Data security detection method and device, computer equipment, readable storage medium and program product

Abstract

The invention relates to a data security detection method and device, computer equipment, a readable storage medium and a program product, and relates to the field of data detection. The method comprises the following steps: in response to a security detection instruction for target data, performing detection rule analysis on the target data through a rule analysis model to obtain a security detection rule of the target data; determining a security detection task of the target data based on the security detection rule, and dividing the security detection task into a plurality of sub-detection tasks; according to the respective execution priority of each sub-detection task, executing each sub-detection task to obtain a respective sub-detection result of each sub-detection task; and summarizing the sub-detection results to obtain a security detection result of the target data. By adopting the method, the data security detection efficiency can be improved.

Description

Technical Field

[0001] The present application relates to the field of data detection, and in particular to a data security detection method, device, computer equipment, readable storage medium and program product. Background Art

[0002] With the rapid development of computer technology, the amount of data is also increasing exponentially. Based on this, how to ensure data security becomes particularly important.

[0003] In traditional technology, manual detection is usually used to achieve data security detection. However, when the amount of data is large, the workload of manual detection will also increase, thus affecting the efficiency of data security detection. Summary of the invention

[0004] Based on this, it is necessary to provide a data security detection method, device, computer equipment, computer-readable storage medium and computer program product that can improve the efficiency of data security detection in response to the above technical problems.

[0005] In a first aspect, the present application provides a data security detection method, comprising: in response to a security detection instruction for target data, performing detection rule analysis on the target data through a rule analysis model to obtain security detection rules for the target data; determining a security detection task for the target data based on the security detection rules, and dividing the security detection task into multiple sub-detection tasks; executing each sub-detection task according to the execution priority of each sub-detection task to obtain a sub-detection result for each sub-detection task; and summarizing the sub-detection results to obtain a security detection result for the target data.

[0006] In one of the embodiments, the method further includes: collecting data for each target object through a data collection component deployed in each target object to obtain the original data of each target object; based on a hash algorithm, removing duplicate data from each original data to obtain intermediate data; and supplementing missing values ​​in the intermediate data to obtain target data.

[0007] In one of the embodiments, missing values ​​are supplemented in the intermediate data to obtain target data, including: supplementing the missing values ​​in the intermediate data to obtain complete data; formatting the complete data to obtain target data; the formatting includes at least one of data timestamp formatting, value formatting, and string formatting.

[0008] In one of the embodiments, each sub-detection task is executed according to the respective execution priority of each sub-detection task to obtain the respective sub-detection result of each sub-detection task, including: according to the respective execution priority of each sub-detection task, each sub-detection task is sent to a task execution node that matches the execution priority; and each sub-detection task is executed through each task execution node to obtain the respective sub-detection result of each sub-detection task.

[0009] In one of the embodiments, the method further includes: when the security detection results of the target data include abnormal detection results, performing optimization operation matching on the abnormal detection results to obtain a target optimization operation that matches the abnormal detection results; adding the target optimization operation to an optimization template to obtain an optimization task; and performing data optimization on the target data based on the optimization task.

[0010] In one of the embodiments, detection rule analysis is performed on target data through a rule analysis model to obtain security detection rules for the target data, including: extracting features of the target data through a rule analysis model to obtain multiple target features of the target data; performing gain analysis on each target feature to obtain the information gain of each target feature; and performing detection rule analysis on the target data based on each information gain to obtain security detection rules for the target data.

[0011] In the second aspect, the present application also provides a data security detection device, including: a detection rule generation module, which is used to respond to security detection instructions for target data, perform detection rule analysis on the target data through a rule analysis model, and obtain security detection rules for the target data; a detection task division module, which is used to determine the security detection task of the target data based on the security detection rules, and divide the security detection task into multiple sub-detection tasks; a task execution module, which is used to execute each sub-detection task according to the execution priority of each sub-detection task, and obtain the sub-detection result of each sub-detection task; a task summary module, which is used to summarize the sub-detection results to obtain the security detection result of the target data.

[0012] On the third aspect, the present application also provides a computer device, including a memory and a processor, the memory storing a computer program, and the processor implementing the following steps when executing the computer program: in response to a security detection instruction for target data, performing detection rule analysis on the target data through a rule analysis model to obtain security detection rules for the target data; determining a security detection task for the target data based on the security detection rules, and dividing the security detection task into multiple sub-detection tasks; executing each sub-detection task according to the execution priority of each sub-detection task to obtain a sub-detection result of each sub-detection task; and summarizing the sub-detection results to obtain the security detection result of the target data.

[0013] In a fourth aspect, the present application also provides a computer-readable storage medium having a computer program stored thereon, which implements the following steps when the computer program is executed by a processor: in response to a security detection instruction for target data, performing detection rule analysis on the target data through a rule analysis model to obtain security detection rules for the target data; determining a security detection task for the target data based on the security detection rules, and dividing the security detection task into multiple sub-detection tasks; executing each sub-detection task according to the execution priority of each sub-detection task to obtain a sub-detection result for each sub-detection task; and summarizing the sub-detection results to obtain a security detection result for the target data.

[0014] In a fifth aspect, the present application also provides a computer program product, including a computer program, which implements the following steps when executed by a processor: in response to a security detection instruction for target data, performing detection rule analysis on the target data through a rule analysis model to obtain security detection rules for the target data; determining a security detection task for the target data based on the security detection rules, and dividing the security detection task into multiple sub-detection tasks; executing each sub-detection task according to the execution priority of each sub-detection task to obtain a sub-detection result for each sub-detection task; and summarizing the sub-detection results to obtain a security detection result for the target data.

[0015] The above-mentioned data security detection method, device, computer equipment, computer-readable storage medium and computer program product, in response to the security detection instruction for the target data, first analyzes the detection rules of the target data through the rule analysis model to obtain the security detection rules of the target data. Then the security detection task corresponding to the security detection rule is divided into a plurality of sub-detection tasks, so that each sub-detection task is executed according to the execution priority of each sub-detection task, and each sub-detection result is obtained. Finally, the security detection result of the target data is obtained by summarizing the sub-detection results. Compared with the manual detection method, it is undoubtedly more efficient to generate security detection rules by the rule analysis model, and it can also reduce the interference of human factors, making the security detection rules more objective and reliable, thereby improving the efficiency and accuracy of the entire data security detection. In addition, the present application also introduces a distributed execution task mode to further effectively improve the efficiency of data security detection. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] In order to more clearly illustrate the technical solutions in the embodiments of the present application or related technologies, the drawings required for use in the embodiments of the present application or related technical descriptions will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying creative work.

[0017] Figure 1 An application environment diagram of a data security detection method in an embodiment;

[0018] Figure 2 A schematic diagram of a data security detection method in one embodiment;

[0019] Figure 3 A schematic diagram of a process of removing duplicate data in one embodiment;

[0020] Figure 4 A schematic diagram of a process for supplementing missing values ​​in one embodiment;

[0021] Figure 5 A schematic diagram of a process of data optimization in one embodiment;

[0022] Figure 6 A schematic diagram of a process for generating detection rules in an embodiment;

[0023] Figure 7 It is a flowchart of a data security detection method in a specific embodiment;

[0024] Figure 8 A schematic diagram of a data collection process in a specific embodiment;

[0025] Fig. 9 A schematic diagram of the training process of a rule analysis model in a specific embodiment;

[0026] Fig.10 It is a flowchart of executing detection tasks in parallel in a specific embodiment;

[0027] Fig.11 A schematic diagram of a process flow of data optimization in a specific embodiment;

[0028] Fig.12 is a structural block diagram of a data security detection device in one embodiment;

[0029] Fig.13 FIG. 4 is a diagram showing the internal structure of a computer device in one embodiment. DETAILED DESCRIPTION

[0030] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0031] The data security detection method provided in the embodiment of the present application can be applied to Figure 1In the application environment shown. Among them, the terminal 102 communicates with the server 104 through the network. The data storage system can store the data that the server 104 needs to process. The data storage system can be integrated on the server 104, or it can be placed on the cloud or other network servers. Among them, the terminal 102 can be, but is not limited to, various personal computers, laptops, smart phones, tablet computers, and Internet of Things devices. The server 104 can be a server in a data security detection system, an independent physical server, a server cluster or distributed system composed of multiple physical servers, or a cloud server that provides cloud computing services.

[0032] Specifically, in response to the security detection instruction for the target data initiated by the terminal 102, the server 104 first performs detection rule analysis on the target data through the rule analysis model to obtain the security detection rule of the target data. Then, the security detection task of the target data is determined based on the security detection rule, and the security detection task is divided into multiple sub-detection tasks. Then, according to the execution priority of each sub-detection task, each sub-detection task is executed to obtain the sub-detection result of each sub-detection task. Finally, the sub-detection results are summarized to obtain the security detection result of the target data.

[0033] In an exemplary embodiment, Figure 2 As shown, a data security detection method is provided, which is applied to Figure 1 The server 104 in FIG. 1 is used as an example to illustrate, including:

[0034] Step S202 , in response to a security detection instruction for target data, a detection rule analysis is performed on the target data through a rule analysis model to obtain a security detection rule for the target data.

[0035] Among them, the target data may refer to data that needs to be security tested, such as log data. The security detection instruction may refer to an instruction for performing security testing on the target data. The security detection may include but is not limited to data compliance testing, data risk assessment, etc. It can be understood that data compliance testing is the process of detecting whether the target data complies with relevant regulations, standards or internal policy requirements. Data risk assessment is the process of detecting whether there is a risk of leakage or intrusion in the target data. Of course, other security detection contents can also be configured in actual applications, and this embodiment does not limit this. The rule analysis model is a mathematical model based on a machine learning algorithm such as a decision tree algorithm, which can be used to dynamically generate and optimize security detection rules. Security detection rules may refer to a series of rules for performing security testing on target data.

[0036] In one example, the target data may be mixed data of multiple target objects, and the target object may refer to a target cloud network. Therefore, the target data may refer to mixed data in a multi-cloud network environment. A multi-cloud network environment refers to a cloud computing environment that combines a public cloud and a private cloud. A public cloud is a cloud computing resource provided by a third-party cloud service provider, and a private cloud is a cloud computing resource dedicated to a single organization or enterprise. A multi-cloud network environment allows data and applications to be shared and migrated between public clouds and private clouds.

[0037] For example, when a server receives a security detection instruction for target data, such as hybrid data in a multi-cloud environment, it can call a rule analysis model pre-trained based on a machine learning algorithm to perform detection rule analysis on the target data, thereby outputting security detection rules for the target data. The server can then perform security detection on the target data based on these security detection rules.

[0038] Step S204, determining the security detection task of the target data based on the security detection rule, and dividing the security detection task into a plurality of sub-detection tasks.

[0039] The security detection task refers to a task of performing security detection on target data, which may include information such as security detection rules, detection time, detection cycle, etc. The sub-detection task refers to a sub-task obtained by dividing the security detection task.

[0040] Exemplarily, after the rule analysis model outputs the security detection rules of the target data, the server can generate a security detection task including the security detection rules, as well as other information such as the detection time and detection cycle. In order to improve the efficiency of data security detection, the security detection task is divided in this embodiment to obtain multiple sub-detection tasks to achieve the purpose of distributed detection.

[0041] Step S206, executing each sub-detection task according to the execution priority of each sub-detection task, and obtaining a sub-detection result of each sub-detection task.

[0042] The execution priority may refer to the priority of the sub-detection task to be executed, and the higher the priority, the higher the priority. The sub-detection result refers to the result generated after the sub-detection task is executed, which may include but is not limited to whether it is safe, whether it is compliant, whether there is an intrusion risk, detection time, number of detections, etc.

[0043] Exemplarily, after completing the task division to obtain multiple sub-detection tasks, the server can further obtain the execution priority of each sub-detection task. The execution priority can be determined according to the importance of the sub-detection task. The higher the importance, the higher the execution priority. The importance of the sub-detection task can be further determined according to the importance of the data to be detected contained in the sub-detection task in the entire target data. In other words, if the data to be detected contained in the sub-detection task belongs to the important data in the target data, the importance of the sub-detection task will also be higher, so it has a higher execution priority. The server executes each sub-detection task according to the execution priority of each sub-detection task, that is, it performs security detection on the data to be detected contained in each sub-detection task. Thereby obtaining the detection result of each sub-detection task.

[0044] In one example, the server may distribute the sub-detection tasks to corresponding execution nodes according to the execution priority of each sub-detection task, and each execution node may execute the sub-detection tasks in parallel.

[0045] Step S208, summarizing the sub-detection results to obtain the security detection result of the target data.

[0046] Among them, the security detection result refers to the result obtained after summarizing each sub-detection result, which serves as the security detection result of the entire target data.

[0047] Exemplarily, after the server obtains the sub-detection results corresponding to each sub-detection task, it can summarize these sub-detection results to obtain the security detection results of the entire target data.

[0048] In this embodiment, the server responds to the security detection instruction for the target data initiated by the terminal, and first analyzes the detection rules of the target data through the rule analysis model to obtain the security detection rules of the target data. Then the security detection task corresponding to the security detection rule is divided into multiple sub-detection tasks, so that each sub-detection task is executed according to the execution priority of each sub-detection task to obtain each sub-detection result. Finally, the security detection result of the target data is obtained by summarizing the sub-detection results. Compared with the manual detection method, it is undoubtedly more efficient to generate security detection rules by the rule analysis model, and it can also reduce the interference of human factors, making the security detection rules more objective and reliable, thereby improving the efficiency and accuracy of the entire data security detection. In addition, this embodiment also introduces a distributed execution task mode to further effectively improve the efficiency of data security detection.

[0049] In an exemplary embodiment, Figure 3 As shown, the target data acquisition process also includes:

[0050] Step S302 , collecting data from each target object through the data collection components deployed in each target object, to obtain the original data of each target object.

[0051] Among them, the data collection component refers to a component used for log data collection. In this embodiment, the data collection component is an intelligent agent. The intelligent agent is a program that collects data regularly. It does not require human intervention, is highly intelligent and self-learning, and can actively collect required data according to user-defined criteria. The server can communicate with each data collection component to obtain the data collected by each data collection component. The target object can refer to the target cloud network. Data collection components can be deployed in each target cloud network. Public clouds can automatically deploy data collection components through the Terraform open source tool, and private clouds can automatically deploy data collection components through the Ansible open source tool.

[0052] In one example, after configuring the smart agent for each target object, that is, each cloud network, the server can further configure the API (Application Programming Interface) calling permissions of the smart agent, including setting the API key and access token to ensure that the smart agent can access the data resources in the cloud network. After the configuration is completed, the smart agent can obtain the permission to access the data in the cloud network.

[0053] In one example, the intelligent agent can collect data from each cloud network according to the data collection strategy preset by the server. The data collection strategy includes data collection cycle, data collection frequency, data collection scope, etc. For example, the intelligent agent can collect log data of the cloud network once every hour.

[0054] For example, before performing security detection on target data, it is necessary to collect target data first. That is, by calling the API interface of the corresponding cloud network through the intelligent agent pre-deployed in each cloud network, the original data in the cloud network is collected. The server will obtain the original data returned by each intelligent agent.

[0055] Step S304: based on the hash algorithm, remove duplicate data from each original data to obtain intermediate data.

[0056] Among them, duplicate data elimination refers to eliminating duplicate data in each original data. Intermediate data refers to the data obtained after the duplicate data is eliminated.

[0057] Exemplarily, after obtaining each raw data, the server needs to preprocess the data to obtain standardized target data in order to ensure the accuracy of the data. One of the preprocessing methods in this embodiment is to remove duplicate data. For each data record in each raw data, the server can calculate the hash value of its unique identifier such as log ID (Identification), timestamp, source IP (Internet Protocol), etc. based on the hash algorithm. The expression is: , where || represents the string concatenation operation, Indicates the log ID. Indicates the timestamp, Indicates the source IP. This expression is a hash value calculated by concatenating the log ID, timestamp, and source IP. After the server calculates the hash value of each data record, it traverses the original data to check whether there is a duplicate hash value. If so, the data record corresponding to the hash value is deleted. If not, the data record corresponding to the hash value is retained.

[0058] Step S306, supplement the missing values ​​of the intermediate data to obtain the target data.

[0059] Exemplarily, another preprocessing method for raw data in this embodiment is to supplement missing values, specifically to supplement missing values ​​of timestamps. That is, the server will supplement the missing timestamps of each raw data to obtain target data.

[0060] In an exemplary embodiment, supplementing missing values ​​in the intermediate data to obtain target data includes: supplementing missing values ​​in the intermediate data to obtain complete data; and formatting the complete data to obtain target data.

[0061] The complete data refers to the data after the missing values ​​are supplemented. The formatting process includes at least one of data timestamp formatting, value formatting, and string formatting.

[0062] For example, the server can fill in the missing timestamps in each raw data using a linear equation based on the known timestamp value. The expression is as follows:

[0063]

[0064] Among them, y1 and y2 represent known timestamps, x1 and x2 represent the index values ​​corresponding to y1 and y2, and x is the index value of the missing timestamp. That is, the server will traverse the timestamp list, find the two closest known timestamps, and use the linear difference formula to calculate the missing timestamp. After completing the missing value supplement of the timestamp, the complete data can be obtained. The server can then further format the complete data, including at least one of data timestamp formatting, value formatting, and string formatting. Data timestamp formatting refers to the use of parsing functions to unify timestamps of different formats into a unified format, such as ISO8601 format. Value formatting can be understood as value normalization processing, and the expression is:

[0065]

[0066] Among them, x is the original data, is the normalized data, and They are the minimum and maximum values ​​of the original data respectively. String formatting, also known as string standardization, is to convert all strings to lowercase and remove extra spaces at both ends and in the middle of the string.

[0067] In one example, the server may also classify and group the final target data, for example, classify the data according to log types such as operation logs and security logs, and group and store the log data according to time periods.

[0068] In this embodiment, duplicate data is eliminated, missing values ​​are supplemented, and data is formatted to ensure the standardization of target data, lay a data foundation for subsequent security detection, and thus improve the accuracy and efficiency of security detection.

[0069] In an exemplary embodiment, Figure 4 As shown, each sub-detection task is executed according to the execution priority of each sub-detection task, and the sub-detection result of each sub-detection task is obtained, including:

[0070] Step S402: according to the execution priority of each sub-detection task, each sub-detection task is sent to a task execution node that matches the execution priority.

[0071] The task execution node refers to a thread that performs security detection on the data in the sub-detection task.

[0072] For example, the server matches the optimal task execution node for each sub-detection task according to its respective execution priority, and puts each sub-detection task into a message queue. Each task execution node can obtain the corresponding sub-detection task from the message queue.

[0073] Step S404: Execute each sub-detection task through each task execution node to obtain a sub-detection result of each sub-detection task.

[0074] Exemplarily, each task execution node obtains the corresponding sub-detection task from the message queue, and executes each sub-detection task in parallel, that is, performs security detection on the data in the sub-detection task, thereby obtaining the detection result of each sub-detection task.

[0075] In this embodiment, the security detection task of the target data is distributed to multiple task execution nodes for parallel execution through distributed detection technology, which can significantly improve the efficiency of data security detection.

[0076] In an exemplary embodiment, Figure 5 As shown, the data optimization process also includes:

[0077] Step S502: When the security detection result of the target data includes an abnormality detection result, an optimization operation is matched on the abnormality detection result to obtain a target optimization operation that matches the abnormality detection result.

[0078] Among them, abnormal detection results refer to detection results in an abnormal state, such as failure to enable multi-factor authentication configuration, a certain user object having too high permissions, a certain key data not being backed up regularly, no firewall rules being set, log data being saved for too short a time, etc. These abnormal detection results can indicate that the target data is not compliant, that is, the security detection result is actually not passed. Target optimization operations refer to operations that optimize abnormal detection results to solve abnormal problems.

[0079] Exemplarily, after the server obtains the security detection results of the target data, if there are abnormal detection results in the security detection results, the server will perform optimization operation matching, that is, match an optimization operation for each abnormal detection result to solve the abnormal problem. For example, the server can match an optimization operation of enabling the multi-factor authentication configuration for the abnormal detection result that the multi-factor authentication configuration is not enabled. For the abnormal detection result that a certain user object has too high permissions, match an optimization operation of reducing permissions. For the abnormal detection result that a certain key data is not backed up regularly, match an optimization operation of scheduled backup and checking validity. For the abnormal detection result that the firewall rules are not set, match an optimization operation of showing open sensitive ports. For the abnormal detection result that the log data is saved for too short a time, match an optimization operation of modifying the saving time. Of course, if there is no abnormal detection result in the security detection result, it means that the target data security detection has passed, and no data optimization is required.

[0080] Step S504, adding the target optimization operation to the optimization template to obtain the optimization task.

[0081] Step S506: Optimize the target data based on the optimization task.

[0082] The optimization template is a unified template pre-defined for data optimization. The optimization task refers to the task of optimizing the target data, which may include the target optimization operation, the corresponding anomaly detection result, the optimization time, the optimization cycle, etc.

[0083] For example, after matching each anomaly detection result with a corresponding target optimization operation, the server can add the target optimization operation to a predefined optimization template, thereby obtaining an optimization task for the anomaly detection result in the target data. The server can optimize the target data according to the optimization task to fix the anomaly problem corresponding to each anomaly detection result.

[0084] In one example, after completing data optimization, the server can also collect data optimization results, including the optimization task ID, optimized data, task description, optimization status, i.e., whether the optimization is successful, etc., and calculate the success rate of target data optimization, so as to make further adjustments to the optimization task based on these data optimization results.

[0085] In this embodiment, for target data with abnormal detection results, optimization tasks are automatically generated, thereby optimizing the target data and further improving data security.

[0086] In an exemplary embodiment, Figure 6 As shown, through the rule analysis model, the detection rule analysis is performed on the target data to obtain the security detection rules of the target data, including:

[0087] Step S602: extracting features from the target data through a rule analysis model to obtain a plurality of target features of the target data.

[0088] Among them, target features may refer to features used to characterize the characteristics of target data, which may include but are not limited to multi-factor authentication configuration switch status, user permissions, sensitive data format, data backup status, network security, firewall rules, log retention time, etc.

[0089] For example, after receiving the security detection instruction for the target data, the server can call the rule analysis model. The rule analysis model can first extract features of the target data to obtain multiple data features of the target data, which are used as input data in the subsequent rule analysis process.

[0090] In one example, the server can use mixed historical data between various cloud networks as training data in advance to train the rule analysis model. These mixed historical data include data features and data labels. The data labels can include safe and unsafe, and more specifically, compliant and non-compliant. During the model training process, the model calculates the information gain of each feature to evaluate the importance of the feature to the final classification result. The feature with the largest information gain is selected as the split feature to divide the target data and form a branch of the model. Then recursively perform the same operation on the divided data set until the preset stop condition is met, such as reaching the number of divisions, to form a complete decision tree. The final security detection rules can be extracted from the path of the root node and leaf node of the decision tree.

[0091] In one example, the server may periodically collect new data to update the rule analysis model to continuously optimize the security detection rules.

[0092] Step S604: Perform gain analysis on each target feature to obtain the information gain of each target feature.

[0093] For example, information gain is a metric used to select the best split feature during decision tree construction. It is used to measure the purity improvement that can be brought about by dividing a data set into different categories under a certain feature condition. The expression is as follows:

[0094]

[0095]

[0096]

[0097] Among them, A represents the target feature, D represents the target data set, IG(D,A) represents information gain, Entropy (D) represents information entropy, i represents the data label, P i It represents the probability of the i-th data label, and Entropy (D|A) is the conditional entropy. Information gain represents the amount by which the uncertainty of data set D is reduced due to feature A. The larger the information gain, the more important feature A is for classification.

[0098] Exemplarily, the rule analysis model performs a gain analysis on each target feature to analyze the uncertainty of each target feature with respect to the entire target data, thereby calculating the information gain of each target feature.

[0099] Step S606: Based on each information gain, a detection rule analysis is performed on the target data to obtain a security detection rule for the target data.

[0100] For example, after the rule analysis model calculates the information gain of each target feature, it can select the target feature with the largest information gain as the split feature to divide the target data set to form branches. Then, the same operation is recursively performed on the divided data set until the preset stop condition is met, such as reaching the number of divisions, to form a complete decision tree. The final security detection rules can be extracted from the path of the root node and leaf nodes of the decision tree.

[0101] In this embodiment, the use of the rule analysis model can generate security detection rules more efficiently and reduce interference from human factors, making the security detection rules more objective and reliable, thereby improving the efficiency and accuracy of the entire data security detection.

[0102] In a specific embodiment, Figure 7 As shown, Figure 7 The data security detection process is shown in Figure 1. The first is the data acquisition module. Figure 8 , Figure 8 The process of data collection and processing is shown. The server in the data security detection system will collect data from the cloud network through the intelligent agent deployed in each cloud network, obtain the original data of each cloud network, and perform data preprocessing, that is, the server will remove duplicate data from each original data based on the hash algorithm to obtain intermediate data. Then, the intermediate data is supplemented with missing values ​​to obtain complete data. Finally, the complete data is formatted by timestamp, value formatting, and string formatting to obtain the final target data. The target data is stored.

[0103] Next is the rule generation module based on machine learning. The server will call the pre-trained decision tree rule analysis model to perform detection rule analysis on the target data and obtain the compliance detection rules for the target data. Fig. 9 The training process of the decision tree rule analysis model is shown. First, data processing is performed, that is, mixed historical data between various cloud networks is obtained as training data for training the rule analysis model. These mixed historical data include data features and data labels. The data labels may include compliance and non-compliance. Then the model is trained. Finally, the final compliance detection rules can be extracted from the path of the root node and leaf node of the decision tree to generate the corresponding compliance detection tasks. The server can also regularly collect new data to update the decision tree rule analysis model to continuously optimize the compliance detection rules.

[0104] Next is the distributed automatic detection module. The server divides the compliance detection task of the target data into multiple sub-detection tasks. According to the execution priority of each sub-detection task, the optimal task execution node is matched for each sub-detection task, and the sub-detection task is sent to the message queue. Each task execution node reads the corresponding sub-detection task from the message queue, executes each sub-detection task in parallel, and obtains the sub-detection result of each sub-detection task. Fig.10 Finally, the compliance test results of the target data can be obtained by summarizing the results of each sub-test.

[0105] The last one is the data optimization module. Fig.11 As shown in the figure, the server predefines the optimization template. When the compliance detection result of the target data includes the anomaly detection result, the server matches the anomaly detection result with the optimization operation to obtain the target optimization operation that matches the anomaly detection result. The target optimization operation is added to the optimization template to obtain the optimization task. By executing the optimization task, the data optimization of the target data is realized, and the optimization results are collected to update the optimization template.

[0106] In this embodiment, the server responds to the security detection instruction for the target data initiated by the terminal, and first analyzes the detection rules of the target data through the rule analysis model to obtain the compliance detection rules of the target data. Then the compliance detection task corresponding to the compliance detection rule is divided into multiple sub-detection tasks, so that each sub-detection task is executed according to the execution priority of each sub-detection task to obtain each sub-detection result. Finally, the compliance detection result of the target data is obtained by summarizing the sub-detection results. Compared with the manual detection method, it is undoubtedly more efficient to generate compliance detection rules by rule analysis models, and it can also reduce the interference of human factors, making the compliance detection rules more objective and reliable, thereby improving the efficiency and accuracy of the entire data compliance detection. In addition, this embodiment also introduces a distributed execution task mode to further effectively improve the efficiency of data compliance detection.

[0107] It should be understood that, although the various steps in the flowcharts involved in the above-mentioned embodiments are displayed in sequence according to the indication of the arrows, these steps are not necessarily executed in sequence according to the order indicated by the arrows. Unless there is a clear explanation in this article, the execution of these steps does not have a strict order restriction, and these steps can be executed in other orders. Moreover, at least a part of the steps in the flowcharts involved in the above-mentioned embodiments can include multiple steps or multiple stages, and these steps or stages are not necessarily executed at the same time, but can be executed at different times, and the execution order of these steps or stages is not necessarily to be carried out in sequence, but can be executed in turn or alternately with other steps or at least a part of the steps or stages in other steps.

[0108] Based on the same inventive concept, the embodiment of the present application also provides a data security detection device for implementing the data security detection method involved above. The implementation scheme for solving the problem provided by the device is similar to the implementation scheme recorded in the above method, so the specific limitations in one or more data security detection device embodiments provided below can refer to the limitations on the data security detection method above, and will not be repeated here.

[0109] In an exemplary embodiment, Fig.12 As shown, a data security detection device is provided, including: a detection rule generation module 1202, which is used to respond to a security detection instruction for target data, perform detection rule analysis on the target data through a rule analysis model, and obtain the security detection rule of the target data; a detection task division module 1204, which is used to determine the security detection task of the target data based on the security detection rule, and divide the security detection task into multiple sub-detection tasks; a task execution module 1206, which is used to execute each sub-detection task according to the execution priority of each sub-detection task, and obtain the sub-detection result of each sub-detection task; a task aggregation module 1208, which is used to aggregate the sub-detection results to obtain the security detection result of the target data.

[0110] In one of the embodiments, the device is also used to: collect data for each target object through a data collection component deployed in each target object to obtain the original data of each target object; based on a hash algorithm, remove duplicate data from each original data to obtain intermediate data; supplement missing values ​​in the intermediate data to obtain target data.

[0111] In one of the embodiments, the device is also used to: supplement missing values ​​of intermediate data to obtain complete data; format the complete data to obtain target data; the formatting process includes at least one of data timestamp formatting, value formatting, and string formatting.

[0112] In one embodiment, the task execution module 1206 is also used to: send each sub-detection task to a task execution node that matches the execution priority according to the execution priority of each sub-detection task; execute each sub-detection task through each task execution node to obtain the sub-detection result of each sub-detection task.

[0113] In one of the embodiments, the device is also used to: when the security detection results of the target data include abnormal detection results, perform optimization operation matching on the abnormal detection results to obtain a target optimization operation that matches the abnormal detection results; add the target optimization operation to an optimization template to obtain an optimization task; and perform data optimization on the target data based on the optimization task.

[0114] In one embodiment, the detection rule generation module 1202 is also used to: extract features of the target data through a rule analysis model to obtain multiple target features of the target data; perform gain analysis on each target feature to obtain the information gain of each target feature; and perform detection rule analysis on the target data based on each information gain to obtain security detection rules for the target data.

[0115] Each module in the above-mentioned data security detection device can be implemented in whole or in part by software, hardware and their combination. Each module can be embedded in or independent of the processor in the computer device in the form of hardware, or can be stored in the memory in the computer device in the form of software, so that the processor can call and execute the operations corresponding to each module above.

[0116] In an exemplary embodiment, a computer device is provided. The computer device may be a server, and its internal structure diagram may be as shown in FIG. Fig.13 As shown. The computer device includes a processor, a memory, an input / output interface (Input / Output, referred to as I / O) and a communication interface. The processor, the memory and the input / output interface are connected through a system bus, and the communication interface is connected to the system bus through the input / output interface. The processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program and a database. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The database of the computer device is used to store data security detection data. The input / output interface of the computer device is used to exchange information between the processor and an external device. The communication interface of the computer device is used to communicate with an external terminal through a network connection. When the computer program is executed by the processor, a data security detection method is implemented.

[0117] Those skilled in the art will understand that Fig.13 The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0118] In an exemplary embodiment, a computer device is provided, including a memory and a processor, wherein a computer program is stored in the memory, and the processor implements the following steps when executing the computer program: in response to a security detection instruction for target data, performing detection rule analysis on the target data through a rule analysis model to obtain security detection rules for the target data; determining a security detection task for the target data based on the security detection rule, and dividing the security detection task into multiple sub-detection tasks; executing each sub-detection task according to the execution priority of each sub-detection task to obtain a sub-detection result of each sub-detection task; and summarizing the sub-detection results to obtain a security detection result for the target data.

[0119] In one embodiment, when the processor executes the computer program, the following steps are also implemented: data is collected for each target object through the data collection components deployed in each target object to obtain the original data of each target object; based on the hash algorithm, duplicate data is eliminated from each original data to obtain intermediate data; missing values ​​are supplemented for the intermediate data to obtain target data.

[0120] In one embodiment, when the processor executes the computer program, the following steps are also implemented: supplementing the missing values ​​of the intermediate data to obtain complete data; formatting the complete data to obtain target data; the formatting processing includes at least one of data timestamp formatting, value formatting, and string formatting.

[0121] In one embodiment, when the processor executes the computer program, the following steps are also implemented: according to the execution priority of each sub-detection task, each sub-detection task is sent to a task execution node that matches the execution priority; each sub-detection task is executed through each task execution node to obtain a sub-detection result for each sub-detection task.

[0122] In one embodiment, when the processor executes the computer program, the following steps are also implemented: when the security detection results of the target data include abnormal detection results, the abnormal detection results are matched with optimization operations to obtain target optimization operations that match the abnormal detection results; the target optimization operations are added to the optimization template to obtain optimization tasks; and based on the optimization tasks, data optimization is performed on the target data.

[0123] In one embodiment, when the processor executes the computer program, the following steps are also implemented: through the rule analysis model, feature extraction is performed on the target data to obtain multiple target features of the target data; gain analysis is performed on each target feature to obtain the information gain of each target feature; based on each information gain, detection rule analysis is performed on the target data to obtain security detection rules for the target data.

[0124] In one embodiment, a computer-readable storage medium is provided, on which a computer program is stored, and when the computer program is executed by a processor, the following steps are implemented: in response to a security detection instruction for target data, a detection rule analysis is performed on the target data through a rule analysis model to obtain a security detection rule for the target data; a security detection task for the target data is determined based on the security detection rule, and the security detection task is divided into a plurality of sub-detection tasks; each sub-detection task is executed according to the execution priority of each sub-detection task to obtain a sub-detection result of each sub-detection task; and each sub-detection result is summarized to obtain a security detection result for the target data.

[0125] In one embodiment, when the computer program is executed by the processor, the following steps are also implemented: data is collected for each target object through the data collection components deployed in each target object to obtain the original data of each target object; based on the hash algorithm, duplicate data is eliminated from each original data to obtain intermediate data; missing values ​​are supplemented for the intermediate data to obtain target data.

[0126] In one embodiment, when the computer program is executed by the processor, the following steps are also implemented: supplementing the missing values ​​of the intermediate data to obtain complete data; formatting the complete data to obtain target data; the formatting processing includes at least one of data timestamp formatting, value formatting, and string formatting.

[0127] In one embodiment, when the computer program is executed by the processor, the following steps are also implemented: according to the execution priority of each sub-detection task, each sub-detection task is sent to a task execution node that matches the execution priority; each sub-detection task is executed through each task execution node to obtain a sub-detection result for each sub-detection task.

[0128] In one embodiment, when the computer program is executed by the processor, the following steps are also implemented: when the security detection results of the target data include abnormal detection results, the abnormal detection results are matched with optimization operations to obtain target optimization operations that match the abnormal detection results; the target optimization operations are added to the optimization template to obtain optimization tasks; and based on the optimization tasks, data optimization is performed on the target data.

[0129] In one embodiment, when the computer program is executed by the processor, the following steps are also implemented: extracting features of the target data through a rule analysis model to obtain multiple target features of the target data; performing gain analysis on each target feature to obtain the information gain of each target feature; and performing detection rule analysis on the target data based on each information gain to obtain security detection rules for the target data.

[0130] In one embodiment, a computer program product is provided, including a computer program, which implements the following steps when executed by a processor: in response to a security detection instruction for target data, performing detection rule analysis on the target data through a rule analysis model to obtain security detection rules for the target data; determining a security detection task for the target data based on the security detection rules, and dividing the security detection task into multiple sub-detection tasks; executing each sub-detection task according to the execution priority of each sub-detection task to obtain a sub-detection result of each sub-detection task; and summarizing the sub-detection results to obtain a security detection result for the target data.

[0131] In one embodiment, when the computer program is executed by the processor, the following steps are also implemented: data is collected for each target object through the data collection components deployed in each target object to obtain the original data of each target object; based on the hash algorithm, duplicate data is eliminated from each original data to obtain intermediate data; missing values ​​are supplemented for the intermediate data to obtain target data.

[0132] In one embodiment, when the computer program is executed by the processor, the following steps are also implemented: supplementing the missing values ​​of the intermediate data to obtain complete data; formatting the complete data to obtain target data; the formatting processing includes at least one of data timestamp formatting, value formatting, and string formatting.

[0133] In one embodiment, when the computer program is executed by the processor, the following steps are also implemented: according to the execution priority of each sub-detection task, each sub-detection task is sent to a task execution node that matches the execution priority; each sub-detection task is executed through each task execution node to obtain a sub-detection result for each sub-detection task.

[0134] In one embodiment, when the computer program is executed by the processor, the following steps are also implemented: when the security detection results of the target data include abnormal detection results, the abnormal detection results are matched with optimization operations to obtain target optimization operations that match the abnormal detection results; the target optimization operations are added to the optimization template to obtain optimization tasks; and based on the optimization tasks, data optimization is performed on the target data.

[0135] In one embodiment, when the computer program is executed by the processor, the following steps are also implemented: extracting features of the target data through a rule analysis model to obtain multiple target features of the target data; performing gain analysis on each target feature to obtain the information gain of each target feature; and performing detection rule analysis on the target data based on each information gain to obtain security detection rules for the target data.

[0136] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with relevant regulations.

[0137] A person of ordinary skill in the art can understand that all or part of the processes in the above-mentioned embodiment method can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to the memory, database or other medium used in the embodiments provided in the present application can include at least one of non-volatile memory and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. As an illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM). The database involved in each embodiment provided in this application may include at least one of a relational database and a non-relational database. Non-relational databases may include distributed databases based on blockchains, etc., but are not limited to this. The processor involved in each embodiment provided in this application may be a general-purpose processor, a central processing unit, a graphics processor, a digital signal processor, a programmable logic device, a data processing logic device based on quantum computing, an artificial intelligence (AI) processor, etc., but are not limited to this.

[0138] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this application.

[0139] The above-described embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the present application. It should be pointed out that, for a person of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the present application shall be subject to the attached claims.

Claims

1. A data security detection method, characterized in that: The method comprises: In response to a security detection instruction for target data, performing detection rule analysis on the target data through a rule analysis model to obtain a security detection rule for the target data; Determine a security detection task for the target data based on the security detection rule, and divide the security detection task into a plurality of sub-detection tasks; Execute each of the sub-detection tasks according to their respective execution priorities, and obtain respective sub-detection results of each of the sub-detection tasks; The sub-detection results are summarized to obtain the security detection result of the target data.

2. The method according to claim 1, characterized in that The method further comprises: Collecting data from each target object through a data collection component deployed in each target object to obtain original data of each target object; Based on the hash algorithm, duplicate data is removed from each of the original data to obtain intermediate data; The intermediate data are supplemented with missing values ​​to obtain target data.

3. The method according to claim 2, characterized in that The step of supplementing the missing values ​​of the intermediate data to obtain target data includes: Supplementing missing values ​​of the intermediate data to obtain complete data; The complete data is formatted to obtain target data; the formatting includes at least one of data timestamp formatting, value formatting, and character string formatting.

4. The method according to claim 1, characterized in that: The executing each of the sub-detection tasks according to the respective execution priority of each of the sub-detection tasks to obtain the respective sub-detection results of each of the sub-detection tasks includes: According to the respective execution priority of each of the sub-detection tasks, sending each of the sub-detection tasks to a task execution node that matches the execution priority; Each of the sub-detection tasks is executed through each of the task execution nodes to obtain a sub-detection result of each of the sub-detection tasks.

5. The method according to claim 1, characterized in that The method further comprises: When the security detection result of the target data includes an abnormality detection result, performing optimization operation matching on the abnormality detection result to obtain a target optimization operation matching the abnormality detection result; Adding the target optimization operation to the optimization template to obtain an optimization task; Based on the optimization task, data optimization is performed on the target data.

6. The method according to claim 1, characterized in that The detection rule analysis is performed on the target data through the rule analysis model to obtain the security detection rule of the target data, including: Extracting features of the target data through a rule analysis model to obtain multiple target features of the target data; Performing gain analysis on each of the target features respectively to obtain the information gain of each of the target features; Based on each of the information gains, detection rule analysis is performed on the target data to obtain security detection rules for the target data.

7. A data security detection device, characterized in that: The device comprises: A detection rule generation module, for responding to a security detection instruction for target data, performing detection rule analysis on the target data through a rule analysis model to obtain a security detection rule for the target data; A detection task division module, used to determine the security detection task of the target data based on the security detection rule, and divide the security detection task into a plurality of sub-detection tasks; A task execution module, used to execute each of the sub-detection tasks according to the execution priority of each of the sub-detection tasks, and obtain the sub-detection result of each of the sub-detection tasks; The task summary module is used to summarize the sub-detection results to obtain the security detection results of the target data.

8. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 6 are implemented.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

10. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

Images