Chat content alarm method and device, equipment and storage medium

Abstract

The embodiment of the invention provides a chat content alarm method and device, equipment and a storage medium. The chat content alarm method comprises the following steps: monitoring a receiving-transmitting port of a communication tool; if it is monitored that the chat content sending event exists in the receiving and sending port, intercepting a chat window corresponding to the communication tool to obtain a target picture corresponding to the chat window; extracting characters in the target picture to obtain target chat content in the chat window; performing sensitive data identification on the target chat content; and if the sensitive data exists in the target chat content, sending alarm information aiming at the target chat content to a user using the communication tool. According to the embodiment of the invention, the chat content of the instant messaging tool can be effectively monitored in the encrypted environment, and the problem that the chat content cannot be effectively alarmed in the encrypted environment in a traditional auditing scheme is solved; and alarm information can be immediately sent to a user when sensitive data is detected, so that the safety and the response speed are improved.

Description

Technical Field

[0001] The present application relates to the field of data security technology, and in particular to a chat content alarm method and device, an electronic device and a storage medium. Background Art

[0002] With the development of society and the advancement of technology, instant messaging tools such as WeChat, WeChat for Business, and Fetion have become extremely popular social software. It has become the norm for employees to communicate quickly and conveniently through these tools. Team members can easily share documents, pictures and other materials and communicate through text through instant messaging tools. However, this convenience also brings the risk of leakage of work secrets. How to audit the text, files and materials transmitted by instant messaging has become an urgent problem to be solved in the field of data security.

[0003] In the existing auditing scheme of chat content of instant messaging tools, the chat content is stripped from the traffic transmitted by the instant messaging tool by mirroring the traffic from the switch in the form of bypass, and the chat content is identified as sensitive data in the chat content, and the alarm mechanism is executed according to the result of sensitive data identification. However, as enterprises attach importance to transmission security, most new versions of instant messaging tools have adopted transmission link encryption technology, making the traditional auditing scheme of chat content through traffic no longer feasible.

[0004] This change highlights the problem faced in issuing alerts on chat content: due to the encryption of the transmission link, traditional auditing methods cannot effectively obtain and analyze chat content, resulting in the failure of identifying sensitive data, which in turn affects the effectiveness of the alert mechanism. Therefore, how to achieve effective alerts on instant messaging content in an encrypted environment has become a difficult problem that urgently needs to be solved in the current data security field. Summary of the invention

[0005] The embodiment of the present application provides an alarm method for chat content to solve the problem that traditional auditing solutions cannot effectively alarm instant messaging content in an encrypted environment.

[0006] Correspondingly, an embodiment of the present application also provides an alarm device for chat content, an electronic device and a storage medium to ensure the implementation and application of the above method.

[0007] In order to solve the above problem, the embodiment of the present application discloses a chat content alarm method, the method comprising:

[0008] Monitor the sending and receiving ports of communication tools;

[0009] If a chat content sending event is detected in the transceiver port, the chat window corresponding to the communication tool is intercepted to obtain a target image corresponding to the chat window;

[0010] Extracting the text in the target image to obtain the target chat content in the chat window;

[0011] Performing sensitive data identification on the target chat content;

[0012] If sensitive data exists in the target chat content, an alarm message regarding the target chat content is sent to the user of the communication tool.

[0013] Optionally, if a chat content sending event is monitored in the transceiver port, intercepting a chat window corresponding to the communication tool to obtain a target image corresponding to the chat window includes:

[0014] If a chat content sending event is detected in the transceiver port, the chat window is determined;

[0015] If the chat window exists, determining window information corresponding to the chat window; the window information includes position information and size information of the chat window;

[0016] The chat window is captured according to the window information to obtain the target image.

[0017] Optionally, the window information further includes layout information of the chat window, and the extracting text from the target image to obtain target chat content in the chat window includes:

[0018] Dividing the target image into a first area and a second area based on the layout information;

[0019] Extracting the text in the first area to obtain a target chat object in the chat window;

[0020] The text in the second area is extracted to obtain a plurality of target chat contents in the chat window; the chat object corresponding to the target chat content is the target chat object.

[0021] Optionally, the identifying sensitive data of the target chat content includes:

[0022] Determine an initial chat record corresponding to the target chat object;

[0023] Integrate the multiple target chat contents and the initial chat records corresponding to the target chat object to obtain a target chat record corresponding to the target chat object;

[0024] Sensitive data is identified on the target chat record.

[0025] Optionally, the initial chat record corresponding to the target chat object includes multiple initial chat contents, and the multiple target chat contents and the initial chat record corresponding to the target chat object are integrated to obtain the target chat record corresponding to the target chat object, including:

[0026] Comparing the multiple target chat contents with multiple initial chat contents in the initial chat record corresponding to the target chat object, determining newly added chat content; the newly added chat content is the target chat content different from the initial chat content;

[0027] The newly added chat content is added to the initial chat record corresponding to the target chat object to obtain the target chat record corresponding to the target chat object.

[0028] Optionally, the identifying sensitive data on the target chat record includes:

[0029] Preprocessing the newly added chat content in the target chat record corresponding to the target chat object to obtain multiple chat segmentations;

[0030] Match the multiple chat segment words with the multiple sensitive data in the sensitive database to determine whether the chat segment words are the sensitive data.

[0031] Optionally, the monitoring of the transceiver port of the communication tool includes:

[0032] Monitoring the transceiver port of the communication tool to determine whether data transmission exists on the transceiver port;

[0033] If there is data transmission on the transceiver port, it is determined that there is a chat content sending event on the transceiver port.

[0034] The embodiment of the present application also discloses a chat content alarm device, the device comprising:

[0035] A monitoring module, used to monitor the sending and receiving ports of the communication tool;

[0036] An interception module, for intercepting a chat window corresponding to the communication tool and obtaining a target image corresponding to the chat window if a chat content sending event is detected in the transceiver port;

[0037] An extraction module, used to extract the text in the target image to obtain the target chat content in the chat window;

[0038] An identification module, used to identify sensitive data of the target chat content;

[0039] The alarm module is used to send an alarm message for the target chat content to the user of the communication tool if sensitive data exists in the target chat content.

[0040] An embodiment of the present application also discloses an electronic device, including: a processor; and a memory, on which executable code is stored. When the executable code is executed, the processor executes the chat content alarm method as described in any one of the embodiments of the present application.

[0041] The embodiments of the present application also disclose one or more machine-readable media on which executable codes are stored. When the executable codes are executed, the processor executes the chat content alarm method as described in any one of the embodiments of the present application.

[0042] Compared with the prior art, the embodiments of the present application have the following advantages:

[0043] In an embodiment of the present application, the transceiver port of the communication tool is monitored; if a chat content sending event is monitored in the transceiver port, the chat window corresponding to the communication tool is intercepted to obtain the target image corresponding to the chat window; the text in the target image is extracted to obtain the target chat content in the chat window; the target chat content is identified for sensitive data; if sensitive data exists in the target chat content, an alarm message for the target chat content is issued to the user using the communication tool. The embodiment of the present application monitors the transceiver port of the communication tool to determine whether the user using the communication tool has sent a message. At the first time when the user sends a message, the corresponding chat content is obtained by intercepting the picture of the chat window and extracting the text content, so that the chat content of the instant messaging tool can be effectively monitored in an encrypted environment, solving the problem that the traditional auditing scheme cannot effectively warn the chat content in an encrypted environment. By identifying the sensitive data of the chat content, it is also possible to immediately send an alarm message to the user when sensitive data is detected, thereby improving security and response speed. BRIEF DESCRIPTION OF THE DRAWINGS

[0044] Figure 1 This is a flowchart of a chat content alarm method embodiment of the present application;

[0045] Figure 2 It is a logic block diagram of a chat content alarm method of the present application;

[0046] Figure 3 This is a structural block diagram of an embodiment of a chat content alarm device of the present application;

[0047] Figure 4 It is a schematic diagram of the structure of a device provided in one embodiment of the present application. DETAILED DESCRIPTION

[0048] In order to make the above-mentioned objects, features and advantages of the present application more obvious and easy to understand, the present application is further described in detail below in conjunction with the accompanying drawings and specific implementation methods.

[0049] In the embodiment of the present application, the text sending and receiving ports of the instant messaging tool are mainly monitored. After information transmission is monitored in the text sending and receiving ports, a screenshot of the chat window of the instant messaging interface is taken, the content is identified through OCR technology, the chat content is extracted and deduplicated to form a complete chat record, sensitive data is identified based on the chat record, and an alarm is issued for chats where sensitive data appears.

[0050] Reference Figure 1 , is a flowchart of an embodiment of a chat content alarm method of the present application, comprising the following steps:

[0051] Step 101, monitoring the sending and receiving ports of the communication tool;

[0052] A transceiver port (also called a network port) is a logical interface for data transmission in a computer network. Each port has a unique number (usually a number between 1 and 65535) that identifies a specific service or application. When data is transmitted over a network, packets are sent and received through specific ports.

[0053] In the embodiment of the present application, a network filter is installed on the terminal computer, and the transceiver port (text sending and receiving port) of the communication tool (such as instant messaging software, chat application, etc.) is continuously monitored through the monitoring module. The transceiver port is a channel for data transmission. Therefore, monitoring the transceiver port can capture the data transmission activities of the communication tool. By monitoring the transceiver port, it is possible to detect whether the communication tool has a data sending or receiving event.

[0054] Step 102: if a chat content sending event is detected in the transceiver port, the chat window corresponding to the communication tool is intercepted to obtain a target image corresponding to the chat window;

[0055] When a chat content sending event is monitored in the transceiver port of the communication tool, the screenshot module will be immediately notified to capture the chat window of the communication tool. Specifically, the capture method can be a screen shot to obtain a picture of the chat window.

[0056] The screenshot module in the embodiment of the present application can obtain image information of the current chat content by capturing a picture of the chat window, thereby preparing for subsequent text extraction.

[0057] Step 103: extract the text in the target image to obtain the target chat content in the chat window;

[0058] In the embodiment of the present application, the screenshot module sends the captured target image to the text recognition module (OCR module).

[0059] OCR (Optical Character Recognition) technology is a technology that converts text in images into editable and searchable text. Its main features include: high-precision text extraction capabilities, which can accurately extract text content from images, scanned documents or screenshots, and is widely used in document digitization, automated data entry and image search; multi-language support, which can recognize text in multiple languages ​​and is suitable for application scenarios around the world; automated processing, which can efficiently process a large number of documents and improve work efficiency; real-time, which can process text in images in real time, and is suitable for application scenarios that require fast response; and strong adaptability, which can process images of different formats and qualities and has strong adaptability.

[0060] Based on the characteristics of OCR technology, the OCR module in the embodiment of the present application extracts text content from the captured chat window image through OCR technology, and can convert the text in the image into editable and searchable text. By extracting the text in the image, the specific chat content in the chat window can be obtained for subsequent sensitive data identification.

[0061] Step 104: Identify sensitive data of the target chat content;

[0062] After obtaining the target chat content, the OCR module in the embodiment of the present application will send the target chat content to the recognition module so that the recognition and alarm module can identify sensitive data in the extracted chat content.

[0063] Sensitive data identification refers to the detection and identification of sensitive information contained in data through specific technical means and rules. Such sensitive information may include personal identity information (such as ID number, phone number), financial data (such as bank account number, credit card number), confidential information (such as trade secrets, patent information), etc. Sensitive data identification plays a vital role in information security and compliance management.

[0064] The identification and alarm module in the embodiment of the present application will perform sensitive data identification on the target chat content, and then be able to determine whether there are potential security risks or compliance issues in the target chat content.

[0065] Step 105: If sensitive data exists in the target chat content, an alarm message regarding the target chat content is issued to the user of the communication tool.

[0066] The identification and warning module in the embodiment of the present application will immediately send a warning message to the user of the communication tool if sensitive data is found in the target chat content during the sensitive data identification process. The warning message will usually notify the user through a pop-up window, email, text message, etc., to remind them of potential security risks.

[0067] By sending warning information to users in a timely manner, users can be made aware of potential security issues and take appropriate measures to protect sensitive data and prevent data leakage or abuse.

[0068] The embodiment of the present application monitors the sending and receiving ports of the communication tool to determine whether the user using the communication tool has sent a message. When the user sends a message, the embodiment of the present application obtains the corresponding chat content by capturing the image of the chat window and extracting the text content. The chat content of the instant messaging tool can be effectively monitored in an encrypted environment, which solves the problem that traditional auditing solutions cannot effectively warn about the chat content in an encrypted environment. By identifying sensitive data in the chat content, it can also immediately send a warning message to the user when sensitive data is detected, thereby improving security and response speed.

[0069] In one embodiment of the present application, if a chat content sending event is monitored in the transceiver port, intercepting a chat window corresponding to the communication tool to obtain a target image corresponding to the chat window includes:

[0070] If a chat content sending event is detected in the transceiver port, the chat window is determined;

[0071] If the chat window exists, determining window information corresponding to the chat window; the window information includes position information and size information of the chat window;

[0072] The chat window is captured according to the window information to obtain the target image.

[0073] In an embodiment of the present application, if the monitoring module monitors the existence of a chat content sending event in the transceiver port, it will notify the screenshot module to perform a screenshot operation. The screenshot module captures the chat window of the instant messaging tool based on HOOK technology (hook technology), and determines whether the chat window exists, calculates the position, height, and width of the chat window on the screen, and then takes a screenshot based on the calculated window position and size to form a chat record picture, and sends the chat record picture to the OCR module.

[0074] Specifically, when the monitoring module monitors a chat content sending event in the transceiver port of the communication tool, the monitoring module will notify the screenshot module to capture the chat window of the instant messaging tool through the HOOK technology. The HOOK technology can directly determine whether the window existing in the interface is the chat window of the instant messaging tool; if the screenshot module determines that there is a chat window of the instant messaging tool, it will further calculate the position information (such as the coordinates of the upper left corner) and size information (such as the height and width of the chat window) of the chat window on the screen. This information is collectively referred to as window information; then, the screenshot module will take a screenshot of the chat window according to the calculated window information (position and size) to obtain a picture of the chat window, that is, the target picture.

[0075] The screenshot module in the embodiment of the present application uses HOOK technology to determine whether the chat window exists and determine the window information, by calling the API (Application Programming Interface, such as the SetWindowsHook Ex function of Windows) in the operating system of the terminal computer to install a hook (HookInstallation), which is a callback function for capturing window events. Capture window events (EventCapture): When the chat window of the instant messaging tool appears or changes, the operating system triggers corresponding window events (such as window creation, window movement, window size change, etc.), and the hook function is called when these events occur to capture the window events.

[0076] Then, get the detailed information of the window (Window Information Determination): After capturing the window event, the hook function will further obtain the detailed information of the window by calling the operating system API, such as the GetWindowRect function of Windows, including the window handle, window class name, window title, window position and size, etc.

[0077] Determine whether the window is a chat window of an instant messaging tool (Chat Window Identification): Determine whether the window is a chat window of an instant messaging tool based on the captured window information. Usually, the determination can be made based on features such as the window class name and the window title.

[0078] Capture the chat window image based on the window position and size information (Window Capture): After determining the chat window, the operating system API (such as Windows' BitBlt function) is called to perform a screenshot of the chat window based on the window position and size information to obtain the target image.

[0079] The embodiment of the present application uses a system-level hook mechanism to capture and process window events in real time, accurately obtain window information, and efficiently capture images of chat windows, providing a reliable data basis for subsequent text extraction and sensitive data identification.

[0080] In one embodiment of the present application, the window information further includes layout information of the chat window, and the extracting text from the target image to obtain target chat content in the chat window includes:

[0081] Dividing the target image into a first area and a second area based on the layout information;

[0082] Extracting the text in the first area to obtain a target chat object in the chat window;

[0083] The text in the second area is extracted to obtain a plurality of target chat contents in the chat window; the chat object corresponding to the target chat content is the target chat object.

[0084] In the existing related technologies, when the monitoring module monitors the existence of chat content sending events on the transceiver port, it generally directly obtains the data packets transmitted by the transceiver port. However, these data packets are often encrypted, and without the key for decryption, it is impossible to obtain the relevant data in the data packet, and it is also impossible to obtain the user's chat content. Therefore, in order to solve this problem, the embodiment of the present application obtains the target image by intercepting the chat window, and performs text recognition on the target image through OCR technology, and also extracts the target chat content.

[0085] In an embodiment of the present application, after receiving the target image, the OCR module will first extract the name of the chat object (a group or an individual), and extract the chat content of different chat objects, so as to subsequently form a text chat record based on the chat object dimension.

[0086] Specifically, when capturing the image of the chat window, the screenshot module not only obtains the window position and size information, but also obtains the layout information of the chat window. The layout information includes the division of various areas in the chat window, such as the chat object area and the chat content area. By obtaining the layout information, the OCR module can accurately divide the image of the chat window into different areas to facilitate subsequent text extraction; the OCR module divides the image of the chat window into two areas according to the obtained layout information: a first area (usually the chat object area) and a second area (usually the chat content area). By dividing the areas, the OCR module can respectively extract the chat objects in the first area and multiple target chat contents in the second area, and the chat objects corresponding to these target chat contents are the target chat objects extracted previously.

[0087] In one embodiment of the present application, the step of identifying sensitive data of the target chat content includes:

[0088] Determine an initial chat record corresponding to the target chat object;

[0089] Integrate the multiple target chat contents and the initial chat records corresponding to the target chat object to obtain a target chat record corresponding to the target chat object;

[0090] Sensitive data is identified on the target chat record.

[0091] In an embodiment of the present application, before processing the target chat content, it is first necessary to determine the initial chat record corresponding to the target chat object. This step is crucial because the initial chat record contains the historical conversation content of the chat object.

[0092] A chat record database is maintained in the recognition and alarm module, which stores the historical chat records (initial chat records) corresponding to all chat objects. When receiving new target chat content, the recognition and alarm module will retrieve the initial chat record corresponding to the chat object from the database based on the unique identifier of the chat object (such as user ID, chat session ID, etc.).

[0093] After determining the initial chat record of the target chat object, the identification and alarm module will integrate multiple target chat contents with the initial chat record to form a complete chat record of the target chat object.

[0094] After the target chat records are integrated, the recognition and alarm module will perform sensitive data recognition on the records, with the purpose of detecting and marking sensitive information that may be contained in the chat records for subsequent processing and alarm. Specifically, the recognition and alarm module will use a predefined sensitive word library to match the target chat records. The sensitive word library contains various possible sensitive words, such as personal privacy information, commercial secrets, politically sensitive words, etc. The recognition and alarm module will scan the chat records one by one and mark the content containing sensitive words.

[0095] In one embodiment of the present application, the initial chat record corresponding to the target chat object includes multiple initial chat contents, and the multiple target chat contents and the initial chat record corresponding to the target chat object are integrated to obtain the target chat record corresponding to the target chat object, including:

[0096] Comparing the multiple target chat contents with multiple initial chat contents in the initial chat record corresponding to the target chat object, determining newly added chat content; the newly added chat content is the target chat content different from the initial chat content;

[0097] The newly added chat content is added to the initial chat record corresponding to the target chat object to obtain the target chat record corresponding to the target chat object.

[0098] In actual application scenarios, when a user receives or sends new chat content, the monitoring module in the embodiment of the present application will immediately send a signal to enable the screenshot module to perform a screenshot operation on the chat window. At this time, the target chat content obtained by the recognition and alarm module identifying the target image may contain the chat content obtained in the image captured when the user received or sent new chat content last time. For example, target image 1 contains target chat content 1-10, and target image 2 contains target chat content 2-11. At this time, the target chat content 2-10 in target image 2 will overlap with that of target image 1. Therefore, in the embodiment of the present application, after obtaining the target chat content corresponding to the new target image, it is necessary to perform a deduplication process on the target chat content based on the initial chat content (that is, the target chat content obtained in advance).

[0099] Deduplication refers to identifying and removing duplicate data records in a data set. The purpose of deduplication is to ensure that each record in the data set is unique and to avoid duplication from interfering with subsequent analysis and processing.

[0100] The deduplication processing in the embodiment of the present application specifically refers to that the identification and alarm module will compare the target chat content and the initial chat content one by one to perform content matching. For each target chat content, the identification and alarm module will check whether it already exists in the initial chat record.

[0101] Content matching can be done in a number of ways, for example:

[0102] 1) Text matching: directly compare the text content to determine whether the target chat content is exactly the same as the initial chat content.

[0103] 2) Hash matching: Use a hash algorithm (such as MD5, SHA-256, etc.) to calculate the hash values ​​of the target chat content and the initial chat content, and determine whether the content is the same by comparing the hash values.

[0104] 3) Fuzzy matching: In some cases, fuzzy matching algorithms (such as Levenshtein distance, Jaccard similarity, etc.) can be used to determine whether the target chat content is similar to the initial chat content.

[0105] In an embodiment of the present application, a suitable content matching method can be selected according to actual needs to determine whether the target chat content already exists in the initial chat record, and the embodiment of the present application is not limited thereto.

[0106] In actual application scenarios, the chat records corresponding to each chat object may be very large. If the entire chat record needs to be re-analyzed every time there is new chat content, the processing efficiency of the identification and alarm module will be greatly reduced. Therefore, in the embodiment of the present application, it is necessary to obtain the newly added chat content through filtering processing. The identification and alarm module can only process the newly added chat content, thereby saving computing resources and improving processing efficiency.

[0107] Filtering refers to filtering out qualified data records from a data set or removing unqualified data records based on certain conditions or rules, with the aim of extracting or excluding data based on specific requirements.

[0108] The filtering process in the embodiment of the present application specifically refers to the identification and alarm module filtering out the parts that are different from the initial chat content, that is, the newly added chat content, from the new target chat content based on the results obtained by matching the above content.

[0109] The embodiment of the present application can directly add the newly added chat content to the initial chat record through deduplication and filtering processing to form the final target chat record.

[0110] For example, the target image 1 contains the target chat content 1-10, and the target image 2 contains the target chat content 2-11. The target chat content 1-10 contained in the target image 1 is the initial chat content 1-10 in the embodiment of the present application. By matching the target chat content 2-11 with the initial chat content 1-10, it can be obtained that the target chat content 2-10 and the initial chat content 2-10 overlap, so the target chat content 2-10 needs to be deduplicated and filtered to obtain the target chat content 11 as the newly added chat content. Then, the identification and alarm module can only add the newly added chat content (target chat content 11) to the initial chat record to generate a target chat record containing chat content 1-11.

[0111] In an embodiment of the present application, through deduplication and filtering processing, the target chat content can be processed efficiently and accurately to ensure the timely identification and processing of subsequent sensitive data. It can also save computing resources, improve processing efficiency, and avoid data consistency problems caused by data duplication.

[0112] In an embodiment of the present application, the target chat record needs to be stored so that the target chat record can be traced later.

[0113] In one embodiment of the present application, the step of identifying sensitive data on the target chat record includes:

[0114] Preprocessing the newly added chat content in the target chat record corresponding to the target chat object to obtain multiple chat segmentations;

[0115] Match the multiple chat segment words with the multiple sensitive data in the sensitive database to determine whether the chat segment words are the sensitive data.

[0116] In actual application scenarios, the chat records corresponding to each chat object may be very large. If the entire chat record needs to be re-analyzed every time there is new chat content, the processing efficiency of the identification and alarm module will be greatly reduced. In order to save computing resources and improve processing efficiency, the embodiment of the present application will only perform sensitive data identification on the newly added chat content to ensure real-time processing of the newly added chat content and timely discovery and processing of sensitive information. In addition, in order to ensure that the content that has been analyzed is not repeatedly processed, the embodiment of the present application will also only perform sensitive data identification on the newly added chat content.

[0117] For example, target image 1 includes target chat content 1-10, and target image 2 includes target chat content 2-11. Target chat content 1-10 included in target image 1 is the initial chat content 1-10 in the embodiment of the present application. By matching the target chat content 2-11 with the initial chat content 1-10, it can be obtained that the target chat content 2-10 and the initial chat content 2-10 overlap. Since the initial chat content 2-10 has been previously identified as sensitive data, performing sensitive data identification on it again is a repetitive operation, which not only increases computing resources but also affects the overall processing efficiency. Therefore, it is necessary to deduplicate and filter the target chat content 2-10 to obtain the target chat content 11 as the newly added chat content. Then, the identification and alarm module can only perform sensitive data identification on the newly added chat content (target chat content 11) without repeatedly performing sensitive data identification on the target chat content 2-10 (which is also the initial chat content 2-10).

[0118] Therefore, after the newly added chat content is determined, the identification and alarm module of the embodiment of the present application will pre-process the newly added chat content to facilitate the subsequent sensitive data identification. The main purpose of the pre-processing is to convert the newly added chat content into a form suitable for matching.

[0119] Specifically, the recognition and alarm module will perform word segmentation on the newly added chat content and decompose the newly added chat content into multiple chat words. The purpose of word segmentation is to divide the continuous text into independent vocabulary units to facilitate subsequent matching and analysis.

[0120] Different word segmentation methods can be used for newly added chat content in different languages. For example, for Chinese chat content, Chinese word segmentation tools (such as Jieba, HanLP, etc.) can be used to segment the text into independent words. For English chat content, spaces or punctuation marks can be used to segment the text into independent words.

[0121] In one embodiment of the present application, in order to improve the accuracy of sensitive data recognition, the accuracy of word segmentation can be improved. Therefore, before word segmentation, the accuracy of word segmentation can also be improved by the following related preprocessing steps:

[0122] 1) Text cleaning

[0123] Text cleaning refers to removing noise and unnecessary information from text to improve the effect of subsequent word segmentation processing.

[0124] Remove special characters: remove punctuation marks, numbers, special symbols, etc. from the text, leaving only letters and Chinese characters. For example, "Hello! Today's weather is great." is cleaned to "Hello, today's weather is great".

[0125] Remove spaces and line breaks: Remove extra spaces and line breaks in the text to make it more compact. For example, "Hello\nThe weather is great today" can be cleaned into "Hello, the weather is great today".

[0126] 2) Case conversion

[0127] In some cases, converting all letters in a text to lowercase or uppercase can improve the accuracy of the match. For example, in English text, converting all letters to lowercase can avoid matching failures caused by different capitalization. For example, converting "Hello World" to "hello world".

[0128] 3) Write checks and corrections

[0129] Spell checking and correction refers to detecting and correcting spelling errors in text, which is very important for improving text quality and matching accuracy.

[0130] Spell Check: Detect spelling errors in the text using spell check tools such as Hunspell, Aspell, etc. For example, "teh" is detected as a spelling error.

[0131] Spelling Correction: Automatically correct spelling errors in text based on the spell check results, for example, correcting "teh" to "the".

[0132] 4) Text Standardization

[0133] Text standardization refers to converting text into a unified format to improve matching accuracy. For example, the date format is standardized as "YYYY-MM-DD" and the phone number format is standardized as "+86-123-4567-8901".

[0134] The embodiment of the present application can perform the above-mentioned preprocessing steps on the newly added chat content before word segmentation to significantly improve the accuracy and efficiency of word segmentation, for example, one or more combinations of text cleaning, case conversion, spelling checking and correction, text standardization, etc., which are not limited by the embodiment of the present application. After completing the preprocessing, the recognition and alarm module will perform word segmentation on the text obtained after the preprocessing, and divide the continuous text into independent vocabulary units, that is, multiple chat word segments.

[0135] In an embodiment of the present application, after completing the word segmentation and preprocessing, the recognition and alarm module will compare the chat word segmentations with the sensitive data in the sensitive database to determine which chat word segmentations belong to sensitive data.

[0136] The sensitive database maintained in the identification and alarm module contains various possible sensitive words, phrases, patterns, etc. These sensitive data can be predefined or dynamically updated based on historical data and user feedback.

[0137] The identification and alarm module will match chat words with sensitive data in the sensitive database to determine which chat words belong to sensitive data. Specifically, it can be determined through the following matching methods:

[0138] 1) Exact match: The identification and alarm module will compare the chat segmentation words and the sensitive data in the sensitive database one by one to determine whether they are exactly the same. For example, if the chat segmentation word "password" is exactly the same as the sensitive data "password" in the sensitive database, the system will mark it as sensitive data.

[0139] 2) Fuzzy matching: In some cases, the system can use fuzzy matching algorithms (such as Levenshtein distance, Jaccard similarity, etc.) to determine whether the chat word is similar to sensitive data. For example, if the chat word "passw0rd" is similar to the sensitive data "password" in the sensitive database, the system will mark it as sensitive data.

[0140] 3) Regular expression matching: The system can use regular expressions to match complex sensitive patterns, such as matching specific phone numbers, ID numbers, bank card numbers, etc. For example, if the chat word "123-456-7890" matches the regular expression "\d{3}-\d{3}-\d{4}" in the sensitive database, the system will mark it as sensitive data.

[0141] The matching method is not limited in the embodiments of the present application and may depend on actual needs.

[0142] In one embodiment of the present application, in addition to the above-mentioned matching methods, sensitive data can also be identified through machine learning, natural language processing (NLP), data classification, etc. For example, machine learning uses machine learning models (such as classifiers and clustering algorithms) to identify sensitive data. This method can identify unknown sensitive data formats, has high accuracy and adaptability, and can continuously optimize the recognition effect through training models; natural language processing analyzes text content through natural language processing technology to identify sensitive information. This method can process complex text structures and identify sensitive information hidden in texts. It is suitable for processing large amounts of text data and has high flexibility and adaptability; data classification classifies data according to its type and attributes to identify sensitive data. This method is suitable for large-scale data processing and can quickly identify sensitive data. The formulation and maintenance of classification rules are relatively simple and easy to expand and adjust.

[0143] Several methods for sensitive data identification have their own advantages and can be applied to different application scenarios and data types. Among them, the matching method is simple and fast, and is applicable to sensitive data of known formats; the machine learning method has high accuracy and adaptability; the natural language processing method is suitable for processing complex texts; and the data classification method is suitable for large-scale data processing. In practical applications, appropriate methods can be selected or multiple methods can be combined according to specific needs and data characteristics to improve the efficiency and accuracy of sensitive data identification. The embodiments of this application do not limit the methods for sensitive data identification.

[0144] In one embodiment of the present application, the recognition and alarm module can monitor chat content in real time, identify new sensitive data, and dynamically update the sensitive database. For example, if the recognition and alarm module finds that a certain word appears frequently in a short period of time and is related to sensitive topics, the recognition and alarm module will mark it as a potential sensitive word and add it to the sensitive database.

[0145] In one embodiment of the present application, the monitoring of the transceiver port of the communication tool includes:

[0146] Monitoring the transceiver port of the communication tool to determine whether data transmission exists on the transceiver port;

[0147] If there is data transmission on the transceiver port, it is determined that there is a chat content sending event on the transceiver port.

[0148] When data is sent through the network, the data packet will be transmitted through a specific port. Therefore, the monitoring module in the embodiment of the present application adopts the port monitoring technology to realize the monitoring of the transceiver port, and the port monitoring technology utilizes the characteristics of the network protocol (such as TCP / IP) to determine whether the data is sent by capturing the transmission event of the data packet. By monitoring these ports, the monitoring module can capture the sending and receiving events of the data packet. If the monitoring module monitors that a certain port has a data sending event, it can be determined that the application corresponding to the port (such as an instant messaging tool) is sending data.

[0149] For example, in actual applications, if a user wants to send a message after editing it, he will click the "Send" control to send the message to the communication partner. At this time, when the user clicks the "Send" control, the monitoring module will monitor the data transmission on the sending and receiving ports, and it will be determined that there is a chat content sending event in the sending and receiving ports.

[0150] The embodiment of the present application monitors the sending and receiving ports of the communication tool to determine whether the user using the communication tool has sent a message. When the user sends a message, the embodiment of the present application obtains the corresponding chat content by capturing the image of the chat window and extracting the text content. The chat content of the instant messaging tool can be effectively monitored in an encrypted environment, which solves the problem that traditional auditing solutions cannot effectively warn about the chat content in an encrypted environment. By identifying sensitive data in the chat content, it can also immediately send a warning message to the user when sensitive data is detected, thereby improving security and response speed.

[0151] Reference Figure 2 , showing a logical block diagram of a chat content alarm method of the present application.

[0152] Monitoring module 201: Install network filtering on the terminal computer to start, monitor the sending and receiving ports of the chat content of the instant messaging tool, and determine whether there is data transmission. If so, notify the screenshot module 202 to take a screenshot.

[0153] Screen capture module 202: Captures the chat window of the instant messaging tool based on HOOK technology, determines whether the window exists, and calculates the position and size of the chat window on the screen, takes a screenshot based on the calculated window position and size, forms a target image, and sends the target image to the OCR module 203.

[0154] OCR module 203: After receiving the target image, extract the text (chat object and chat content) in the image to obtain the target chat content.

[0155] Identification and alarm module 204: After receiving the target chat content, it will be merged with the initial chat record to form a target chat record, and sensitive data will be identified for the newly added chat content in the target chat record. After sensitive data is found, an alarm will be executed (an alarm message will be sent).

[0156] It should be noted that, for the method embodiments, for the sake of simplicity, they are all expressed as a series of action combinations, but those skilled in the art should be aware that the embodiments of the present application are not limited by the described order of actions, because according to the embodiments of the present application, certain steps can be performed in other orders or simultaneously. Secondly, those skilled in the art should also be aware that the embodiments described in the specification are all preferred embodiments, and the actions involved are not necessarily required by the embodiments of the present application.

[0157] On the basis of the above-mentioned embodiment, this embodiment further provides an alarm device for chat content, which is applied to electronic devices such as terminal devices and servers.

[0158] Reference Figure 3 , shows a structural block diagram of an embodiment of a chat content alarm device of the present application, which may specifically include the following modules:

[0159] A monitoring module 301 is used to monitor the transceiver port of the communication tool;

[0160] The interception module 302 is used to intercept the chat window corresponding to the communication tool and obtain the target image corresponding to the chat window if a chat content sending event is monitored in the transceiver port;

[0161] An extraction module 303 is used to extract the text in the target image to obtain the target chat content in the chat window;

[0162] An identification module 304 is used to identify sensitive data of the target chat content;

[0163] The alarm module 305 is used to send an alarm message for the target chat content to the user using the communication tool if sensitive data exists in the target chat content.

[0164] The embodiment of the present application also provides a non-volatile readable storage medium, which stores one or more modules (programs). When the one or more modules are applied to a device, the device can execute instructions (instructions) of each method step in the embodiment of the present application.

[0165] The present application embodiment provides one or more machine-readable media on which instructions are stored, and when executed by one or more processors, an electronic device executes one or more of the methods described in the above embodiments. In the present application embodiment, the electronic device includes various types of devices such as terminal devices and servers (clusters).

[0166] The embodiments of the present disclosure may be implemented as a device configured as desired using any appropriate hardware, firmware, software, or any combination thereof, and the device may include electronic devices such as terminal devices and servers (clusters). Figure 4 An exemplary apparatus 400 that may be used to implement various embodiments described in this application is schematically illustrated.

[0167] For one embodiment, Figure 4 An exemplary apparatus 400 is shown having one or more processors 402, a control module (chip set) 404 coupled to at least one of the processor(s) 402, a memory 406 coupled to the control module 404, a non-volatile memory (NVM) / storage device 408 coupled to the control module 404, one or more input / output devices 410 coupled to the control module 404, and a network interface 412 coupled to the control module 404.

[0168] The processor 402 may include one or more single-core or multi-core processors, and the processor 402 may include any combination of general-purpose processors or special-purpose processors (such as graphics processors, application processors, baseband processors, etc.). In some embodiments, the device 400 can be used as a terminal device, server (cluster), etc. described in the embodiments of the present application.

[0169] In some embodiments, the apparatus 400 may include one or more computer-readable media (e.g., memory 406 or NVM / storage device 408) having instructions 414 and one or more processors 402 combined with the one or more computer-readable media and configured to execute the instructions 414 to implement a module to perform the actions described in the present disclosure.

[0170] For one embodiment, control module 404 may include any suitable interface controller to provide any suitable interface to at least one of processor(s) 402 and / or any suitable device or component in communication with control module 404 .

[0171] The control module 404 may include a memory controller module to provide an interface to the memory 406. The memory controller module may be a hardware module, a software module, and / or a firmware module.

[0172] The memory 406 may be used, for example, to load and store data and / or instructions 414 for the device 400. For one embodiment, the memory 406 may include any suitable volatile memory, such as a suitable DRAM. In some embodiments, the memory 406 may include a double data rate type four synchronous dynamic random access memory (DDR4 SDRAM).

[0173] For one embodiment, control module 404 may include one or more input / output controllers to provide interfaces to NVM / storage device 408 and input / output device(s) 410 .

[0174] For example, NVM / storage 408 may be used to store data and / or instructions 414. NVM / storage 408 may include any suitable non-volatile memory (e.g., flash memory) and / or may include any suitable non-volatile storage device(s) (e.g., one or more hard disk drives (HDDs), one or more compact disk (CD) drives, and / or one or more digital versatile disk (DVD) drives).

[0175] NVM / storage device 408 may include storage resources that are physically part of the device on which apparatus 400 is installed, or it may be accessible to the device without being part of the device. For example, NVM / storage device 408 may be accessed via input / output device(s) 410 over a network.

[0176] (One or more) input / output devices 410 may provide an interface for the apparatus 400 to communicate with any other appropriate device, and the input / output device 410 may include a communication component, an audio component, a sensor component, etc. The network interface 412 may provide an interface for the apparatus 400 to communicate through one or more networks, and the apparatus 400 may wirelessly communicate with one or more components of a wireless network according to any of one or more wireless network standards and / or protocols, for example, accessing a wireless network based on a communication standard, such as WiFi, 2G, 3G, 4G, 5G, etc., or a combination thereof for wireless communication.

[0177] For one embodiment, at least one of the processor(s) 402 may be packaged together with the logic of one or more controllers (e.g., a memory controller module) of the control module 404. For one embodiment, at least one of the processor(s) 402 may be packaged together with the logic of one or more controllers of the control module 404 to form a system-in-package (SiP). For one embodiment, at least one of the processor(s) 402 may be integrated on the same die with the logic of one or more controllers of the control module 404. For one embodiment, at least one of the processor(s) 402 may be integrated on the same die with the logic of one or more controllers of the control module 404 to form a system-on-chip (SoC).

[0178] In various embodiments, the device 400 may be, but is not limited to, a terminal device such as a server, a desktop computing device, or a mobile computing device (e.g., a laptop computing device, a handheld computing device, a tablet computer, a netbook, etc.). In various embodiments, the device 400 may have more or fewer components and / or different architectures. For example, in some embodiments, the device 400 includes one or more cameras, a keyboard, a liquid crystal display (LCD) screen (including a touch screen display), a non-volatile memory port, multiple antennas, a graphics chip, an application-specific integrated circuit (ASIC), and a speaker.

[0179] Among them, the main control chip can be used as a processor or control module in the detection device, sensor data, location information, etc. are stored in a memory or NVM / storage device, the sensor group can be used as an input / output device, and the communication interface may include a network interface.

[0180] As for the device embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0181] The various embodiments in this specification are described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the various embodiments can be referenced to each other.

[0182] The embodiments of the present application are described with reference to the flowcharts and / or block diagrams of the methods, terminal devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable chat content alarm terminal device to produce a machine, so that the instructions executed by the processor of the computer or other programmable chat content alarm terminal device generate instructions for implementing the process in the process. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0183] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable chat content alarm terminal device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce a manufactured product including an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0184] These computer program instructions may also be loaded onto a computer or other programmable chat content alarm terminal device, so that a series of operating steps are executed on the computer or other programmable terminal device to produce a computer-implemented process, thereby providing instructions executed on the computer or other programmable terminal device for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0185] Although the preferred embodiments of the present application have been described, those skilled in the art may make additional changes and modifications to these embodiments once they have learned the basic creative concept. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications that fall within the scope of the embodiments of the present application.

[0186] Finally, it should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or terminal device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or terminal device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the existence of other identical elements in the process, method, article or terminal device including the elements.

[0187] The above is a detailed introduction to a chat content alarm method and device, an electronic device and a storage medium provided by the present application. Specific examples are used in this article to illustrate the principles and implementation methods of the present application. The description of the above embodiments is only used to help understand the method of the present application and its core idea; at the same time, for general technical personnel in this field, according to the idea of ​​the present application, there will be changes in the specific implementation method and application scope. In summary, the content of this specification should not be understood as a limitation on the present application.

Claims

1. A chat content alarm method, characterized in that: The method comprises: Monitor the sending and receiving ports of communication tools; If a chat content sending event is detected in the transceiver port, the chat window corresponding to the communication tool is intercepted to obtain a target image corresponding to the chat window; Extracting the text in the target image to obtain the target chat content in the chat window; Performing sensitive data identification on the target chat content; If sensitive data exists in the target chat content, an alarm message regarding the target chat content is sent to the user of the communication tool.

2. The method according to claim 1, characterized in that If a chat content sending event is monitored in the transceiver port, the chat window corresponding to the communication tool is intercepted to obtain a target image corresponding to the chat window, including: If a chat content sending event is detected in the transceiver port, the chat window is determined; If the chat window exists, determining window information corresponding to the chat window; the window information includes position information and size information of the chat window; The chat window is captured according to the window information to obtain the target image.

3. The method according to claim 2, characterized in that The window information also includes layout information of the chat window, and the extracting of text from the target image to obtain target chat content in the chat window includes: Dividing the target image into a first area and a second area based on the layout information; Extracting the text in the first area to obtain a target chat object in the chat window; The text in the second area is extracted to obtain a plurality of target chat contents in the chat window; the chat object corresponding to the target chat content is the target chat object.

4. The method according to claim 3, characterized in that The step of identifying sensitive data of the target chat content includes: Determine an initial chat record corresponding to the target chat object; Integrate the multiple target chat contents and the initial chat records corresponding to the target chat object to obtain a target chat record corresponding to the target chat object; Sensitive data is identified on the target chat record.

5. The method according to claim 4, characterized in that The initial chat record corresponding to the target chat object includes a plurality of initial chat contents, and the integrating the plurality of target chat contents and the initial chat record corresponding to the target chat object to obtain the target chat record corresponding to the target chat object includes: Comparing the multiple target chat contents with multiple initial chat contents in the initial chat record corresponding to the target chat object, determining newly added chat content; the newly added chat content is the target chat content different from the initial chat content; The newly added chat content is added to the initial chat record corresponding to the target chat object to obtain the target chat record corresponding to the target chat object.

6. The method according to claim 5, characterized in that The step of identifying sensitive data on the target chat record includes: Preprocessing the newly added chat content in the target chat record corresponding to the target chat object to obtain multiple chat segmentations; Match the multiple chat segment words with the multiple sensitive data in the sensitive database to determine whether the chat segment words are the sensitive data.

7. The method according to claim 1, characterized in that The transceiver port of the monitoring communication tool includes: Monitoring the transceiver port of the communication tool to determine whether data transmission exists on the transceiver port; If there is data transmission on the transceiver port, it is determined that there is a chat content sending event on the transceiver port.

8. A chat content alarm device, characterized in that: The device comprises: A monitoring module, used to monitor the sending and receiving ports of the communication tool; An interception module, for intercepting a chat window corresponding to the communication tool and obtaining a target image corresponding to the chat window if a chat content sending event is detected in the transceiver port; An extraction module, used to extract the text in the target image to obtain the target chat content in the chat window; An identification module, used to identify sensitive data of the target chat content; The alarm module is used to send an alarm message for the target chat content to the user of the communication tool if sensitive data exists in the target chat content.

9. An electronic device, characterized in that: include: processor; and A memory having executable codes stored thereon, which, when executed, causes the processor to execute the chat content alarm method as described in any one of claims 1-7.

10. One or more machine-readable media having executable codes stored thereon, which, when executed, cause a processor to execute the chat content alarm method as described in any one of claims 1-7.

Images