Method, system, medium and equipment for desensitizing record based on keyword matching log

Abstract

The invention discloses a method, a system, a medium and equipment for desensitizing a record based on a keyword matching log. The method comprises the following steps: S1, constructing a reusable keyword matching configuration file; s2, acquiring a log data record; s3, log data sensitive keyword matching; s4, carrying out sensitive information identification according to a matching result; s5, performing desensitization processing on the log data identified as sensitive information; and S6, storing the log data record. The method has the advantages that the efficient matching algorithm based on the keyword configuration file and implementation thereof can efficiently and accurately identify sensitive information, so that the keyword matching accuracy is high, and the complexity of processing is reduced; according to the method and the device, the sensitive information of a newly added type can be dynamically adapted under the condition that codes are not modified through a key management configuration file and a more flexible updating and modifying mode of the key management configuration file, so that the expansibility is enhanced, the maintenance process is simplified, and manual intervention and management cost are reduced. Sensitive information does not need to be recorded hierarchically, and safety is enhanced.

Description

Technical Field

[0001] The present invention relates to the field of computer software technology, and in particular to a method, system, medium and device for desensitizing log records based on keyword matching. Background Art

[0002] With the development of information technology, log records play an important role in system operation and maintenance, security auditing, etc. However, logs often contain sensitive information of users, especially in scenarios such as government self-service machines, bank self-service machines, and hospital self-service machines that read user ID cards, bank cards, and other media to verify identity information. Sensitive information such as name, ID number, and bank card number will inevitably be involved in the log data. Common log desensitization technology generally performs desensitization processing during the code writing and recording stage. This is a special processing of log output when the sensitive information to be recorded is clear, and manual code processing is required for each sensitive information log. Another type is to record logs in levels, setting the logs of sensitive data to a high level of record level. Normal log information viewing will filter out high-level sensitive data. This is to desensitize sensitive data through log level recording.

[0003] The existing data desensitization has the following problems:

[0004] 1. Complicated processing: Each piece of sensitive data needs to be desensitized separately, and the processing operation is at the coding level, which has a high maintenance cost.

[0005] 2. Poor scalability: It cannot adapt to the newly added sensitive information types and requires targeted desensitization processing.

[0006] 3. Low security of hierarchical records: The essence of hierarchical records of sensitive information is output records. As long as they are recorded in plain text, there is a security risk of leakage.

[0007] 4. Processing lag: As long as the original file exists, there is a risk of leakage.

[0008] For example, the Chinese patent with publication number CN114116644B discloses a log file processing method, device, equipment and storage medium, the method comprising: first obtaining a log file to be processed, and obtaining a preset business sensitive keyword list, and then detecting whether the log file to be processed contains sensitive keywords in the business sensitive keyword list. When it is determined that the log file to be processed contains sensitive keywords and the preset first number of characters after the sensitive keyword contains a preset connection symbol, based on the sensitive data type corresponding to the sensitive keyword, it is determined whether the preset second number of characters after the connection symbol in the log file to be processed contains sensitive data belonging to the sensitive data type, and when it is determined that sensitive data is contained, the sensitive data in the log file to be processed is desensitized. The above-mentioned reference file is to desensitize the log file, that is, the log data has been completely stored in the file, which is equivalent to a delayed desensitization of the log file. This delayed desensitization is the existence of an un-desensitized original log file, that is, the existing file is the original data before it is processed, and the sensitive data and privacy data are in the plaintext exposure state. There is a risk of leakage if there is a file.

[0009] In view of this, it is necessary to provide a method, system, medium and device for desensitizing log records based on keyword matching. Summary of the invention

[0010] The method, system, medium and device for desensitizing log records based on keyword matching provided by the present invention effectively solve the problems of cumbersome processing, poor scalability, low security of hierarchical records and delayed processing in existing data desensitization.

[0011] The technical solution adopted by the present invention is:

[0012] The method for desensitizing log records based on keyword matching includes the following steps:

[0013] S1. Build a reusable keyword matching profile;

[0014] S2, obtaining log data records;

[0015] S3, matching of sensitive keywords in log data;

[0016] S4. Identify sensitive information based on the matching results;

[0017] S5. Desensitize the log data identified as sensitive information;

[0018] S6. Store log data records.

[0019] Furthermore, the configuration file in S1 is used to manage keywords, and keyword information can be added, deleted, and modified according to actual business needs.

[0020] Furthermore, the step S2, obtaining log data records, specifically, in the program source code, during the code execution process, a log recording interface is called according to the need for data recording, and the called log interface obtains the data content that needs to be recorded in the log.

[0021] Furthermore, the S3, log data sensitive keyword matching, specifically, after the diary interface obtains data, the obtained content is identified and matched with the keywords in the configuration file using a data algorithm.

[0022] Furthermore, S4 performs sensitive information identification based on the matching result, specifically, judging whether the input log content contains sensitive data that needs to be desensitized and shielded based on the identification and matching result in S3.

[0023] Furthermore, S5 desensitizes the log data identified as sensitive information, specifically, desensitizes the sensitive information by replacing it.

[0024] Furthermore, S5 desensitizes the log data identified as sensitive information, specifically, desensitizes the sensitive information by masking.

[0025] The system based on keyword matching log desensitization records includes:

[0026] A keyword profile building module is used to build a profile containing common sensitive information keywords;

[0027] The keyword matching module is used to match the log data to be output for sensitive information, and to use the data structure and algorithm to determine whether the log data to be output is sensitive information;

[0028] The information desensitization processing module is used to desensitize and store log data determined to be sensitive information by replacing or masking it.

[0029] In addition, the above-mentioned computer-readable storage medium can adopt any combination of one or more readable storage media, wherein the readable storage medium includes electrical, optical, electromagnetic, infrared or semiconductor systems, devices or components, or any combination of the above.

[0030] A computer-readable storage medium stores a computer program, which, when executed, implements the steps of the method for desensitizing log records based on keyword matching.

[0031] A computer device comprises a processor, a communication interface, a memory and a communication bus, wherein the processor, the communication interface and the memory communicate with each other via the communication bus:

[0032] The memory is used to store computer programs;

[0033] The processor is used to execute the steps of the method for desensitizing records based on keyword matching logs by running the program stored in the memory.

[0034] The communication bus mentioned in the above terminal can be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus, etc. The communication bus can be divided into an address bus, a data bus, a control bus, etc.

[0035] The communication interface is used for communication between the above terminal and other devices.

[0036] The memory may include a random access memory (RAM) or a non-volatile memory, such as at least one disk memory. Optionally, the memory may also be at least one storage device located away from the aforementioned processor.

[0037] The above-mentioned processor can be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc.; it can also be a digital signal processor (DSP), an application specific integrated circuit (ASIC), a field programmable gate array (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components.

[0038] Beneficial effects of the invention: The efficient matching algorithm based on the keyword configuration file and its implementation can efficiently and accurately identify sensitive information, making the keyword matching accuracy high and reducing the complexity of processing; and the more flexible update and modification mode of the keyword management configuration file can dynamically adapt to the newly added types of sensitive information without modifying the code, enhancing the scalability, simplifying the maintenance process, and reducing manual intervention and management costs. There is no need to record sensitive information in a hierarchical manner, which enhances security. BRIEF DESCRIPTION OF THE DRAWINGS

[0039] Figure 1 A flowchart of a method for desensitizing log records based on keyword matching provided in an embodiment of the present application. DETAILED DESCRIPTION

[0040] In order to make the above-mentioned objects, features and advantages of the present invention more obvious and easy to understand, the specific embodiments of the present invention are described in detail below with reference to the accompanying drawings.

[0041] like Figure 1 As shown, the present application provides a first embodiment, which is a method for desensitizing log records based on keyword matching, comprising the following steps

[0042] S1. Build a reusable keyword matching profile. Build a profile containing common sensitive information keywords by analyzing real production log data and combining application and business data.

[0043] S2, obtaining log data records;

[0044] S3. Matching of sensitive keywords in log data; for example, if the log data contains an identity number record "IDNum=3713..." or a bank card number record "card number: 62178888888888888", "IDNum=" and "card number:" can be configured as keywords in the keyword configuration file to serve as a basis for identifying sensitive information.

[0045] S4. Identify sensitive information based on the matching results;

[0046] S5. Desensitize the log data identified as sensitive information;

[0047] S6. Storing log data records, including directly storing the log data identified as non-sensitive information in S4 and the log data of sensitive information after desensitization processing in S5.

[0048] In the above design, the efficient matching algorithm and its implementation based on the keyword configuration file can efficiently and accurately identify sensitive information, making the keyword matching accuracy high and reducing the complexity of processing; and the more flexible update and modification mode of the keyword management configuration file can dynamically adapt to new types of sensitive information without modifying the code, enhancing scalability, simplifying the maintenance process, and reducing manual intervention and management costs. There is no need to record sensitive information in a hierarchical manner, which enhances security.

[0049] Specifically: the configuration file in S1 is used to manage keywords, and keyword information can be added, deleted, and modified according to actual business needs. For example, in diary records, some data cannot be displayed in plain text, involving some personal privacy information, such as name, mobile phone number, home address, ID number, etc., or some data involving industry secrets, which generally need to be recorded in the log due to debugging needs or flow viewing. The configuration file is used to manage which information needs to be blocked and desensitized. Generally, these sensitive data will not exist alone in the log. There must be some descriptive and indicative descriptions to reflect the content of this data. For example, a person's bank card number "62178888888888888" is recorded in the log. Generally, only this string of numbers is recorded in the log. Otherwise, the person viewing the log will not know what this string of numbers means. There will be field descriptions to increase readability, such as "CardNO=62178888888888888" or "Bank card number: 62178888888888888". The two strings "CardNO=" and "Bank card number:" are used as keywords. The configuration file is used to manage these keywords. The keyword information can be added, deleted, and modified according to actual business needs.

[0050] In the above design, the keyword matching configuration file can be dynamically updated and adapted to adapt to new sensitive data types without modifying the code, which simplifies the maintenance process and reduces manual intervention and management costs.

[0051] Specifically: S2, obtaining log data records, specifically, in the program source code, the log recording interface will be called according to the need of data recording during the code execution process, and the called log interface obtains the data content that needs to be recorded in the log. Generally, it refers to the key data recording during the program running process in the program code. This part is in the program source code. During the code execution process, the log recording interface will be called according to the need of data recording, and the data content that needs to be recorded in the log will be input into the log interface.

[0052] Specifically: S3, log data sensitive keyword matching, specifically, after the diary interface obtains data, the data algorithm is used to perform content identification and keyword matching between the obtained content and the keywords in the configuration file.

[0053] Specifically: S4, based on the matching results, performs sensitive information identification, specifically: based on the identification and matching results in S3, determines whether the input log content contains sensitive data that needs to be desensitized and shielded, for example, whether it contains keywords such as "card number, ID number", etc.

[0054] In the above design, sensitive information is identified through data structure and algorithm to ensure the speed and accuracy of the matching process.

[0055] Specifically: S5, desensitizes the log data identified as sensitive information, specifically by replacing the sensitive information. For example, the sensitive information "Card number: 62178888888888888" will be desensitized to "Card number: 6217XXXXXXXXX8888". The sensitive information "ID number: 500888888888886637" will be desensitized to "5008XXXXXXXXX8888".

[0056] In the above design, by replacing sensitive information, the original real data can be covered, which can ensure the security of user information and prevent it from being leaked.

[0057] Specifically: S5, desensitizes the log data identified as sensitive information, specifically by masking the sensitive information. For example, the sensitive information "Card number: 62178888888888888" will be desensitized to "Card number: 6217*********8888". The sensitive information "ID number: 500888888888886637" will be desensitized to "5008**********8888".

[0058] In the above design, by masking sensitive data, the security of user information can be ensured not to be leaked.

[0059] The present application also provides a second embodiment, which is a system for desensitizing log records based on keyword matching, including:

[0060] A keyword profile building module is used to build a profile containing common sensitive information keywords;

[0061] The keyword matching module is used to match the log data to be output for sensitive information, and to use the data structure and algorithm to determine whether the log data to be output is sensitive information;

[0062] The information desensitization processing module is used to desensitize and store log data determined to be sensitive information by replacing or masking it.

[0063] The present application also provides a third embodiment, which is a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, and when the computer program is processed and executed, the steps of the method for desensitizing records based on keyword matching logs are implemented.

[0064] In addition, the computer-readable storage medium of this embodiment may adopt any combination of one or more computer-readable storage media, wherein the computer-readable storage medium includes electrical, optical, electromagnetic, infrared or semiconductor systems, devices or components, or any combination thereof.

[0065] The present application also provides a fourth embodiment, which is a computer device, including a processor, a communication interface, a memory, and a communication bus, wherein the processor, the communication interface, and the memory communicate with each other through the communication bus:

[0066] The memory is used to store computer programs;

[0067] The processor is used to execute the steps of the method for desensitizing records based on keyword matching logs by running the program stored in the memory.

[0068] As an embodiment of the present invention, the communication bus mentioned in the above terminal can be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus, etc. The communication bus can be divided into an address bus, a data bus, a control bus, etc.

[0069] As an implementation mode of the present invention, the communication interface is used for communication between the above-mentioned terminal and other devices.

[0070] As an embodiment of the present invention, the memory may include a random access memory (RAM) or a non-volatile memory, such as at least one disk memory. Optionally, the memory may also be at least one storage device located away from the aforementioned processor.

[0071] As an embodiment of the present invention, the above-mentioned processor can be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc.; it can also be a digital signal processor (DSP), an application specific integrated circuit (ASIC), a field programmable gate array (FPGA) or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components.

[0072] To further explain in detail, it should be understood that the above is only a specific embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention should be included in the protection scope of the present invention.

Claims

1. A method for desensitizing log records based on keyword matching, characterized in that: The following steps are included S1. Build a reusable keyword matching profile; S2, obtaining log data records; S3, matching of sensitive keywords in log data; S4. Identify sensitive information based on the matching results; S5. Desensitize the log data identified as sensitive information; S6. Store log data records.

2. The method for desensitizing log records based on keyword matching according to claim 1 is characterized in that: The configuration file in S1 is used to manage keywords, and keyword information can be added, deleted, and modified according to actual business needs.

3. The method for desensitizing log records based on keyword matching according to claim 1 is characterized in that: The step S2, obtaining log data records, specifically involves calling a log recording interface in the program source code according to the need for data recording during code execution, and the called log interface obtains the data content that needs to be recorded in the log.

4. The method for desensitizing log records based on keyword matching according to claim 1, characterized in that: The S3, log data sensitive keyword matching, specifically, after the diary interface obtains data, the data algorithm is used to perform content identification and keyword matching between the obtained content and the keywords in the configuration file.

5. The method for desensitizing log records based on keyword matching according to claim 1, characterized in that: S4, performing sensitive information identification according to the matching results, specifically: judging whether the input log content contains sensitive data that needs to be desensitized and shielded according to the identification and matching results in S3.

6. The method for desensitizing log records based on keyword matching according to claim 1, characterized in that: S5: desensitizing the log data identified as sensitive information, specifically desensitizing the sensitive information by replacing it.

7. The method for desensitizing log records based on keyword matching according to claim 1, characterized in that: The step S5 desensitizes the log data identified as sensitive information, specifically, desensitizes the sensitive information by masking.

8. A system for desensitizing log records based on keyword matching, characterized by: include, A keyword profile building module is used to build a profile containing common sensitive information keywords; The keyword matching module is used to match the log data to be output for sensitive information, and to use the data structure and algorithm to determine whether the log data to be output is sensitive information; The information desensitization processing module is used to desensitize and store log data determined to be sensitive information by replacing or masking it.

9. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is processed and executed, the steps of the method for desensitizing log records based on keyword matching according to any one of claims 1 to 7 are implemented.

10. A computer device, characterized in that: The method comprises a processor, a communication interface, a memory and a communication bus, wherein the processor, the communication interface and the memory communicate with each other via the communication bus: The memory is used to store computer programs; The processor is used to execute the steps of the method for desensitizing log records based on keyword matching according to any one of claims 1 to 7 by running the program stored in the memory.

Images