Threat detection method and device for sensitive data, equipment and storage medium

Abstract

The invention relates to a threat detection method and device for sensitive data, equipment and a storage medium. When the threat of the sensitive data is detected, the database access log corresponding to the sensitive data needs to be acquired in real time; detecting whether an access behavior exists or not by utilizing the database access log; the access behavior is an access behavior executed on the sensitive data; if yes, creating a first graph model of the sensitive data; the first graph model comprises transmission paths and attribute information of the sensitive data among the nodes; and detecting a threat path of the sensitive data according to the first graph model. It can be seen that the graph model is created through the database access log obtained in real time, the threat paths possibly existing in all the nodes from the source to the outside of the sensitive data can be searched through the graph model, multi-dimensional data association is achieved, real-time monitoring of the full-link data flow is achieved, and the threat detection precision is improved.

Description

Technical Field

[0001] The present application relates to the field of threat detection, and in particular to a method, apparatus, device and storage medium for threat detection of sensitive data. Background Art

[0002] Sensitive data refers to data that may cause serious harm to society or individuals after being leaked. The traditional methods of detecting threats to sensitive data are mainly through static analysis tools, log auditing and SIEM (Security Information and Event Management) systems, data classification and encryption technologies, intrusion detection systems (IDS) and firewalls. However, when detecting potential threats to sensitive data assets, the above solutions lack dynamic and real-time full-link data flow monitoring, cannot combine the correlation of multi-dimensional data for analysis, and have low accuracy in detecting threats.

[0003] Therefore, how to detect threats to sensitive data in a timely and effective manner is a problem that technical personnel need to solve. Summary of the invention

[0004] The present application provides a sensitive data threat detection method, apparatus, device and storage medium to timely and effectively detect threats to sensitive data.

[0005] In a first aspect, the present application provides a method for threat detection of sensitive data, comprising:

[0006] Obtain database access logs corresponding to sensitive data in real time;

[0007] Using the database access log to detect whether there is access behavior; the access behavior is access behavior performed on the sensitive data;

[0008] If yes, then create a first graph model of the sensitive data; the first graph model includes the transmission path and attribute information of the sensitive data between nodes;

[0009] The threat path of the sensitive data is detected according to the first graph model.

[0010] Optionally, before obtaining the database access log corresponding to the sensitive data in real time, the method further includes:

[0011] Identify sensitive data in the database according to a predetermined period;

[0012] Determine the sensitivity level of each type of sensitive data;

[0013] A sensitive data identification report is generated based on the sensitive data and the sensitivity level corresponding to each sensitive data.

[0014] Optionally, the threat detection method further includes:

[0015] Detecting application services running in the network; wherein the application services include sensitive application services determined by sensitive data;

[0016] Determine the service dependencies between different application services;

[0017] Constructing a second graph model according to the application service and the service dependency relationship; the nodes in the second graph model are application services, and the edges between the nodes represent the service dependency relationship;

[0018] The threat path of the sensitive application service is detected according to the second graph model.

[0019] Optionally, the application service running in the detection network includes:

[0020] Use scanning parameters and network traffic to detect application services running on the network;

[0021] Sensitive application services among the application services are determined through sensitive data.

[0022] Optionally, the threat detection method further includes:

[0023] Detecting devices in a network; the devices include sensitive asset devices determined by sensitive data;

[0024] Determine the link connectivity between different devices;

[0025] A third graph model is constructed according to the device and the link connection status; the nodes in the third graph model are devices, and the edges between the nodes represent the link connection status;

[0026] The threat path of the sensitive asset device is detected according to the third graph model.

[0027] Optionally, detecting a threat path of a sensitive asset device according to the third graph model includes:

[0028] Traversing each path in the third graph model, and calculating a risk score for each path according to the risk factor in each path;

[0029] Threat paths are determined based on the risk score of each path.

[0030] Optionally, detecting the threat path of the sensitive data according to the first graph model includes:

[0031] Determine attribute information of the first graph model; wherein the attribute information includes at least one of sensitivity level information, data transformation information, and system topology information corresponding to the sensitive data;

[0032] A threat path in the first graph model is detected according to the attribute information.

[0033] In a second aspect, the present application provides a threat detection device for sensitive data, comprising:

[0034] An acquisition module, used to acquire database access logs corresponding to sensitive data in real time;

[0035] A first detection module is used to detect whether there is an access behavior using the database access log; the access behavior is an access behavior performed on the sensitive data; if so, triggering a first creation module;

[0036] A first creation module, used to create a first graph model of the sensitive data; the first graph model includes a transmission path and attribute information of the sensitive data between nodes;

[0037] The second detection module is used to detect the threat path of the sensitive data according to the first graph model.

[0038] In a third aspect, the present application provides an electronic device, including:

[0039] A processor, a memory, and a computer program stored in the memory and executable on the processor, wherein the processor executes the steps of the above-mentioned sensitive data threat detection method of the present application through the computer program.

[0040] In a fourth aspect, the present application further provides a computer storage medium, wherein the computer storage medium stores computer executable instructions, and the computer executable instructions are used to execute the steps of the above-mentioned sensitive data threat detection method of the present application.

[0041] The above technical solution provided by the embodiment of the present application has the following advantages compared with the prior art: when detecting threats to sensitive data, the present application needs to obtain the database access log corresponding to the sensitive data in real time; use the database access log to detect whether there is an access behavior; the access behavior is an access behavior performed on the sensitive data; if so, create a first graph model of the sensitive data; the first graph model includes the transmission path and attribute information of the sensitive data between each node; detect the threat path of the sensitive data according to the first graph model. It can be seen that the present application creates a graph model through the database access log obtained in real time, and the graph model can be used to find the possible threat paths of sensitive data from the source to each node outside, realize multi-dimensional data association, realize real-time monitoring of the full-link data flow, and improve the detection accuracy of threats. BRIEF DESCRIPTION OF THE DRAWINGS

[0042] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the invention and, together with the description, serve to explain the principles of the invention.

[0043] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, for ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative labor.

[0044] One or more embodiments are exemplarily described by pictures in the corresponding drawings, and these exemplified descriptions do not constitute limitations on the embodiments. Elements with the same reference numerals in the drawings represent similar elements, and unless otherwise stated, the figures in the drawings do not constitute proportional limitations.

[0045] Figure 1 A flowchart of a sensitive data threat detection method provided in an embodiment of the present application;

[0046] Figure 2 A flowchart of another sensitive data threat detection method provided in an embodiment of the present application;

[0047] Figure 3 A flowchart of another sensitive data threat detection method provided in an embodiment of the present application;

[0048] Figure 4 A schematic diagram of the structure of a threat detection device for sensitive data provided in an embodiment of the present application;

[0049] Figure 5 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0050] In traditional detection solutions, detecting threats through static analysis tools means relying on static code analysis, configuration scanning and other methods to find potential sensitive data leakage points. However, these methods can only find known vulnerabilities in the design and deployment phase, and lack effective tracking methods for dynamic data flows in actual operation. Many companies use security information and event management systems to aggregate logs and analyze the use of sensitive data. However, this method relies more on the quality of logs, and it is difficult to achieve real-time detection, and usually can only be analyzed after the fact. Traditional detection solutions can also classify and encrypt sensitive data through data classification and encryption technology, and restrict data access rights, so that companies can reduce the risk of data leakage. However, these methods focus more on prevention rather than real-time detection of abnormal use or leakage risks. Existing intrusion detection systems and firewalls focus more on threat detection at the network level, and have limited threat detection capabilities for high-level application data such as specific data flow and sensitive information access.

[0051] The above analysis shows that traditional solutions have the following problems in threat detection:

[0052] 1. Information is scattered and lacks a global perspective: Existing systems usually store and manage sensitive data assets, network topology, application relationships and other information separately, making it difficult to form an overall view, making it difficult to effectively identify potential cross-system or cross-domain threats.

[0053] 2. Data flow is difficult to track: In a complex enterprise network environment, the entire path of sensitive data from storage, processing to external exposure often involves multiple systems and services. Traditional methods are difficult to automatically track the complete data flow, especially in a microservice architecture and cloud environment.

[0054] 3. Dynamic risks are difficult to assess in real time: Due to frequent changes in system configuration, network topology, API (Application Programming Interface) calls and other factors, manual risk assessment cannot track and reflect new risks in a timely manner. Most existing solutions are static analysis or regular audits, which cannot reflect the dynamic changes of risks in real time.

[0055] 4. Low accuracy of anomaly detection: Current anomaly detection systems mostly rely on predefined rules or patterns, which makes it difficult to capture complex abnormal behaviors that do not conform to business logic, especially when facing complex scenarios such as data abuse and internal threats.

[0056] Therefore, the embodiments of the present invention disclose a threat detection method, device, equipment and storage medium for sensitive data. This solution integrates sensitive data assets, application services, network topology and security control measures into a graph data model, and realizes full-link visualization and analysis from the data field level to the external network exposure surface. The specific innovations are as follows:

[0057] 1. Multi-dimensional data association: Integrate data that is traditionally scattered in different systems (such as database sensitive information, call relationships between applications, and network topology) into a unified graph model, achieving unprecedented multi-dimensional data association.

[0058] 2. Automated sensitive data flow tracking: Through the graph traversal algorithm, the complete path of sensitive data from the storage location to the possible external exposure point is automatically tracked, solving the problem of difficulty in fully grasping the data flow in traditional methods.

[0059] 3. Dynamic risk assessment model: Based on the graph data model, a dynamic risk assessment system is implemented, which can reflect the risk changes caused by configuration changes, new APIs or data flow changes in real time.

[0060] 4. Intelligent anomaly detection: Using the relational characteristics of graph data, a new anomaly detection algorithm has been developed that can identify data access patterns that do not conform to normal business logic.

[0061] In order to make the purpose, technical solution and advantages of the embodiments of the present application clearer, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of this application.

[0062] The disclosure below provides many different embodiments or examples to implement different structures of the present invention. In order to simplify the disclosure of the present invention, the parts and settings of specific examples are described below. Of course, they are only examples, and the purpose is not to limit the present invention. In addition, the present invention can repeat reference numbers and / or letters in different examples. This repetition is for the purpose of simplification and clarity, and does not itself indicate the relationship between the various embodiments and / or settings discussed.

[0063] See also Figure 1 , Figure 1 A flowchart of a sensitive data threat detection method provided in an embodiment of the present application, the method specifically comprises the following steps:

[0064] S101, obtaining database access logs corresponding to sensitive data in real time;

[0065] In this embodiment, sensitive data specifically refers to: personal identity information, financial data, medical information, etc. When determining sensitive data, this solution can perform a comprehensive and systematic scan of all databases to detect and identify sensitive data. The database includes a relational database, a NoSQL database (Not Only SQL, a non-relational database), etc., which are not specifically limited here. The database access log is an audit log, which contains access information of sensitive data, specifically including SQL (Structured Query Language, Structured Query Language) statements, access time, access users and other information. This application can achieve SQL statement-level monitoring, which can be refined to a single query operation, so as to accurately track data access patterns.

[0066] S102, using the database access log to detect whether there is any access behavior; the access behavior is an access behavior performed on sensitive data;

[0067] If yes, execute S103; if no, continue to execute S102;

[0068] In this application, the access behavior of sensitive data can be monitored through the database access log, and the access status of each SQL statement can be collected; and when the access status of each SQL statement is collected, the access log can be aggregated into an operation mode of a certain period according to the aggregation period, so that the system can quickly identify abnormal behavior. For example, if the aggregation period is set to 5 minutes and frequent access to sensitive data is detected within 5 minutes, the sensitive data has a higher risk of exposure. By setting the aggregation period, this application can capture data flow trends in a shorter period of time and identify potential threats.

[0069] S103, creating a first graph model of sensitive data; the first graph model includes a transmission path and attribute information of the sensitive data between nodes;

[0070] In this embodiment, if access to sensitive data is detected, a first graph model can be created in the graph database based on the database access log, system topology information and data transformation information; wherein the system topology information includes the association relationship and data flow relationship between applications, servers, and databases, and the data transformation information includes the rules and logs of operations such as encryption, decryption, and conversion. Through the data transformation information, the encryption, decryption, and conversion process of the data can be monitored to ensure that the data will not be exposed without authorization during the transmission process.

[0071] The first graph model created by this solution includes: nodes, edges and attribute information. Nodes represent data storage locations (such as database tables, file systems, etc.), application modules, processing servers, etc.; edges represent the paths along which data flows between nodes. Attribute information includes node attribute information and edge attribute information. Node attribute information includes the sensitivity level and data type of the node. Edge attribute information includes corresponding data transformation information and system topology information, such as transmission protocol, encryption status, etc. This application can determine the path graph of sensitive data from the storage location to the external exposure point through this first graph model. For example: After the data in sensitive table A is encrypted, it is transmitted to the external API interface C through application server B.

[0072] S104. Detect threat paths of sensitive data according to the first graph model.

[0073] It is understandable that this solution can analyze each path in the first graph model through a graph algorithm, detect possible exposure points from the source to the outside in each path, and then determine the threat path that poses a risk of exposure to sensitive data. In this embodiment, the threat path can specifically be a path for unencrypted transmission of sensitive data, or a path that exposes sensitive data to untrusted external nodes, etc., which is not limited here. As long as it is a path that exposes sensitive data, it can be called a threat path. Furthermore, if a threat path is detected, a risk warning and processing suggestions can be generated in the detection report. The present application can set the maximum number of jumps for the path, such as setting the maximum number of jumps to 3 to 5 jumps, to avoid the path being too long and resulting in increased computational complexity.

[0074] Specifically, when the present application detects the threat path of sensitive data based on the first graph model, the attribute information of the first graph model can be first determined; the attribute information includes at least one of the sensitivity level information, data transformation information, and system topology information corresponding to the sensitive data; and then the threat path in the first graph model is detected based on the attribute information.

[0075] For example, if there is a database DB1 inside the company, which contains sensitive data (such as user information). The database is accessed by the application App1, and App1 then provides data to the external service ExternalAPI through the API. This application can analyze the data flow path from DB1 to ExternalAPI for threat detection. The threat detection process specifically includes the following steps:

[0076] 1. Data acquisition:

[0077] In this embodiment, data is mainly obtained from the following three data sources, namely: SQL audit log, system topology information and data transformation information. Among them, SQL access records are mainly obtained from SQL audit logs, which record the access to sensitive data tables in the database (such as user_data table), including: executed SQL statements (such as SELECT*FROM user_data), executed applications (such as App1), user ID, access time, etc. Among them, application architecture and network topology are mainly obtained from system topology information, which describe how App1 interacts with database DB1 and external service ExternalAPI, including: connection information for App1 to access DB1, specific network path and protocol for App1 to send data to ExternalAPI through API (such as HTTP (Hypertext Transfer Protocol) or HTTPS (Hypertext TransferProtocol Secure)). Among them, encryption / decryption and data conversion are mainly obtained from data transformation information. It can indicate which nodes have processed the data during the data flow, such as: whether the sensitive data table is encrypted after being extracted from DB1; whether there is a decryption operation inside App1; whether the sensitive data table is converted or otherwise transformed when it is transmitted to ExternalAPI.

[0078] 2. Data processing and graph construction:

[0079] This embodiment constructs a graph model based on the collected information to represent the data flow path from DB1 to ExternalAPI. The specific steps are as follows:

[0080] 2.1. Create graph nodes (Vertices):

[0081] In this embodiment, the created nodes mainly include the following three types:

[0082] Node type 1 is data storage; create node DB1, mark it as a data storage node, and attach attribute information, such as the data table user_data stores sensitive data.

[0083] Node type 2 is application / intermediate processing: Create node App1, mark it as an application node, and attach attribute information, such as the application's ability to process data and whether encryption and decryption operations are performed.

[0084] Node type 3 is an external exposure point: create a node ExternalAPI, mark it as an external exposure point, and attach attribute information. The attributes include data transmission method (such as whether it is encrypted transmission), transmission protocol (such as HTTP / HTTPS), etc.

[0085] 2.2. Create the edges of the graph:

[0086] In this embodiment, the edge type is a data flow path. In this solution, an edge is created from the node DB1 to App1, indicating that App1 reads sensitive data from DB1 through SQL statements. The attribute information attached to this edge includes: the table user_data described in the SQL query log, and the access method (such as read-only or modify); then another edge is created from the node App1 to ExternalAPI, indicating that App1 transfers data to the external API. The attribute information that can be attached to this edge includes: transmission protocol (such as HTTPS, if it is HTTP, it is insecure transmission), whether the data is encrypted / decrypted, and other information.

[0087] 2.3. Path construction and analysis:

[0088] In this embodiment, a depth-first search (DFS) or breadth-first search (BFS) algorithm is specifically used to build possible paths starting from the DB1 node until the external exposure point ExternalAPI. On the path, the data passes through DB1 (storage node) → App1 (processing node) → ExternalAPI (exposure node) in sequence. The data used in the data flow process is: In DB1, the SQL query log is obtained, indicating that App1 reads the sensitive data user_data. In App1, the system topology information is obtained, indicating that App1 interacts with ExternalAPI through the API. Combined with the data transformation information, determine whether to encrypt the data. On the edge from App1 to ExternalAPI, combined with the transmission protocol information, confirm whether the data is encrypted and transmitted (such as HTTPS) to determine the security of the path.

[0089] 3. Key point analysis:

[0090] The key points analyzed in this embodiment mainly include: data transformation check and transmission protocol check; data transformation check refers to checking whether the App1 node encrypts or converts the data. If App1 performs unauthorized decryption operations on sensitive data, or does not re-encrypt the data during transmission, this will be a potential exposure risk point. Transmission protocol check refers to checking the transmission protocol between App1 and ExternalAPI. If the transmission is unencrypted (for example, using HTTP instead of HTTPS), the risk of data being exposed externally is greatly increased.

[0091] 4. Results and risk assessment:

[0092] The threat path output through the above steps is: DB1 (storing sensitive data) → App1 (processing data, unencrypted processing) → ExternalAPI (unencrypted transmission).

[0093] And through the above key point analysis, it can be seen that App1 does not encrypt the data, and the transmission path with ExternalAPI uses HTTP instead of HTTPS, which poses a risk of data leakage. Therefore, the system will mark this path as a high-risk threat path and recommend encryption in App1 or using HTTPS protocol for transmission. It should be noted that when managing data flow threat exposure, the sensitivity level of sensitive data can also be used to determine the risk level of the link.

[0094] From the above, it can be seen that the present application can monitor the access behavior of sensitive data in real time, quickly locate abnormal operations, automatically discover the complete link of sensitive data from storage to external exposure points, and identify the intermediate data transformation process and transmission security issues. Through the results of path analysis, potential exposure points can be discovered in a timely manner and early warnings can be issued to help the security team identify potential threats and provide optimization suggestions for corporate security policies to prevent sensitive data leakage. In addition, the present application is different from traditional server- or application-centric asset management. The system refines the granularity to the data field level, achieving more accurate sensitive data management, and can realize full-stack link visualization of database fields from the internal to the external network, providing unprecedented end-to-end visibility.

[0095] Based on the above embodiments, in this embodiment, before obtaining the database access log corresponding to the sensitive data in real time, it also includes: identifying the sensitive data in the database according to a predetermined period; determining the sensitivity level of each sensitive data; and generating a sensitive data identification report based on the sensitive data and the sensitivity level corresponding to each sensitive data.

[0096] Specifically, this application identifies sensitive data by scanning the database, and the scanning depth is table level, column level, and data sampling level; among them, table-level scanning refers to checking each table in the database and identifying its metadata, such as table name, number of fields, etc.; column-level scanning refers to further refinement to specific fields / columns, checking field names, data types and other information; data sampling level refers to extracting part of the data from the column for further analysis, which is used to identify and classify sensitive data. The scanning frequency can be daily incremental scanning or weekly full scanning. Daily incremental scanning refers to scanning and identifying only the most recently added or updated data, which is suitable for environments with frequent data changes; weekly full scanning refers to a complete scan of the entire database, which is suitable for periodic comprehensive inspections.

[0097] This application can use regular expressions and machine learning models to identify sensitive data. Regular expressions and machine learning models can be used alone or in combination during the identification of sensitive data. Simple sensitive data types (such as ID card numbers, credit card numbers, etc.) can be quickly matched using regular expressions, while more complex or variable data patterns (such as personal information in natural language) are suitable for identification using machine learning models. For example: To identify a set of credit card numbers, you can use a regular expression:

[0098] \b\d{4}[-]? \d{4}[-]? \d{4}[-]? \d{4}\b to match data with specific patterns, so that credit card numbers that match the format can be quickly located; use the trained machine learning model to analyze the data in the column. For example, if a column contains "John Doe, 123 Main St, City, SSN: 123-45-6789", the text-based classification model can identify the name, address, and social security number (SSN) contained in it based on context understanding.

[0099] In this embodiment, sensitive data can also be identified through sensitive data patterns. Sensitive data patterns refer to specific methods for identifying sensitive data based on data type, format, and context. For example: Personal identifying information (PII): Pattern examples: ID card number, passport number, email address, mobile phone number, etc. Identification method: Regular expressions can be used to match specific formats (such as mobile phone numbers).

[0100] \b\d{3}-\d{3}-\d{4}\b). Machine learning models can identify, for example, names and addresses in a text by context.

[0101] Financial data: Pattern examples: bank account number, credit card number, transaction amount, etc. Identification method: Regular expressions identify common formats, such as credit card numbers. For transaction information, the model can be used to determine whether certain values ​​or text fragments are financial data.

[0102] Medical information: Pattern examples: medical record number, medical diagnosis information, medical payment record, etc. Recognition method: The model learns to recognize medical terms such as "diagnosis is..." or "operation date is..." and associates the context of the medical record.

[0103] After the application identifies the sensitive data in the database, it is also necessary to classify the sensitive data according to its type and importance, determine the sensitivity level of the sensitive data, and ensure that sensitive data of different levels can take appropriate security measures according to their sensitivity levels. Data types can be divided into: personal identity information, financial data, medical information, geographic location information, etc. This embodiment can classify data based on predefined rules and machine learning models. These rules may be regular expressions, logical rules (such as a combination of specific field types), and classification models (such as supervised learning algorithms) are classified according to data features.

[0104] In this embodiment, the sensitivity levels are set to the following three levels:

[0105] High sensitivity level: such as personal identity information, financial data, medical information, etc., which are highly sensitive and may lead to serious consequences if leaked.

[0106] Medium sensitivity level: such as internal company financial records, contract terms, etc., which have a greater impact but do not directly threaten personal safety.

[0107] Low sensitivity level: such as public company information, general data, etc., with limited impact.

[0108] Here, the process of identifying sensitive data, the process of classifying sensitive data, and the process of generating a report are specifically described through a specific embodiment:

[0109] 1. Data collection and preprocessing:

[0110] Collect data from each column of the database table, which may contain personal information such as name, address, ID number, etc. The data format can be structured (such as relational database) or semi-structured (such as JSON data). Perform preprocessing steps on the collected data, including: cleaning the data, removing noise (such as null values, invalid characters), standardizing the format of dates, amounts, etc., and ensuring that the data can be used for model training or regular expression matching.

[0111] 2. Preliminary rule-based identification of sensitive data:

[0112] In this embodiment, a series of regular expressions can be used to quickly detect common sensitive information. For example:

[0113] ID number matching: \b\d{15}|\d{18}\b (used to match the format of Chinese ID number).

[0114] Email Matching:

[0115] \b[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,}\b.

[0116] Mobile phone number matching: \b\d{3}-\d{4}-\d{4}\b or similar format.

[0117] The above rules can be used to preliminarily screen out potential sensitive data in the table, especially formatted data columns (such as ID number, phone number, email address, etc.).

[0118] 3. Machine Learning Model Identification:

[0119] For complex data that cannot be identified by simple rules, such as sensitive information in free text (e.g., a database column contains freely described personal information), a supervised learning model is used for further classification. In this embodiment, a classification model based on natural language processing (NLP), such as a model based on BERT (Bidirectional Encoder Representations from Transformers) or LSTM (Long Short-Term Memory) can be used to identify sensitive information in context.

[0120] The model needs to be trained using an annotated dataset, which contains a large amount of free text with personal identification information such as name, address, ID number, etc. For example:

[0121] Input: "John Doe lives at 123 Main St, City, with ID number 123456789012345678"

[0122] Tags: {"name":"John Doe","address":"123Main St,City","ID":"123456789012345678"}

[0123] Once the training data set is determined, the model can learn from the training data to identify patterns of personally identifiable information such as name, address, and ID number, and learn to make classification decisions based on context in new data. The trained model is applied to the scanned database data, with the input being the free text data in the table and the output being the classification result. For example, the name, address, and ID number of an individual in a text snippet are identified and marked as personally identifiable information.

[0124] 4. Sensitivity classification:

[0125] After sensitive data is identified, the identified personal identity information is classified according to the sensitivity of the data, such as: High sensitivity: such as ID card number, passport number, social security number, etc., which directly endanger personal privacy and property security after leakage. Medium sensitivity: such as email address, phone number, etc., which may be used for privacy attacks or marketing. Low sensitivity: such as general non-sensitive text data.

[0126] When classifying sensitive data, the output of the model and the classification rules can be combined to determine the sensitivity level of each column of data. For example, social security numbers and addresses are classified as "high sensitivity", while email addresses may be classified as "medium sensitivity".

[0127] 5. Output and report generation:

[0128] After the above process, a detailed report is generated, which includes the name of sensitive data, sensitive data type, sensitivity level and sample data; for example, the column name is user_id, email, address, the data type is PII, the sensitivity level is high, and the sample data is some sensitive data samples extracted for review. In addition, the report can also generate relevant policies based on the sensitivity level of sensitive data, for example, highly sensitive data needs to be encrypted and stored.

[0129] For example, the input data is:

[0130] Plain Text

[0131] "Name:John Doe,Address:123Main St,ID:123456789012345678,Email:john.doe@example.com"

[0132] The output data is:

[0133] JSON

[0134] {

[0135] "name":"John Doe",

[0136] "address":"123 Main St",

[0137] "ID":"123456789012345678",

[0138] "email":"john.doe@example.com",

[0139] "sensitivity_level":{

[0140] "name":"medium",

[0141] "address":"high",

[0142] "ID":"high",

[0143] "email":"medium"

[0144] }

[0145] }

[0146] In summary, this application can more accurately identify data of different structures by combining rules and machine learning, and improves the ability to identify complex free text data, especially privacy information in unstructured data. The classified sensitive data report can help companies implement appropriate security measures at different sensitivity levels to ensure data compliance (such as meeting regulatory requirements such as GDPR (General Data Protection Regulation), CCPA (California Consumer Privacy Act)). Through the introduction of machine learning models, the system can optimize itself as the training data increases, and continuously improve the ability to recognize new data formats.

[0147] See also Figure 2 , Figure 2 A flowchart of another sensitive data threat detection method provided in an embodiment of the present application, the method specifically comprises the following steps:

[0148] S201, identifying sensitive data in the database according to a predetermined period;

[0149] S202, determining the sensitivity level of each sensitive data;

[0150] S203, obtaining database access logs corresponding to sensitive data in real time;

[0151] S204, using the database access log to detect whether there is any access behavior; the access behavior is an access behavior performed on sensitive data;

[0152] If yes, execute S205; if no, continue to execute S204;

[0153] S205: Create a first graph model of sensitive data; the first graph model includes a transmission path and attribute information of the sensitive data between nodes;

[0154] S206. Detect threat paths of sensitive data according to the first graph model.

[0155] S207, detecting application services running in the network; wherein the application services include sensitive application services determined by sensitive data;

[0156] S208, determining service dependencies between different application services;

[0157] S209, constructing a second graph model according to the application services and service dependencies; the nodes in the second graph model are application services, and the edges between the nodes represent service dependencies;

[0158] S210. Detect threat paths of sensitive application services according to the second graph model.

[0159] It should be noted that after the present application determines the sensitive data and sensitivity level through S201-S202, it can perform threat exposure management on the sensitive data at the data flow layer through S203-S206, and it can also perform threat exposure management on the sensitive data at the application layer through S207-S210. Here, the process of threat exposure management of sensitive data at the application layer is explained.

[0160] Specifically, the present application can identify the distribution of various application services within an enterprise, their dependencies, and expose and manage possible threats through analysis of sensitive data at the application layer. After the present application determines the sensitive data, sensitive application services can be determined based on the sensitive data. Sensitive application services are services that process, store or transmit sensitive data, which usually have confidentiality, integrity and availability requirements. Therefore, sensitive data is an important part of sensitive application services, and protecting sensitive data is also the key to ensuring the security of sensitive application services. The sensitivity of application services is usually directly related to the type of data and data sensitivity they process. For example: in the online banking system of a financial institution, the customer data it processes includes account information, transaction records, identity authentication information (such as ID number, password), etc. Therefore, the customer's account information, transaction records, and identity authentication information are highly sensitive data. If the data is leaked, it may cause financial losses and privacy risks. Services that process these data, such as user identity authentication services, transaction processing services, etc., are sensitive application services. Because the security of these services directly affects the security of customer data. Therefore, the present application can also protect the security of sensitive data by protecting the security of sensitive application services.

[0161] In this embodiment, scanning parameters and network traffic can be used to detect application services running in the network; sensitive application services in application services are determined by sensitive data. Among them, detecting application services by scanning parameters is an active scanning technology, and detecting application services by network traffic is a passive traffic monitoring technology. This application can discover application services running in the network through active scanning technology and passive traffic monitoring technology. This solution can use tools such as Nmap to perform active scanning technology. In the active scanning stage, the classic port scanning technology is used to perform port scanning on the host in the enterprise intranet according to the provided parameters (such as IP (Internet Protocol) address range, port number range), and identify the host and port that may run the service, such as: HTTP (Hypertext Transfer Protocol) service uses port 80 or 443, RPC (Remote Procedure Call) uses a specific port, etc.; Passive traffic monitoring technology monitors the traffic in the network to identify the traffic characteristics of common application services, and identify hidden services or services that cannot be discovered through active scanning. It should be noted that the application services identified in this application include sensitive application services, and sensitive application services need to be analyzed in detail during threat analysis.

[0162] Furthermore, this application needs to use deep packet inspection (DPI) and log analysis technology to extract the call relationship between application services and construct the dependency relationship between services. Among them, this application monitors network traffic and uses deep packet inspection to analyze the communication mode between services. The depth of DPI analysis determines the accuracy of identifying the call relationship between services, such as: understanding the interaction mode between services through the communication protocols (HTTP, RPC, custom protocols, etc.) and communication frequencies (such as the number of requests per minute) between different services, so as to determine which services depend on other services; this application can also parse API calls, access logs, etc. from the logs of application services to extract call chain information between services.

[0163] Through the above analysis process, the analysis results of application services and service dependencies can be stored in the graph database. In the graph database, application services are used as nodes, and the dependencies between services are used as edges to construct a second graph model, and threat analysis is performed through graph algorithms. Specifically, the node types in the second graph model include: application services and servers of associated application services; each application service is used as a node, and the node attributes are: service name, IP address, port number, protocol type, etc.; the server can be a physical or virtual server node. The edge types between nodes include call relationships and communication links, where the call relationship refers to the dependency between application services, and the call frequency between services is used to determine the closeness of the dependency. Connected by calling protocols (HTTP, RPC, etc.); communication links refer to the connection between physical servers, reflecting actual network communications.

[0164] For example, set the network scanning parameters as follows: IP range: 192.168.0.0 / 16; port range: 1-65535. The application services in the network can be detected by scanning the parameters. Then, the real-time traffic data packets in the network are detected by network traffic analysis, and the service dependencies are determined based on the calls between applications; the call logs of the application services are analyzed to determine the service dependencies. Finally, a graph model is created, which is a graph containing all application services and their dependencies. The nodes in the graph model are:

[0165] Application A: IP = 192.168.1.1, Port = 8080, Protocol = HTTP

[0166] Application B: IP = 192.168.1.2, Port = 9090, Protocol = RPC

[0167] The edges in the graph model are:

[0168] Application A calls application B, protocol = HTTP, calling frequency = 100 times / minute.

[0169] If we know through the analysis of the graph model that application B is a sensitive application service and application A is an untrusted external service, then we can determine that the path of application A calling application B is a threat path. Through this threat path, it is easy to expose sensitive application services to untrusted external services, forming a potential attack path.

[0170] Through the above process, it can be seen that this application can comprehensively discover the application services and their interdependencies in the enterprise network and build a complete graph database model through this method. Subsequently, through the graph algorithm, the risk of sensitive asset exposure can be quickly identified, potential attack paths can be found, and a clear threat exposure management solution can be provided. This process can help enterprises identify and prioritize the repair of existing security risks and effectively improve network security situation awareness capabilities.

[0171] See also Figure 3 , Figure 3 A flowchart of another sensitive data threat detection method provided in an embodiment of the present application, the method specifically comprises the following steps:

[0172] S301, identifying sensitive data in the database according to a predetermined period;

[0173] S302, determining the sensitivity level of each sensitive data;

[0174] S303, obtaining database access logs corresponding to sensitive data in real time;

[0175] S304, using the database access log to detect whether there is access behavior; the access behavior is an access behavior performed on sensitive data;

[0176] If yes, execute S305; if no, continue to execute S304;

[0177] S305: Create a first graph model of sensitive data; the first graph model includes a transmission path and attribute information of the sensitive data between nodes;

[0178] S306. Detect threat paths of sensitive data according to the first graph model.

[0179] S307, detecting application services running in the network; wherein the application services include sensitive application services determined by sensitive data;

[0180] S308, determining service dependencies between different application services;

[0181] S309: construct a second graph model according to the application services and service dependencies; the nodes in the second graph model are application services, and the edges between the nodes represent service dependencies;

[0182] S310. Detect threat paths of sensitive application services according to the second graph model.

[0183] S311, detecting devices in the network; the devices include sensitive asset devices determined by sensitive data;

[0184] S312, determining the link connection status between different devices;

[0185] S313, constructing a third graph model according to the devices and link connection conditions; the nodes in the third graph model are devices, and the edges between the nodes represent the link connection conditions;

[0186] S314. Detect threat paths of sensitive asset devices according to the third graph model.

[0187] It should be noted that after the application determines the sensitive data and sensitivity level through S301-S302, it can manage the threat exposure of sensitive data at the data flow layer through S303-S306, manage the threat exposure of sensitive data at the application layer through S307-S310, and manage the threat exposure of sensitive data at the network layer through S311-S314. The network layer threat exposure management uses a graph database to model and analyze the link exposure of sensitive asset devices in the network. Taking advantage of the graph database, each node and link in the network can be quickly queried and traversed to identify potential threat exposure points. This method can track the connection between sensitive asset devices and other network devices by constructing a graph model of network devices and links, and then evaluate the actual protection effect of security devices such as firewalls and isolated networks.

[0188] Specifically, the present application first detects the devices in the network, including servers, firewalls, routers, switches, and the like. The device includes sensitive asset devices determined by sensitive data, and the sensitive asset devices are devices for storing sensitive data, such as database servers, personal privacy data storage nodes, and the like. Therefore, the present application can also protect the security of sensitive data by protecting the security of sensitive asset devices. After determining the devices in the network, it is also necessary to determine the link connection between different devices. Then, a third graph model is constructed through the devices and link connections. In the third graph model, nodes represent devices in the network, and edges represent the link connection between devices. If there are edges between nodes, it means that there is a link connection between the two devices, otherwise, it means that there is no link connection between the two devices. Among them, node attributes include: device type (server, firewall), network (DMZ (demilitarized zone, isolation zone), intranet), security level (high, medium, low), running service (HTTP, SSH (Secure Shell, remote connection tool)), whether it is a sensitive asset (yes / no). Edge attributes include: communication protocol (TCP (Transmission Control Protocol) / UDP (User Datagram Protocol)), port number, firewall policy, isolated network configuration, bandwidth, latency, connection stability, etc. Among them, the present application marks sensitive asset devices in the graph model, and can focus on analyzing the exposure of sensitive asset devices during threat detection. Firewall policy is used to determine whether a link is protected by a firewall, such as whether port access is allowed, source IP restrictions, etc. This policy affects the risk score of the path. ; Isolation network configuration is used to describe whether certain links are protected by isolated networks (such as VLAN (Virtual Local Area Network), DMZ (demilitarized zone), etc.). The existence of an isolated network will reduce the risk score of certain paths.

[0189] When the present application detects the threat path of sensitive asset equipment through the third graph model, each path in the third graph model can be traversed, and the risk score of each path can be calculated according to the risk factor in each path; the threat path is determined according to the risk score of each path. In this embodiment, all possible communication paths can be searched from external nodes (such as public networks, non-trusted areas) to sensitive asset nodes based on a graph traversal algorithm (such as BFS or DFS). The risk factor is a factor that affects the risk score, and the risk factor can be: whether to pass through a firewall, link bandwidth, whether to isolate the network, etc. Finally, the overall risk score of the path is calculated based on the risk factors on each path, such as: according to the attributes of each link, the sensitivity level of the sensitive asset equipment, whether to pass through a firewall, link security, device security, connection complexity and other information, the scoring rules are configured to calculate the risk score. The higher the score, the greater the threat of the path. In this embodiment, the exposure degree of each path can be evaluated based on algorithms such as Dijkstra to determine the risk score. This solution can also automatically generate a risk assessment report based on the analysis results, and propose repair suggestions for high-risk threat paths.

[0190] For example, input network topology data includes: description of network devices, link connectivity, and the location of protection devices such as firewalls and isolated networks.

[0191] Plain Text

[0192] Node 1: Server A (sensitive assets, intranet, service: HTTP)

[0193] Node 2: Firewall B (isolation device)

[0194] Node 3: Internet portal C

[0195] Side 1: Server A -> Firewall B, Protocol: TCP, Port: 80

[0196] Side 2: Firewall B -> Internet portal C, protocol: TCP, port: 80

[0197] The output data includes a risk assessment report that lists all threat paths with potential threats, their exposure risk scores, and treatment recommendations.

[0198] Plain Text

[0199] Path 1: Internet portal C -> Firewall B -> Server A

[0200] Exposure risk score: 75 (high)

[0201] Suggestion: Add firewall rules to restrict external access to port 80.

[0202] This application can automatically identify potential threat paths for sensitive assets by quickly building a graph model of network devices and links. This application provides efficient exposure risk assessment and helps security teams locate high-risk network links through a scoring mechanism. Based on the analysis results, this application can generate processing suggestions, optimize firewall policies, or adjust isolated network structures to reduce the exposure of sensitive assets. In addition, this application can also continuously monitor network changes and respond to new threats in a timely manner through periodic evaluations.

[0203] See also Figure 4 , Figure 4 A schematic diagram of a sensitive data threat detection device provided in an embodiment of the present application, the device specifically includes:

[0204] An acquisition module 11 is used to acquire database access logs corresponding to sensitive data in real time;

[0205] A first detection module 12 is used to detect whether there is an access behavior using the database access log; the access behavior is an access behavior performed on the sensitive data; if so, triggering a first creation module;

[0206] A first creation module 13, used to create a first graph model of the sensitive data; the first graph model includes a transmission path and attribute information of the sensitive data between nodes;

[0207] The second detection module 14 is used to detect the threat path of the sensitive data according to the first graph model.

[0208] As an optional embodiment, the threat detection device further includes:

[0209] An identification module, used to identify sensitive data in the database according to a predetermined period;

[0210] A first determination module, used to determine the sensitivity level of each sensitive data;

[0211] A generating module is used to generate a sensitive data identification report according to the sensitive data and the sensitivity level corresponding to each sensitive data.

[0212] As an optional embodiment, the threat detection device further includes:

[0213] A third detection module is used to detect application services running in the network; wherein the application services include sensitive application services determined by sensitive data;

[0214] A second determination module is used to determine the service dependency relationship between different application services;

[0215] A second creation module is used to construct a second graph model according to the application service and the service dependency relationship; the nodes in the second graph model are application services, and the edges between the nodes represent the service dependency relationship;

[0216] The fourth detection module is used to detect the threat path of sensitive application services according to the second graph model.

[0217] As an optional embodiment, the third detection module includes:

[0218] A detection unit, used for detecting application services running in the network by using scanning parameters and network traffic;

[0219] A determination unit is used to determine sensitive application services among the application services through sensitive data.

[0220] As an optional embodiment, the threat detection device further includes:

[0221] A fifth detection module, used to detect devices in the network; the devices include sensitive asset devices determined by sensitive data;

[0222] A third determination module is used to determine the link connection status between different devices;

[0223] A third creation module is used to construct a third graph model according to the device and the link connection status; the nodes in the third graph model are devices, and the edges between the nodes represent the link connection status;

[0224] The sixth detection module is used to detect the threat path of the sensitive asset equipment according to the third graph model.

[0225] As an optional embodiment, the sixth detection module is specifically used to: traverse each path in the third graph model, calculate the risk score of each path according to the risk factor in each path; and determine the threat path according to the risk score of each path.

[0226] As an optional embodiment, the second detection module is specifically used to: determine attribute information of the first graph model; wherein the attribute information includes at least one of sensitivity level information, data transformation information, and system topology information corresponding to the sensitive data; and detect the threat path in the first graph model based on the attribute information.

[0227] Regarding the device in the above embodiment, the specific manner in which each module performs operations has been described in detail in the embodiment of the method, and will not be elaborated here.

[0228] See also Figure 5 , Figure 5A schematic diagram of the structure of an electronic device provided in an embodiment of the present application, the electronic device specifically includes:

[0229] A processor 21, a memory 22, and a computer program stored in the memory 22 and executable on the processor 21. The processor 21 executes the steps of the threat detection method for sensitive data described in any of the above method embodiments through the computer program.

[0230] Among them, the processor 21 may include one or more processing cores, such as a 4-core processor, an 8-core processor, etc. The processor 21 may be implemented in at least one hardware form of DSP (Digital Signal Processing), FPGA (Field-Programmable Gate Array), and PLA (Programmable Logic Array). The processor 21 may also include a main processor and a coprocessor. The main processor is a processor for processing data in the awake state, also known as a CPU (Central Processing Unit); the coprocessor is a low-power processor for processing data in the standby state. In some embodiments, the processor 21 may be integrated with a GPU (Graphics Processing Unit), which is responsible for rendering and drawing the content to be displayed on the display screen. In some embodiments, the processor 21 may also include an AI (Artificial Intelligence) processor, which is used to process computing operations related to machine learning.

[0231] The memory 22 may include one or more computer-readable storage media, which may be non-transitory. The memory 22 may also include a high-speed random access memory, and a non-volatile memory, such as one or more disk storage devices, flash memory storage devices. In this embodiment, the memory 22 is at least used to store the following computer program 221, wherein, after the computer program is loaded and executed by the processor 21, it can implement the relevant steps in the threat detection method for sensitive data disclosed in any of the aforementioned embodiments. In addition, the resources stored in the memory 22 may also include an operating system 222 and data 223, etc., and the storage method may be temporary storage or permanent storage. Among them, the operating system 222 may include Windows, Unix, Linux, etc.

[0232] In some embodiments, the electronic device may further include a display screen 23 , an input / output interface 24 , a communication interface 25 , a sensor 26 , a power source 27 , and a communication bus 28 .

[0233] certainly, Figure 5 The structure of the electronic device shown does not constitute a limitation on the electronic device in the embodiments of the present application. In actual applications, the electronic device may include Figure 5 More or fewer components than shown, or combinations of certain components.

[0234] In another exemplary embodiment, a computer storage medium is also provided, and when the program instructions are executed by a processor, the steps of the threat detection method for sensitive data described in any of the above method embodiments are implemented. The storage medium may include: a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, and other media that can store program codes.

[0235] Optionally, the specific examples in this embodiment may refer to the examples described in the above embodiments, and this embodiment will not be described in detail here.

[0236] It should be understood that the terms used herein are only for the purpose of describing specific example embodiments and are not intended to be limiting. Unless the context clearly indicates otherwise, the singular forms "one", "an" and "said" as used herein may also be meant to include plural forms. The terms "include", "comprise", "contain", and "have" are inclusive, and therefore specify the existence of stated features, steps, operations, elements and / or parts, but do not exclude the existence or addition of one or more other features, steps, operations, elements, parts, and / or combinations thereof. The method steps, processes, and operations described herein are not interpreted as necessarily requiring them to be performed in the specific order described or illustrated, unless the execution order is clearly indicated. It should also be understood that additional or alternative steps may be used.

[0237] The foregoing is merely a specific embodiment of the present invention, which enables those skilled in the art to understand or implement the present invention. Various modifications to these embodiments will be apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present invention. Therefore, the present invention will not be limited to the embodiments shown herein, but rather to the widest scope consistent with the principles and novel features claimed herein.

Claims

1. A method for detecting threats to sensitive data, characterized in that: include: Obtain database access logs corresponding to sensitive data in real time; Using the database access log to detect whether there is access behavior; The access behavior is an access behavior performed on the sensitive data; If yes, then create a first graph model of the sensitive data; the first graph model includes the transmission path and attribute information of the sensitive data between nodes; The threat path of the sensitive data is detected according to the first graph model.

2. The threat detection method according to claim 1, characterized in that: Before obtaining the database access log corresponding to the sensitive data in real time, the method further includes: Identify sensitive data in the database according to a predetermined period; Determine the sensitivity level of each type of sensitive data; A sensitive data identification report is generated based on the sensitive data and the sensitivity level corresponding to each sensitive data.

3. The threat detection method according to claim 2, characterized in that: The threat detection method further includes: Detecting application services running in the network; wherein the application services include sensitive application services determined by sensitive data; Determine the service dependencies between different application services; Constructing a second graph model according to the application service and the service dependency relationship; the nodes in the second graph model are application services, and the edges between the nodes represent the service dependency relationship; The threat path of the sensitive application service is detected according to the second graph model.

4. The threat detection method according to claim 3, characterized in that: The application services running in the detection network include: Use scanning parameters and network traffic to detect application services running on the network; Sensitive application services among the application services are determined through sensitive data.

5. The threat detection method according to claim 2, characterized in that: The threat detection method further includes: Detecting devices in a network; the devices include sensitive asset devices determined by sensitive data; Determine the link connectivity between different devices; A third graph model is constructed according to the device and the link connection status; the nodes in the third graph model are devices, and the edges between the nodes represent the link connection status; The threat path of the sensitive asset device is detected according to the third graph model.

6. The threat detection method according to claim 5, characterized in that: Detecting a threat path of a sensitive asset device according to the third graph model includes: Traversing each path in the third graph model, and calculating a risk score for each path according to the risk factor in each path; Threat paths are determined based on the risk score of each path.

7. The threat detection method according to any one of claims 1 to 6, characterized in that: The detecting the threat path of the sensitive data according to the first graph model includes: Determine attribute information of the first graph model; wherein the attribute information includes at least one of sensitivity level information, data transformation information, and system topology information corresponding to the sensitive data; A threat path in the first graph model is detected according to the attribute information.

8. A threat detection device for sensitive data, characterized in that: include: An acquisition module, used to acquire database access logs corresponding to sensitive data in real time; A first detection module is used to detect whether there is an access behavior using the database access log; the access behavior is an access behavior performed on the sensitive data; if so, triggering a first creation module; A first creation module, used to create a first graph model of the sensitive data; the first graph model includes a transmission path and attribute information of the sensitive data between nodes; The second detection module is used to detect the threat path of the sensitive data according to the first graph model.

9. An electronic device, characterized in that: include: A processor, a memory, and a computer program stored in the memory and executable on the processor, wherein the processor executes the steps of the threat detection method for sensitive data described in any one of claims 1 to 7 of the present application through the computer program.

10. A computer storage medium, characterized in that: The computer storage medium stores computer executable instructions, and the computer executable instructions are used to execute the steps of the threat detection method for sensitive data described in any one of claims 1 to 7 of the present application.

Images