Data leakage detection method, device, equipment, storage medium and program product

Abstract

The application relates to the technical field of data security, and provides a data leakage detection method and device, equipment, a storage medium and a program product, which can adapt to continuous changes in data modes and maintain high detection performance in various environments. According to a network traffic log data set, a historical data packet size sequence and a historical data packet transmission duration sequence of a four-tuple in continuous multiple historical time periods are obtained, so that the data packet size range and the data packet transmission duration range of the four-tuple are obtained through statistics; a current data packet size and a current data packet transmission duration of the four-tuple in a current time period are obtained; and whether data leakage exists in data transmission of the four-tuple in the current time period is determined according to whether the current data packet size of the four-tuple is within the corresponding data packet size range and whether the current data packet transmission duration of the four-tuple is within the corresponding data packet transmission duration range.

Description

Technical Field

[0001] This application relates to the field of data security technology, and in particular to a method, apparatus, computer equipment, storage medium and computer program product for detecting data leakage. Background Technology

[0002] With the acceleration of digital transformation, businesses and individuals are increasingly reliant on data storage and processing, thus placing higher demands on the risk detection of data breaches.

[0003] Traditional data leakage detection methods are mostly based on static rule-based anomaly detection mechanisms. These methods have limitations when dealing with complex and dynamically changing data streams, and are prone to errors (i.e., incorrectly identifying normal data transmission as anomalies) and false negatives (i.e., failing to detect actual abnormal data transmission). Summary of the Invention

[0004] Therefore, it is necessary to provide a method, apparatus, computer equipment, storage medium, and computer program product for detecting data leakage in response to the above-mentioned technical problems.

[0005] This application provides a method for detecting data leakage, the method comprising:

[0006] Based on the network traffic log dataset, the historical data packet size sequence and historical data packet transmission duration sequence of each quadruple are obtained for multiple consecutive historical time periods.

[0007] Statistically analyze the historical data packet size sequence and historical data packet transmission duration sequence for each quaternion to determine the data packet size range and data packet transmission duration range for each quaternion.

[0008] Get the current data packet size and current data packet transmission duration for each quadruple in the current time period;

[0009] Based on whether the current data packet size of each quaternion is within the corresponding data packet size range, and whether the current data packet transmission duration of each quaternion is within the corresponding data packet transmission duration range, determine whether there is data leakage in the data transmission of each quaternion during the current time period.

[0010] In one embodiment, based on a network traffic log dataset, the historical packet size sequence and historical packet transmission duration sequence for each quaternion over multiple consecutive historical time periods are obtained, including:

[0011] Obtain the network traffic log dataset;

[0012] For each network traffic log data, if the network traffic log data includes sensitive information, or the network traffic log data represents data transmission, or a source IP address included in the network traffic log data belongs to an IP address of a crawler center, the network traffic log data is determined as suspicious network traffic log data, and a plurality of suspicious network traffic log data is obtained;

[0013] According to the time stamp included in the suspicious network traffic log data, a suspicious log data set of a same historical time period is determined, and a plurality of suspicious log data sets of historical time periods are obtained;

[0014] According to the plurality of suspicious log data sets of historical time periods, historical packet size and historical packet transmission duration of each four tuple in the plurality of historical time periods are determined, and a historical packet size sequence and a historical packet transmission duration sequence are formed.

[0015] In one embodiment, the method further comprises:

[0016] According to the communication protocol included in the network traffic log data, the network traffic log data set is classified, and network traffic log data subsets of each communication protocol are obtained;

[0017] The network traffic log data subset of the communication protocol used for data transmission is determined as a target network traffic log data subset;

[0018] It is determined that each network traffic log data in the target network traffic log data subset represents data transmission.

[0019] In one embodiment, the historical packet size sequence of each four tuple is counted, and the packet size range of each four tuple is determined, including:

[0020] According to the historical packet size sequence of each four tuple, the mean and the standard deviation of the historical packet size of each four tuple are obtained;

[0021] According to the sum of the mean and the standard deviation of a set multiple of each four tuple, the upper limit value of the packet size range of each four tuple is obtained;

[0022] According to the difference between the mean and the standard deviation of a set multiple of each four tuple, the lower limit value of the packet size range of each four tuple is obtained;

[0023] According to the upper limit value and the lower limit value of the packet size range of each four tuple, the packet size range of each four tuple is obtained.

[0024] In one embodiment, the historical packet transmission duration sequence of each four tuple is counted, and the packet transmission duration range of each four tuple is determined, including:

[0025] According to the historical data packet transmission duration sequence of each four-tuple, a mean value and a standard deviation of the historical data packet transmission duration of each four-tuple are obtained;

[0026] According to the sum of the mean value and the set multiple of the standard deviation of the historical data packet transmission duration of each four-tuple, an upper limit value of the data packet transmission duration range of each four-tuple is obtained;

[0027] According to the difference between the mean value and the set multiple of the standard deviation of the historical data packet transmission duration of each four-tuple, a lower limit value of the data packet transmission duration range of each four-tuple is obtained;

[0028] According to the upper limit value and the lower limit value of the data packet transmission duration range of each four-tuple, the data packet transmission duration range of each four-tuple is obtained.

[0029] In one embodiment, the set multiple is three.

[0030] The present application provides a data leakage detection device, which comprises:

[0031] A sequence obtaining module is configured to obtain, according to a network traffic log data set, a historical data packet size sequence and a historical data packet transmission duration sequence of each four-tuple in a plurality of continuous historical time periods;

[0032] A range determining module is configured to determine, by counting the historical data packet size sequence and the historical data packet transmission duration sequence of each four-tuple, a data packet size range and a data packet transmission duration range of each four-tuple;

[0033] A current information obtaining module is configured to obtain a current data packet size and a current data packet transmission duration of each four-tuple in a current time period;

[0034] A data leakage identifying module is configured to determine, according to whether the current data packet size of each four-tuple is within the corresponding data packet size range and whether the current data packet transmission duration of each four-tuple is within the corresponding data packet transmission duration range, whether data leakage exists in the data transmission of each four-tuple in the current time period.

[0035] The present application provides a computer device comprising a memory and a processor, wherein the memory stores a computer program, and the processor executes the above method.

[0036] The present application provides a computer readable storage medium, which stores a computer program, and the computer program is executed by a processor to execute the above method.

[0037] The application provides a computer program product, which stores a computer program, and the computer program is executed by a processor to execute the above method.

[0038] The data leakage detection method, device, computer device, storage medium and computer program product provided by the application can obtain the historical data packet size sequence and the historical data packet transmission duration sequence of each four tuple in a plurality of continuous historical time periods according to a network flow log data set, count the historical data packet size sequence and the historical data packet transmission duration sequence of each four tuple, determine the data packet size range and the data packet transmission duration range of each four tuple, obtain the current data packet size and the current data packet transmission duration of each four tuple in a current time period, and determine whether data leakage exists in the data transmission of each four tuple in the current time period according to whether the current data packet size of each four tuple is within the corresponding data packet size range and whether the current data packet transmission duration of each four tuple is within the corresponding data packet transmission duration range. The scheme provided by the application can detect data leakage based on time sequence, can process larger-scale data, and can adapt to continuous changes in data mode and maintain high detection performance in various environments. BRIEF DESCRIPTION OF DRAWINGS

[0039] In order to more clearly illustrate the technical solutions in the embodiments of the application or the related art, the following will briefly introduce the drawings needed to be used in the embodiments or the related art description. Obviously, the drawings in the following description are only some embodiments of the application, and for those skilled in the art, other drawings can also be obtained from these drawings without creative labor.

[0040] Figure 1 The flow environment diagram of the data leakage detection method in an embodiment;

[0041] Figure 2 The network architecture schematic diagram of the data leakage detection method in an embodiment;

[0042] Figure 3 The flow schematic diagram of determining the time sequence in an embodiment;

[0043] Figure 4 The structural block diagram of the data leakage detection device in an embodiment;

[0044] Figure 5 The internal structure diagram of the computer device in an embodiment. DETAILED DESCRIPTION

[0045] In order to make the purposes, technical solutions and advantages of the present application clearer, the present application will be further described in detail below with reference to the drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and not to limit the present application.

[0046] The following introduces the technical data related to the present application:

[0047] Time series: a sequence of data points arranged in the order of time occurrence. The time interval of a set of time series is usually a constant value (such as 1 second, 5 minutes, 12 hours, 7 days, 1 year), so the time series can be analyzed and processed as discrete time data.

[0048] Anomaly detection: the identification of items, events or observations that do not match the expected pattern or other items in the data set. Anomaly is also called outlier, novelty, noise, bias and exception.

[0049] Data leakage: data leakage refers to the intentional or unintentional release of private, confidential information of individuals or organizations to a dangerous environment.

[0050] 3-sigma: a concept in statistics, usually used to describe the variability of observations in a normal distribution (also called Gaussian distribution).

[0051] Four-tuple: information of a transport layer protocol, which contains four basic elements to identify a communication connection in the network. The composition of the four-tuple includes: source IP (Internet Protocol) address, source port, target IP address and target port.

[0052] The data leakage detection method provided by the present application can be executed by a computer device, comprising Figure 1 The steps shown.

[0053] Step S101, according to the network traffic log data set, obtaining the historical data packet size sequence and the historical data packet transmission duration sequence of each four-tuple in a plurality of continuous historical time periods.

[0054] Referring to Figure 2 , the enterprise includes an application server, a database and an enterprise network export gateway. The internal application server of the enterprise can interact with the external server through the enterprise network export gateway. Some servers steal sensitive data in the enterprise through the enterprise network export gateway, such servers are called malicious external servers; compared with the malicious external servers, other external servers belong to normal external servers.

[0055] To ensure the integrity and accuracy of network traffic log data, log collection tools can be deployed at key nodes of the network, ensuring that the log collection tools can handle high traffic and record data in real time. Considering that the amount of network traffic log data can be very large, the log collection system needs to have sufficient storage capacity and processing capacity to avoid data loss.

[0056] In some embodiments, network traffic log data sets can be collected from enterprise network exit gateways (such as routers). Each piece of network traffic log data includes packet information transmitted through the network, such as source IP address, destination IP, communication protocol, source port number, target port number, request packet, response packet, packet size, and timestamp.

[0057] In network traffic log data, timestamps are critical for identifying and analyzing network activity trends. The timestamp carried by each piece of network traffic log data not only reflects the sending and receiving times of the packet, but can also be used to construct time series data for subsequent anomaly detection analysis.

[0058] After collecting the network traffic log data set, since each piece of network traffic log data carries the source IP address, destination IP, source port number, and target port number, the four-tuple to which each piece of network traffic log data belongs can be determined, and then a number of network traffic log data for each four-tuple can be obtained.

[0059] Since each piece of network traffic log data carries a timestamp, for any four-tuple, the network traffic log data for the four-tuple can be divided into groups, with network traffic log data with timestamps falling within the same historical time period being grouped together to form a network traffic log data sequence for the four-tuple in that historical time period.

[0060] Each piece of network traffic log data carries a packet size, so based on the network traffic log data sequence for the four-tuple in that historical time period, a historical packet size sequence for the four-tuple in that historical time period can be formed.

[0061] Each piece of network traffic log data carries a timestamp, so based on the network traffic log data sequence for the four-tuple in that historical time period, the distribution of data transmission times for the four-tuple in that historical time period can be determined, resulting in a historical packet transmission duration sequence for the four-tuple in that historical time period; for example, the historical time period is from 10:00 to 11:00, the four-tuple continuously transmits data multiple times from 10:00 to 10:15 and continuously transmits data multiple times from 10:30 to 10:40, so the historical packet transmission duration sequence for the four-tuple in that historical time period includes 15 minutes and 10 minutes.

[0062] The time window length corresponding to the historical time period and the current time period can be consistent. The time window length can be set according to actual conditions, such as several minutes, several hours, or even several days. The time window length will affect the granularity of data and the capture of volatility. Because sensitive data leakage is often calculated in units of days or even months, in some scenarios, the time window length can be set to hours and days.

[0063] In step S102, the historical packet size sequence and the historical packet transmission duration sequence of each four tuple are counted, and the packet size range and the packet transmission duration range of each four tuple are determined.

[0064] For any four tuple, the historical packet size sequence of the four tuple can be obtained, and the packet size range of the four tuple is determined through a statistical method such as 3-sigma. The historical packet transmission duration sequence of the four tuple can also be obtained, and the packet transmission duration range of the four tuple is determined through a statistical method such as 3-sigma.

[0065] In step S103, the current packet size and the current packet transmission duration of each four tuple in the current time period are obtained.

[0066] The current packet size and the current packet transmission duration of each four tuple in the current time period can be obtained through a log collection tool.

[0067] In step S104, whether the data transmission of each four tuple in the current time period has data leakage is determined according to whether the current packet size of each four tuple is within the corresponding packet size range and whether the current packet transmission duration of each four tuple is within the corresponding packet transmission duration range.

[0068] For any four tuple, if the current packet size of the four tuple is not within the packet size range of the four tuple, and the current packet transmission duration of the four tuple is not within the packet transmission duration range of the four tuple, it can be determined that the data transmission of the four tuple in the current time period is abnormal activity, and there is a risk of data leakage.

[0069] For any four tuple, if the current packet size of the four tuple is within the packet size range of the four tuple, or the current packet transmission duration of the four tuple is within the packet transmission duration range of the four tuple, it can be determined that the data transmission of the four tuple in the current time period is normal activity, and the possibility of data leakage is low.

[0070] In the method for detecting data leakage, according to the network traffic log data set, the historical data packet size sequence and the historical data packet transmission duration sequence of each four tuple in continuous multiple historical time periods are obtained; the historical data packet size sequence and the historical data packet transmission duration sequence of each four tuple are counted to determine the data packet size range and the data packet transmission duration range of each four tuple; the current data packet size and the current data packet transmission duration of each four tuple in the current time period are obtained; and whether the data transmission of each four tuple in the current time period has data leakage is determined according to whether the current data packet size of each four tuple is within the corresponding data packet size range and whether the current data packet transmission duration of each four tuple is within the corresponding data packet transmission duration range. The scheme provided in the application performs data leakage detection based on time sequence, can process larger-scale data, and can also adapt to continuous changes in data mode and maintain high detection performance in various environments.

[0071] In one embodiment, according to the network traffic log data set, the historical data packet size sequence and the historical data packet transmission duration sequence of each four tuple in continuous multiple historical time periods are obtained, including the steps shown in the following table: Figure 3

[0072] In step S301, a network traffic log data set is obtained; in step S302, for each network traffic log data, if the network traffic log data includes sensitive information, or the network traffic log data represents data transmission, or the source IP address included in the network traffic log data belongs to the IP address of a crawler center, the network traffic log data is regarded as suspicious network traffic log data, and a plurality of suspicious network traffic log data is obtained; in step S303, according to the time stamp included in the suspicious network traffic log data, a suspicious log data set in the same historical time period is determined, and a plurality of suspicious log data sets in multiple historical time periods are obtained; and in step S304, according to the suspicious log data sets in multiple historical time periods, the historical data packet size and the historical data packet transmission duration of each four tuple in multiple historical time periods are determined to form the historical data packet size sequence and the historical data packet transmission duration sequence.

[0073] After obtaining the network traffic log data set, suspicious network traffic log data can be screened out from the network traffic log data set based on static rules, so that more accurate feature extraction can be performed, and more accurate data packet size range and data packet transmission duration range can be obtained.

[0074] ​Specifically, for each network traffic log data, it can be determined by static rule matching whether the network traffic log data includes sensitive information, or whether it is used for data transmission, or whether the source IP address belongs to the IP address of the crawler center; if the network traffic log data satisfies any of the above conditions, i.e., the network traffic log data includes sensitive information, or the network traffic log data represents data transmission, or the source IP address included in the network traffic log data belongs to the IP address of the crawler center, the network traffic log data is regarded as suspicious network traffic log data.

[0075] Among them, rules can be defined in advance to identify network traffic log data containing sensitive information. The rules can be based on keywords, data formats or specific data patterns; using a regular expression or string matching as shown in Table 1, network traffic log data containing sensitive information is identified.

[0076]

[0077] Table 1

[0078] The source IP address of the network traffic log data can be detected by static rules to determine whether it belongs to the IP address of the crawler center. If so, it means that there may be a robot crawler. Robot crawlers usually exhibit specific characteristics different from normal user behavior, such as access frequency, access mode, user agent string, etc. Since other information is more likely to be fake, the embodiment determines by checking whether the source IP address of the network traffic log data belongs to the IP address of the crawler center.

[0079] In the above manner, each network traffic log data is determined, and a number of suspicious network traffic log data can be obtained. After determining the suspicious network traffic log data, the suspicious network traffic log data included in the time stamp can be determined to belong to the same historical time period, and the suspicious log data set of the same historical time period is formed, and then a plurality of historical time period suspicious log data sets are obtained.

[0080] For each historical time period suspicious log data set, the suspicious network traffic log data included in the source IP address and other information of the suspicious log data set can be determined to belong to the same four tuple, and then the historical packet size and historical packet transmission duration of each four tuple in the historical time period are obtained.

[0081] In the above manner, the historical packet size and historical packet transmission duration of each four tuple in a plurality of historical time periods can be obtained, and then the historical packet size sequence and historical packet transmission duration sequence are formed.

[0082] Then, the history packet size sequence of each four tuple can be counted to obtain a packet size range of each four tuple; the history packet transmission duration sequence of each four tuple can be counted to obtain a packet transmission duration range of each four tuple.

[0083] In one embodiment, the method provided by the application further comprises:

[0084] The network traffic log data set is classified according to the communication protocols included in the network traffic log data, to obtain network traffic log data subsets of each communication protocol; the network traffic log data subset of the communication protocol used for data transmission is determined as a target network traffic log data subset; and each network traffic log data in the target network traffic log data subset represents data transmission.

[0085] The network traffic log data set is classified according to the communication protocols included in the network traffic log data, to obtain network traffic log data subsets of each communication protocol; the network traffic log data subset of the communication protocol used for data transmission is determined as a target network traffic log data subset; and each network traffic log data in the target network traffic log data subset represents data transmission.

[0086] HTTP and FTP are communication protocols used for data transmission. Therefore, the network traffic log data subset of HTTP and the network traffic log data subset of FTP can be determined as the target network traffic log data subset; and correspondingly, the network traffic log data in the two network traffic log data subsets is used for data transmission.

[0087] In some scenarios, the network traffic log data can not carry a communication protocol. In this case, it can be determined whether the network traffic log data is used for data transmission according to a port number. If the port number is a commonly used port number of a data transmission type communication protocol, or the port number is a commonly used port number of a database, it can be determined that the network traffic log data is used for data transmission. The commonly used port number of the data transmission type communication protocol is, for example, the commonly used port number of FTP is 21, the commonly used port number of SSH (Secure Shell, Secure Shell protocol) is 22, the commonly used port number of HTTP is 80, and the commonly used port number of HTTPS (Hypertext Transfer Protocol Secure, Hypertext Transfer Protocol Secure) is 443. The commonly used port number of the database is, for example, the commonly used port number of Redis (which belongs to a kind of database) is 6379, and the commonly used port number of Elasticsearch (which belongs to a kind of database) is 9200.

[0088] In some scenarios, it can also be determined whether a large amount of data is transmitted between the corresponding four tuples according to the network traffic log data. If the amount of data transmitted between the four tuples is greater than a set value, it can be determined that the network traffic log data of the four tuples is used for data transmission. The set value can be set according to the network bandwidth and normal business traffic, for example, it can be set to 10MB.

[0089] In some scenarios, it can also be determined whether data is continuously transmitted between the corresponding four tuples according to the network traffic log data. If so, it can be further determined whether the time of continuously transmitting data exceeds a time threshold. If the time of continuously transmitting data exceeds the time threshold, it can be determined that the network traffic log data of the four tuples is used for data transmission. The time threshold can be set according to the normal business traffic module and the expected behavior, for example, it can be set to 30 minutes.

[0090] The present application can determine whether the network traffic log data is used for data transmission by four data characteristics. The four data characteristics are shown in Table 2.

[0091]

[0092] Table 2

[0093] Non-data characteristics include periodic small data packet transmission (such as heartbeat detection), HTTP request (such as GET request for page loading), DNS (Domain Name Server, Domain Name Server) query, etc.

[0094] In one embodiment, the historical packet size sequence of each four tuple is counted, and the packet size range of each four tuple is determined, including:

[0095] According to the historical data packet size sequence of each four tuple, the mean value and the standard deviation of the historical data packet size of each four tuple are obtained; according to the sum of the mean value and the standard deviation multiplied by a set multiple of the historical data packet size of each four tuple, the upper limit value of the data packet size range of each four tuple is obtained; according to the difference between the mean value and the standard deviation multiplied by a set multiple of the historical data packet size of each four tuple, the lower limit value of the data packet size range of each four tuple is obtained; and according to the upper limit value and the lower limit value of the data packet size range of each four tuple, the data packet size range of each four tuple is obtained.

[0096] When the 3-sigma method is used for statistics, the set multiple is three.

[0097] For any four tuple, the historical data packet size sequence of the four tuple can be obtained, and the mean value and the standard deviation of the historical data packet size are calculated according to the historical data packet size sequence. The product of the standard deviation of the historical data packet size and 3 can be obtained; according to the sum of the mean value of the historical data packet size and the product, the upper limit value of the data packet size range is obtained; according to the difference between the mean value of the historical data packet size and the product, the lower limit value of the data packet size range is obtained; and according to the upper limit value and the lower limit value, the data packet size range of the four tuple can be obtained.

[0098] In one embodiment, the historical data packet transmission duration sequence of each four tuple is counted, and the data packet transmission duration range of each four tuple is determined, including:

[0099] According to the historical data packet transmission duration sequence of each four tuple, the mean value and the standard deviation of the historical data packet transmission duration of each four tuple are obtained; according to the sum of the mean value and the standard deviation multiplied by a set multiple of the historical data packet transmission duration of each four tuple, the upper limit value of the data packet transmission duration range of each four tuple is obtained; according to the difference between the mean value and the standard deviation multiplied by a set multiple of the historical data packet transmission duration of each four tuple, the lower limit value of the data packet transmission duration range of each four tuple is obtained; and according to the upper limit value and the lower limit value of the data packet transmission duration range of each four tuple, the data packet transmission duration range of each four tuple is obtained.

[0100] When the 3-sigma method is used for statistics, the set multiple is three.

[0101] For any four-tuple, a history data packet transmission duration sequence of the four-tuple can be obtained, and according to the history data packet transmission duration sequence, a mean value and a standard deviation of the history data packet transmission duration are calculated. A product result of the standard deviation of the history data packet transmission duration and 3 can be obtained, and an upper limit value of the data packet transmission duration range is obtained according to a sum of the mean value of the history data packet transmission duration and the product result. A lower limit value of the data packet transmission duration range is obtained according to a difference between the mean value of the history data packet transmission duration and the product result. According to the upper limit value and the lower limit value, the data packet transmission duration range of the four-tuple can be obtained.

[0102] The method provided in the application can improve the data security and confidentiality in the enterprise network environment. One example is as follows:

[0103] The history data packet size sequence and the history data packet transmission duration sequence of a certain four-tuple are obtained, as shown in Table 3.

[0104]

[0105] Table 3

[0106] According to the history data packet size sequence of the four-tuple, the mean value of the history data packet size is 111, and the standard deviation of the history data packet size is 13.71. According to the mean value and the standard deviation of the history data packet size, the data packet size range is 72.58-149.42.

[0107] According to the history data packet transmission duration sequence of the four-tuple, the mean value of the history data packet transmission duration is 1125, and the standard deviation of the history data packet transmission duration is 128.02. According to the mean value and the standard deviation of the history data packet transmission duration, the data packet transmission duration range is 738.96-1509.04.

[0108] If the data packet size of the four-tuple is not within the above data packet size range and the data packet transmission duration is not within the above data packet transmission duration range in the current time period or the subsequent time period, it can be determined that the data transmission of the four-tuple is abnormal, and there is a data leakage risk.

[0109] The scheme provided in the application analyzes the network traffic log data, combines the use of protocol classification and static rules, effectively avoids the disadvantages of using only static rules, and this real-time monitoring method can better adapt to the rapid changes of the network environment, thereby more effectively preventing and reducing the data leakage risk. The scheme provided in the application can be flexibly applied to enterprise networks of different scales and types. Enterprises of various scales can adjust the corresponding configurations according to their own network structures and needs, thereby achieving the best data protection effect.

[0110] The scheme provided in the application can accurately identify abnormal patterns in network behavior by applying a 3-sigma algorithm and time series analysis. Compared with traditional rule-based systems, the scheme provided in the application can more accurately distinguish between normal and abnormal behavior based on a statistical method, thereby greatly reducing the possibility of false positives and false negatives.

[0111] It should be understood that, although each step in the flowchart involved in each embodiment as described above is shown in sequence according to the arrow, these steps are not necessarily executed in sequence according to the arrow. Unless otherwise specified herein, the execution of these steps is not strictly limited in sequence, and these steps can be executed in other sequences. Moreover, at least part of the steps in the flowchart involved in each embodiment as described above can include multiple steps or multiple stages, which are not necessarily executed at the same time, but can be executed at different times, and the execution sequence of these steps or stages is not necessarily sequential, but can be alternately executed with at least part of other steps or steps or stages in other steps.

[0112] Based on the same inventive concept, the embodiments of the application also provide a data leakage detection device for implementing the above-mentioned data leakage detection method. The implementation scheme for solving the problem provided by the device is similar to the implementation scheme described in the above method, so the specific limitations in one or more data leakage detection device embodiments provided below can refer to the limitations of the data leakage detection method described above, which will not be repeated here.

[0113] In one embodiment, as shown in Figure 4 a data leakage detection device is provided, comprising:

[0114] The sequence acquisition module 401 is configured to obtain, according to the network traffic log data set, a historical data packet size sequence and a historical data packet transmission duration sequence of each four tuple in a plurality of continuous historical time periods respectively;

[0115] The range determination module 402 is configured to determine a data packet size range and a data packet transmission duration range of each four tuple by counting the historical data packet size sequence and the historical data packet transmission duration sequence of each four tuple;

[0116] The current information acquisition module 403 is configured to acquire a current data packet size and a current data packet transmission duration of each four tuple in a current time period;

[0117] The data leakage identification module 404 is configured to determine whether data leakage exists in data transmission of each four tuple in the current time period according to whether the current data packet size of each four tuple is within the corresponding data packet size range and whether the current data packet transmission duration of each four tuple is within the corresponding data packet transmission duration range.

[0118] In an embodiment, the sequence acquisition module 401 is further configured to:

[0119] acquire a network traffic log data set; for each network traffic log data, if the network traffic log data includes sensitive information, or the network traffic log data represents data transmission, or a source IP address included in the network traffic log data belongs to an IP address of a crawler center, the network traffic log data is regarded as suspicious network traffic log data, and a plurality of suspicious network traffic log data is obtained; according to time stamps included in the suspicious network traffic log data, a suspicious log data set of the same historical time period is determined, and a plurality of suspicious log data sets of historical time periods is obtained; and according to the plurality of suspicious log data sets of historical time periods, historical data packet sizes and historical data packet transmission durations of each four tuple in the plurality of historical time periods are determined, and a historical data packet size sequence and a historical data packet transmission duration sequence are formed.

[0120] In an embodiment, the sequence acquisition module 401 is further configured to:

[0121] classify the network traffic log data set according to communication protocols included in the network traffic log data, and obtain network traffic log data subsets of each communication protocol; determine a network traffic log data subset of a communication protocol used for data transmission as a target network traffic log data subset; and determine that each network traffic log data in the target network traffic log data subset represents data transmission.

[0122] In an embodiment, the range determination module 402 is further configured to:

[0123] obtain a mean value and a standard deviation of the historical data packet size of each four tuple according to the historical data packet size sequence of each four tuple; obtain an upper limit value of the data packet size range of each four tuple according to a sum of the mean value of the historical data packet size of each four tuple and a set multiple of the standard deviation; obtain a lower limit value of the data packet size range of each four tuple according to a difference between the mean value of the historical data packet size of each four tuple and a set multiple of the standard deviation; and obtain the data packet size range of each four tuple according to the upper limit value and the lower limit value of the data packet size range of each four tuple.

[0124] In an embodiment, the range determination module 402 is further configured to:

[0125] According to the historical data packet transmission duration sequence of each four-tuple, the mean value and the standard deviation of the historical data packet transmission duration of each four-tuple are obtained; according to the sum of the mean value and the set multiple of the standard deviation of the historical data packet transmission duration of each four-tuple, the upper limit value of the data packet transmission duration range of each four-tuple is obtained; according to the difference between the mean value and the set multiple of the standard deviation of the historical data packet transmission duration of each four-tuple, the lower limit value of the data packet transmission duration range of each four-tuple is obtained; and according to the upper limit value and the lower limit value of the data packet transmission duration range of each four-tuple, the data packet transmission duration range of each four-tuple is obtained.

[0126] In one embodiment, the set multiple is three.

[0127] The modules in the data leakage detection device described above can be implemented by software, hardware, and combinations thereof, in whole or in part. The modules described above can be embedded in the processor in the computer device in hardware form or independent of the processor in the computer device, or can be stored in the memory in the computer device in software form, so as to be called and executed by the processor to perform the operations corresponding to the modules.

[0128] In one exemplary embodiment, a computer device is provided, and an internal structure diagram of the computer device can be as shown in Figure 5 The computer device includes a processor, a memory, an input / output interface (I / O), and a communication interface. The processor, the memory, and the input / output interface are connected through a system bus, and the communication interface is connected to the system bus through the input / output interface. The processor of the computer device is configured to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program, and a database. The internal memory provides an environment for the operating system and the computer program in the non-volatile storage medium to run. The database of the computer device is configured to store data related to the method described above. The input / output interface of the computer device is configured to exchange information between the processor and external devices. The communication interface of the computer device is configured to communicate with external terminals through a network connection. The computer program is executed by the processor to implement a data leakage detection method.

[0129] Those skilled in the art can understand that Figure 5 the structure shown in the figure is only a block diagram of part of the structure related to the scheme of the present application, and does not constitute a limitation on the computer device to which the scheme of the present application is applied. The specific computer device can include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0130] In an embodiment, a computer device is provided, comprising a memory and a processor, the memory stores a computer program, and the processor implements the steps in each of the above method embodiments when executing the computer program.

[0131] In an embodiment, a computer readable storage medium is provided, which stores a computer program, and the computer program implements the steps in each of the above method embodiments when executed by a processor.

[0132] In an embodiment, a computer program product is provided, which stores a computer program, and the computer program implements the steps in each of the above method embodiments when executed by a processor.

[0133] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data for analysis, stored data, displayed data, etc.) involved in the present application are all information and data authorized by the user or authorized by all parties, and the collection, use and processing of related data need to comply with relevant regulations.

[0134] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program. The computer program can be stored in a non-volatile computer readable storage medium, and when executed, can include the processes of the above-mentioned embodiment methods. Any reference to memory, database or other medium used in the embodiments provided in the present application can include at least one of non-volatile memory and volatile memory. The non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical storage, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetoresistive random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. The volatile memory can include random access memory (RAM) or external cache memory, etc. As an illustration but not limitation, the RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM), etc. The database involved in the embodiments provided in the present application can include at least one of a relational database and a non-relational database. The non-relational database can include a distributed database based on a block chain, etc., without being limited thereto. The processor involved in the embodiments provided in the present application can be a general-purpose processor, a central processing unit, a graphics processing unit, a digital signal processor, a programmable logic device, a data processing logic device based on quantum computing, an artificial intelligence (AI) processor, etc., without being limited thereto.

[0135] The technical features of the above embodiments can be combined in any manner. To make the description concise, all possible combinations of the technical features in the above embodiments are not described, but as long as the combinations of the technical features do not exist, they should be considered as the scope of the present application.

[0136] The above-described embodiments are merely illustrative of several embodiments of the present application, and the description is relatively specific and detailed, but should not be understood as a limitation on the scope of the patent. It should be noted that for those skilled in the art, without departing from the concept of the present application, a number of modifications and improvements can be made, which are all within the scope of the present application. Therefore, the scope of protection of the present application should be subject to the appended claims.

Claims

1. A method of detecting data breach, the method comprising: The method comprises: According to the network traffic log data set, the historical data packet size sequence and the historical data packet transmission duration sequence of each four tuple in a plurality of continuous historical time periods are obtained; The historical data packet size sequence and the historical data packet transmission duration sequence of each four tuple are counted to determine the data packet size range and the data packet transmission duration range of each four tuple; The current data packet size and the current data packet transmission duration of each four tuple in the current time period are obtained; According to whether the current data packet size of each four tuple is within the corresponding data packet size range and whether the current data packet transmission duration of each four tuple is within the corresponding data packet transmission duration range, it is determined whether there is data leakage in data transmission of each four tuple in the current time period.

2. The method of claim 1, wherein, According to the network traffic log data set, the historical data packet size sequence and the historical data packet transmission duration sequence of each four tuple in a plurality of continuous historical time periods are obtained, comprising: Obtain a network traffic log data set; For each network traffic log data, if the network traffic log data includes sensitive information, or the network traffic log data represents data transmission, or the source IP address included in the network traffic log data belongs to the IP address of a crawler center, the network traffic log data is regarded as suspicious network traffic log data, and a plurality of suspicious network traffic log data is obtained; According to the time stamp included in the suspicious network traffic log data, the suspicious log data set of the same historical time period is determined, and a plurality of historical time period suspicious log data sets are obtained; According to the suspicious log data set of a plurality of historical time periods, the historical data packet size and the historical data packet transmission duration of each four tuple in a plurality of historical time periods are determined to form the historical data packet size sequence and the historical data packet transmission duration sequence.

3. The method of claim 2, wherein, The method further comprises: Classify the network traffic log data set according to the communication protocol included in the network traffic log data to obtain the network traffic log data subset of each communication protocol; The network traffic log data subset of the communication protocol used for data transmission is determined as the target network traffic log data subset; It is determined that each network traffic log data in the target network traffic log data subset represents data transmission.

4. The method of claim 1, wherein, Counting the historical data packet size sequence of each four tuple to determine the data packet size range of each four tuple comprises: According to the historical data packet size sequence of each four tuple, the mean and the standard deviation of the historical data packet size of each four tuple are obtained; According to the sum of the mean and the standard deviation of a set multiple of each four tuple, the upper limit value of the data packet size range of each four tuple is obtained; According to the difference between the mean and the standard deviation of a set multiple of each four tuple, the lower limit value of the data packet size range of each four tuple is obtained; According to the upper limit value and the lower limit value of the data packet size range of each four tuple, the data packet size range of each four tuple is obtained.

5. The method of claim 1, wherein, Counting the historical data packet transmission duration sequence of each four tuple to determine the data packet transmission duration range of each four tuple comprises: According to the historical data packet transmission duration sequence of each four-tuple, a mean value and a standard deviation of the historical data packet transmission duration of each four-tuple are obtained; According to the sum of the mean value and a set multiple of the standard deviation of the historical data packet transmission duration of each four-tuple, an upper limit value of the data packet transmission duration range of each four-tuple is obtained; According to the difference between the mean value and a set multiple of the standard deviation of the historical data packet transmission duration of each four-tuple, a lower limit value of the data packet transmission duration range of each four-tuple is obtained; According to the upper limit value and the lower limit value of the data packet transmission duration range of each four-tuple, the data packet transmission duration range of each four-tuple is obtained.

6. The method according to claim 4 or 5, characterized in that, The set multiple is three.

7. A data leakage detection apparatus characterized by comprising: The apparatus comprises: a sequence obtaining module configured to obtain, according to a network traffic log data set, a historical data packet size sequence and a historical data packet transmission duration sequence of each four-tuple in a plurality of continuous historical time periods; a range determining module configured to determine, by counting the historical data packet size sequence and the historical data packet transmission duration sequence of each four-tuple, a data packet size range and a data packet transmission duration range of each four-tuple; a current information obtaining module configured to obtain a current data packet size and a current data packet transmission duration of each four-tuple in a current time period; a data leakage identifying module configured to determine, according to whether the current data packet size of each four-tuple is within the corresponding data packet size range and whether the current data packet transmission duration of each four-tuple is within the corresponding data packet transmission duration range, whether data transmission of each four-tuple in the current time period has data leakage.

8. A computer device comprising a memory and a processor, the memory storing a computer program, characterized in that, The processor implements the method of any one of claims 1 to 6 when executing the computer program.

9. A computer readable storage medium having stored thereon a computer program, characterized in that, The computer program, when executed by the processor, implements the method of any one of claims 1 to 6.

10. A computer program product comprising a computer program, characterized in that, The computer program, when executed by the processor, implements the method of any one of claims 1 to 6. The computer program, when executed by the processor, implements the method of any one of claims 1 to 6.

Images