Data leakage disposal method and device, storage medium and electronic equipment

Abstract

The invention discloses a data leakage disposal method and device, a storage medium and electronic device.The method comprises the steps that in response to triggering of an operation request, a call chain and a data operation request of an application program are intercepted; according to the call chain and the data operation request, a detection result is determined, and the detection result comprises a data leakage result; and executing a corresponding treatment action according to the detection result. According to the method, data leakage is detected by using the information of the call chain and the data operation request, so that the data leakage result can be quickly obtained, the response time is shortened, the accuracy of data leakage detection is enhanced, the conditions of false alarm and missing alarm are reduced, and further, an instant early warning function can be provided, and a data leakage event is effectively prevented. The corresponding processing action is automatically executed according to the detection result, so that the response efficiency of the data leakage event is improved, and the potential loss is reduced to the maximum extent.

Description

Technical Field

[0001] The present invention relates to the field of computer technology, and in particular to a data leakage handling method, device, storage medium and electronic device. Background Art

[0002] With the rapid advancement of digital transformation, the collection, storage and use of personal data have become an important part of modern Internet and mobile applications. However, privacy data leakage incidents occur frequently, resulting in the abuse or theft of user information, causing serious economic losses and reputation damage to enterprises. Against the backdrop of increasingly stringent data protection regulations such as the Personal Information Protection Law, enterprises face the major challenge of effectively preventing data leakage under the premise of compliance. Traditional data leakage protection solutions often rely on static rule configuration or predefined detection for specific scenarios. These methods lack flexibility and are difficult to adapt to rapidly changing application environments. Summary of the invention

[0003] This specification provides a data leakage handling method, device, storage medium and electronic device, and the technical solution is as follows:

[0004] In a first aspect, this specification provides a data leakage handling method, the method comprising:

[0005] In response to triggering of an operation request, intercepting the application's call chain and data operation request;

[0006] Determine a detection result according to the call chain and the data operation request, wherein the detection result includes a data leakage result;

[0007] According to the detection result, a corresponding treatment action is performed.

[0008] In a second aspect, this specification provides a data leakage handling device, the device comprising:

[0009] A call interception module, used to intercept the call chain and data operation request of the application program in response to the triggering of the operation request;

[0010] A leakage detection module, used to determine a detection result according to the call chain and the data operation request, wherein the detection result includes a data leakage result;

[0011] The action handling module is used to execute corresponding handling actions according to the detection results.

[0012] In a third aspect, the present specification provides a computer storage medium, wherein the computer storage medium stores a plurality of instructions, wherein the instructions are suitable for being loaded by a processor and executing the above-mentioned method steps.

[0013] In a fourth aspect, the present specification provides an electronic device, which may include: a processor and a memory; wherein the memory stores a computer program, and the computer program is suitable for being loaded by the processor and executing the above-mentioned method steps.

[0014] In a fifth aspect, the present specification provides a computer program product, which stores at least one instruction, and the at least one instruction is loaded by a processor to execute any one of the above method steps.

[0015] The beneficial effects brought by the technical solutions provided by some embodiments of this specification include at least:

[0016] The data leakage disposal method proposed in this specification can dynamically monitor the flow path of data and timely discover potential data leakage risks by intercepting and analyzing the call chain and data operation requests of the application in real time. By using the information of the call chain and data operation request to detect data leakage, the data leakage results can be obtained quickly, the response time can be reduced, and the accuracy of data leakage detection can be enhanced, and false positives and missed positives can be reduced, thereby providing an immediate warning function and effectively preventing the occurrence of data leakage incidents. The corresponding disposal actions are automatically executed according to the detection results, which improves the response efficiency of data leakage incidents, thereby minimizing potential losses. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] In order to more clearly illustrate the technical solutions in this specification or the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this specification. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0018] Figure 1 This is a scenario diagram of a data leakage handling system provided in this manual.

[0019] Figure 2 This is a flowchart of a data leakage handling method provided in this manual.

[0020] Figure 3 is based on Figure 2 A specific implementation flowchart of step S200 in the data leakage handling method shown in the corresponding embodiment.

[0021] Figure 4 is based on Figure 2 Another specific implementation flowchart of step S200 in the data leakage handling method shown in the corresponding embodiment.

[0022] Figure 5 is based on Figure 2A specific implementation flowchart of step S300 in the data leakage handling method shown in the corresponding embodiment.

[0023] Figure 6 is based on Figure 5 A specific implementation flowchart of step S310 in the data leakage handling method shown in the corresponding embodiment.

[0024] Figure 7 This is a structural diagram of a data leakage handling device provided in this specification.

[0025] Figure 8 It is a structural schematic diagram of an electronic device provided in this manual;

[0026] Fig. 9 It is a schematic diagram of the structure of the operating system and user space provided in this manual;

[0027] Fig.10 yes Fig. 9 The architecture diagram of the Android operating system;

[0028] Fig.11 yes Fig. 9 Architecture diagram of the IOS operating system. DETAILED DESCRIPTION

[0029] The following will be combined with the drawings in this specification to clearly and completely describe the technical solutions in this specification. Obviously, the described embodiments are only part of the embodiments of this specification, not all of the embodiments. Based on the embodiments in this specification, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this specification.

[0030] In the description of this specification, it should be understood that the terms "first", "second", etc. are only used for descriptive purposes and cannot be understood as indicating or implying relative importance. In the description of this specification, it should be noted that, unless otherwise clearly specified and limited, "including" and "having" and any of their variations are intended to cover non-exclusive inclusions. For example, a process, method, system, product or device that includes a series of steps or units is not limited to the listed steps or units, but optionally also includes steps or units that are not listed, or optionally also includes other steps or units inherent to these processes, methods, products or devices. For those of ordinary skill in the art, the specific meanings of the above terms in this specification can be understood in specific circumstances. In addition, in the description of this specification, unless otherwise specified, "multiple" refers to two or more. "And / or" describes the association relationship of associated objects, indicating that there can be three relationships, for example, A and / or B, which can represent: A exists alone, A and B exist at the same time, and B exists alone. The character " / " generally indicates that the associated objects before and after are an "or" relationship.

[0031] The present specification is described in detail below with reference to specific embodiments.

[0032] See also Figure 1 , is a scenario diagram of a data leakage handling system provided in this specification. Figure 1 As shown, the data leakage handling system may include at least a client cluster and a service platform 100 .

[0033] The client cluster may include at least one client, such as Figure 1 As shown, it specifically includes client 1 corresponding to user 1, client 2 corresponding to user 2, ..., client n corresponding to user n, where n is an integer greater than 0.

[0034] Each client in the client cluster may be an electronic device with communication function, including but not limited to: wearable device, handheld device, personal computer, tablet computer, vehicle-mounted device, smart phone, computing device or other processing device connected to a wireless modem, etc. Electronic devices may be called different names in different networks, such as: user equipment, access terminal, user unit, user station, mobile station, mobile station, remote station, remote terminal, mobile device, user terminal, terminal, wireless communication device, user agent or user device, cellular phone, cordless phone, personal digital assistant (PDA), electronic device in 5G network or future evolution network, etc.

[0035] The service platform 100 can be a separate server device, such as a rack-mounted, blade, tower, or cabinet-mounted server device, or a workstation, mainframe computer, or other hardware device with strong computing power; it can also be a server cluster composed of multiple servers, and the servers in the service cluster can be composed in a symmetrical manner, wherein each server has equivalent functions and status in the transaction link, and each server can provide services to the outside independently, and the independent service can be understood as not requiring the assistance of other servers.

[0036] In one or more embodiments of the present specification, the service platform 100 can establish a communication connection with at least one client in the client cluster, and complete data interaction during the data leakage disposal process based on the communication connection, such as transaction data interaction of online call chains and data operation requests, and transaction data includes but is not limited to various types of transaction request data interaction. The specific transaction service type is determined based on the actual application situation.

[0037] It should be noted that the service platform 100 and at least one client in the client cluster establish a communication connection through a network for interactive communication, wherein the network can be a wireless network or a wired network, the wireless network includes but is not limited to a cellular network, a wireless local area network, an infrared network or a Bluetooth network, and the wired network includes but is not limited to Ethernet, a universal serial bus (USB) or a controller local area network. In one or more embodiments of the specification, technologies and / or formats including Hyper Text Mark-up Language (HTML), Extensible Markup Language (XML), etc. are used to represent data (such as a target compressed package) exchanged through a network. In addition, conventional encryption technologies such as Secure Socket Layer (SSL), Transport Layer Security (TLS), Virtual Private Network (VPN), Internet Protocol Security (IPsec), etc. can also be used to encrypt all or some links. In other embodiments, customized and / or dedicated data communication technologies can also be used to replace or supplement the above data communication technologies.

[0038] The data leakage handling system embodiment provided in this specification and the data leakage handling method in one or more embodiments belong to the same concept. The execution subject corresponding to the data leakage handling method involved in one or more embodiments of the specification can be the above-mentioned service platform 100; the execution subject corresponding to the data leakage handling method involved in one or more embodiments of the specification can also be the electronic device corresponding to the client, which is determined based on the actual application environment. The embodiment of the data leakage handling system and its implementation process can be detailed in the following method embodiment, which will not be repeated here.

[0039] based on Figure 1 The scenario diagram is shown, and the data leakage handling method provided by one or more embodiments of this specification is introduced in detail below.

[0040] See also Figure 2 , a flow chart of a data leakage handling method is provided for one or more embodiments of the present specification, the method can be implemented by a computer program and can be run on a data leakage handling device based on the von Neumann system. The computer program can be integrated into an application or run as an independent tool application. The data leakage handling device can be a service platform.

[0041] Specifically, the data leakage disposal method includes:

[0042] S100, in response to triggering an operation request, intercepting a call chain and a data operation request of an application.

[0043] S200, determining a detection result according to the call chain and the data operation request, wherein the detection result includes a data leakage result.

[0044] S300: Execute corresponding treatment actions according to the detection result.

[0045] In the embodiments of this specification, by intercepting and analyzing the call chain and data operation request of the application in real time, the flow path of data can be dynamically monitored and potential data leakage risks can be discovered in time. By using the information of the call chain and data operation request to detect data leakage, the data leakage results can be quickly obtained, the response time can be reduced, and the accuracy of data leakage detection can be enhanced, and false positives and false negatives can be reduced, thereby providing an immediate warning function and effectively preventing the occurrence of data leakage incidents. The corresponding disposal actions are automatically executed according to the detection results, which improves the response efficiency of data leakage incidents, thereby minimizing potential losses.

[0046] In S100, by intercepting the application's call chain and data operation requests, the application's behavior and data processing process can be fully captured, providing a basis for subsequent data analysis and enhancing the transparency of data flow.

[0047] In some embodiments of the present application, aspects can be used to intercept the application's call chain and data operation requests. That is, aspects are embedded in the key modules of the application to dynamically monitor the application's data operation behavior in different usage scenarios (such as data processing, transmission, and storage operations). Aspects can dynamically intercept the application's call chain and implement data leakage detection without affecting the original transaction logic.

[0048] Aspects are a programming technique that allows you to dynamically add or modify functions while the program is running by cross-cutting concerns (such as logging, permission control, etc.) without changing the original transaction logic. Aspects can perform specific operations at specific entry points to achieve cross-module reuse of functions.

[0049] In S200, by analyzing the call chain and data request, it is possible to accurately determine whether data leakage has occurred, reduce misjudgments, and improve detection efficiency and accuracy.

[0050] Specifically, in some embodiments, the specific implementation of step S200 can be found in Figure 3 . Figure 3 is based on Figure 2 The detailed description of step S200 in the data leakage handling method shown in the corresponding embodiment, in the data leakage handling method, step S200 may include the following steps:

[0051] S210: Analyze the data operation request and identify the current data usage scenario.

[0052] S220: Detect whether there is data leakage in the call chain according to the current usage scenario, and obtain a data leakage result.

[0053] In this embodiment, by identifying the current data usage scenario, the system can better understand the data usage context, thereby improving the pertinence and effectiveness of data monitoring. Data leakage detection based on the current data usage scenario, combined with data usage scenario and call chain analysis, can more accurately determine which operations may cause data leakage, improve the early warning capability of potential data leakage incidents, enhance the overall security protection of the system, and thus reduce the false alarm rate.

[0054] In S210, the calling context of the application is analyzed to identify the current data usage scenario, such as data access, data storage, data transmission, etc. And combined with the predefined scenario model, it is determined whether plain text access or transmission of private data is allowed in the scenario.

[0055] In S220, combining the current data usage scenario with the call chain helps to accurately locate potential security risks, identify specific data leakage situations in a timely manner, and provide a basis for quickly taking countermeasures.

[0056] Specifically, in some embodiments, the specific implementation of step S220 can refer to the following embodiments. Figure 3 The detailed description of step S220 in the data leakage handling method shown in the corresponding embodiment, in the data leakage handling method, step S220 may include the following steps:

[0057] Determine whether plain text access or transmission of private data is allowed in the current usage scenario;

[0058] If the current usage scenario allows plain text access or transmission of private data, the data leakage result is determined to be no data leakage;

[0059] If plaintext access or transmission of private data is not allowed in the current usage scenario, a check is performed in the call chain to determine whether there is any reading or transmission of plaintext private data;

[0060] If there is no reading or transmission of plaintext private data, the data leakage result is determined to be that the data has not been leaked;

[0061] If there is reading or transmission of plaintext private data, the data leakage result is determined to be that the data has been leaked.

[0062] In this embodiment, different data access policies are adjusted according to different data usage scenarios. By clearly defining the access rights to privacy data in different data usage scenarios, the flexibility and adaptability of data protection in complex environments can be improved, and the risk of data leakage can be effectively reduced and data security can be enhanced.

[0063] Specifically, first determine whether plaintext access or transmission of private data is allowed in the current data usage scenario. If plaintext access or transmission of private data is allowed in the current data usage scenario, it proves that data confidentiality does not need to be maintained in this scenario, and private data can be transmitted in plaintext. Naturally, there is no possibility of data leakage, so the data leakage result can be directly determined as no data leakage. If plaintext access or transmission of private data is not allowed in the current data usage scenario, it proves that data confidentiality needs to be maintained in this scenario, and only then does there exist the possibility of data leakage. In order to determine whether there is a data leakage, a detection is performed in the call chain to determine whether there is any reading or transmission of plaintext private data. If the reading or transmission of plaintext private data is detected in an unauthorized scenario (i.e., a scenario where plaintext access or transmission of private data is not allowed), it is considered a data leakage, otherwise, the data is not leaked. The above detection logic is based on dynamic scene matching and data type identification technology.

[0064] Specifically, in some other embodiments, the specific implementation of step S200 can be found in Figure 4 . Figure 4 is based on Figure 2The detailed description of step S200 in the data leakage handling method shown in the corresponding embodiment, in the data leakage handling method, step S200 may include the following steps:

[0065] S280, extract features from the call chain and the data operation request to obtain a call feature vector and a request feature vector.

[0066] S290, input the calling feature vector and the request feature vector together into a detection model for detection to obtain a detection result.

[0067] In this embodiment, by extracting features from call chains and data operation requests, more representative feature information can be obtained, thereby improving the accuracy and reliability of the detection model and reducing the probability of false positives and false negatives. Complex and multi-dimensional call feature vectors and request feature vectors can adapt to a variety of application scenarios and enhance their flexibility and adaptability. By analyzing the extracted features using a neural network model, automated threat detection can be achieved, the intelligence level of the system can be improved, and the need for manual intervention can be reduced.

[0068] In S280, the original call chain and request information are converted into feature vectors to reduce the complexity of the data and make subsequent processing more efficient. At the same time, different calls and requests can be compared through standardized feature vectors to facilitate the identification of abnormal behaviors.

[0069] In S290, the use of detection models for analysis can use advanced algorithms to gain a deeper understanding of the extracted features and discover potential safety hazards. Through the feedback of the detection model, it can provide users with explanations of the detection results, help users understand the judgment basis of the system, and enhance trust.

[0070] Specifically, in some other embodiments, the specific implementation of step S290 can refer to the following embodiments. Figure 4 The detailed description of step S290 in the data leakage handling method shown in the corresponding embodiment, in the data leakage handling method, step S290 may include the following steps:

[0071] Inputting the request feature vector into a scene detection sub-model to obtain a scene feature vector;

[0072] Input the scene vector and the call feature vector together into the leakage detection sub-model for detection to obtain a leakage feature vector;

[0073] The detection result is obtained according to the scene feature vector and the leakage feature vector.

[0074] In this embodiment, by dividing the detection into two sub-models, scene detection and leakage detection, and processing different types of features (scenes and leakages) respectively, it is possible not only to identify abnormal situations in a targeted manner, reduce misjudgments, and improve the accuracy and reliability of detection results; it is also possible to more comprehensively analyze data requests and calling behaviors, thereby improving the system's recognition rate of potential threats.

[0075] First, this embodiment inputs the request feature vector into the scene detection sub-model, simplifies the request features, and extracts the scene feature vector to effectively identify the specific scenario in which the data request is located, distinguish between normal and abnormal scenarios, help establish contextual understanding, facilitate subsequent analysis and processing, and improve overall detection efficiency.

[0076] Then, this embodiment inputs the scene vector and the call feature vector into the leakage detection sub-model together. By combining the scene features and the call features for joint detection and comparing different feature vectors, it can better identify potential data leakage risks, consider the contextual environment, and then more accurately determine whether there is data leakage, improve the comprehensiveness of detection, and thus reduce the possibility of underreporting.

[0077] Finally, this embodiment integrates the outputs of the two sub-models and forms the final detection result by clarifying the relationship between the source of the feature vector and the detection result, which enhances the interpretability of the result, makes the final decision result more scientific and reasonable, and provides more convincing safety feedback.

[0078] The above detection models need to be trained together. In some other embodiments, the two sub-models of scene detection and leakage detection can also be pre-trained separately and then trained together.

[0079] Specifically, the training method of the above detection model specifically includes:

[0080] The feature vector sample pair set is obtained, wherein the feature vector sample pair set includes a plurality of feature vector sample pairs, each feature vector sample pair includes a calling feature vector and a request feature vector, and is marked with a corresponding detection tag.

[0081] The feature vector sample pairs are input into the detection model one by one to obtain the detection results.

[0082] According to the output detection result and the detection label, the parameters of the detection model are updated until a predetermined end condition is reached, and the training is terminated to obtain a trained detection model.

[0083] In an embodiment of the present application, during training, a feature vector sample pair set including multiple feature vector sample pairs can be first obtained, each feature vector sample pair includes a calling feature vector and a request feature vector, and is marked with a corresponding detection label; then the multiple feature vector sample pairs are divided into a training set, a validation set, and a test set according to a predetermined ratio, and then the parameters of the encoder and decoder in the detection model are adjusted and determined according to the feature vector sample pairs included in the training set, the validation set, and the test set to obtain a trained detection model.

[0084] It should be noted that the above-mentioned feature vector sample pairs include feature vector sample pairs with different scenarios, different requests and different call information, so as to improve the model's recognition ability for different scenarios.

[0085] When training the model, the feature vector sample pair set can be divided into a training set, a validation set, and a test set, and then training is performed based on the training set, validation is performed based on the validation set, and testing is performed based on the test set to obtain a trained detection model.

[0086] Before training based on the training set, the feature vector sample pairs in the training set can be preprocessed. The preprocessing includes data adjustment, normalization, data enhancement, and category encoding.

[0087] The specific method for data augmentation is to add small random noise (such as Gaussian noise) to the numerical value of the call feature vector, and linearly combine multiple feature vectors to generate a new feature vector, and randomly select two features to exchange them to simulate different call modes; and randomly change the values ​​of certain parameters in the request feature vector (for example, randomly select an ID, status, etc.), add additional pseudo fields to simulate the complexity of the request (for example, add some random user agent strings), and fine-tune the request timestamp to simulate network delays or differences in user behavior.

[0088] In some embodiments, the GAN network can also be used to generate some special call feature vectors and request feature vectors, which can help the algorithm model accurately identify rare leakage scenarios, help reduce misidentification and missed identification, and help improve the accuracy of the model in identifying data leakage in special scenarios.

[0089] After obtaining the enhanced training set, the detection model can be trained based on the enhanced training set to update the parameters and weights in the network.

[0090] Specifically, the feature vector sample pairs in the training set are input into the detection model to obtain the detection results output by the detection model. The detection results are compared with the detection labels and the loss function is calculated. The stochastic gradient descent method is then used to minimize the loss function, and the parameters and weights in the detection model are updated by back propagation until the loss function meets the predetermined conditions, such as convergence or less than a predetermined threshold.

[0091] In some embodiments, the detection result includes the current usage scenario and the data leakage result, and the detection label may include at least one of the scenario label and the data leakage label. When calculating the loss function, the loss function is obtained by comparing the current usage scenario with the scenario label and comparing the data leakage result with the data leakage label, or it can also be obtained by directly comparing only the data leakage result with the data leakage label.

[0092] After training, the detection network with updated parameters of the training set can be verified based on the validation set. Specifically, the detection network is debugged based on the validation set data, and when the loss function meets the predetermined conditions, the model parameters of this stage are output. If the loss function does not meet the predetermined conditions, the hyperparameters such as the learning rate are automatically adjusted to train the next round of network model.

[0093] When the loss function calculated on the validation set meets the predetermined conditions, the parameters and weights can be retained, and then the retained parameters can be tested based on the test set. Specifically, the test set data is input so that the detection network with retained parameters and weights can output the detection results and model weights. The model loss and corresponding weights of multiple rounds are compared, and the model weight with the minimum loss is output to determine the trained detection model.

[0094] After obtaining the trained detection model, detection can be completed based on the detection model.

[0095] In addition, no data augmentation is required for the data input in the validation set and the test set.

[0096] In S300, automated disposal actions can take immediate measures to prevent further data loss, optimize emergency response processes, and improve overall security management levels.

[0097] Specifically, in some embodiments, the specific implementation of step S300 can be found in Figure 5 . Figure 5 is based on Figure 2 The detailed description of step S300 in the data leakage handling method shown in the corresponding embodiment, in the data leakage handling method, step S300 may include the following steps:

[0098] S310: Determine a corresponding target handling action according to the detection result.

[0099] S320, executing the target processing action on the data flow of the application.

[0100] In this embodiment, by determining the disposal action based on the detection results, the system can flexibly adjust the response strategy for different threats or abnormal situations, thereby improving the effectiveness of security defense. After determining the target disposal action, the disposal action is performed on the data flow of the application, which can directly intervene and manage the data transmission process, further ensuring the security of sensitive information. This embodiment ensures that when a security incident is detected, it can respond quickly and effectively, reduce risks and strengthen data protection.

[0101] In S310, the disposal action is determined according to the detection results, which can ensure that the disposal measures are in line with the actual security situation and improve the pertinence and effectiveness of the disposal. The corresponding disposal actions include interception, nullification, encryption, desensitization, etc. The disposal strategy can be configured according to specific transaction needs to ensure that personal data is protected to the greatest extent without affecting normal transaction operations.

[0102] Specifically, in some embodiments, the specific implementation of step S310 can be found in Figure 6 . Figure 6 is based on Figure 5 The detailed description of step S310 in the data leakage handling method shown in the corresponding embodiment, in the data leakage handling method, step S310 may include the following steps:

[0103] S312, determining whether the current usage scene is a preset scene.

[0104] S314: If the current usage scenario is a preset scenario, determine the target processing action as a preset processing action, and the preset processing action includes at least one of plain text, encryption, and desensitization.

[0105] S316: If the current usage scenario is not a preset scenario, determine the target handling action as a standard handling action, where the standard handling action includes at least one of interception and neutralization.

[0106] In the embodiment of the present application, the detection result includes the current usage scenario and the data leakage result.

[0107] When determining the corresponding target disposal action, first determine whether the current usage scenario is a preset scenario in the whitelist. If it is not a preset scenario, directly use the general standard action for disposal, that is, determine the target disposal action as the standard disposal action. If it is a preset scenario, then according to the specific preset scenario, execute the corresponding preset action for disposal, that is, determine the target disposal action as the preset disposal action. That is, this embodiment determines whether the current usage scenario is a preset scenario. According to different usage scenarios, the system can select preset disposal actions (such as plain text, encryption, desensitization) or standard disposal actions (such as interception, blanking), thereby improving the pertinence and adaptability of disposal measures, helping to reduce the risk of false alarms and mishandling, and reducing unnecessary interference and waste of resources.

[0108] In S312, by determining whether the current usage scenario is a preset scenario, the preset scenario and the non-preset scenario are clearly distinguished. According to different usage scenarios, the system will perform different actions.

[0109] In S314, corresponding processing actions (such as plain text, encryption, and desensitization) are adopted for known preset scenarios, which can quickly adapt to and ensure the compliance and security of data use.

[0110] Specifically, in some embodiments, the specific implementation of step S314 can refer to the following embodiments. Figure 6 The detailed description of step S314 in the data leakage handling method shown in the corresponding embodiment, in the data leakage handling method, step S314 may include the following steps:

[0111] If the current usage scenario is a preset scenario, the data leakage result is read.

[0112] If the data leakage result is that the data has been leaked, the target processing action is determined to be a first preset processing action, and the first preset processing action includes at least one of encryption and desensitization.

[0113] If the data leakage result is that the data is not leaked, the target processing action is determined to be a second preset processing action, and the second preset processing action includes plain text.

[0114] In this embodiment, for known preset scenarios, the disposal strategy can be flexibly adjusted according to the current usage scenario and data leakage situation, and the corresponding disposal action can be automatically selected, thereby improving the response speed and accuracy. At the same time, by selectively selecting encryption, desensitization or plain text processing, unnecessary resource waste is avoided and efficiency is improved.

[0115] Specifically, after confirming that the data has been leaked, encryption or desensitization measures are immediately taken to effectively reduce the risk of leakage and protect sensitive information. After confirming that the data has not been leaked, it is allowed to process the data in plain text, which improves the flexibility and convenience of operations and reduces interference with data processing.

[0116] Desensitization refers to the use of technical means to deform sensitive information so that it cannot directly identify an individual, thereby protecting privacy. This action can be used when the current usage scenario is related to identity authentication, for example, replacing part of the digits in the ID number with "*".

[0117] Encryption refers to the encryption of data to prevent unauthorized reading or tampering. The encrypted data will be decrypted on the server side of the application. Decryption is the reverse process of encryption and is used to restore the data before encryption.

[0118] Plain text means directly using plain text to transmit data. When the data leakage result is that the data has not been leaked and the current usage scenario allows plain text access or transmission of private data, plain text can be directly used to transmit data.

[0119] In S316, standard handling actions (such as interception and clearing) are taken for unknown or abnormal scenarios, which can timely prevent potential security threats and avoid data leakage or abuse.

[0120] Interception refers to preventing unauthorized data circulation or access through set rules during data transmission or processing.

[0121] Specifically, in other embodiments, the specific implementation of step S320 can refer to the following embodiments. Figure 5 The detailed description of step S320 in the data leakage handling method shown in the corresponding embodiment, in the data leakage handling method, step S320 may include the following steps:

[0122] Feature engineering is performed on the detection result to obtain a detection result vector.

[0123] The detection result vector is input into the action handling model to obtain the target handling action.

[0124] In this embodiment, through feature engineering, the original detection results are converted into structured data vectors, and key features are extracted, which enhances the availability of information and ensures that the data input into the disposal model is more accurate. The disposal actions can also be flexibly adjusted for different types of data leakage situations to adapt to a variety of application scenarios, thereby improving the decision-making accuracy of the target disposal actions.

[0125] At the same time, the selection of disposal actions through the neural network model and the integration of detection results and the generation of disposal actions reduce human intervention, enabling the system to have self-learning capabilities, continuously optimize and adjust disposal strategies, adapt to complex and changing environments, and improve response speed, so that potential data leakage incidents can be responded to more quickly in real time.

[0126] In some embodiments of the present specification, when performing feature engineering, the data can also be cleaned, filtered and selected. Through feature selection, irrelevant or redundant information can be removed to improve the training and reasoning efficiency of subsequent models.

[0127] Specifically, in some embodiments, the training method of the above-mentioned action handling model includes:

[0128] A detection result vector sample set is obtained, wherein the detection result vector sample set includes a plurality of detection result vector samples, and each of the detection result vector samples is marked with a corresponding handling action label in advance.

[0129] All the detection result vector samples in the detection result vector sample set are input into the action handling model one by one to obtain the target handling action.

[0130] According to the target handling action and the handling action label, the parameters of the action handling model are updated until a predetermined end condition is reached, and the training is terminated to obtain a trained action handling model.

[0131] Specifically, in some embodiments, updating the parameters of the action handling model according to the target handling action and the handling action label until a predetermined end condition is reached, and the training is terminated. Obtaining the trained action handling model may specifically include:

[0132] If, in the detection result vector sample set, less than a predetermined number of detection result vector samples are input into the action handling model, and the target handling action is obtained to be consistent with the marked handling action label, the parameters of the action handling model are updated.

[0133] If, in the detection result vector sample set, more than a predetermined number of detection result vector samples are input into the action handling model and the target handling action obtained is consistent with the marked handling action label, then the predetermined end condition is met, the training is ended, and a trained action handling model is obtained.

[0134] Specifically, in some other embodiments, updating the parameters of the action handling model according to the target handling action and the handling action label until a predetermined end condition is reached, and the training is terminated. Obtaining the trained action handling model may specifically include:

[0135] A loss function is determined based on the target disposal action and the disposal action label.

[0136] The parameters of the action handling model are updated according to the loss function until a predetermined end condition is reached, and the training is terminated to obtain a trained action handling model.

[0137] In this embodiment, the loss function reaching a predetermined end condition may be that the loss function converges or the loss function is less than a predetermined loss (eg, 0.001).

[0138] In S320, directly intervening in the data flow can effectively prevent violations such as data leakage or improper access, thereby improving data security.

[0139] In some embodiments, after S400, the method further includes:

[0140] The detection result and the treatment action are recorded.

[0141] In this embodiment, the detection results and disposal actions are recorded to form a disposal log, which can ensure that the handling of each security incident is traceable and enhance the transparency of the system. The disposal log also forms a feedback mechanism, providing a basis for future system optimization and improvement, forming a closed loop of continuous learning.

[0142] At the same time, by accumulating historical records, the disposal logs obtained can be used for data analysis to identify common risk patterns, thereby providing important reference for future decision-making and helping to optimize disposal strategies.

[0143] The following will be combined Figure 7 , the data leakage handling device provided in this specification is introduced in detail. It should be noted that Figure 7 The data leakage handling device shown is used to execute this instruction Figure 1 to Figure 6 For the convenience of explanation, only the parts related to this specification are shown. For the specific technical details not disclosed, please refer to this specification. Figure 1 to Figure 6 The embodiment shown.

[0144] See also Figure 7 , which shows a schematic diagram of the structure of the data leakage handling device of this specification. The data leakage handling device 700 can be implemented as all or part of the user terminal through software, hardware or a combination of both. According to some embodiments, the data leakage handling device 700 includes a call interception module 710, a leakage detection module 720 and an action handling module 730.

[0145] Among them, the call interception module 710 is used to intercept the call chain and data operation request of the application in response to the triggering of the operation request; the leakage detection module 720 is used to determine the detection result based on the call chain and the data operation request, and the detection result includes the data leakage result; the action handling module 730 is used to perform corresponding handling actions according to the detection result.

[0146] Specifically, in some optional embodiments of the present application, the leakage detection module specifically includes: a scene recognition submodule, used to analyze the data operation request and identify the current data usage scene; a leakage detection submodule, used to detect whether there is data leakage in the call chain according to the current data usage scene, and obtain a data leakage result.

[0147] Specifically, in some optional embodiments of the present application, the leakage detection submodule specifically includes: a scenario determination unit, which is used to determine whether plain text access or transmission of privacy data is allowed in the current data usage scenario; a first judgment unit, which is used to determine that the data leakage result is not leaked if plain text access or transmission of privacy data is allowed in the current data usage scenario; a call detection unit, which is used to detect in the call chain to determine whether there is reading or transmission of plain text privacy data if plain text access or transmission of privacy data is not allowed in the current data usage scenario; a second judgment unit, which is used to determine that the data leakage result is not leaked if there is no reading or transmission of plain text privacy data; and a third judgment unit, which is used to determine that the data leakage result is leaked if there is reading or transmission of plain text privacy data.

[0148] Specifically, in some optional embodiments of the present application, the action handling module specifically includes: an action determination submodule, used to determine the corresponding target handling action based on the detection result; and an action execution submodule, used to execute the target handling action on the data flow of the application.

[0149] Specifically, in some optional embodiments of the present application, the detection result includes a current digital usage scenario, and the action determination submodule specifically includes: a scenario judgment unit, used to judge whether the current digital usage scenario is a preset scenario; a first determination unit, used to determine that the target disposal action is a preset disposal action if the current digital usage scenario is the preset scenario, and the preset disposal action includes at least one of plain text, encryption, and desensitization; a second determination unit, used to determine that the target disposal action is a standard disposal action if the current digital usage scenario is not the preset scenario, and the standard disposal action includes at least one of interception and nullification.

[0150] Specifically, in some optional embodiments of the present application, the first determination unit is specifically used to perform: if the current usage scenario is a preset scenario, then read the data leakage result; if the data leakage result is that the data has been leaked, then determine the target disposal action to be a first preset disposal action, and the first preset disposal action includes at least one of encryption and desensitization. If the data leakage result is that the data has not been leaked, then determine the target disposal action to be a second preset disposal action, and the second preset disposal action includes plain text.

[0151] Specifically, in some optional embodiments of the present application, the action determination submodule specifically includes: a feature engineering unit, used to perform feature engineering on the detection result to obtain a detection result vector; and a model determination unit, used to input the detection result vector into an action handling model to obtain a target handling action.

[0152] Specifically, in some optional embodiments of the present application, the data leakage handling device also includes: a log recording module, which is used to record the detection result and the handling action.

[0153] Specifically, in some optional embodiments of the present application, the leakage detection module specifically includes: a feature extraction submodule, used to extract features from the call chain and the data operation request to obtain a call feature vector and a request feature vector; a neural network submodule, used to input the call feature vector and the request feature vector into a detection model for detection to obtain a detection result.

[0154] Specifically, in some optional embodiments of the present application, the detection model includes a scene detection sub-model and a leakage detection sub-model, and the neural network sub-module specifically includes: a scene detection unit, used to input the request feature vector into the scene detection sub-model to obtain a scene feature vector; a leakage detection unit, used to input the scene vector and the call feature vector together into the leakage detection sub-model for detection to obtain a leakage feature vector; a comprehensive detection unit, used to obtain the detection result based on the scene feature vector and the leakage feature vector.

[0155] It should be noted that the data leakage handling device provided in the above embodiment only uses the division of the above functional modules as an example when executing the data leakage handling method. In actual applications, the above functions can be assigned to different functional modules as needed, that is, the internal structure of the device is divided into different functional modules to complete all or part of the functions described above. In addition, the data leakage handling device provided in the above embodiment and the data leakage handling method embodiment belong to the same concept, and the implementation process thereof is detailed in the method embodiment, which will not be repeated here.

[0156] The above serial numbers in this specification are for description only and do not represent the advantages or disadvantages of the embodiments.

[0157] In the embodiments of this specification, by intercepting and analyzing the call chain and data operation request of the application in real time, the flow path of data can be dynamically monitored and potential data leakage risks can be discovered in time. By using the information of the call chain and data operation request to detect data leakage, the data leakage results can be quickly obtained, the response time can be reduced, and the accuracy of data leakage detection can be enhanced, and false positives and false negatives can be reduced, thereby providing an immediate warning function and effectively preventing the occurrence of data leakage incidents. The corresponding disposal actions are automatically executed according to the detection results, which improves the response efficiency of data leakage incidents, thereby minimizing potential losses.

[0158] The present specification also provides a computer storage medium, which can store multiple instructions, which are suitable for being loaded and executed by a processor as described above. Figure 1 to Figure 6 The data leakage handling method of the embodiment shown in the figure can be found in the specific execution process. Figure 1 to Figure 6 The specific description of the illustrated embodiment will not be repeated here.

[0159] The present specification also provides a computer program product, which stores at least one instruction, and the at least one instruction is loaded and executed by the processor as described above. Figure 1 to Figure 6 The data leakage handling method of the embodiment shown in the figure can be found in the specific execution process. Figure 1 to Figure 6 The specific description of the illustrated embodiment will not be repeated here.

[0160] Please refer to Figure 8 , which shows a block diagram of the structure of an electronic device provided by an exemplary embodiment of this specification. The electronic device in this specification may include one or more of the following components: a processor 110, a memory 120, an input device 130, an output device 140, and a bus 150. The processor 110, the memory 120, the input device 130, and the output device 140 may be connected via the bus 150.

[0161] The processor 110 may include one or more processing cores. The processor 110 uses various interfaces and lines to connect various parts of the entire electronic device, and executes various functions and processes data of the electronic device 100 by running or executing instructions, programs, code sets or instruction sets stored in the memory 120, and calling data stored in the memory 120. Optionally, the processor 110 can be implemented in at least one hardware form of digital signal processing (DSP), field-programmable gate array (FPGA), and programmable logic array (PLA). The processor 110 can integrate one or a combination of a central processing unit (CPU), a graphics processing unit (GPU), and a modem. Among them, the CPU mainly processes the operating system, user interface, and application programs; the GPU is responsible for rendering and drawing display content; and the modem is used to process wireless communications. It can be understood that the above-mentioned modem may not be integrated into the processor 110, but may be implemented separately through a communication chip.

[0162] The memory 120 may include a random access memory (RAM) or a read-only memory (ROM). Optionally, the memory 120 includes a non-transitory computer-readable storage medium. The memory 120 may be used to store instructions, programs, codes, code sets or instruction sets. The memory 120 may include a program storage area and a data storage area, wherein the program storage area may store instructions for implementing an operating system, instructions for implementing at least one function (such as a touch function, a sound playback function, an image playback function, etc.), instructions for implementing the following various method embodiments, etc. The operating system may be an Android system, including a system deeply developed based on the Android system, an IOS system developed by Apple, including a system deeply developed based on the IOS system or other systems. The data storage area may also store data created by the electronic device during use, such as a phone book, audio and video data, chat record data, etc.

[0163] See also Fig. 9As shown, the memory 120 can be divided into an operating system space and a user space. The operating system runs in the operating system space, and native and third-party applications run in the user space. In order to ensure that different third-party applications can achieve good operating results, the operating system allocates corresponding system resources to different third-party applications. However, different application scenarios in the same third-party application also have different requirements for system resources. For example, in the local resource loading scenario, the third-party application has higher requirements for disk reading speed; in the animation rendering scenario, the third-party application has higher requirements for GPU performance. The operating system and third-party applications are independent of each other, and the operating system often cannot perceive the current application scenario of the third-party application in a timely manner, resulting in the operating system being unable to perform targeted system resource adaptation according to the specific application scenario of the third-party application.

[0164] In order for the operating system to distinguish the specific application scenarios of third-party applications, it is necessary to open up data communication between third-party applications and the operating system so that the operating system can obtain the current scenario information of third-party applications at any time, and then perform targeted system resource adaptation based on the current scenario.

[0165] Taking the Android operating system as an example, the programs and data stored in the memory 120 are as follows: Fig.10As shown, the memory 120 may store a Linux kernel layer 320, a system runtime library layer 340, an application framework layer 360 and an application layer 380, wherein the Linux kernel layer 320, the system runtime library layer 340 and the application framework layer 360 belong to the operating system space, and the application layer 380 belongs to the user space. The Linux kernel layer 320 provides underlying drivers for various hardware of electronic devices, such as display drivers, audio drivers, camera drivers, Bluetooth drivers, Wi-Fi drivers, power management, etc. The system runtime library layer 340 provides the main feature support for the Android system through some C / C++ libraries. For example, the SQLite library provides database support, the OpenGL / ES library provides 3D drawing support, and the Webkit library provides browser kernel support, etc. The Android runtime library (Android runtime) is also provided in the system runtime library layer 340, which mainly provides some core libraries that allow developers to use the Java language to write Android applications. The application framework layer 360 provides various APIs that may be used when building applications. Developers can also use these APIs to build their own applications, such as activity management, window management, view management, notification management, content provider, package management, call management, resource management, and location management. At least one application runs in the application layer 380. These applications can be native applications that come with the operating system, such as contact applications, text messaging applications, clock applications, camera applications, etc.; they can also be third-party applications developed by third-party developers, such as game applications, instant messaging applications, photo beautification applications, etc.

[0166] Taking the operating system as an IOS system as an example, the programs and data stored in the memory 120 are as follows: Fig.11As shown, the IOS system includes: a core operating system layer 420 (Core OS layer), a core service layer 440 (Core Services layer), a media layer 460 (Media layer), and a touchable layer 480 (Cocoa Touch Layer). The core operating system layer 420 includes the operating system kernel, drivers, and underlying program frameworks, which provide functions closer to the hardware for use by the program framework located in the core service layer 440. The core service layer 440 provides system services and / or program frameworks required by the application, such as the foundation framework, account framework, advertising framework, data storage framework, network connection framework, geographic location framework, motion framework, etc. The media layer 460 provides audio-visual interfaces for the application, such as graphics and image related interfaces, audio technology related interfaces, video technology related interfaces, and wireless playback (AirPlay) interfaces for audio and video transmission technologies. The touchable layer 480 provides various commonly used interface-related frameworks for application development, and the touchable layer 480 is responsible for the user's touch interaction operations on the electronic device. For example, local notification service, remote push service, advertising framework, game tool framework, message user interface (UI) framework, user interface UIKit framework, map framework, etc.

[0167] exist Fig.11 Among the frameworks shown, the frameworks related to most applications include but are not limited to: the basic framework in the core service layer 440 and the UIKit framework in the touchable layer 480. The basic framework provides many basic object classes and data types, provides the most basic system services for all applications, and has nothing to do with UI. The classes provided by the UIKit framework are basic UI class libraries for creating touch-based user interfaces. iOS applications can provide UIs based on the UIKit framework, so it provides the basic architecture of applications for building user interfaces, drawing, processing and user interaction events, responding to gestures, etc.

[0168] Among them, the method and principle of implementing data communication between third-party applications and the operating system in the IOS system can be referred to the Android system, and this manual will not go into details here.

[0169] Among them, the input device 130 is used to receive input instructions or data, and the input device 130 includes but is not limited to a keyboard, a mouse, a camera, a microphone or a touch device. The output device 140 is used to output instructions or data, and the output device 140 includes but is not limited to a display device and a speaker. In one example, the input device 130 and the output device 140 can be combined, and the input device 130 and the output device 140 are touch screens, which are used to receive touch operations on or near them by users using any suitable objects such as fingers and touch pens, and to display the user interfaces of various applications. The touch screen is usually set on the front panel of the electronic device. The touch screen can be designed as a full screen, a curved screen or a special-shaped screen. The touch screen can also be designed as a combination of a full screen and a curved screen, or a combination of a special-shaped screen and a curved screen, which is not limited in this specification.

[0170] In addition, those skilled in the art will appreciate that the structure of the electronic device shown in the above drawings does not constitute a limitation on the electronic device, and the electronic device may include more or fewer components than shown, or combine certain components, or arrange the components differently. For example, the electronic device also includes a radio frequency circuit, an input unit, a sensor, an audio circuit, a wireless fidelity (WiFi) module, a power supply, a Bluetooth module and other components, which will not be described in detail here.

[0171] In this specification, the execution subject of each step may be the electronic device described above. Optionally, the execution subject of each step is the operating system of the electronic device. The operating system may be an Android system, an IOS system, or other operating systems, which is not limited in this specification.

[0172] The electronic device of this specification may also be equipped with a display device, which may be any device capable of realizing a display function, such as a cathode ray tube display (CR), a light-emitting diode display (LED), an electronic ink screen, a liquid crystal display (LCD), a plasma display panel (PDP), etc. The user may use the display device on the electronic device 101 to view displayed text, images, videos and other information. The electronic device may be a smart phone, a tablet computer, a gaming device, an AR (Augmented Reality) device, a car, a data storage device, an audio playback device, a video playback device, a notebook, a desktop computing device, a wearable device such as an electronic watch, an electronic glasses, an electronic helmet, an electronic bracelet, an electronic necklace, electronic clothing and other devices.

[0173] exist Figure 8 In the electronic device shown, which may be a terminal, the processor 110 may be used to call a network optimization application stored in the memory 120, and specifically perform the following operations: in response to triggering an operation request, intercept the application's call chain and data operation request; determine a detection result based on the call chain and the data operation request, the detection result including a data leakage result; and perform a corresponding disposal action based on the detection result.

[0174] In one embodiment, the processor 110, when executing the detection result including the current data usage scenario and the data leakage result, determines the detection result based on the call chain and the data operation request, and specifically performs the following operations: analyzing the data operation request to identify the current data usage scenario; detecting whether there is data leakage in the call chain according to the current data usage scenario to obtain the data leakage result.

[0175] In one embodiment, when the processor 110 executes the detection of whether there is data leakage in the call chain according to the current data usage scenario and obtains the data leakage result, the following specific operations are performed: determining whether plain text access or transmission of privacy data is allowed in the current data usage scenario; if plain text access or transmission of privacy data is allowed in the current data usage scenario, determining that the data leakage result is that the data is not leaked; if plain text access or transmission of privacy data is not allowed in the current data usage scenario, detecting in the call chain to determine whether there is plain text privacy data reading or transmission; if there is no plain text privacy data reading or transmission, determining that the data leakage result is that the data is not leaked; if there is plain text privacy data reading or transmission, determining that the data leakage result is that the data has been leaked.

[0176] In one embodiment, when executing the corresponding processing action according to the detection result, the processor 110 specifically performs the following operations: determining the corresponding target processing action according to the detection result; and executing the target processing action on the data flow of the application.

[0177] In one embodiment, the detection result includes the current usage scenario, and the processor 110, when determining the corresponding target handling action according to the detection result, specifically performs the following operations:

[0178] Determine whether the current data usage scenario is a preset scenario; if the current data usage scenario is a preset scenario, determine the target handling action to be the preset handling action, and the preset handling action includes at least one of plain text, encryption, and desensitization; if the current data usage scenario is not a preset scenario, determine the target handling action to be a standard handling action, and the standard handling action includes at least one of interception and setting in the air.

[0179] In one embodiment, when the processor 110 executes the step of determining the target handling action as the preset handling action if the current data usage scenario is the preset scenario, the processor 110 specifically performs the following operations: if the current data usage scenario is the preset scenario, the data leakage result is read; if the data leakage result is that the data has been leaked, the target handling action is determined to be the first preset handling action, and the first preset handling action includes at least one of encryption and desensitization; if the data leakage result is that the data has not been leaked, the target handling action is determined to be the second preset handling action, and the second preset handling action includes plain text.

[0180] In one embodiment, when the processor 110 determines the corresponding target handling action based on the detection result, it specifically performs the following operations: performing feature engineering on the detection result to obtain a detection result vector; inputting the detection result vector into an action handling model to obtain a target handling action.

[0181] In one embodiment, after executing the corresponding treatment action according to the detection result, the processor 110 further performs the following operations: recording the detection result and the treatment action.

[0182] In one embodiment, when the processor 110 determines the detection result based on the call chain and the data operation request, it specifically performs the following operations: extracting features from the call chain and the data operation request to obtain a call feature vector and a request feature vector; inputting the call feature vector and the request feature vector into a detection model for detection to obtain a detection result.

[0183] In one embodiment, the detection model includes a scene detection sub-model and a leakage detection sub-model. When the processor 110 executes the step of inputting the calling feature vector and the request feature vector into the detection model for detection to obtain a detection result, the following specific operations are performed: inputting the request feature vector into the scene detection sub-model to obtain a scene feature vector; inputting the scene vector and the calling feature vector together into the leakage detection sub-model for detection to obtain a leakage feature vector; and obtaining the detection result based on the scene feature vector and the leakage feature vector.

[0184] In the embodiments of this specification, by intercepting and analyzing the call chain and data operation request of the application in real time, the flow path of data can be dynamically monitored and potential data leakage risks can be discovered in time. By using the information of the call chain and data operation request to detect data leakage, the data leakage results can be quickly obtained, the response time can be reduced, and the accuracy of data leakage detection can be enhanced, and false positives and false negatives can be reduced, thereby providing an immediate warning function and effectively preventing the occurrence of data leakage incidents. The corresponding disposal actions are automatically executed according to the detection results, which improves the response efficiency of data leakage incidents, thereby minimizing potential losses.

[0185] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiments can be implemented by instructing related hardware through a computer program, and the program can be stored in a computer-readable storage medium, and when the program is executed, it can include the processes of the embodiments of the above-mentioned methods. The storage medium can be a disk, an optical disk, a read-only storage memory, or a random access memory, etc.

[0186] It should be noted that the information (including but not limited to user device information, user personal information, etc.), data (including but not limited to data used for analysis, stored data, displayed data, etc.) and signals involved in the embodiments of this specification are all authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with the relevant laws, regulations and standards of the relevant countries and regions. For example, the object features, interactive behavior features and user information involved in this specification are all obtained with full authorization.

[0187] The above disclosure is only the preferred embodiment of this specification, which certainly cannot be used to limit the scope of rights of this specification. Therefore, equivalent changes made according to the claims of this specification are still within the scope covered by this specification.

Claims

1. A data leakage handling method, the method comprising: In response to triggering of an operation request, intercepting the application's call chain and data operation request; Determine a detection result according to the call chain and the data operation request, wherein the detection result includes a data leakage result; According to the detection result, a corresponding treatment action is performed.

2. According to the method of claim 1, the detection result includes the current usage scenario and the data leakage result, and the determining the detection result according to the call chain and the data operation request specifically includes: Analyze the data operation request and identify the current data usage scenario; According to the current usage scenario, detect whether there is data leakage in the call chain to obtain a data leakage result.

3. According to the method of claim 2, the detecting whether there is data leakage in the call chain according to the current usage scenario to obtain the data leakage result specifically includes: Determine whether plain text access or transmission of private data is allowed in the current usage scenario; If the current usage scenario allows plain text access or transmission of private data, the data leakage result is determined to be no data leakage; If plaintext access or transmission of private data is not allowed in the current usage scenario, a check is performed in the call chain to determine whether there is any reading or transmission of plaintext private data; If there is no reading or transmission of plaintext private data, the data leakage result is determined to be that the data has not been leaked; If there is reading or transmission of plaintext private data, the data leakage result is determined to be that the data has been leaked.

4. The method according to claim 1, wherein the performing corresponding treatment actions according to the detection result specifically comprises: Determine a corresponding target handling action according to the detection result; The target handling action is performed on the data flow of the application.

5. According to the method of claim 4, the detection result includes the current usage scenario, and the determining of the corresponding target handling action according to the detection result specifically includes: Determine whether the current usage scene is a preset scene; If the current usage scenario is a preset scenario, determining the target processing action to be a preset processing action, wherein the preset processing action includes at least one of plain text, encryption, and desensitization; If the current usage scenario is not a preset scenario, the target handling action is determined to be a standard handling action, and the standard handling action includes at least one of interception and neutralization.

6. The method according to claim 5, wherein if the current usage scenario is a preset scenario, determining the target processing action as the preset processing action specifically comprises: If the current usage scenario is a preset scenario, reading the data leakage result; If the data leakage result is that the data has been leaked, determining the target processing action to be a first preset processing action, wherein the first preset processing action includes at least one of encryption and desensitization; If the data leakage result is that the data is not leaked, the target processing action is determined to be a second preset processing action, and the second preset processing action includes plain text.

7. The method according to claim 4, wherein determining a corresponding target handling action according to the detection result specifically comprises: Performing feature engineering on the detection result to obtain a detection result vector; The detection result vector is input into the action handling model to obtain the target handling action.

8. The method according to claim 1, after performing a corresponding treatment action according to the detection result, the method further comprises: The detection result and the treatment action are recorded.

9. According to the method of claim 1, determining the detection result according to the call chain and the data operation request specifically comprises: Extracting features from the call chain and the data operation request to obtain a call feature vector and a request feature vector; The calling feature vector and the request feature vector are input into a detection model for detection to obtain a detection result.

10. The method according to claim 9, wherein the detection model includes a scene detection sub-model and a leakage detection sub-model, and the inputting the call feature vector and the request feature vector into the detection model for detection to obtain the detection result specifically includes: Inputting the request feature vector into a scene detection sub-model to obtain a scene feature vector; Input the scene vector and the call feature vector together into the leakage detection sub-model for detection to obtain a leakage feature vector; The detection result is obtained according to the scene feature vector and the leakage feature vector.

11. A data leakage handling device, the device comprising: A call interception module, used to intercept the call chain and data operation request of the application program in response to the triggering of the operation request; A leakage detection module, used to determine a detection result according to the call chain and the data operation request, wherein the detection result includes a data leakage result; The action handling module is used to execute corresponding handling actions according to the detection results.

12. A computer storage medium storing a plurality of instructions, wherein the instructions are suitable for being loaded by a processor and executing the method steps according to any one of claims 1 to 10.

13. A computer program product, the computer program product storing at least one instruction, wherein the at least one instruction is loaded by a processor and executes the method steps according to any one of claims 1 to 10.

14. An electronic device comprising: A processor and a memory; wherein the memory stores a computer program, and the computer program is suitable for being loaded by the processor and executing the method steps as claimed in any one of claims 1 to 10.

Images