Secret-related detection method and device, electronic equipment and storage medium
By detecting sensitive operations at user terminals and using neural network models to calculate confidential risk values, the problem of terminal performance degradation caused by existing data leakage prevention methods is solved, and a wider data monitoring and a more efficient office experience is achieved.
Patent Information
- Application Number
- CN202411853496.7
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-12-16
- Publication Date
- 2025-03-25
AI Technical Summary
Existing data leakage prevention methods rely on gateways or terminal full disk scanning, resulting in excessive CPU and disk usage, affecting office efficiency, and limited application scenarios.
By detecting the permissions of the user when performing sensitive operations, obtaining relevant data and inputting the pre-constructed neural network model for calculation, the confidential risk value is obtained. If the risk value exceeds the threshold, the user operation is interrupted and an alarm message is generated.
This method can monitor data leakage channels more extensively and take into account more usage scenarios, avoiding the problem of terminal performance degradation caused by frequent full-disk scanning and improving office efficiency.
Smart Images
Figure CN119691738A_ABST
Abstract
Description
Technical Field
[0001] The present application relates to the field of data security technology, and in particular to a method, device, electronic device and storage medium for confidentiality detection. Background Art
[0002] With the rapid development of data, data resource information has become one of the core resources of enterprises. Sufficient data has become an indispensable part of enterprise decision-making. A large amount of data is collected, stored, processed and analyzed every day. However, the massive growth of data has brought about data security issues that cannot be ignored. Incomplete data processing mechanisms can easily lead to the leakage of user information, business secrets, and personal privacy, thereby causing data safety production incidents or public opinion crises.
[0003] At present, the main means of data leakage prevention mainly rely on the software and hardware deployed at the gateway, or regular full disk scans on employee terminals. These methods often rely on setting a series of security policies and have fewer application scenarios. At the same time, the high CPU and disk usage during frequent full disk scans leads to a decline in terminal performance, thus affecting office efficiency. Summary of the invention
[0004] In view of this, the present application provides a method, device, electronic device and storage medium for confidentiality detection to solve the above problems.
[0005] To achieve the above objectives, this application provides the following technical solutions:
[0006] The first aspect of the present application discloses a method for confidentiality detection, comprising:
[0007] When a user is detected to perform a sensitive operation, the user's permissions are authenticated;
[0008] If the authentication is successful, obtain the data involved in the sensitive operation performed by the user;
[0009] The data is input into a pre-built confidentiality detection model to calculate the confidentiality risk value; wherein the confidentiality detection model is a neural network model pre-trained based on sample data;
[0010] If the confidentiality risk value is greater than a preset threshold, the user is determined to be confidential, the user operation will be interrupted, and confidentiality warning information will be generated.
[0011] Optionally, in the above method, the step of obtaining data related to the user operation includes:
[0012] The data involved in the user performing sensitive operations is obtained through a probe application; wherein the probe application is pre-installed in the terminal and configured with a permission policy.
[0013] Optionally, the above method further includes:
[0014] If the confidentiality risk value is not greater than the threshold, the user operation is allowed, and the data involved when the user performs the sensitive operation is filed.
[0015] The second aspect of the present application discloses a device for confidentiality detection, comprising:
[0016] An authentication unit, used to authenticate the user's authority when detecting that the user performs a sensitive operation;
[0017] An acquisition unit, used to acquire data involved in the user performing sensitive operations if the authentication is successful;
[0018] A calculation unit, used to input the data into a pre-built confidentiality detection model to calculate a confidentiality risk value; wherein the confidentiality detection model is a neural network model pre-trained based on sample data;
[0019] The first processing unit is used to determine that the user is involved in confidentiality if the confidentiality risk value is greater than a preset threshold, interrupt the user operation, and generate confidentiality warning information.
[0020] Optionally, in the above device, the acquiring of data related to the user operation includes:
[0021] The acquisition subunit is used to acquire the data involved when the user performs sensitive operations through a probe application; wherein the probe application is pre-installed in the terminal and configured with a permission policy.
[0022] Optionally, the above device further includes:
[0023] The second processing unit is used to allow the user to operate if the confidentiality risk value is not greater than the threshold, and to file the data involved when the user performs the sensitive operation.
[0024] The third aspect of the present application discloses an electronic device, comprising:
[0025] one or more processors;
[0026] a storage device having one or more programs stored thereon;
[0027] When the one or more programs are executed by the one or more processors, the one or more processors implement the method as described in any one of the first aspects of the present invention.
[0028] A fourth aspect of the present application discloses a computer storage medium having a computer program stored thereon, wherein when the computer program is executed by a processor, the method described in any one of the first aspects of the present invention is implemented.
[0029] It can be seen from the above technical solutions that the present application provides a method for confidentiality detection. When a user is detected to perform a sensitive operation, the user's authority is authenticated; if the authentication is successful, the data involved in the user's sensitive operation is obtained; the data is input into a pre-constructed confidentiality detection model to calculate the confidentiality risk value; wherein the confidentiality detection model is a neural network model pre-trained according to sample data. If the confidentiality risk value is greater than a preset threshold, the user is determined to be confidential, the user operation will be interrupted, and confidentiality alarm information will be generated. It can be seen that by using the method of the present application, a wider range of data leakage channels can be monitored, more user usage scenarios can be taken into account, and it is more compatible and user-feasible. Compared with the heuristic full disk scan of confidential files, the present application does not perform a full disk detection on disk files, which can avoid the problem of terminal performance degradation and office efficiency affected by excessive CPU and disk usage during frequent full disk scans. BRIEF DESCRIPTION OF THE DRAWINGS
[0030] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on the provided drawings without paying any creative work.
[0031] Figure 1 A flowchart of a method for confidentiality detection disclosed in an embodiment of the present application;
[0032] Figure 2 A schematic diagram of a confidentiality detection device disclosed in an embodiment of the present application;
[0033] Figure 3 A schematic diagram of an electronic device disclosed in an embodiment of the present application. DETAILED DESCRIPTION
[0034] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.
[0035] In this application, the terms "comprises", "comprising" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device comprising a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, an element defined by the sentence "comprising a ..." does not exclude the presence of other identical elements in the process, method, article or device comprising the element.
[0036] Furthermore, in this document, relational terms such as first and second, etc. are used only to distinguish one entity or operation from another entity or operation, but do not necessarily require or imply any such actual relationship or order between these entities or operations.
[0037] The present application embodiment provides a method for confidentiality detection, such as Figure 1 As shown, specifically including:
[0038] S101. When it is detected that a user performs a sensitive operation, the user's authority is authenticated.
[0039] It should be noted that based on the zero-trust system, user operations are monitored. When a user is detected to perform a sensitive operation, the user's permissions are authenticated. Sensitive operations include but are not limited to using a USB flash drive to copy files, using an email to send and receive files, using a shared folder or shared document, using network disk software, using an instant messaging program, using remote login, using a network file transfer protocol, etc. The user authentication module is triggered to check whether the user has the permission for the relevant sensitive operation. If the user does not have the permission, the user operation is directly interrupted through the system to disable sensitive behaviors.
[0040] S102: If the authentication is successful, obtain the data involved when the user performs sensitive operations.
[0041] It should be noted that if the user authentication is passed, the data involved in the user performing sensitive operations is obtained through a data acquisition tool.
[0042] Optionally, in another embodiment of the present application, an implementation of step S102 may include:
[0043] The data involved in the user performing sensitive operations is obtained through a probe application; wherein the probe application is pre-installed in the terminal and configured with a permission policy.
[0044] It should be noted that the data involved in the user's sensitive operations is obtained through the probe application; wherein the probe application is pre-installed in the terminal and configured with permission policies. After the office terminal system and common software are installed, the terminal leakage detection probe application is installed. The application automatically starts when the computer is turned on, and registers itself as a system-level service, creating a probe process with administrator permissions and a self-protection daemon process. The terminal then waits for the user to log in. After the terminal is online, it obtains the permission policy information of the relevant user from the zero-trust permission policy allocation server. After the synchronization is completed, the terminal is in a zero-trust management and anti-leakage state.
[0045] S103, inputting the data into a pre-built confidentiality detection model to calculate a confidentiality risk value; wherein the confidentiality detection model is a neural network model pre-trained based on sample data.
[0046] It should be noted that after obtaining the data involved in the user's operation, the obtained data is input into the pre-built confidentiality detection model for processing to calculate the confidentiality risk value of the user's current operation. The confidentiality detection model is a neural network model pre-trained based on sample data.
[0047] It should also be noted that, unlike the sensitive information detection program deployed on the server, the deployment of lightweight models on the terminal for end-to-end detection has the properties of low latency and early detection. Although the large-scale model and high computing power on the server can identify and process sensitive information faster, from the process point of view, the one-to-many detection process of multiple user terminals corresponding to one content inspection server will inevitably lead to the generation of detection queues and increase detection delays. At this time, the data flow already exists in the form of files in transit. In order to transmit data, the carriers in the form of file data packets or data streams will cause carrier in-transit overhead. The data density of core data in the transmission data is reduced, resulting in a larger data throughput if the detection is performed in server mode. The model deployed on the terminal side can take advantage of the user-side probe, inherently close to the core user data, and can achieve touch perception of every sensitive operation of the user, and use lightweight models to track the data flow vector after each user operation. When using this system, users do not need to pay attention to whether the stored information on the terminal is sensitive, do not need to use a large-scale scanning engine that will occupy a large amount of computing resources and IO resources to detect tens of thousands of stored file systems in advance, and do not need to pay attention to possible misoperations that may cause data leakage. The pre-made model of this system tracks the working mode of user operations, directly identifies sensitive content for each data access behavior such as cutting, copying, modifying, and deleting by the user, and compresses or encrypts the data during file transfer.
[0048] Sensitive data labels have been previously established for files with updated modification timestamps. Even if users subjectively perform operations such as encryption, encoding, decoding, and obfuscation on sensitive data, the model can still identify that the raw data of the data contains sensitive content, and thus directly intercept and terminate the task when the user with export permission exports high-risk data blocks to the terminal. The process of pre-processing user-accessible data blocks through lightweight models can effectively save terminal computing resources consumed when user data overflows, reduce terminal operating system freezes, and leave more office hardware resources for front-end work. The authentication server only issues user permission policy information to the terminal when the user logs in, and performs centralized collection of user-triggered sensitive data leakage alarms and permission downgrade functions after frequent alarm triggering. Almost all detections are completed by the terminal probe, and there is no need to consume a lot of resources on the server for decryption, decompression calculations, etc. The advantageous working scenario of the system model is the scenario where the data is exported after being completely processed. Under this working condition, the model can know the full amount of exported data while the user is editing the data file. At the same time, the corresponding worst working condition exists in the scenario where the user is eager to export a large amount of terminal data at a single point. In this scenario, the system efficiency is equivalent to a scanning system that decompresses, decrypts and parses each exported data block. In short, under the condition of meeting the basic functional scenario of sensitive information leakage, the model can minimize the occupation of system resources and the detection delay during data export, improve the detection response speed and optimize the user experience. At the same time, a group of terminal combinations with the same detection probes installed are regarded as a management domain, and user permissions are allocated using a centralized permission policy server. The data blocks exchanged between domain users can be accompanied by compatible sensitive data labels, so that the original sensitive information detection can be reused for multiple authentication points once, and the sensitive data labels that have been calculated can be used to directly determine the leakage of sensitive data when other users export data to outside the domain. Compared with large-scale repeated scanning of terminals, it greatly reduces the loss of hardware repeated computing resources between office terminal clusters and greatly improves the efficiency of domain operation. This model can also quickly detect incremental data problems caused by file changes based on the timestamp marks in the file data block editing and access journey, reducing repeated detection of sensitive information files that may be involved in the same block, and avoiding the resource waste of traditional data leakage prevention gateway software and hardware that performs full detection on every file with a different hash value.
[0049] S104: If the confidentiality risk value is greater than a preset threshold, the user is determined to be confidential, the user operation is interrupted, and confidentiality warning information is generated.
[0050] It should be noted that if the confidentiality risk value is greater than a preset threshold, the user is determined to be confidential, sensitive behaviors are disabled, and confidentiality warning information is generated to warn the user of confidential information in a timely manner.
[0051] The embodiment of the present application provides a method for confidentiality detection. When a user is detected to perform a sensitive operation, the user's authority is authenticated; if the authentication is successful, the data involved in the user's sensitive operation is obtained; the data is input into a pre-constructed confidentiality detection model to calculate the confidentiality risk value; wherein the confidentiality detection model is a neural network model pre-trained based on sample data. If the confidentiality risk value is greater than a preset threshold, the user is determined to be confidential, the user operation is interrupted, and a confidentiality alarm message is generated. It can be seen that by using the method of the present application, a wider range of data leakage channels can be monitored, more user usage scenarios can be taken into account, and it is more compatible and user-feasible. Compared with the heuristic full disk scan of confidential files, the present application does not perform a full disk detection on disk files, which can avoid the problem of terminal performance degradation caused by excessive CPU and disk usage during frequent full disk scans, thereby affecting office efficiency.
[0052] Optionally, in another embodiment of the present application, the above-mentioned confidentiality detection method may further include:
[0053] If the confidentiality risk value is not greater than the threshold, the user operation is allowed, and the data involved when the user performs the sensitive operation is filed.
[0054] It should be noted that if the confidentiality risk value is not greater than the preset threshold, the user is allowed to operate. However, since it is a sensitive operation, for security reasons, the data involved in the user's sensitive operation still needs to be filed.
[0055] Another embodiment of the present application also discloses a device for confidentiality detection, such as Figure 2 As shown, specifically including:
[0056] The authentication unit 201 is used to authenticate the authority of the user when it is detected that the user performs a sensitive operation.
[0057] The acquisition unit 202 is used to acquire the data involved when the user performs sensitive operations if the authentication is successful.
[0058] The calculation unit 203 is used to input the data into a pre-built confidentiality detection model to calculate the confidentiality risk value; wherein the confidentiality detection model is a neural network model pre-trained based on sample data.
[0059] The first processing unit 204 is used to determine that the user is involved in confidentiality if the confidentiality risk value is greater than a preset threshold, interrupt the user operation, and generate confidentiality warning information.
[0060] In this embodiment, the specific execution process of the authentication unit 201, the acquisition unit 202, the calculation unit 203 and the first processing unit 204 can be referred to in the corresponding Figure 1 The content of the method embodiment will not be repeated here.
[0061] The embodiment of the present application provides a device for confidentiality detection. When the authentication unit 201 detects that a user performs a sensitive operation, the user's authority is authenticated; if the authentication is passed, the acquisition unit 202 acquires the data involved in the user's sensitive operation; the calculation unit 203 inputs the data into a pre-built confidentiality detection model to calculate the confidentiality risk value; wherein the confidentiality detection model is a neural network model pre-trained according to sample data. If the confidentiality risk value is greater than a preset threshold, the first processing unit 204 determines that the user is confidential, interrupts the user operation, and generates confidentiality alarm information. It can be seen that the method of the present application can monitor a wider range of data leakage channels, can take into account more user usage scenarios, and has greater compatibility and user feasibility. Compared with the heuristic full disk scan of confidential files, the present application does not perform full disk detection on disk files, which can avoid the problem of terminal performance degradation caused by excessive CPU and disk occupancy during frequent full disk scans, thereby affecting office efficiency.
[0062] Optionally, in another embodiment of the present application, an implementation of the acquisition unit 202 includes:
[0063] The acquisition subunit is used to acquire the data involved when the user performs sensitive operations through a probe application; wherein the probe application is pre-installed in the terminal and configured with a permission policy.
[0064] In this embodiment, the specific execution process of the acquisition sub-unit can be found in the corresponding method embodiment described above, which will not be repeated here.
[0065] Optionally, in another embodiment of the present application, the above-mentioned confidentiality detection device further includes:
[0066] The second processing unit is used to allow the user to operate if the confidentiality risk value is not greater than the threshold, and to file the data involved when the user performs the sensitive operation.
[0067] In this embodiment, the specific execution process of the second processing unit can refer to the corresponding method embodiment described above, which will not be repeated here.
[0068] Another embodiment of the present application further provides an electronic device, such as Figure 3 As shown, specifically including:
[0069] One or more processors 301 .
[0070] The storage device 302 stores one or more programs.
[0071] When one or more programs are executed by one or more processors 301 , the one or more processors 301 implement any one of the methods in the above embodiments.
[0072] Another embodiment of the present application further provides a computer storage medium on which a computer program is stored, wherein when the computer program is executed by a processor, any one of the methods in the above embodiments is implemented.
[0073] Each embodiment in this specification is described in a progressive manner, and the same or similar parts between the embodiments can refer to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the system or system embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can refer to the partial description of the method embodiment. The system and system embodiments described above are merely schematic, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this embodiment. Ordinary technicians in this field can understand and implement it without creative work.
[0074] Professionals may further appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the composition and steps of each example have been generally described in the above description according to function. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professionals and technicians may use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of the present invention.
[0075] The above description of the disclosed embodiments enables those skilled in the art to implement or use the present invention. Various modifications to these embodiments will be apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present application. Therefore, the present application will not be limited to the embodiments shown herein, but will conform to the widest scope consistent with the principles and novel features disclosed herein.
Claims
1. A method for confidentiality detection, characterized in that: include: When a user is detected to perform a sensitive operation, the user's permissions are authenticated; If the authentication is successful, obtain the data involved in the sensitive operation performed by the user; The data is input into a pre-built confidentiality detection model to calculate the confidentiality risk value; wherein the confidentiality detection model is a neural network model pre-trained based on sample data; If the confidentiality risk value is greater than a preset threshold, the user is determined to be confidential, the user operation is interrupted, and confidentiality warning information is generated.
2. The method according to claim 1, characterized in that The obtaining of data related to the user operation includes: The data involved in the user performing sensitive operations is obtained through a probe application; wherein the probe application is pre-installed in the terminal and configured with a permission policy.
3. The method according to claim 1, characterized in that Also includes: If the confidentiality risk value is not greater than the threshold, the user operation is allowed, and the data involved when the user performs the sensitive operation is filed.
4. A device for confidentiality detection, characterized in that: include: An authentication unit, used to authenticate the user's authority when detecting that the user performs a sensitive operation; An acquisition unit, used to acquire data involved in the user performing sensitive operations if the authentication is successful; A calculation unit, used to input the data into a pre-built confidentiality detection model to calculate a confidentiality risk value; wherein the confidentiality detection model is a neural network model pre-trained based on sample data; The first processing unit is used to determine that the user is involved in confidentiality if the confidentiality risk value is greater than a preset threshold, interrupt the user operation, and generate confidentiality warning information.
5. The device according to claim 4, characterized in that The obtaining of data related to the user operation includes: The acquisition subunit is used to acquire the data involved when the user performs sensitive operations through a probe application; wherein the probe application is pre-installed in the terminal and configured with a permission policy.
6. The device according to claim 4, characterized in that Also includes: The second processing unit is used to allow the user to operate if the confidentiality risk value is not greater than the threshold, and to file the data involved when the user performs the sensitive operation.
7. An electronic device, characterized in that: include: one or more processors; a storage device having one or more programs stored thereon; When the one or more programs are executed by the one or more processors, the one or more processors are enabled to implement the method according to any one of claims 1 to 3.
8. A computer storage medium, characterized in that A computer program is stored thereon, wherein when the computer program is executed by a processor, the method according to any one of claims 1 to 3 is implemented.