Computer information security management method

Abstract

The invention relates to the technical field of information security management, and discloses a computer information security management method, which comprises the following steps: acquiring a habit model of target equipment, forming equipment analysis data, forming first transmission analysis data or second transmission analysis data, forming personnel analysis data, forming security transmission data, and transmitting the data, the invention discloses a computer information security management method. According to the use habit of an equipment owner, a transmission receiving device corresponding to historical transmission data, a transmission receiving device corresponding to current transmission data, a transmission mode and a query process which are correspondingly used by the historical transmission data, and a transmission mode and a query process corresponding to the current transmission data. And whether the personnel currently executing the data transmission operation is the owner of the equipment is judged, so that the situation that the data is stolen by others is reduced, data leakage is avoided, and the potential safety hazard of personnel data privacy is reduced.

Description

Technical Field

[0001] The present invention relates to the technical field of information security management, in particular to a computer information security management method. Background Art

[0002] With the rapid development of information technology, computer and network technology have penetrated into all areas of society, including government agencies, financial institutions, medical industry, education system and various enterprises. This extensive digital and information transformation has greatly improved production efficiency and business flexibility, but it has also brought unprecedented information security challenges. Information security issues, such as data leakage, network attacks, malware infection, unauthorized access, etc., pose a serious threat to personal privacy, corporate secrets and national security. Computer information security management measures are a series of technical and management measures taken by organizations to protect their computer systems, networks and data from various security threats under the background of rapid development of information technology, continuous evolution of network threats and increasingly improved laws and regulations. Information security management is not only a technical issue, but also an important issue involving the overall operation and strategy of the organization. By establishing a comprehensive information security management system, organizations can effectively respond to information security challenges and protect their core assets and business continuity.

[0003] The existing computer information security management methods cannot determine whether the person currently performing the data transmission operation is the device owner himself based on the device owner's usage habits. They cannot determine whether the person currently performing the data transmission operation is the device owner himself based on the transmission and receiving devices corresponding to the historical transmission data and the transmission and receiving devices corresponding to the current transmission data. They cannot determine whether the person currently performing the data transmission operation is the device owner himself based on the transmission method and query process corresponding to the historical transmission data and the transmission method and query process corresponding to the current transmission data. This can easily cause data to be stolen by others, thereby causing data leakage, increasing the security risks of personnel data privacy, and its practicality has certain limitations. Summary of the invention

[0004] The present invention provides a computer information security management method for promoting the solution of the problems mentioned in the background technology.

[0005] The present invention provides the following technical solution: a computer information security management method, comprising:

[0006] Obtaining a target device, target transmission data, and a target transmission device;

[0007] Obtain a habit model of the target device;

[0008] Get historical transmission records;

[0009] The historical transmission record includes historical transmission data and historical transmission equipment;

[0010] According to the historical transmission equipment and the target transmission equipment, the equipment analysis strategy is used to form equipment analysis data;

[0011] The device analysis data includes historical devices and newly transmitted devices;

[0012] If the device analysis data is a historical device, executing a first transmission analysis strategy to form first transmission analysis data;

[0013] If the device analysis data is a new transmission device, a second transmission analysis strategy is executed to form second transmission analysis data;

[0014] According to the first transmission analysis data or the second transmission analysis data, combined with the habit model, the process analysis strategy is executed to form personnel analysis data;

[0015] The personnel analysis data includes the operations of the individual and others;

[0016] If the personnel analyzing the data is operated by themselves, the target transmission data is transmitted from the target device to the target transmission device;

[0017] If the personnel analysis data is operated by others, the security transmission strategy is implemented to form secure transmission data;

[0018] The target transmission data is transmitted from the target device to the target transmission device according to the secure transmission data.

[0019] As an optional solution of the computer information security management method of the present invention, wherein: the acquisition of the habit model of the target device includes generating a transmission habit model, specifically:

[0020] Set the collection start time and collection end time;

[0021] The model collection period is formed by taking the collection start time as the starting time and the collection end time as the ending time;

[0022] Acquire the transmission operation of the target person within the model collection period, wherein the transmission operation includes transmission operation;

[0023] Extract all transmission data corresponding to the transmission operation to form a transmission data set;

[0024] Extracting the data type of each transmission data in the transmission data set;

[0025] The data type of each transmission data is matched one by one with each element in the transmission data set to form a data type set;

[0026] Identify each data type as the target analysis type in turn and execute A1-A4;

[0027] Extract the target usage corresponding to each data type;

[0028] The target usage mode corresponding to each data type is matched one by one with each element in the data type set to form a transmission mode set;

[0029] The execution of A1-A4 is specifically as follows:

[0030] A1. extract all transmission data corresponding to the target analysis type in the data type set and define them as target analysis data;

[0031] A2. Obtain the transmission mode of each target transmission data and set it as the target analysis mode;

[0032] A3. Obtain the number of target transmission data corresponding to each target analysis method, and define it as the number of times used;

[0033] A4. Extract the target analysis method that is used most frequently and set it as the target usage method.

[0034] As an optional solution of the computer information security management method of the present invention, wherein: the acquisition of the habit model of the target device also includes generating a query habit model, specifically:

[0035] Get the model collection period;

[0036] Acquire the transmission operation of the target person within the model collection period, wherein the transmission operation includes a query operation;

[0037] Extract all the transmission modes corresponding to the query operation;

[0038] Identify each transmission mode as the analysis transmission mode in turn and execute B1-B6;

[0039] Get the transmission mode set;

[0040] The target execution process corresponding to each transmission mode is matched one by one with each element in the transmission mode set to form a transmission process set;

[0041] The execution of B1-B6 is specifically as follows:

[0042] B1. Obtain all query processes corresponding to the analysis transmission mode, wherein the query process includes a first process and a second process;

[0043] B2. Extract the number of transmission modes searched and analyzed using the first process, and define it as the first search number;

[0044] B3, extracting the number of transmission modes searched and analyzed using the second process, and setting it as the second search number;

[0045] B4. If the first search quantity is greater than the second search quantity, the first process is set as the target execution process;

[0046] B5. If the first search quantity is less than the second search quantity, the second process is set as the target execution process;

[0047] B6. If the first search quantity = the second search quantity, then either the first process or the second process is arbitrarily extracted and determined as the target execution process.

[0048] As an optional solution of the computer information security management method of the present invention, the device analysis strategy is specifically:

[0049] Obtain all historical transmission devices to form a historical device set;

[0050] Get the target transmission device;

[0051] If the target transmission device is included in the historical device set, the device analysis data is determined to be a historical device;

[0052] If the target transmission device is not included in the historical device set, the device analysis data is determined to be a new transmission device.

[0053] As an optional solution of the computer information security management method of the present invention, the first transmission analysis strategy is specifically:

[0054] Get target transmission data and all historical transmission data;

[0055] Extract the data type of the target transmission data and set it as the target type;

[0056] Extract the data type of each historical transmission data and define it as the historical type;

[0057] The historical transmission data with the historical type equal to the target type is defined as the same transmission data;

[0058] If there is the same transmission data, the transmission mode used by each of the same transmission data is obtained and determined as the historical transmission mode;

[0059] Get the habit model;

[0060] Extract the transmission mode corresponding to the target type in the transmission mode set and set it as the reference transmission mode;

[0061] If the historical transmission mode = the reference transmission mode, then the transmission mode selected by the target person for the target transmission data is obtained and determined as the determined transmission mode;

[0062] If the transmission mode is determined to be the historical transmission mode, the transmission mode is determined to be the common mode;

[0063] If the transmission mode is determined to be ≠ the historical transmission mode, the transmission mode is determined to be an uncommon mode;

[0064] If the historical transmission mode ≠ the reference transmission mode, all target analysis modes corresponding to the target type are extracted to form an analysis mode set;

[0065] If the analysis mode set includes the historical transmission mode, the determined transmission mode is obtained;

[0066] If the transmission mode is determined to be the historical transmission mode, the transmission mode is determined to be the common mode;

[0067] If the transmission mode is determined to be ≠ the historical transmission mode, the transmission mode is determined to be an uncommon mode;

[0068] If the analysis mode set does not include the historical transmission mode, obtaining the determined transmission mode;

[0069] If the transmission mode is determined to be the historical transmission mode, the transmission mode is determined to be an uncommon mode, and all operations performed by the target person on the target device are monitored in real time;

[0070] If the determined transmission mode ≠ the historical transmission mode, and the determined transmission mode is not included in the analysis mode set, the transmission mode is determined to be an uncommon mode, and all operations performed by the target person on the target device are monitored in real time;

[0071] If the determined transmission mode ≠ the historical transmission mode, but the determined transmission mode is included in the analysis mode set, then the determined transmission mode is the common mode;

[0072] If there is no identical transmission data, the data analysis strategy is executed.

[0073] As an optional solution of the computer information security management method of the present invention, the data analysis strategy is specifically:

[0074] Get the habit model;

[0075] Extract reference transmission mode;

[0076] Get the transmission mode of determination;

[0077] If the determined transmission mode = the reference transmission mode, the determined transmission mode is the common mode;

[0078] If the transmission mode is determined to be ≠ the reference transmission mode, then the analysis mode set is extracted;

[0079] If the analysis method set does not include the determined transmission method, the transmission method is determined to be an uncommon method, and all operations performed by the target person on the target device are monitored in real time;

[0080] If the analysis mode set includes the determined transmission mode, the determined transmission mode is the common mode.

[0081] As an optional solution of the computer information security management method of the present invention, the second transmission analysis strategy is specifically:

[0082] Acquire habit models and goal transfer data;

[0083] Extract target type;

[0084] Get all historical transmission data corresponding to the target type and define it as type transmission data;

[0085] Extract the transmission mode used by each type of transmitted data and define it as the type transmission mode;

[0086] Obtain the number of type transmission data corresponding to each type transmission mode and define it as the usage number;

[0087] All types of transmission methods are sorted into a usage order set from large to small according to the number of usage;

[0088] If the usage order set contains the reference transmission mode, the first element in the usage order set is extracted and determined as the common transmission mode;

[0089] If the reference transmission mode = the commonly used transmission mode, the commonly used transmission mode is identified as the comparison transmission mode;

[0090] If the reference transmission mode ≠ the commonly used transmission mode, the reference transmission mode is identified as the comparison transmission mode;

[0091] If the determined transmission mode = the compared transmission mode, the determined transmission mode is the common mode;

[0092] If it is determined that the transmission mode is ≠ the comparison transmission mode, the transmission mode is determined to be an uncommon mode, and all operations performed by the target person on the target device are monitored in real time;

[0093] If the usage order set does not contain the reference transmission method, the analysis method set is extracted;

[0094] The type of transmission method that exists in both the extraction analysis method set and the usage order set is identified as the comparative transmission method;

[0095] If the determined transmission mode = the compared transmission mode, the determined transmission mode is the common mode;

[0096] If it is determined that the transmission mode ≠ the comparison transmission mode, the transmission mode is determined to be an uncommon mode, and all operations performed by the target person on the target device are monitored in real time.

[0097] As an optional solution of the computer information security management method of the present invention, the process analysis strategy is specifically:

[0098] Obtaining a use determination result of a transmission method;

[0099] If the transmission mode is determined to be a common mode, obtaining the transmission mode;

[0100] Acquire habit models and goal transfer data;

[0101] Extract the target execution process corresponding to the transmission mode in the transmission process set and set it as the reference query process;

[0102] Extract the query process used by the target personnel to determine the transmission method, and define it as the determination query process;

[0103] If the query process is determined to be the comparison query process, the data analysis is performed by the person himself;

[0104] If the query process is determined to be ≠ the comparison query process, it is determined that the person analyzing the data is someone else's operation, and all operations performed by the target person on the target device are monitored in real time

[0105] If the transmission method is determined to be an unusual method, the personnel will analyze the data and determine that it is operated by someone else, and monitor all operations performed by the target person on the target device in real time.

[0106] As an optional solution of the computer information security management method of the present invention, the secure transmission strategy is specifically:

[0107] Get target transmission data;

[0108] Set the transmission password and set it as the target password;

[0109] Obtain the transmission password input by the target person and set it as the determination password;

[0110] If the password is determined to be equal to the target password, the target transmission data is transmitted from the target device to the target transmission device;

[0111] If the password is determined to be ≠ the target password, the encryption tool is obtained;

[0112] The encryption tool extracts the format data of the target transmission data;

[0113] According to the format data of the target transmission data, the encryption tool automatically generates new transmission data at random and defines it as encrypted transmission data;

[0114] The encrypted transmission data is transmitted from the target device to the target transmission device.

[0115] The present invention has the following beneficial effects:

[0116] 1. This computer information security management method sets a habit collection period and collects the usage habits of the device owner during the habit collection period to generate a habit model. By obtaining the usage habits of the person currently performing the data transmission operation, it is determined whether the person currently performing the data transmission operation is the device owner himself. If it is the device owner himself, data transmission is performed directly. If it is not the device owner himself, secure data transmission is performed, and all operation behaviors of the person currently performing the data transmission operation are monitored in real time to reduce the situation where data is stolen by others, avoid data leakage, and reduce the security risks of personnel data privacy.

[0117] 2. The computer information security management method obtains all historical transmission data of the device owner, and obtains the transmission and reception devices corresponding to the historical transmission data, obtains the transmission and reception devices corresponding to the data transmitted this time, and whether the device receiving this time has a historical transmission record. If there is a historical transmission record, then based on the historical transmission record and the habit model, it is judged whether the person currently performing the data transmission operation is the device owner himself. If there is no historical transmission record, then based on the habit model, it is judged whether the person currently performing the data transmission operation is the device owner himself. If it is the device owner himself, the data is directly transmitted. If it is not the device owner himself, secure data transmission is performed, and all operation behaviors of the person currently performing the data transmission operation are monitored in real time to reduce the situation where data is stolen by others, avoid data leakage, and reduce the security risks of personnel data privacy.

[0118] 3. This computer information security management method obtains all historical transmission data of the device owner, and obtains the transmission method and query process corresponding to the historical transmission data, obtains the transmission method and query process corresponding to the current transmission data, and determines whether the person currently performing the data transmission operation is the device owner himself. If it is the device owner himself, the data transmission is performed directly. If it is not the device owner himself, secure data transmission is performed, and all operation behaviors of the person currently performing the data transmission operation are monitored in real time to reduce the situation where data is stolen by others, avoid data leakage, and reduce the security risks of personnel data privacy. BRIEF DESCRIPTION OF THE DRAWINGS

[0119] Figure 1 This is a flow chart of the computer information security management method of the present invention. DETAILED DESCRIPTION

[0120] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0121] Embodiment 1, a computer information security management method, see Figure 1 ,include:

[0122] Obtaining a target device, target transmission data, and a target transmission device;

[0123] Obtain a habit model of the target device;

[0124] Get historical transmission records;

[0125] The historical transmission record includes historical transmission data and historical transmission equipment;

[0126] According to the historical transmission equipment and the target transmission equipment, the equipment analysis strategy is used to form equipment analysis data;

[0127] The device analysis data includes historical devices and newly transmitted devices;

[0128] If the device analysis data is a historical device, executing a first transmission analysis strategy to form first transmission analysis data;

[0129] If the device analysis data is a new transmission device, a second transmission analysis strategy is executed to form second transmission analysis data;

[0130] According to the first transmission analysis data or the second transmission analysis data, combined with the habit model, the process analysis strategy is executed to form personnel analysis data;

[0131] The personnel analysis data includes the operations of the individual and others;

[0132] If the personnel analyzing the data is operated by themselves, the target transmission data is transmitted from the target device to the target transmission device;

[0133] If the personnel analysis data is operated by others, the security transmission strategy is implemented to form secure transmission data;

[0134] The target transmission data is transmitted from the target device to the target transmission device according to the secure transmission data.

[0135] Through the above method, according to the usage habits of the device owner, it is judged whether the person currently performing the data transmission operation is the device owner himself, according to the transmission and receiving devices corresponding to the historical transmission data and the transmission and receiving devices corresponding to the current transmission data, it is judged whether the person currently performing the data transmission operation is the device owner himself, according to the transmission method and query process corresponding to the historical transmission data and the transmission method and query process corresponding to the current transmission data, it is judged whether the person currently performing the data transmission operation is the device owner himself, thereby reducing the situation of data being stolen by others, avoiding data leakage, and reducing the security risks of personnel data privacy.

[0136] Embodiment 2: This embodiment is an improvement made on the basis of embodiment 1. In the computer information security management method, the step of obtaining the habit model of the target device includes generating a transmission habit model, specifically:

[0137] Set the collection start time and collection end time;

[0138] The model collection period is formed by taking the collection start time as the starting time and the collection end time as the ending time;

[0139] Acquire the transmission operations of the target person during the model collection period, wherein the transmission operations include transmission operations, which are operations performed by the user according to the data type of the data to be transmitted, such as packaging to a folder and generating a compressed package, etc.;

[0140] Extract all transmission data corresponding to the transmission operation to form a transmission data set;

[0141] Extracting the data type of each transmission data in the transmission data set, wherein the data type includes plain text and plain data, etc.;

[0142] The data type of each transmission data is matched one by one with each element in the transmission data set to form a data type set;

[0143] Identify each data type as the target analysis type in turn and execute A1-A4;

[0144] Extract the target usage corresponding to each data type;

[0145] The target usage mode corresponding to each data type is matched one by one with each element in the data type set to form a transmission mode set;

[0146] The execution of A1-A4 is specifically as follows:

[0147] A1. extract all transmission data corresponding to the target analysis type in the data type set and define them as target analysis data;

[0148] A2. Obtain the transmission mode of each target transmission data and set it as the target analysis mode;

[0149] A3. Obtain the number of target transmission data corresponding to each target analysis method, and define it as the number of times used;

[0150] A4. Extract the target analysis method that is used most frequently and set it as the target usage method.

[0151] This embodiment also provides that the acquiring the habit model of the target device further includes generating a query habit model, specifically:

[0152] Get the model collection period;

[0153] Acquire the transmission operations of the target person within the model collection period, wherein the transmission operations include query operations, which are operations performed by the user to search for transmission tools according to each transmission operation, such as searching by entering the name of the transmission tool or searching by clicking the storage path where the transmission tool is located;

[0154] Extract all the transmission modes corresponding to the query operation;

[0155] Identify each transmission mode as the analysis transmission mode in turn and execute B1-B6;

[0156] Get the transmission mode set;

[0157] The target execution process corresponding to each transmission mode is matched one by one with each element in the transmission mode set to form a transmission process set;

[0158] The execution of B1-B6 is specifically as follows:

[0159] B1. Obtain all query processes corresponding to the analysis transmission mode, wherein the query process includes a first process and a second process;

[0160] B2. Extract the number of transmission modes searched and analyzed using the first process, and define it as the first search number;

[0161] B3, extracting the number of transmission modes searched and analyzed using the second process, and setting it as the second search number;

[0162] B4. If the first search quantity is greater than the second search quantity, the first process is set as the target execution process;

[0163] B5. If the first search quantity is less than the second search quantity, the second process is set as the target execution process;

[0164] B6. If the first search quantity = the second search quantity, then either the first process or the second process is arbitrarily extracted and determined as the target execution process.

[0165] Embodiment 3: This embodiment is an improvement made on the basis of Embodiment 2. In this embodiment, the device analysis strategy is specifically as follows:

[0166] Obtain all historical transmission devices to form a historical device set;

[0167] Get the target transmission device;

[0168] If the target transmission device is included in the historical device set, the device analysis data is determined to be a historical device;

[0169] If the target transmission device is not included in the historical device set, the device analysis data is determined to be a new transmission device.

[0170] This embodiment also provides that the first transmission analysis strategy is specifically:

[0171] Get target transmission data and all historical transmission data;

[0172] Extract the data type of the target transmission data and set it as the target type;

[0173] Extract the data type of each historical transmission data and define it as the historical type;

[0174] The historical transmission data with the historical type equal to the target type is defined as the same transmission data;

[0175] If there is the same transmission data, the transmission mode used by each of the same transmission data is obtained and determined as the historical transmission mode;

[0176] Get the habit model;

[0177] Extract the transmission mode corresponding to the target type in the transmission mode set and set it as the reference transmission mode;

[0178] If the historical transmission mode = the reference transmission mode, then the transmission mode selected by the target person for the target transmission data is obtained and determined as the determined transmission mode;

[0179] If the transmission mode is determined to be the historical transmission mode, the transmission mode is determined to be the common mode;

[0180] If the transmission mode is determined to be ≠ the historical transmission mode, the transmission mode is determined to be an uncommon mode;

[0181] If the historical transmission mode ≠ the reference transmission mode, all target analysis modes corresponding to the target type are extracted to form an analysis mode set;

[0182] If the analysis mode set includes the historical transmission mode, the determined transmission mode is obtained;

[0183] If the transmission mode is determined to be the historical transmission mode, the transmission mode is determined to be the common mode;

[0184] If the transmission mode is determined to be ≠ the historical transmission mode, the transmission mode is determined to be an uncommon mode;

[0185] If the analysis mode set does not include the historical transmission mode, obtaining the determined transmission mode;

[0186] If the transmission mode is determined to be the historical transmission mode, the transmission mode is determined to be an uncommon mode, and all operations performed by the target person on the target device are monitored in real time;

[0187] If the determined transmission mode ≠ the historical transmission mode, and the determined transmission mode is not included in the analysis mode set, the transmission mode is determined to be an uncommon mode, and all operations performed by the target person on the target device are monitored in real time;

[0188] If the determined transmission mode ≠ the historical transmission mode, but the determined transmission mode is included in the analysis mode set, then the determined transmission mode is the common mode;

[0189] If there is no identical transmission data, the data analysis strategy is executed.

[0190] The data analysis strategy is specifically as follows:

[0191] Get the habit model;

[0192] Extract reference transmission mode;

[0193] Get the transmission mode of determination;

[0194] If the determined transmission mode = the reference transmission mode, the determined transmission mode is the common mode;

[0195] If the transmission mode is determined to be ≠ the reference transmission mode, then the analysis mode set is extracted;

[0196] If the analysis method set does not include the determined transmission method, the transmission method is determined to be an uncommon method, and all operations performed by the target person on the target device are monitored in real time;

[0197] If the analysis mode set includes the determined transmission mode, the determined transmission mode is the common mode.

[0198] This embodiment also provides that the second transmission analysis strategy is specifically:

[0199] Acquire habit models and goal transfer data;

[0200] Extract target type;

[0201] Get all historical transmission data corresponding to the target type and define it as type transmission data;

[0202] Extract the transmission mode used by each type of transmitted data and define it as the type transmission mode;

[0203] Obtain the number of type transmission data corresponding to each type transmission mode and define it as the usage number;

[0204] All types of transmission methods are sorted into a usage order set from large to small according to the number of usage;

[0205] If the usage order set contains the reference transmission mode, the first element in the usage order set is extracted and determined as the common transmission mode;

[0206] If the reference transmission mode = the commonly used transmission mode, the commonly used transmission mode is identified as the comparison transmission mode;

[0207] If the reference transmission mode ≠ the commonly used transmission mode, the reference transmission mode is identified as the comparison transmission mode;

[0208] If the determined transmission mode = the compared transmission mode, the determined transmission mode is the common mode;

[0209] If it is determined that the transmission mode is ≠ the comparison transmission mode, the transmission mode is determined to be an uncommon mode, and all operations performed by the target person on the target device are monitored in real time;

[0210] If the usage order set does not contain the reference transmission method, the analysis method set is extracted;

[0211] The type of transmission method that exists in both the extraction analysis method set and the usage order set is identified as the comparative transmission method;

[0212] If the determined transmission mode = the compared transmission mode, the determined transmission mode is the common mode;

[0213] If it is determined that the transmission mode ≠ the comparison transmission mode, the transmission mode is determined to be an uncommon mode, and all operations performed by the target person on the target device are monitored in real time.

[0214] This embodiment also provides that the process analysis strategy is specifically:

[0215] Obtaining a use determination result of a transmission method;

[0216] If the transmission mode is determined to be a common mode, obtaining the transmission mode;

[0217] Acquire habit models and goal transfer data;

[0218] Extract the target execution process corresponding to the transmission mode in the transmission process set and set it as the reference query process;

[0219] Extract the query process used by the target personnel to determine the transmission method, and define it as the determination query process;

[0220] If the query process is determined to be the comparison query process, the data analysis is performed by the person himself;

[0221] If the query process is determined to be ≠ the comparison query process, it is determined that the person analyzing the data is someone else's operation, and all operations performed by the target person on the target device are monitored in real time

[0222] If the transmission method is determined to be an unusual method, the personnel will analyze the data and determine that it is operated by someone else, and monitor all operations performed by the target person on the target device in real time.

[0223] Embodiment 4: This embodiment is an improvement made on the basis of Embodiment 3. In this embodiment, the secure transmission strategy is specifically as follows:

[0224] Get target transmission data;

[0225] Set the transmission password and set it as the target password;

[0226] Obtain the transmission password input by the target person and set it as the determination password;

[0227] If the password is determined to be equal to the target password, the target transmission data is transmitted from the target device to the target transmission device;

[0228] If the password is determined to be ≠ the target password, the encryption tool is obtained;

[0229] The encryption tool extracts the format data of the target transmission data;

[0230] According to the format data of the target transmission data, the encryption tool automatically generates new transmission data at random and defines it as encrypted transmission data;

[0231] The encrypted transmission data is transmitted from the target device to the target transmission device.

[0232] In this embodiment, based on the usage habits of the device owner, it is determined whether the person currently performing the data transmission operation is the device owner himself. Based on the transmission and receiving devices corresponding to the historical transmission data and the transmission and receiving devices corresponding to the current transmission data, it is determined whether the person currently performing the data transmission operation is the device owner himself. Based on the transmission method and query process corresponding to the historical transmission data and the transmission method and query process corresponding to the current transmission data, it is determined whether the person currently performing the data transmission operation is the device owner himself, thereby reducing the possibility of data being stolen by others, avoiding data leakage, and reducing the security risks of personal data privacy.

Claims

1. A computer information security management method, characterized by: include: Obtaining a target device, target transmission data, and a target transmission device; Obtain a habit model of the target device; Get historical transmission records; The historical transmission record includes historical transmission data and historical transmission equipment; According to the historical transmission equipment and the target transmission equipment, the equipment analysis strategy is used to form equipment analysis data; The device analysis data includes historical devices and newly transmitted devices; If the device analysis data is a historical device, executing a first transmission analysis strategy to form first transmission analysis data; If the device analysis data is a new transmission device, a second transmission analysis strategy is executed to form second transmission analysis data; According to the first transmission analysis data or the second transmission analysis data, combined with the habit model, the process analysis strategy is executed to form personnel analysis data; The personnel analysis data includes the operations of the individual and others; If the personnel analyzing the data is operated by themselves, the target transmission data is transmitted from the target device to the target transmission device; If the personnel analysis data is operated by others, the security transmission strategy is implemented to form secure transmission data; The target transmission data is transmitted from the target device to the target transmission device according to the secure transmission data.

2. The computer information security management method according to claim 1, characterized in that: The acquiring the habit model of the target device includes generating a transmission habit model, specifically: Set the collection start time and collection end time; The model collection period is formed by taking the collection start time as the starting time and the collection end time as the ending time; Acquire the transmission operation of the target person within the model collection period, wherein the transmission operation includes transmission operation; Extract all transmission data corresponding to the transmission operation to form a transmission data set; Extracting the data type of each transmission data in the transmission data set; The data type of each transmission data is matched one by one with each element in the transmission data set to form a data type set; Identify each data type as the target analysis type in turn and execute A1-A4; Extract the target usage corresponding to each data type; The target usage mode corresponding to each data type is matched one by one with each element in the data type set to form a transmission mode set; The execution of A1-A4 is specifically as follows: A1. extract all transmission data corresponding to the target analysis type in the data type set and define them as target analysis data; A2. Obtain the transmission mode of each target transmission data and set it as the target analysis mode; A3. Obtain the number of target transmission data corresponding to each target analysis method, and define it as the number of times used; A4. Extract the target analysis method that is used most frequently and set it as the target usage method.

3. The computer information security management method according to claim 2 is characterized in that: The acquiring the habit model of the target device also includes generating a query habit model, specifically: Get the model collection period; Acquire the transmission operation of the target person within the model collection period, wherein the transmission operation includes a query operation; Extract all transmission modes corresponding to the query operation; Identify each transmission mode as the analysis transmission mode in turn and execute B1-B6; Get the transmission mode set; The target execution process corresponding to each transmission mode is matched one by one with each element in the transmission mode set to form a transmission process set; The execution of B1-B6 is specifically as follows: B1. Obtain all query processes corresponding to the analysis transmission mode, wherein the query process includes a first process and a second process; B2. Extract the number of transmission modes searched and analyzed using the first process, and define it as the first search number; B3, extracting the number of transmission modes searched and analyzed using the second process, and setting it as the second search number; B4. If the first search quantity is greater than the second search quantity, the first process is set as the target execution process; B5. If the first search quantity is less than the second search quantity, the second process is set as the target execution process; B6. If the first search quantity = the second search quantity, then either the first process or the second process is arbitrarily extracted and determined as the target execution process.

4. The computer information security management method according to claim 1, characterized in that: The device analysis strategy is specifically: Obtain all historical transmission devices to form a historical device set; Get the target transmission device; If the target transmission device is included in the historical device set, the device analysis data is determined to be a historical device; If the target transmission device is not included in the historical device set, the device analysis data is determined to be a new transmission device.

5. The computer information security management method according to claim 1, characterized in that: The first transmission analysis strategy is specifically: Get target transmission data and all historical transmission data; Extract the data type of the target transmission data and set it as the target type; Extract the data type of each historical transmission data and define it as the historical type; The historical transmission data with the historical type equal to the target type is defined as the same transmission data; If there is the same transmission data, the transmission mode used by each of the same transmission data is obtained and determined as the historical transmission mode; Get the habit model; Extract the transmission mode corresponding to the target type in the transmission mode set and set it as the reference transmission mode; If the historical transmission mode = the reference transmission mode, then the transmission mode selected by the target person for the target transmission data is obtained and determined as the determined transmission mode; If the transmission mode is determined to be the historical transmission mode, the transmission mode is determined to be the common mode; If the transmission mode is determined to be ≠ the historical transmission mode, the transmission mode is determined to be an uncommon mode; If the historical transmission mode ≠ the reference transmission mode, all target analysis modes corresponding to the target type are extracted to form an analysis mode set; If the analysis mode set includes the historical transmission mode, the determined transmission mode is obtained; If the transmission mode is determined to be the historical transmission mode, the transmission mode is determined to be the common mode; If the transmission mode is determined to be ≠ the historical transmission mode, the transmission mode is determined to be an uncommon mode; If the analysis mode set does not include the historical transmission mode, obtaining the determined transmission mode; If the transmission mode is determined to be the historical transmission mode, the transmission mode is determined to be an uncommon mode, and all operations performed by the target person on the target device are monitored in real time; If the determined transmission mode ≠ the historical transmission mode, and the determined transmission mode is not included in the analysis mode set, the transmission mode is determined to be an uncommon mode, and all operations performed by the target person on the target device are monitored in real time; If the determined transmission mode ≠ the historical transmission mode, but the determined transmission mode is included in the analysis mode set, then the determined transmission mode is the common mode; If there is no identical transmission data, the data analysis strategy is executed.

6. The computer information security management method according to claim 5 is characterized in that: The data analysis strategy is specifically as follows: Get the habit model; Extract reference transmission mode; Get the transmission mode of determination; If the determined transmission mode = the reference transmission mode, the determined transmission mode is the common mode; If the transmission mode is determined to be ≠ the reference transmission mode, then the analysis mode set is extracted; If the analysis method set does not include the determined transmission method, the transmission method is determined to be an uncommon method, and all operations performed by the target person on the target device are monitored in real time; If the analysis mode set includes the determined transmission mode, the determined transmission mode is the common mode.

7. The computer information security management method according to claim 1 is characterized in that: The second transmission analysis strategy is specifically: Acquire habit models and goal transfer data; Extract target type; Get all historical transmission data corresponding to the target type and define it as type transmission data; Extract the transmission mode used by each type of transmitted data and define it as the type transmission mode; Obtain the number of type transmission data corresponding to each type transmission mode and define it as the usage number; All types of transmission methods are sorted into a usage order set from large to small according to the number of usage; If the usage order set contains the reference transmission mode, the first element in the usage order set is extracted and determined as the common transmission mode; If the reference transmission mode = the commonly used transmission mode, the commonly used transmission mode is identified as the comparison transmission mode; If the reference transmission mode ≠ the commonly used transmission mode, the reference transmission mode is identified as the comparison transmission mode; If the determined transmission mode = the compared transmission mode, the determined transmission mode is the common mode; If it is determined that the transmission mode is ≠ the comparison transmission mode, the transmission mode is determined to be an uncommon mode, and all operations performed by the target person on the target device are monitored in real time; If the usage order set does not contain the reference transmission method, the analysis method set is extracted; The type of transmission method that exists in both the extraction analysis method set and the usage order set is identified as the comparative transmission method; If the determined transmission mode = the compared transmission mode, the determined transmission mode is the common mode; If it is determined that the transmission mode ≠ the comparison transmission mode, the transmission mode is determined to be an uncommon mode, and all operations performed by the target person on the target device are monitored in real time.

8. The computer information security management method according to claim 1 is characterized in that: The process analysis strategy is specifically: Obtaining a use determination result of a transmission method; If the transmission mode is determined to be a common mode, obtaining the transmission mode; Acquire habit models and goal transfer data; Extract the target execution process corresponding to the transmission mode in the transmission process set and set it as the reference query process; Extract the query process used by the target personnel to determine the transmission method, and define it as the determination query process; If the query process is determined to be the comparison query process, the data analysis is performed by the person himself; If the query process is determined to be ≠ the comparison query process, it is determined that the person analyzing the data is someone else's operation, and all operations performed by the target person on the target device are monitored in real time If the transmission method is determined to be an unusual method, the personnel will analyze the data and determine that it is operated by someone else, and monitor all operations performed by the target person on the target device in real time.

9. The computer information security management method according to claim 1, characterized in that: The secure transmission strategy is specifically: Get target transmission data; Set the transmission password and set it as the target password; Obtain the transmission password input by the target person and set it as the determination password; If the password is determined to be equal to the target password, the target transmission data is transmitted from the target device to the target transmission device; If the password is determined to be ≠ the target password, the encryption tool is obtained; The encryption tool extracts the format data of the target transmission data; According to the format data of the target transmission data, the encryption tool automatically generates new transmission data at random and defines it as encrypted transmission data; The encrypted transmission data is transmitted from the target device to the target transmission device.

Images