Threat detection method, device and equipment for sensitive data and storage medium

Abstract

The application relates to a sensitive data threat detection method, device, equipment and storage medium. When detecting the threat of sensitive data, the application needs to acquire database access logs corresponding to the sensitive data in real time; whether an access behavior exists is detected by using the database access logs; the access behavior is an access behavior performed on the sensitive data; if yes, a first graph model of the sensitive data is created; the first graph model includes transmission paths and attribute information of the sensitive data between nodes; and a threat path of the sensitive data is detected according to the first graph model. It can be seen that the application creates a graph model through real-time acquisition of database access logs, and the threat path possibly existing in each node from the source to the outside of the sensitive data can be found through the graph model, multi-dimensional data correlation is realized, real-time full-link data flow monitoring is realized, and the detection accuracy of the threat is improved.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of threat detection, and particularly relates to a sensitive data threat detection method and device, equipment and a storage medium. BACKGROUND

[0002] Sensitive data refers to data that may cause serious harm to society or individuals after leakage. The sensitive data threat detection method in the traditional scheme mainly detects through static analysis tools, log auditing and SIEM (Security Information and Event Management) systems, data classification and encryption technology, and Intrusion Detection System (IDS) and firewall technology. However, the above scheme lacks dynamic and real-time full-link data flow monitoring when detecting potential threats of sensitive data assets, and cannot analyze in combination with the correlation of multi-dimensional data, so the precision of threat detection is low.

[0003] Therefore, how to detect the threat existing in sensitive data in a timely and effective manner is a problem to be solved by the present technical personnel. SUMMARY

[0004] The present application provides a sensitive data threat detection method, device, equipment and storage medium to detect the threat existing in sensitive data in a timely and effective manner.

[0005] In a first aspect, the present application provides a sensitive data threat detection method, comprising:

[0006] Real-time acquisition of database access logs corresponding to sensitive data;

[0007] Detecting whether there is an access behavior by using the database access logs; the access behavior is an access behavior performed on the sensitive data;

[0008] If yes, a first graph model of the sensitive data is created; the first graph model includes transmission paths and attribute information of the sensitive data between nodes;

[0009] Detecting a threat path of the sensitive data according to the first graph model.

[0010] Optionally, before the real-time acquisition of the database access logs corresponding to the sensitive data, the method further comprises:

[0011] Identifying sensitive data in the database according to a predetermined period;

[0012] Determining the sensitive level of each kind of sensitive data;

[0013] According to the sensitive data and the sensitive level corresponding to each kind of sensitive data, a sensitive data identification report is generated.

[0014] Optionally, the threat detection method further comprises:

[0015] detecting application services running in the network; wherein the application services include sensitive application services determined by the sensitive data;

[0016] determining service dependency relationships between different application services;

[0017] constructing a second graph model according to the application services and the service dependency relationships; nodes in the second graph model are application services, and edges between the nodes represent service dependency relationships;

[0018] detecting threat paths of the sensitive application services according to the second graph model.

[0019] Optionally, the detecting application services running in the network comprises:

[0020] detecting application services running in the network by using scanning parameters and network traffic;

[0021] determining the sensitive application services in the application services by the sensitive data.

[0022] Optionally, the threat detection method further comprises:

[0023] detecting devices in the network; wherein the devices include sensitive asset devices determined by the sensitive data;

[0024] determining link connection conditions between different devices;

[0025] constructing a third graph model according to the devices and the link connection conditions; nodes in the third graph model are devices, and edges between the nodes represent link connection conditions;

[0026] detecting threat paths of the sensitive asset devices according to the third graph model.

[0027] Optionally, the detecting threat paths of the sensitive asset devices according to the third graph model comprises:

[0028] traversing each path in the third graph model, and calculating a risk score of each path according to risk factors in each path;

[0029] determining the threat paths according to the risk scores of each path.

[0030] Optionally, the detecting threat paths of the sensitive data according to the first graph model comprises:

[0031] determine attribute information of the first graph model; wherein the attribute information comprises at least one of sensitive level information corresponding to the sensitive data, data transformation information, and system topology information;

[0032] detect a threat path in the first graph model according to the attribute information.

[0033] In a second aspect, the present application provides a sensitive data threat detection device, comprising:

[0034] an acquisition module configured to acquire database access logs corresponding to sensitive data in real time;

[0035] a first detection module configured to detect whether there is an access behavior by using the database access logs; the access behavior is an access behavior performed on the sensitive data; if yes, a first creation module is triggered;

[0036] the first creation module is configured to create a first graph model of the sensitive data; the first graph model comprises a transmission path of the sensitive data between nodes and attribute information;

[0037] a second detection module configured to detect a threat path of the sensitive data according to the first graph model.

[0038] In a third aspect, the present application provides an electronic device, comprising:

[0039] a processor, a memory, and a computer program stored on the memory and executable on the processor; the processor executes steps of the sensitive data threat detection method of the present application by the computer program.

[0040] In a fourth aspect, the present application further provides a computer storage medium, which stores computer executable instructions for executing steps of the sensitive data threat detection method of the present application.

[0041] Compared with the prior art, the above technical solution provided by the embodiments of the present application has the following advantages: when detecting a threat of sensitive data, the present application needs to acquire database access logs corresponding to the sensitive data in real time; the database access logs are used to detect whether there is an access behavior; the access behavior is an access behavior performed on the sensitive data; if yes, a first graph model of the sensitive data is created; the first graph model comprises a transmission path of the sensitive data between nodes and attribute information; a threat path of the sensitive data is detected according to the first graph model. As can be seen, the present application creates a graph model by using the database access logs acquired in real time; the graph model can be used to find a possible threat path of the sensitive data from a source to each node outside, realize multi-dimensional data association, realize real-time monitoring of a full-link data flow, and improve the detection accuracy of threats. Attached Figure Description

[0042] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with the invention and, together with the description, serve to explain the principles of the invention.

[0043] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, for those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0044] One or more embodiments are illustrated by way of example with reference numerals in the accompanying drawings. These illustrations do not constitute a limitation on the embodiments. Elements with the same reference numerals in the drawings are denoted as similar elements. Unless otherwise stated, the figures in the drawings are not to be limited by scale.

[0045] Figure 1 A flowchart illustrating a threat detection method for sensitive data provided in this application embodiment;

[0046] Figure 2 A flowchart illustrating another threat detection method for sensitive data provided in this application embodiment;

[0047] Figure 3 A flowchart illustrating another threat detection method for sensitive data provided in this application embodiment;

[0048] Figure 4 A schematic diagram of a threat detection device for sensitive data provided in an embodiment of this application;

[0049] Figure 5 This is a schematic diagram of an electronic device structure provided in an embodiment of this application. Detailed Implementation

[0050] In a traditional detection scheme, threats are detected by static analysis tools, which means relying on static code analysis, configuration scanning and other methods to find potential sensitive data leakage points. However, these methods can only find known vulnerabilities at the design and deployment stage, and lack effective tracking means for dynamic data flow in actual operation. Many enterprises use security information and event management systems to aggregate logs and analyze the use of sensitive data. However, this method relies more on log quality and is difficult to detect in real time, and can usually only be analyzed after the fact. The traditional detection scheme can also classify and encrypt sensitive data through data classification and encryption technology, limit data access permissions, and enterprises can reduce the risk of data leakage. However, these methods focus more on prevention rather than real-time detection of abnormal use or leakage risks. Existing intrusion detection systems and firewalls focus more on network-level threat detection, and have limited capabilities for threat detection of specific data flow and sensitive information access at a high level of application data.

[0051] Through the above analysis, it can be seen that the traditional scheme has the following problems in threat detection:

[0052] 1. Information is scattered and lacks a global perspective: Existing systems usually store and manage sensitive data assets, network topology, application relationships, and other information separately, making it difficult to form a holistic view and leading to difficulty in effectively identifying potential threats across systems or domains.

[0053] 2. Data flow is difficult to track: In complex enterprise network environments, the entire path of sensitive data from storage, processing to external exposure often involves multiple systems and services, and traditional methods are difficult to automatically track complete data flow, especially in microservice architectures and cloud environments.

[0054] 3. Dynamic risk is difficult to assess in real time: Due to frequent changes in system configuration, network topology, API (Application Programming Interface) calls and other factors, manual risk assessment cannot keep up with new risks. Existing solutions are mostly static analysis or periodic audits, and cannot reflect the dynamic changes of risks in real time.

[0055] 4. Low accuracy of anomaly detection: Current anomaly detection systems mostly rely on pre-defined rules or patterns, making it difficult to capture complex and non-business logic abnormal behaviors, especially in complex scenarios such as data misuse and internal threats.

[0056] Therefore, the embodiments of the present application disclose a sensitive data threat detection method, device, equipment and storage medium, which integrates sensitive data assets, application services, network topology and security control measures into a graph data model, realizing full-link visualization and analysis from data field level to external exposure. The specific innovations are as follows:

[0057] 1. Multi-dimensional data correlation: Integrating data traditionally scattered in different systems (such as database sensitive information, inter-application call relationships, network topology) into a unified graph model, realizing unprecedented multi-dimensional data correlation.

[0058] 2. Automatic sensitive data flow tracking: Through graph traversal algorithm, automatically tracking the complete path of sensitive data from storage location to possible external exposure point, solving the problem of difficult to fully grasp data flow in traditional methods.

[0059] 3. Dynamic risk assessment model: Based on the graph data model, a dynamic risk assessment system is realized, which can reflect the risk changes caused by configuration changes, new APIs or data flow changes in real time.

[0060] 4. Intelligent anomaly detection: Using the relationship characteristics of graph data, a new anomaly detection algorithm is developed, which can identify data access patterns that do not conform to normal business logic.

[0061] In order to make the purpose, technical scheme and advantages of the embodiments of the present application clearer, the technical scheme in the embodiments of the present application will be described clearly and completely in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, not all embodiments. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative labor belong to the scope of protection of the present application.

[0062] The following disclosure provides many different embodiments or examples for implementing the various structures of the present application. In order to simplify the disclosure of the present application, the components and settings of specific examples are described below. Of course, they are only examples and the purpose is not to limit the present application. In addition, the present application can repeatedly refer to numbers and / or letters in different examples. Such repetition is for the purpose of simplification and clarity, and does not indicate the relationship between the various embodiments and / or settings discussed.

[0063] Referring to Figure 1 , Figure 1 A threat detection method for sensitive data is provided for the embodiments of the present application, which specifically includes the following steps:

[0064] S101, real-time acquisition of database access log corresponding to sensitive data;

[0065] In the embodiment, the sensitive data specifically includes personal identity information, financial data, medical information, and the like. The scheme can comprehensively and systematically scan all databases to detect and identify sensitive data when determining the sensitive data. The databases include relational databases, NoSQL databases (Not Only SQL, non-relational databases), and the like, which are not specifically limited herein. The database access log is an audit log, which contains access information of the sensitive data, and specifically includes SQL (Structured Query Language) statements, access time, access users, and the like. The application can realize SQL statement level monitoring, and can be refined to a single query operation, so as to accurately track data access patterns.

[0066] S102, detecting whether there is an access behavior by using the database access log; the access behavior is an access behavior performed on the sensitive data;

[0067] If yes, S103 is performed; if no, S102 is continuously performed;

[0068] In the application, the database access log can be used to monitor the access behavior of the sensitive data, and the access conditions of each SQL statement can be collected. When the application collects the access conditions of each SQL statement, the access log can be aggregated into an operation pattern of a certain period according to an aggregation period, so that the system can quickly identify abnormal behaviors. For example, if the aggregation period is set to 5 minutes, and the access behavior of frequently accessing the sensitive data is detected within 5 minutes, the sensitive data has a higher risk of exposure. The application can capture data flow trends and identify potential threats in a short period of time by setting the aggregation period.

[0069] S103, creating a first graph model of the sensitive data; the first graph model includes transmission paths and attribute information of the sensitive data between nodes;

[0070] In the embodiment, if the access behavior of the sensitive data is detected, a first graph model can be created in a graph database according to the database access log, system topology information, and data transformation information. The system topology information includes the association relationship and data flow relationship between the application program, the server, and the database. The data transformation information includes rules and logs of encryption, decryption, conversion, and the like. By using the data transformation information, the encryption, decryption, and conversion processes of the data can be monitored to ensure that the data is not exposed unauthorizedly during the transmission process.

[0071] The first graph model created by the scheme includes node, edge and attribute information. The node represents the storage location of data (such as a database table, a file system, etc.), an application module, a processing server, etc. The edge represents the path through which data flows between nodes. The attribute information includes node attribute information and edge attribute information. The node attribute information includes the sensitivity level and data type of the node. The edge attribute information includes corresponding data transformation information and system topology information, such as transmission protocol and encryption status. Through the first graph model, the path graph of sensitive data from the storage location to the external exposure point can be determined. For example, the data in the sensitive table A is transmitted to the external API interface C through the application server B after being encrypted.

[0072] S104, detecting a threat path of sensitive data according to the first graph model.

[0073] It can be understood that the scheme can analyze each path in the first graph model through a graph algorithm, detect the possible exposure point from the source to the outside in each path, and then determine the threat path that exposes the sensitive data. In this embodiment, the threat path can be a path through which the sensitive data is transmitted without encryption, or a path through which the sensitive data is exposed to an untrusted external node, etc. Herein, it is not limited, as long as it is a path through which the sensitive data is exposed, it can be called a threat path. Further, if the threat path is detected, a risk alarm and a processing suggestion can be generated in the detection report. The application can set the maximum number of jumps of the path, such as setting the maximum number of jumps within 3 to 5 jumps, to avoid increasing the calculation complexity due to too long path.

[0074] Specifically, when detecting the threat path of the sensitive data according to the first graph model, the application can first determine the attribute information of the first graph model. The attribute information includes at least one of the sensitivity level information, the data transformation information and the system topology information corresponding to the sensitive data. Then, the threat path in the first graph model is detected according to the attribute information.

[0075] For example, there is a database DB1 in the company, which contains sensitive data (such as user information). The database is accessed by an application App1, and the App1 provides data to an external service ExternalAPI through an API. The application can analyze the data flow path from DB1 to ExternalAPI for threat detection. The threat detection process specifically includes the following steps:

[0076] 1. Data acquisition:

[0077] In this embodiment, data is mainly obtained from the following three data sources: SQL audit logs, system topology information, and data transformation information. Among them, the SQL access records are mainly obtained from the SQL audit logs, which record the access of sensitive data tables (such as the user_data table) in the database, including: executed SQL statements (such as SELECT * FROM user_data), executed applications (such as App1), user IDs, access times, etc. Among them, the application architecture and network topology are mainly obtained from the system topology information, which describes how App1 interacts with database DB1 and external service ExternalAPI, including: connection information of App1 accessing DB1, specific network path and protocol (such as HTTP (Hypertext Transfer Protocol) or HTTPS (Hypertext Transfer Protocol Secure)) of App1 sending data to ExternalAPI through API. Among them, encryption / decryption and data conversion are mainly obtained from the data transformation information, which can represent which nodes process the data during data flow, such as: whether the sensitive data table is encrypted after being extracted from DB1; whether there is a decryption operation inside App1; whether there is a conversion or other transformation operation when the sensitive data table is transmitted to ExternalAPI.

[0078] 2. Data processing and graph construction:

[0079] According to the above information collected in this embodiment, a graph model is constructed to represent the data flow path from DB1 to ExternalAPI. The specific steps are as follows:

[0080] 2.1. Create nodes (Vertices) of the graph:

[0081] In this embodiment, the created nodes mainly include the following three types:

[0082] Node type 1 is data storage; create node DB1, mark it as a data storage node, and attach attribute information, such as the data table user_data storing sensitive data.

[0083] Node type 2 is application program / intermediate processing: create node App1, mark it as an application node, and attach attribute information, such as the ability of the application to process data and whether to perform encryption and decryption operations.

[0084] Node type 3 is an external exposure point: create node ExternalAPI, mark it as an external exposure point, and attach attribute information, including data transmission method (such as whether to encrypt transmission), transmission protocol (such as HTTP / HTTPS), etc.

[0085] 2.2, Create Edges of the graph:

[0086] In this embodiment, the edge type is data flow path. In this scenario, an edge is created from node DB1 to App1, indicating that App1 reads sensitive data from DB1 through SQL statement. The attribute information attached to this edge includes: the table user_data described in the SQL query log, and the access mode (e.g. read-only or modification); then another edge is created from node App1 to External API, indicating that App1 transmits data to external API. The attribute information that can be attached to this edge includes: the transmission protocol (e.g. HTTPS, if it is HTTP, it is insecure transmission), whether the data is encrypted / decrypted, etc.

[0087] 2.3, Path construction and analysis:

[0088] In this embodiment, Depth-First-Search (DFS) or Breadth First Search (BFS) algorithm is used to construct possible paths from DB1 node to external exposure point External API. On the path, data goes through DB1 (storage node) -> App1 (processing node) -> External API (exposure node) in turn. The data used in the data flow process is: in DB1, the SQL query log is obtained, indicating that App1 reads sensitive data user_data. In App1, system topology information is obtained, indicating that App1 interacts with External API through API. Combined with data transformation information, it is determined whether the data is encrypted. On the edge from App1 to External API, combined with transmission protocol information, it is confirmed whether the data is encrypted transmission (e.g. HTTPS), to judge the security of the path.

[0089] 3, Key point analysis:

[0090] The key points of this embodiment include: data transformation check and transmission protocol check; data transformation check refers to checking whether the node App1 encrypts or converts the data. If App1 performs unauthorized decryption operation on sensitive data, or does not re-encrypt the data during transmission, it will be a potential exposure risk point. Transmission protocol check refers to checking the transmission protocol between App1 and External API. If the transmission is not encrypted (e.g. using HTTP instead of HTTPS), the risk of data exposure outside is greatly increased.

[0091] 4, Results and risk assessment:

[0092] The threat path output through the above steps is: DB1 (stores sensitive data) -> App1 (processes data, unencrypted processing) -> External API (unencrypted transmission).

[0093] And through the above key point analysis, it can be known that App1 does not perform encryption processing on the data, and the transmission path with the External API uses HTTP instead of HTTPS, and the data is at risk of leakage. Therefore, the system will mark this path as a high-risk threat path and suggest that encryption processing be performed in App1 or that HTTPS protocol be used for transmission. It should be noted that in the data flow threat exposure management, the risk level of the link can also be determined by using the sensitive level of the sensitive data.

[0094] In summary, the present application can monitor the access behavior of sensitive data in real time, quickly locate abnormal operations, automatically discover the complete link of sensitive data from storage to external exposure points, and identify the intermediate data transformation process and transmission security problems. Through the path analysis result, potential exposure points can be discovered in time and early warning can be provided, which helps the security team to identify potential threats and provides optimization suggestions for enterprise security policies to prevent sensitive data leakage. Moreover, unlike the traditional server or application-centric asset management, the present system refines the granularity to the data field level, realizes more accurate sensitive data management, and can realize the visualization of the full-stack link of the database field from the internal to the external network, providing unprecedented end-to-end visibility.

[0095] Based on the above embodiment, in the present embodiment, before the database access log corresponding to the sensitive data is acquired in real time, it further includes: identifying the sensitive data in the database according to a predetermined period; determining the sensitive level of each kind of sensitive data; and generating a sensitive data identification report according to the sensitive data and the sensitive level corresponding to each kind of sensitive data.

[0096] Specifically, the present application identifies sensitive data by scanning the database, and the scanning depth is table level, column level and data sampling level. The table level scanning refers to checking each table in the database and identifying its metadata, such as table name, field number, etc. The column level scanning refers to further refining to specific fields / columns and checking field name, data type, etc. The data sampling level refers to extracting part of the data from the column for further analysis, which is used for identifying and classifying sensitive data. The scanning frequency can be daily incremental scanning or weekly full scanning. The daily incremental scanning refers to only scanning and identifying the newly added or updated data, which is suitable for environments with frequent data changes. The weekly full scanning refers to a complete scan of the entire database, which is suitable for periodic comprehensive checking.

[0097] In identifying sensitive data, the present application can identify through regular expressions and machine learning models, which can be used alone or in combination in the process of identifying sensitive data. Simple sensitive data types (such as ID numbers, credit card numbers, etc.) can be quickly matched through regular expressions, while more complex or variable data patterns (such as personal information in natural language) are suitable for identification using machine learning models. For example: if a set of credit card numbers is to be identified, a regular expression can be used to match data of a specific pattern, which can quickly locate credit card numbers that meet the format; a trained machine learning model is used to analyze the data in the column, such as a column containing "John Doe, 123 Main St, City, SSN: 123-45-6789", and a text-based classification model based on the context understands that it contains names, addresses, and Social Security numbers (SSN).

[0098] \b\d{4}[-]?\d{4}[-]?\d{4}[-]?\d{4}\b to match data of a specific pattern, which can quickly locate credit card numbers that meet the format; a trained machine learning model is used to analyze the data in the column, such as a column containing "John Doe, 123 Main St, City, SSN: 123-45-6789", and a text-based classification model based on the context understands that it contains names, addresses, and Social Security numbers (SSN).

[0099] In this embodiment, sensitive data can also be identified through sensitive data patterns. Sensitive data patterns refer to specific methods for identifying sensitive data based on data type, format, and context. For example: personal identifying information (PII): pattern examples: ID numbers, passport numbers, email addresses, mobile phone numbers, etc. Identification method: regular expressions can be used to match specific formats (such as mobile phone numbers

[0100] \b\d{3}-\d{3}-\d{4}\b). Machine learning models can identify names, addresses, etc. in a piece of text through context.

[0101] Financial data: pattern examples: bank account numbers, credit card numbers, transaction amounts, etc. Identification method: regular expressions identify common formats such as credit card numbers. For transaction information, a model can determine whether certain numerical or text fragments are financial data.

[0102] Medical information: pattern examples: medical record numbers, medical diagnosis information, medical payment records, etc. Identification method: learn to identify medical terms such as "diagnosed as…" or "surgery date…" through a model, and associate the context of the medical record.

[0103] After identifying sensitive data in the database, the present application also needs to classify the sensitive data according to its type and importance, determine the sensitive level of the sensitive data, and ensure that sensitive data of different levels can take appropriate security measures according to its sensitive level. The data type can be divided into: personal identity information, financial data, medical information, geographic location information, etc. The present embodiment can classify data based on predefined rules and machine learning models. These rules can be regular expressions, logical rules (such as the combination of specific field types), and classification models (such as supervised learning algorithms) according to data features.

[0104] In the present embodiment, the sensitive level is set as follows:

[0105] High sensitive level: such as personal identity information, financial data, medical information, etc., highly sensitive and may cause serious consequences after leakage.

[0106] Medium sensitive level: such as company's internal financial records, contract terms, etc., which have a greater impact but do not directly threaten personal safety.

[0107] Low sensitive level: such as public company information, general data, etc., with limited impact.

[0108] Here, the identification process of sensitive data, the classification process of sensitive data, and the report generation process are specifically described through a specific embodiment:

[0109] 1. Data collection and preprocessing:

[0110] Collect data from each column of the database table, which may contain personal information such as name, address, ID number, etc. The data format can be structured (such as relational database) or semi-structured (such as JSON data). Perform preprocessing steps on the collected data, including: clean data, remove noise (such as null values, invalid characters), standardize date, amount, etc. Format to ensure that the data can be used for model training or regular expression matching.

[0111] 2. Preliminary sensitive data identification based on rules:

[0112] In the present embodiment, a series of regular expressions can be used to quickly detect common sensitive information. For example:

[0113] ID number matching: \b\d{15}|\d{18}\b (used to match the format of Chinese ID number).

[0114] Email matching:

[0115] \b[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,}\b.

[0116] Mobile number match: \b\d{3}-\d{4}-\d{4}\b or similar formats.

[0117] The above rules can be used to preliminarily screen potential sensitive data in the table, especially formatted data columns (such as ID number, phone number, email, etc.).

[0118] 3. Machine learning model identification:

[0119] For complex data that cannot be identified by simple rules, such as sensitive information in free text (for example, a database column contains free description of personal information), a supervised learning model is used for further classification. In this embodiment, a classification model based on natural language processing (NLP) can be used, such as a model based on BERT (Bidirectional Encoder Representations from Transformers) or LSTM (Long Short-Term Memory) to identify sensitive information in context.

[0120] The model needs to use a labeled data set for model training, which contains a large amount of free text and has been labeled with personal identity information such as name, address, ID number, etc. For example:

[0121] Input: "John Doe lives at 123Main St,City,with IDnumber123456789012345678"

[0122] Label: {"name":"John Doe","address":"123Main St,City","ID":"123456789012345678"}

[0123] After the training data set is determined, the model can learn the patterns of names, addresses, ID numbers, etc. by learning from the training data, and learn to make classification decisions based on context in new data. Apply the trained model to the scanned database data, the input is the free text data in the table, and the output is the classification result. For example, identify the personal name, address, ID number in the text segment and mark it as personal identity information.

[0124] 4. Sensitivity classification:

[0125] After the sensitive data is identified, the identified personal identity information is classified according to the sensitivity degree of the data, such as: high sensitivity: such as ID number, passport number, social security number, etc., which directly endangers personal privacy and property safety after leakage. Medium sensitivity: such as email, phone number, etc., which may be used for privacy attacks or marketing. Low sensitivity: such as general non-sensitive text data.

[0126] In the classification of sensitive data, the sensitivity level of each column of data can be determined in combination with the output of the model and the classification rules. For example, ID number and address are classified as "high sensitivity", and email address may be classified as "medium sensitivity".

[0127] 5. Output and report generation:

[0128] After the above process, a detailed report is generated, which specifically includes sensitive data name, sensitive data type, sensitive level and example data; For example: the column name is user_id, email, address, the data type is PII, the sensitive level is high, and the example data is some examples of sensitive data for review. And, according to the sensitive level of the sensitive data, the report can also generate related strategies, for example: high sensitive data needs to be encrypted and stored.

[0129] For example: the input data is:

[0130] Plain Text

[0131] "Name:John Doe,Address:123Main St,ID:123456789012345678,Email:john.doe@example.com"

[0132] The output data is:

[0133] JSON

[0134] {

[0135] "name":"John Doe",

[0136] "address":"123Main St",

[0137] "ID":"123456789012345678",

[0138] "email":"john.doe@example.com",

[0139] "sensitivity_level":{

[0140] "name":"medium",

[0141] "address":"high",

[0142] "ID":"high",

[0143] "email":"medium"

[0144] }

[0145] }

[0146] In summary, the present application can more accurately identify different structures of data by combining rules and machine learning, improving the recognition ability of complex free text data, especially the privacy information in unstructured data. The sensitive data report after classification can help enterprises implement appropriate security measures at different sensitivity levels to ensure data compliance (such as meeting the requirements of GDPR (General Data Protection Regulation), CCPA (California Consumer Privacy Act), and other regulations). With the introduction of machine learning models, the system can optimize itself as the training data increases, continuously improving its ability to recognize new data formats.

[0147] Referring to Figure 2 , Figure 2 Another threat detection method flowchart for sensitive data provided by an embodiment of the present application, which specifically includes the following steps:

[0148] S201, identifying sensitive data in the database according to a predetermined period;

[0149] S202, determining the sensitivity level of each sensitive data;

[0150] S203, acquiring the database access log corresponding to the sensitive data in real time;

[0151] S204, detecting whether there is an access behavior using the database access log; the access behavior is an access behavior performed on the sensitive data;

[0152] If yes, perform S205; if no, continue to perform S204;

[0153] S205, creating a first graph model of the sensitive data; the first graph model includes the transmission path and attribute information of the sensitive data between nodes;

[0154] S206, detecting the threat path of the sensitive data according to the first graph model.

[0155] S207, detecting an application service running in the network; wherein the application service includes a sensitive application service determined by the sensitive data;

[0156] S208, determining a service dependency relationship between different application services;

[0157] S209, constructing a second graph model according to the application service and the service dependency relationship; the node in the second graph model is the application service, and the edge between the nodes represents the service dependency relationship;

[0158] S210, detecting a threat path of the sensitive application service according to the second graph model.

[0159] It should be noted that, after the sensitive data and the sensitive level are determined by S201-S202, the sensitive data can be managed in the data flow layer by S203-S206, and the sensitive data can also be managed in the application layer by S207-S210. Here, the process of managing the sensitive data in the application layer is described.

[0160] Specifically, the application can analyze and identify the distribution of various application services in the enterprise and their dependency relationship by analyzing the sensitive data in the application layer, and expose and manage possible threats. After the sensitive data is determined, the sensitive application service can be determined according to the sensitive data. The sensitive application service is a service that processes, stores or transmits sensitive data, and these data usually have requirements for confidentiality, integrity and availability. Therefore, the sensitive data is an important content of the sensitive application service, and protecting the sensitive data is also the key to ensuring the security of the sensitive application service. The sensitivity of the application service is usually directly related to the type of data processed and the sensitivity of the data. For example: in the online banking system of a financial institution, the customer data processed includes account information, transaction records, identity authentication information (such as ID number, password), etc. Therefore, the customer's account information, transaction records, identity authentication information belong to high-sensitivity data, and if the data is leaked, it may cause financial loss and privacy risk. The services that process these data, such as user identity verification service, transaction processing service, etc., are sensitive application services. Because the security of these services directly affects the security of customer data. Therefore, by protecting the security of the sensitive application service, the security of the sensitive data can also be protected.

[0161] In the embodiment, the application service running in the network can be detected by using the scanning parameter and network traffic, and the sensitive application service in the application service is determined by using the sensitive data. The application service is detected by using the scanning parameter, which is an active scanning technology, and the application service is detected by using the network traffic, which is a passive flow monitoring technology. The active scanning technology and the passive flow monitoring technology can be used to find the application service running in the network. The active scanning technology can be executed by using a tool such as Nmap. In the active scanning stage, the classical port scanning technology is used to perform the port scanning on the host in the enterprise intranet according to the provided parameter (such as the IP address range and the port number range), and the host and the port on which the service can be run are identified, for example, the HTTP service uses the 80 or 443 port, the RPC uses the specific port, and the like. The passive flow monitoring technology is used to monitor the traffic in the network, identify the traffic characteristics of the common application service, and identify the hidden service or the service that cannot be found by using the active scanning. It should be noted that the application service identified by the application includes the sensitive application service, and the sensitive application service needs to be analyzed in the threat analysis.

[0162] Further, the application needs to use the deep packet inspection (DPI) and the log analysis technology to extract the calling relationship between the application services, and construct the dependency relationship between the services. The communication mode between the services is analyzed by using the deep packet inspection by monitoring the network traffic, and the accuracy of the identification of the calling relationship between the services is determined by the DPI analysis. For example, the interaction mode between the services is understood by using the communication protocol (HTTP, RPC, custom protocol, and the like) and the communication frequency (such as the number of requests per minute) between the different services, so as to determine which service depends on the other service. The API calling, the access log, and the like can be parsed from the log of the application service, and the calling chain information between the services is extracted.

[0163] Through the above analysis process, the analysis result of the application service and the service dependency relationship can be stored into the graph database. In the graph database, the application service is taken as a node, and the dependency relationship between the services is taken as an edge to construct a second graph model. Threat analysis is performed through a graph algorithm. Specifically, the node types in the second graph model include: application services and servers associated with the running application services; wherein each application service is taken as a node, and the node attributes are: service name, IP address, port number, protocol type, etc.; the server can be a physical or virtual server node. The edge types between the nodes include calling relationship and communication link. The calling relationship refers to the dependency relationship between the application services, and the calling frequency between the services is used to determine the closeness of the dependency. The calling relationship is connected through the calling protocol (HTTP, RPC, etc.). The communication link refers to the connection between the physical servers, reflecting the actual network communication.

[0164] For example, the network scanning parameters are set as: IP range: 192.168.0.0 / 16; port range: 1-65535. The application services in the network can be detected through the scanning parameters. Further, real-time traffic data packets in the network are detected through network traffic analysis, the service dependency relationship is determined according to the calling between the applications, and the calling log of the application services is analyzed to determine the service dependency relationship. Finally, a graph model is created. The graph model is a graph containing all application services and their dependency relationships. The nodes in the graph model are:

[0165] Application A: IP = 192.168.1.1, port = 8080, protocol = HTTP

[0166] Application B: IP = 192.168.1.2, port = 9090, protocol = RPC

[0167] The edges in the graph model are:

[0168] Application A calls application B, protocol = HTTP, calling frequency = 100 times / minute.

[0169] If it is known through analyzing the graph model that application B is a sensitive application service, and application A is an untrusted external service, it can be determined that the path of application A calling application B is a threat path, through which the sensitive application service can be easily exposed to the untrusted external service, forming a potential attack path.

[0170] Through the above process, it can be known that through the method, the application services in the enterprise network and their mutual dependency relationship can be comprehensively discovered, and a complete graph database model can be constructed. Subsequently, through a graph algorithm, the risk of sensitive asset exposure can be quickly identified, the potential attack path can be found out, and a clear threat exposure management scheme can be provided. This process can help the enterprise to identify and repair the existing security risks in priority, and effectively improve the network security situation awareness capability.

[0171] Referring to Figure 3 , Figure 3 Another threat detection method flowchart of sensitive data provided by the embodiment of the application, the method specifically includes the following steps:

[0172] S301, identifying sensitive data in the database according to a predetermined period;

[0173] S302, determining the sensitive level of each sensitive data;

[0174] S303, acquiring a database access log corresponding to the sensitive data in real time;

[0175] S304, detecting whether there is an access behavior using the database access log; the access behavior is an access behavior performed on the sensitive data;

[0176] If yes, S305 is executed; if no, S304 is continuously executed;

[0177] S305, creating a first graph model of the sensitive data; the first graph model includes a transmission path and attribute information of the sensitive data between nodes;

[0178] S306, detecting a threat path of the sensitive data according to the first graph model.

[0179] S307, detecting an application service running in the network; wherein the application service includes a sensitive application service determined by the sensitive data;

[0180] S308, determining a service dependency relationship between different application services;

[0181] S309, constructing a second graph model according to the application service and the service dependency relationship; the node in the second graph model is the application service, and the edge between the nodes represents the service dependency relationship;

[0182] S310, detecting a threat path of the sensitive application service according to the second graph model.

[0183] S311, detecting a device in the network; the device includes a sensitive asset device determined by the sensitive data;

[0184] S312, determining a link connection condition between different devices;

[0185] S313, constructing a third graph model according to the device and the link connection condition; the node in the third graph model is the device, and the edge between the nodes represents the link connection condition;

[0186] S314, detecting a threat path of the sensitive asset device according to the third graph model.

[0187] It should be noted that after the sensitive data and the sensitive level are determined through S301-S302, the sensitive data can be managed through S303-S306 for threat exposure management at the data flow layer, through S307-S310 for threat exposure management at the application layer, and also through S311-S314 for threat exposure management at the network layer. The network layer threat exposure management models and analyzes the link exposure of the sensitive asset device in the network through a graph database. By taking advantage of the graph database, the nodes and links in the network can be quickly queried and traversed to identify potential threat exposure points. In this way, by constructing a graph model of network devices and links, the connection of the sensitive asset device with other network devices can be tracked, and the actual protection effect of security devices such as firewalls and isolated networks can be evaluated.

[0188] Specifically, the present application first detects the devices in the network, including servers, firewalls, routers, switches, and the like. The devices include sensitive asset devices determined by sensitive data, and the sensitive asset devices are devices storing sensitive data, such as database servers, personal privacy data storage nodes, and the like. Therefore, by protecting the security of the sensitive asset devices, the security of the sensitive data can also be protected. After determining the devices in the network, the link connection conditions between different devices also need to be determined. Then, a third graph model is constructed through the devices and the link connections. In the third graph model, the nodes represent the devices in the network, and the edges represent the link connection conditions between the devices. If there is an edge between the nodes, it means that there is a link connection between the two devices, otherwise, it means that there is no link connection between the two devices. The node attributes include: device type (server, firewall), network to which it belongs (DMZ (demilitarized zone), intranet), security level (high, medium, low), running service (HTTP, SSH (Secure Shell, remote connection tool)), and whether it is a sensitive asset (yes / no). The edge attributes include: communication protocol (TCP (Transmission Control Protocol) / UDP (User Datagram Protocol)), port number, firewall policy, isolated network configuration, bandwidth, delay, connection stability, and the like. Among them, the present application marks the sensitive asset devices in the graph model, and can focus on analyzing the exposure of the sensitive asset devices when detecting threats. The firewall policy is used to determine whether the link is protected by the firewall, such as whether the port access is allowed, the source IP is limited, and the like. The policy affects the risk score of the path. The isolated network configuration is used to describe whether some links are protected by an isolated network (such as VLAN (Virtual Local Area Network), DMZ (demilitarized zone), and the like). The existence of the isolated network will reduce the risk score of some paths.

[0189] When detecting a threat path of a sensitive asset device through the third graph model, the third graph model can be traversed, a risk score of each path can be calculated according to a risk factor in each path, and a threat path can be determined according to the risk score of each path. In this embodiment, all possible communication paths can be searched from an external node (such as a public network or a non-trusted area) to a sensitive asset node based on a graph traversal algorithm (such as BFS or DFS). The risk factor is a factor that affects the risk score, and the risk factor can be whether to pass through a firewall, a link bandwidth, whether to isolate a network, and the like. Finally, the overall risk score of the path can be calculated based on the risk factor on each path, for example, a risk score can be calculated according to a property of each link, a sensitive level of the sensitive asset device, whether to pass through a firewall, link security, device security, connection complexity, and the like. The higher the score is, the greater the threat of the path is. In this embodiment, the exposure degree of each path can be determined based on Dijkstra algorithm or the like to evaluate the risk score. The scheme can also automatically generate a risk assessment report according to the analysis result, and propose a repair suggestion for a high-risk threat path.

[0190] For example, the input network topology data includes: description of connection conditions of network devices and links, and positions of protection devices such as firewalls and isolated networks.

[0191] Plain Text

[0192] Node 1: Server A (sensitive asset, intranet, service: HTTP)

[0193] Node 2: Firewall B (isolated device)

[0194] Node 3: Internet gateway C

[0195] Edge 1: Server A -> Firewall B, protocol: TCP, port: 80

[0196] Edge 2: Firewall B -> Internet gateway C, protocol: TCP, port: 80

[0197] The output data includes a risk assessment report, and the risk report lists all threat paths with potential threats, exposure risk scores, and processing suggestions.

[0198] Plain Text

[0199] Path 1: Internet gateway C -> Firewall B -> Server A

[0200] Exposure risk score: 75 (high)

[0201] Suggestion: Increase firewall rules to limit external access to port 80.

[0202] The application can automatically identify potential threat paths of sensitive assets by quickly constructing a graph model of network devices and links. The application provides efficient exposure risk assessment, and helps the security team to locate high-risk network links through a scoring mechanism. The application can generate processing recommendations according to the analysis results, optimize firewall policies or adjust isolated network structures to reduce the exposure of sensitive assets. In addition, the application can continuously monitor network changes through periodic evaluation and respond to new threats in a timely manner.

[0203] Referring to Figure 4 , Figure 4 A structure diagram of a sensitive data threat detection device provided by an embodiment of the application is shown in the figure. The device specifically includes:

[0204] The acquisition module 11 is configured to acquire database access logs corresponding to sensitive data in real time.

[0205] The first detection module 12 is configured to detect whether there is an access behavior by using the database access logs. The access behavior is an access behavior performed on the sensitive data. If so, the first creation module is triggered.

[0206] The first creation module 13 is configured to create a first graph model of the sensitive data. The first graph model includes transmission paths and attribute information of the sensitive data between nodes.

[0207] The second detection module 14 is configured to detect a threat path of the sensitive data according to the first graph model.

[0208] As an optional embodiment, the threat detection device further includes:

[0209] The identification module is configured to identify sensitive data in the database according to a predetermined period.

[0210] The first determination module is configured to determine a sensitive level of each kind of sensitive data.

[0211] The generation module is configured to generate a sensitive data identification report according to the sensitive data and the sensitive level corresponding to each kind of sensitive data.

[0212] As an optional embodiment, the threat detection device further includes:

[0213] The third detection module is configured to detect application services running in the network. The application services include sensitive application services determined by the sensitive data.

[0214] The second determination module is configured to determine a service dependency relationship between different application services.

[0215] a second creating module, configured to construct a second graph model according to the application services and the service dependency relationships; nodes in the second graph model are the application services, and edges between the nodes represent the service dependency relationships;

[0216] a fourth detecting module, configured to detect a threat path of the sensitive application service according to the second graph model.

[0217] As an optional embodiment, the third detecting module comprises:

[0218] a detecting unit, configured to detect the application services running in the network by using the scanning parameters and the network traffic;

[0219] a determining unit, configured to determine the sensitive application services in the application services by using the sensitive data.

[0220] As an optional embodiment, the threat detection apparatus further comprises:

[0221] a fifth detecting module, configured to detect devices in the network; the devices comprise sensitive asset devices determined by using the sensitive data;

[0222] a third determining module, configured to determine link connection conditions between different devices;

[0223] a third creating module, configured to construct a third graph model according to the devices and the link connection conditions; nodes in the third graph model are the devices, and edges between the nodes represent the link connection conditions;

[0224] a sixth detecting module, configured to detect a threat path of the sensitive asset devices according to the third graph model.

[0225] As an optional embodiment, the sixth detecting module is specifically configured to: traverse each path in the third graph model, calculate a risk score of each path according to risk factors in each path, and determine the threat path according to the risk score of each path.

[0226] As an optional embodiment, the second detecting module is specifically configured to: determine attribute information of the first graph model; wherein the attribute information comprises at least one of sensitive level information corresponding to the sensitive data, data transformation information, and system topology information; and detect the threat path in the first graph model according to the attribute information.

[0227] As to the apparatuses in the above embodiments, the specific manners in which various modules perform operations have been described in detail in the embodiments of the method, and will not be described here in detail.

[0228] See Figure 5 , Figure 5This application provides a schematic diagram of an electronic device structure, which specifically includes:

[0229] The processor 21, the memory 22, and the computer program stored on the memory 22 and executable on the processor 21, wherein the processor 21 executes the steps of the threat detection method for sensitive data described in any of the above method embodiments through the computer program.

[0230] The processor 21 may include one or more processing cores, such as a quad-core processor or an octa-core processor. The processor 21 may be implemented using at least one hardware form selected from DSP (Digital Signal Processing), FPGA (Field-Programmable Gate Array), and PLA (Programmable Logic Array). The processor 21 may also include a main processor and a coprocessor. The main processor, also known as a CPU (Central Processing Unit), is used to process data in the wake-up state; the coprocessor is a low-power processor used to process data in the standby state. In some embodiments, the processor 21 may integrate a GPU (Graphics Processing Unit), which is responsible for rendering and drawing the content to be displayed on the screen. In some embodiments, the processor 21 may also include an AI (Artificial Intelligence) processor, which is used to handle computational operations related to machine learning.

[0231] The memory 22 may include one or more computer-readable storage media, which may be non-transitory. The memory 22 may also include high-speed random access memory and non-volatile memory, such as one or more disk storage devices or flash memory devices. In this embodiment, the memory 22 is used to store at least the following computer program 221, which, after being loaded and executed by the processor 21, is capable of implementing the relevant steps in the sensitive data threat detection method disclosed in any of the foregoing embodiments. In addition, the resources stored in the memory 22 may also include an operating system 222 and data 223, etc., and the storage method may be temporary storage or permanent storage. The operating system 222 may include Windows, Unix, Linux, etc.

[0232] In some embodiments, the electronic device may further include a display screen 23, an input / output interface 24, a communication interface 25, a sensor 26, a power supply 27, and a communication bus 28.

[0233] Of course, Figure 5 The structure of the electronic device shown does not constitute a limitation on the electronic device in the embodiments of the present application, and in actual applications, the electronic device can include more or fewer components than those shown, or combine certain components. Figure 5 The structure of the electronic device shown does not constitute a limitation on the electronic device in the embodiments of the present application, and in actual applications, the electronic device can include more or fewer components than those shown, or combine certain components.

[0234] In another exemplary embodiment, a computer storage medium is also provided, and the program instructions are executed by a processor to implement the steps of the sensitive data threat detection method described in any of the method embodiments. The storage medium can include a U disk, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, and various media that can store program codes.

[0235] Optionally, specific examples in the embodiments can refer to the examples described in the above embodiments, and the embodiments will not be described here again.

[0236] It should be understood that the terms used herein are for the purpose of describing particular example implementations and are not intended to be limiting. As used herein, the singular forms "a", "an" and "the" are intended to include the plural forms as well, unless the context clearly indicates otherwise. The terms "comprises", "comprising", "includes", "including" and the like are to be construed in an inclusive sense, as opposed to an exclusive or exhaustive sense, and therefore specify the presence of stated features, steps or elements, but do not preclude the presence or addition of one or more other features, steps, elements, or combinations thereof. The method steps, processes, and operations described herein are not to be construed as necessarily requiring their performance in the particular order in which they are described, unless specifically identified as an order dependent step. It is also to be understood that additional or alternative steps can be employed.

[0237] The above description is merely that of specific embodiments of the present application, to enable a person skilled in the art to understand or implement the present application. Various modifications to these embodiments will be apparent to those skilled in the art, and the general principles defined herein can be implemented in other embodiments without departing from the spirit or scope of the present application. Therefore, the present application will not be limited to these embodiments shown herein, but is intended to conform to the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A method for detecting threats to sensitive data, characterized in that, The method comprises the following steps: acquiring, in real time, database access logs corresponding to sensitive data, wherein the database access logs comprise monitoring information at the SQL statement level; detecting, according to a preset aggregation period, whether there is an access behavior by using the database access logs; the access behavior is an access behavior performed on the sensitive data; if yes, creating a first graph model of the sensitive data according to the database access logs, system topology information and data transformation information; wherein the system topology information comprises the association relationship and data flow relationship among an application program, a server and a database, and the data transformation information comprises the rules and logs of encryption, decryption and conversion operations; the first graph model comprises the transmission path and attribute information of the sensitive data among nodes; analyzing the path in the first graph model by using a graph traversal algorithm, and detecting a threat path of the sensitive data based on the attribute information; wherein the attribute information comprises at least one of sensitive level information, data transformation information and system topology information corresponding to the sensitive data.

2. The threat detection method of claim 1, wherein, Before the step of acquiring, in real time, the database access logs corresponding to the sensitive data, the method further comprises the following steps: identifying sensitive data in a database according to a predetermined period; determining the sensitive level of each kind of sensitive data; generating a sensitive data identification report according to the sensitive data and the sensitive level corresponding to each kind of sensitive data.

3. The threat detection method of claim 2, wherein, The threat detection method further comprises the following steps: detecting application services running in a network; wherein the application services comprise sensitive application services determined by the sensitive data; determining the service dependency relationship among different application services; constructing a second graph model according to the application services and the service dependency relationship; the nodes in the second graph model are application services, and the edges among the nodes represent the service dependency relationship; detecting a threat path of the sensitive application services according to the second graph model.

4. The threat detection method of claim 3, wherein, The step of detecting the application services running in the network comprises the following steps: detecting the application services running in the network by using scanning parameters and network traffic; determining the sensitive application services in the application services by using the sensitive data.

5. The threat detection method of claim 2, wherein, The threat detection method further comprises the following steps: detecting devices in the network; the devices comprise sensitive asset devices determined by the sensitive data; determining the link connection situation among different devices; constructing a third graph model according to the devices and the link connection situation; the nodes in the third graph model are devices, and the edges among the nodes represent the link connection situation; detecting a threat path of the sensitive asset devices according to the third graph model.

6. The threat detection method of claim 5, wherein, The step of detecting a threat path of the sensitive asset devices according to the third graph model comprises the following steps: traversing each path in the third graph model, and calculating the risk score of each path according to the risk factors in each path; determining a threat path according to the risk score of each path.

7. A threat detection apparatus for sensitive data, characterized by, The method comprises the following steps: an acquisition module, configured to acquire, in real time, database access logs corresponding to sensitive data, wherein the database access logs comprise monitoring information at the SQL statement level; The first detection module is configured to detect, according to a preset aggregation period, whether there is an access behavior by using the database access log; the access behavior is an access behavior performed on the sensitive data; if yes, the first creation module is triggered; The first creation module is configured to create a first graph model of the sensitive data according to the database access log, system topology information and data transformation information; the system topology information includes an association relationship and a data flow relationship among an application program, a server and a database, and the data transformation information includes rules and logs of encryption, decryption and conversion operations; the first graph model includes transmission paths and attribute information of the sensitive data among nodes. The second detection module is configured to analyze paths in the first graph model by using a graph traversal algorithm and detect a threat path of the sensitive data based on the attribute information according to the first graph model; the attribute information includes at least one of sensitive level information, data transformation information and system topology information corresponding to the sensitive data.

8. An electronic device, comprising: The processor, the memory and the computer program stored on the memory and executable on the processor are provided, and the processor executes the steps of the sensitive data threat detection method in any one of claims 1 to 6 of the application by the computer program. The computer storage medium stores computer executable instructions for executing the steps of the sensitive data threat detection method in any one of claims 1 to 6 of the application.

9. A computer storage medium, characterized in that ​

Images