based on the encrypted transmission protocol sensitive data identification knowledge base.

[0118] Exemplarily, when the SNI of a certain data flow is an abnormal SNIabc.com, and the payload data message length is an abnormal payload data message length of 64, 164, 64, then according to Table 1, the sensitive data identified as 00000003 can be determined as sensitive information in the data flow.

[0119] The present application can match the sensitive data identifier corresponding to the abnormal feature from the sensitive data identification knowledge base of the encrypted transmission protocol according to the abnormal feature of the data stream, thereby locating the sensitive data and realizing the identification of sensitive information in the data stream.

[0120] like Fig.10 As shown, a flow chart of sensitive data identification is shown. First, traffic collection is performed through a network traffic collection device to collect a complete data stream. Further, it is identified whether the application layer protocol of the data stream is the HTTP protocol or the HTTPS protocol. If the application layer protocol of the data stream is the HTTP protocol, the URL of the data stream is extracted, and the URL is matched with the URL in the non-encrypted transmission protocol sensitive data identification knowledge base. If there is no match, it is determined that there is no sensitive data in the data stream; if there is a match, it is determined that there is sensitive data in the data stream (the sensitive data is the data corresponding to the sensitive data identifier of the sensitive data in the non-encrypted transmission protocol sensitive data identification knowledge base).

[0121] If the application layer protocol of the data stream is the HTTPS protocol, then the explicit traffic feature information (such as SNI) in the data stream is extracted. And the SNI is matched with the SNI in the encrypted transmission protocol sensitive data identification knowledge base. If there is no match, it is determined that there is no sensitive data in the data stream. If there is a match, the statistical characteristics of the data stream (such as the length of the data payload part) are further extracted. Further, using a similarity algorithm, the length of the data payload part is compared with the length of the load data message corresponding to the SNI in the encrypted transmission protocol sensitive data identification knowledge base to obtain the similarity. And determine whether the obtained similarity is greater than the preset similarity.

[0122] If the obtained similarity is greater than the preset similarity, it is determined that sensitive data exists in the data stream; if the obtained similarity is not greater than the preset similarity, it is determined that sensitive data exists in the data stream (sensitive data is the data corresponding to the sensitive data identifier of the sensitive data in the sensitive data identification knowledge base of the encrypted transmission protocol).

[0123] The above mainly introduces the solution provided by the embodiment of the present application from the perspective of the method. In order to realize the above functions, it includes hardware structures and / or software modules corresponding to the execution of each function. Those skilled in the art should easily realize that, in combination with the units and algorithm steps of each example described in the embodiment disclosed herein, the embodiment of the present application can be implemented in the form of hardware or a combination of hardware and computer software. Whether a function is executed in the form of hardware or computer software driving hardware depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to exceed the scope of the present application.

[0124] The embodiment of the present application can divide a data recognition method into functional modules according to the above method example. For example, each functional module can be divided corresponding to each function, or two or more functions can be integrated into one processing module. The above integrated module can be implemented in the form of hardware or in the form of software functional modules. Optionally, the division of modules in the embodiment of the present application is schematic and is only a logical function division. There may be other division methods in actual implementation.

[0125] Fig.11 This is a schematic diagram of the structure of a data identification device provided in an embodiment of the present application. Fig.11 As shown, a data identification device 110 is used to reduce the computing resources consumed when identifying sensitive data in a data stream, for example, for executing Figure 2 A data identification method is shown. The data identification device 110 includes: a transmission unit 1101 and a determination unit 1102.

[0126] The transmission unit 1101 is used to obtain data characteristics of the data stream when the protocol of the data stream is an encrypted transmission protocol; the data characteristics include: data volume and / or domain name.

[0127] The determination unit 1102 is configured to determine whether the data flow is an abnormal data flow based on the data features of the data flow and the abnormal features corresponding to the data features.

[0128] In a possible implementation, the abnormal features include: multiple abnormal data volumes and multiple abnormal domain names; one abnormal domain name corresponds to at least one abnormal data volume; the determination unit 1102 is also used to determine the similarity between the data volume and the target data volume when the domain name is the same as the target domain name; the target domain name is any one of the multiple abnormal domain names; the target data volume is any one of the at least one abnormal data volume corresponding to the target domain name among the multiple abnormal data volumes; the determination unit 1102 is also used to determine that the data flow is an abnormal data flow when the similarity between the data volume and the target data volume is greater than a preset similarity; the determination unit 1102 is also used to determine that the data flow is a normal data flow when the similarity between the data volume and the target data volume is less than or equal to a preset similarity.

[0129] In one possible implementation, the abnormal features include: the amount of abnormal data; the determination unit 1102 is also used to determine that the data flow is an abnormal data flow when the similarity between the data amount and the abnormal data amount is greater than a preset similarity; the determination unit 1102 is also used to determine that the data flow is a normal data flow when the similarity between the data amount and the abnormal data amount is less than or equal to a preset similarity.

[0130] In one possible implementation, the abnormal features include: an abnormal domain name; a determination unit 1102, further used to determine that the data flow is an abnormal data flow when the domain name is the same as the abnormal domain name; and a determination unit 1102, further used to determine that the data flow is a normal data flow when the domain name is different from the abnormal domain name.

[0131] In one possible implementation, the transmission unit 1101 is further used to obtain the URL of the data stream when the protocol of the data stream is a non-encrypted transmission protocol; the determination unit 1102 is further used to determine that the data stream is an abnormal data stream when the URL is the same as the abnormal URL; the determination unit 1102 is further used to determine that the data stream is a normal data stream when the URL is different from the abnormal URL.

[0132] In a possible implementation, the determination unit 1102 is further configured to determine information corresponding to the abnormal website address as sensitive information in the data stream.

[0133] In a possible implementation, the data identification device 110 further includes: a processing unit 1103; the processing unit 1103 is used to collect data streams; the processing unit 1103 is also used to identify whether the protocol of the data stream is an encrypted transmission protocol.

[0134] like Fig.12 As shown, an electronic device 130 is used to reduce the computing resources consumed when identifying sensitive data in a data stream, for example, for executing Figure 2A data identification method is shown. The electronic device 130 includes a processor 1301, a memory 1302 and a bus 1303. The processor 1301 and the memory 1302 may be connected via the bus 1303.

[0135] The processor 1301 is the control center of the communication device, which can be a processor or a general term for multiple processing elements. For example, the processor 1301 can be a general-purpose central processing unit (CPU) or other general-purpose processors. Among them, the general-purpose processor can be a microprocessor or any conventional processor.

[0136] As an embodiment, the processor 1301 may include one or more CPUs, such as Fig.12 CPU 0 and CPU 1 are shown in .

[0137] The memory 1302 may be a read-only memory (ROM) or other type of static storage device that can store static information and instructions, a random access memory (RAM) or other type of dynamic storage device that can store information and instructions, an electrically erasable programmable read-only memory (EEPROM), a disk storage medium or other magnetic storage device, or any other medium that can be used to carry or store desired program code in the form of instructions or data structures and can be accessed by a computer, but is not limited to these.

[0138] As a possible implementation, the memory 1302 may exist independently of the processor 1301, and the memory 1302 may be connected to the processor 1301 via a bus 1303 to store instructions or program codes. When the processor 1301 calls and executes the instructions or program codes stored in the memory 1302, a data identification method provided in an embodiment of the present application can be implemented.

[0139] In another possible implementation, the memory 1302 may also be integrated with the processor 1301 .

[0140] The bus 1303 may be an industry standard architecture (ISA) bus, a peripheral component interconnect (PCI) bus, or an extended industry standard architecture (EISA) bus. The bus may be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Fig.12 Only one thick line is used in the diagram, but this does not mean that there is only one bus or only one type of bus.

[0141] It should be pointed out that Fig.12 The structure shown does not constitute a limitation on the electronic device 130. Fig.12 In addition to the components shown, the electronic device 130 may include more or fewer components than shown, or combine certain components, or arrange the components differently.

[0142] As an example, combining Fig.11 The functions implemented by the transmission unit 1101, the determination unit 1102 and the processing unit 1103 in the data identification device 110 are similar to those Fig.12 The function of processor 1301 in is the same.

[0143] Optional, such as Fig.12 As shown, the electronic device 130 provided in the embodiment of the present application may further include a communication interface 1304 .

[0144] The communication interface 1304 is used to connect with other devices through a communication network. The communication network may be Ethernet, wireless access network, wireless local area network (WLAN), etc. The communication interface 1304 may include a receiving unit for receiving data and a sending unit for sending data.

[0145] In one design, in the electronic device provided in the embodiment of the present application, the communication interface can also be integrated into the processor.

[0146] Through the description of the above implementation methods, those skilled in the art can clearly understand that for the convenience and simplicity of description, only the division of the above functional units is used as an example. In practical applications, the above functions can be assigned to different functional units as needed, that is, the internal structure of the device can be divided into different functional units to complete all or part of the functions described above. The specific working process of the system, device and unit described above can refer to the corresponding process in the aforementioned method embodiment, and will not be repeated here.

[0147] An embodiment of the present application also provides a computer-readable storage medium, in which instructions are stored. When a computer executes the instructions, the computer executes each step in the method flow shown in the above method embodiment.

[0148] An embodiment of the present application provides a computer program product. When a computer instruction is executed on an electronic device, the electronic device executes a data identification method in the above method embodiment.

[0149] Among them, the computer-readable storage medium can be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples of computer-readable storage media (a non-exhaustive list) include: an electrical connection with one or more wires, a portable computer disk, a hard disk. Random access memory (random access memory, RAM), read-only memory (read-only memory, ROM), erasable programmable read only memory (erasable programmable read only memory, EPROM), registers, hard disks, optical fibers, portable compact disc read-only memory (compact disc read-only memory, CD-ROM), optical storage devices, magnetic storage devices, or the above in a suitable combination, or any other form of computer-readable storage medium known in the art.

[0150] An exemplary storage medium is coupled to a processor so that the processor can read information from the storage medium and write information to the storage medium. Of course, the storage medium can also be an integral part of the processor. The processor and the storage medium can be located in an application specific integrated circuit (ASIC).

[0151] In the embodiments of the present application, a computer-readable storage medium may be any tangible medium that contains or stores a program, which may be used by or in conjunction with an instruction execution system, apparatus, or device.

[0152] Since the electronic device, computer-readable storage medium, and computer program product in the embodiments of the present application can be applied to the above method, the technical effects that can be obtained can also refer to the above method embodiments, and the embodiments of the present application will not be repeated here.

[0153] The above are only specific implementation methods of the present application, but the protection scope of the present application is not limited thereto, and any changes or substitutions within the technical scope disclosed in the present application should be included in the protection scope of the present application.

Claims

1. A data identification method, characterized in that: The method comprises: In the case where the protocol of the data stream is an encrypted transmission protocol, obtaining data features of the data stream; the data features include: data volume and / or domain name; Based on the data features of the data flow and the abnormal features corresponding to the data features, it is determined whether the data flow is an abnormal data flow.

2. The method according to claim 1, characterized in that The abnormal features include: multiple abnormal data volumes and multiple abnormal domain names; one abnormal domain name corresponds to at least one abnormal data volume; The determining whether the data flow is an abnormal data flow based on the data feature of the data flow and the abnormal feature corresponding to the data feature includes: In the case where the domain name is the same as the target domain name, determining the similarity between the data volume and the target data volume; the target domain name is any one of the multiple abnormal domain names; the target data volume is any one of the at least one abnormal data volume corresponding to the target domain name among the multiple abnormal data volumes; In a case where the similarity between the data volume and the target data volume is greater than a preset similarity, determining that the data flow is an abnormal data flow; Alternatively, when the similarity between the data volume and the target data volume is less than or equal to the preset similarity, the data flow is determined to be a normal data flow.

3. The method according to claim 1, characterized in that: The abnormal characteristics include: abnormal data volume; The determining whether the data flow is an abnormal data flow based on the data feature of the data flow and the abnormal feature corresponding to the data feature includes: In a case where the similarity between the data volume and the abnormal data volume is greater than a preset similarity, determining that the data flow is an abnormal data flow; Alternatively, when the similarity between the data volume and the abnormal data volume is less than or equal to the preset similarity, the data flow is determined to be a normal data flow.

4. The method according to claim 1, characterized in that: The abnormal features include: abnormal domain names; The determining whether the data flow is an abnormal data flow based on the data feature of the data flow and the abnormal feature corresponding to the data feature includes: In a case where the domain name is the same as the abnormal domain name, determining that the data flow is an abnormal data flow; Alternatively, when the domain name is different from the abnormal domain name, it is determined that the data flow is a normal data flow.

5. The method according to claim 1, characterized in that The method further comprises: When the protocol of the data stream is a non-encrypted transmission protocol, obtaining the URL of the data stream; In the case where the website address is the same as the abnormal website address, determining that the data flow is an abnormal data flow; Alternatively, when the website address is different from the abnormal website address, it is determined that the data flow is a normal data flow.

6. The method according to claim 5, characterized in that In the case where the website address is the same as the abnormal website address, after determining that the data flow is an abnormal data flow, the method further includes: The information corresponding to the abnormal website address is determined as sensitive information in the data stream.

7. The method according to claim 1, characterized in that In the case where the protocol of the data stream is an encrypted transmission protocol, before obtaining the data volume of the data stream, the method further includes: collecting the data stream; Identify whether the protocol of the data stream is an encrypted transmission protocol.

8. The method according to claim 1, characterized in that After determining whether the data flow is an abnormal data flow based on the data feature of the data flow and the abnormal feature corresponding to the data feature, the method further includes: In the case that the data flow is an abnormal data flow, the information corresponding to the abnormal feature is determined as sensitive information in the data flow.

9. A data identification device, characterized in that: The data identification device comprises: a transmission unit and a determination unit; The transmission unit is used to obtain data characteristics of the data stream when the protocol of the data stream is an encrypted transmission protocol; the data characteristics include: data volume and / or domain name; The determining unit is used to determine whether the data flow is an abnormal data flow based on data features of the data flow and abnormal features corresponding to the data features.

10. An electronic device, characterized in that: include: Processor and memory; The memory is used to store one or more programs, and the one or more programs include computer-executable instructions. When the electronic device is running, the processor executes the computer-executable instructions stored in the memory to enable the electronic device to perform the method described in any one of claims 1-8.

11. A computer-readable storage medium storing one or more programs, characterized in that: The one or more programs include instructions which, when executed by a computer, cause the computer to perform the method of any one of claims 1-8.

12. A computer program product, characterized in that The computer program product comprises computer instructions, and when the computer instructions are executed on an electronic device, the electronic device executes the method according to any one of claims 1 to 8.

Images