Data flow control method and system and electronic equipment

Abstract

The invention provides a data flow control method and system and electronic equipment, and relates to the field of information security processing, the method uses a regular expression and an extraction strategy corresponding to a data packet to identify sensitive data in an interactive data stream, can accurately obtain a potential library dragging behavior, and reduces the false alarm rate of the library dragging behavior; meanwhile, according to the method, blocking measures can be taken quickly after the drag behavior is found, the adaptability and the real-time performance of drag detection are improved, and therefore the risk of data loss is greatly reduced.

Description

Technical Field

[0001] The present invention relates to the field of information security processing, and in particular to a data flow control method, system and electronic equipment. Background Art

[0002] With the rapid development of cloud computing and big data technology, data security has become the most important issue facing data service providers. In recent years, data dumping incidents have occurred frequently, causing significant economic losses and reputation damage to data service providers. Therefore, how to monitor and effectively prevent data dumping in real time has become an important research direction in the field of information security.

[0003] Current methods for detecting data dragging mainly rely on traffic monitoring and log analysis, but such solutions have various defects in data dragging detection, especially in key aspects such as adaptability, false alarm rate and real-time performance. They are unable to meet the current needs of timely and effective protection of data in the database when data dragging occurs. Summary of the invention

[0004] In view of this, the purpose of the present invention is to provide a data flow control method, system and electronic device. The method uses regular expressions and extraction strategies corresponding to data packets to identify sensitive data in interactive data flows, and can accurately obtain potential database drag behaviors, thereby reducing the false alarm rate of database drag behaviors; at the same time, the method can quickly take blocking measures after discovering database drag behaviors, thereby improving the adaptability and real-time performance of database drag detection, thereby greatly reducing the risk of data loss.

[0005] In a first aspect, an embodiment of the present invention provides a data flow control method, the method comprising: Traffic monitoring steps: obtaining the interactive data flow of the target database in real time, and using the mirror data of the interactive data flow to determine the data packet corresponding to the interactive data flow; Data classification step: classify the data packets using the regular expressions corresponding to the data packets and the preset extraction strategy, and determine the sensitive data in the data packets based on the classification results; Data processing steps: After controlling the target database to drag sensitive data into the database, obtain the behavior data corresponding to the sensitive data, determine the encryption strategy corresponding to the sensitive data based on the behavior data, and use the encryption strategy to encrypt the sensitive data.

[0006] Optional flow monitoring steps include: Determine the cloud server corresponding to the target database, use the cloud server's gateway to obtain the interactive data stream in real time, and generate mirror data corresponding to the interactive data stream through the traffic mirroring module in the gateway; Capture mirrored data in real time and identify data packets based on the mirrored data; The preprocessing rules corresponding to the data packet are obtained, the cleaning strategy, formatting strategy and denoising strategy corresponding to the data packet are determined using the preprocessing rules, and the preprocessing operation is performed on the data packet according to the cleaning strategy, formatting strategy and denoising strategy.

[0007] Optionally, the data classification step includes: The data packets are filtered using the regular expression of the data packets to obtain the filtering result of the data packets; Determine the risk value of the data packets in the screening results according to the preset data identification strategy, and classify the data packets based on the risk value to obtain the classification results; The sensitive data contained in the data packet is determined based on the classification result.

[0008] Optionally, sensitive data contained in the data packet is determined based on the classification result, including: Determine the sensitivity value of the interactive data flow corresponding to the data packet based on the classification result, and compare the sensitivity value with a preset threshold; If the sensitivity value is greater than the preset threshold, the interactive data flow is determined as sensitive data; if the sensitivity value is not greater than the preset threshold, the flow monitoring step is re-executed.

[0009] Optionally, determining the risk value of the data packet in the screening result according to a preset data identification strategy, and classifying the data packet based on the risk value to obtain a classification result, including: Determine data identification strategies based on preset machine learning models; Input the screening results into the machine learning model, and control the machine learning model to output the risk value corresponding to the data packet according to the data identification strategy; The data packets are marked using the risk value, and the data packets are classified according to the marking result to obtain the classification result.

[0010] Optional data processing steps include: Control the dragging of sensitive data from the target database based on the classification results; Obtaining behavioral analysis results of sensitive data, and determining abnormal data contained in the sensitive data based on the behavioral analysis results; Control abnormal data to remove it from the interactive data flow, and use the preset encryption strategy to encrypt sensitive data.

[0011] Optionally, after the data processing step is completed, the method further includes a log storage step: Obtain the encrypted sensitive data, and obtain the data logs and operation logs corresponding to the sensitive data; Upload data logs and operation logs to the cloud server.

[0012] Optionally, after uploading the data log and the operation log to the cloud server, the method further includes: The target database is updated using data logs and operation logs.

[0013] In a second aspect, the present invention provides a data flow control system, the system comprising: Traffic monitoring unit: used to obtain the interactive data flow of the target database in real time, and determine the data packet corresponding to the interactive data flow by using the mirror data of the interactive data flow; Data classification unit: used to classify data packets using regular expressions corresponding to the data packets and preset extraction strategies, and determine sensitive data in the data packets based on the classification results; Data processing unit: used to control the target database to drag sensitive data into the database, obtain the behavior data corresponding to the sensitive data, determine the encryption strategy corresponding to the sensitive data based on the behavior data, and encrypt the sensitive data using the encryption strategy.

[0014] In a third aspect, an embodiment of the present invention further provides an electronic device, including a processor and a memory, wherein the memory stores computer-executable instructions that can be executed by the processor, and the processor executes the computer-executable instructions to implement the steps of the data flow control method provided in the first aspect.

[0015] In a fourth aspect, an embodiment of the present invention further provides a storage medium, which stores computer executable instructions. When the computer executable instructions are called and executed by a processor, the computer executable instructions prompt the processor to implement the steps of the data flow control method provided in the first aspect.

[0016] A data flow control method, system and electronic device provided by the embodiment of the present invention, in the process of detecting and processing the dragging behavior, the method first obtains the interactive data flow of the target database in real time, and uses the mirror data of the interactive data flow to determine the data packet corresponding to the interactive data flow; then uses the regular expression corresponding to the data packet and the preset extraction strategy to classify the data packet, and determines the sensitive data in the data packet according to the classification result; finally, after controlling the dragging operation on the sensitive data in the target database, obtains the behavior data corresponding to the sensitive data, determines the encryption strategy corresponding to the sensitive data based on the behavior data, and uses the encryption strategy to encrypt the sensitive data. The method uses the regular expression and extraction strategy corresponding to the data packet to identify the sensitive data in the interactive data flow, can accurately obtain the potential dragging behavior, and reduce the false alarm rate of the dragging behavior; at the same time, the method can quickly take blocking measures after discovering the dragging behavior, improves the adaptability and real-time performance of the dragging detection, and thus greatly reduces the risk of data loss.

[0017] Other features and advantages of the present invention will be described in the following description, and partly become apparent from the description, or understood by practicing the present invention. The purpose and other advantages of the present invention are realized and obtained by the structures particularly pointed out in the description, claims and drawings.

[0018] In order to make the above-mentioned objects, features and advantages of the present invention more obvious and easy to understand, preferred embodiments are given below and described in detail with reference to the accompanying drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] In order to more clearly illustrate the specific implementation methods of the present invention or the technical solutions in the prior art, the drawings required for use in the specific implementation methods or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are some implementation methods of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0020] Figure 1 A flow chart of a data flow control method provided by an embodiment of the present invention; Figure 2 A flow chart of a flow monitoring step S101 in a data flow control method provided in an embodiment of the present invention; Figure 3 A flowchart of a data classification step S102 in a data flow control method provided in an embodiment of the present invention; Figure 4 A flowchart of step S303 in a data flow control method provided in an embodiment of the present invention; Figure 5 A flowchart of step S302 in a data flow control method provided in an embodiment of the present invention; Figure 6 A flowchart of step S103 in a data flow control method provided in an embodiment of the present invention; Figure 7 A flowchart of a log storage step in another data flow control method provided by an embodiment of the present invention; Figure 8 A flowchart of another data flow control method provided by an embodiment of the present invention; Fig. 9 A schematic diagram of the principle of a data flow control method provided by an embodiment of the present invention; Fig.10 A timing diagram of a data flow control method provided by an embodiment of the present invention; Fig.11 A schematic diagram of a data flow control system provided by an embodiment of the present invention; Fig.12A schematic diagram of another data flow control system provided by an embodiment of the present invention; Fig.13 A schematic diagram of the structure of an electronic device provided by an embodiment of the present invention.

[0021] icon: 1110 - traffic monitoring unit; 1120 - data classification unit; 1130 - data processing unit; 1140 - storage and log unit; 1110a-traffic mirroring module; 1110b-traffic capturing module; 1110c-data preprocessing module; 1120a-regular expression calculation module; 1120b-machine learning module; 1120c-sensitive data marking module; 1130a-behavior analysis module; 1130b-emergency response module; 1130c-data encryption module; 1140a-data log module; 1140b-operation log module; 101 - processor; 102 - memory; 103 - bus; 104 - communication interface. DETAILED DESCRIPTION

[0022] In order to make the purpose, technical solution and advantages of the embodiments of the present invention clearer, the technical solution of the present invention will be clearly and completely described in combination with the embodiments below. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0023] With the rapid development of cloud computing and big data technology, data security has become the most important issue facing data service providers. In recent years, data loss (de-database) incidents have occurred frequently, causing significant economic losses and reputation damage to data service providers. Therefore, how to monitor and effectively prevent data loss in real time has become an important research direction in the field of information security.

[0024] Current methods for detecting data dumps mainly rely on traffic monitoring and log analysis, but such solutions have various defects in detecting data dumps: Limitations of traffic monitoring: Traditional methods generally rely on traffic records of the infrastructure, which may ignore subtle interactions at the middleware layer and thus fail to capture potential attack patterns.

[0025] Flaws in rule configuration: Although configuring rules to screen attack behaviors is a common method, attackers can bypass detection by changing tactics or disguising traffic, resulting in poor actual monitoring results.

[0026] Insufficient event correlation: Existing methods generally monitor access and response independently, lacking in-depth analysis of the dynamic behavior and relationship between access and response in traffic, and easily miss complex attack behaviors.

[0027] Lack of real-time response capabilities: The detection of data dragging behavior often cannot respond in time and fails to provide sensitive real-time monitoring, making it difficult to reduce the losses after the attack.

[0028] High false alarm rate: In the process of analyzing and processing a large amount of data, due to the overlap between attack judgment rules and actual business call methods, normal traffic frequently triggers alarms, which brings a huge workload to the network security team. In addition, in order to solve this problem, many methods rely on configuring whitelists to exclude normal traffic. However, the configuration of whitelists often faces many challenges, especially when facing massive traffic, it is difficult to fully cover all normal operations, resulting in difficulty in finding a balance between false alarms and effective monitoring.

[0029] In the prior art, two main methods are used for database drag detection: static rule-based traffic monitoring and traffic anomaly detection. The static rule-based traffic monitoring method mainly relies on a series of predefined rules, and conducts detailed analysis of traffic characteristics and patterns to determine whether there is database drag behavior. These rules are usually based on industry best practices and historical attack patterns and have high recognition capabilities. When abnormal behaviors that meet the conditions are detected, the system can quickly take response measures such as blocking or issuing alarms, thereby protecting the security of the system to a certain extent. However, the rule update of this type of detection method has a lag. Since the evolution speed of attack methods far exceeds the speed of rule updates, traditional static rules are often difficult to adapt to new threats in a timely manner. This results in some emerging attack methods being able to bypass detection without obstacles, thereby increasing the vulnerability of the system. In addition, the false alarm rate of this type of monitoring method is high. In daily operations, many normal business flows may overlap with static rule configurations, resulting in legitimate requests being mistakenly regarded as abnormal behaviors. In this case, frequent false alarms of the system will not only burden the network security team, but may also lead to a decrease in vigilance against real threats.

[0030] The monitoring method based on traffic anomaly detection analyzes the usage pattern of network traffic and uses machine learning algorithms to automatically identify abnormal traffic. This method can dynamically adapt to changes in traffic and continuously optimize the model using big data technology to improve the ability to identify traffic anomalies. Through real-time analysis of activity patterns, this method can sensitively identify potential threats, which to a certain extent enhances the accuracy and response speed of monitoring. However, this type of detection method is not adaptable enough. When faced with low-frequency and highly concealed attack methods, methods based on traffic anomaly detection often perform poorly and fail to detect complex attack behaviors in a timely manner. This makes some mature attack techniques "invisible" under the monitoring of the system, resulting in data loss.

[0031] In addition, this type of monitoring method has high data requirements: this method usually requires a large amount of historical traffic data for model training, and this data is often difficult to obtain or difficult to guarantee its representativeness. If the training data is insufficient, the accuracy and reliability of the algorithm will be significantly reduced, and may even lead to incorrect attack judgments.

[0032] In summary, the existing implementation schemes have their own defects in data drag detection, especially in key aspects such as adaptability, false alarm rate and real-time performance. Based on this, the present invention implements a data flow control method, system and electronic device, which uses regular expressions and extraction strategies corresponding to data packets to identify sensitive data in interactive data streams, can accurately obtain potential drag behavior, and reduce the false alarm rate of drag behavior; at the same time, the method can quickly take blocking measures after discovering the drag behavior, which improves the adaptability and real-time performance of drag detection, thereby greatly reducing the risk of data loss.

[0033] To facilitate understanding of this embodiment, a data flow control method disclosed in an embodiment of the present invention is first described in detail. Figure 1 As shown, including: Traffic monitoring step S101: acquiring the interactive data flow of the target database in real time, and determining the data packet corresponding to the interactive data flow by using the mirror data of the interactive data flow; Data classification step S102: classifying the data packets using the regular expressions corresponding to the data packets and the preset extraction strategy, and determining the sensitive data in the data packets according to the classification results; Data processing step S103: After controlling the target database to perform a database drag operation on sensitive data, behavior data corresponding to the sensitive data is obtained, an encryption strategy corresponding to the sensitive data is determined based on the behavior data, and the encryption strategy is used to encrypt the sensitive data.

[0034] The method first performs a traffic monitoring step, obtains the interactive data flow of the target database in real time, obtains the mirror data of the interactive data flow through traffic mirroring technology, and monitors the mirror data in real time, thereby achieving comprehensive monitoring of the interactive data flow without affecting the use of the target database.

[0035] The data classification step is then executed to enter the sensitive data identification stage. The data packets are identified and marked using regular expressions and extraction strategies to obtain the classification results of the data packets, and the sensitive data in the data packets is obtained based on the classification results.

[0036] Sensitive data is the data corresponding to the external database drag operation. Therefore, in the data processing step, the sensitive data is first controlled in the target database to perform local database drag operations on the sensitive data to achieve data isolation, and then the behavior of the sensitive data is analyzed, and emergency response is carried out according to the analysis results. In addition, in order to ensure data security, the encryption strategy corresponding to the sensitive data is obtained through the behavior data corresponding to the sensitive data, and the encryption strategy is used to encrypt the sensitive data to ensure data security.

[0037] Optionally, the flow monitoring step S101, such as Figure 2 As shown, including: Step S201, determining the cloud server corresponding to the target database, using the gateway of the cloud server to obtain the interactive data flow in real time, and generating mirror data corresponding to the interactive data flow through the traffic mirroring module in the gateway; Step S202, capturing mirrored data in real time, and determining a data packet based on the mirrored data; Step S203, obtaining preprocessing rules corresponding to the data packet, determining the cleaning strategy, formatting strategy and denoising strategy corresponding to the data packet using the preprocessing rules, and performing preprocessing operations on the data packet according to the cleaning strategy, formatting strategy and denoising strategy.

[0038] The execution body of the traffic monitoring process is located in the cloud server gateway or router corresponding to the target database. The traffic mirroring module in the gateway or router captures the interactive data flow in real time and generates the corresponding mirror data. Since the traffic mirroring module is seamlessly integrated into the gateway or router, it will not affect the network performance of the cloud server and ensure comprehensive monitoring of data packets.

[0039] The generated data packets need to undergo necessary preprocessing to avoid interference from unnecessary data. Specifically, the cleaning strategy, formatting strategy and denoising strategy corresponding to the data packets are determined by obtaining the preprocessing rules corresponding to the data packets, and then the above strategies are used to preprocess the data packets.

[0040] Optionally, the data classification step S102, such as Figure 3 As shown, including: Step S301, filtering the data packets using the regular expression of the data packets to obtain the filtering result of the data packets; Step S302, determining the risk value of the data packets in the screening result according to a preset data identification strategy, and classifying the data packets based on the risk value to obtain a classification result; Step S303: determine the sensitive data contained in the data packet based on the classification result.

[0041] The data classification step classifies the captured data packets and finally filters out suspicious sensitive data. Specifically, after filtering the data packets using the regular expression of the data packets, after obtaining the screening results of the data packets, the risk value of the data packets in the screening results is determined according to the data identification strategy, and finally the data packets are classified based on the risk value to obtain the classification results. After the classification results are obtained, the classification results are used to determine the interactive data flow corresponding to the data packets, so as to determine the sensitive data. Optionally, step S303 of determining the sensitive data contained in the data packet based on the classification results, such as Figure 4 As shown, including: Step S401, determining a sensitivity value of an interactive data flow corresponding to a data packet based on the classification result, and comparing the sensitivity value with a preset threshold; Step S402: if the sensitivity value is greater than a preset threshold, the interactive data flow is determined as sensitive data; if the sensitivity value is not greater than the preset threshold, the flow monitoring step is re-executed.

[0042] The sensitive data determination process is implemented based on the sensitivity value. After determining the sensitivity value of the interactive data flow corresponding to the data packet based on the classification result, the sensitivity value is compared with the preset threshold. If the sensitivity value is greater than the preset threshold, the interactive data flow is determined as sensitive data; if the sensitivity value is not greater than the preset threshold, the flow monitoring step is re-executed.

[0043] Optionally, the risk value of the data packet in the screening result is determined according to a preset data identification strategy, and the data packet is classified based on the risk value to obtain a classification result in step S302, such as Figure 5 As shown, including: Step S501, determining a data identification strategy based on a preset machine learning model; Step S502, inputting the screening result into the machine learning model, and controlling the machine learning model to output the risk value corresponding to the data packet according to the data identification strategy; Step S503: Mark the data packets using the risk value, and classify the data packets according to the marking result to obtain a classification result.

[0044] The acquisition process of sensitive data can be achieved by using relevant machine learning models. At this time, the data identification strategy is determined by the machine learning model. After the data identification strategy is determined based on the machine learning model, the screening results are input into the machine learning model, and the machine learning model is controlled to output the risk value corresponding to the data packet according to the data identification strategy. The data packet is then marked using the risk value to obtain the corresponding marking result, and finally the data packet is classified according to the marking result to obtain the classification result. The above process is analyzed by the machine learning model, which can automatically learn and adapt to traffic changes. This dynamic detection mechanism can improve the accuracy of detection when the attack mode and traffic characteristics are constantly evolving, thereby effectively reducing the occurrence of false positives and false negatives.

[0045] Optionally, the data processing step S103 is as follows: Figure 6 As shown, including: Step S601, controlling the target database to perform a database drag operation on sensitive data based on the classification result; Step S602, obtaining behavior analysis results of sensitive data, and determining abnormal data contained in the sensitive data based on the behavior analysis results; Step S603: Control the removal of abnormal data from the interactive data stream, and encrypt the sensitive data using a preset encryption strategy.

[0046] The data processing process performs local database dragging operations on the identified sensitive data, performs behavioral analysis on the selected sensitive data, and obtains specific abnormal data based on the analysis results and responds to them, that is, removes abnormal data from the interactive data stream. In addition, in order to ensure data security, sensitive data is encrypted using preset encryption strategies such as the AES encryption standard.

[0047] Optionally, after the data processing step is completed, the method further includes a log storage step, such as Figure 7 As shown, the steps of storing logs include: Step S701, obtaining the encrypted sensitive data, and obtaining the data log and operation log corresponding to the sensitive data; Step S702, uploading data logs and operation logs to the cloud server.

[0048] For the encrypted sensitive data, obtain the corresponding data log and operation log, and upload the log file to the relevant storage module in the cloud server. This ensures the secure storage of sensitive data and achieves the traceability requirements required for auditing and compliance inspections through detailed operation logs. Optionally, after uploading the data log and operation log to the cloud server, the method also includes: using the data log and operation log to update the target database. Figure 8 As shown, through Figure 8The steps described in the previous section effectively manage the entire process of data flow from capture to storage, ensuring the comprehensiveness and efficiency of data drag protection.

[0049] like Fig. 9 A schematic diagram of the principle of a data flow control method is shown in FIG. Fig. 9 The data flow control process is described in a modular process. Specifically, the data flow monitoring module mainly performs the traffic monitoring steps. After capturing the data traffic, the data traffic monitoring module performs data preprocessing and feature extraction to prepare for subsequent data analysis.

[0050] The data classification module performs data classification steps, and the data analysis module combines machine learning algorithms and regular expressions to efficiently identify sensitive information in data streams. It can not only quickly identify common sensitive information, but also continuously optimize the identification rules based on the learning model.

[0051] The data processing module performs data processing steps. After identifying sensitive data, the data processing module conducts in-depth behavioral analysis and takes emergency response measures for data detected as abnormal. In addition, the data is encrypted using advanced encryption standards to ensure the confidentiality and integrity of sensitive data information.

[0052] The storage and log module is used to perform the storage log step. The storage and log module is used to record data and alarm log information for subsequent query. Strict technical logic and data flow paths are used between each submodule to ensure the efficient operation of data identification, processing and storage processes.

[0053] like Fig.10 The timing diagram of a data flow control method shown in the figure describes in detail the processing time sequence of the data and the specific time point of each operation, ensuring the coordination and efficiency of the data drag detection and protection process. The first step is to capture the request, marking the time point when the data flow starts to be monitored in the system through the data flow monitoring module. Next, the data enters the preprocessing and classification stage, which records in detail the time period for the data flow to be preprocessed and sensitive data to be identified, ensuring data consistency and accurate processing. Subsequently, the data analysis stage records the deep analysis of the screened sensitive data to determine whether it is abnormal, thereby effectively reducing the false alarm rate, and the emergency response is handled according to the data analysis results; in addition, encrypting sensitive data helps to protect privacy data. The final log reporting stage records the time point when the data is stored and the log is generated, ensuring the secure storage of the processed data and the traceability of the operation.

[0054] The data flow control method in the above embodiment realizes in-depth analysis and anomaly detection of traffic flow. By understanding the behavior patterns of normal users, it can more effectively identify abnormal traffic, especially the more concealed attack methods, and effectively improve the sensitivity and coverage of detection. When potential database dragging behavior is discovered, the method can quickly take blocking measures, such as suspending suspicious activities or notifying relevant administrators, to ensure that effective defense is taken at the first time of the attack and reduce the risk of data loss.

[0055] From the data flow control method mentioned in the above embodiment, it can be seen that this method can adapt to the ever-changing traffic patterns and attack methods in real time through dynamic feature learning, rather than relying solely on static rules, which significantly improves the ability to identify new threats; compared with traditional methods, the data flow control method in this embodiment can optimize the decision-making process through deep behavior analysis and machine learning, reduce the false alarm rate, and ensure that real security incidents can be effectively captured. In addition, the data flow control method in this embodiment can provide real-time traffic monitoring and instant response mechanisms, which can take prompt action when an attack occurs, prevent data leakage in time, and reduce potential losses; the data flow control method conducts in-depth analysis of traffic in the cloud environment from a global perspective, can monitor security in multiple dimensions at the same time, and enhances the ability to identify and deal with complex attack behaviors.

[0056] Corresponding to the data flow control method provided in the above embodiment, the embodiment of the present invention provides a data flow control system, such as Fig.11 As shown, the system includes: Traffic monitoring unit 1110: used to obtain the interactive data flow of the target database in real time, and determine the data packet corresponding to the interactive data flow by using the mirror data of the interactive data flow; Data classification unit 1120: used to classify the data packet using the regular expression corresponding to the data packet and the preset extraction strategy, and determine the sensitive data in the data packet according to the classification result; Data processing unit 1130: used to control the target database to perform a drag operation on sensitive data, obtain behavior data corresponding to the sensitive data, determine the encryption strategy corresponding to the sensitive data based on the behavior data, and encrypt the sensitive data using the encryption strategy.

[0057] like Fig.12The structural diagram of another data flow control system shown in the figure shows the four main modules of the data flow control system and their interrelationships. The traffic monitoring unit 1110 includes a traffic mirroring module 1110a, a traffic capture module 1110b, and a data preprocessing module 1110c. The traffic monitoring unit 1110 is deployed at the gateway or router of the cloud environment. The traffic mirroring module 1110a uses traffic mirroring technology to obtain the mirror of the interactive data flow in real time, and then uses the traffic capture module 1110b to capture all data packets in transmission. The data preprocessing module 1110c preprocesses the obtained data packets, including cleaning, formatting and denoising.

[0058] The data classification unit 1120 classifies the captured data packets, filters out suspicious sensitive data, obtains the classification results of the data packets through the regular expression calculation module 1120a and the machine learning module 1120b, and marks the sensitive data using the sensitive data marking module 1120c.

[0059] The data processing unit 1130 performs a drag operation on the identified sensitive data, uses the behavior analysis module 1130a to perform behavior analysis on the screened sensitive data, and uses the emergency response module 1130b to perform emergency response to the analysis results. In addition, in order to ensure data security, the data encryption module 1130c uses encryption technology to encrypt data, or removes sensitive data from traffic according to actual business needs.

[0060] Finally, the processed data and operation logs are delivered to the data log module 1140a and the operation log module 1140b in the storage and log unit 1140. The storage and log unit 1140 not only ensures the secure storage of sensitive data, but also obtains detailed operation logs, providing the traceability required for auditing and compliance inspections.

[0061] From the data flow control system mentioned in the above embodiment, it can be seen that the system uses regular expressions and extraction strategies corresponding to data packets to identify sensitive data in interactive data flows, and can accurately obtain potential database drag behaviors, reducing the false alarm rate of database drag behaviors; at the same time, the system can quickly take blocking measures after discovering database drag behaviors, thereby improving the adaptability and real-time performance of database drag detection, thereby greatly reducing the risk of data loss.

[0062] The data flow control system provided in the embodiment of the present invention has the same implementation principle and technical effects as those of the aforementioned data flow control method embodiment. For the sake of brief description, for matters not mentioned in the system embodiment, reference may be made to the corresponding contents in the aforementioned data flow control method embodiment.

[0063] This embodiment also provides an electronic device. The structural diagram of the electronic device is as follows: Fig.13As shown, the device includes a processor 101 and a memory 102; wherein the memory 102 is used to store one or more computer instructions, and the one or more computer instructions are executed by the processor to implement the steps of the above-mentioned data flow control method.

[0064] Fig.13 The electronic device shown further includes a bus 103 and a communication interface 104 , and the processor 101 , the communication interface 104 and the memory 102 are connected via the bus 103 .

[0065] The memory 102 may include a high-speed random access memory (RAM), and may also include a non-volatile memory, such as at least one disk storage. The bus 103 may be an ISA bus, a PCI bus, or an EISA bus. The bus may be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Fig.13 Only one bidirectional arrow is used in the diagram, but this does not mean that there is only one bus or only one type of bus.

[0066] The communication interface 104 is used to connect to at least one user terminal and other network units through a network interface, and send the encapsulated IPv4 message or IPv4 message to the user terminal through the network interface.

[0067] The processor 101 may be an integrated circuit chip with signal processing capabilities. In the implementation process, each step of the above method can be completed by the hardware integrated logic circuit or software instructions in the processor 101. The above processor 101 can be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc.; it can also be a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA) or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components. The disclosed methods, steps and logic block diagrams in the embodiments of the present disclosure can be implemented or executed. The general-purpose processor can be a microprocessor or the processor can also be any conventional processor, etc. The steps of the method disclosed in conjunction with the embodiments of the present disclosure can be directly embodied as a hardware decoding processor for execution, or a combination of hardware and software modules in the decoding processor for execution. The software module may be located in a storage medium mature in the art, such as a random access memory, a flash memory, a read-only memory, a programmable read-only memory, or an electrically erasable programmable memory, a register, etc. The storage medium is located in the memory 102, and the processor 101 reads the information in the memory 102 and completes the steps of the method of the above embodiment in combination with its hardware.

[0068] An embodiment of the present invention further provides a storage medium on which a computer program is stored. When the computer program is executed by a processor, the steps of the data flow control method in the aforementioned embodiment are executed.

[0069] In the several embodiments provided in the present application, it should be understood that the disclosed systems, devices, equipment and methods can be implemented in other ways. The system embodiments described above are merely schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some communication interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0070] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0071] In addition, each functional unit in each embodiment of the present invention may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.

[0072] If the functions are implemented in the form of software functional units and sold or used as independent products, they can be stored in a non-volatile computer-readable storage medium that can be executed by a processor. Based on this understanding, the technical solution of the present invention can essentially or in other words, the part that contributes to the prior art or the part of the technical solution can be embodied in the form of a software product. The computer software product is stored in a storage medium and includes several instructions to enable a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk and other media that can store program codes.

[0073] Finally, it should be noted that the above-described embodiments are only specific implementations of the present invention, which are used to illustrate the technical solutions of the present invention, rather than to limit them. The protection scope of the present invention is not limited thereto. Although the present invention is described in detail with reference to the above-described embodiments, ordinary technicians in the field should understand that any technician familiar with the technical field can still modify the technical solutions recorded in the above-described embodiments within the technical scope disclosed by the present invention, or can easily think of changes, or make equivalent replacements for some of the technical features therein; and these modifications, changes or replacements do not make the essence of the corresponding technical solutions deviate from the spirit and scope of the technical solutions of the embodiments of the present invention, and should be included in the protection scope of the present invention. Therefore, the protection scope of the present invention shall be based on the protection scope of the claims.

Claims

1. A data flow control method, characterized in that: The method comprises: Traffic monitoring step: acquiring the interactive data flow of the target database in real time, and determining the data packet corresponding to the interactive data flow by using the mirror data of the interactive data flow; Data classification step: classifying the data packet using the regular expression corresponding to the data packet and the preset extraction strategy, and determining the sensitive data in the data packet according to the classification result; Data processing step: after controlling the target database to perform a database drag operation on the sensitive data, obtaining behavior data corresponding to the sensitive data, determining an encryption strategy corresponding to the sensitive data based on the behavior data, and encrypting the sensitive data using the encryption strategy.

2. The data flow control method according to claim 1, characterized in that: The flow monitoring step includes: Determine the cloud server corresponding to the target database, use the gateway of the cloud server to obtain the interactive data flow in real time, and generate the mirror data corresponding to the interactive data flow through the traffic mirror module in the gateway; Capturing the mirror data in real time, and determining the data packet according to the mirror data; The preprocessing rules corresponding to the data packet are obtained, a cleaning strategy, a formatting strategy and a denoising strategy corresponding to the data packet are determined using the preprocessing rules, and a preprocessing operation is performed on the data packet according to the cleaning strategy, the formatting strategy and the denoising strategy.

3. The data flow control method according to claim 1, characterized in that: The data classification step includes: Filtering the data packet using the regular expression of the data packet to obtain a filtering result of the data packet; Determining the risk value of the data packet in the screening result according to a preset data identification strategy, and classifying the data packet based on the risk value to obtain the classification result; The sensitive data included in the data packet is determined based on the classification result.

4. The data flow control method according to claim 3, characterized in that: Determining the sensitive data contained in the data packet based on the classification result includes: Determine a sensitivity value of the interactive data flow corresponding to the data packet based on the classification result, and compare the sensitivity value with a preset threshold; If the sensitivity value is greater than the preset threshold, the interactive data flow is determined as the sensitive data; if the sensitivity value is not greater than the preset threshold, the flow monitoring step is re-executed.

5. The data flow control method according to claim 3, characterized in that: Determining the risk value of the data packet in the screening result according to a preset data identification strategy, and classifying the data packet based on the risk value to obtain the classification result, including: Determining the data identification strategy based on a preset machine learning model; Inputting the screening result into the machine learning model, and controlling the machine learning model to output the risk value corresponding to the data packet according to the data identification strategy; The data packet is marked using the risk value, and the data packet is classified according to the marking result to obtain the classification result.

6. The data flow control method according to claim 1, characterized in that: Data processing steps include: Controlling the target database to perform a database drag operation on the sensitive data based on the classification result; Obtaining a behavior analysis result of the sensitive data, and determining abnormal data contained in the sensitive data based on the behavior analysis result; The abnormal data is controlled to be removed from the interactive data stream, and the sensitive data is encrypted using a preset encryption strategy.

7. The data flow control method according to claim 2, characterized in that: After the data processing step is completed, the method further includes a log storage step: Obtain the sensitive data that has completed encryption processing, and obtain the data log and operation log corresponding to the sensitive data; The data log and the operation log are uploaded to the cloud server.

8. The data flow control method according to claim 7, characterized in that: After uploading the data log and the operation log to the cloud server, the method further includes: The target database is updated using the data log and the operation log.

9. A data flow control system, characterized in that: The system comprises: Traffic monitoring unit: used for acquiring the interactive data flow of the target database in real time, and determining the data packet corresponding to the interactive data flow by using the mirror data of the interactive data flow; Data classification unit: used to classify the data packet using the regular expression corresponding to the data packet and the preset extraction strategy, and determine the sensitive data in the data packet according to the classification result; Data processing unit: used to control the target database to drag the sensitive data to the database, obtain the behavior data corresponding to the sensitive data, determine the encryption strategy corresponding to the sensitive data based on the behavior data, and encrypt the sensitive data using the encryption strategy.

10. An electronic device, characterized in that: It comprises a processor and a memory, wherein the memory stores computer executable instructions that can be executed by the processor, and the processor executes the computer executable instructions to implement the steps of the data flow control method described in any one of claims 1 to 8.

Images