Data risk management method, device and equipment and readable storage medium

Abstract

The embodiment of the invention provides a data risk management method and device, equipment and a readable storage medium. The method comprises the following steps: acquiring data packet downloading information for at least one data packet providing end; the data packet downloading information is related to requests of a plurality of clients for downloading data packets from at least one data packet providing end. The method further includes determining factor information related to a data risk factor to be detected. The method further comprises the step of determining one or more target clients with data risk factors from the multiple clients based on the data packet downloading information and the factor information. In this way, data risks can be quickly identified and software licenses can be managed.

Description

Technical Field

[0001] Example embodiments of the present disclosure generally relate to the field of computers, and more particularly, to methods, devices, apparatuses, and readable storage media for data risk management. Background Art

[0002] Some entities (e.g., large enterprises) have a large amount of virtual and physical information technology (IT) infrastructure, which has thousands or even millions of assets such as network equipment, bare metal servers, and virtual machines. This IT infrastructure is also called assets. These assets require the download of various data packets, and the downloaded data packets may have some data risks. Therefore, entities need to manage the data risks of data packets. Summary of the invention

[0003] In a first aspect of the present disclosure, a data risk management method is provided. The method includes: obtaining data packet download information for at least one data packet provider, the data packet download information being related to requests of multiple clients to download data packets from the at least one data packet provider; determining factor information related to a data risk factor to be detected; and determining one or more target clients having data risk factors from multiple clients based on the data packet download information and the factor information.

[0004] In a second aspect of the present disclosure, a device for data risk management is provided. The device includes: a data packet download information acquisition module, configured to acquire data packet download information for at least one data packet provider, the data packet download information being related to requests of multiple clients to download data packets from at least one data packet provider; a factor information determination module, configured to determine factor information related to the data risk factor to be detected; and a target client determination module, configured to determine one or more target clients having data risk factors from multiple clients based on the data packet download information and the factor information.

[0005] In a third aspect of the present disclosure, an electronic device is provided. The electronic device includes at least one processing unit; and at least one memory, the at least one memory is coupled to the at least one processing unit and stores instructions for execution by the at least one processing unit. When the instructions are executed by the at least one processing unit, the electronic device executes the method of the first aspect.

[0006] In a fourth aspect of the present disclosure, a computer-readable storage medium is provided, wherein a computer program is stored on the computer-readable storage medium, and when the computer program is executed by a processor, the method of the first aspect is implemented.

[0007] In a fifth aspect of the present disclosure, a computer program product is provided, wherein the computer program product comprises a computer program, and when the computer program is executed by a processor, the method of the first aspect is implemented.

[0008] It should be understood that the content described in this section is not intended to limit the key features or important features of the embodiments of the present disclosure, nor is it intended to limit the scope of the present disclosure. Other features of the present disclosure will become easily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0009] The above and other features, advantages and aspects of the embodiments of the present disclosure will become more apparent with reference to the following detailed description in conjunction with the accompanying drawings. In the accompanying drawings, the same or similar reference numerals represent the same or similar elements, wherein:

[0010] Figure 1 A schematic diagram showing an example environment in which embodiments of the present disclosure can be implemented;

[0011] Figure 2 A schematic diagram showing a data risk management architecture according to some embodiments of the present disclosure is shown;

[0012] Figure 3 A flowchart showing a method for data risk management according to some embodiments of the present disclosure is shown;

[0013] Figure 4 A schematic structural block diagram showing an apparatus for data risk management according to some embodiments of the present disclosure; and

[0014] Figure 5 A block diagram of an electronic device in which one or more embodiments of the present disclosure may be implemented is shown. DETAILED DESCRIPTION

[0015] The embodiments of the present disclosure will be described in more detail below with reference to the accompanying drawings. Although certain embodiments of the present disclosure are shown in the accompanying drawings, it should be understood that the present disclosure can be implemented in various forms and should not be construed as being limited to the embodiments described herein. On the contrary, these embodiments are provided to provide a more thorough and complete understanding of the present disclosure. It should be understood that the drawings and embodiments of the present disclosure are only for exemplary purposes and are not intended to limit the scope of protection of the present disclosure.

[0016] In the description of the embodiments of the present disclosure, the term "including" and similar terms should be understood as open inclusion, that is, "including but not limited to". The term "based on" should be understood as "based at least in part on". The term "one embodiment" or "the embodiment" should be understood as "at least one embodiment". The term "some embodiments" should be understood as "at least some embodiments". Other explicit and implicit definitions may also be included below.

[0017] Herein, unless explicitly stated, executing a step “in response to A” does not mean executing the step immediately after “A” but may include one or more intermediate steps.

[0018] It is understandable that the data involved in this technical solution (including but not limited to the data itself, the acquisition, use, storage or deletion of the data) shall comply with the requirements of relevant laws, regulations and relevant provisions.

[0019] It is understandable that before using the technical solutions disclosed in each embodiment of the present disclosure, the types, scope of use, usage scenarios, etc. of the information involved in the present disclosure should be informed to relevant users and their authorization should be obtained in an appropriate manner in accordance with relevant laws and regulations. The relevant users may include any type of right holders, such as individuals, enterprises, and groups.

[0020] For example, in response to receiving an active request from a user, a prompt message is sent to the relevant user to clearly prompt the relevant user that the operation requested to be performed will require obtaining and using the information of the relevant user, so that the relevant user can independently choose whether to provide information to software or hardware such as an electronic device, application, server or storage medium that executes the operation of the technical solution of the present disclosure based on the prompt message.

[0021] As an optional but non-limiting implementation, in response to receiving an active request from a relevant user, a prompt message is sent to the relevant user, for example, in the form of a pop-up window, in which the prompt message may be presented in text form. In addition, the pop-up window may also carry a selection control for the user to select "agree" or "disagree" to provide information to the electronic device.

[0022] It is understandable that the above notification and the process of obtaining user authorization are merely illustrative and do not constitute a limitation on the implementation of the present disclosure. Other methods that meet relevant laws and regulations may also be applied to the implementation of the present disclosure.

[0023] First, some concepts and principles used in this disclosure are introduced.

[0024] The term "packet manager" or "package manager" is a software tool that automates the process of installing, upgrading, configuring, and removing software packages from a computer operating system in a consistent manner. Package managers are designed to help users manage software applications and libraries that are distributed in a specific form (e.g., data packages).

[0025] A package manager can manage operating system software packages. Popular package managers for operating systems include dpkg (a package manager for Debian operating systems), RPM (a package manager for Red Hat Linux operating systems), and brew (a package manager for macOS applications). A package manager can also manage software packages for specific programming languages. Popular package managers for programming languages ​​include pip (a package manager for Python packages) and NPM (a package manager for NodeJS packages). It should be understood that only examples of package managers are listed above without any intention of limitation. Embodiments of the present disclosure can be used for various package managers.

[0026] A package manager can download software packages from a package mirror or official repository over a network. Physical and virtual servers can use package managers to download, install, update, or remove software packages running on their operating systems. Developers and servers can use multiple package managers at the same time.

[0027] Developers can also use package managers to download, update, or delete dependencies (such as other software components, libraries, frameworks, or modules that the software program depends on) when building software programs on their computers. The developed software program can only run properly if these dependencies are correctly installed and available. If there are problems with the dependencies, such as incompatible versions, missing or damaged, the software program may not compile or run properly or errors may occur. Therefore, developers need to use tools such as package managers to effectively manage these dependencies to ensure the smooth development of software programs. In addition, the servers that make up the build pipeline can also use package managers to download, update, or delete dependencies when building software programs.

[0028] The term "packet mirroring" or "package mirroring" refers to services that provide alternative data sources for software packages. These data sources are copies of the original software packages in the original repository. Package mirroring can provide advantages in terms of geographic distribution, load distribution, redundancy, bandwidth, and security.

[0029] For example, package mirrors are often geographically distributed to provide users with a closer, and therefore faster, source for software downloads. Accessing a nearby package mirror can significantly reduce latency and increase download speeds. By providing multiple package mirrors, the load on any single server can be reduced. This prevents bottlenecks and potential server overloads, especially when a new update or package is released and many users are trying to download it at the same time.

[0030] For another example, in the event that the original repository is unavailable, package mirrors ensure that packages are still available to users. This redundancy is critical to maintaining the continuity of software distribution. Enterprises can use local package mirrors to save external bandwidth usage. All internal clients can get updates from the local mirror instead of downloading each individual system from an external source. Enterprises with isolated networks can only download software packages from local package mirrors, thereby ensuring security.

[0031] The term Common Vulnerabilities and Exposures (CVE) refers to publicly disclosed computer security vulnerabilities with a standard identifier. Each CVE is identified by a unique identifier (usually in the form CVE-yyyy-nnnn, where "yyyy" represents the year it was identified and "nnnn" represents a sequence number). The severity of a CVE can be measured using the Common Vulnerability Scoring System (CVSS).

[0032] In some solutions, a supervised CVE system can provide users with a reliable way to identify unique vulnerabilities and coordinate the development of security tools and solutions using standard identifiers. CVE databases can also provide a standardized basis for assessing the coverage of tools and services so that users can determine whether their systems are vulnerable to specific security threats. Although these CVE systems and databases are maintained, CVE entries can be submitted by anyone from the open source community.

[0033] The term "software license" is a legal contract between the creator or rights holder of software and the users of the software. They outline the terms and conditions for the use and distribution of the software, defining what the user can and cannot do with it. They are essential to protecting the intellectual property of the software, ensuring that the developer receives credit and compensation for their work, while also providing the terms under which the software can be shared and used. Software packages distributed by package managers often include license information.

[0034] Commercial enterprises using third-party software must pay attention to its licenses, particularly the terms involving use in personal, educational, or business settings and the ability to modify the software, or face legal action.

[0035] Figure 1A schematic diagram of an example environment 100 in which embodiments of the present disclosure can be implemented is shown. The environment 100 involves multiple clients 110 and a data packet provider 120. Multiple clients 110 are deployed, for example, in an entity content, such as within an enterprise. A user (such as a developer or a server user) can send a download request (such as a request to download a software installation package) to the data packet provider 120 through the client 110. The data packet provider 120 sends a corresponding data packet to the client 110 in response to the download request. The administrator can view the download information of the downloaded data packet through the client 110 to determine whether there is a security vulnerability or an incompatible software package problem.

[0036] The data packet provider 120 can be any type of device that can provide data packet download, such as a server. The data packet provider 120 can also be a service hosted on a server. Although shown as a single data packet provider 120, it should be understood that a user can send a download request to multiple data packet providers 120 through one client 110 or to one of the data packet providers 120 through multiple clients 110 and receive data packets.

[0037] It should be understood that the structure and functionality of environment 100 are described for exemplary purposes only and does not imply any limitation on the scope of the present disclosure.

[0038] As briefly mentioned above, entities that own assets (e.g., enterprises) need to manage risks in the data packages downloaded by various assets. For example, entities need to track their assets and identify CVEs. However, this is a challenge for entities. Taking an enterprise as an example, if a new CVE with a serious impact is reported, the enterprise must quickly identify the affected assets and patch them. Delays will provide attackers with a window to exploit CVEs and attack the enterprise's IT infrastructure by stealing data, hijacking assets, or disrupting services.

[0039] Current solutions for detecting CVEs include running host-based agents (such as antivirus software) locally on assets that scan their hosts to detect the presence of CVEs. However, the effectiveness of this solution is limited because it requires security experts to write accurate signatures or rules for the agent to run, which can delay response time. In addition, host-based agents are not completely reliable because they can be disabled by attackers who exploit CVEs, or enterprises may not install agents at all due to cost or performance issues.

[0040] Solutions for detecting CVEs also include scanning assets with security tools. Security tools can scan the network signatures of assets to detect the presence of CVEs. However, the effectiveness of this solution is limited because not all CVEs have detectable network signatures.

[0041] Solutions to detect CVEs also include scanning the Software Bill of Materials (SBOM) during asset build using security tools. If the asset is built in-house, the enterprise may be able to generate and store their SBOMs. These SBOMs can be scanned to detect the presence of CVEs. For example, container images built in-house and deployed on certain clusters will generate SBOMs. However, this solution has limited effectiveness because software packages may be dynamically updated, causing the SBOM to become outdated.

[0042] In addition to CVE, it is also challenging for enterprises to identify whether assets in a large virtual and physical IT infrastructure use software packages with incompatible licenses. Using incompatible software licenses can create legal risks for the enterprise, which may cause monetary or reputational damage.

[0043] Current solutions for detecting incompatible licenses include the use of host-based agents. A host-based agent running locally on an asset can scan its host to detect the presence of incompatible licenses. However, the effectiveness of this solution is limited because there are no known commercial agents that can perform this task. In addition, enterprises may not install agents due to cost or performance issues.

[0044] Solutions to detect incompatible licenses also include scanning SBOMs during asset builds using security tools. If assets are built in-house, enterprises may be able to generate and store their SBOMs. These SBOMs can be scanned to detect the presence of incompatible licenses. For example, container images built in-house and deployed on certain clusters will generate SBOMs. However, this solution has limited effectiveness because software packages may be dynamically updated with updated licenses, making the SBOMs out of date.

[0045] In an embodiment of the present disclosure, an improved scheme for data packet management is provided. The scheme can be used for incident response, vulnerability management, and license management. In the scheme, data packet download information for at least one data packet provider is obtained. The data packet download information is related to requests of multiple clients to download data packets from at least one data packet provider. Factor information related to the data risk factor to be detected is determined. Based on the data packet download information and the factor information, one or more target clients having data risk factors are determined from multiple clients.

[0046] In this way, data risks in assets can be quickly identified, which can help entities with a large number of assets manage data security risks. For example, vulnerabilities in assets can be quickly identified and patched, and incompatible software licenses can also be quickly identified, helping entities with a large number of assets to easily manage vulnerabilities and software licenses.

[0047] Some example embodiments of the present disclosure will be described in detail below with reference to examples of the accompanying drawings.

[0048] Figure 2 FIG. 2 is a schematic diagram of a data risk management architecture 200 according to some embodiments of the present disclosure. The architecture 200 may be implemented in Figure 1 The architecture 200 involves multiple clients 110, a data packet provider 120, and an observation system 220. The data packet provider 120 may include a data packet mirror. Figure 1 It should be understood that the architecture 200 may include multiple data packet providers 120, and the present disclosure is not limited thereto.

[0049] like Figure 2 As shown, a user can send a request to download a data packet to the data packet provider 120 through the client 110. The data packet provider 120 sends a corresponding data packet to the client 110 in response to the download request. The administrator can view the download information of the data packet sent by the data packet provider 120 through the observation system 220 to determine whether there is a security vulnerability or an incompatible software package problem. The data packet download information is related to the requests of multiple clients 110 to download data packets from the data packet provider 120.

[0050] In some embodiments, the architecture 200 further includes a load balancer 210. The load balancer 210 may be connected to the data packet provider 120 and configured to coordinate the data transmission load between the plurality of clients 110 and the data packet provider 120.

[0051] In some implementations, the data package provider 120 includes a data package repository 242 and a log database 244. The data package repository 242 is configured to store software packages. The log database 244 is configured to provide log access for the data package provider.

[0052] In some embodiments, the observation system 220 includes an aggregator 222, a database 224, and a backend 226. The aggregator 222 is configured to interact with the load balancer 210 or the data packet provider 120 to obtain the required data packet download information and write them to the database 224. The database 224 stores the obtained data packet download information for retrieval by the backend 226. In some cases where the malware in the data packet is persistent, simply updating the data packet may not solve the problem. Storing and maintaining a list of all data packets that a client has downloaded in the database 224 can better identify clients with data risks. In this document, the term "data risk" refers to any appropriate type of risk associated with a data packet. Data risks may include security risks posed by the data packet itself and / or security risks posed by the data in the data packet.

[0053] In some embodiments, the observation system 220 further includes a graphical user interface 227. The administrator can send a query request through the graphical user interface 227. The back end 226 receives the query request and retrieves the corresponding data package download information in the database 224. In this way, a single interface can be provided for the administrator to retrieve all data package usage information within the enterprise. This saves time and effort in collecting and parsing information from multiple sources.

[0054] In some implementations, observation system 220 includes application programming interface 228. Correlation service 230 can query corresponding data packet download information via backend 226 in a programmatic manner.

[0055] In some implementations, the data packet provider 120 may include a service hosted on a server, and the electronic device 110 may include a hosted software system.

[0056] The observation system 220 can be any type of device with computing capabilities, including a terminal device or a server device. The terminal device can be any type of mobile terminal, fixed terminal or portable terminal, including a mobile phone, a desktop computer, a laptop computer, a notebook computer, a netbook computer, a tablet computer, a media computer, a multimedia tablet, a personal communication system (PCS) device, a personal navigation device, a personal digital assistant (PDA), an audio / video player, a digital camera / camcorder, a positioning device, a television receiver, a radio broadcast receiver, an e-book device, a gaming device, or any combination of the foregoing, including accessories and peripherals of these devices or any combination thereof. The server device can include, for example, a computing system / server, such as a mainframe, an edge computing node, a computing device in a cloud environment, and the like.

[0057] In the architecture 200 , the observation system 220 can perform data risk management. Specifically, the data packet provider 120 responds to the download request of the client 110 and sends the corresponding data packet to the client 110 . The observation system 220 obtains the data packet download information sent by the data packet provider 120 .

[0058] In some implementations, the observation system 220 may detect data packets on data traffic associated with the data packet provider 120. From the detected data packets, the observation system 220 may extract information of a data packet download request associated with the data packet provider 120 as the data packet download information or a portion thereof. For example, the aggregator 222 in the observation system 220 may perform data packet inspection on the data traffic passing through the load balancer 210.

[0059] In some embodiments, the observation system 220 can obtain the corresponding operation log of the data packet provider 120. The observation system 220 can extract the information of the data packet download request associated with the data packet provider 120 from the obtained operation log as the data packet download information or a part thereof. For example, the aggregator 222 in the observation system 220 can parse the obtained operation log. The data packet provider 120 is, for example, a web server that hosts the software package. The data packet provider 120 can generate operation logs and store them in the log database 244. The aggregator 222 can obtain and parse these operation logs from the log database 244 to extract the information of the data packet download request.

[0060] In some embodiments, the data packet download information may include entries corresponding to respective data packet download requests. For example, the data packet download information may include a first entry corresponding to a first data packet download request. An example of the first entry is a data point constituting a software package mapping. The data point corresponds to a request for the client 110 to download a software package. Table 1 shows multiple field information of a sample data point.

[0061] Table 1

[0062]

[0063] The first entry may include an identifier of a client that initiates the first data packet download request, such as the client identifier "XX.XX.XX" in Table 1, indicating the source IP address of the client that has sent the request. Additionally or alternatively, the first entry may include attributes of the first data packet downloaded through the first data packet download request, such as the data packet name "AA" and the data packet version "XXX" in Table 1, indicating the name and version of the software package being downloaded, respectively.

[0064] Additionally or alternatively, the first entry may include an identifier of a data packet management system used to download the first data packet, such as the data packet management system identifier "BB" in Table 1, indicating a package manager and a package management system used to download the software package. Additionally or alternatively, the first entry may include an identifier of a data packet provider that provides the first data packet, such as the data packet provider identifier "CC" in Table 1, indicating a unique identifier of the data packet provider. Additionally or alternatively, the first entry may also include download time information of the first data packet, such as the timestamp "2016-01-01T15:01:01Z01:00" in Table 1.

[0065] The above describes that the observation system 220 obtains data packet download information. In order to manage data packets, the observation system 220 also needs to determine factor information related to the data risk factors to be detected. Data risk factors may include factors that may affect the security of enterprise assets. In some embodiments, data risk factors may include computer security vulnerabilities, such as CVE. Alternatively or additionally, in some embodiments, data risk factors may include incompatible software credentials, such as incompatible software licenses, etc. Factor information related to the data risk factors to be detected may include various information that can identify data risk factors or information that can indicate the existence of data risk factors. For example, factor information may include the number of a security vulnerability, or an indication of which versions of data packets are at risk.

[0066] In some embodiments, the observation system 220 may receive a query request for a data risk factor. Such a query request includes factor information. For example, the observation system 220 receives a query request for download information from an administrator via the graphical user interface 227. For another example, the observation system 220 receives a request from the relevant service 230 to programmatically query download information via the application programming interface 228. Further, the observation system 220 may provide a response to the query request. Such a response may indicate that the target client has a data risk factor.

[0067] After obtaining the data packet download information and factor information, the observation system 220 can determine one or more target clients with data risk factors from the multiple clients 110 based on the information. Identifying such target clients and taking timely measures can avoid risks such as data theft and service interruption.

[0068] In some embodiments, the observation system 220 may determine the data packet attributes of the data packet with data risk factors based on the factor information. The data packet attributes include, for example, the name and version number of the data packet. For example, the observation system 220 determines that the data packet with version number "xx" is risky based on the version of the incompatible software package. For another example, the observation system 220 determines that the data packet with name "yy" and download time "zz" is risky based on the information of the security vulnerability. Based on the data packet download information and the data packet attributes, the observation system 220 may determine one or more target clients that download the data packet with the data packet attributes.

[0069] In some embodiments, the data packet download information may include multiple entries corresponding to multiple data packet download requests. The observation system 220 may determine the search condition based on the data packet attributes and multiple fields included in each of the multiple entries. The search condition may define one or more fields in the multiple fields and corresponding field values. After determining the search condition, the observation system 220 may select one or more entries from the multiple entries, and determine one or more target clients based on the client identifiers in the selected entries.

[0070] As an example, multiple users send download requests to the data packet provider 120 through multiple clients 110. The aggregator 222 obtains data packet download information associated with the download requests sent by the multiple clients 110 from the log database 244. The data packet download information, for example, includes multiple data points respectively shown in Table 1. The obtained data packet download information is stored in the database 224. The observation system 220 determines the retrieval conditions based on the data packet attributes and the field values ​​contained in the multiple data points. The back end 226 receives the administrator's query request through the user interface (UI) 227, and uses the retrieval conditions to retrieve the target client with data risk from the database 224. Then, the back end 226 can provide the query results to the administrator through the user interface 227, for example, providing information of the detected target client. An example of a user interface is a webUI.

[0071] In summary, embodiments of the present disclosure help enterprises to easily manage security vulnerabilities and software licenses. Specifically, by aggregating data packet download information from multiple data packet providers to the observation system 220 in the architecture 200, the present disclosure can provide a unified information source for vulnerability management and license management teams to detect the use of vulnerable or incompatible software packages. This reduces the workload of a single team and avoids duplication of work (separate teams do not have to collect information themselves). The present disclosure provides a comprehensive audit trail of data packet usage information, allowing administrators to quickly and easily identify vulnerabilities in enterprise IT assets and patch them, and also allows administrators to quickly and easily identify incompatible software licenses in enterprise IT assets. Further, the present disclosure provides a single point interface between the observation system 220 and the data packet provider or load balancer, which makes compliance easier to achieve.

[0072] Figure 3 1 is a flowchart of a method 300 for data risk management according to some embodiments of the present disclosure. The method 300 may be implemented in Figure 2 The observation system 220 in FIG. Figure 2 Method 300 is described.

[0073] At block 310, the observation system 220 obtains data packet download information for at least one data packet provider. The data packet download information is related to requests from multiple clients to download data packets from the at least one data packet provider.

[0074] At block 320 , observation system 220 determines factor information related to the data risk factor to be detected.

[0075] At block 330 , observation system 220 determines one or more target clients having data risk factors from among the plurality of clients based on the data packet download information and the factor information.

[0076] In some embodiments, the observation system 220 detects data packets on a data flow associated with one or more data packet providers among at least one data packet provider; and extracts information of a data packet download request associated with one or more data packet providers from the detected data packets as at least a part of the data packet download information.

[0077] In some embodiments, the data traffic is traffic passing through a load balancer, which is connected to one or more data packet providers and is configured to coordinate data transmission loads between multiple clients and the one or more data packet providers.

[0078] In some embodiments, the observation system 220 obtains corresponding operation logs of one or more data packet providers among at least one data packet provider; and extracts information of data packet download requests associated with one or more data packet providers from the corresponding operation logs as at least a part of the data packet download information.

[0079] In some embodiments, the data packet download information includes a first entry corresponding to a first data packet download request, and the first entry includes at least one of the following: an identifier of a client that initiates the first data packet download request, an attribute of a first data packet downloaded through the first data packet download request, an identifier of a data packet management system for downloading the first data packet, an identifier of a data packet provider that provides the first data packet, or download time information of the first data packet.

[0080] In some embodiments, the observation system 220 determines the data packet attributes of the data packet having the data risk factor based on the factor information; and determines one or more clients that download the data packet having the data packet attributes as one or more target clients based on the data packet download information and the data packet attributes.

[0081] In some embodiments, the data packet download information includes multiple entries corresponding to multiple data packet download requests, and the observation system 220 determines a retrieval condition based on the data packet attributes and multiple fields included in the entries in the multiple entries, and the retrieval condition limits one or more fields in the multiple fields and corresponding field values ​​of the one or more fields; selects one or more entries from the multiple entries according to the retrieval condition; and determines one or more clients based on client identifiers in the one or more entries.

[0082] In some embodiments, the observation system 220 receives a query request for data risk factors, the query request includes factor information, and the observation system 220 also provides a response to the query request, the response indicating that one or more target clients have data risk factors.

[0083] In some implementations, the query request is received via at least one of: a graphical user interface, or an application programming interface.

[0084] In some embodiments, the data risk factor includes at least one of: a computer security breach or an incompatible software credential.

[0085] Figure 4 FIG. 4 is a schematic structural block diagram of an apparatus 400 for data risk management according to some embodiments of the present disclosure. The apparatus 400 may be implemented in or included in Figure 2In the observation system 220 shown in the figure, each module / component in the apparatus 400 may be implemented by hardware, software, firmware or any combination thereof.

[0086] As shown in the figure, the device 400 includes a data packet download information acquisition module 410, which is configured to acquire data packet download information for at least one data packet provider, and the data packet download information is related to requests of multiple clients to download data packets from at least one data packet provider. The device 400 also includes a factor information determination module 420, which is configured to determine factor information related to the data risk factor to be detected. The device 400 also includes a target client determination module 430, which is configured to determine one or more target clients with data risk factors from multiple clients based on the data packet download information and the factor information.

[0087] In some embodiments, the data packet download information acquisition module 410 can be specifically configured to: detect data packets on a data flow associated with one or more data packet providers among at least one data packet provider; and extract information on data packet download requests associated with one or more data packet providers from the detected data packets as at least a part of the data packet download information.

[0088] In some embodiments, the data traffic is traffic passing through a load balancer, which is connected to one or more data packet providers and is configured to coordinate data transmission loads between multiple clients and the one or more data packet providers.

[0089] In some embodiments, the data packet download information acquisition module 410 can be specifically configured to: obtain corresponding operation logs of one or more data packet providers among at least one data packet provider; and extract information on data packet download requests associated with one or more data packet providers from the corresponding operation logs as at least a part of the data packet download information.

[0090] In some embodiments, the data packet download information includes a first entry corresponding to a first data packet download request, and the first entry includes at least one of the following: an identifier of a client that initiates the first data packet download request, an attribute of a first data packet downloaded through the first data packet download request, an identifier of a data packet management system for downloading the first data packet, an identifier of a data packet provider that provides the first data packet, or download time information of the first data packet.

[0091] In some embodiments, the target client determination module 430 can be specifically configured to: determine the data packet attributes of the data packet with data risk factors based on factor information; and determine one or more clients that download the data packet with the data packet attributes as one or more target clients based on the data packet download information and the data packet attributes.

[0092] In some embodiments, the data packet download information includes multiple entries corresponding to multiple data packet download requests, and the target client determination module 430 can be specifically configured to: determine a retrieval condition based on the data packet attributes and multiple fields included in the entries in the multiple entries, the retrieval condition limiting one or more fields in the multiple fields and the corresponding field values ​​of the one or more fields; select one or more entries from the multiple entries according to the retrieval condition; and determine one or more clients based on the client identifiers in the one or more entries.

[0093] In some embodiments, the factor information determination module 430 can be specifically configured to: receive a query request for data risk factors, the query request includes factor information, and the device 400 also includes a response providing module, which is configured to provide a response to the query request, and the response indicates that one or more target clients have data risk factors.

[0094] In some implementations, the query request is received via at least one of: a graphical user interface, or an application programming interface.

[0095] In some embodiments, the data risk factor includes at least one of: a computer security breach or an incompatible software credential.

[0096] Figure 5 1 shows a block diagram of an electronic device 500 in which one or more embodiments of the present disclosure may be implemented. It should be understood that Figure 5 The electronic device 500 shown is merely exemplary and should not constitute any limitation on the functionality and scope of the embodiments described herein. Figure 5 The electronic device 500 shown may include or be implemented as Figure 2 Observation system 220 or Figure 4 Device 400.

[0097] like Figure 5 As shown, the electronic device 500 is in the form of a general electronic device. The components of the electronic device 500 may include, but are not limited to, one or more processors or processing units 510, a memory 520, a storage device 530, one or more communication units 540, one or more input devices 550, and one or more output devices 560. The processing unit 510 may be an actual or virtual processor and is capable of performing various processes according to a program stored in the memory 520. In a multi-processor system, multiple processing units execute computer executable instructions in parallel to improve the parallel processing capability of the electronic device 500.

[0098] The electronic device 500 typically includes a plurality of computer storage media. Such media may be any accessible media that is accessible to the electronic device 500, including but not limited to volatile and non-volatile media, removable and non-removable media. The memory 520 may be a volatile memory (e.g., registers, caches, random access memory (RAM)), a non-volatile memory (e.g., a read-only memory (ROM), an electrically erasable programmable read-only memory (EEPROM), flash memory), or some combination thereof. The storage device 530 may be a removable or non-removable medium, and may include a machine-readable medium, such as a flash drive, a disk, or any other medium, which may be capable of being used to store information and / or data and may be accessed within the electronic device 500.

[0099] The electronic device 500 may further include additional removable / non-removable, volatile / non-volatile storage media. Figure 5 As shown in , a disk drive for reading or writing from a removable, non-volatile disk (e.g., a "floppy disk") and an optical drive for reading or writing from a removable, non-volatile optical disk may be provided. In these cases, each drive may be connected to the bus (not shown) by one or more data media interfaces. The memory 520 may include a computer program product 525 having one or more program modules that are configured to perform various methods or actions of various embodiments of the present disclosure.

[0100] The communication unit 540 implements communication with other electronic devices through a communication medium. Additionally, the functions of the components of the electronic device 500 can be implemented in a single computing cluster or multiple computing machines that can communicate through a communication connection. Therefore, the electronic device 500 can operate in a networked environment using a logical connection with one or more other servers, a network personal computer (PC), or another network node.

[0101] The input device 550 may be one or more input devices, such as a mouse, a keyboard, a tracking ball, etc. The output device 560 may be one or more output devices, such as a display, a speaker, a printer, etc. The electronic device 500 may also communicate with one or more external devices (not shown) through the communication unit 540 as needed, such as a storage device, a display device, etc., communicate with one or more devices that allow a user to interact with the electronic device 500, or communicate with any device that allows the electronic device 500 to communicate with one or more other electronic devices (e.g., a network card, a modem, etc.). Such communication may be performed via an input / output (I / O) interface (not shown).

[0102] According to an exemplary implementation of the present disclosure, a computer-readable storage medium is provided, on which computer-executable instructions are stored, wherein the computer-executable instructions are executed by a processor to implement the method described above. According to an exemplary implementation of the present disclosure, a computer program product is also provided, which is tangibly stored on a non-transitory computer-readable medium and includes computer-executable instructions, and the computer-executable instructions are executed by a processor to implement the method described above.

[0103] Various aspects of the present disclosure are described herein with reference to the flowcharts and / or block diagrams of the methods, devices, equipment, and computer program products implemented according to the present disclosure. It should be understood that each box in the flowchart and / or block diagram and the combination of each box in the flowchart and / or block diagram can be implemented by computer-readable program instructions.

[0104] These computer-readable program instructions can be provided to a processing unit of a general-purpose computer, a special-purpose computer, or other programmable data processing device, thereby producing a machine, so that when these instructions are executed by the processing unit of the computer or other programmable data processing device, a device that implements the functions / actions specified in one or more boxes in the flowchart and / or block diagram is generated. These computer-readable program instructions can also be stored in a computer-readable storage medium, and these instructions cause the computer, programmable data processing device, and / or other equipment to work in a specific manner, so that the computer-readable medium storing the instructions includes a manufactured product, which includes instructions for implementing various aspects of the functions / actions specified in one or more boxes in the flowchart and / or block diagram.

[0105] Computer-readable program instructions can be loaded onto a computer, other programmable data processing apparatus, or other device so that a series of operational steps are performed on the computer, other programmable data processing apparatus, or other device to produce a computer-implemented process, so that the instructions executed on the computer, other programmable data processing apparatus, or other device implement the functions / actions specified in one or more boxes in the flowchart and / or block diagram.

[0106] The flow chart and block diagram in the accompanying drawings show the possible architecture, function and operation of the system, method and computer program product according to multiple implementations of the present disclosure. In this regard, each square box in the flow chart or block diagram can represent a part of a module, program segment or instruction, and a part of a module, program segment or instruction includes one or more executable instructions for realizing the logical function of the specification. In some implementations as replacements, the function marked in the square box can also occur in a sequence different from that marked in the accompanying drawings. For example, two continuous square boxes can actually be executed substantially in parallel, and they can sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each square box in the block diagram and / or flow chart, and the combination of the square boxes in the block diagram and / or flow chart can be realized by a special hardware-based system that performs the function or action of the specification, or can be realized by a combination of special hardware and computer instructions.

[0107] The above descriptions of various implementations of the present disclosure are exemplary, non-exhaustive, and not limited to the disclosed implementations. Many modifications and variations will be apparent to those of ordinary skill in the art without departing from the scope and spirit of the described implementations. The selection of terms used herein is intended to best explain the principles of the implementations, practical applications, or improvements to the technology in the market, or to enable other persons of ordinary skill in the art to understand the various implementations disclosed herein.

Claims

1. A data risk management method, comprising: Acquire data packet download information for at least one data packet provider, the data packet download information being related to requests of multiple clients to download data packets from the at least one data packet provider; Determine factor information related to the data risk factor to be detected; as well as Based on the data packet download information and the factor information, one or more target clients having the data risk factor are determined from the multiple clients.

2. The method according to claim 1, wherein obtaining data packet download information for at least one data packet provider comprises: detecting data packets on a data flow associated with one or more of the at least one data packet provider; as well as Information of a data packet download request associated with the one or more data packet providers is extracted from the detected data packets as at least a part of the data packet download information.

3. The method according to claim 2, wherein the data traffic is traffic passing through a load balancer, the load balancer is connected to the one or more data packet providers, and is configured to coordinate the data transmission load between the multiple clients and the one or more data packet providers.

4. The method according to claim 1, wherein obtaining data packet download information for at least one data packet provider comprises: Obtaining corresponding operation logs of one or more data packet providers among the at least one data packet provider; as well as Information of the data packet download request associated with the one or more data packet providers is extracted from the corresponding operation log as at least a part of the data packet download information.

5. The method according to claim 1, wherein the data packet download information comprises a first entry corresponding to a first data packet download request, and the first entry comprises at least one of the following: an identifier of the client that initiates the first data packet download request, an attribute of a first data packet downloaded by the first data packet download request, an identifier of a data packet management system for downloading said first data packet, an identifier of a data packet provider that provides the first data packet, or Download time information of the first data packet.

6. The method according to claim 1, wherein determining one or more target clients having the data risk factor from the plurality of clients comprises: Based on the factor information, determining a data packet attribute of a data packet having the data risk factor; as well as Based on the data packet download information and the data packet attributes, one or more clients that download the data packet with the data packet attributes are determined as the one or more target clients.

7. The method according to claim 6, wherein the data packet download information comprises a plurality of entries respectively corresponding to a plurality of data packet download requests, and determining a client among the plurality of clients that downloads a data packet having the data packet attribute comprises: Determining a search condition based on the data packet attribute and a plurality of fields included in an entry of the plurality of entries, the search condition limiting one or more fields of the plurality of fields and corresponding field values ​​of the one or more fields; Selecting one or more entries from the plurality of entries according to the search condition; as well as The one or more clients are determined based on the client identifications in the one or more entries.

8. The method according to claim 1, wherein determining factor information related to the data risk factor to be detected comprises: receiving a query request for the data risk factor, the query request including the factor information, and the method further comprising: A response to the query request is provided, the response indicating that the one or more target clients have the data risk factor.

9. The method of claim 8, wherein the query request is received by at least one of: Graphical user interface, or Application programming interface.

10. The method according to claim 1, wherein the data risk factor comprises at least one of the following: Computer security breaches, or Incompatible software credentials.

11. A device for data risk management, comprising: a data packet download information acquisition module, configured to acquire data packet download information for at least one data packet provider, the data packet download information being related to requests of multiple clients to download data packets from the at least one data packet provider; a factor information determination module, configured to determine factor information related to the data risk factor to be detected; as well as The target client determination module is configured to determine one or more target clients having the data risk factor from the multiple clients based on the data packet download information and the factor information.

12. An electronic device comprising: at least one processing unit; as well as At least one memory, the at least one memory being coupled to the at least one processing unit and storing instructions for execution by the at least one processing unit, the instructions causing the electronic device to perform the method according to any one of claims 1 to 10 when executed by the at least one processing unit.

13. A computer-readable storage medium having a computer program stored thereon, wherein the computer program can be executed by a processor to implement the method according to any one of claims 1 to 10.

14. A computer program product, comprising a computer program, which, when executed by a processor, implements the method according to any one of claims 1 to 10.

Images