Method and device for detecting access data leakage and computer equipment

Abstract

The invention relates to an access data leakage detection method and device and computer equipment. The method comprises the following steps: acquiring each piece of current access information input into a cloud platform, and extracting semantic feature information of each piece of current access information; identifying time sequence feature information of each piece of current access information, and matching a weight value corresponding to each piece of time sequence feature information; based on each piece of time sequence feature information and the corresponding weight value, predicting leakage risk information of each piece of current access information, and collecting access behavior data of the current access information corresponding to the leakage risk information greater than a leakage risk threshold value; and based on the access behavior data, through an anomaly detection model, identifying an anomaly detection score corresponding to each piece of access behavior data, and based on the anomaly detection score of each piece of access behavior data and each piece of access behavior data, performing attack protection processing on each piece of access behavior data. By adopting the method, the detection accuracy of data leakage can be improved.

Description

Technical Field

[0001] The present application relates to the field of application security technology, and in particular to a method, device and computer equipment for detecting access data leakage. Background Art

[0002] With the rapid development of cloud computing, more and more enterprises have migrated their business systems and important data to cloud platforms. Cloud computing provides a flexible, agile and efficient IT resource usage model, helping enterprises to significantly reduce IT costs and improve business response speed. However, the cloud environment also brings new security challenges, especially the risk of data leakage faced by core enterprise data in the cloud. Therefore, how to improve the accuracy of data leakage detection is the current research focus.

[0003] Traditional technology detects data leaks through data security protection measures based on rules and signatures, but the rule base requires continuous maintenance and updates by security managers, and new attack methods cannot be discovered in a timely manner.

[0004] The existing attack detection method for Web applications is to conduct all-round detection of server-side attacks through detection based on rule engines, semantic analysis, and machine learning detection engines. However, in the case of web attack detection in a high-concurrency and low-latency environment, the above technical solutions put a lot of pressure on the performance of the server, and due to the small amount of front-end data, the algorithm migration cost is high, which makes the efficiency of web attack detection in a high-concurrency and low-latency environment low. At the same time, these methods usually require a lot of manual intervention and are difficult to adapt to the characteristics of the rapid changes in the cloud environment. As a result, the detection accuracy of data leakage is low. Summary of the invention

[0005] Based on this, it is necessary to provide a method, apparatus, computer device, computer-readable storage medium and computer program product for detecting access data leakage in response to the above technical problems.

[0006] In a first aspect, the present application provides a method for detecting access data leakage, comprising:

[0007] Acquire each current access information input into the cloud platform, and extract semantic feature information of each current access information through a semantic feature extraction model;

[0008] Based on each of the semantic feature information, the temporal feature information of each of the currently accessed information is identified through a sequence modeling model, and based on an attention mechanism strategy, each of the temporal feature information is weighted and processed to obtain a weight value corresponding to each of the temporal feature information;

[0009] Based on the weight value corresponding to each of the time series feature information and each of the time series feature information, the leakage risk information of the current access information corresponding to each of the time series feature information is predicted through a classification neural network, and the access behavior data of the current access information corresponding to the leakage risk information greater than the leakage risk threshold is collected;

[0010] Based on each of the access behavior data, an anomaly detection score corresponding to each access behavior data is identified through an anomaly detection model, and based on the anomaly detection score of each access behavior data and each access behavior data, attack protection processing is performed on each of the access behavior data.

[0011] Optionally, extracting semantic feature information of each currently accessed information by using a semantic feature extraction model includes:

[0012] For each current access information, extracting each semantic feature vector of the current access information through a semantic feature extraction model;

[0013] Each of the semantic feature vectors is used as the semantic feature information of the current access information.

[0014] Optionally, the identifying the temporal feature information of each current access information through a sequence modeling model based on each semantic feature information includes:

[0015] For each current access information, based on the position information of each semantic feature vector of the current access information in the current access information, identifying the sequence information between the semantic feature vectors;

[0016] Based on the sequence information between the semantic feature vectors, the temporal correlation features between the semantic feature vectors are identified through a sequence modeling model, and the temporal correlation features are used as the temporal feature information of the current access information.

[0017] Optionally, the attention mechanism-based strategy performs weight matching processing on each time series feature information to obtain a weight value corresponding to each time series feature information, including:

[0018] Based on the location information corresponding to each semantic feature vector and each semantic feature vector, the leakage risk weight value of each semantic feature vector is identified through the attention mechanism strategy;

[0019] Based on the semantic feature vector corresponding to each time series correlation feature and the leakage risk weight value of each semantic feature vector, the feature weight value of each time series correlation feature is identified, and the feature weight values ​​of all time series correlation features are used as the weight values ​​corresponding to the time series feature information.

[0020] Optionally, the predicting the leakage risk information of the current access information corresponding to each of the time series feature information through a classification neural network based on the weight value corresponding to each of the time series feature information and each of the time series feature information includes:

[0021] For each time series feature information, identify the data information corresponding to each semantic feature vector of each time series associated feature;

[0022] Through the weight value corresponding to each time series correlation feature and the data information corresponding to each time series correlation feature, the leakage risk value corresponding to each data information is identified through a classification neural network, and the leakage risk values ​​corresponding to all data information are used as the leakage risk information of the current access information corresponding to the timing feature information.

[0023] Optionally, based on each of the access behavior data, identifying an anomaly detection score corresponding to each of the access behavior data through an anomaly detection model, and performing attack protection processing on each of the access behavior data based on the anomaly detection score of each of the access behavior data and each of the access behavior data, including:

[0024] For each current access information, based on each access behavior data of the current access information and the leakage risk information of the current access information, an anomaly detection model is used to identify an anomaly detection score corresponding to each access behavior data;

[0025] Filtering access behavior data corresponding to anomaly detection scores greater than anomaly detection score threshold values ​​as abnormal access behavior data of the current access information, and identifying a behavior type corresponding to each abnormal access behavior data;

[0026] Based on the behavior type corresponding to each abnormal access behavior data, the protection strategy corresponding to each abnormal access behavior data is queried in the protection database, and based on the protection strategy corresponding to each abnormal access behavior data, attack protection processing is performed on each abnormal access behavior data.

[0027] In a second aspect, the present application also provides a device for detecting access data leakage, including:

[0028] An acquisition module, used to acquire each current access information input into the cloud platform, and extract semantic feature information of each current access information through a semantic feature extraction model;

[0029] An identification module is used to identify the temporal feature information of each currently accessed information through a sequence modeling model based on each of the semantic feature information, and to perform weight matching processing on each temporal feature information based on an attention mechanism strategy to obtain a weight value corresponding to each temporal feature information;

[0030] A prediction module, for predicting the leakage risk information of the current access information corresponding to each of the time series feature information through a classification neural network based on the weight value corresponding to each of the time series feature information and each of the time series feature information, and collecting access behavior data of the current access information corresponding to the leakage risk information greater than the leakage risk threshold;

[0031] The protection module is used to identify the anomaly detection score corresponding to each access behavior data through an anomaly detection model based on each access behavior data, and perform attack protection processing on each access behavior data based on the anomaly detection score of each access behavior data and each access behavior data.

[0032] Optionally, the acquisition module is specifically used to:

[0033] For each current access information, extracting each semantic feature vector of the current access information through a semantic feature extraction model;

[0034] Each of the semantic feature vectors is used as the semantic feature information of the current access information.

[0035] Optionally, the identification module is specifically used to:

[0036] For each current access information, based on the position information of each semantic feature vector of the current access information in the current access information, identifying the sequence information between the semantic feature vectors;

[0037] Based on the sequence information between the semantic feature vectors, the temporal correlation features between the semantic feature vectors are identified through a sequence modeling model, and the temporal correlation features are used as the temporal feature information of the current access information.

[0038] Optionally, the identification module is specifically used to:

[0039] Based on the location information corresponding to each semantic feature vector and each semantic feature vector, the leakage risk weight value of each semantic feature vector is identified through the attention mechanism strategy;

[0040] Based on the semantic feature vector corresponding to each time series correlation feature and the leakage risk weight value of each semantic feature vector, the feature weight value of each time series correlation feature is identified, and the feature weight values ​​of all time series correlation features are used as the weight values ​​corresponding to the time series feature information.

[0041] Optionally, the prediction module is specifically used to:

[0042] For each time series feature information, identify the data information corresponding to each semantic feature vector of each time series associated feature;

[0043] Through the weight value corresponding to each time series correlation feature and the data information corresponding to each time series correlation feature, the leakage risk value corresponding to each data information is identified through a classification neural network, and the leakage risk values ​​corresponding to all data information are used as the leakage risk information of the current access information corresponding to the timing feature information.

[0044] Optionally, the protection module is specifically used to:

[0045] For each current access information, based on each access behavior data of the current access information and the leakage risk information of the current access information, an anomaly detection model is used to identify an anomaly detection score corresponding to each access behavior data;

[0046] Filtering access behavior data corresponding to anomaly detection scores greater than anomaly detection score threshold values ​​as abnormal access behavior data of the current access information, and identifying a behavior type corresponding to each abnormal access behavior data;

[0047] Based on the behavior type corresponding to each abnormal access behavior data, the protection strategy corresponding to each abnormal access behavior data is queried in the protection database, and based on the protection strategy corresponding to each abnormal access behavior data, attack protection processing is performed on each abnormal access behavior data.

[0048] In a third aspect, the present application provides a computer device, wherein the computer device comprises a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, the steps of any one of the methods in the first aspect are implemented.

[0049] In a fourth aspect, the present application provides a computer-readable storage medium having a computer program stored thereon, wherein when the computer program is executed by a processor, the steps of any one of the methods in the first aspect are implemented.

[0050] In a fifth aspect, the present application provides a computer program product. The computer program product includes a computer program, and when the computer program is executed by a processor, the steps of any one of the methods in the first aspect are implemented.

[0051] The above-mentioned detection method, device and computer equipment for access data leakage obtain each current access information input into the cloud platform, and extract the semantic feature information of each current access information through a semantic feature extraction model; based on each semantic feature information, identify the temporal feature information of each current access information through a sequence modeling model, and perform weight matching processing on each temporal feature information based on an attention mechanism strategy to obtain a weight value corresponding to each temporal feature information; based on the weight value corresponding to each temporal feature information and each temporal feature information, predict the leakage risk information of the current access information corresponding to each temporal feature information through a classification neural network, and collect the access behavior data of the current access information corresponding to the leakage risk information greater than the leakage risk threshold; based on each access behavior data, identify the anomaly detection score corresponding to each access behavior data through an anomaly detection model, and perform attack protection processing on each access behavior data based on the anomaly detection score of each access behavior data and each access behavior data. This solution analyzes the leakage risk of each access information by performing semantic feature and temporal feature recognition on each access information and performing weight matching, thereby improving the comprehensiveness and accuracy of the leakage risk identification of each access information. Then, through the leakage risk of each access information, the anomaly detection score is identified through the anomaly detection model, so as to protect the abnormal behavior data with anomalies in each access information, and improve the accuracy and efficiency of anomaly protection. In addition, this solution improves the protection level of personal privacy data of cloud users, reduces the probability of data leakage incidents, and protects the privacy rights of users. Thus, the accuracy of data leakage detection is comprehensively improved. BRIEF DESCRIPTION OF THE DRAWINGS

[0052] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the related technologies, the drawings required for use in the embodiments or the related technical descriptions are briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0053] Figure 1 A flowchart of a method for detecting access data leakage in one embodiment;

[0054] Figure 2 A flowchart of an example of detecting access data leakage in one embodiment;

[0055] Figure 3 is a structural block diagram of a detection device for access data leakage in one embodiment;

[0056] Figure 4 FIG. 4 is a diagram showing the internal structure of a computer device in one embodiment. DETAILED DESCRIPTION

[0057] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0058] The access data leakage detection method provided in the embodiment of the present application can be applied to the application environment of the access data leakage detection. Among them, the method can be applied to the terminal, can also be applied to the server, can also be applied to the system including the terminal and the server, and is realized through the interaction between the terminal and the server. Among them, the terminal can be, but not limited to, various personal computers, laptops, medium-sized computers, etc. Among them, the terminal analyzes the leakage risk of each access information by identifying the semantic features and temporal features of each access information, and performs weight matching, thereby improving the comprehensiveness and accuracy of the leakage risk identification of each access information. Then, through the leakage risk of each access information, the anomaly detection score is identified through the anomaly detection model, so that the abnormal behavior data with abnormalities in each access information is protected and processed, thereby improving the accuracy and efficiency of the anomaly protection. In addition, this solution improves the protection level of the personal privacy data of cloud users, reduces the probability of data leakage incidents, and protects the privacy rights of users. Thereby comprehensively improving the accuracy of data leakage detection.

[0059] In an exemplary embodiment, Figure 1 As shown, a method for detecting access data leakage is provided, which is described by taking the method applied to a terminal as an example, and includes the following steps S101 to S10,4. Among them:

[0060] Step S101, obtaining each current access information input into the cloud platform, and extracting the semantic feature information of each current access information through a semantic feature extraction model.

[0061] In this embodiment, the terminal responds to the access data of each client uploaded to the cloud platform, and obtains each access information input to the cloud platform, wherein the access information includes access request data and access behavior data. The access behavior data is the operation data of various operation behaviors performed by the user after connecting to the cloud platform. After obtaining each access information, the terminal performs text preprocessing on each access information to obtain the current access information. Among them, the text preprocessing method is to perform preprocessing operations such as word segmentation, stop word removal, and normalization on the input text data. Finally, the terminal extracts the semantic feature information of each current access information through a semantic feature extraction model. Among them, the semantic feature extraction model is a pre-trained BERT model. The specific extraction process will be described in detail later.

[0062] Step S102, based on each semantic feature information, through the sequence modeling model, identify the temporal feature information of each currently accessed information, and based on the attention mechanism strategy, perform weight matching processing on each temporal feature information to obtain the weight value corresponding to each temporal feature information.

[0063] In this embodiment, the terminal identifies the temporal feature information of each currently accessed information through a sequence modeling model based on each semantic feature information, and performs weight matching processing on each temporal feature information based on the attention mechanism strategy to obtain the weight value corresponding to each temporal feature information. Among them, the sequence modeling model is a BiLSTM sequence modeling model. The sequence modeling model can construct a bidirectional LSTM network, set appropriate hyperparameters, such as the number of hidden layer units, dropout ratio, etc., and take BERT features as input. BiLSTM can learn the temporal features of the previous and next associations in the text, and provide more effective feature representation for subsequent classification tasks. The LSTM network can learn the normal mode of these behavior sequences, and monitor new user behaviors in real time to find abnormal situations. Specifically, the workflow of the LSTM network is as follows: the input layer takes BERT features as input. The LSTM unit includes memory cell, input gate, forget gate and output gate, which can effectively control the inflow, outflow and forgetting of information, and capture long-term and short-term dependencies in time series data. The output of the LSTM network is the abnormal probability score of the user behavior sequence, which reflects the degree of deviation of the current user behavior from the normal mode. The specific recognition process will be described in detail later. Among them, BERT (Bidirectional Encoder Representations from Transformers): a language representation model based on Transformer, good at capturing the bidirectional contextual semantic information of text. BiLSTM (Bidirectional Long Short-Term Memory): a bidirectional recurrent neural network that can simultaneously learn the forward and backward dependencies of text.

[0064] Step S103, based on the weight value corresponding to each time series feature information and each time series feature information, the leakage risk information of the current access information corresponding to each time series feature information is predicted through a classification neural network, and the access behavior data of the current access information corresponding to the leakage risk information greater than the leakage risk threshold is collected.

[0065] In this embodiment, the terminal predicts the leakage risk information of the current access information corresponding to each time series feature information through a classification neural network based on the weight value corresponding to each time series feature information and each time series feature information, and collects the access behavior data of the current access information corresponding to the leakage risk information greater than the leakage risk threshold. The classification neural network is a fully connected neural network, and the prediction method is to perform binary classification processing on each access behavior data, wherein the output of the network is 0 or 1, respectively indicating that the text does not exist or has a leakage risk.

[0066] Step S104, based on each access behavior data, an anomaly detection model is used to identify an anomaly detection score corresponding to each access behavior data, and based on the anomaly detection score of each access behavior data and each access behavior data, attack protection processing is performed on each access behavior data.

[0067] In this embodiment, the terminal identifies the anomaly detection score corresponding to each access behavior data through an anomaly detection model based on each access behavior data, and performs attack protection processing on each access behavior data based on the anomaly detection score of each access behavior data and each access behavior data. Among them, the anomaly detection model is a trained deep learning model, and the specific score recognition process will be described in detail later.

[0068] Based on the above scheme, by identifying the semantic features and temporal features of each access information and performing weight matching, the leakage risk of each access information is analyzed, thereby improving the comprehensiveness and accuracy of the leakage risk identification of each access information. Then, through the leakage risk of each access information, the anomaly detection score is identified through the anomaly detection model, so that the abnormal behavior data with anomalies in each access information is protected and processed, improving the accuracy and efficiency of anomaly protection. In addition, this scheme improves the protection level of personal privacy data of cloud users, reduces the probability of data leakage incidents, and protects the privacy rights of users. Thereby comprehensively improving the accuracy of data leakage detection.

[0069] Optionally, semantic feature information of each current access information is extracted through a semantic feature extraction model, including: for each current access information, extracting each semantic feature vector of the current access information through a semantic feature extraction model; and using each semantic feature vector as the semantic feature information of the current access information.

[0070] In this embodiment, the terminal extracts each semantic feature vector of the current access information through a semantic feature extraction model for each current access information. Each semantic feature vector is used as the semantic feature information of the current access information. Specifically, the terminal uses a pre-trained BERT-base model to encode the pre-processed text into a 512-dimensional vector representation. These semantic features contain context information in the current access information.

[0071] Based on the above scheme, semantic feature extraction is used to extract semantic feature vectors corresponding to context information in the access information, thereby improving the comprehensiveness of the recognition of context information of the current text information.

[0072] Optionally, based on each semantic feature information, a sequence modeling model is used to identify the timing feature information of each current access information, including: for each current access information, based on the position information of each semantic feature vector in the current access information, identifying the sequence information between each semantic feature vector; based on the sequence information between each semantic feature vector, a sequence modeling model is used to identify the timing association features between each semantic feature vector, and use each timing association feature as the timing feature information of the current access information.

[0073] In this embodiment, the terminal identifies the sequence information between the semantic feature vectors for each current access information based on the position information of the semantic feature vectors in the current access information, wherein the sequence information is the context ordering relationship between the semantic feature vectors.

[0074] Then, based on the sequence information between the semantic feature vectors, the terminal uses the sequence modeling model to identify the temporal correlation features between the semantic feature vectors, and uses each temporal correlation feature as the temporal feature information of the currently accessed information. Specifically, the terminal inputs the feature vector output by BERT into the BiLSTM network, which can learn the forward and backward dependencies of the text and obtain richer temporal features.

[0075] Based on the above solution, by sorting first and then identifying the time series correlation features, the comprehensiveness and accuracy of the identification of time series correlation features are improved.

[0076] Optionally, based on the attention mechanism strategy, each time series feature information is weighted and processed to obtain the weight value corresponding to each time series feature information, including: based on the position information corresponding to each semantic feature vector and each semantic feature vector, identifying the leakage risk weight value of each semantic feature vector through the attention mechanism strategy; based on the semantic feature vector corresponding to each time series association feature and the leakage risk weight value of each semantic feature vector, identifying the feature weight value of each time series association feature, and using the feature weight values ​​of all time series association features as the weight value corresponding to the time series feature information.

[0077] In this embodiment, the terminal identifies the leakage risk weight value of each semantic feature vector based on the location information corresponding to each semantic feature vector and each semantic feature vector through the attention mechanism strategy. The leakage risk weight value is used to characterize the risk value of the semantic feature vector being easily leaked, wherein the higher the risk weight value, the easier it is to leak the semantic feature vector.

[0078] Then, the terminal identifies the feature weight value of each time-series correlation feature based on the semantic feature vector corresponding to each time-series correlation feature and the leakage risk weight value of each semantic feature vector, and uses the feature weight values ​​of all time-series correlation features as the weight value corresponding to the time-series feature information. Among them, the attention mechanism strategy is a strategy for identifying the weight value based on each semantic feature vector and the position information of the semantic feature vector.

[0079] Based on the above scheme, by applying the attention mechanism condition technology on the output features of BiLSTM, the model's perception of text structure information is enhanced, further improving the accuracy of data leakage prevention detection.

[0080] Optionally, based on the weight values ​​corresponding to each timing feature information and each timing feature information, a classification neural network is used to predict the leakage risk information of the current access information corresponding to each timing feature information, including: for each timing feature information, identifying the data information corresponding to each semantic feature vector of each timing association feature; through the weight values ​​corresponding to each timing association feature and each data information corresponding to each timing association feature, a classification neural network is used to identify the leakage risk value corresponding to each data information, and the leakage risk values ​​corresponding to all data information are used as the leakage risk information of the current access information corresponding to the timing feature information.

[0081] In this embodiment, the terminal identifies data information corresponding to each semantic feature vector of each time series associated feature for each time series feature information, wherein the data information corresponding to each semantic feature vector is the data content of each semantic feature vector in the current access information.

[0082] Then, the terminal uses the weight value corresponding to each time series correlation feature and each data information corresponding to each time series correlation feature, and through the classification neural network, identifies the leakage risk value corresponding to each data information, and averages the leakage risk values ​​corresponding to all data information to obtain the leakage risk information of the current access information corresponding to the time series feature information. Among them, since each leakage risk value is 1 or 0, the terminal averages each data information, and the average value obtained is the proportion of data information with leakage risk values ​​in the current access information.

[0083] Based on the above scheme, each semantic feature vector is split to identify the leakage risk, and then the leakage risk value of the current access information is determined, thereby improving the accuracy of leakage risk identification of the current access information.

[0084] Optionally, based on each access behavior data, an anomaly detection model is used to identify the anomaly detection score corresponding to each access behavior data, and based on the anomaly detection score of each access behavior data and each access behavior data, attack protection processing is performed on each access behavior data, including: for each current access information, based on each access behavior data of the current access information and the leakage risk information of the current access information, an anomaly detection model is used to identify the anomaly detection score corresponding to each access behavior data; access behavior data corresponding to an anomaly detection score greater than an anomaly detection score threshold is screened as abnormal access behavior data of the current access information, and the behavior type corresponding to each abnormal access behavior data is identified; based on the behavior type corresponding to each abnormal access behavior data, the protection strategy corresponding to each abnormal access behavior data is queried in the protection database, and attack protection processing is performed on each abnormal access behavior data based on the protection strategy corresponding to each abnormal access behavior data.

[0085] In this embodiment, the terminal identifies the anomaly detection score corresponding to each access behavior data for each current access information based on the access behavior data of the current access information and the leakage risk information of the current access information through the anomaly detection model. Among them, the anomaly detection model is an LSTM network, which includes a memory cell, an input gate, a forget gate and an output gate, and can effectively control the inflow, outflow and forgetting of information, and capture the long-term and short-term dependencies in the time series data. The output of the LSTM network is the abnormal probability score of the user behavior sequence, which reflects the degree of deviation of the current user behavior from the normal mode.

[0086] Then, the terminal screens the access behavior data corresponding to the anomaly detection score greater than the anomaly detection score threshold as the current access information, the abnormal access behavior data, and identifies the behavior type corresponding to each abnormal access behavior data. Among them, the behavior type characterizes the leakage risk type of the abnormal access behavior data to the data information of the cloud platform, and the behavior type includes but is not limited to injecting virus data, adding data sending scripts, and generating data automatic collection scripts. Afterwards, based on the behavior type corresponding to each abnormal access behavior data, the terminal queries the protection strategy corresponding to each abnormal access behavior data in the protection database, and performs attack protection processing on each abnormal access behavior data based on the protection strategy corresponding to each abnormal access behavior data.

[0087] Based on the above solution, by splitting the behavior types of each abnormal access behavior data, a protection strategy for each abnormal access behavior data is generated, thereby improving the data protection effect of the abnormal access behavior data.

[0088] This application also provides an example of detecting access data leakage, such as Figure 2 As shown, the specific processing process includes the following steps:

[0089] Step S201, obtaining current access information input into the cloud platform.

[0090] Step S202: for each current access information, extract each semantic feature vector of the current access information through a semantic feature extraction model.

[0091] Step S203: taking each semantic feature vector as semantic feature information of the current access information.

[0092] Step S204 : for each current access information, based on the position information of each semantic feature vector of the current access information in the current access information, identify the sequence information between the semantic feature vectors.

[0093] Step S205 , based on the sequence information between the semantic feature vectors, the temporal correlation features between the semantic feature vectors are identified through a sequence modeling model, and each temporal correlation feature is used as the temporal feature information of the current access information.

[0094] Step S206, based on the position information corresponding to each semantic feature vector and each semantic feature vector, the leakage risk weight value of each semantic feature vector is identified through the attention mechanism strategy.

[0095] Step S207, based on the semantic feature vector corresponding to each time series correlation feature and the leakage risk weight value of each semantic feature vector, identify the feature weight value of each time series correlation feature, and use the feature weight values ​​of all time series correlation features as the weight values ​​corresponding to the time series feature information.

[0096] Step S208: for each time series feature information, identify the data information corresponding to each semantic feature vector of each time series associated feature.

[0097] Step S209, through the weight value corresponding to each time series correlation feature and the data information corresponding to each time series correlation feature, the classification neural network is used to identify the leakage risk value corresponding to each data information, and the leakage risk value corresponding to all data information is used as the leakage risk information of the current access information corresponding to the timing feature information.

[0098] Step S210: collecting access behavior data of current access information corresponding to leakage risk information greater than a leakage risk threshold.

[0099] Step S211 , for each current access information, based on each access behavior data of the current access information and the leakage risk information of the current access information, an anomaly detection model is used to identify an anomaly detection score corresponding to each access behavior data.

[0100] Step S212, screening access behavior data corresponding to anomaly detection scores greater than anomaly detection score threshold as abnormal access behavior data of current access information, and identifying the behavior type corresponding to each abnormal access behavior data.

[0101] Step S213, based on the behavior type corresponding to each abnormal access behavior data, query the protection strategy corresponding to each abnormal access behavior data in the protection database, and perform attack protection processing on each abnormal access behavior data based on the protection strategy corresponding to each abnormal access behavior data.

[0102] It should be understood that, although the various steps in the flowcharts involved in the above-mentioned embodiments are displayed in sequence according to the indication of the arrows, these steps are not necessarily executed in sequence according to the order indicated by the arrows. Unless there is a clear explanation in this article, the execution of these steps does not have a strict order restriction, and these steps can be executed in other orders. Moreover, at least a part of the steps in the flowcharts involved in the above-mentioned embodiments can include multiple steps or multiple stages, and these steps or stages are not necessarily executed at the same time, but can be executed at different times, and the execution order of these steps or stages is not necessarily to be carried out in sequence, but can be executed in turn or alternately with other steps or at least a part of the steps or stages in other steps.

[0103] Based on the same inventive concept, the embodiment of the present application also provides an access data leakage detection device for implementing the access data leakage detection method involved above. The implementation scheme for solving the problem provided by the device is similar to the implementation scheme recorded in the above method, so the specific limitations in the one or more access data leakage detection device embodiments provided below can refer to the limitations of the access data leakage detection method above, and will not be repeated here.

[0104] In an exemplary embodiment, Figure 3 As shown, a detection device for access data leakage is provided, including: an acquisition module 310, an identification module 320, a prediction module 330, and a protection module 340, wherein:

[0105] The acquisition module 310 is used to acquire each current access information input into the cloud platform, and extract the semantic feature information of each current access information through a semantic feature extraction model;

[0106] The identification module 320 is used to identify the temporal feature information of each currently accessed information through a sequence modeling model based on each of the semantic feature information, and perform weight matching processing on each temporal feature information based on an attention mechanism strategy to obtain a weight value corresponding to each temporal feature information;

[0107] The prediction module 330 is used to predict the leakage risk information of the current access information corresponding to each of the time series feature information through a classification neural network based on the weight value corresponding to each of the time series feature information and each of the time series feature information, and collect the access behavior data of the current access information corresponding to the leakage risk information greater than the leakage risk threshold;

[0108] The protection module 340 is used to identify the anomaly detection score corresponding to each access behavior data through an anomaly detection model based on each access behavior data, and perform attack protection processing on each access behavior data based on the anomaly detection score of each access behavior data and each access behavior data.

[0109] Optionally, the acquisition module 310 is specifically configured to:

[0110] For each current access information, extracting each semantic feature vector of the current access information through a semantic feature extraction model;

[0111] Each of the semantic feature vectors is used as the semantic feature information of the current access information.

[0112] Optionally, the identification module 320 is specifically configured to:

[0113] For each current access information, based on the position information of each semantic feature vector of the current access information in the current access information, identifying the sequence information between the semantic feature vectors;

[0114] Based on the sequence information between the semantic feature vectors, the temporal correlation features between the semantic feature vectors are identified through a sequence modeling model, and the temporal correlation features are used as the temporal feature information of the current access information.

[0115] Optionally, the identification module 320 is specifically configured to:

[0116] Based on the location information corresponding to each semantic feature vector and each semantic feature vector, the leakage risk weight value of each semantic feature vector is identified through the attention mechanism strategy;

[0117] Based on the semantic feature vector corresponding to each time series correlation feature and the leakage risk weight value of each semantic feature vector, the feature weight value of each time series correlation feature is identified, and the feature weight values ​​of all time series correlation features are used as the weight values ​​corresponding to the time series feature information.

[0118] Optionally, the prediction module 330 is specifically configured to:

[0119] For each time series feature information, identify the data information corresponding to each semantic feature vector of each time series associated feature;

[0120] Through the weight value corresponding to each time series correlation feature and the data information corresponding to each time series correlation feature, the leakage risk value corresponding to each data information is identified through a classification neural network, and the leakage risk values ​​corresponding to all data information are used as the leakage risk information of the current access information corresponding to the timing feature information.

[0121] Optionally, the protection module 340 is specifically used to:

[0122] For each current access information, based on each access behavior data of the current access information and the leakage risk information of the current access information, an anomaly detection model is used to identify an anomaly detection score corresponding to each access behavior data;

[0123] Filtering access behavior data corresponding to anomaly detection scores greater than anomaly detection score threshold values ​​as abnormal access behavior data of the current access information, and identifying a behavior type corresponding to each abnormal access behavior data;

[0124] Based on the behavior type corresponding to each abnormal access behavior data, the protection strategy corresponding to each abnormal access behavior data is queried in the protection database, and based on the protection strategy corresponding to each abnormal access behavior data, attack protection processing is performed on each abnormal access behavior data.

[0125] Each module in the above-mentioned access data leakage detection device can be implemented in whole or in part by software, hardware and their combination. Each of the above-mentioned modules can be embedded in or independent of the processor in the computer device in the form of hardware, or can be stored in the memory of the computer device in the form of software, so that the processor can call and execute the corresponding operations of each of the above modules.

[0126] In an exemplary embodiment, a computer device is provided. The computer device may be a terminal, and its internal structure diagram may be as shown in FIG. Figure 4 As shown. The computer device includes a processor, a memory, an input / output interface, a communication interface, a display unit and an input device. The processor, the memory and the input / output interface are connected through a system bus, and the communication interface, the display unit and the input device are connected to the system bus through the input / output interface. The processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system and a computer program. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The input / output interface of the computer device is used to exchange information between the processor and the external device. The communication interface of the computer device is used to communicate with an external terminal in a wired or wireless manner, and the wireless manner can be realized through WIFI, a mobile cellular network, NFC (near field communication) or other technologies. When the computer program is executed by the processor, a method for detecting access data leakage is implemented. The display unit of the computer device is used to form a visually visible picture, which can be a display screen, a projection device or a virtual reality imaging device. The display screen can be a liquid crystal display screen or an electronic ink display screen, and the input device of the computer device can be a touch layer covering the display screen, or a button, trackball or touchpad set on the computer device shell, or an external keyboard, touchpad or mouse.

[0127] Those skilled in the art will understand that Figure 4 The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0128] In an exemplary embodiment, a computer device is provided, including a memory and a processor, wherein a computer program is stored in the memory, and the processor implements the steps of a method for detecting access data leakage when executing the computer program.

[0129] In one embodiment, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the steps of the method for detecting access data leakage are implemented.

[0130] In one embodiment, a computer program product is provided, comprising a computer program, which implements the steps of a method for detecting access data leakage when executed by a processor.

[0131] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with relevant regulations.

[0132] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to the memory, database or other medium used in the embodiments provided in this application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetoresistive random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. As an illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM). The database involved in each embodiment provided in this application may include at least one of a relational database and a non-relational database. Non-relational databases may include distributed databases based on blockchains, etc., but are not limited to this. The processor involved in each embodiment provided in this application may be a general-purpose processor, a central processing unit, a graphics processor, a digital signal processor, a programmable logic device, a data processing logic device based on quantum computing, etc., but are not limited to this.

[0133] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0134] The above-described embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the present application. It should be pointed out that, for a person of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the present application shall be subject to the attached claims.

Claims

1. A method for detecting access data leakage, characterized in that: The method comprises: Acquire each current access information input into the cloud platform, and extract semantic feature information of each current access information through a semantic feature extraction model; Based on each of the semantic feature information, the temporal feature information of each of the currently accessed information is identified through a sequence modeling model, and based on an attention mechanism strategy, each of the temporal feature information is weighted and processed to obtain a weight value corresponding to each of the temporal feature information; Based on the weight value corresponding to each of the time series feature information and each of the time series feature information, the leakage risk information of the current access information corresponding to each of the time series feature information is predicted through a classification neural network, and the access behavior data of the current access information corresponding to the leakage risk information greater than the leakage risk threshold is collected; Based on each of the access behavior data, an anomaly detection score corresponding to each access behavior data is identified through an anomaly detection model, and based on the anomaly detection score of each access behavior data and each access behavior data, attack protection processing is performed on each of the access behavior data.

2. The method according to claim 1, characterized in that The extracting semantic feature information of each currently accessed information by using a semantic feature extraction model includes: For each current access information, extracting each semantic feature vector of the current access information through a semantic feature extraction model; Each of the semantic feature vectors is used as the semantic feature information of the current access information.

3. The method according to claim 2, characterized in that The identifying the temporal feature information of each current access information through a sequence modeling model based on each of the semantic feature information includes: For each current access information, based on the position information of each semantic feature vector of the current access information in the current access information, identifying the sequence information between the semantic feature vectors; Based on the sequence information between the semantic feature vectors, the temporal correlation features between the semantic feature vectors are identified through a sequence modeling model, and the temporal correlation features are used as the temporal feature information of the current access information.

4. The method according to claim 3, characterized in that The attention mechanism-based strategy performs weight matching processing on each time series feature information to obtain the weight value corresponding to each time series feature information, including: Based on the location information corresponding to each semantic feature vector and each semantic feature vector, the leakage risk weight value of each semantic feature vector is identified through the attention mechanism strategy; Based on the semantic feature vector corresponding to each time series correlation feature and the leakage risk weight value of each semantic feature vector, the feature weight value of each time series correlation feature is identified, and the feature weight values ​​of all time series correlation features are used as the weight values ​​corresponding to the time series feature information.

5. The method according to claim 4, characterized in that The predicting the leakage risk information of the current access information corresponding to each of the time series feature information by using a classification neural network based on the weight value corresponding to each of the time series feature information and each of the time series feature information includes: For each time series feature information, identify the data information corresponding to each semantic feature vector of each time series associated feature; Through the weight value corresponding to each time series correlation feature and the data information corresponding to each time series correlation feature, the leakage risk value corresponding to each data information is identified through a classification neural network, and the leakage risk values ​​corresponding to all data information are used as the leakage risk information of the current access information corresponding to the timing feature information.

6. The method according to claim 5, characterized in that Based on each of the access behavior data, an anomaly detection model is used to identify an anomaly detection score corresponding to each of the access behavior data, and based on the anomaly detection score of each of the access behavior data and each of the access behavior data, attack protection processing is performed on each of the access behavior data, including: For each current access information, based on each access behavior data of the current access information and the leakage risk information of the current access information, an anomaly detection model is used to identify an anomaly detection score corresponding to each access behavior data; Filtering access behavior data corresponding to anomaly detection scores greater than anomaly detection score threshold values ​​as abnormal access behavior data of the current access information, and identifying a behavior type corresponding to each abnormal access behavior data; Based on the behavior type corresponding to each abnormal access behavior data, the protection strategy corresponding to each abnormal access behavior data is queried in the protection database, and based on the protection strategy corresponding to each abnormal access behavior data, attack protection processing is performed on each abnormal access behavior data.

7. A device for detecting access data leakage, characterized in that: The device comprises: An acquisition module, used to acquire each current access information input into the cloud platform, and extract semantic feature information of each current access information through a semantic feature extraction model; An identification module is used to identify the temporal feature information of each currently accessed information through a sequence modeling model based on each of the semantic feature information, and to perform weight matching processing on each temporal feature information based on an attention mechanism strategy to obtain a weight value corresponding to each temporal feature information; A prediction module, for predicting the leakage risk information of the current access information corresponding to each of the time series feature information through a classification neural network based on the weight value corresponding to each of the time series feature information and each of the time series feature information, and collecting access behavior data of the current access information corresponding to the leakage risk information greater than the leakage risk threshold; The protection module is used to identify the anomaly detection score corresponding to each access behavior data through an anomaly detection model based on each access behavior data, and perform attack protection processing on each access behavior data based on the anomaly detection score of each access behavior data and each access behavior data.

8. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 6 are implemented.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

10. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

Images