A data leakage handling method and device, a storage medium and an electronic device

Abstract

The specification discloses a data leakage handling method and device, a storage medium and an electronic device, wherein the method comprises: in response to a trigger of an operation request, intercepting a call chain and a data operation request of an application; determining a detection result according to the call chain and the data operation request, the detection result comprising a data leakage result; and performing a corresponding handling action according to the detection result. The specification uses the information of the call chain and the data operation request to detect data leakage, can quickly obtain a data leakage result, reduce response time, enhance the accuracy of data leakage detection, reduce false positives and false negatives, and can provide instant early warning functions to effectively prevent data leakage events. According to the detection result, the corresponding handling action is automatically performed, the response efficiency of the data leakage event is improved, and the potential loss is minimized.

Description

TECHNICAL FIELD

[0001] The present specification relates to the technical field of computer technology, and particularly relates to a data leakage handling method and device, a storage medium and an electronic equipment. BACKGROUND

[0002] With the rapid advancement of digital transformation, the collection, storage and use of personal data have become an important part of modern Internet and mobile applications. However, privacy data leakage incidents occur frequently, resulting in misuse or theft of user information, causing serious economic losses and reputation damage to enterprises. Under the background of increasingly stringent data protection regulations such as the Personal Information Protection Law, enterprises are facing the major challenge of effectively preventing data leakage under the premise of compliance. Traditional data leakage protection solutions often rely on static rule configuration or predefined detection in specific scenarios, and these methods lack flexibility and are difficult to adapt to rapidly changing application environments. SUMMARY

[0003] The present specification provides a data leakage handling method, device, storage medium and electronic equipment, and the technical solution is as follows:

[0004] In a first aspect, the present specification provides a data leakage handling method, and the method comprises:

[0005] In response to triggering of an operation request, intercepting a call chain and a data operation request of an application program;

[0006] According to the call chain and the data operation request, determining a detection result, the detection result comprising a data leakage result;

[0007] According to the detection result, performing a corresponding handling action.

[0008] In a second aspect, the present specification provides a data leakage handling device, and the device comprises:

[0009] A call interception module, configured to intercept a call chain and a data operation request of an application program in response to triggering of an operation request;

[0010] A leakage detection module, configured to determine a detection result according to the call chain and the data operation request, the detection result comprising a data leakage result;

[0011] An action handling module, configured to perform a corresponding handling action according to the detection result.

[0012] In a third aspect, the present specification provides a computer storage medium, which stores a plurality of instructions, the instructions being adapted to be loaded and executed by a processor to perform the method steps described above.

[0013] In a fourth aspect, the present specification provides an electronic device, which can include: a processor and a memory; wherein the memory stores a computer program, and the computer program is adapted to be loaded by the processor and execute the method steps described above.

[0014] In a fifth aspect, the present specification provides a computer program product, which stores at least one instruction, and the at least one instruction is loaded by a processor and executes the method steps of any one of the above aspects.

[0015] The technical solutions provided by some embodiments of the present specification have at least the following beneficial effects:

[0016] The data leakage handling method proposed in the present specification can dynamically monitor the flow path of data by real-time interception and analysis of the call chain and data operation request of the application program, and timely discover potential data leakage risks. The use of call chain and data operation request information for data leakage detection can quickly obtain data leakage results, reduce response time, and also enhance the accuracy of data leakage detection, reduce false positives and omissions, and thus provide instant early warning functions to effectively prevent data leakage events. According to the detection results, the corresponding handling actions are automatically executed, which improves the response efficiency of data leakage events, thereby minimizing potential losses. BRIEF DESCRIPTION OF DRAWINGS

[0017] In order to more clearly illustrate the technical solutions in the present specification or the prior art, the following will briefly introduce the drawings needed to be used in the embodiments or prior art description. Obviously, the drawings in the following description are only some embodiments of the present specification, and for those skilled in the art, other drawings can also be obtained without creative labor on the basis of these drawings.

[0018] Figure 1 is a scene schematic diagram of a data leakage handling system provided by the present specification.

[0019] Figure 2 is a flowchart of a data leakage handling method provided by the present specification.

[0020] Figure 3 is a specific implementation flowchart of step S200 in the data leakage handling method according to Figure 2 is a specific implementation flowchart of step S200 in the data leakage handling method according to

[0021] Figure 4 is a specific implementation flowchart of step S200 in the data leakage handling method according to Figure 2 is another specific implementation flowchart of step S200 in the data leakage handling method according to

[0022] Figure 5 is another specific implementation flowchart of step S200 in the data leakage handling method according to Figure 2A specific implementation flow chart of step S300 in the data leakage handling method shown in the corresponding embodiment.

[0023] Figure 6 According to Figure 5 A specific implementation flow chart of step S310 in the data leakage handling method shown in the corresponding embodiment.

[0024] Figure 7 A structural schematic diagram of a data leakage handling device provided in the present specification.

[0025] Figure 8 A structural schematic diagram of an electronic device provided in the present specification.

[0026] Figure 9 A structural schematic diagram of an operating system and a user space provided in the present specification.

[0027] Figure 10 An architecture diagram of an Android operating system. Figure 9 An architecture diagram of an Android operating system.

[0028] Figure 11 An architecture diagram of an IOS operating system. Figure 9 An architecture diagram of an IOS operating system. DETAILED DESCRIPTION

[0029] The technical solutions in the present specification will be described clearly and completely in combination with the drawings in the present specification. Obviously, the described embodiments are only some of the embodiments of the present specification, but not all the embodiments. Based on the embodiments in the present specification, all the other embodiments obtained by those skilled in the art without creative labor fall within the protection scope of the present specification.

[0030] In the description of the specification, it is understood that the terms "first", "second" and the like are used only for the purpose of description, and cannot be understood as indicating or implying relative importance. In the description of the specification, it is necessary to explain that, unless otherwise explicitly specified and limited, "including" and "having" and any variations thereof are intended to cover non-exclusive inclusion. For example, a process, method, system, product or device including a series of steps or units is not limited to the listed steps or units, but optionally also includes steps or units not listed, or optionally also includes other steps or units inherent to the process, method, product or device. The above terms can be specifically understood in the specification. In addition, in the description of the specification, "multiple" means two or more, unless otherwise specified. "And / or", the association relationship between the associated objects, means that there can be three relationships, for example, A and / or B can mean that A exists alone, A and B exist together, and B exists alone. The character " / " generally represents a "or" relationship between the associated objects before and after.

[0031] The specification will be described in detail below in conjunction with specific embodiments.

[0032] Please refer to Figure 1 , a scenario diagram of a data leakage handling system provided in the specification. As Figure 1 indicated, the data leakage handling system can at least include a client cluster and a service platform 100.

[0033] The client cluster can include at least one client, such as Figure 1 indicated, specifically including client 1 corresponding to user 1, client 2 corresponding to user 2,..., and client n corresponding to user n, n being an integer greater than 0.

[0034] Each client in the client cluster can be an electronic device with communication function, including but not limited to: wearable devices, handheld devices, personal computers, tablet computers, vehicle-mounted devices, smart phones, computing devices or other processing devices connected to wireless modems, etc. In different networks, the electronic device can be called by different names, such as: user equipment, access terminal, user unit, user station, mobile station, mobile station, remote station, remote terminal, mobile device, user terminal, terminal, wireless communication device, user agent or user device, cellular phone, cordless phone, personal digital assistant (PDA), 5G network or future evolution network electronic device, etc.

[0035] The service platform 100 can be a single server device, such as a rack-mounted, blade, tower, or cabinet server device, or a hardware device with strong computing power such as a workstation, a mainframe computer, etc. The service platform 100 can also be a server cluster composed of multiple servers. The servers in the server cluster can be symmetrically composed, that is, each server is functionally and positionally equivalent in the transaction link, and each server can independently provide services. The independent service can be understood as not requiring the assistance of another server.

[0036] In one or more embodiments of the present specification, the service platform 100 can establish a communication connection with at least one client in the client cluster, and based on the communication connection, complete the interaction of data in the data leakage handling process, such as the interaction of transaction data such as online call chains and data operation requests. The transaction data includes but is not limited to various types of transaction request data interactions, and the specific transaction service type is determined based on the actual application situation.

[0037] It should be noted that the service platform 100 and at least one client in the client cluster establish a communication connection through a network for interactive communication. The network can be a wireless network or a wired network. The wireless network includes but is not limited to a cellular network, a wireless local area network, an infrared network, or a Bluetooth network. The wired network includes but is not limited to an Ethernet network, a universal serial bus (USB) network, or a controller area network. In one or more embodiments of the specification, technologies and / or formats including Hyper Text Mark-up Language (HTML), Extensible Markup Language (XML), etc. are used to represent data exchanged through the network (such as the target compressed package). In addition, all or some links can be encrypted using conventional encryption technologies such as Secure Socket Layer (SSL), Transport Layer Security (TLS), Virtual Private Network (VPN), Internet Protocol Security (IPsec), etc. In other embodiments, custom and / or dedicated data communication technologies can be used instead of or in addition to the above data communication technologies.

[0038] The data leakage handling system embodiments provided by the specification belong to the same concept as the data leakage handling method in one or more embodiments. The execution subject of the data leakage handling method corresponding to the one or more embodiments of the specification can be the service platform 100 described above. The execution subject of the data leakage handling method corresponding to the one or more embodiments of the specification can also be the electronic device corresponding to the client, which is determined based on the actual application environment. The implementation process of the data leakage handling system embodiment can be seen from the method embodiments described below, which will not be described here.

[0039] Based on Figure 1 The following describes in detail the data leakage handling method provided by one or more embodiments of the specification based on the scenario schematic diagram shown in the figure.

[0040] Please refer to Figure 2 A flowchart of a data leakage handling method is provided in one or more embodiments of the specification. The method can be implemented by relying on a computer program and can run on a data leakage handling device based on the von Neumann architecture. The computer program can be integrated in an application or run as a standalone tool application. The data leakage handling device can be a service platform.

[0041] Specifically, the data leakage handling method includes:

[0042] S100, in response to the triggering of an operation request, intercepting the call chain of an application and a data operation request.

[0043] S200, determining a detection result according to the call chain and the data operation request, the detection result including a data leakage result.

[0044] S300, performing a corresponding handling action according to the detection result.

[0045] In the embodiments of the specification, by real-time intercepting and analyzing the call chain and data operation request of the application, the flow path of the data can be dynamically monitored, and potential data leakage risks can be discovered in time. Using the information of the call chain and the data operation request for data leakage detection can quickly obtain the data leakage result, reduce the response time, and also enhance the accuracy of data leakage detection, reduce false positives and omissions, and thus provide immediate warning function, effectively prevent the occurrence of data leakage events. According to the detection result, the corresponding handling action is automatically executed, which improves the response efficiency of the data leakage event, thereby minimizing potential losses.

[0046] In S100, by intercepting the call chain and data operation request of the application, the behavior and data processing process of the application can be fully captured, providing a basis for subsequent data analysis and enhancing the transparency of data flow.

[0047] In some embodiments of the present application, an aspect can be used to intercept the call chain and data operation request of an application. That is, an aspect is embedded in a key module of the application to dynamically monitor the data operation behavior (such as data processing, transmission and storage operation) of the application in different use scenarios. The aspect can dynamically intercept the call chain of the application, and realize the data leakage detection function without affecting the original transaction logic.

[0048] Among them, the aspect is a programming technology, which is used to dynamically add or modify functions by crossing the concern points (such as log recording, permission control, etc.) at runtime without changing the original transaction logic. The aspect can execute specific operations on specific points, realizing the cross-module reuse of functions.

[0049] In S200, by analyzing the call chain and data request, it can be accurately judged whether data leakage occurs, reducing false judgments and improving the efficiency and accuracy of detection.

[0050] Specifically, in some embodiments, the specific implementation of step S200 can refer to Figure 3 . Figure 3 is the specific implementation of step S200 in the data leakage handling method according to Figure 2 the corresponding embodiment, wherein step S200 can include the following steps:

[0051] S210, analyzing the data operation request and identifying the current use scenario.

[0052] S220, detecting whether there is data leakage in the call chain according to the current use scenario, and obtaining a data leakage result.

[0053] In this embodiment, by identifying the current use scenario, the system can better understand the data use context, thereby improving the pertinence and effectiveness of data monitoring. Based on the current use scenario for data leakage detection, combined with use scenario and call chain analysis, it can more accurately judge which operation may cause data leakage, improve the early warning ability of potential data leakage events, and enhance the overall security protection of the system, thereby reducing the false positive rate.

[0054] In S210, by analyzing the call context of the application, the current use scenario such as data access, data storage, data transmission, etc. is identified. And combined with the pre-defined scene model, it is judged whether plaintext access or transmission of private data is allowed in this scenario.

[0055] In S220, the current use scenario is combined with the call chain, which helps to accurately locate potential security risks and identify specific data leakage situations in time, providing a basis for taking prompt measures.

[0056] Specifically, in some embodiments, the specific implementation of step S220 can refer to the following embodiments. The embodiments are based on the data leakage handling method shown in the corresponding embodiments Figure 3 The specific description of step S220 in the data leakage handling method shown in the corresponding embodiments, wherein step S220 can include the following steps:

[0057] determining whether plaintext access or transmission of private data is allowed in the current use scenario;

[0058] If plaintext access or transmission of private data is allowed in the current use scenario, it is determined that the data leakage result is that the data is not leaked;

[0059] If plaintext access or transmission of private data is not allowed in the current use scenario, it is determined whether there is reading or transmission of plaintext private data in the call chain;

[0060] If there is no reading or transmission of plaintext private data, it is determined that the data leakage result is that the data is not leaked;

[0061] If there is reading or transmission of plaintext private data, it is determined that the data leakage result is that the data is leaked.

[0062] In this embodiment, different data access strategies are adjusted according to different use scenarios. By explicitly defining the access rights of private data in different use scenarios, the flexibility and adaptability of data protection in complex environments can be improved, and the risk of data leakage can be effectively reduced, and the data security can be enhanced.

[0063] Specifically, it is first determined whether plaintext access or transmission of private data is allowed in the current use scenario. If plaintext access or transmission of private data is allowed in the current use scenario, it is proved that data security is not needed in this scenario, and private data can be transmitted in plaintext, so there is no possibility of data leakage, and therefore the data leakage result can be directly determined as data not leaked. If plaintext access or transmission of private data is not allowed in the current use scenario, it is proved that data security is needed in this scenario, and therefore there is a possibility of data leakage. In order to determine whether there is data leakage, it is determined whether there is reading or transmission of plaintext private data in the call chain. If reading or transmission of plaintext private data is detected in an unauthorized scenario (i.e., a scenario where plaintext access or transmission of private data is not allowed), it is considered as data leakage, otherwise, the data is not leaked. The above detection logic is based on dynamic scenario matching and data type identification technology.

[0064] Specifically, in some other embodiments, the specific implementation of step S200 can refer to the following embodiments Figure 4 . Figure 4 is based on the data leakage handling method shown in the corresponding embodiments Figure 2Corresponding to the detailed description of step S200 in the data leakage handling method shown in the embodiment, in the data leakage handling method, step S200 can include the following steps:

[0065] S280, feature extraction is performed on the call chain and the data operation request to obtain a call feature vector and a request feature vector.

[0066] S290, the call feature vector and the request feature vector are input into a detection model for detection to obtain a detection result.

[0067] In this embodiment, by performing feature extraction on the call chain and the data operation request, more representative feature information can be obtained, thereby improving the accuracy and reliability of the detection model and reducing the probability of false positives and false negatives. The complex multi-dimensional call feature vector and request feature vector can adapt to diversified application scenarios, enhancing their flexibility and adaptability. By using a neural network model to analyze the extracted features, automated threat detection can be achieved, improving the intelligent level of the system and reducing the need for manual intervention.

[0068] In S280, the original call chain and request information are converted into feature vectors, reducing the complexity of the data and making subsequent processing more efficient. At the same time, different calls and requests can be compared through standardized feature vectors, facilitating the identification of abnormal behavior.

[0069] In S290, analysis is performed using a detection model, which can utilize advanced algorithms to understand the extracted features at a deeper level and discover potential security risks. Through the feedback of the detection model, the user can be provided with an explanation of the detection result, helping the user understand the basis for the system's judgment and enhancing trust.

[0070] Specifically, in some other embodiments, the specific implementation of step S290 can refer to the following embodiments. This embodiment is based on Figure 4 Corresponding to the detailed description of step S290 in the data leakage handling method shown in the embodiment, in the data leakage handling method, step S290 can include the following steps:

[0071] The request feature vector is input into a scene detection sub-model to obtain a scene feature vector;

[0072] The scene feature vector and the call feature vector are input into a leakage detection sub-model for detection to obtain a leakage feature vector;

[0073] The detection result is obtained according to the scene feature vector and the leakage feature vector.

[0074] In the embodiment, by dividing the detection into two sub-models of scene detection and leakage detection, different types of features (scene and leakage) are processed respectively, which not only can identify abnormal situations pertinently, reduce misjudgment, and improve the accuracy and reliability of the detection result, but also can more comprehensively analyze the data request and calling behavior, thereby improving the identification rate of potential threats.

[0075] Firstly, the request feature vector is input into the scene detection sub-model in the embodiment, the request feature is simplified, and the scene feature vector is extracted, so as to effectively identify the specific scene of the data request, distinguish between normal and abnormal scenes, help establish context understanding, facilitate subsequent analysis and processing, and improve the overall detection efficiency.

[0076] Then, the scene feature vector and the calling feature vector are input into the leakage detection sub-model in the embodiment, the joint detection is performed by combining the scene feature and the calling feature, the potential data leakage risk can be better identified by comparing different feature vectors, the context environment is considered, and then whether there is data leakage can be more accurately judged, the comprehensiveness of the detection is improved, and the possibility of false negatives is reduced.

[0077] Finally, the outputs of the two sub-models are integrated in the embodiment, the relationship between the source of the feature vector and the detection result is clear, the final detection result is formed, the result is more explainable, the final decision result is more scientific and reasonable, and more persuasive security feedback is provided.

[0078] The detection model needs to be trained together, and in other embodiments, the two sub-models of scene detection and leakage detection can also be pre-trained and then trained together.

[0079] Specifically, the training method of the detection model includes the following steps:

[0080] Obtain the set of feature vector sample pairs, the set of feature vector sample pairs contains a plurality of feature vector sample pairs, each feature vector sample pair contains a calling feature vector and a request feature vector, and is labeled with a corresponding detection label.

[0081] The feature vector sample pairs are input into the detection model one by one to obtain the detection result.

[0082] According to the output detection result and the detection label, the parameters of the detection model are updated until a predetermined end condition is reached, the training is ended, and a trained detection model is obtained.

[0083] In the embodiments of the present application, during training, a set of feature vector sample pairs containing a plurality of feature vector sample pairs can be obtained first, each feature vector sample pair contains a calling feature vector and a request feature vector, and is labeled with a corresponding detection label; then the plurality of feature vector sample pairs are divided into a training set, a validation set and a test set according to a predetermined proportion, and then the parameters of the encoder and the decoder in the detection model are adjusted and determined according to the feature vector sample pairs included in the training set, the validation set and the test set, to obtain a trained detection model.

[0084] It should be noted that the feature vector sample pair described above contains feature vector sample pairs with different scenes, different requests and different calling information, so as to improve the recognition ability of the model for different scenes.

[0085] During model training, the set of feature vector sample pairs can be divided into a training set, a validation set and a test set, then training is performed based on the training set, validation is performed based on the validation set, and testing is performed based on the test set, to obtain a trained detection model.

[0086] Before training based on the training set, the feature vector sample pairs in the training set can be preprocessed. The preprocessing includes data adjustment, normalization, data enhancement, and class encoding.

[0087] The specific method of data enhancement is to add small random noise (such as Gaussian noise) to the numerical value of the calling feature vector, and linearly combine a plurality of feature vectors to generate a new feature vector, and randomly select two features for exchange to simulate different calling modes; and randomly change the value of some parameters (for example, randomly select an ID, status, etc.) in the request feature vector, and add additional pseudo fields to simulate the complexity of the request (for example, add some random user agent string), and fine-tune the request timestamp to simulate network delay or user behavior differences.

[0088] In some embodiments, GAN network can also be used to generate some special calling feature vectors and request feature vectors, which helps the algorithm model accurately identify rare leak scenarios, helps reduce misidentification and missed identification phenomena, and helps improve the accuracy of the model in identifying special scenarios for data leakage.

[0089] After obtaining the enhanced training set, the detection model can be trained based on the enhanced training set to update the parameters and weights in the network.

[0090] Specifically, the feature vector samples in the training set are input into the detection model to obtain a detection result output by the detection model. The detection result and the detection label are compared to calculate a loss function. Then, the loss function is minimized using a stochastic gradient descent method, and the parameters and weights in the detection model are updated by back propagation until the loss function meets a predetermined condition, such as convergence or being less than a predetermined threshold.

[0091] In some embodiments, the detection result includes a current use case and a data leakage result, and the detection label can include at least one of a use case label and a data leakage label. When calculating the loss function, the comparison between the current use case and the use case label and the comparison between the data leakage result and the data leakage label are obtained, or only the comparison between the data leakage result and the data leakage label is obtained.

[0092] After training, the detection network with updated parameters based on the training set can be verified based on the verification set. Specifically, the detection network is debugged based on the verification set data, and when the loss function meets the predetermined condition, the model parameters of this stage are output. If the loss function does not meet the predetermined condition, the learning rate and other hyperparameters are automatically adjusted, and the next round of network model training is performed.

[0093] When the loss function calculated on the verification set meets the predetermined condition, the parameters and weights can be retained, and then the retained parameters are tested based on the test set. Specifically, the test set data is input to enable the detection network with retained parameters and weights to output detection results and model weights. The model loss of multiple rounds and the corresponding weights are compared to output the model weight with the minimum loss, and the detection model obtained by training is determined.

[0094] After obtaining the trained detection model, detection can be completed based on the detection model.

[0095] In addition, data enhancement can not be performed for data input in the verification set and the test set.

[0096] In S300, the automated handling action can immediately take measures to prevent further data loss, optimize the emergency response process, and improve the overall security management level.

[0097] Specifically, in some embodiments, the specific implementation of step S300 can refer to Figure 5 . Figure 5 is based on Figure 2 The detailed description of step S300 in the data leakage handling method according to the corresponding embodiments is shown. In the data leakage handling method, step S300 can include the following steps:

[0098] S310, according to the detection result, determining a corresponding target handling action.

[0099] S320, performing the target handling action on the data stream of the application.

[0100] In this embodiment, by determining the handling action according to the detection result, the system can flexibly adjust the response strategy for different threats or abnormal situations, improving the effectiveness of security defense. After determining the target handling action, performing the handling action on the data stream of the application can directly intervene and manage the data transmission process, further ensuring the security of sensitive information. This embodiment ensures that the system can quickly and effectively respond when a security event is detected, reducing risks and strengthening data protection.

[0101] In S310, the handling action is determined according to the detection result, which can ensure that the handling measure is practical for the security situation and improve the pertinence and effectiveness of the handling. The corresponding handling action includes interception, nullification, encryption, desensitization, etc. The handling strategy can be configured according to the specific transaction requirements to ensure that the personal data is protected to the maximum extent without affecting the normal transaction operation.

[0102] Specifically, in some embodiments, the specific implementation of step S310 can refer to Figure 6 . Figure 6 is the detailed description of step S310 in the data leakage handling method according to Figure 5 the corresponding embodiment, wherein step S310 can include the following steps:

[0103] S312, determining whether the current data usage scenario is a preset scenario.

[0104] S314, if the current data usage scenario is a preset scenario, determining the target handling action as a preset handling action, the preset handling action including at least one of plaintext, encryption, and desensitization.

[0105] S316, if the current data usage scenario is not a preset scenario, determining the target handling action as a standard handling action, the standard handling action including at least one of interception and nullification.

[0106] In the embodiments of the present application, the detection result contains the current data usage scenario and the data leakage result.

[0107] In determining the corresponding target disposal action, it is first determined whether the current use number scene is a preset scene in the white list. If it is not a preset scene, a general standard action is directly used for disposal, i.e., the target disposal action is determined as a standard disposal action. If it is a preset scene, a corresponding preset action is executed for disposal according to the specific preset scene, i.e., the target disposal action is determined as a preset disposal action. That is, by judging whether the current use number scene is a preset scene, according to different use number scenes, the system can select a preset disposal action (such as plaintext, encryption, desensitization) or a standard disposal action (such as interception, emptying), improve the pertinence and adaptability of the disposal measures, help reduce the risk of false positives and misprocessing, and reduce unnecessary interference and resource waste.

[0108] In S312, the current use number scene is judged to be a preset scene or not, so as to clearly distinguish between preset scenes and non-preset scenes. According to different use number scenes, the system will execute different actions.

[0109] In S314, for known preset scenes, corresponding disposal actions (such as plaintext, encryption, desensitization) are adopted, which can quickly adapt to and protect the compliant use and safety of data.

[0110] Specifically, in some embodiments, the specific implementation of step S314 can refer to the following embodiments. The present embodiment is based on Figure 6 The details of step S314 in the data leakage disposal method shown in the corresponding embodiment are described as follows. In the data leakage disposal method, step S314 can include the following steps:

[0111] If the current use number scene is a preset scene, read the data leakage result.

[0112] If the data leakage result is that data has been leaked, determine the target disposal action as a first preset disposal action, and the first preset disposal action includes at least one of encryption and desensitization.

[0113] If the data leakage result is that data has not been leaked, determine the target disposal action as a second preset disposal action, and the second preset disposal action includes plaintext.

[0114] In the present embodiment, for known preset scenes, the disposal strategy can be flexibly adjusted according to the current use number scene and the data leakage situation, and the corresponding disposal action can be automatically selected, so as to improve the response speed and accuracy. At the same time, by selecting encryption, desensitization or plaintext processing in a targeted manner, unnecessary resource waste is avoided, and the efficiency is improved.

[0115] Specifically, after confirming that the data has been leaked, measures such as encryption or desensitization are immediately taken to effectively reduce the risk brought by the leakage and protect sensitive information. After confirming that the data has not been leaked, the data is allowed to be processed in plaintext, improving the flexibility and convenience of operation while reducing interference with data processing.

[0116] Desensitization refers to the transformation of sensitive information through technical means to make it impossible to directly identify the identity of an individual, thereby protecting privacy. This disposal action can be used when the current use case is a scenario related to identity authentication, for example, replacing some digits in an ID number with "*".

[0117] Encryption refers to the encryption of data to prevent unauthorized reading or tampering. Encrypted data is decrypted on the server side of the application. Decryption is the inverse of encryption and is used to restore the data before encryption.

[0118] Plaintext refers to the direct use of plaintext to transmit data. When the data leakage result is that the data has not been leaked, and plaintext access or transmission of private data is allowed in the current use case, plaintext can be used to transmit data directly.

[0119] In S316, standard disposal actions (such as interception, nullification) are taken for unknown or abnormal scenarios, which can prevent potential security threats in a timely manner and avoid data leakage or misuse.

[0120] Interception refers to preventing unauthorized data flow or access during data transmission or processing by setting rules.

[0121] Specifically, in some other embodiments, the specific implementation of step S320 can refer to the following embodiments. This embodiment is based on Figure 5 The detailed description of step S320 in the data leakage disposal method shown in the corresponding embodiment can include the following steps:

[0122] Feature engineering is performed on the detection result to obtain a detection result vector.

[0123] The detection result vector is input into an action disposal model to obtain a target disposal action.

[0124] In this embodiment, feature engineering is used to convert the original detection result into a structured data vector, extract key features, and enhance the usability of information, ensuring that the data input into the disposal model is more accurate. It can also adjust the disposal action flexibly for different types of data leakage situations and adapt to various application scenarios, thereby improving the decision-making accuracy of the target disposal action.

[0125] Meanwhile, the selection of the treatment action is performed through the neural network model, the detection result and the generation of the treatment action are integrated, manual intervention is reduced, the system has self-learning ability, can continuously optimize and adjust the treatment strategy, adapt to complex and changeable environment, and the reaction speed is improved, so that the potential data leakage event can be responded to faster in real time.

[0126] In some embodiments of the present specification, when feature engineering is performed, the data can also be cleaned, filtered and selected. Through feature selection, irrelevant or redundant information can be removed, and the training and inference efficiency of the subsequent model can be improved.

[0127] Specifically, in some embodiments, the training method of the action treatment model comprises:

[0128] Obtain a detection result vector sample set, the detection result vector sample set contains a plurality of detection result vector samples, and each detection result vector sample is labeled with a corresponding treatment action label in advance.

[0129] Input all detection result vector samples in the detection result vector sample set into the action treatment model one by one to obtain a target treatment action.

[0130] According to the target treatment action and the treatment action label, the parameters of the action treatment model are updated until a predetermined end condition is reached, the training is ended, and a trained action treatment model is obtained.

[0131] Specifically, in some embodiments, according to the target treatment action and the treatment action label, the parameters of the action treatment model are updated until a predetermined end condition is reached, the training is ended, and a trained action treatment model is obtained, which can specifically include:

[0132] If only less than a predetermined number of detection result vector samples in the detection result vector sample set are input into the action treatment model to obtain a target treatment action consistent with the labeled treatment action label, the parameters of the action treatment model are updated.

[0133] If more than a predetermined number of detection result vector samples in the detection result vector sample set are input into the action treatment model to obtain a target treatment action consistent with the labeled treatment action label, the predetermined end condition is reached, the training is ended, and a trained action treatment model is obtained.

[0134] Specifically, in some other embodiments, according to the target treatment action and the treatment action label, the parameters of the action treatment model are updated until a predetermined end condition is reached, the training is ended, and a trained action treatment model is obtained, which can specifically include:

[0135] According to the target handling action and the handling action label, a loss function is determined.

[0136] According to the loss function, the action handling model is updated in parameters until a predetermined end condition is reached, the training is ended, and a trained action handling model is obtained.

[0137] In this embodiment, the loss function reaching the predetermined end condition can be that the loss function converges or the loss function is less than a predetermined loss (for example, 0.001).

[0138] In S320, intervention is directly performed on the data stream, which can effectively prevent the occurrence of violation behaviors such as data leakage or improper access, thereby improving data security.

[0139] In some embodiments, after S400, the method further includes:

[0140] The detection result and the handling action are recorded.

[0141] In this embodiment, the detection result and the handling action are recorded to form a handling log, which can ensure that the processing of each security event has a traceable basis and enhances the transparency of the system. The handling log also forms a feedback mechanism to provide a basis for future system optimization and improvement, forming a continuous learning closed loop.

[0142] At the same time, by accumulating historical records, the handling log obtained can be analyzed to identify common risk patterns, thereby providing an important reference basis for future decision-making and helping to optimize handling strategies.

[0143] The following will be described in detail Figure 7 , the data leakage handling apparatus provided in the specification will be described in detail. It should be noted that Figure 7 The data leakage handling apparatus shown in the specification is used to execute the method of the embodiments of the specification Figures 1-6 The method of the embodiments shown in the specification is only shown in relation to the specification for the purpose of illustration, and specific technical details not disclosed are described with reference to the specification Figures 1-6 The embodiments shown in the specification.

[0144] Please refer to Figure 7 , which shows a structural schematic diagram of the data leakage handling apparatus of the specification. The data leakage handling apparatus 700 can be realized by software, hardware, or a combination of the two to become all or part of a user terminal. According to some embodiments, the data leakage handling apparatus 700 includes a call interception module 710, a leakage detection module 720, and an action handling module 730.

[0145] The calling interception module 710 is configured to intercept a calling chain and a data operation request of an application in response to triggering of an operation request; the leakage detection module 720 is configured to determine a detection result according to the calling chain and the data operation request, the detection result including a data leakage result; and the action handling module 730 is configured to perform a corresponding handling action according to the detection result.

[0146] Specifically, in some alternative embodiments of the present application, the leakage detection module specifically includes: a scene identification sub-module, configured to analyze the data operation request and identify a current data usage scene; and a leakage detection sub-module, configured to detect whether there is data leakage in the calling chain according to the current data usage scene, to obtain a data leakage result.

[0147] Specifically, in some alternative embodiments of the present application, the leakage detection sub-module specifically includes: a scene determination unit, configured to determine whether clear text access or transmission of private data is allowed in the current data usage scene; a first judgment unit, configured to determine that the data leakage result is that data is not leaked if clear text access or transmission of private data is allowed in the current data usage scene; a calling detection unit, configured to detect whether there is reading or transmission of clear text private data in the calling chain if clear text access or transmission of private data is not allowed in the current data usage scene; a second judgment unit, configured to determine that the data leakage result is that data is not leaked if there is no reading or transmission of clear text private data; and a third judgment unit, configured to determine that the data leakage result is that data is leaked if there is reading or transmission of clear text private data.

[0148] Specifically, in some alternative embodiments of the present application, the action handling module specifically includes: an action determination sub-module, configured to determine a corresponding target handling action according to the detection result; and an action execution sub-module, configured to perform the target handling action on a data flow of the application.

[0149] Specifically, in some alternative embodiments of the present application, the detection result includes a current data usage scene, and the action determination sub-module specifically includes: a scene judgment unit, configured to judge whether the current data usage scene is a preset scene; a first determination unit, configured to determine that a target handling action is a preset handling action if the current data usage scene is the preset scene, the preset handling action including at least one of clear text, encryption, and desensitization; and a second determination unit, configured to determine that the target handling action is a standard handling action if the current data usage scene is not the preset scene, the standard handling action including at least one of interception and nulling.

[0150] Specifically, in some alternative embodiments of the present application, the first determining unit is specifically configured to perform: if the current use scenario is a preset scenario, reading a data leakage result; if the data leakage result is that data has been leaked, determining a target disposal action as a first preset disposal action, the first preset disposal action including at least one of encryption and desensitization. If the data leakage result is that data has not been leaked, determining the target disposal action as a second preset disposal action, the second preset disposal action including plaintext.

[0151] Specifically, in some alternative embodiments of the present application, the action determining sub-module specifically includes: a feature engineering unit, configured to perform feature engineering on the detection result to obtain a detection result vector; and a model determining unit, configured to input the detection result vector into an action disposal model to obtain a target disposal action.

[0152] Specifically, in some alternative embodiments of the present application, the data leakage disposal apparatus further includes: a log recording module, configured to record the detection result and the disposal action.

[0153] Specifically, in some alternative embodiments of the present application, the leakage detection module specifically includes: a feature extraction sub-module, configured to perform feature extraction on the call chain and the data operation request to obtain a call feature vector and a request feature vector; and a neural network sub-module, configured to input the call feature vector and the request feature vector together into a detection model for detection to obtain a detection result.

[0154] Specifically, in some alternative embodiments of the present application, the detection model includes a scenario detection sub-model and a leakage detection sub-model, and the neural network sub-module specifically includes: a scenario detection unit, configured to input the request feature vector into the scenario detection sub-model to obtain a scenario feature vector; a leakage detection unit, configured to input the scenario feature vector and the call feature vector together into the leakage detection sub-model for detection to obtain a leakage feature vector; and a comprehensive detection unit, configured to obtain the detection result according to the scenario feature vector and the leakage feature vector.

[0155] It should be noted that the data leakage disposal apparatus provided in the above embodiments is only used as an example to illustrate the division of the above functional modules when the data leakage disposal method is performed. In actual applications, the above functions can be completed by different functional modules according to needs, that is, the internal structure of the device is divided into different functional modules to complete all or part of the functions described above. In addition, the data leakage disposal apparatus and the data leakage disposal method embodiments provided in the above embodiments belong to the same concept, and the implementation process is detailed in the method embodiments. Here, it is not repeated.

[0156] The above serial numbers in the specification are only for description, and do not represent the pros and cons of the embodiments.

[0157] In the embodiments of the present specification, by intercepting and analyzing the call chain and data operation request of the application in real time, the flow path of the data can be dynamically monitored, and the potential data leakage risk can be found in time. Using the information of the call chain and the data operation request for data leakage detection can quickly obtain the data leakage result, reduce the response time, and also enhance the accuracy of data leakage detection, reduce the false positive and false negative cases, and then provide instant warning function, effectively prevent the occurrence of data leakage events. According to the detection result, the corresponding disposal action is automatically executed, the response efficiency of the data leakage event is improved, so as to minimize the potential loss.

[0158] The present specification also provides a computer storage medium, which can store a plurality of instructions, the instructions being suitable for being loaded and executed by a processor to perform the data leakage disposal method of the above-mentioned Figures 1-6 embodiments. For specific implementation process, please refer to the specific description of the above-mentioned Figures 1-6 embodiments, which will not be repeated here.

[0159] The present specification also provides a computer program product, which stores at least one instruction, the at least one instruction being loaded and executed by the processor to perform the data leakage disposal method of the above-mentioned Figures 1-6 embodiments. For specific implementation process, please refer to the specific description of the above-mentioned Figures 1-6 embodiments, which will not be repeated here.

[0160] Please refer to Figure 8 , which shows the structure block diagram of the electronic device provided by an exemplary embodiment of the present specification. The electronic device in the present specification can include one or more of the following components: a processor 110, a memory 120, an input device 130, an output device 140 and a bus 150. The processor 110, the memory 120, the input device 130 and the output device 140 can be connected through the bus 150.

[0161] The processor 110 can include one or more processing cores. The processor 110 connects various parts within the entire electronic device by various interfaces and lines, performs various functions of the electronic device 100 and processes data by running or executing instructions, programs, code sets or instruction sets stored in the memory 120, and calling data stored in the memory 120. Alternatively, the processor 110 can be implemented in at least one of a hardware form of a digital signal processing (DSP), a field-programmable gate array (FPGA), a programmable logic array (PLA). The processor 110 can integrate a combination of one or several of a central processing unit (CPU), a graphics processing unit (GPU), and a modem, etc. Among them, the CPU mainly processes an operating system, a user interface, and an application program, etc.; the GPU is responsible for rendering and drawing display content; and the modem is used for processing wireless communication. It can be understood that the above-mentioned modem can also not be integrated into the processor 110, but be implemented by a separate communication chip.

[0162] The memory 120 can include a random access memory (RAM) and can also include a read-only memory (ROM). Alternatively, the memory 120 includes a non-transitory computer-readable storage medium. The memory 120 can be used to store instructions, programs, codes, code sets or instruction sets. The memory 120 can include a program storage area and a data storage area, wherein the program storage area can store instructions for implementing an operating system, instructions for implementing at least one function (such as a touch function, a sound playing function, an image playing function, etc.), instructions for implementing each of the following method embodiments, etc., the operating system can be an Android system, an IOS system developed by Apple Inc., a system developed based on the Android system or other systems. The data storage area can also store data created by the electronic device in use, such as a phone book, audio and video data, chat record data, etc.

[0163] Referring to Figure 9As shown, the memory 120 can be divided into an operating system space and a user space, the operating system runs in the operating system space, and native and third-party applications run in the user space. In order to ensure that different third-party applications can achieve good running effect, the operating system allocates corresponding system resources for different third-party applications. However, there are also differences in the demand for system resources in different application scenarios in the same third-party application. For example, in the local resource loading scenario, the third-party application has a higher requirement for the disk reading speed; in the animation rendering scenario, the third-party application has a higher requirement for the GPU performance. However, the operating system and the third-party application are independent of each other, and the operating system often cannot timely perceive the current application scenario of the third-party application, resulting in that the operating system cannot perform targeted system resource adaptation according to the specific application scenario of the third-party application.

[0164] In order to enable the operating system to distinguish the specific application scenario of the third-party application, it is necessary to open up the data communication between the third-party application and the operating system, so that the operating system can obtain the current scenario information of the third-party application at any time, and then perform targeted system resource adaptation based on the current scenario.

[0165] Taking the Android system as an example, the programs and data stored in the memory 120 are as follows Figure 10As shown, the memory 120 can store a Linux kernel layer 320, a system runtime library layer 340, an application framework layer 360, and an application layer 380, wherein the Linux kernel layer 320, the system runtime library layer 340, and the application framework layer 360 belong to an operating system space, and the application layer 380 belongs to a user space. The Linux kernel layer 320 provides underlying drivers for various hardware of the electronic device, such as display drivers, audio drivers, camera drivers, Bluetooth drivers, Wi-Fi drivers, power management, and the like. The system runtime library layer 340 provides main feature support for the Android system through some C / C++ libraries. For example, an SQLite library provides database support, an OpenGL / ES library provides 3D drawing support, a Webkit library provides browser kernel support, and the like. An Android runtime is also provided in the system runtime library layer 340, which mainly provides some core libraries to allow developers to use the Java language to write Android applications. The application framework layer 360 provides various APIs that can be used when building an application, and developers can also build their own applications by using these APIs, such as activity management, window management, view management, notification management, content provider, package management, call management, resource management, and location management. At least one application program is running in the application layer 380, which can be native applications provided by the operating system, such as a contact program, a message program, a clock program, a camera application, and the like, or third-party applications developed by third-party developers, such as game applications, instant messaging programs, photo beautification programs, and the like.

[0166] For example, taking an IOS system as the operating system, the programs and data stored in the memory 120 can include an IOS kernel 320, an IOS runtime library 340, an application framework 360, and an application 380. Figure 11As shown, the IOS system includes: a core operating system layer 420, a core service layer 440, a media layer 460, and a Cocoa Touch layer 480. The core operating system layer 420 includes an operating system kernel, drivers, and underlying frameworks that provide more hardware-specific functionality to frameworks in the core service layer 440. The core service layer 440 provides system services and / or frameworks for applications, such as a Foundation framework, an Accounts framework, an Ad framework, a Data Store framework, a Network Connectivity framework, a GeoLocation framework, a Motion framework, and the like. The media layer 460 provides interfaces for applications related to audiovisual aspects, such as interfaces related to graphics images, interfaces related to audio technology, interfaces related to video technology, an AirPlay interface for wireless audio and video transmission technology, and the like. The Cocoa Touch layer 480 provides various commonly used interface-related frameworks for application development, and is responsible for touch interaction operations of users on the electronic device. For example, a local notification service, a remote push service, an Ad framework, a game tool framework, a message user interface (UI) framework, a user interface UIKit framework, a map framework, and the like.

[0167] In Figure 11 In the framework shown, the frameworks related to most applications include, but are not limited to, a Foundation framework in the core service layer 440 and a UIKit framework in the Cocoa Touch layer 480. The Foundation framework provides many basic object classes and data types, and provides the most basic system services for all applications, and is independent of UI. The UIKit framework provides basic UI class libraries, and is used to create touch-based user interfaces. An iOS application can provide UI based on the UIKit framework, so it provides the basic framework of the application, and is used to build user interfaces, draw, handle and respond to user interaction events, respond to gestures, and the like.

[0168] In the IOS system, the manner and principle of implementing data communication between a third-party application and an operating system can refer to the Android system, and the present specification will not be repeated here.

[0169] The input device 130 is configured to receive input instructions or data, and the input device 130 includes but is not limited to a keyboard, a mouse, a camera, a microphone, or a touch device. The output device 140 is configured to output instructions or data, and the output device 140 includes but is not limited to a display device and a speaker. In an example, the input device 130 and the output device 140 can be combined, and the input device 130 and the output device 140 are a touch display screen configured to receive a touch operation of a user using a finger, a touch pen, or any suitable object on or near the touch display screen, and display a user interface of each application. The touch display screen is usually arranged on a front panel of the electronic device. The touch display screen can be designed as a full screen, a curved screen, or a special-shaped screen. The touch display screen can also be designed as a combination of a full screen and a curved screen, a combination of a special-shaped screen and a curved screen, which is not limited in the present specification.

[0170] In addition, those skilled in the art can understand that the structure of the electronic device shown in the above-described drawings does not constitute a limitation on the electronic device, and the electronic device can include more or fewer components than those shown in the drawings, or combine certain components, or different component arrangements. For example, the electronic device further includes a radio frequency circuit, an input unit, a sensor, an audio circuit, a wireless fidelity (WiFi) module, a power supply, a Bluetooth module, and the like, which are not described herein.

[0171] In the present specification, the execution subject of each step can be the electronic device described above. Alternatively, the execution subject of each step is an operating system of the electronic device. The operating system can be an Android system, an IOS system, or other operating systems, which are not limited in the present specification.

[0172] The electronic device of the present specification can further have a display device installed thereon. The display device can be various devices capable of realizing a display function, such as a cathode ray tube display (CR), a light-emitting diode display (LED), an electronic ink screen, a liquid crystal display (LCD), a plasma display panel (PDP), and the like. A user can view displayed text, images, videos, and the like using the display device on the electronic device 101. The electronic device can be a smartphone, a tablet computer, a game device, an AR (Augmented Reality) device, a car, a data storage device, an audio playback device, a video playback device, a notebook, a desktop computing device, a wearable device such as an electronic watch, electronic glasses, an electronic helmet, an electronic bracelet, an electronic necklace, an electronic clothing, and the like.

[0173] In Figure 8 In the electronic device shown, the processor 110 can be configured to invoke a network optimization application stored in the memory 120, and specifically perform the following operations: in response to a trigger of an operation request, intercept a call chain and a data operation request of an application; determine a detection result according to the call chain and the data operation request, the detection result including a data leakage result; and perform a corresponding handling action according to the detection result.

[0174] In one embodiment, the processor 110, when performing the detection result including a current use number scenario and a data leakage result, and determining the detection result according to the call chain and the data operation request, specifically performs the following operations: analyzes the data operation request to identify the current use number scenario; and determines whether there is data leakage in the call chain according to the current use number scenario to obtain a data leakage result.

[0175] In one embodiment, the processor 110, when performing the detection result according to the current use number scenario in the call chain, specifically performs the following operations: determines whether plaintext access or transmission of private data is allowed under the current use number scenario; if plaintext access or transmission of private data is allowed under the current use number scenario, determines that the data leakage result is that data has not been leaked; if plaintext access or transmission of private data is not allowed under the current use number scenario, detects in the call chain to determine whether there is reading or transmission of plaintext private data; if there is no reading or transmission of plaintext private data, determines that the data leakage result is that data has not been leaked; and if there is reading or transmission of plaintext private data, determines that the data leakage result is that data has been leaked.

[0176] In one embodiment, the processor 110, when performing the handling action according to the detection result, specifically performs the following operations: determines a corresponding target handling action according to the detection result; and performs the target handling action on a data flow of the application.

[0177] In one embodiment, the detection result includes a current use number scenario, and the processor 110, when performing the target handling action according to the detection result, specifically performs the following operations:

[0178] determines whether the current use number scenario is a preset scenario; if the current use number scenario is the preset scenario, determines that the target handling action is a preset handling action, the preset handling action including at least one of plaintext, encryption, and desensitization; and if the current use number scenario is not the preset scenario, determines that the target handling action is a standard handling action, the standard handling action including at least one of interception and nulling.

[0179] In an embodiment, the processor 110, in execution of the determining the target disposal action as the preset disposal action if the current use scenario is the preset scenario, specifically performs the following operation: reading a data leakage result if the current use scenario is the preset scenario; determining the target disposal action as a first preset disposal action if the data leakage result is that data has been leaked, the first preset disposal action including at least one of encryption and desensitization; and determining the target disposal action as a second preset disposal action if the data leakage result is that data has not been leaked, the second preset disposal action including plaintext.

[0180] In an embodiment, the processor 110, in execution of the determining the corresponding target disposal action according to the detection result, specifically performs the following operation: performing feature engineering on the detection result to obtain a detection result vector; and inputting the detection result vector into an action disposal model to obtain the target disposal action.

[0181] In an embodiment, the processor 110, in execution of the determining the corresponding target disposal action according to the detection result, specifically performs the following operation: performing feature engineering on the detection result to obtain a detection result vector; and inputting the detection result vector into an action disposal model to obtain the target disposal action.

[0182] In an embodiment, the processor 110, in execution of the determining the detection result according to the call chain and the data operation request, specifically performs the following operation: performing feature extraction on the call chain and the data operation request to obtain a call feature vector and a request feature vector; and inputting the call feature vector and the request feature vector into a detection model for detection to obtain the detection result.

[0183] In an embodiment, the detection model includes a scenario detection sub-model and a leakage detection sub-model, and the processor 110, in execution of the inputting the call feature vector and the request feature vector into the detection model for detection to obtain the detection result, specifically performs the following operation: inputting the request feature vector into the scenario detection sub-model to obtain a scenario feature vector; inputting the scenario feature vector and the call feature vector into the leakage detection sub-model for detection to obtain a leakage feature vector; and obtaining the detection result according to the scenario feature vector and the leakage feature vector.

[0184] In the embodiments described in this specification, by intercepting and analyzing the application's call chain and data operation requests in real time, the data flow path can be dynamically monitored, and potential data leakage risks can be detected in a timely manner. Utilizing information from the call chain and data operation requests for data leakage detection allows for rapid acquisition of data leakage results, reduces response time, and enhances the accuracy of data leakage detection, reducing false positives and false negatives. This provides an immediate early warning function, effectively preventing data leakage events from occurring. Automatically executing corresponding actions based on the detection results improves the response efficiency to data leakage events, thereby minimizing potential losses.

[0185] Those skilled in the art will understand that all or part of the processes in the above embodiments can be implemented by a computer program instructing related hardware. The program can be stored in a computer-readable storage medium, and when executed, it can include the processes of the embodiments of the above methods. The storage medium can be a magnetic disk, optical disk, read-only memory, or random access memory, etc.

[0186] It should be noted that the information (including but not limited to user device information, user personal information, etc.), data (including but not limited to data used for analysis, stored data, displayed data, etc.), and signals involved in the embodiments of this specification are all authorized by the user or fully authorized by all parties, and the collection, use, and processing of related data must comply with the relevant laws, regulations, and standards of the relevant countries and regions. For example, the object characteristics, interactive behavior characteristics, and user information involved in this specification were all obtained under full authorization.

[0187] The above-disclosed embodiments are merely preferred embodiments of this specification and should not be construed as limiting the scope of this specification. Therefore, any equivalent variations made in accordance with the claims of this specification shall still fall within the scope of this specification.

Claims

1. A data leakage handling method, the method comprising: intercepting a call chain and a data operation request of an application in response to a trigger of an operation request; determining a detection result according to the call chain and the data operation request, the detection result comprising a data leakage result; performing a corresponding handling action according to the detection result; wherein the detection result comprises a current data usage scenario and a data leakage result, and the determining of the detection result according to the call chain and the data operation request specifically comprises: analyzing the data operation request to identify the current data usage scenario; detecting whether there is data leakage in the call chain according to the current data usage scenario to obtain the data leakage result; the detecting whether there is data leakage in the call chain according to the current data usage scenario to obtain the data leakage result specifically comprises: determining whether plaintext access or transmission of private data is allowed under the current data usage scenario; if plaintext access or transmission of private data is allowed under the current data usage scenario, determining that the data leakage result is that data is not leaked; if plaintext access or transmission of private data is not allowed under the current data usage scenario, detecting in the call chain to determine whether there is reading or transmission of plaintext private data; if there is no reading or transmission of plaintext private data, determining that the data leakage result is that data is not leaked; if there is reading or transmission of plaintext private data, determining that the data leakage result is that data is leaked.

2. The method of claim 1, wherein the performing of the corresponding handling action according to the detection result specifically comprises: determining a corresponding target handling action according to the detection result; performing the target handling action on a data flow of the application.

3. The method of claim 2, wherein the detection result contains a current data usage scenario, and the determining of the corresponding target handling action according to the detection result specifically comprises: judging whether the current data usage scenario is a preset scenario; if the current data usage scenario is the preset scenario, determining that the target handling action is a preset handling action, the preset handling action comprising at least one of plaintext, encryption, and desensitization; if the current data usage scenario is not the preset scenario, determining that the target handling action is a standard handling action, the standard handling action comprising at least one of interception and nulling.

4. The method of claim 3, wherein the determining of the target handling action as the preset handling action if the current data usage scenario is the preset scenario specifically comprises: if the current data usage scenario is the preset scenario, reading the data leakage result; if the data leakage result is that data is leaked, determining that the target handling action is a first preset handling action, the first preset handling action comprising at least one of encryption and desensitization; if the data leakage result is that data is not leaked, determining that the target handling action is a second preset handling action, the second preset handling action comprising plaintext.

5. The method of claim 2, wherein the determining of the corresponding target handling action according to the detection result specifically comprises: performing feature engineering on the detection result to obtain a detection result vector; inputting the detection result vector into an action handling model to obtain the target handling action. 6.The method of claim 1, after performing the corresponding treatment action according to the detection result, the method further comprises: recording the detection result and the treatment action. 7.The method of claim 1, wherein the determining the detection result according to the call chain and the data operation request specifically comprises: extracting features of the call chain and the data operation request to obtain a call feature vector and a request feature vector; inputting the call feature vector and the request feature vector into a detection model for detection to obtain the detection result. 8.The method of claim 7, wherein the detection model comprises a scene detection sub-model and a leakage detection sub-model, and the inputting the call feature vector and the request feature vector into the detection model for detection to obtain the detection result specifically comprises: inputting the request feature vector into the scene detection sub-model to obtain a scene feature vector; inputting the scene feature vector and the call feature vector into the leakage detection sub-model for detection to obtain a leakage feature vector; obtaining the detection result according to the scene feature vector and the leakage feature vector. 9.A data leakage treatment apparatus, the apparatus comprising: a call interception module configured to intercept a call chain and a data operation request of an application in response to a trigger of an operation request; a leakage detection module configured to determine a detection result according to the call chain and the data operation request, the detection result comprising a data leakage result; an action treatment module configured to perform a corresponding treatment action according to the detection result. The leakage detection module specifically comprises a scene recognition sub-module configured to analyze the data operation request to recognize a current data scene, and a leakage detection sub-module configured to detect whether there is data leakage in the call chain according to the current data scene to obtain a data leakage result. The leakage detection sub-module specifically comprises a scene determination unit configured to determine whether plaintext access or transmission of private data is allowed in the current data scene, a first judgment unit configured to determine that the data leakage result is that data is not leaked if plaintext access or transmission of private data is allowed in the current data scene, a call detection unit configured to detect whether there is reading or transmission of plaintext private data in the call chain if plaintext access or transmission of private data is not allowed in the current data scene, a second judgment unit configured to determine that the data leakage result is that data is not leaked if there is no reading or transmission of plaintext private data, and a third judgment unit configured to determine that the data leakage result is that data is leaked if there is reading or transmission of plaintext private data. 10.A computer storage medium storing a plurality of instructions, the instructions being adapted to be loaded and executed by a processor to perform the method steps of any one of claims 1-8. 11.A computer program product storing at least one instruction, the at least one instruction being loaded and executed by a processor to perform the method steps of any one of claims 1-8.

12. An electronic device comprising: a processor and a memory; wherein the memory stores a computer program adapted to be loaded and executed by the processor and to perform the method steps of any one of claims 1 to 8.

Images