Gateway interception method and gateway interception device capable of preventing sensitive information leakage

Abstract

The invention discloses a gateway interception method and a gateway interception device for preventing leakage of sensitive information. The gateway interception method comprises the following steps that: a gateway forwards received interface response data to a sensitive data evaluation model; the sensitive data evaluation model evaluates interface response data and judges whether the interface response data contains sensitive data; and if the judgment result is yes, blocking the forwarding of the gateway for the interface response data, and if the judgment result is no, releasing the forwarding of the gateway for the interface response data. According to the gateway interception method capable of preventing sensitive information leakage, the core is that sensitive data leakage is identified and prevented by using a machine learning technology, and a sensitive data evaluation model can learn and identify complex modes and characteristics of sensitive data from historical data.

Description

Technical Field

[0001] The present invention relates to the technical field of computer network security, and specifically provides a gateway interception method and a gateway interception device for preventing leakage of sensitive information. Background Art

[0002] With the rapid development of Internet technology, data security has become the focus of enterprises. Especially in security scenarios, interfaces are important channels for data exchange between systems. Once there are security vulnerabilities, such as SQL injection (an attack technique whereby attackers insert malicious SQL code into the input field of an application to trick the database into executing unexpected queries or commands, thereby accessing, modifying, or deleting data in the database) and logical vulnerabilities (logical errors in software or system design that attackers can exploit to bypass security controls and perform unauthorized operations), attackers may exploit these vulnerabilities to pull a large amount of user data in a short period of time, leading to data leakage incidents.

[0003] Existing technologies mainly use the following methods to identify and prevent data leakage:

[0004] Rule matching: Sensitive data is identified through preset rules, such as regular expressions matching mobile phone numbers, ID card numbers, etc. However, this method has the following defects: The rules are difficult to cover all variations, resulting in missed reports. The rules are too strict and prone to false positives, such as misidentifying timestamps as mobile phone numbers. The rules require manual maintenance and updates, which are difficult to iterate and cannot adapt to changing data formats.

[0005] Manual review: Security operations personnel manually review interface response data, but this method is inefficient and cannot cope with large-scale data traffic.

[0006] In view of this, the present invention patent is proposed, and the specific technical problems to be solved include:

[0007] Sensitive data identification problem: How to accurately identify sensitive data (such as ID number, mobile phone number, home address, etc.) from a large amount of interface response data and reduce the false alarm rate and missed alarm rate.

[0008] Rule matching optimization problem: The existing sensitive data identification methods based on rule matching have many omissions and false positives. How to optimize rule matching through technical means to improve identification accuracy.

[0009] Model training and iteration issues: How to use historical gateway interface response data to train an efficient and accurate recognition model, and continuously optimize and iterate in practical applications to improve recognition effects.

[0010] Real-time data processing problem: In the gateway scenario, how to achieve real-time processing of interface response data to ensure that when the risk of sensitive data leakage is discovered, an alarm can be quickly issued and the transmission link can be cut off.

[0011] The problem of coordination between manual intervention and model optimization: How to build an early warning platform to enable operation and maintenance personnel to intervene in the model recognition results, and feed back the intervention results to the model to assist in model iterative optimization.

[0012] Network security protection issues: How to reduce the risk of data leakage and improve the company's network security protection capabilities while ensuring data transmission security. Summary of the invention

[0013] In view of the above technical problems, the present invention proposes a gateway interception method and a gateway interception device for preventing leakage of sensitive information. Specifically, the following technical solutions are adopted:

[0014] In a first aspect, the present invention provides a gateway interception method for preventing leakage of sensitive information, comprising:

[0015] The gateway forwards the received interface response data to the sensitive data assessment model;

[0016] The sensitive data evaluation model evaluates the interface response data to determine whether it contains sensitive data;

[0017] If the judgment result is yes, the gateway is blocked from forwarding the interface response data; if the judgment result is no, the gateway is allowed to forward the interface response data.

[0018] As an optional implementation manner of the present invention, a gateway interception method for preventing leakage of sensitive information of the present invention includes:

[0019] Recording a model blocking event of blocking the gateway from forwarding data in response to the interface;

[0020] Send the model blocking event to the operation and maintenance personnel for manual judgment;

[0021] Obtain the manual judgment result. If the manual judgment result is inconsistent with the judgment result of the sensitive data assessment model, mark the manual judgment result data and feed it back to the sensitive data assessment model;

[0022] The sensitive data assessment model is iteratively optimized based on the feedback of labeled manual judgment result data.

[0023] As an optional implementation manner of the present invention, a gateway interception method for preventing leakage of sensitive information of the present invention includes:

[0024] Count the details and quantity of blocking events of each model recorded within the first preset time interval;

[0025] When there are first model blocking events whose number is greater than the first preset blocking event number threshold within the first preset time, an alarm mechanism is triggered to send an alarm message to the operation and maintenance personnel.

[0026] As an optional implementation manner of the present invention, a gateway interception method for preventing leakage of sensitive information of the present invention includes:

[0027] Counting the total number of blocking events of each model recorded within the second preset time interval;

[0028] When the total number of blocking events of each model recorded within the second preset time interval is greater than the second preset blocking event number threshold, the gateway stops forwarding the interface response data to the sensitive data assessment model, and triggers the alarm mechanism to send an alarm message to the operation and maintenance personnel;

[0029] The second preset time interval is greater than the first preset time interval, and the second preset blocking event quantity threshold is greater than the first preset blocking event quantity threshold.

[0030] As an optional implementation manner of the present invention, a gateway interception method for preventing leakage of sensitive information of the present invention includes:

[0031] Obtain the manual review results of the alarm information by the operation and maintenance personnel;

[0032] If there is an error in forwarding the interface response data targeted by the blocking gateway in the first model blocking event, the request IP corresponding to the interface response data targeted by the blocking gateway in the first model blocking event is added to the gateway temporary whitelist;

[0033] The gateway directly releases the interface response data requested again by the requesting IP that is added to the gateway's temporary whitelist.

[0034] As an optional implementation manner of the present invention, in a gateway interception method for preventing leakage of sensitive information of the present invention, the sensitive data evaluation model is obtained by training based on a machine learning model, and the training process of the sensitive data evaluation model includes:

[0035] Obtain historical gateway interface response data, which includes normal operation data and data that may contain sensitive information;

[0036] Perform data cleaning on historical gateway interface response data;

[0037] The historical gateway interface response data after data cleaning is marked, and the data containing sensitive information is marked as a positive sample data set, and the data not containing sensitive information is marked as a negative sample data set;

[0038] Use positive sample data sets and negative sample data sets to feed the machine learning model for learning and training to obtain a sensitive data assessment model.

[0039] In a second aspect, the present invention provides a gateway interception device for preventing leakage of sensitive information, comprising:

[0040] A sensitive data assessment module receives the interface response data forwarded by the gateway;

[0041] The sensitive data evaluation module uses a sensitive data evaluation model to evaluate the interface response data to determine whether it contains sensitive data;

[0042] The sensitive data leakage prevention module blocks the gateway from forwarding the interface response data if the judgment result is yes, and allows the gateway to forward the interface response data if the judgment result is no.

[0043] As an optional embodiment of the present invention, a gateway interception device for preventing leakage of sensitive information of the present invention includes a model training platform, the sensitive data evaluation model is obtained by training a machine learning model based on the model training platform, and the training process of the sensitive data evaluation model includes:

[0044] Obtain historical gateway interface response data, which includes normal operation data and data that may contain sensitive information;

[0045] Perform data cleaning on historical gateway interface response data;

[0046] The historical gateway interface response data after data cleaning is marked, and the data containing sensitive information is marked as a positive sample data set, and the data not containing sensitive information is marked as a negative sample data set;

[0047] The positive sample data set and the negative sample data set are put into the model training platform, and the machine learning model is trained to obtain a sensitive data evaluation model.

[0048] As an optional implementation mode of the present invention, a gateway interception device for preventing leakage of sensitive information of the present invention includes an operation and maintenance evaluation system:

[0049] The sensitive data leakage prevention module records the model blocking event of blocking the gateway from forwarding the interface response data;

[0050] The sensitive data leakage prevention module sends the model blocking event to the operation and maintenance assessment system for manual judgment by the operation and maintenance personnel;

[0051] The operation and maintenance assessment system obtains the manual judgment results. If the manual judgment results are inconsistent with the judgment results of the sensitive data assessment model, the manual judgment result data is marked and fed back to the model training platform;

[0052] The model training platform iteratively optimizes the sensitive data assessment model based on the feedback of labeled manual judgment result data.

[0053] In a third aspect, the present invention provides a computer-readable recording medium storing a computer-executable program, which, when executed, implements the gateway interception method for preventing leakage of sensitive information.

[0054] Compared with the prior art, the present invention has the following beneficial effects:

[0055] The invention discloses a gateway interception method for preventing leakage of sensitive information. The core of the method is to use machine learning technology to identify and prevent leakage of sensitive data. This sensitive data evaluation model can learn from historical data and identify complex patterns and features of sensitive data. Specifically, it has the following advantages:

[0056] Advantage 1: Improve the accuracy of sensitive data identification.

[0057] Reasoning: Because the sensitive data assessment model can learn complex patterns and features from historical data, it can more accurately identify various forms of sensitive data, thereby reducing false negatives and false positives.

[0058] Advantage 2: Automated rule iteration to improve adaptability.

[0059] Reasoning: The sensitive data assessment model is able to automatically learn from new data, which means it can continuously update and optimize recognition rules to adapt to changes in data formats and new security threats.

[0060] Advantage three: Real-time monitoring and protection, enhanced response speed.

[0061] Reasoning: By implementing the sensitive data evaluation model on the gateway, the present invention can realize real-time analysis of interface response data, timely discover and prevent sensitive data leakage, and improve the response speed of the system.

[0062] Advantage 4: Build a closed-loop feedback system to continuously optimize the model.

[0063] Reasoning: The manual judgment results of the early warning platform are fed back to the model, forming a closed-loop feedback system, which enables the sensitive data assessment model to continuously learn and improve, thereby improving its long-term effectiveness.

[0064] Advantage 5: Strengthen network security protection and reduce the risk of data leakage.

[0065] Reasoning: The present invention effectively reduces the occurrence of data leakage incidents by improving the accuracy of sensitive data identification and real-time protection capabilities, thereby improving the company's network security protection level. BRIEF DESCRIPTION OF THE DRAWINGS

[0066] Figure 1 A flowchart of a gateway interception method for preventing leakage of sensitive information according to a first embodiment of the present invention;

[0067] Figure 2 A schematic diagram of a gateway interception device for preventing leakage of sensitive information according to a first embodiment of the present invention;

[0068] Figure 3 A schematic structural diagram of an electronic device according to a second embodiment of the present invention;

[0069] Figure 4 A schematic diagram of a computer-readable recording medium according to a second embodiment of the present invention. DETAILED DESCRIPTION

[0070] To make the purpose, technical solution and advantages of the embodiments of the present invention clearer, the technical solution in the embodiments of the present invention will be described clearly and completely in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of them.

[0071] Therefore, the following detailed description of the embodiments of the present invention is not intended to limit the scope of the invention claimed for protection, but merely represents some embodiments of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0072] It should be noted that, in the absence of conflict, the embodiments of the present invention and the features and technical solutions in the embodiments may be combined with each other.

[0073] It should be noted that similar reference numerals and letters denote similar items in the following drawings, and therefore, once an item is defined in one drawing, further definition and explanation thereof is not required in subsequent drawings.

[0074] In the description of the present invention, it should be noted that the orientation or positional relationship indicated by the terms "upper", "lower", etc. is based on the orientation or positional relationship shown in the drawings, or the orientation or positional relationship in which the invention product is usually placed when in use, or the orientation or positional relationship commonly understood by those skilled in the art. Such terms are only for the convenience of describing the present invention and simplifying the description, and do not indicate or imply that the device or element referred to must have a specific orientation, be constructed and operated in a specific orientation, and therefore cannot be understood as limiting the present invention. In addition, the terms "first", "second", etc. are only used to distinguish the description, and cannot be understood as indicating or implying relative importance.

[0075] Embodiment 1

[0076] See also Figure 1 As shown, a gateway interception method for preventing leakage of sensitive information in this embodiment includes:

[0077] The gateway forwards the received interface response data to the sensitive data assessment model;

[0078] The sensitive data evaluation model evaluates the interface response data to determine whether it contains sensitive data;

[0079] If the judgment result is yes, the gateway is blocked from forwarding the interface response data; if the judgment result is no, the gateway is allowed to forward the interface response data.

[0080] The core of the sensitive information leakage prevention gateway interception method of this embodiment is to use machine learning technology to identify and prevent sensitive data leakage. This sensitive data evaluation model can learn from historical data and identify complex patterns and features of sensitive data.

[0081] Compared with the existing rule-based matching of sensitive data, since rule matching relies on fixed patterns, it cannot adapt to the diversity and changes of data, resulting in the inability to identify all forms of sensitive data (omissions), and it may also mistakenly identify non-sensitive data as sensitive data (false positives). In a gateway interception method for preventing leakage of sensitive information in this embodiment, the sensitive data evaluation model adopts a machine learning model, which can learn the complex patterns and features of data, thereby more accurately identifying sensitive data and reducing omissions and false positives.

[0082] Compared with the existing manual review of sensitive data, manual review cannot process a large amount of interface response data, is inefficient, and cannot cope with large-scale data traffic, resulting in the inability to monitor and prevent data leakage in real time. In this embodiment, a gateway interception method for preventing leakage of sensitive information, a sensitive data assessment model can process a large amount of data in real time, quickly identify potential leakage risks, and improve monitoring efficiency.

[0083] In addition, a gateway interception method for preventing leakage of sensitive information in this embodiment has a real-time data analysis and blocking mechanism: real-time data analysis of interface response data is implemented at the gateway level. Once the risk of sensitive data leakage is detected, an alarm is immediately triggered and the transmission link is cut off to prevent further data leakage.

[0084] Furthermore, a gateway interception method for preventing leakage of sensitive information in this embodiment includes:

[0085] Recording a model blocking event of blocking the gateway from forwarding data in response to the interface;

[0086] Send the model blocking event to the operation and maintenance personnel for manual judgment;

[0087] Obtain the manual judgment result. If the manual judgment result is inconsistent with the judgment result of the sensitive data assessment model, mark the manual judgment result data and feed it back to the sensitive data assessment model;

[0088] The sensitive data assessment model is iteratively optimized based on the feedback of labeled manual judgment result data.

[0089] In this embodiment, a gateway interception method for preventing leakage of sensitive information is used to ensure the accuracy of sensitive data identification by the sensitive data assessment model. The event is blocked by the manual judgment model, and the judgment result data is fed back to the sensitive data assessment model. The sensitive data assessment model is iteratively optimized, and the machine learning model is retrained and optimized using the fed-back data. Through continuous iteration, the sensitive data assessment model will better adapt to the actual data environment and security requirements.

[0090] Compared with the existing rule matching method for sensitive data, rule matching requires manual maintenance and updating, and iteration is difficult. With the change of data format and the emergence of new types of sensitive data, manual updating of rules is both time-consuming and error-prone. In a gateway interception method for preventing leakage of sensitive information in this embodiment, the sensitive data evaluation model can automatically learn from new data, continuously optimize itself, and reduce dependence on manual maintenance.

[0091] As an optional implementation of this embodiment, a gateway interception method for preventing leakage of sensitive information in this embodiment includes:

[0092] Count the details and quantity of blocking events of each model recorded within the first preset time interval;

[0093] When there are first model blocking events whose number is greater than the first preset blocking event number threshold within the first preset time, an alarm mechanism is triggered to send an alarm message to the operation and maintenance personnel.

[0094] In this embodiment, the first preset time interval can be set to be relatively short. By monitoring that the same model blocking event (i.e., the first model blocking event) is blocked multiple times within the shorter first preset time interval, and the number threshold of the first preset blocking events is exceeded, it is necessary to manually analyze the request IP of the interface response data corresponding to the first model blocking event, and promptly determine that the analysis is a normal request and release it. If it is determined that the analysis is an abnormal attack, it will be blocked in time (added to the blacklist).

[0095] Furthermore, a gateway interception method for preventing leakage of sensitive information in this embodiment includes:

[0096] Obtain the manual review results of the alarm information by the operation and maintenance personnel;

[0097] If there is an error in forwarding the interface response data targeted by the blocking gateway in the first model blocking event, the request IP corresponding to the interface response data targeted by the blocking gateway in the first model blocking event is added to the gateway temporary whitelist;

[0098] The gateway directly releases the interface response data requested again by the requesting IP that is added to the gateway's temporary whitelist.

[0099] This embodiment manually reviews the first model blocking events whose blocking times are greater than the first preset blocking event number threshold. When it is found that the first model blocking event is misjudged, the request IP corresponding to the interface response data targeted by the blocked gateway in the first model blocking event can be added to the gateway temporary whitelist. Thereafter, the interface data requested by the request IP again will no longer be forwarded to the sensitive data assessment model.

[0100] A gateway interception method for preventing leakage of sensitive information in this embodiment includes:

[0101] Counting the total number of blocking events of each model recorded within the second preset time interval;

[0102] When the total number of blocking events of each model recorded within the second preset time interval is greater than the second preset blocking event number threshold, the gateway stops forwarding the interface response data to the sensitive data assessment model, and triggers the alarm mechanism to send an alarm message to the operation and maintenance personnel;

[0103] The second preset time interval is greater than the first preset time interval, and the second preset blocking event quantity threshold is greater than the first preset blocking event quantity threshold.

[0104] In this embodiment, the second preset time interval can be set to be relatively long. When the total number of blocking events of each model is large within the second preset time interval, the sensitive data evaluation model may be abnormal. Therefore, the gateway of this embodiment stops forwarding interface response data to the sensitive data evaluation model, and the operation and maintenance personnel promptly evaluate and optimize the sensitive data evaluation model. At the same time, when the gateway stops forwarding interface response data to the sensitive data evaluation model, the existing rule matching method or manual review method can be used to monitor the interface response data forwarded by the gateway to avoid sensitive data leakage.

[0105] As an optional implementation of this embodiment, in a gateway interception method for preventing leakage of sensitive information in this embodiment, the sensitive data evaluation model is obtained based on training of a machine learning model, and the training process of the sensitive data evaluation model includes:

[0106] Obtain historical gateway interface response data, which includes normal operation data and data that may contain sensitive information;

[0107] Perform data cleaning on historical gateway interface response data;

[0108] The historical gateway interface response data after data cleaning is marked, and the data containing sensitive information is marked as a positive sample data set, and the data not containing sensitive information is marked as a negative sample data set;

[0109] Use positive sample data sets and negative sample data sets to feed the machine learning model for learning and training to obtain a sensitive data assessment model.

[0110] The sensitive data assessment model of this embodiment is trained based on a machine learning model. Since the machine learning model can learn complex patterns and features from historical data, it can more accurately identify various forms of sensitive data, thereby reducing underreporting and false positives.

[0111] See also Figure 1 and Figure 2 As shown, the specific implementation process of a gateway interception method for preventing leakage of sensitive information in this embodiment includes:

[0112] Step 1: Obtain historical gateway interface response data and collect interface response data from the enterprise's gateway system for the past year. This data includes normal operation data and data that may contain sensitive information.

[0113] Step 2: Data preprocessing and labeling: clean the collected interface response data, remove invalid and erroneous data, and ensure data quality. Label the data, label the data containing sensitive information as positive samples, and label the data without sensitive information as negative samples.

[0114] Step 3: Train the machine learning model, use the preprocessed and labeled data set, and put it into the large model training platform to train the sensitive data evaluation model, which can identify sensitive data in the interface response data. During the training process, use cross-validation and other techniques to evaluate the performance of the model, and adjust the model parameters based on the evaluation results.

[0115] Step 4: Deploy the trained sensitive data evaluation model to the gateway system. The gateway forwards the interface response data to the sensitive data leakage prevention module. The sensitive data evaluation model will evaluate each interface response to determine whether it contains sensitive data.

[0116] Step 5: Sensitive data is detected. If the sensitive data assessment model identifies that the interface response contains sensitive data, the system will immediately trigger an alarm mechanism. At the same time, the system will automatically block the current data transmission link to prevent further leakage of sensitive data.

[0117] Step 7: Feed the results back to the model. The system will record the alarm and transmission blocking events, and the subsequent operation and maintenance personnel will make manual judgments. After the judgment is completed, the information will be fed back to the sensitive data assessment model. If a false alarm occurs, the corresponding data also needs to be marked and fed back to the sensitive data assessment model.

[0118] Step 8: Model iteration and optimization: Use the feedback data to retrain and optimize the sensitive data assessment model. Through continuous iteration, the sensitive data assessment model will better adapt to the actual data environment and security requirements.

[0119] In summary, the gateway interception method for preventing leakage of sensitive information in this embodiment has the following advantages:

[0120] Advantage 1: Improve the accuracy of sensitive data identification.

[0121] Reasoning: Because the sensitive data assessment model can learn complex patterns and features from historical data, it can more accurately identify various forms of sensitive data, thereby reducing false negatives and false positives.

[0122] Advantage 2: Automated rule iteration to improve adaptability.

[0123] Reasoning: The sensitive data assessment model is able to automatically learn from new data, which means it can continuously update and optimize recognition rules to adapt to changes in data formats and new security threats.

[0124] Advantage three: Real-time monitoring and protection, enhanced response speed.

[0125] Reasoning: By implementing the sensitive data evaluation model on the gateway, the present invention can realize real-time analysis of interface response data, timely discover and prevent sensitive data leakage, and improve the response speed of the system.

[0126] Advantage 4: Build a closed-loop feedback system to continuously optimize the model.

[0127] Reasoning: The manual judgment results of the early warning platform are fed back to the model, forming a closed-loop feedback system, which enables the sensitive data assessment model to continuously learn and improve, thereby improving its long-term effectiveness.

[0128] Advantage 5: Strengthen network security protection and reduce the risk of data leakage.

[0129] Reasoning: The present invention effectively reduces the occurrence of data leakage incidents by improving the accuracy of sensitive data identification and real-time protection capabilities, thereby improving the company's network security protection level.

[0130] See also Figure 2 As shown, this embodiment also provides a gateway interception device for preventing leakage of sensitive information, including an anti-leakage system, the anti-leakage system including:

[0131] A sensitive data assessment module receives the interface response data forwarded by the gateway;

[0132] The sensitive data evaluation module uses a sensitive data evaluation model to evaluate the interface response data to determine whether it contains sensitive data;

[0133] The sensitive data leakage prevention module blocks the gateway from forwarding the interface response data if the judgment result is yes, and allows the gateway to forward the interface response data if the judgment result is no.

[0134] The core of the sensitive information leakage prevention gateway interception device of this embodiment is to use machine learning technology to identify and prevent sensitive data leakage. This sensitive data evaluation model can learn from historical data and identify complex patterns and features of sensitive data.

[0135] Compared with the existing rule-based matching of sensitive data, since rule matching relies on fixed patterns, it cannot adapt to the diversity and changes of data, resulting in the inability to identify all forms of sensitive data (omissions), and it may also mistakenly identify non-sensitive data as sensitive data (false positives). In a gateway interception device for preventing leakage of sensitive information in this embodiment, the sensitive data evaluation model adopts a machine learning model, which can learn the complex patterns and features of data, thereby more accurately identifying sensitive data and reducing omissions and false positives.

[0136] Compared with the existing manual review of sensitive data, manual review cannot process a large amount of interface response data, is inefficient, and cannot cope with large-scale data traffic, resulting in the inability to monitor and prevent data leakage in real time. In this embodiment, a gateway interception device for preventing leakage of sensitive information, a sensitive data assessment model can process a large amount of data in real time, quickly identify potential leakage risks, and improve monitoring efficiency.

[0137] In addition, a gateway interception device for preventing leakage of sensitive information in this embodiment has a real-time data analysis and blocking mechanism: real-time data analysis of interface response data is implemented at the gateway level. Once the risk of sensitive data leakage is detected, an alarm is immediately triggered and the transmission link is cut off to prevent further data leakage.

[0138] Furthermore, the gateway interception device for preventing leakage of sensitive information described in this embodiment includes a model training platform, the sensitive data evaluation model is obtained by training the machine learning model based on the model training platform, and the training process of the sensitive data evaluation model includes:

[0139] Obtain historical gateway interface response data, which includes normal operation data and data that may contain sensitive information;

[0140] Perform data cleaning on historical gateway interface response data;

[0141] The historical gateway interface response data after data cleaning is marked, and the data containing sensitive information is marked as a positive sample data set, and the data not containing sensitive information is marked as a negative sample data set;

[0142] The positive sample data set and the negative sample data set are put into the model training platform, and the machine learning model is trained to obtain a sensitive data evaluation model.

[0143] The sensitive data assessment model of this embodiment is trained based on a machine learning model. Since the machine learning model can learn complex patterns and features from historical data, it can more accurately identify various forms of sensitive data, thereby reducing underreporting and false positives.

[0144] Furthermore, a gateway interception device for preventing leakage of sensitive information in this embodiment includes an operation and maintenance evaluation system:

[0145] The sensitive data leakage prevention module records the model blocking event of blocking the gateway from forwarding the interface response data;

[0146] The sensitive data leakage prevention module sends the model blocking event to the operation and maintenance assessment system for manual judgment by the operation and maintenance personnel;

[0147] The operation and maintenance assessment system obtains the manual judgment results. If the manual judgment results are inconsistent with the judgment results of the sensitive data assessment model, the manual judgment result data is marked and fed back to the model training platform;

[0148] The model training platform iteratively optimizes the sensitive data assessment model based on the feedback of labeled manual judgment result data.

[0149] In order to ensure the accuracy of sensitive data assessment model in identifying sensitive data, a gateway interception device for preventing leakage of sensitive information in this embodiment uses an artificial judgment model to block events, and feeds back the judgment result data to the sensitive data assessment model. The sensitive data assessment model is iteratively optimized, and the machine learning model is retrained and optimized using the fed-back data. Through continuous iteration, the sensitive data assessment model will better adapt to the actual data environment and security requirements.

[0150] Embodiment 2

[0151] The following describes an electronic device embodiment of the present invention, which can be regarded as a specific physical implementation of the method and device embodiments of the present invention. The details described in the electronic device embodiment of the present invention should be regarded as a supplement to the above method or device embodiments; details not disclosed in the electronic device embodiment of the present invention can be implemented with reference to the above method or device embodiments.

[0152] Figure 3 It is a structural diagram of an electronic device of an embodiment of the present invention, which includes a processor and a memory, wherein the memory is used to store a computer executable program, and when the computer program is executed by the processor, the processor executes a gateway interception method for preventing leakage of sensitive information of embodiment one.

[0153] like Figure 3 As shown, the electronic device is presented in the form of a general computing device. The processor may be one or more and work in coordination. The present invention does not exclude distributed processing, that is, the processor may be dispersed in different physical devices. The electronic device of the present invention is not limited to a single entity, but may also be the sum of multiple physical devices.

[0154] The memory stores a computer executable program, which is usually a machine-readable code. The computer-readable program can be executed by the processor to enable the electronic device to perform the method of the present invention, or at least part of the steps in the method.

[0155] The memory includes a volatile memory, such as a random access memory unit (RAM) and / or a cache memory unit, and may also be a non-volatile memory, such as a read-only memory unit (ROM).

[0156] Optionally, in this embodiment, the electronic device further includes an I / O interface, which is used for the electronic device to exchange data with an external device. The I / O interface can represent one or more of several types of bus structures, including a storage unit bus or a storage unit controller, a peripheral bus, a graphics acceleration port, a processing unit, or a local bus using any of a variety of bus structures.

[0157] It should be understood that Figure 3 The electronic device shown is only an example of the present invention, and the electronic device of the present invention may also include elements or components not shown in the above examples. For example, some electronic devices also include display units such as display screens, and some electronic devices also include human-computer interaction elements such as buttons, keyboards, etc. As long as the electronic device can execute the computer-readable program in the memory to implement the method of the present invention or at least part of the steps of the method, it can be considered as an electronic device covered by the present invention.

[0158] Figure 4 Schematic diagram of a computer readable recording medium according to an embodiment of the present invention. Figure 4 As shown, a computer executable program is stored in a computer-readable recording medium, and when the computer executable program is executed, a gateway interception method for preventing leakage of sensitive information in Embodiment 1 of the present invention is implemented. The computer-readable recording medium may include a data signal propagated in a baseband or as part of a carrier wave, which carries a readable program code. This propagated data signal may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. The readable recording medium may also be any readable medium other than a readable recording medium, which may send, propagate, or transmit a program for use by or in combination with an instruction execution system, device, or device. The program code contained on the readable recording medium may be transmitted using any suitable medium, including but not limited to wireless, wired, optical cable, RF, etc., or any suitable combination of the above.

[0159] Program code for performing the operations of the present invention may be written in any combination of one or more programming languages, including object-oriented programming languages ​​such as Java, C++, etc., and conventional procedural programming languages ​​such as "C" or similar programming languages. The program code may be executed entirely on the user computing device, partially on the user device, as a separate software package, partially on the user computing device and partially on a remote computing device, or entirely on a remote computing device or server. In cases involving a remote computing device, the remote computing device may be connected to the user computing device through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computing device (e.g., through the Internet using an Internet service provider).

[0160] Through the above description of the implementation mode, it is easy for those skilled in the art to understand that the present invention can be implemented by hardware capable of executing a specific computer program, such as the system of the present invention, and the electronic processing unit, server, client, mobile phone, control unit, processor, etc. contained in the system. The present invention can also be implemented by computer software that executes the method of the present invention, such as control software executed by a microprocessor, an electronic control unit, a client, a server, etc. However, it should be noted that the computer software that executes the method of the present invention is not limited to being executed by one or a specific hardware entity, and it can also be implemented in a distributed manner by unspecified specific hardware. For computer software, the software product can be stored in a computer-readable recording medium (which can be a CD-ROM, a USB flash drive, a mobile disk, etc.), and can also be distributed and stored on the network, as long as it enables the electronic device to execute the method according to the present invention.

[0161] The above embodiments are only used to illustrate the present invention and are not intended to limit the technical solutions described in the present invention. Although the present invention has been described in detail with reference to the above embodiments, the present invention is not limited to the above specific implementation methods. Therefore, any modification or equivalent replacement of the present invention; and all technical solutions and improvements thereof that do not depart from the spirit and scope of the invention are included in the scope of the claims of the present invention.

Claims

1. A gateway interception method for preventing leakage of sensitive information, characterized in that: include: The gateway forwards the received interface response data to the sensitive data assessment model; The sensitive data evaluation model evaluates the interface response data to determine whether it contains sensitive data; If the judgment result is yes, the gateway is blocked from forwarding the interface response data; if the judgment result is no, the gateway is allowed to forward the interface response data.

2. A gateway interception method for preventing leakage of sensitive information according to claim 1, characterized in that: include: Recording a model blocking event of blocking the gateway from forwarding data in response to the interface; Send the model blocking event to the operation and maintenance personnel for manual judgment; Obtain the manual judgment result. If the manual judgment result is inconsistent with the judgment result of the sensitive data assessment model, mark the manual judgment result data and feed it back to the sensitive data assessment model; The sensitive data assessment model is iteratively optimized based on the feedback of labeled manual judgment result data.

3. A gateway interception method for preventing leakage of sensitive information according to claim 2, characterized in that: include: Count the details and quantity of blocking events of each model recorded within the first preset time interval; When there are first model blocking events whose number is greater than the first preset blocking event number threshold within the first preset time, an alarm mechanism is triggered to send an alarm message to the operation and maintenance personnel.

4. A gateway interception method for preventing leakage of sensitive information according to claim 3, characterized in that: include: Counting the total number of blocking events of each model recorded within the second preset time interval; When the total number of blocking events of each model recorded within the second preset time interval is greater than the second preset blocking event number threshold, the gateway stops forwarding the interface response data to the sensitive data assessment model, and triggers the alarm mechanism to send an alarm message to the operation and maintenance personnel; The second preset time interval is greater than the first preset time interval, and the second preset blocking event quantity threshold is greater than the first preset blocking event quantity threshold.

5. A gateway interception method for preventing leakage of sensitive information according to claim 3, characterized in that: include: Obtain the manual review results of the alarm information by the operation and maintenance personnel; If there is an error in forwarding the interface response data targeted by the blocking gateway in the first model blocking event, the request IP corresponding to the interface response data targeted by the blocking gateway in the first model blocking event is added to the gateway temporary whitelist; The gateway directly releases the interface response data requested again by the requesting IP that is added to the gateway's temporary whitelist.

6. A gateway interception method for preventing leakage of sensitive information according to claim 1, characterized in that: The sensitive data assessment model is obtained through training based on a machine learning model. The training process of the sensitive data assessment model includes: Obtain historical gateway interface response data, which includes normal operation data and data that may contain sensitive information; Perform data cleaning on historical gateway interface response data; The historical gateway interface response data after data cleaning is marked, and the data containing sensitive information is marked as a positive sample data set, and the data not containing sensitive information is marked as a negative sample data set; Use positive sample data sets and negative sample data sets to feed the machine learning model for learning and training to obtain a sensitive data assessment model.

7. A gateway interception device for preventing leakage of sensitive information, characterized in that: include: A sensitive data assessment module receives the interface response data forwarded by the gateway; The sensitive data evaluation module uses a sensitive data evaluation model to evaluate the interface response data to determine whether it contains sensitive data; The sensitive data leakage prevention module blocks the gateway from forwarding the interface response data if the judgment result is yes, and allows the gateway to forward the interface response data if the judgment result is no.

8. A gateway interception device for preventing leakage of sensitive information according to claim 7, characterized in that: A model training platform is included, and the sensitive data assessment model is obtained by training the machine learning model based on the model training platform. The training process of the sensitive data assessment model includes: Obtain historical gateway interface response data, which includes normal operation data and data that may contain sensitive information; Perform data cleaning on historical gateway interface response data; The historical gateway interface response data after data cleaning is marked, and the data containing sensitive information is marked as a positive sample data set, and the data not containing sensitive information is marked as a negative sample data set; The positive sample data set and the negative sample data set are put into the model training platform, and the machine learning model is trained to obtain a sensitive data evaluation model.

9. A gateway interception device for preventing leakage of sensitive information according to claim 8, characterized in that: Including operation and maintenance assessment system: The sensitive data leakage prevention module records the model blocking event of blocking the gateway from forwarding the interface response data; The sensitive data leakage prevention module sends the model blocking event to the operation and maintenance assessment system for manual judgment by the operation and maintenance personnel; The operation and maintenance assessment system obtains the manual judgment results. If the manual judgment results are inconsistent with the judgment results of the sensitive data assessment model, the manual judgment result data is marked and fed back to the model training platform; The model training platform iteratively optimizes the sensitive data assessment model based on the feedback of labeled manual judgment result data.

10. A computer-readable recording medium storing a computer-executable program, characterized in that: When the computer executable program is executed, a gateway interception method for preventing leakage of sensitive information as described in any one of claims 1 to 6 is implemented.

Images