Unstructured data tracing method and device and electronic equipment

Abstract

The invention provides an unstructured data tracing method and apparatus, and an electronic device. The method comprises the steps of creating matching information; acquiring network traffic; performing reduction processing on the unstructured data to obtain a to-be-matched file; searching mark data from the to-be-matched file, if the to-be-matched file comprises the mark data, adding a data element label for the mark data, and setting the to-be-matched file as a mark file; storing first traceability information of the marked file; and executing search according to the first traceability field to obtain traceability mark data or a traceability label, and obtaining a first traceability file. The method comprises the following steps: marking corresponding traceability data in unstructured data according to matching information; setting a file including the traceability data in the unstructured data as a tag file and storing the tag file; search is executed through the traceability field in the traceability stage to obtain the tag file including the traceability data, and the efficiency, the real-time performance and the comprehensiveness of unstructured data traceability are improved.

Description

Technical Field

[0001] Embodiments of the present application relate to the field of network security technology, and in particular, to a method, device, and electronic device for tracing the source of unstructured data. Background Art

[0002] Network data is confidential, and tracing the source of unstructured data is a key means to prevent data leakage, which can improve the integrity and credibility of data. Unstructured data includes text, images, sound and video, which are characterized by diverse formats, complex content and huge data volume. Data tracing technology provides a complete chain of data by tracing the source, processing process and transformation history of data, thereby reducing the probability of data leakage.

[0003] Unstructured data traceability methods include label-based data traceability and computational process-based data traceability. Label-based data traceability records the source and transformation process of data by adding labels during data generation or processing. Computational process-based data traceability records the transformation of data in the computational process, including input data, computational tools, parameter settings, and output results, to build a complete data traceability chain.

[0004] However, both the label-based and computational process-based data traceability methods have certain defects. Due to the complexity and diversity of unstructured data, the data traceability process needs to be carried out after the data is generated or processed, and the traceability means of the above methods are only to search through labels or processes, which reduces the real-time and comprehensiveness of data traceability. Summary of the invention

[0005] The present application provides an unstructured data tracing method, device and electronic device to improve the real-time and comprehensiveness of unstructured data tracing.

[0006] In a first aspect, the present application provides a method for tracing the provenance of unstructured data, comprising:

[0007] Creating matching information, wherein the matching information includes a data element tag and a data matching rule;

[0008] Acquiring network traffic, wherein the network traffic includes unstructured data;

[0009] Performing restoration processing on the unstructured data to obtain a file to be matched;

[0010] Searching for the marked data from the to-be-matched file according to the data matching rule, and if the to-be-matched file includes the marked data, adding the data element tag corresponding to the data matching rule to the marked data, and setting the to-be-matched file as a marked file;

[0011] storing first traceability information of the marked file, wherein the first traceability information includes at least one of the marked data, the data element label, basic file information, and file flow information;

[0012] Input a first traceability field, perform a search based on the first traceability field to obtain traceability marking data or a traceability label, wherein the traceability marking data is the marking data identical to the first traceability field, and the traceability label is the data element label identical to the first traceability field, and obtain a first traceability file, wherein the first traceability file is a file including the traceability marking data or the traceability label in the first traceability information.

[0013] The method first creates matching information for marking traceability data, and marks the corresponding traceability data in the unstructured data according to the matching information; and sets the file including the traceability data in the unstructured data as a marked file and stores it; in the traceability stage, a search is performed through the traceability field to obtain a marked file including the traceability data, thereby improving the efficiency, real-time and comprehensiveness of the traceability of the unstructured data.

[0014] In an implementation manner of the first aspect, the creating matching information includes:

[0015] Obtain the data to be traced;

[0016] Determine the classification name of the data to be traced, and store the classification name as the data element label;

[0017] Setting the data matching rule according to the content of the data to be traced;

[0018] The data element labels of the same data to be traced are bound to the data matching rules to obtain the matching information.

[0019] In an implementation manner of the first aspect, setting the data matching rule according to the content of the data to be traced includes:

[0020] Obtain the data type of the data to be traced, the data type includes text type, number type and composite type;

[0021] Setting keywords representing the content of the data to be traced for the text type data to be traced, so as to obtain the data matching rule;

[0022] Setting a regular expression representing the content of the digital type data to be traced to obtain the data matching rule;

[0023] A combination of a keyword and a regular expression representing the content of the data to be traced is set for the composite type of the data to be traced, so as to obtain the data matching rule.

[0024] In an implementation manner of the first aspect, performing restoration processing on the unstructured data to obtain the to-be-matched file includes:

[0025] Acquire the file type of the unstructured data, where the file type includes a text type, a table type, and an image type;

[0026] Determine a file processing tool according to the file type, wherein a text processing tool is selected to process the unstructured data of the text type, a table processing tool is selected to process the unstructured data of the table type, and an image processing tool is selected to process the unstructured data of the image type;

[0027] The file processing tool is used to read the unstructured data to obtain the file to be matched.

[0028] In an implementation manner of the first aspect, the method further includes:

[0029] Searching the marked data from the to-be-matched file according to the data matching rule;

[0030] If the to-be-matched file does not include the marked data, storing the to-be-matched file as an unmarked file;

[0031] The second traceability information of the unmarked file is stored, where the second traceability information includes at least one of basic file information and file flow information.

[0032] In an implementation manner of the first aspect, the basic file information includes a file name, and the method further includes:

[0033] Input a second traceability field, perform a search according to the second traceability field to obtain a traceability name, where the traceability name is the file name of the to-be-matched file that is the same as the second traceability field;

[0034] A second tracing file is obtained, where the second tracing file is the file to be matched whose file name is the same as the second tracing field.

[0035] In an implementation manner of the first aspect, the basic file information includes a file hash value, and the method further includes:

[0036] Obtaining a hash value of the file to be matched;

[0037] The basic file information and file flow information of the to-be-matched files with the same hash value are stored as the same file portrait.

[0038] In an implementation manner of the first aspect, the method further includes:

[0039] Obtaining file flow information of the first traceability file or the second traceability file;

[0040] The flow path of the first traceability file or the second traceability file is obtained according to the file flow information.

[0041] In a second aspect, the present application also provides an unstructured data tracing device, comprising:

[0042] A matching information creation module is configured to: create matching information, wherein the matching information includes a data element label and a data matching rule;

[0043] The network traffic acquisition module is configured to: acquire network traffic, wherein the network traffic includes unstructured data;

[0044] A file restoration module is configured to: perform restoration processing on the unstructured data to obtain a file to be matched;

[0045] a marking file acquisition module, configured to: search for marking data from the to-be-matched file according to the data matching rule, and if the to-be-matched file includes the marking data, add the data element tag corresponding to the data matching rule to the marking data, and set the to-be-matched file as a marking file;

[0046] A first traceability information storage module is configured to: store first traceability information of the marked file, wherein the first traceability information includes at least one of the marked data, the data element label, basic file information, and file flow information;

[0047] The traceability module is configured to: input a first traceability field, perform a search based on the first traceability field to obtain traceability marking data or a traceability label, wherein the traceability marking data is the marking data identical to the first traceability field, and the traceability label is the data element label identical to the first traceability field, and obtain a first traceability file, wherein the first traceability file is a file including the traceability marking data or the traceability label in the first traceability information.

[0048] In a third aspect, the present application further provides an electronic device, including:

[0049] one or more processors;

[0050] a memory configured to store one or more programs;

[0051] Among them, when the one or more programs are executed by the one or more processors, the one or more processors implement the unstructured data tracing method described in any one of the first aspects above.

[0052] As can be seen from the above technical solutions, the present application provides a method, device and electronic device for tracing the provenance of unstructured data, the method comprising: creating matching information, the matching information comprising a data element tag and a data matching rule; obtaining network traffic, the network traffic comprising unstructured data; performing restoration processing on the unstructured data to obtain a file to be matched; searching for marker data from the file to be matched according to the data matching rule, if the file to be matched includes the marker data, adding the data element tag corresponding to the data matching rule to the marker data, and setting the file to be matched as a marker file; storing first tracing information of the marker file, the first tracing information comprising at least one of the marker data, the data element tag, basic file information and file flow information; inputting a first tracing field, performing a search according to the first tracing field to obtain tracing marker data or a tracing tag, the tracing marker data is the marker data identical to the first tracing field, the tracing tag is the data element tag identical to the first tracing field, and obtaining a first tracing file, the first tracing file being a file including the tracing marker data or the tracing tag in the first tracing information.

[0053] The method first creates matching information for marking traceability data, and marks the corresponding traceability data in the unstructured data according to the matching information; and sets the file including the traceability data in the unstructured data as a marked file and stores it; in the traceability stage, a search is performed through the traceability field to obtain a marked file including the traceability data, thereby improving the efficiency, real-time and comprehensiveness of the traceability of the unstructured data. BRIEF DESCRIPTION OF THE DRAWINGS

[0054] In order to more clearly illustrate the technical solution of the present application, the drawings required for use in the embodiments are briefly introduced below. Obviously, for ordinary technicians in this field, other drawings can be obtained based on these drawings without any creative work.

[0055] Figure 1 This is a schematic diagram of the unstructured data tracing method described in an embodiment of the present application;

[0056] Figure 2 A schematic diagram of a method for creating matching information according to an embodiment of the present application;

[0057] Figure 3 This is a schematic diagram of the network traffic acquisition process described in an embodiment of the present application;

[0058] Figure 4 A schematic diagram of a method for performing restoration processing on unstructured data according to an embodiment of the present application;

[0059] Figure 5 This is an overall flow chart of the unstructured data tracing method described in the embodiment of the present application;

[0060] Figure 6 This is a schematic diagram of the structure of the unstructured data tracing device described in an embodiment of the present application;

[0061] Figure 7 It is a schematic diagram of the structure of the electronic device described in the embodiment of the present application. DETAILED DESCRIPTION

[0062] The following embodiments are described in detail, and examples thereof are shown in the accompanying drawings. When the following description refers to the drawings, unless otherwise indicated, the same numbers in different drawings represent the same or similar elements. The implementations described in the following embodiments do not represent all implementations consistent with the present application. They are only examples of systems and methods consistent with some aspects of the present application as detailed in the claims.

[0063] It should be noted that the brief description of terms in this application is only for the convenience of understanding the embodiments described below, and is not intended to limit the embodiments of this application. Unless otherwise specified, these terms should be understood according to their common and usual meanings.

[0064] The terms "first", "second", "third", etc. in the specification and claims of this application and the above drawings are used to distinguish similar or similar objects or entities, and do not necessarily mean to limit a specific order or sequence, unless otherwise noted. It should be understood that the terms used in this way can be interchangeable under appropriate circumstances.

[0065] During the transmission process, network data may leak in the form of unstructured data, such as text, images, sound and video. Unstructured data has various formats, complex content and huge data volume, which makes it difficult to store, manage and analyze data. Data traceability technology provides a complete life cycle chain for data by tracking the source, processing process and transformation history of data, thereby reducing the risk of data leakage.

[0066] Among the methods of unstructured data traceability, data traceability based on labels and data traceability based on computing processes are the two main technical means. Data traceability based on labels records the source and transformation process of data by adding specific labels during data generation or processing. Labels can clearly identify information such as the source, creator, modification time, and modification content of the data. Data traceability based on computing processes builds a complete traceability chain by recording the transformation steps of data in the computing process, such as input data, computing tools, parameter settings, and output results.

[0067] However, label-based data traceability and computing process-based data traceability are inefficient in the traceability process and have poor real-time and comprehensiveness.

[0068] The embodiments of the present application provide a method, device and electronic device for tracing unstructured data, which can improve the efficiency, real-time and comprehensiveness of tracing unstructured data. Figure 1 A flowchart of a method for tracing the provenance of unstructured data provided by some embodiments of the present application is shown in FIG. Figure 1 As shown, the unstructured data tracing method includes steps S100-S600.

[0069] S100: Create matching information, where the matching information includes data element tags and data matching rules.

[0070] In some embodiments, the unstructured data includes sensitive data that users are concerned about, such as personal information, business information, etc. In order to trace the sensitive data, it is necessary to create matching information based on the sensitive data. Figure 2 As shown, when creating matching information, first perform step S201: obtain the data to be traced. For example, the data to be traced is an "enterprise employee information table", including employee names, such as "Zhang San"; employee ID numbers, such as "11010519491231****"; employee work numbers, such as "Development Department 221005".

[0071] Next, execute step S202: determine the classification name of the data to be traced, and store the classification name as a data element label.

[0072] In some embodiments, after obtaining the data to be traced, it is necessary to classify the data to be traced and generate data element labels for marking. For example, according to the classification in the "Enterprise Employee Information Table", three data element labels of "employee name", "employee ID number" and "employee work number" are generated.

[0073] Then execute step S203: set data matching rules according to the content of the data to be traced.

[0074] In some embodiments, when setting matching rules, it is necessary to obtain the data type of the data to be traced. The data type includes text type, number type and composite type. Different matching rules need to be set for different types of data.

[0075] For the text type data to be traced, set keywords that represent the content of the data to be traced to obtain data matching rules. For example, if the data to be traced is "Enterprise Employee Information Table", "Employee Name" in "Enterprise Employee Information Table" is of text type, and the keyword "Zhang San" is set for the data element label "Employee Name", then "Zhang San" is the data matching rule corresponding to the data element label "Employee Name".

[0076] For the digital type of data to be traced, set a regular expression representing the content of the data to be traced to obtain data matching rules. For example, if the data to be traced is the "Enterprise Employee Information Table", and the "Employee ID Number" in the "Enterprise Employee Information Table" is of digital type, the regular expression set for the data element label "Employee ID Number" is "^[1-9]\d{5}(18|19|(

[23] \d))\d{2}((0[1-9])|(10|11|12))(([0-2][1-9])|10|20|30|31)\d{3}[0-9X x]$", this regular expression represents an 18-digit number, the first digit is 1-9, the second to sixth digits are the area code (numbers between 0-9), the seventh to tenth digits are the year of birth (can be 18xx, 19xx, 20xx-23xx), the eleventh to twelfth digits are the month (01-12), the thirteenth to fourteenth digits are the date (01-31), the fifteenth to seventeenth digits are the sequence code (numbers between 0-9), and the eighteenth digit is the check code (0-9 or X / x). Therefore, this regular expression is the data matching rule corresponding to the data element label "employee ID number".

[0077] For the composite type of data to be traced, a combination of keywords and regular expressions representing the content of the data to be traced is set to obtain data matching rules. For example, if the data to be traced is "Enterprise Employee Information Table", and "Employee Number" in the "Enterprise Employee Information Table" is a composite type, the combination of keywords and regular expressions set for the data element label "Employee Number" is "Development Department ^(?!0{6})\d{6}$". The regular expression in the combination represents a 6-digit number other than "000000". This combination is the data matching rule corresponding to the data element label "Employee Number".

[0078] It should be noted that multiple data matching rules can be set for the same data element tag. For example, for the data element tag "employee name", the data matching rule can be set to "Zhang San", or "Li Si", or "Zhang San, Li Si, Wang Wu", which is not specifically limited in the embodiments of this application.

[0079] Finally, step S204 is performed: the data element labels of the same data to be traced are bound to the data matching rules to obtain matching information. For example, "employee name" and "Zhang San" are a set of matching information; "employee ID number" and "^[1-9]\d{5}(18|19|(

[23] \d))\d{2}((0[1-9])|(10|11|12))(([0-2][1-9])|10|20|30|31)\d{3}[0-9Xx]$" are a set of matching information; "employee work number" and "Development Department^(?!0{6})\d{6}$" are a set of matching information.

[0080] S200: Acquire network traffic, where the network traffic includes unstructured data.

[0081] In some embodiments, before performing source tracing on unstructured data, in order to avoid affecting the normal transmission process of network traffic, it is necessary to obtain network traffic dedicated to source tracing. Figure 3 As shown, in the conventional transmission process, the network traffic is first input into the core switch, then input into the access switch by the core switch, and then input into the core database and application server by the access switch for storage and processing. In some embodiments of the present application, the network traffic can be mirrored in the core switch, and a copy of the network traffic can be used for data tracing.

[0082] S300: Perform restoration processing on the unstructured data to obtain files to be matched.

[0083] It should be understood that unstructured data has various formats and is difficult to analyze uniformly, so it is necessary to perform restoration processing on the unstructured data to obtain traceable files to be matched. Figure 4 As shown, when performing restoration processing on unstructured data, step S401 is first performed: obtaining the file type of the unstructured data. The file type includes text type, table type and image type. For example, text type data includes document files with a file name suffix of "doc"; table type data includes tables with a file name suffix of "xls"; and image type includes pictures with a file name suffix of "jpg".

[0084] Then execute step S402: determine the file processing tool according to the file type.

[0085] For different types of unstructured data, select different types of processing tools to perform processing. For example, select text processing tools to process text-type unstructured data, select table processing tools to process table-type unstructured data, and select image processing tools to process image-type unstructured data.

[0086] Finally, step S403 is performed: using a file processing tool to read the unstructured data to obtain a file to be matched.

[0087] Exemplarily, for a document file with a file name suffix of "doc", a text editor, a file reading function in a programming language (such as Python, Java), or a text processing library is used to perform reading. For a table with a file name suffix of "xls", a spreadsheet software (such as Excel, Google Sheets) or a spreadsheet processing library in a programming language is used to perform reading. For a picture with a file name suffix of "jpg", an image editing software, an image processing library (such as OpenCV), or other image analysis tools are used to perform reading.

[0088] S400: searching for marked data from the file to be matched according to the data matching rule; if the file to be matched includes the marked data, adding a data element tag corresponding to the data matching rule to the marked data, and setting the file to be matched as the marked file.

[0089] In some embodiments, after reading the content in the file to be matched, the sensitive data of interest to the user in the file to be matched can be marked according to the created matching information to facilitate subsequent data tracing.

[0090] For example, according to the data matching rule "Zhang San, Li Si, Wang Wu", the matching file "Enterprise Employee Information Table" is searched, and the marked data "Zhang San" and "Li Si" are searched, then the matching data element label "employee name" is added to "Zhang San" and "Li Si". According to the data matching rule "Zhang San, Li Si, Wang Wu", the matching file "Enterprise Employee Information Table" is searched, and the marked data "Zhang San" and "Li Si" are searched, then the matching data element label "employee name" in the matching information is added to "Zhang San" and "Li Si". According to the data matching rule "^[1-9]\d{5}(18|19|(

[23] \d))\d{2}((0[1-9])|(10|11|12))(([0-2][1-9])|10|20|30|31)\d{3}[0-9Xx]$", the matching file "Enterprise Employee Information Table" is searched, and the tag data "11010519491231****" is found. The data element tag "employee ID number" matching it is added to the matching information as "11010519491231****". According to the data matching rule "Development Department^(?!0{6})\d{6}$", the matching file "Enterprise Employee Information Table" is searched, and the tag data "Development Department 100025" is found. The data element tag "employee ID number" matching it is added to the matching information as "Development Department 100025".

[0091] In some embodiments, if the marked data is searched in the to-be-matched file, it means that the to-be-matched file contains sensitive data of concern to the user, and therefore the to-be-matched file needs to be set as a marked file. For example, if the marked data "Zhang San" is searched in the to-be-matched file "Enterprise Employee Information Table", the "Enterprise Employee Information Table" is set as a marked file.

[0092] S500: Storing first traceability information of a marked file, where the first traceability information includes at least one of marked data, data element labels, basic file information, and file flow information.

[0093] In some embodiments, after the marked file is obtained by executing step S400, the marked file's marked data, data element label, basic file information, and file flow information need to be stored as the first traceability information for subsequent data traceability. The basic file information includes the file name of the marked file, the file hash value, the file data volume, the file transfer time, and the file encryption status; the file flow information includes the transmission source / destination terminal IP, application domain name, user account, source / destination device MAC address, etc.

[0094] In some embodiments, since the tag file already includes the tag data and the data element tags of the tag data, when storing the first traceability information, in addition to storing the tag data itself, the contextual content of the tag data can also be stored based on the position of the tag data in the tag file, thereby improving the comprehensiveness of the traceability content.

[0095] In some embodiments, when searching for marked data from a to-be-matched file according to a data matching rule, if the to-be-matched file does not include the marked data, the to-be-matched file is stored as an unmarked file, and the second traceability information of the unmarked file is stored. Since the unmarked file does not include the marked data, the second traceability information only includes the basic file information and the file flow information.

[0096] In some embodiments, when storing the first traceability information, the marking data or data element label may also be associated with the device information, application information, and user information involved in the transmission process. This means that a relationship chain with the marking data or data element label as the core can be obtained, that is, the relationship between the specified marking data or data element label, the marking file containing the marking data or data element label, and all device lists, application lists, and user lists involved in the marking file.

[0097] In some embodiments, when storing the first traceability information or the second traceability information, the marked file or the unmarked file may also be associated with the device information, application information, and user information involved in the transmission process, so as to obtain a relationship chain with the file as the core, that is, the relationship between the specified file and all the device lists, application lists, and user lists involved in its transmission.

[0098] It should be understood that by establishing the above-mentioned relationship chain, the multi-dimensional information of the traced file can be viewed during the traceability process, thereby improving the comprehensiveness and multi-dimensionality of unstructured data traceability.

[0099] In some embodiments, by executing steps S100-S500, the marking and storage of unstructured data can be achieved, and the data foundation required for traceability can be completed for data traceability.

[0100] S600: Input the first traceability field, perform a search based on the first traceability field to obtain traceability marking data or a traceability label, the traceability marking data is the same marking data as the first traceability field, the traceability label is the same data element label as the first traceability field, and obtain the first traceability file, the first traceability file is a file that includes the traceability marking data or the traceability label in the first traceability information.

[0101] In some embodiments, data traceability can be performed based on sensitive data that the user is concerned about, that is, the sensitive data is set as the first traceability field, and the first traceability field is searched to check whether the unstructured data includes the same marking data or data element label as the first traceability field. If it does, the first traceability file including the marking data or data element label is obtained.

[0102] Exemplarily, taking "employee name" as the first traceability field, and obtaining the data element tag "employee name" in the "enterprise employee information table" through searching, the "enterprise employee information table" is obtained as the first traceability file.

[0103] Exemplarily, taking "11010519491231****" as the first traceability field, and obtaining the tag data "11010519491231****" in the "Enterprise Employee Information Table" through searching, the "Enterprise Employee Information Table" is obtained as the first traceability file.

[0104] It should be understood that, since the first provenance file includes the marking data, the first provenance file is a marking file. After the first provenance file is acquired, the first provenance information of the stored marking file can be viewed.

[0105] For example, if the first traceability file is an "Enterprise Employee Information Table", you can view all marked data and data element labels in the "Enterprise Employee Information Table" as well as their context information, basic file information of the "Enterprise Employee Information Table", and file flow information.

[0106] In some embodiments, since the basic information of the file includes the file name, the file can also be directly traced according to the file name. The file name is used as the second traceability field, and a search is performed according to the second traceability field to obtain a file name that is the same as the second traceability field, and a second traceability file with the second traceability field as the file name is obtained.

[0107] Exemplarily, taking "commodity shipping information table" as the second traceability field, a table file with the file name "commodity shipping information table" is obtained through search, and the table file is obtained as the second traceability file.

[0108] It should be noted that if the relevant matching information of the "Commodity Shipping Information Table" is not created, the data element tags in the "Commodity Shipping Information Table" are not added in the data marking stage, that is, the "Commodity Shipping Information Table" does not include the marked data. At this time, the "Commodity Shipping Information Table" is an unmarked file, which only stores the basic information of the file and the file flow information. After obtaining the "Commodity Shipping Information Table" as the second traceability file in the traceability stage, only the basic information and file flow information of the second traceability file can be viewed.

[0109] In some embodiments, after obtaining the first traceability file or the second traceability file, relevant information of the traceability data, such as the file flow path, can be obtained based on the basic file information and file flow information in the traceability file.

[0110] In some embodiments, the unstructured data tracing method can create a file portrait for each unstructured data, which includes basic file information, file flow information, etc., to facilitate users to view detailed information of the data after obtaining the tracing data.

[0111] In some embodiments, during the transmission process of unstructured data, the file name or file format may change, but the file content may remain unchanged. In order to avoid identifying files with the same content but different file names or file formats as different files, resulting in incomplete and incorrect data traceability, the file hash value in the basic information of the file can be obtained, and the file basic information, file history information, and file flow information of files with the same file hash value can be stored as the same file portrait.

[0112] In summary, the overall process of the unstructured data tracing method described in the embodiment of the present application is as follows: Figure 5 As shown. First, design the data elements for marking based on the sensitive data that the user is concerned about, and create matching information. After the matching information is created, obtain the network traffic, and determine whether the unstructured data in the network traffic matches the data element based on the matching information. If it matches, record the matching file information and element matching information; if it does not match, only record the file information. Then establish a data multi-dimensional relationship chain for the recorded file information and element matching information and store it. Finally, trace the source based on the stored data.

[0113] Based on the unstructured data tracing method provided by some embodiments of the present application, some embodiments of the present application also provide an unstructured data tracing device. Figure 6 This is a schematic diagram of the structure of an unstructured data tracing device provided in some embodiments of the present application. Figure 6 As shown, the unstructured data tracing device includes:

[0114] The matching information creation module 601 is configured to: create matching information, wherein the matching information includes a data element tag and a data matching rule;

[0115] The network traffic acquisition module 602 is configured to: acquire network traffic, wherein the network traffic includes unstructured data;

[0116] The file restoration module 603 is configured to: perform restoration processing on the unstructured data to obtain a file to be matched;

[0117] The marking file acquisition module 604 is configured to: search for marking data from the to-be-matched file according to the data matching rule, if the to-be-matched file includes the marking data, add the data element tag corresponding to the data matching rule to the marking data, and set the to-be-matched file as a marking file;

[0118] The first traceability information storage module 605 is configured to: store the first traceability information of the marked file, wherein the first traceability information includes at least one of the marked data, the data element label, the basic file information, and the file flow information;

[0119] The traceability module 606 is configured to: input a first traceability field, perform a search based on the first traceability field to obtain traceability marking data or a traceability label, wherein the traceability marking data is the marking data identical to the first traceability field, and the traceability label is the data element label identical to the first traceability field, and obtain a first traceability file, wherein the first traceability file is a file including the traceability marking data or the traceability label in the first traceability information.

[0120] Some embodiments of the present application further provide an electronic device including:

[0121] Memory for storing computer programs;

[0122] A processor is used to execute the computer program to implement the steps of any one of the methods in the first aspect.

[0123] For example, Figure 7 As shown, the electronic device includes a processor 701, at least one communication bus 702, a user interface 703, at least one external communication interface 704 and a memory 705. The communication bus 702 is configured to realize the connection and communication between these components. The user interface 703 may include a display screen, and the external communication interface 704 may include a standard wired interface and a wireless interface. The memory 705 stores a computer program. The processor 701 is used to execute the computer program stored in the memory 705.

[0124] As can be seen from the above technical solutions, the present application provides a method, device and electronic device for tracing the provenance of unstructured data, the method comprising: creating matching information, the matching information comprising a data element tag and a data matching rule; obtaining network traffic, the network traffic comprising unstructured data; performing restoration processing on the unstructured data to obtain a file to be matched; searching for marker data from the file to be matched according to the data matching rule, if the file to be matched includes the marker data, adding the data element tag corresponding to the data matching rule to the marker data, and setting the file to be matched as a marker file; storing first tracing information of the marker file, the first tracing information comprising at least one of the marker data, the data element tag, basic file information and file flow information; inputting a first tracing field, performing a search according to the first tracing field to obtain tracing marker data or a tracing tag, the tracing marker data is the marker data identical to the first tracing field, the tracing tag is the data element tag identical to the first tracing field, and obtaining a first tracing file, the first tracing file being a file including the tracing marker data or the tracing tag in the first tracing information.

[0125] The method first creates matching information for marking traceability data, and marks the corresponding traceability data in the unstructured data according to the matching information; and sets the file including the traceability data in the unstructured data as a marked file and stores it; in the traceability stage, a search is performed through the traceability field to obtain a marked file including the traceability data, thereby improving the efficiency, real-time and comprehensiveness of the traceability of the unstructured data.

[0126] Similar parts between the embodiments provided in this application can be referenced to each other. The specific implementation methods provided above are only a few examples under the general concept of this application and do not constitute a limitation on the protection scope of this application. For those skilled in the art, any other implementation methods expanded based on the scheme of this application without creative work belong to the protection scope of this application.

Claims

1. A method for tracing the provenance of unstructured data, characterized in that: include: Creating matching information, wherein the matching information includes a data element tag and a data matching rule; Acquiring network traffic, wherein the network traffic includes unstructured data; Performing restoration processing on the unstructured data to obtain a file to be matched; Searching for the marked data from the to-be-matched file according to the data matching rule, and if the to-be-matched file includes the marked data, adding the data element tag corresponding to the data matching rule to the marked data, and setting the to-be-matched file as a marked file; storing first traceability information of the marked file, wherein the first traceability information includes at least one of the marked data, the data element label, basic file information, and file flow information; Input a first traceability field, perform a search based on the first traceability field to obtain traceability marking data or a traceability label, wherein the traceability marking data is the marking data identical to the first traceability field, and the traceability label is the data element label identical to the first traceability field, and obtain a first traceability file, wherein the first traceability file is a file including the traceability marking data or the traceability label in the first traceability information.

2. The unstructured data tracing method according to claim 1, characterized in that: The creating matching information includes: Obtain the data to be traced; Determine the classification name of the data to be traced, and store the classification name as the data element label; Setting the data matching rule according to the content of the data to be traced; The data element labels of the same data to be traced are bound to the data matching rules to obtain the matching information.

3. The unstructured data tracing method according to claim 2, characterized in that: The step of setting the data matching rule according to the content of the data to be traced includes: Obtain the data type of the data to be traced, the data type includes text type, number type and composite type; Setting keywords representing the content of the data to be traced for the text type data to be traced, so as to obtain the data matching rule; Setting a regular expression representing the content of the digital type data to be traced to obtain the data matching rule; A combination of a keyword and a regular expression representing the content of the data to be traced is set for the composite type of the data to be traced, so as to obtain the data matching rule.

4. The unstructured data tracing method according to claim 1, characterized in that: The performing restoration processing on the unstructured data to obtain the to-be-matched file includes: Acquire the file type of the unstructured data, where the file type includes a text type, a table type, and an image type; Determine a file processing tool according to the file type, wherein a text processing tool is selected to process the unstructured data of the text type, a table processing tool is selected to process the unstructured data of the table type, and an image processing tool is selected to process the unstructured data of the image type; The file processing tool is used to read the unstructured data to obtain the file to be matched.

5. The unstructured data tracing method according to claim 1, characterized in that: The method further comprises: Searching the marked data from the to-be-matched file according to the data matching rule; If the to-be-matched file does not include the marked data, storing the to-be-matched file as an unmarked file; The second traceability information of the unmarked file is stored, where the second traceability information includes at least one of basic file information and file flow information.

6. The unstructured data tracing method according to claim 5, characterized in that: The basic file information includes a file name, and the method further includes: Input a second traceability field, perform a search according to the second traceability field to obtain a traceability name, where the traceability name is the file name of the to-be-matched file that is the same as the second traceability field; A second tracing file is obtained, where the second tracing file is the file to be matched whose file name is the same as the second tracing field.

7. The unstructured data tracing method according to claim 6, characterized in that: The basic file information includes a file hash value, and the method further includes: Obtaining a hash value of the file to be matched; The basic file information and file flow information of the to-be-matched files with the same hash value are stored as the same file portrait.

8. The unstructured data tracing method according to claim 1 or 6, characterized in that: The method further comprises: Obtaining file flow information of the first traceability file or the second traceability file; The flow path of the first traceability file or the second traceability file is obtained according to the file flow information.

9. An unstructured data tracing device, characterized in that: include: A matching information creation module is configured to: create matching information, wherein the matching information includes a data element label and a data matching rule; The network traffic acquisition module is configured to: acquire network traffic, wherein the network traffic includes unstructured data; A file restoration module is configured to: perform restoration processing on the unstructured data to obtain a file to be matched; a marking file acquisition module, configured to: search for marking data from the to-be-matched file according to the data matching rule, and if the to-be-matched file includes the marking data, add the data element tag corresponding to the data matching rule to the marking data, and set the to-be-matched file as a marking file; A first traceability information storage module is configured to: store first traceability information of the marked file, wherein the first traceability information includes at least one of the marked data, the data element label, basic file information, and file flow information; The traceability module is configured to: input a first traceability field, perform a search based on the first traceability field to obtain traceability marking data or a traceability label, wherein the traceability marking data is the marking data identical to the first traceability field, and the traceability label is the data element label identical to the first traceability field, and obtain a first traceability file, wherein the first traceability file is a file including the traceability marking data or the traceability label in the first traceability information.

10. An electronic device, characterized in that: include: one or more processors; a memory configured to store one or more programs; Wherein, when the one or more programs are executed by the one or more processors, the one or more processors implement the unstructured data tracing method according to any one of claims 1-8.

Images