Method, device and equipment for data security risk alarm and storage medium

Abstract

The embodiment of the invention provides a data security risk warning method and device, equipment and a storage medium. The method comprises the following steps: determining at least one operation of one or more terminal devices on data resources in a target time period; and on the basis of the at least one operation, one or more risk identification rules corresponding to the one or more risks are utilized to identify whether the data resource has one or more risks, and the risk identification rule in the one or more risk identification rules is used for identifying the corresponding risk. And based on at least one target risk in the identified one or more risks, presenting risk alarm information for the at least one target risk, the risk alarm information being generated by using a machine learning model based on a cue word template corresponding to the at least one target risk. Therefore, the accuracy and efficiency of risk identification are improved. The scheme can be used in an IT management system or a data security management system of an enterprise.

Description

Technical Field

[0001] Example embodiments of the present disclosure generally relate to the field of computers, and more particularly to methods, devices, apparatuses, and storage media for data security risk warning. Background Art

[0002] Currently, organizations (enterprises, government agencies, other groups, etc.) face severe challenges in data security management, especially in preventing data leaks and illegal operations. Existing data security management solutions rely on security managers to operate. On the one hand, manual operation makes it difficult to ensure the accuracy of data security identification. On the other hand, it is difficult for security managers to quickly identify high-risk data security risks. Summary of the invention

[0003] In a first aspect of the present disclosure, a method for data security risk warning is provided. The method may include: determining at least one operation of one or more terminal devices on a data resource in a target time period. Based on the at least one operation, one or more risk identification rules corresponding to the one or more risks are used to identify whether the data resource has one or more risks, and the risk identification rules in the one or more risk identification rules are used to identify the corresponding risks. Based on identifying at least one target risk among the one or more risks, risk warning information for the at least one target risk is presented, and the risk warning information is generated based on a prompt word template corresponding to the at least one target risk using a machine learning model.

[0004] In a second aspect of the present disclosure, a device for data security risk warning is provided. The device may include: an operation determination module, configured to determine at least one operation of one or more terminal devices on a data resource in a target time period. A risk identification module, configured to identify whether there are one or more risks in a data resource based on at least one operation using one or more risk identification rules corresponding to one or more risks, respectively, and the risk identification rules in the one or more risk identification rules are used to identify the corresponding risks. A risk warning information presentation module, configured to present risk warning information for at least one target risk based on at least one target risk identified in one or more risks, and the risk warning information is generated based on a prompt word template corresponding to at least one target risk using a machine learning model.

[0005] In a third aspect of the present disclosure, an electronic device is provided. The device includes at least one processing unit; and at least one memory, the at least one memory is coupled to the at least one processing unit and stores instructions for execution by the at least one processing unit. When the instructions are executed by the at least one processing unit, the electronic device executes the method of the first aspect.

[0006] In a fourth aspect of the present disclosure, a computer-readable storage medium is provided, wherein a computer program is stored on the medium, and when the computer program is executed by a processor, the method of the first aspect is implemented.

[0007] In a fifth aspect of the present disclosure, a computer program product is provided, which includes computer executable instructions, and when the computer executable instructions are executed by a processor, the method of the first aspect is implemented.

[0008] It should be understood that the content described in this section is not intended to limit the key features or important features of the embodiments of the present disclosure, nor is it intended to limit the scope of the present disclosure. Other features of the present disclosure will become easily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0009] The above and other features, advantages and aspects of the embodiments of the present disclosure will become more apparent with reference to the following detailed description in conjunction with the accompanying drawings. In the accompanying drawings, the same or similar reference numerals represent the same or similar elements, wherein:

[0010] Figure 1 A schematic diagram showing an example environment in which embodiments of the present disclosure can be implemented;

[0011] Figure 2 A process diagram of a method for data security risk warning according to some embodiments of the present disclosure is shown;

[0012] Figure 3 A flowchart of a method for data security risk warning according to some embodiments of the present disclosure is shown;

[0013] Figure 4 An example diagram of risk identification rules according to some embodiments of the present disclosure is shown;

[0014] Figure 5A A schematic diagram showing risk warning information of target risk according to some embodiments of the present disclosure;

[0015] Figure 5B A schematic diagram showing detailed content presentation of risk warning information of target risk according to some embodiments of the present disclosure;

[0016] Figure 5C A schematic diagram showing risk warning information of object dimensions according to some embodiments of the present disclosure;

[0017] Figure 6 A schematic structural block diagram of an apparatus for data security risk warning according to some embodiments of the present disclosure is shown; and

[0018] Figure 7A block diagram of an electronic device in which one or more embodiments of the present disclosure may be implemented is shown. DETAILED DESCRIPTION

[0019] Embodiments of the present disclosure will be described in more detail below with reference to the accompanying drawings. Although certain embodiments of the present disclosure are shown in the accompanying drawings, it should be understood that the present disclosure can be implemented in various forms and should not be construed as being limited to the embodiments set forth herein. On the contrary, these embodiments are provided to provide a more thorough and complete understanding of the present disclosure. It should be understood that the drawings and embodiments of the present disclosure are only for exemplary purposes and are not intended to limit the scope of protection of the present disclosure.

[0020] In the description of the embodiments of the present disclosure, the term "including" and similar terms should be understood as open inclusion, that is, "including but not limited to". The term "based on" should be understood as "based at least in part on". The term "one embodiment" or "the embodiment" should be understood as "at least one embodiment". The term "some embodiments" should be understood as "at least some embodiments". Other explicit and implicit definitions may also be included below.

[0021] Herein, unless explicitly stated, executing a step “in response to A” does not mean executing the step immediately after “A” but may include one or more intermediate steps.

[0022] It is understandable that the data involved in this technical solution (including but not limited to the data itself, the acquisition, use, storage or deletion of the data) shall comply with the requirements of relevant laws, regulations and relevant provisions.

[0023] It is understandable that before using the technical solutions disclosed in the various embodiments of the present disclosure, the types, scopes of use, usage scenarios, etc. of the information involved in the present disclosure should be informed to relevant users and their authorization should be obtained in an appropriate manner in accordance with relevant laws and regulations. The relevant users may include any type of right holders, such as individuals and groups.

[0024] For example, in response to receiving an active request from a user, a prompt message is sent to the relevant user to clearly prompt the relevant user that the operation requested to be performed will require obtaining and using the information of the relevant user, so that the relevant user can independently choose whether to provide information to software or hardware such as an electronic device, application, server or storage medium that executes the operation of the technical solution of the present disclosure based on the prompt message.

[0025] As an optional but non-limiting implementation, in response to receiving an active request from a relevant user, a prompt message is sent to the relevant user, for example, in the form of a pop-up window, in which the prompt message may be presented in text form. In addition, the pop-up window may also carry a selection control for the user to select "agree" or "disagree" to provide information to the electronic device.

[0026] It is understandable that the above notification and the process of obtaining user authorization are merely illustrative and do not constitute a limitation on the implementation of the present disclosure. Other methods that meet relevant laws and regulations may also be applied to the implementation of the present disclosure.

[0027] Figure 1 1 is a schematic diagram of an example environment 100 in which embodiments of the present disclosure can be implemented. Figure 1 As shown, environment 100 may include a data management platform 110 .

[0028] In the example environment 100, the data management platform 110 can obtain the operations of one or more terminal devices on the data resources of an organization (e.g., an enterprise, a group). The data resources may be data within the organization, such as research and development data, email data, etc. The operations on the data resources may include access, downloading, and sending, etc. The data management platform 110 can automatically identify the operations of one or more terminal devices on the data resources. For the identification result that the operation on the data resources is a risky operation, the data management platform 110 may present risk warning information for the risky operation on the interface to inform the administrator. In some cases, the user 140 may be a user who operates the data resources by using a terminal device. In some cases, the user 140 may be a user who manages the data resources by using a terminal device, such as an administrator of an enterprise.

[0029] In some embodiments, at least some of the functions of the data management platform 110 can be implemented based on the target model 155. In the process of presenting risk warning information on the data management platform 110, one or more target models 155, such as the capabilities of the target model 155, can be called. As used herein, the term "model" can learn the association between the corresponding input and output from the training data, so that after the training is completed, the corresponding output can be generated for the given input. The generation of the model can be based on machine learning technology. Deep learning is a machine learning algorithm that processes inputs and provides corresponding outputs by using multiple layers of processing units. A neural network model is an example of a model based on deep learning. In this article, "model" may also be referred to as "machine learning model", "learning model", "machine learning network" or "learning network", and these terms are used interchangeably in this article.

[0030] The data management platform 110 may be deployed locally on the terminal device of the user 140, and / or may be supported by a server-side device. For example, the terminal device of the user 140 may run a client of the data management platform, which may support the interaction between the user and the data management platform provided by the server. In the case where the data management platform runs locally on the user's terminal device, the user 140 may directly interact with the local data management platform using the terminal device. In the case where the data management platform runs on the server-side device, the server-side device may provide services to the client running in the terminal device based on the communication connection with the terminal device. The data management platform 110 may present a corresponding interface 142 to the user 140 based on the operation of the user 140, so as to output and / or receive information related to data management to the user 140.

[0031] The data management platform 110 can run on appropriate electronic devices. The electronic devices here can be any type of device with computing capabilities, including terminal devices or server devices. The terminal device can be any type of mobile terminal, fixed terminal or portable terminal, including mobile phones, desktop computers, laptop computers, notebook computers, netbook computers, tablet computers, media computers, multimedia tablets, personal communication systems (PCS) devices, personal navigation devices, personal digital assistants (PDAs), audio / video players, digital cameras / camcorders, positioning devices, television receivers, radio broadcast receivers, e-book devices, gaming devices, or any combination of the foregoing, including accessories and peripherals of these devices or any combination thereof. The server device can include, for example, a computing system / server, such as a mainframe, an edge computing node, a computing device in a cloud environment, and the like. In some embodiments, the data management platform 110 can be implemented based on cloud services.

[0032] In the data security management of modern enterprises, with the development of informatization and digitalization, enterprises are facing huge data security risks, especially in preventing data leakage and illegal operations on data resources. To deal with these risks, many enterprises have deployed data leakage prevention (DLP) systems. The system generates alarm information by identifying the operation of the object on the specified data (such as R&D data). However, the existing DLP system faces many challenges in operation. For example, the challenges include the huge number of alarms generated by the DLP system, and the enterprises need to invest a lot of manpower to screen and analyze these alarm data. Invisibly increase the cost of security management. For example, the challenges also include the difficulty of analyzing the alarm data. For example, not all enterprises have mature security operation experience. When faced with a large amount of risk alarm data, enterprises often lack effective means to timely discover and deal with high-risk risks. In addition, most enterprises can only use these alarm data as logs for post-analysis, and cannot achieve real-time early warning and disposal of risks. For example, the challenges also include the difficulty of reporting and summarizing the alarm data. When reporting on data risk management, security operations personnel in enterprises often need to summarize a large number of written security incident reports, which consumes a lot of manpower and time, thus affecting the overall efficiency of security management.

[0033] In an embodiment of the present disclosure, an improved scheme for data security risk warning is proposed. The scheme can be used in an enterprise's IT management system or data security management system. In the scheme, a data management platform determines at least one operation of one or more terminal devices on a data resource in a target time period. Based on at least one operation, one or more risk identification rules corresponding to one or more risks are used to identify whether the data resource has one or more risks, and the risk identification rules in the one or more risk identification rules are used to identify the corresponding risks. Based on identifying at least one target risk among the one or more risks, risk warning information for the at least one target risk is presented, and the risk warning information is generated using a machine learning model based on a prompt word template corresponding to the at least one target risk.

[0034] Through the above process, based on the specific operations of data resources and predefined risk identification rules, the data management platform can more accurately identify potential risks in operations, thereby reducing false positives and irrelevant alarms. Each risk identification rule is designed for different risk scenarios to ensure the pertinence of alarm information. In addition, through real-time detection and risk analysis of operations, potential high-risk operations can be identified more quickly, and alarms can be issued in a timely manner, helping enterprises to respond quickly when risks occur.

[0035] Figure 2 An example process of a method 200 for data security risk warning according to some embodiments of the present disclosure is shown. The data management platform 110 may obtain operations of the terminal device 210 on enterprise data resources. Figure 2 The example shown only presents a single terminal device 210 , but in an actual scenario, there may be multiple terminal devices 210 .

[0036] The data management platform 110 receives 201 information related to the operation of the enterprise data resource by the terminal device 210. The data management platform 110 first stores 202 the information related to the operation in the storage device 220. The data management platform 110 can perform risk identification on the received information related to the operation in real time, or read 203 the information related to the operation stored in the storage device 220 and perform risk identification. In order to ensure the accuracy of the data, the storage device 220 will merge and deduplicate 204 the information related to the operation to avoid duplication.

[0037] Exemplarily, the data management platform 110 may identify 205 whether the operation complies with a certain target risk based on a plurality of preset risk identification rules. That is, each identification rule may correspond to a risk. When the data management platform 110 identifies that the operation belongs to a target risk, the identification result is stored 206 in a storage device 220. Next, the data management platform 110 may read 207 the identification result that complies with a certain target risk from the storage device 220, and generate 208 corresponding risk warning information for the target risk. The data management platform 110 may present the risk warning information of the target risk, and store 209 the risk warning information of the risk target risk in the storage device 220.

[0038] Figure 3 FIG. 3 shows an example process of a data security risk warning method 300 according to some embodiments of the present disclosure. Figure 1 The process 300 is described in the environment 100. In the environment 100, the data security risk warning can be completed by the data management platform 110, but some operations can be performed by requesting a server device (not shown).

[0039] In block 301 , the data management platform 110 determines at least one operation of one or more terminal devices 210 on a data resource during a target time period.

[0040] The target time period may be the past 8 hours, 12 hours, 24 hours, etc. In addition, the target time period may also be a specific working time period, a non-working time period, or certain key business time points (such as a project delivery period, a project bidding period, etc.). The data resources may be data resources within an organization (enterprise, government agency, other group, etc.), such as R&D data, work email data, etc. The operations of the terminal device 210 on the data resources may include, but are not limited to, accessing, downloading, modifying, copying, deleting, and sending the data resources.

[0041] In box 302, the data management platform 110 identifies whether a data resource has one or more risks based on at least one operation using one or more risk identification rules corresponding to one or more risks, wherein the risk identification rules in the one or more risk identification rules are used to identify corresponding risks.

[0042] After obtaining the operation of the terminal device 210 on the data resource, the data management platform 110 will analyze and judge the operation based on one or more predefined risk identification rules to determine whether the data resource has risks. Each identification rule may correspond to one risk. Figure 4 A classification diagram 400 of risk identification rules according to some embodiments of the present disclosure is shown. According to the time dimension of the operation, the risk identification rules can be divided into "before" risk identification rules and "during / after" risk identification rules.

[0043] The focus of the "ex ante" risk identification rules is prevention, and the end point of the "in-process / ex post" risk identification rules is real-time management and remediation. Exemplarily, the "ex ante" risk identification rules can be further divided into "data resource risk" identification rules and "operational risk" identification rules. The "data resource risk" identification rules involve different dimensions such as operational events and operational objects. For example, the constraint of downloading data from a custom domain name can be determined as an "operational event-related" risk. The target object that is not related to the specified type of work downloads a large amount of data related to the specified type of work, which can be determined as a "target object-related" risk. On the other hand, the "operational risk" identification rules mainly focus on the operational behavior itself, such as downloading or sending a large amount of data during non-working hours, taking a large number of screenshots of certain specific data resources in a short period of time, etc.

[0044] In terms of the “in-process / post-process” risk identification rules, Figure 4 The “high-risk role risk” identification rules, “illegal operation risk” identification rules and “data risk” identification rules are exemplarily shown. Exemplarily, the “high-risk role risk” identification rules can be used to indicate specified risk operation behaviors of a specific group of objects, such as a target object that is not related to a specified type of work downloading or sending a large amount of data related to a specified type of work. The “illegal operation risk” identification rules can indicate the identification of abnormal behaviors for operations such as the outbound sending of data resources and device connection, such as using unauthorized devices to connect external storage to perform data copying, etc. In addition, the “data risk” identification rules can indicate the outbound sending or access to predetermined types of images or files, etc. Through these risk identification rules, the data management platform 110 can effectively identify data security risks in different scenarios.

[0045] In box 303, the data management platform 110 presents risk warning information for at least one target risk based on identifying at least one target risk among the one or more risks, and the risk warning information is generated based on a prompt word template corresponding to the at least one target risk using a machine learning model.

[0046] Based on at least one target risk among the one or more identified risks, the data management platform 110 will generate and present corresponding risk warning information. The risk warning information can be generated by processing the risk warning word template corresponding to the target risk using a machine learning model. The machine learning model can correspond to Figure 1 The target model in. The risk warning word template corresponding to the target risk can indicate the key information related to the target risk that needs to be determined, such as the risk type, operation details (such as operation time, data type, terminal device performing the operation), etc. The data management platform 110 uses a machine learning model to process the risk warning word template to obtain risk warning information for the target risk. For example, if the target risk involves the unauthorized outbound transmission of a predetermined type of data, the warning information will present in detail the operating device, the level of the outbound file, and the relevant information of the target object performing the unauthorized outbound transmission, so that the administrator can quickly take action to prevent or investigate.

[0047] Through the above process, the data management platform 110 can quickly and accurately identify potential risks in the operation of data resources, and present the corresponding risks through standardized warning information. This improves the efficiency of data risk identification, reduces the need for manual intervention, and ensures that warnings can be issued in a timely manner when risks occur, thereby helping enterprises to take timely countermeasures to avoid data leakage or illegal operations.

[0048] The determination of one or more risks may be performed based on the operation attribute information. Exemplarily, for a given risk identification rule in one or more risk identification rules, the data management platform 110 obtains operation attribute information corresponding to at least one operation. A comparison result between the operation attribute information and the risk condition indicated by the given risk identification rule is determined. Based on the comparison result, a given risk corresponding to the given risk identification rule in the one or more risks is identified.

[0049] The data management platform 110 obtains operation attribute information related to at least one operation performed by the terminal device according to a given risk identification rule. The operation attribute information may indicate at least one of the following: the operation category of at least one operation, the type of data targeted by at least one operation, the time when at least one operation occurred, or the identity authority attribute of the target object (user 140) performing at least one operation.

[0050] The operation category may include access, download, store, send (outbound), etc. The data type may include R&D data, email data, etc. In addition, the data type may also indicate the level of the data, such as level 1 (L1) data, level 2 (L2) data, etc. The time when the operation occurs may correspond to working hours, non-working hours, etc. The identity and permission attributes of the target object performing the operation may indicate the role of the target object, the department to which it belongs, etc.

[0051] The data management platform 110 compares these operation attribute information with the risk conditions defined in the given risk identification rules. The risk conditions may be specific operation categories, time limits, data levels, or operator identity and authority attributes, etc. By comparing the operation attribute information with the risk conditions defined in the given risk identification rules, the data management platform 110 may obtain the corresponding comparison results.

[0052] If the comparison result indicates that the operation attribute information satisfies the risk condition indicated by the given risk identification rule, the given risk can be identified as one of the target risks. If the comparison result indicates that the operation attribute information does not satisfy the risk condition indicated by the given risk identification rule, the comparison result can indicate that the data resource corresponding to the operation does not have a risk.

[0053] After determining the target risk, the data management platform 110 needs to determine the risk warning information of the target risk. The data management platform 110 can determine the target operation related to the at least one target risk from at least one operation based on the at least one target risk. Based on the operation information of the target operation, the risk warning word template corresponding to at least one target risk is used to determine the prompt information related to the target risk. Based on the prompt information, the risk warning information is determined using a machine learning model.

[0054] Based on the identified at least one target risk, the data management platform 110 determines target operations related to the target risk from the operation records performed by the terminal device 210. These target operations are operation behaviors that trigger target risks, such as a target object sending a large amount of predetermined type of data outside of working hours.

[0055] The data management platform 110 generates prompt information related to the target risk based on the operational attribute information of these target operations (such as operation category, data type, operation time, object performing the operation, etc.), and in combination with the risk warning word template corresponding to the target risk. The risk warning word template may indicate the keyword information that needs to be determined from the operational attribute information corresponding to the operation. Exemplarily, if the target risk is "high-risk role risk", the keyword information indicated by the risk warning word template may include the operation time of the data, the type of data targeted by the operation, the identity authority attributes of the target object performing the operation, etc. If the target risk is "predetermined type data risk", the keyword information indicated by the risk warning word template may mainly include the type of data targeted by the operation.

[0056] Figure 5A A schematic diagram 500A of risk warning information of target risks according to some embodiments of the present disclosure is shown. Taking an operation determined as an operation corresponding to a target risk as an example, in the operation attribute information presentation area 501 of the operation, information related to the operation such as operation time, management mode, file information (file name and type corresponding to the data resource, etc.), hit predetermined type data (corresponding specified content in the data resource), operation mode (outbound, download, etc.), object (identity authority attribute of the target object performing the operation), etc. can be displayed. In the identification presentation area 502 of the operation, the risk identification of the target risk related to the operation can be presented. In the processing area 503 of the target risk, the processing component for the target risk can be presented. Exemplarily, the processing component can include "Ignore" and "Details". In response to receiving the selection of the "Details" processing component, the detailed content of the risk warning information of the target risk can be presented.

[0057] Exemplarily, the detailed content of the risk warning information may indicate at least one of the following: a description of at least one target risk, a reason for determining at least one target risk, or a treatment suggestion for the target risk. Figure 5B A schematic diagram 500B showing the detailed content presentation of the risk warning information of the target risk according to some embodiments of the present disclosure is shown. In the detailed content display area 504, a description of the target risk (event description), the reason for determining at least one target risk (assessment reason) and the risk analysis (treatment suggestions for the target risk) can be presented. In addition, information related to the operation, such as event ID (event identification), operation time, reporting time, etc., can also be displayed in the information display area. In the evidence display area 505, a screenshot corresponding to the operation, as well as relevant information such as the source of the data resource, can also be displayed.

[0058] The risk warning information includes warning information of a target warning dimension among the multiple warning dimensions. For presenting the risk warning information for at least one target risk, in response to identifying at least one target risk, multiple prompt word templates matching the at least one target risk can be obtained, and the risk warning dimensions between the multiple prompt word templates are different from each other. A prompt word template of the target warning dimension is determined from the multiple prompt word templates. The warning information for the target warning dimension is presented using the prompt word template of the target warning dimension.

[0059] The risk warning information includes warning information of a target warning dimension among the multiple warning dimensions. When presenting risk warning information for at least one target risk, the data management platform 110 processes based on different warning dimensions. Exemplarily, the warning dimension may include an event dimension and an object dimension.

[0060] Taking the event dimension as an example, the prompt word template corresponding to the event dimension can be a description of the operation event itself. The main focus of this dimension is the time of the operation (such as whether the operation occurs during non-working hours), the type of operation (such as downloading, outbound, deletion, etc.), and the type of data involved (such as high-level data such as L1 and L2). By selecting the prompt word template of this dimension, the data management platform 110 can generate warning information for the operation event and provide a risk description directly related to the operation behavior.

[0061] Taking the object dimension as an example, the prompt word template corresponding to the object dimension may be a description of the target object for performing the operation. For example, the focus is mainly on the role, authority, etc. of the target object. By selecting the prompt word template of this dimension, the data management platform 110 can generate warning information for the object dimension and provide a risk description directly related to the target object.

[0062] Figure 5C A schematic diagram 500C of risk warning information of the object dimension according to some embodiments of the present disclosure is shown. The presentation result of the object dimension may correspond to the operation of the target object. Taking target object 1 as an example, the risk presentation area 507 corresponding to target object 1 may display the identification of target object 1, the number of alarms (the number of times target object 1 has been alarmed), the highest situation description of the outbound path of target object 1 (outbound path TOP3), the data level (the level of the data corresponding to the operation), and the total number of local predetermined type files. In the risk identification presentation area 508, the situation of at least one target risk involved in the target object may be displayed.

[0063] Similar to the above example, the risk warning information of the target risk of the object dimension may also include a detail page. In the detail presentation area of ​​the detail page, the details of the risk warning information of the object dimension also include a description of the target risk (action summary), reasons for determining at least one target risk (assessment reasons), and risk analysis (processing suggestions for the target object).

[0064] In addition to presenting risk warning information, the data management platform 110 may also present risk identification. Exemplarily, the risk identification may include presenting a risk identification for a target operation in association with the target operation, or presenting a risk identification for a target operation in association with the target object.

[0065] Risk indicators can provide administrators with concise visual prompts to quickly identify potential high-risk operations or high-risk objects. Figure 5A The logo presentation area 502 and Figure 5C The risk identifiers presented in the middle identifier presentation area 508 .

[0066] When an operation is identified as a target risk (such as outbound data of a predetermined type or large-scale data downloads during non-working hours), the data management platform 110 can display a risk identification for the target operation in the interface 142. The risk identification can be in the form of color, icon, or specific prompt box, so that the administrator can identify the risk nature of the operation at a glance. In addition, the data management platform 110 not only marks the risk identification for the target operation, but also presents the risk identification in the object dimension in the interface 142, such as presenting risk identification for different target objects (performing risk operations). For example, if the target object has performed a large number of predetermined type data downloads, the data management platform 110 can present the risk identification in the relevant display area of ​​the target object in the interface 142, prompting the administrator that the recent behavior of the target object has potential risks.

[0067] Figure 6 A schematic structural block diagram of an apparatus 600 for data security risk warning according to some embodiments of the present disclosure is shown. The apparatus 600 may be implemented in or included in the data management platform 110, for example. Each module / component in the apparatus 600 may be implemented by hardware, software, firmware, or any combination thereof.

[0068] like Figure 6As shown, the device 600 can operate a determination module 601, which is configured to determine at least one operation of one or more terminal devices on a data resource in a target time period. A risk identification module 602 is configured to identify whether there are one or more risks in a data resource based on at least one operation using one or more risk identification rules corresponding to one or more risks, respectively, and the risk identification rules in the one or more risk identification rules are used to identify the corresponding risks. A risk warning information presentation module 603 is configured to present risk warning information for at least one target risk based on at least one target risk identified in one or more risks, and the risk warning information is generated based on a prompt word template corresponding to at least one target risk using a machine learning model.

[0069] In some embodiments of the present disclosure, the risk identification module 602 may be configured to: for a given risk identification rule in one or more risk identification rules, obtain operation attribute information corresponding to at least one operation, determine a comparison result between the operation attribute information and a risk condition indicated by the given risk identification rule, and identify a given risk corresponding to the given risk identification rule in the one or more risks based on the comparison result.

[0070] In some embodiments of the present disclosure, the risk identification module 602 may be specifically configured to: in response to the comparison result indicating that the operation attribute information satisfies the risk condition indicated by the given risk identification rule, identify the given risk as one of the at least one target risk.

[0071] In some embodiments of the present disclosure, the operation attribute information indicates at least one of the following: the operation category of at least one operation, the type of data targeted by at least one operation, the time when at least one operation occurred, or the identity authority attribute of the target object performing at least one operation.

[0072] In some embodiments of the present disclosure, the risk warning information presentation module 603 may be configured to: determine a target operation related to at least one target risk from at least one operation based on at least one target risk; determine prompt information related to the target risk based on the operation information of the target operation and using a risk prompt word template corresponding to at least one target risk; and determine risk warning information based on the prompt information and using a machine learning model.

[0073] In some embodiments of the present disclosure, the risk warning information includes warning information of a target warning dimension among multiple warning dimensions, and the risk warning information presentation module 603 may be specifically configured as follows: in response to identifying at least one target risk, a plurality of prompt word templates matching the at least one target risk are acquired, and the risk warning dimensions between the plurality of prompt word templates are different from each other. A prompt word template of the target warning dimension is determined from the plurality of prompt word templates. The prompt word template of the target warning dimension is used to present the warning information for the target warning dimension.

[0074] In some embodiments of the present disclosure, the risk warning information indicates at least one of the following: a description of at least one target risk, a reason for determining at least one target risk, or a treatment suggestion for the target risk.

[0075] In some embodiments of the present disclosure, a risk identification presentation module is further included. The risk identification presentation module may be configured to: based on at least one target risk, determine a target operation related to at least one target risk from at least one operation, and present a risk identification for the target operation in association with the target operation.

[0076] In some embodiments of the present disclosure, the risk identification presentation module may also be configured to: based on at least one target risk, determine a target operation related to at least one target risk and a target object for performing at least one operation from at least one operation, and present a risk identification for the target operation in association with the target object.

[0077] Figure 7 1 shows a block diagram of an electronic device 700 in which one or more embodiments of the present disclosure may be implemented. It should be understood that Figure 7 The electronic device 700 shown is merely exemplary and should not constitute any limitation on the functionality and scope of the embodiments described herein. Figure 7 The electronic device 700 shown may include or be implemented as Figure 1 Data management platform 110 or Figure 6 Device 600.

[0078] like Figure 7 As shown, the electronic device 700 is in the form of a general electronic device. The components of the electronic device 700 may include, but are not limited to, one or more processors or processing units 710, a memory 720, a storage device 730, one or more communication units 740, one or more input devices 750, and one or more output devices 760. The processing unit 710 may be an actual or virtual processor and is capable of performing various processes according to a program stored in the memory 720. In a multi-processor system, multiple processing units execute computer executable instructions in parallel to improve the parallel processing capability of the electronic device 700.

[0079] The electronic device 700 typically includes a plurality of computer storage media. Such media may be any accessible media that is accessible to the electronic device 700, including but not limited to volatile and non-volatile media, removable and non-removable media. The memory 720 may be a volatile memory (e.g., registers, caches, random access memory (RAM)), a non-volatile memory (e.g., a read-only memory (ROM), an electrically erasable programmable read-only memory (EEPROM), flash memory), or some combination thereof. The storage device 730 may be a removable or non-removable medium, and may include a machine-readable medium, such as a flash drive, a disk, or any other medium, which may be capable of being used to store information and / or data and may be accessed within the electronic device 700.

[0080] The electronic device 700 may further include additional removable / non-removable, volatile / non-volatile storage media. Figure 7 As shown in , a disk drive for reading or writing from a removable, non-volatile disk (e.g., a "floppy disk") and an optical drive for reading or writing from a removable, non-volatile optical disk may be provided. In these cases, each drive may be connected to the bus (not shown) by one or more data media interfaces. The memory 720 may include a computer program product 725 having one or more program modules that are configured to perform various methods or actions of various embodiments of the present disclosure.

[0081] The communication unit 740 implements communication with other electronic devices through a communication medium. Additionally, the functions of the components of the electronic device 700 can be implemented with a single computing cluster or multiple computing machines that can communicate through a communication connection. Therefore, the electronic device 700 can operate in a networked environment using a logical connection with one or more other servers, a network personal computer (PC), or another network node.

[0082] The input device 750 may be one or more input devices, such as a mouse, a keyboard, a tracking ball, etc. The output device 760 may be one or more output devices, such as a display, a speaker, a printer, etc. The electronic device 700 may also communicate with one or more external devices (not shown) through the communication unit 740 as needed, such as a storage device, a display device, etc., communicate with one or more devices that allow a user to interact with the electronic device 700, or communicate with any device that allows the electronic device 700 to communicate with one or more other electronic devices (e.g., a network card, a modem, etc.). Such communication may be performed via an input / output (I / O) interface (not shown).

[0083] According to an exemplary implementation of the present disclosure, a computer-readable storage medium is provided, on which computer-executable instructions are stored, wherein the computer-executable instructions are executed by a processor to implement the method described above. According to an exemplary implementation of the present disclosure, a computer program product is also provided, which is tangibly stored on a non-transitory computer-readable medium and includes computer-executable instructions, and the computer-executable instructions are executed by a processor to implement the method described above.

[0084] According to an exemplary implementation of the present disclosure, a computer program product or a computer program is provided, the computer program product or the computer program including computer instructions, the computer instructions being stored in a computer-readable storage medium. A processor of a computer device reads the computer instructions from the computer-readable storage medium, and the processor executes the computer instructions, so that the computer device executes Figure 3 The methods provided in the various optional methods are therefore not described in detail here.

[0085] Various aspects of the present disclosure are described herein with reference to the flowcharts and / or block diagrams of the methods, devices, equipment, and computer program products implemented according to the present disclosure. It should be understood that each box in the flowchart and / or block diagram and the combination of each box in the flowchart and / or block diagram can be implemented by computer-readable program instructions.

[0086] These computer-readable program instructions can be provided to a processing unit of a general-purpose computer, a special-purpose computer, or other programmable data processing device, thereby producing a machine, so that when these instructions are executed by the processing unit of the computer or other programmable data processing device, a device that implements the functions / actions specified in one or more boxes in the flowchart and / or block diagram is generated. These computer-readable program instructions can also be stored in a computer-readable storage medium, and these instructions cause the computer, programmable data processing device, and / or other equipment to work in a specific manner, so that the computer-readable medium storing the instructions includes a manufactured product, which includes instructions for implementing various aspects of the functions / actions specified in one or more boxes in the flowchart and / or block diagram.

[0087] Computer-readable program instructions can be loaded onto a computer, other programmable data processing apparatus, or other device so that a series of operational steps are performed on the computer, other programmable data processing apparatus, or other device to produce a computer-implemented process, so that the instructions executed on the computer, other programmable data processing apparatus, or other device implement the functions / actions specified in one or more boxes in the flowchart and / or block diagram.

[0088] The flow chart and block diagram in the accompanying drawings show the possible architecture, function and operation of the system, method and computer program product according to multiple implementations of the present disclosure. In this regard, each square box in the flow chart or block diagram can represent a part of a module, program segment or instruction, and a part of a module, program segment or instruction includes one or more executable instructions for realizing the logical function of the specification. In some implementations as replacements, the function marked in the square box can also occur in a sequence different from that marked in the accompanying drawings. For example, two continuous square boxes can actually be executed substantially in parallel, and they can sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each square box in the block diagram and / or flow chart, and the combination of the square boxes in the block diagram and / or flow chart can be realized by a special hardware-based system that performs the function or action of the specification, or can be realized by a combination of special hardware and computer instructions.

[0089] The above descriptions of various implementations of the present disclosure are exemplary, non-exhaustive, and not limited to the disclosed implementations. Many modifications and variations will be apparent to those of ordinary skill in the art without departing from the scope and spirit of the described implementations. The selection of terms used herein is intended to best explain the principles of the implementations, practical applications, or improvements to the technology in the market, or to enable other persons of ordinary skill in the art to understand the various implementations disclosed herein.

Claims

1. A method for data security risk warning, comprising: Determining at least one operation of one or more terminal devices on a data resource during a target time period; Based on the at least one operation, using one or more risk identification rules corresponding to the one or more risks respectively, identifying whether the data resource has the one or more risks, wherein the risk identification rule in the one or more risk identification rules is used to identify the corresponding risk; as well as Based on identifying at least one target risk among the one or more risks, risk warning information for the at least one target risk is presented, and the risk warning information is generated using a machine learning model based on a prompt word template corresponding to the at least one target risk.

2. The method according to claim 1, wherein identifying whether the data resource has the one or more risks comprises: For a given risk identification rule among the one or more risk identification rules, Acquire operation attribute information corresponding to the at least one operation; Determining a comparison result between the operation attribute information and the risk condition indicated by the given risk identification rule; as well as Based on the comparison result, a given risk among the one or more risks corresponding to the given risk identification rule is identified.

3. The method according to claim 2, wherein identifying a given risk among one or more risks corresponding to the given risk identification rule comprises: In response to the comparison result indicating that the operation attribute information satisfies the risk condition indicated by the given risk identification rule, the given risk is identified as one of the at least one target risk.

4. The method according to claim 2, wherein the operation attribute information indicates at least one of the following: The operation category of the at least one operation, The type of data on which the at least one operation is performed, the time at which at least one operation occurred, or The identity and authority attributes of the target object for performing the at least one operation.

5. The method according to claim 1, wherein the risk warning information is determined by: Based on the at least one target risk, determining a target operation related to the at least one target risk from the at least one operation; Based on the operation information of the target operation, using the risk warning word template corresponding to the at least one target risk, determining the warning information related to the target risk; as well as Based on the prompt information, the risk warning information is determined using the machine learning model.

6. The method according to claim 1, wherein the risk warning information comprises warning information of a target warning dimension among multiple warning dimensions, and presenting the risk warning information for the at least one target risk comprises: In response to identifying the at least one target risk, acquiring a plurality of prompt word templates matching the at least one target risk, wherein the risk warning dimensions of the plurality of prompt word templates are different from each other; Determining a prompt word template of the target alarm dimension from the multiple prompt word templates; as well as The prompt word template of the target alarm dimension is used to present the alarm information for the target alarm dimension.

7. The method according to claim 1, wherein the risk warning information indicates at least one of the following: a description of the at least one target risk, determining the cause of the at least one target risk, or Recommendations for addressing the target risks.

8. The method according to claim 1, further comprising: Based on the at least one target risk, determining a target operation related to the at least one target risk from the at least one operation; as well as A risk indicator for the target operation is presented in association with the target operation.

9. The method according to claim 1, further comprising: Based on the at least one target risk, determining a target operation related to the at least one target risk and a target object for performing the at least one operation from the at least one operation; as well as A risk indicator for the target operation is presented in association with the target object.

10. A device for data security risk warning, comprising: an operation determination module, configured to determine at least one operation of one or more terminal devices on a data resource in a target time period; a risk identification module configured to identify, based on the at least one operation, whether the data resource has the one or more risks by using one or more risk identification rules respectively corresponding to the one or more risks, wherein a risk identification rule in the one or more risk identification rules is used to identify the corresponding risk; as well as The risk warning information presentation module is configured to present risk warning information for at least one target risk identified among the one or more risks, wherein the risk warning information is generated using a machine learning model based on a prompt word template corresponding to the at least one target risk.

11. An electronic device, comprising: at least one processing unit; as well as At least one memory, the at least one memory being coupled to the at least one processing unit and storing instructions for execution by the at least one processing unit, the instructions causing the electronic device to perform the method according to any one of claims 1 to 9 when executed by the at least one processing unit.

12. A computer-readable storage medium having a computer program stored thereon, wherein the computer program can be executed by a processor to implement the method according to any one of claims 1 to 9.

13. A computer program product, comprising computer executable instructions, which, when executed by a processor, implement the method according to any one of claims 1 to 9.

Images