Data identification method, device, equipment, storage medium and program product

Abstract

The application discloses a data identification method and device, equipment, a storage medium and a program product, relates to the technical field of communication, and is used for reducing the consumed computing power resources when sensitive data of a data stream is identified. The method comprises the following steps: in the case that the protocol of the data stream is an encrypted transmission protocol, acquiring data characteristics of the data stream; the data characteristics comprise a data amount and / or a domain name; and based on the data characteristics of the data stream and abnormal characteristics corresponding to the data characteristics, it is determined whether the data stream is an abnormal data stream. The application is applied to a scene of identifying data.

Description

Technical Field

[0001] This application relates to the field of communication technology, and in particular to a data identification method, apparatus, device, storage medium, and program product. Background Technology

[0002] With the development and popularity of internet technology, issues such as data privacy and security have become particularly prominent. As a channel for data and information dissemination, the internet has had a profound impact on many aspects of society and culture. In response to the increasingly serious problems of privacy data leaks, online rumor-mongering, online fraud, and the spread of harmful information, identifying and monitoring sensitive data (also known as sensitive words or sensitive information) in internet data streams (also called network traffic) is one effective solution. Currently, data in data streams can be extracted into text, and sensitive words (such as privacy information, fraudulent information, etc.) can be matched or identified in the text of the data stream using methods such as manually established sensitive word databases or recognition models based on text features, thereby discovering sensitive data in the data stream.

[0003] However, when extracting data from a data stream into text for sensitive word recognition, it is necessary to perform operations such as deserialization on the binary data packets in the data stream to extract the text, which results in a significant consumption of computing resources. Summary of the Invention

[0004] This application provides a data recognition method, apparatus, device, storage medium, and program product to solve the technical problem that when extracting data from a data stream into text for sensitive word recognition, it is necessary to perform operations such as deserialization on the binary data packets in the data stream to extract the text, which leads to a high consumption of computing resources.

[0005] To achieve the above objectives, this application adopts the following technical solution:

[0006] Firstly, a data identification method is provided, comprising: when the protocol of the data stream is an encrypted transmission protocol, obtaining the data characteristics of the data stream; the data characteristics include: data volume and / or domain name; and determining whether the data stream is an abnormal data stream based on the data characteristics of the data stream and the abnormal characteristics corresponding to the data characteristics.

[0007] In one possible implementation, the abnormal features include: multiple abnormal data volumes and multiple abnormal domain names; each abnormal domain name corresponds to at least one abnormal data volume; based on the data features of the data stream and the abnormal features corresponding to the data features, determining whether the data stream is an abnormal data stream includes: when the domain name is the same as the target domain name, determining the similarity between the data volume and the target data volume; the target domain name is any one of the multiple abnormal domain names; the target data volume is any one of the multiple abnormal data volumes corresponding to at least one abnormal data volume of the target domain name; when the similarity between the data volume and the target data volume is greater than a preset similarity, determining the data stream as an abnormal data stream; or, when the similarity between the data volume and the target data volume is less than or equal to a preset similarity, determining the data stream as a normal data stream.

[0008] In one possible implementation, the abnormal features include: abnormal data volume; determining whether a data stream is an abnormal data stream based on the data features of the data stream and the abnormal features corresponding to the data features includes: determining the data stream as an abnormal data stream if the similarity between the data volume and the abnormal data volume is greater than a preset similarity; or, determining the data stream as a normal data stream if the similarity between the data volume and the abnormal data volume is less than or equal to a preset similarity.

[0009] In one possible implementation, the abnormal features include: abnormal domain names; determining whether a data stream is an abnormal data stream based on the data features of the data stream and the abnormal features corresponding to the data features, including: determining that the data stream is an abnormal data stream when the domain name is the same as the abnormal domain name; or, determining that the data stream is a normal data stream when the domain name is different from the abnormal domain name.

[0010] In one possible implementation, the method further includes: obtaining the URL of the data stream when the protocol of the data stream is an unencrypted transmission protocol; determining that the data stream is an abnormal data stream when the URL is the same as the abnormal URL; or determining that the data stream is a normal data stream when the URL is different from the abnormal URL.

[0011] In one possible implementation, after determining that the data stream is an abnormal data stream when the URL is the same as the abnormal URL, the method further includes: identifying the information corresponding to the abnormal URL as sensitive information in the data stream.

[0012] In one possible implementation, if the data stream protocol is an encrypted transmission protocol, before acquiring the data volume of the data stream, the method further includes: acquiring the data stream; and identifying whether the data stream protocol is an encrypted transmission protocol.

[0013] In one possible implementation, after determining whether a data stream is an abnormal data stream based on its data characteristics and the corresponding abnormal characteristics, the method further includes: if the data stream is an abnormal data stream, identifying the information corresponding to the abnormal characteristics as sensitive information in the data stream.

[0014] Secondly, a data identification device is provided, comprising: a transmission unit and a determination unit; the transmission unit is used to acquire data characteristics of the data stream when the data stream protocol is an encrypted transmission protocol; the data characteristics include: data volume and / or domain name; the determination unit is used to determine whether the data stream is an abnormal data stream based on the data characteristics of the data stream and the abnormal characteristics corresponding to the data characteristics.

[0015] In one possible implementation, the abnormal features include: multiple abnormal data volumes and multiple abnormal domain names; each abnormal domain name corresponds to at least one abnormal data volume; the determining unit is further configured to determine the similarity between the data volume and the target data volume when the domain name is the same as the target domain name; the target domain name is any one of the multiple abnormal domain names; the target data volume is any one of the multiple abnormal data volumes corresponding to at least one abnormal data volume of the target domain name; the determining unit is further configured to determine the data stream as an abnormal data stream when the similarity between the data volume and the target data volume is greater than a preset similarity; the determining unit is further configured to determine the data stream as a normal data stream when the similarity between the data volume and the target data volume is less than or equal to a preset similarity.

[0016] In one possible implementation, the abnormal features include: abnormal data volume; the determining unit is further configured to determine the data stream as an abnormal data stream when the similarity between the data volume and the abnormal data volume is greater than a preset similarity; the determining unit is further configured to determine the data stream as a normal data stream when the similarity between the data volume and the abnormal data volume is less than or equal to a preset similarity.

[0017] In one possible implementation, the abnormal features include: an abnormal domain name; a determining unit, further configured to determine that the data stream is an abnormal data stream when the domain name is the same as the abnormal domain name; and a determining unit, further configured to determine that the data stream is a normal data stream when the domain name is different from the abnormal domain name.

[0018] In one possible implementation, the transmission unit is further configured to obtain the URL of the data stream when the protocol of the data stream is an unencrypted transmission protocol; the determination unit is further configured to determine that the data stream is an abnormal data stream when the URL is the same as the abnormal URL; and the determination unit is further configured to determine that the data stream is a normal data stream when the URL is different from the abnormal URL.

[0019] In one possible implementation, the determining unit is also used to determine the information corresponding to the abnormal URL as sensitive information in the data stream.

[0020] In one possible implementation, the data identification device further includes: a processing unit; the processing unit is used to acquire data streams; the processing unit is also used to identify whether the protocol of the data stream is an encrypted transmission protocol.

[0021] Thirdly, an electronic device includes: a processor and a memory; wherein the memory is used to store one or more programs, the one or more programs including computer-executable instructions, and when the electronic device is running, the processor executes the computer-executable instructions stored in the memory to cause the electronic device to perform a data identification method as described in the first and second aspects.

[0022] Fourthly, a computer-readable storage medium is provided for storing one or more programs, the one or more programs including instructions that, when executed by a computer, cause the computer to perform a data identification method as described in the first and second aspects.

[0023] Fifthly, a computer program product is provided, which, when computer instructions are executed on an electronic device, causes the electronic device to perform a data identification method as described in the first and second aspects.

[0024] This application provides a data identification method, apparatus, device, storage medium, and program product, applied in data identification scenarios. When the data stream protocol is an encrypted transmission protocol, data characteristics of the data stream, including data volume and / or domain name, are obtained. Further, based on the data characteristics of the data stream and the corresponding abnormal characteristics, it is determined whether the data stream is an abnormal data stream. That is, when the data stream is transmitted encrypted, external data characteristics (i.e., data volume and / or domain name) can be extracted to identify the data stream. If the external data characteristics are abnormal, it indicates that the data stream is abnormal, and vice versa. If the data stream is abnormal, it indicates that the data stream contains sensitive data. Thus, it is unnecessary to extract the data from the data stream into text to identify whether the data stream contains sensitive data. Using the above method, it is possible to identify whether a data stream is an abnormal data stream based on the data volume and / or domain name of the encrypted data stream. This solves the technical problem that extracting text from a data stream for sensitive word recognition requires deserialization of binary data packets in the data stream, which leads to high consumption of computing resources. As a result, it reduces the computing resources consumed when performing sensitive data recognition on a data stream. Attached Figure Description

[0025] Figure 1 A schematic diagram of the structure of a data recognition system provided for an embodiment of this application;

[0026] Figure 2 A flowchart illustrating a data identification method provided for embodiments of this application. Figure 1 ;

[0027] Figure 3 A flowchart illustrating a data identification method provided for embodiments of this application. Figure 2 ;

[0028] Figure 4 A flowchart illustrating a data identification method provided for embodiments of this application. Figure 3 ;

[0029] Figure 5 A flowchart illustrating a data identification method provided for embodiments of this application. Figure 4 ;

[0030] Figure 6 A flowchart illustrating a data identification method provided for embodiments of this application. Figure 5 ;

[0031] Figure 7 A flowchart illustrating a data identification method provided for embodiments of this application. Figure 6 ;

[0032] Figure 8 A flowchart illustrating a data identification method provided for embodiments of this application. Figure 7 ;

[0033] Figure 9 A flowchart illustrating a data identification method provided for embodiments of this application. Figure 8 ;

[0034] Figure 10 A schematic diagram of a sensitive data identification process provided for an embodiment of this application;

[0035] Figure 11 A schematic diagram of the structure of a data identification device provided for an embodiment of this application;

[0036] Figure 12 This is a schematic diagram of the structure of an electronic device provided as an embodiment of this application. Detailed Implementation

[0037] The technical solutions in the embodiments of this application will now be described with reference to the accompanying drawings.

[0038] In the description of this application, unless otherwise stated, " / " means "or". For example, A / B can mean A or B. "And / or" in this document is merely a description of the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent: A alone, A and B simultaneously, and B alone. Furthermore, "at least one" and "multiple" refer to two or more. The terms "first," "second," etc., do not limit the quantity or order of execution, and "first," "second," etc., do not necessarily imply differences.

[0039] Currently, most mainstream websites use encrypted traffic protocols such as Hypertext Transfer Protocol Secure (HTTPS) to transmit data, which poses unprecedented challenges to network monitoring. Currently, data in the data stream can be extracted into text, and sensitive words can be matched or identified using manually built sensitive word libraries or recognition models based on text features, thereby discovering sensitive data within the data stream.

[0040] However, when extracting data from a data stream into text for sensitive word recognition, it is necessary to perform operations such as deserialization on the binary data packets in the data stream to extract the text, which results in a significant consumption of computing resources.

[0041] To address the aforementioned issues, this application provides a data identification method that can automatically crawl the raw data of web pages and identify sensitive data within the raw data through manual analysis or identification models. Then, it establishes sensitive data identification knowledge bases for two types of application layer protocols: unencrypted transmission protocols such as Hypertext Transfer Protocol (HTTP) and encrypted transmission protocols such as HTTPS. Furthermore, it matches the corresponding sensitive data identification knowledge bases with the features of unencrypted and encrypted data streams respectively, thereby achieving the identification of sensitive data in unencrypted and encrypted data streams.

[0042] The data recognition method provided in this application embodiment can be applied to a data recognition system. Figure 1 A schematic diagram of the structure of a data recognition system is shown. Figure 1 As shown, the data identification system 10 includes a terminal device 11 and an electronic device 12. The terminal device 11 and the electronic device 12 can be connected by a wired connection or a wireless connection, and this embodiment of the invention does not limit the connection.

[0043] Electronic device 12 is used to determine whether a data stream is an abnormal data stream when the protocol of the data stream in terminal device 11 is an encrypted transmission protocol.

[0044] Both terminal device 11 and electronic device 12 can be physical machines. For example, electronic device 12 can be a base station device, a desktop computer, or a server, or a server cluster composed of multiple servers. Terminal device 11 can be a mobile phone, tablet computer, laptop computer, ultra-mobile personal computer (UMPC), netbook, personal digital assistant (PDA), or other terminal devices.

[0045] The following description, in conjunction with the accompanying drawings, describes a data identification method provided by an embodiment of this application. For example... Figure 2 As shown in the embodiment of this application, a data identification method is provided and applied to an electronic device. The method includes steps S201-S204:

[0046] S201. When the data stream protocol is an encrypted transmission protocol, obtain the data characteristics of the data stream.

[0047] The data characteristics include: data volume and / or domain name.

[0048] It is understandable that when the data stream protocol is an encrypted transmission protocol, electronic devices can obtain the data characteristics of the data stream.

[0049] Optionally, the electronic device can collect data streams (also known as data traffic) from multiple web pages on multiple websites on the terminal device, and analyze and identify the data stream of each web page through manual judgment or a pre-established identification model. If sensitive data is identified in a web page, a sensitive data identifier (e.g., an identifier (ID)) is generated for that sensitive data. Furthermore, if the web page uses an encrypted transmission protocol, the web page is crawled and accessed to access the data stream containing the sensitive data, extracting the explicit traffic characteristics of the data stream containing the sensitive data, and statistically analyzing the statistical characteristics of the data stream containing the sensitive data.

[0050] Furthermore, the explicit traffic characteristics and statistical characteristics (collectively referred to as data characteristics) of the data stream containing the sensitive data are identified as abnormal explicit traffic characteristics and abnormal statistical characteristics, and these abnormal data characteristics are updated in a pre-established knowledge base for identifying sensitive data in encrypted transmission protocols. Explicit traffic characteristics can include information such as domain names and cipher suites. Statistical characteristics can include information representing the data volume, such as the length of the data payload. Domain names are used to represent the address information of the website where the webpage corresponding to the data stream resides.

[0051] For example, sensitive data can be text data such as words and phrases that involve user privacy, terrorism, politics, online rumor-mongering, or online fraud. The encrypted transmission protocol can be an application layer protocol such as HTTPS. The domain name can be information representing the domain name, such as a Server Name Indication (SNI).

[0052] Table 1 shows an example of the structure of a knowledge base for identifying sensitive data in encrypted transmission protocols.

[0053] Table 1

[0054] Sensitive data identification Abnormal SNI Abnormal load data packet length Similarity threshold 00000003 abc.com 64，164，64 α 00000004 abc.com 152，132，40，33，4 α 00000005 cba.cn 55，24，55，66 α

[0055] The similarity threshold (also known as the preset similarity) in Table 1 is the similarity threshold corresponding to the length of the abnormal load data packet. The similarity threshold corresponding to the length of each abnormal load data packet can be the same or different, and can be set as needed.

[0056] Optionally, the electronic device may include a network traffic acquisition device. The electronic device can use the network traffic acquisition device to collect traffic from the terminal device, capturing a complete data stream. The captured complete data stream may be the complete data stream of a specific webpage from a specific website on the terminal device.

[0057] Furthermore, when the data stream protocol is an encrypted transmission protocol, electronic devices can extract the data characteristics of the data stream.

[0058] S202. Based on the data characteristics of the data stream and the abnormal characteristics corresponding to the data characteristics, determine whether the data stream is an abnormal data stream.

[0059] It is understandable that electronic devices can determine whether a data stream is an abnormal data stream based on the data characteristics of the data stream and the abnormal characteristics corresponding to the data characteristics.

[0060] Optionally, when the data characteristic of the data stream is data volume, the corresponding anomalous characteristic is anomalous data volume. When the data characteristic of the data stream is domain name, the corresponding anomalous characteristic is anomalous domain name. When the data characteristics of the data stream are both data volume and domain name, the corresponding anomalous characteristics are both anomalous data volume and anomalous domain name.

[0061] Electronic devices can determine whether a data stream is an abnormal data stream based on the data characteristics of the data stream and the corresponding abnormal characteristics, according to a knowledge base for sensitive data identification of encrypted transmission protocols.

[0062] For example, if the payload data packet length of a certain data stream is 64, 164, 64, and the SNI is abc.com, then according to Table 1, the payload data packet length of this data stream is an abnormal payload data packet length, and the SNI is an abnormal SNI. This data stream includes sensitive data with a sensitive data identifier of 00000003, so the data stream can be determined to be an abnormal data stream.

[0063] It's important to note that, generally, the URL of a data stream is more accurate in indicating whether it contains sensitive data. However, if the data stream uses an encrypted transmission protocol, the URL cannot be extracted. In this case, explicit traffic characteristics and statistical features of the data stream can be extracted to identify whether it contains sensitive data. These explicit traffic characteristics and statistical features are external features of the data stream and can be obtained without decrypting the data stream.

[0064] In a design, such as Figure 3 As shown, the data identification method provided in this application embodiment includes the following abnormal features: multiple abnormal data volumes and multiple abnormal domain names; each abnormal domain name corresponds to at least one abnormal data volume; the method in step S202 above specifically includes S301-S302, or S301-S303:

[0065] S301. When the domain name is the same as the target domain name, determine the similarity between the data volume and the target data volume.

[0066] The target domain name is any one of the multiple abnormal domain names; the target data volume is any one of the multiple abnormal data volumes corresponding to the target domain name.

[0067] Optionally, the knowledge base for identifying sensitive data in encrypted transmission protocols includes multiple abnormal domain names. Electronic devices can perform preliminary screening based on the domain name of the data stream. Specifically, the electronic device can first extract the domain name of the data stream and check if the domain name exists in the knowledge base for identifying sensitive data in encrypted transmission protocols. If the domain name does not exist in the knowledge base (i.e., the domain name of the data stream is different from the target domain name), it indicates that the data stream does not contain sensitive data, and the data stream is determined to be a normal data stream.

[0068] If the domain name exists in the knowledge base for identifying sensitive data in encrypted transmission protocols (i.e., the domain name of the data stream is the same as the target domain name), a similarity algorithm is further used to calculate the similarity between the data volume of the data stream and the data volume corresponding to that domain name in the knowledge base for identifying sensitive data in encrypted transmission protocols (i.e., the target data volume). Suitable algorithms can be Euclidean distance, Manhattan distance, cosine similarity, etc.

[0069] It should be noted that under the same domain name, there may be multiple sensitive data with different data volumes. For example, in Table 1, the abnormal SNI of sensitive data 00000003 and sensitive data 00000004 is abc.com, but the abnormal payload data packet lengths are 64, 164, 64 and 152, 132, 40, 33, 4 respectively.

[0070] For example, assuming the SNI of the data stream is abc.com, and the payload packet lengths are 64, 164, and 64, then according to Table 1, we need to calculate the similarity between the payload packet lengths of the data stream and the abnormal payload packet lengths of 64, 164, and 64, as well as the abnormal payload packet lengths of 152, 132, 40, 33, and 4. We can then find that the similarity between the payload packet lengths of the data stream (64, 164, 64) and the abnormal payload packet lengths (64, 164, 64) is 100%. The similarity between the payload packet lengths of the data stream (64, 164, 64) and the abnormal payload packet lengths (152, 132, 40, 33, 4) is 0%.

[0071] S302. If the similarity between the data volume and the target data volume is greater than the preset similarity, the data stream is determined to be an abnormal data stream.

[0072] Optionally, if the similarity between the data volume and the target data volume is greater than a preset similarity, the electronic device can determine that the data stream is an abnormal data stream. Furthermore, the electronic device can generate a result log. This result log may include sensitive data identifiers corresponding to the data stream, original traffic metadata, and other related information. The original traffic metadata may include SNI, source Internet Protocol Address (IP), source port, destination IP, destination port, etc.

[0073] For example, the preset similarity can be any reasonable value such as 80% or 90%. If the similarity between the payload data packet lengths of the data stream (64,164,64) and the abnormal payload data packet lengths (64,164,64) is 100%, that is, the similarity between the payload data packet lengths of the data stream (64,164,64) and the abnormal payload data packet lengths (64,164,64) is greater than the preset similarity, then the data stream includes sensitive data with the sensitive data identifier 00000003, and therefore the data stream is an abnormal data stream.

[0074] S303. If the similarity between the data volume and the target data volume is less than or equal to the preset similarity, the data stream is determined to be a normal data stream.

[0075] Optionally, if the similarity between the data volume and the target data volume is less than or equal to a preset similarity, the electronic device can determine that the data stream is a normal data stream.

[0076] This application can first filter whether a data stream is likely to be abnormal based on its domain name, and then further filter it based on its data volume if it is considered potentially abnormal. This reduces the workload of identifying abnormal data streams, as it only requires matching the data volume corresponding to the domain name that matches the data stream's domain name, rather than matching every data volume in the encrypted transmission protocol sensitive data identification knowledge base. This improves the efficiency of identifying abnormal data streams. Furthermore, by performing these two matching steps—domain name and data volume—the accuracy of identifying abnormal data streams can be improved.

[0077] In a design, such as Figure 4 As shown, the data identification method provided in this application embodiment includes abnormal data volume as an abnormal feature; the method in step S202 above specifically includes S401 or S402:

[0078] S401. If the similarity between the data volume and the abnormal data volume is greater than the preset similarity, the data stream is determined to be an abnormal data stream.

[0079] Optionally, when the knowledge base for identifying sensitive data in encrypted transmission protocols contains only abnormal data volumes but no abnormal domain names, the electronic device can use a similarity algorithm to calculate the similarity between the data volume of the data stream and the abnormal data volumes in the knowledge base. Furthermore, if the similarity between the data volume and any abnormal data volume is greater than a preset similarity, the electronic device can determine that the data stream is an abnormal data stream.

[0080] S402. If the similarity between the data volume and the abnormal data volume is less than or equal to the preset similarity, the data stream is determined to be a normal data stream.

[0081] Optionally, if the similarity between the data volume and any abnormal data volume is less than or equal to a preset similarity, the electronic device can determine that the data stream is an abnormal data stream.

[0082] This application can identify abnormal data streams based on the amount of data in the data stream, thereby enabling the identification of whether the data stream contains sensitive data.

[0083] In a design, such as Figure 5 As shown, the data identification method provided in this application embodiment includes anomaly features such as: abnormal domain names; the method in step S202 above specifically includes S501 or S502:

[0084] S501. If the domain name is the same as the abnormal domain name, the data stream is determined to be an abnormal data stream.

[0085] Optionally, if the knowledge base for identifying sensitive data in encrypted transmission protocols contains only abnormal domain names but no abnormal data volume, the electronic device can query whether the domain name of the data stream is the same as the abnormal domain name in the knowledge base. Furthermore, if the domain name of the data stream is the same as any abnormal domain name in the knowledge base, the electronic device can determine that the data stream is an abnormal data stream.

[0086] S502. If the domain name is different from the abnormal domain name, determine that the data stream is a normal data stream.

[0087] Optionally, if the domain name of the data stream is different from each abnormal domain name in the knowledge base for identifying sensitive data of encrypted transmission protocols, the electronic device can determine that the data stream is a normal data stream.

[0088] This application can identify abnormal data streams based on their domain names, thereby enabling the identification of whether sensitive data is included in the data stream.

[0089] In a design, such as Figure 6As shown in the embodiment of this application, a data identification method is provided, which further includes steps S601-S602 or S601-S603:

[0090] S601. If the data stream protocol is an unencrypted transmission protocol, obtain the URL of the data stream.

[0091] Optionally, the electronic device can collect data streams from multiple web pages of multiple websites on the terminal device, and analyze and identify the data stream of each web page through manual judgment or a pre-established identification model. If sensitive data is identified in a web page, a sensitive data identifier for that sensitive data is generated. Further, if the web page uses an unencrypted transmission protocol, the web page is crawled to access the data stream containing the sensitive data and extract its URL. Further, the URL of the data stream containing the sensitive data is identified as an abnormal URL, and these abnormal URLs are updated in a pre-established knowledge base for identifying sensitive data in unencrypted transmission protocols. The URL is used to represent the address information of the web page corresponding to the data stream.

[0092] For example, the unencrypted transport protocol can be an application layer protocol such as HTTP. The URL can be information from a Uniform Resource Locator (URL).

[0093] Table 2 shows an example of the structure of a knowledge base for identifying sensitive data in unencrypted transmission protocols.

[0094] Table 2

[0095] Sensitive data identification Abnormal URL 00000001 http: / / www.abc.com / tex / 111 00000002 http: / / www.nc.co / x / qecc

[0096] Optionally, if the protocol of the data stream collected by the electronic device is an encrypted transmission protocol, the electronic device can extract the URL of the data stream and match the URL of the data stream with abnormal URLs in the knowledge base for identifying sensitive data using unencrypted transmission protocols.

[0097] S602. If the URL is the same as the abnormal URL, determine that the data stream is an abnormal data stream.

[0098] Optionally, if the URL of the data stream is the same as any abnormal URL in the knowledge base for identifying sensitive data in unencrypted transmission protocols, the electronic device can determine that the data stream is an abnormal data stream. Furthermore, the electronic device can generate a result log. This result log may include the sensitive data identifier corresponding to the data stream, the original traffic metadata of the data stream, and other related information. The original traffic metadata may include URL, source IP, source port, destination IP, destination port, etc.

[0099] If the URL of a certain data stream is http: / / www.abc.com / tex / 111, then according to Table 2, the URL of this data stream is an abnormal URL. The data stream contains sensitive data with a sensitive data identifier of 00000001, so the data stream can be determined to be an abnormal data stream.

[0100] S603. If the URL is different from the abnormal URL, determine that the data stream is a normal data stream.

[0101] Optionally, if the URL of the data stream is different from each abnormal URL in the knowledge base for identifying sensitive data of unencrypted transmission protocols, the data stream is determined to be a normal data stream.

[0102] This application enables the identification of whether a data stream contains sensitive data by extracting its URL when the data stream protocol is unencrypted. In other words, compared to explicit traffic characteristics and statistical features of the data stream, the URL is more accurate in characterizing whether a data stream contains sensitive data. Since the data stream protocol is unencrypted, the URL can be directly extracted to identify whether the data stream contains sensitive data. This improves the accuracy of identifying whether a data stream contains sensitive data.

[0103] In a design, such as Figure 7 As shown, the data identification method provided in this application embodiment further includes step S701 after step S602:

[0104] S701. Identify the information corresponding to the abnormal URL as sensitive information in the data stream.

[0105] Alternatively, electronic devices can identify information corresponding to abnormal URLs as sensitive information in the data stream based on a knowledge base for identifying sensitive data in unencrypted transmission protocols.

[0106] For example, if the URL of a certain data stream is an abnormal URL http: / / www.abc.com / tex / 111, then according to Table 2, the sensitive data marked as 00000001 can be identified as sensitive information in that data stream.

[0107] This application can locate sensitive data by matching the sensitive data identifier corresponding to the abnormal URL in the knowledge base for identifying sensitive data in unencrypted transmission protocols based on the abnormal URL in the data stream, thereby realizing the identification of sensitive information in the data stream.

[0108] In a design, such as Figure 8 As shown, the data identification method provided in this application embodiment further includes steps S801-S802 before the above-described steps S201 and S601:

[0109] S801, Acquire data stream.

[0110] S802. Identify whether the protocol of the data stream is an encrypted transmission protocol.

[0111] Optionally, the electronic device can collect traffic from the terminal device using a network traffic acquisition device, and when a complete data stream is collected, it can identify the application layer protocol of the data stream using a protocol identification method. Furthermore, the electronic device can determine whether the application layer protocol of the data stream is an encrypted transmission protocol. The protocol identification method can be port number identification, which is a method of determining the transmission protocol by examining the destination port number of the data stream.

[0112] Protocol identification methods also include viewing the browser address bar and analyzing the data stream content. Specifically, viewing the browser address bar means that when a browser visits a website, if the address bar displays a lock icon, it indicates that the website uses an encrypted transmission protocol; if no lock icon is displayed, it indicates that the website uses an unencrypted transmission protocol. Analyzing the data stream content means that for those familiar with network transmission protocol analysis, they can determine whether a transmission protocol is encrypted by analyzing the content of the data stream.

[0113] For example, it is known that HTTP uses port 80 by default, and HTTPS uses port 443 by default. Therefore, using the port number identification method, if the destination port number of the data stream is 80, then the application layer protocol of the data stream is HTTP, and the protocol of the data stream is an unencrypted transmission protocol. If the destination port number of the data stream is 443, then the application layer protocol of the data stream is HTTPS, and the protocol of the data stream is an encrypted transmission protocol.

[0114] This application can identify whether the protocol of a data stream is an encrypted transmission protocol, which facilitates the subsequent use of the corresponding sensitive data identification knowledge base to identify whether the data stream contains sensitive data based on different transmission protocols, thereby improving the efficiency and accuracy of identifying whether the data stream contains sensitive data.

[0115] In a design, such as Figure 9 As shown, the data identification method provided in this application embodiment further includes step S901 after the above step S202:

[0116] S901. In the case of an abnormal data stream, the information corresponding to the abnormal characteristics is identified as sensitive information in the data stream.

[0117] Alternatively, the electronic device can identify sensitive information in the data stream based on the sensitive data identification knowledge base of the encrypted transmission protocol, using information corresponding to abnormal features.

[0118] For example, if the SNI of a certain data stream is an abnormal SNIabc.com, and the length of the payload data packet is an abnormal payload data packet length of 64, 164, or 64, then according to Table 1, the sensitive data identified as 00000003 can be identified as the sensitive information in the data stream.

[0119] This application can locate sensitive data by matching the sensitive data identifier corresponding to the abnormal characteristics of the data stream from the sensitive data identification knowledge base of the encrypted transmission protocol, thereby realizing the identification of sensitive information in the data stream.

[0120] like Figure 10 The diagram illustrates a process for sensitive data identification. First, network traffic is collected using a network traffic acquisition device to obtain a complete data stream. Next, the application layer protocol of this data stream is identified as either HTTP or HTTPS. If the application layer protocol is HTTP, the URL of the data stream is extracted and matched against URLs in the unencrypted transmission protocol sensitive data identification knowledge base. If there is no match, it is determined that no sensitive data exists in the data stream; if there is a match, it is determined that sensitive data exists in the data stream (the sensitive data is the data corresponding to the sensitive data identifier in the unencrypted transmission protocol sensitive data identification knowledge base).

[0121] If the application layer protocol of the data stream is HTTPS, then explicit traffic feature information (e.g., SNI) is extracted from the data stream. This SNI is then matched against SNIs in the encrypted transmission protocol sensitive data identification knowledge base. If there is no match, it is determined that there is no sensitive data in the data stream. If there is a match, then statistical features of the data stream (e.g., data payload length) are further extracted. Furthermore, a similarity algorithm is used to compare the length of the data payload with the payload data packet length corresponding to the SNI in the encrypted transmission protocol sensitive data identification knowledge base, obtaining a similarity score. It is then determined whether the obtained similarity score is greater than a preset similarity score.

[0122] If the obtained similarity is greater than the preset similarity, it is determined that there is sensitive data in the data stream; if the obtained similarity is not greater than the preset similarity, it is determined that there is sensitive data in the data stream (the sensitive data is the data corresponding to the sensitive data identifier in the knowledge base for sensitive data identification of encrypted transmission protocol).

[0123] The foregoing mainly describes the solutions provided by the embodiments of this application from a methodological perspective. To achieve the above functions, it includes corresponding hardware structures and / or software modules for executing each function. Those skilled in the art should readily recognize that, in conjunction with the units and algorithm steps of the various examples described in the embodiments disclosed herein, the embodiments of this application can be implemented in hardware or a combination of hardware and computer software. Whether a function is executed in hardware or by computer software driving hardware depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0124] This application embodiment can divide a data recognition method into functional modules based on the above method example. For example, each function can be divided into its own functional modules, or two or more functions can be integrated into one processing module. The integrated module can be implemented in hardware or as a software functional module. Optionally, the module division in this application embodiment is illustrative and only represents one logical functional division; other division methods may be used in actual implementation.

[0125] Figure 11 This is a schematic diagram of the structure of a data identification device provided in an embodiment of this application. Figure 11 As shown, a data identification device 110 is used to reduce the computing resources consumed when performing sensitive data identification on a data stream, for example, for performing... Figure 2 The data identification method shown is described. The data identification device 110 includes a transmission unit 1101 and a determination unit 1102.

[0126] The transmission unit 1101 is used to obtain the data characteristics of the data stream when the data stream protocol is an encrypted transmission protocol; the data characteristics include: data volume and / or domain name.

[0127] The determining unit 1102 is used to determine whether a data stream is an abnormal data stream based on the data characteristics of the data stream and the abnormal characteristics corresponding to the data characteristics.

[0128] In one possible implementation, the abnormal features include: multiple abnormal data volumes and multiple abnormal domain names; each abnormal domain name corresponds to at least one abnormal data volume; the determining unit 1102 is further configured to determine the similarity between the data volume and the target data volume when the domain name is the same as the target domain name; the target domain name is any one of the multiple abnormal domain names; the target data volume is any one of the multiple abnormal data volumes corresponding to at least one abnormal data volume of the target domain name; the determining unit 1102 is further configured to determine the data stream as an abnormal data stream when the similarity between the data volume and the target data volume is greater than a preset similarity; the determining unit 1102 is further configured to determine the data stream as a normal data stream when the similarity between the data volume and the target data volume is less than or equal to a preset similarity.

[0129] In one possible implementation, the abnormal features include: abnormal data volume; the determining unit 1102 is further configured to determine the data stream as an abnormal data stream when the similarity between the data volume and the abnormal data volume is greater than a preset similarity; the determining unit 1102 is further configured to determine the data stream as a normal data stream when the similarity between the data volume and the abnormal data volume is less than or equal to a preset similarity.

[0130] In one possible implementation, the abnormal features include: an abnormal domain name; the determining unit 1102 is further configured to determine that the data stream is an abnormal data stream when the domain name is the same as the abnormal domain name; the determining unit 1102 is further configured to determine that the data stream is a normal data stream when the domain name is different from the abnormal domain name.

[0131] In one possible implementation, the transmission unit 1101 is further configured to obtain the URL of the data stream when the protocol of the data stream is an unencrypted transmission protocol; the determination unit 1102 is further configured to determine that the data stream is an abnormal data stream when the URL is the same as the abnormal URL; the determination unit 1102 is further configured to determine that the data stream is a normal data stream when the URL is different from the abnormal URL.

[0132] In one possible implementation, the determining unit 1102 is further configured to determine the information corresponding to the abnormal URL as sensitive information in the data stream.

[0133] In one possible implementation, the data identification device 110 further includes: a processing unit 1103; the processing unit 1103 is used to acquire data streams; the processing unit 1103 is also used to identify whether the protocol of the data stream is an encrypted transmission protocol.

[0134] like Figure 12 As shown, an electronic device 130 is used to reduce the computing resources consumed when performing sensitive data identification on a data stream, for example, for performing... Figure 2The diagram illustrates a data identification method. The electronic device 130 includes a processor 1301, a memory 1302, and a bus 1303. The processor 1301 and the memory 1302 are connected via the bus 1303.

[0135] Processor 1301 is the control center of the communication device. It can be a single processor or a collective term for multiple processing elements. For example, processor 1301 can be a general-purpose central processing unit (CPU) or other general-purpose processors. Among them, the general-purpose processor can be a microprocessor or any conventional processor.

[0136] As one embodiment, processor 1301 may include one or more CPUs, for example Figure 12 CPU 0 and CPU 1 are shown in the diagram.

[0137] The memory 1302 may be a read-only memory (ROM) or other type of static storage device capable of storing static information and instructions, random access memory (RAM) or other type of dynamic storage device capable of storing information and instructions, or electrically erasable programmable read-only memory (EEPROM), disk storage medium or other magnetic storage device, or any other medium capable of carrying or storing desired program code in the form of instructions or data structures and accessible by a computer, but is not limited thereto.

[0138] As one possible implementation, the memory 1302 can exist independently of the processor 1301. The memory 1302 can be connected to the processor 1301 via the bus 1303 and is used to store instructions or program code. When the processor 1301 calls and executes the instructions or program code stored in the memory 1302, it can implement the data identification method provided in the embodiments of this application.

[0139] In another possible implementation, the memory 1302 can also be integrated with the processor 1301.

[0140] Bus 1303 can be an industry standard architecture (ISA) bus, a peripheral component interconnect (PCI) bus, or an extended industry standard architecture (EISA) bus. This bus can be divided into address bus, data bus, control bus, etc. For ease of representation, Figure 12 The bus is represented by a single thick line, but this does not mean that there is only one bus or one type of bus.

[0141] It should be pointed out that, Figure 12 The structure shown does not constitute a limitation on the electronic device 130. Except... Figure 12 In addition to the components shown, the electronic device 130 may include more or fewer components than illustrated, or combine certain components, or have different component arrangements.

[0142] As an example, combined Figure 11 The functions implemented by the transmission unit 1101, the determination unit 1102, and the processing unit 1103 in the data identification device 110 are the same as those of the data identification device 110. Figure 12 The processor 1301 in it has the same function.

[0143] Optional, such as Figure 12 As shown, the electronic device 130 provided in this application embodiment may further include a communication interface 1304.

[0144] Communication interface 1304 is used to connect with other devices via a communication network. This communication network can be Ethernet, a wireless access network, a wireless local area network (WLAN), etc. Communication interface 1304 may include a receiving unit for receiving data and a transmitting unit for transmitting data.

[0145] In one design, the communication interface in the electronic device provided in this application embodiment can also be integrated into the processor.

[0146] Through the above description of the embodiments, those skilled in the art will clearly understand that, for the sake of convenience and brevity, only the division of the above functional units is used as an example. In practical applications, the above functions can be assigned to different functional units as needed, that is, the internal structure of the device can be divided into different functional units to complete all or part of the functions described above. The specific working process of the system, device, and unit described above can be referred to the corresponding process in the foregoing method embodiments, and will not be repeated here.

[0147] This application also provides a computer-readable storage medium storing instructions. When a computer executes these instructions, the computer performs each step of the method flow shown in the above-described method embodiments.

[0148] The embodiments of this application provide a computer program product in which, when computer instructions are run on an electronic device, the electronic device executes a data recognition method according to the above method embodiments.

[0149] The computer-readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples of computer-readable storage media (a non-exhaustive list) include: an electrical connection having one or more wires, a portable computer disk, a hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM), registers, hard disks, optical fibers, compact disc read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination of the foregoing, or any other form of computer-readable storage medium in the art.

[0150] An exemplary storage medium is coupled to a processor, enabling the processor to read information from and write information to the storage medium. Of course, the storage medium can also be a component of the processor. The processor and storage medium can reside within an application-specific integrated circuit (ASIC).

[0151] In the embodiments of this application, the computer-readable storage medium can be any tangible medium that contains or stores a program that can be used by or in conjunction with an instruction execution system, apparatus, or device.

[0152] Since the electronic devices, computer-readable storage media, and computer program products in the embodiments of this application can be applied to the above methods, the technical effects they can achieve can also be referred to the above method embodiments. The embodiments of this application will not be repeated here.

[0153] The above are merely specific embodiments of this application, but the scope of protection of this application is not limited thereto. Any changes or substitutions within the technical scope disclosed in this application should be covered within the scope of protection of this application.

Claims

1. A data recognition method, characterized in that, The method includes: When the data stream protocol is an encrypted transmission protocol, the data characteristics of the data stream are obtained; the encrypted transmission protocol is Hypertext Transfer Security Protocol (HTTPS); the data characteristics include: data volume and domain name, wherein the data volume is the length of the data payload. Based on the data characteristics of the data stream and the abnormal characteristics corresponding to the data characteristics, determine whether the data stream is an abnormal data stream; The abnormal features include: multiple abnormal data volumes and multiple abnormal domain names; one abnormal domain name corresponds to at least one abnormal data volume. Determining whether a data stream is an anomalous data stream based on its data characteristics and corresponding anomaly characteristics includes: If the domain name is the same as the target domain name, determine the similarity between the data volume and the target data volume; the target domain name is any one of the plurality of abnormal domain names; the target data volume is any one of the plurality of abnormal data volumes corresponding to the target domain name. If the similarity between the data volume and the target data volume is greater than a preset similarity, the data stream is determined to be an abnormal data stream; Alternatively, if the similarity between the data volume and the target data volume is less than or equal to the preset similarity, the data stream is determined to be a normal data stream.

2. The method according to claim 1, characterized in that, The abnormal characteristics include: abnormal data volume; Determining whether a data stream is an anomalous data stream based on its data characteristics and corresponding anomaly characteristics includes: If the similarity between the data volume and the abnormal data volume is greater than a preset similarity, the data stream is determined to be an abnormal data stream. Alternatively, if the similarity between the data volume and the abnormal data volume is less than or equal to the preset similarity, the data stream is determined to be a normal data stream.

3. The method according to claim 1, characterized in that, The abnormal characteristics include: abnormal domain name; Determining whether a data stream is an anomalous data stream based on its data characteristics and corresponding anomaly characteristics includes: If the domain name is the same as the abnormal domain name, the data stream is determined to be an abnormal data stream; Alternatively, if the domain name is different from the abnormal domain name, the data stream is determined to be a normal data stream.

4. The method according to claim 1, characterized in that, The method further includes: If the protocol of the data stream is an unencrypted transmission protocol, obtain the URL of the data stream; If the URL is the same as the abnormal URL, the data stream is determined to be an abnormal data stream; Alternatively, if the URL is different from the abnormal URL, the data stream can be determined to be a normal data stream.

5. The method according to claim 4, characterized in that, After determining that the data stream is an abnormal data stream when the URL is the same as the abnormal URL, the method further includes: The information corresponding to the abnormal URL is identified as sensitive information in the data stream.

6. The method according to claim 1, characterized in that, When the data stream protocol is an encrypted transmission protocol, before obtaining the data volume of the data stream, the method further includes: Collect the data stream; Identify whether the protocol of the data stream is an encrypted transmission protocol.

7. The method according to claim 1, characterized in that, After determining whether the data stream is an abnormal data stream based on the data characteristics of the data stream and the abnormal characteristics corresponding to the data characteristics, the method further includes: In the case that the data stream is an abnormal data stream, the information corresponding to the abnormal features is identified as sensitive information in the data stream.

8. A data identification device, characterized in that, The data identification device includes: a transmission unit and a determination unit; The transmission unit is used to acquire data characteristics of the data stream when the data stream protocol is an encrypted transmission protocol; the encrypted transmission protocol includes Hypertext Transfer Security Protocol (HTTPS); the data characteristics include: data volume and domain name, wherein the data volume is the length of the data payload portion; The determining unit is used to determine whether the data stream is an abnormal data stream based on the data characteristics of the data stream and the abnormal characteristics corresponding to the data characteristics; The abnormal features include: multiple abnormal data volumes and multiple abnormal domain names; one abnormal domain name corresponds to at least one abnormal data volume. The determining unit is further configured to determine the similarity between the data volume and the target data volume when the domain name is the same as the target domain name; the target domain name is any one of the plurality of abnormal domain names; the target data volume is any one of the plurality of abnormal data volumes corresponding to the target domain name; The determining unit is further configured to determine that the data stream is an abnormal data stream when the similarity between the data volume and the target data volume is greater than a preset similarity. The determining unit is further configured to determine that the data stream is a normal data stream when the similarity between the data volume and the target data volume is less than or equal to the preset similarity.

9. An electronic device, characterized in that, include: Processor and memory; The memory is used to store one or more programs, the one or more programs including computer execution instructions. When the electronic device is running, the processor executes the computer execution instructions stored in the memory to cause the electronic device to perform the method of any one of claims 1-7.

10. A computer-readable storage medium for storing one or more programs, characterized in that, The one or more programs include instructions that, when executed by a computer, cause the computer to perform the method as described in any one of claims 1-7.

11. A computer program product, characterized in that, The computer program product includes computer instructions that, when executed on an electronic device, cause the electronic device to perform the method as described in any one of claims 1-7.

Images