Computer file protection method

Abstract

The invention relates to the technical field of computers, and provides a computer file protection method which comprises the following steps: a monitoring and triggering step: monitoring various operation behaviors in a computer system in real time, and triggering a file protection mechanism when a specific operation possibly influencing file security is detected, related operation information and file metadata are transmitted to an analysis processing module; and a permission verification step: after the analysis processing module receives the trigger information, verifying the identity of the operation initiator, judging whether the operation initiator has the permission to execute the operation or not according to a preset user permission rule, and if the permission verification is not passed, stopping the operation and recording related information. By utilizing a system kernel hook technology, all file operations in a computer system are comprehensively captured, and by combining with a machine learning algorithm, the risk of each file operation can be accurately analyzed, potential security threats can be timely found, and security accidents caused by missing report or false report are effectively avoided.

Description

Technical Field

[0001] The present invention relates to the field of computer technology, in particular to a computer file protection method. Background Art

[0002] In today's digital age, computer files have become the main carrier for enterprises, organizations and individuals to store and transmit important information. However, computer systems face many security threats, such as virus infection, malware attack, human error, malicious behavior of insiders and hardware failure. These threats may cause files to be tampered with, deleted, and leaked, causing serious losses to users. For example, a company's commercial confidential files may be stolen by competitors, personal privacy files may be illegally obtained, and damage to important system configuration files may cause the system to crash and fail to operate normally. Therefore, protecting the security, integrity and availability of computer files has become a key task in the field of computer technology.

[0003] At present, there are many shortcomings in the existing computer file protection methods. The traditional permission management method based on access control list (ACL) is relatively simple, easy to be bypassed or tampered, and cannot effectively deal with complex attack methods. Although anti-virus software and firewalls can prevent external virus and malware intrusions to a certain extent, they have limited detection capabilities for malicious operations by internal personnel and new unknown threats. Data backup methods often lack flexibility and timeliness, cannot perform dynamic backup according to real-time changes and risk conditions of files, and may cause data inconsistency or loss of key information when restoring data. In addition, most existing technologies lack the ability to comprehensively monitor file operations and conduct real-time risk assessments, and cannot take effective protection measures in a timely manner at the early stages of threats. Summary of the invention

[0004] In view of the deficiencies in the prior art, the present invention provides a computer file protection method, which ensures the security, integrity and availability of computer files in various complex environments through real-time monitoring of file operation behavior, strict permission verification, accurate risk assessment and flexible protection strategy execution, and effectively prevents various security threats. At the same time, it provides efficient data recovery and auditing functions, which facilitates users to trace and manage all events in the file protection process.

[0005] To achieve the above objectives, the present invention is implemented through the following technical solutions: A computer file protection method comprises the following steps:

[0006] Monitoring triggering step: Real-time monitoring of various operating behaviors in the computer system. When a specific operation that may affect the security of the file is detected, the file protection mechanism is triggered and the relevant operation information and file metadata are transmitted to the analysis and processing module;

[0007] Permission verification step: After receiving the trigger information, the analysis and processing module verifies the identity of the initiator of the operation and determines whether the initiator has the permission to perform the operation according to the preset user permission rules. If the permission verification fails, the operation is blocked and relevant information is recorded;

[0008] Risk assessment step: If the permission verification is passed, the risk value of the operation is calculated through the pre-trained risk assessment model, and further risk assessment is performed on the operation;

[0009] Protection strategy execution steps: Select and execute the corresponding file protection strategy based on the risk assessment results;

[0010] Recovery and audit steps: After the file protection policy is executed, the file system is checked regularly and an audit report is generated to record all operations and events during the file protection process.

[0011] Preferably, the monitoring triggering step utilizes system kernel hook technology to capture underlying operation information to ensure comprehensive monitoring of all file operations, including operations on hidden files and system critical files. The specific operations detected in the monitoring triggering step include file modification, deletion, and access.

[0012] Preferably, the user permission rules in the permission verification step are based on multi-factor authentication, including user role, password strength, access time limit and device fingerprint recognition.

[0013] Preferably, the further risk assessment in the risk assessment step includes the operation type, the importance level of the target file, and the current system environment.

[0014] Preferably, the corresponding file protection policy in the protection policy execution step is:

[0015] If the risk value is low, allow the operation to proceed normally and perform regular logging;

[0016] If the risk value is at a medium level, the operation will be reconfirmed, requiring the user to provide additional verification information, and the level of log record detail will be increased;

[0017] If the risk value is high, the operation is blocked, the file is temporarily locked, and the backup and recovery process is started to back up the file to a safe storage location.

[0018] Preferably, the additional verification information is any one of a password, a verification code, a fingerprint, or a combination of any two of them. The backup data is stored in an encrypted manner, and the encryption algorithm is dynamically selected according to the importance level of the file to ensure the confidentiality and integrity of the backup data.

[0019] Preferably, in the recovery and auditing steps, the audit report adopts a standardized format to facilitate integration with other security management systems, while supporting customized report templates to meet the needs of different users.

[0020] A computer file protection system, comprising:

[0021] Data monitoring module: deeply embedded in the computer operating system kernel through system kernel hook technology, it can capture the underlying information of all file-related operations in the system in real time, and can also monitor system environment information and integrate it into complete operation event data for real-time transmission;

[0022] Permission management module: responsible for managing the permission information of users and user groups, authenticating the initiator of the operation according to the multi-factor authentication rules, and upon receiving the permission verification request from the analysis and processing module, quickly determining whether the operation is allowed according to the preset permission rules, and recording the relevant information to the log management module;

[0023] Risk assessment module: Uses a pre-trained machine learning risk assessment model to perform risk assessment on file operations, where the model's training data comes from a large number of historical file operation records. After receiving the file operation event data transmitted by the analysis and processing module, it comprehensively considers the operation type and calculates the risk value of the operation;

[0024] Policy execution module: selects and executes corresponding file protection policies according to the risk value fed back by the risk assessment module;

[0025] Backup and recovery module: When the policy execution module triggers a backup operation, it selects an appropriate backup strategy based on the importance level and risk status of the file. The backup data is stored in an encrypted manner to ensure the confidentiality and integrity of the backup data during storage and transmission;

[0026] Log management module: Comprehensive and detailed records of all file operation events and related information in the system. Log data is stored in a standardized format and supports custom log report templates. Administrators can generate different types of audit reports based on their needs.

[0027] Preferably, the risk assessment results are as follows:

[0028] When the risk value is low, the file operation is allowed to proceed normally, and the log management module is notified to perform regular log recording;

[0029] When the risk value is at a medium level, a secondary confirmation dialog box pops up to the initiator of the operation, requiring the user to provide additional verification information. After the verification is passed, the operation is allowed to continue. At the same time, the log management module is notified to increase the level of detail of the log record and record the additional verification information provided by the user.

[0030] When the risk value is high, file operations are immediately blocked and the target file is temporarily locked to prevent further damage or tampering. At the same time, the backup and recovery module is started to back up the file to a secure storage location, and the administrator is notified to handle the risk after the backup is completed.

[0031] Preferably, the recorded contents in the log management module include the identity information of the operation initiator, the operation time, the operation type, the operation object, the operation result, the risk assessment result and the protection strategy execution status.

[0032] The present invention provides a computer file protection method, which has the following beneficial effects:

[0033] 1. The present invention realizes the comprehensive capture of all file operations in the computer system by utilizing the system kernel hook technology. Combined with the machine learning algorithm, it can accurately analyze the risk of each file operation, timely discover potential security threats, and effectively avoid security accidents caused by missed reports or false reports.

[0034] 2. The present invention adopts a multi-factor authentication mechanism, which greatly enhances the accuracy and security of user identity authentication. It also supports dynamic permission adjustment and can optimize permission allocation in real time according to changes in enterprise security policies and user behavior, ensuring that only legitimate and authorized users can perform corresponding file operations, effectively reducing the risks brought by illegal operations by internal personnel.

[0035] 3. The present invention realizes the transformation from simple allow / reject operation to dynamic, multi-level protection. For low-risk operations, the system fluency is maintained; for medium-risk operations, additional verification is added to ensure the legality of the operation; for high-risk operations, the files are blocked and backed up in time to protect the file security to the greatest extent. This adaptive policy execution method effectively balances the system performance and file security requirements, and shows high flexibility and effectiveness in dealing with complex and changing security threats. BRIEF DESCRIPTION OF THE DRAWINGS

[0036] Figure 1 It is a flow chart of the present invention. DETAILED DESCRIPTION

[0037] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0038] Example:

[0039] As one aspect of the present invention, an embodiment of the present invention provides a computer file protection system, including:

[0040] Data monitoring module: deeply embedded in the computer operating system kernel through system kernel hook technology, it captures the underlying information of all file-related operations in the system in real time, including file creation, modification, deletion, reading, writing and other operations, as well as detailed data such as the process information of the operation initiator, operation time, and operation object (file path, name, etc.). At the same time, it can monitor system environment information, such as the current network connection status, system resource usage, whether there are abnormal processes, etc., integrate this information into complete operation event data, and transmit it to the subsequent analysis and processing module in real time; it has a high degree of system compatibility and can be applied to different versions of mainstream operating systems such as Windows, Linux, Mac, etc.; it adopts efficient data capture algorithms to ensure comprehensive and real-time monitoring of file operations without affecting system performance, and can also accurately capture operations on hidden files and system key files.

[0041] Permission management module: responsible for managing the permission information of users and user groups, and authenticating the initiator of the operation according to the multi-factor authentication rules. Multi-factor authentication includes but is not limited to user roles (administrators, ordinary users, visitors, etc.), password strength (password length, complexity, password history, etc.), access time restrictions (allowing or prohibiting access to certain files within a specific time period), and device fingerprint recognition (identifying the hardware characteristics and software environment of the operating device, etc.). When receiving the permission verification request from the analysis and processing module, it quickly determines whether the operation is allowed according to the preset permission rules. If not allowed, it returns the instruction to block the operation to the system and records the relevant information to the log management module; it supports dynamic permission management, and the administrator can adjust the user permissions in real time according to user behavior, security policy changes, etc.; it integrates seamlessly with the company's existing user management system (such as Active Directory, etc.) to achieve unified user identity management and permission allocation; it uses advanced encryption algorithms to store user passwords and permission information to ensure data security.

[0042] Risk assessment module: Use pre-trained machine learning risk assessment models to conduct risk assessment on file operations. The training data of the model comes from a large number of historical file operation records (including operation data in normal operations and known security events), known security event characteristics (such as typical patterns of file operations in events such as virus attacks and hacker intrusions), and simulated attack scenario data (file operation data generated by simulating various attack methods). After receiving the file operation event data transmitted by the analysis and processing module, the risk value of the operation is calculated by comprehensively considering the operation type (such as modifying system key files, deleting files in batches, and other high-risk operations), the importance level of the target file (pre-set according to factors such as the business field to which the file belongs and data sensitivity), and the current system environment information (such as whether the network is in a high-risk state, whether the system resources are abnormally tight, etc.), and the assessment results are fed back to the analysis and processing module; the model has self-learning capabilities and can continuously optimize the assessment algorithm based on new security events and data to improve the accuracy of risk assessment; it supports real-time risk assessment and can make risk judgments on file operations in a very short time to adapt to the rapidly changing security threat environment; it provides a visual risk assessment report to help administrators intuitively understand the risk distribution of system file operations.

[0043] Policy execution module: selects and executes the corresponding file protection policy based on the risk value fed back by the risk assessment module. When the risk value is low, the file operation is allowed to proceed normally, and the log management module is notified to perform regular log records, including detailed operation information, risk assessment results, etc.; when the risk value is at a medium level, a secondary confirmation dialog box pops up to the initiator of the operation, requiring the user to provide additional verification information (such as password, verification code, dynamic token, etc.). After the verification is passed, the operation is allowed to continue, and the log management module is notified to strengthen the detail of the log record and record the additional verification information provided by the user; when the risk value is high, the file operation is immediately blocked, the target file is temporarily locked to prevent further damage or tampering, and the backup and recovery module is started at the same time to back up the file to a safe storage location (such as an off-site backup server, encrypted storage medium, etc.), and after the backup is completed, the administrator is notified to handle the risk; the policy execution module is highly flexible, and the administrator can customize the protection strategy under different risk levels according to the actual security needs of the enterprise; it is compatible with a variety of encryption algorithms and storage devices, and can select the appropriate encryption method and storage location for backup according to the importance and risk level of the file; it supports both automatic and manual execution modes, and the administrator can manually intervene in the policy execution process in an emergency.

[0044] Backup and recovery module: responsible for the backup and recovery operations of files. When the policy execution module triggers the backup operation, it selects the appropriate backup strategy, such as full backup, incremental backup or differential backup, according to the importance level and risk status of the file. The backup data is stored in an encrypted manner, and the encryption algorithm is dynamically selected according to the importance level of the file (for highly sensitive files, a high-intensity encryption algorithm, such as AES-256, is used) to ensure the confidentiality and integrity of the backup data during storage and transmission. When the system detects that the file is damaged, lost or data recovery is required, the corresponding backup file is retrieved from the backup storage location, decrypted and data recovery operations are performed, and the file is restored to the original location or the specified location, and it is ensured that the restored file is completely consistent with the original file in terms of data integrity and consistency; it supports a variety of backup storage media, including local hard disks, network storage devices (NAS, SAN, etc.), cloud storage services, etc., and can flexibly configure backup storage solutions according to enterprise needs; it has a backup data integrity verification function, and regularly verifies the backup data to ensure the availability of the backup data; it provides rapid recovery capabilities, can complete file recovery operations in the shortest time, and reduce the impact of data loss or damage on the business.

[0045] Log management module: Comprehensive and detailed records of all file operation events and related information in the system. The record content includes the identity information of the operation initiator, operation time, operation type, operation object, operation result, risk assessment result, protection strategy implementation status, etc. Log data is stored in a standardized format to facilitate integration and data sharing with other security management systems (such as SI EM systems, etc.). At the same time, it supports custom log report templates. Administrators can generate different types of audit reports according to needs, such as screening and statistical analysis by time range, by user, by operation type, etc., so as to conduct in-depth analysis and tracking of system file operations and timely discover potential security issues; it has automatic archiving and cleaning functions for log data, and archives or deletes old log data according to preset time periods or log data volume thresholds to ensure the efficient operation of the log management system; it adopts efficient log storage and retrieval technology, which can quickly query and obtain historical log data to meet the log management needs in large-scale data environments; it provides encrypted storage and transmission functions for log data to ensure the security of log information.

[0046] Based on the above-mentioned computer file protection system, as another aspect of the present invention, please refer to the attached Figure 1 , a computer file protection method, comprising the following steps:

[0047] Monitoring triggering steps: using system kernel hook technology to capture the underlying operation information, ensuring comprehensive monitoring of all file operations, including operations on hidden files and system key files, real-time monitoring of various operation behaviors in the computer system, and triggering the file protection mechanism when specific operations that may affect file security (such as file modification, deletion, access, etc.) are detected, and the relevant operation information and file metadata are transmitted to the analysis and processing module;

[0048] Permission verification step: After receiving the trigger information, the analysis and processing module first verifies the identity of the initiator of the operation, and determines whether he has the permission to perform the operation according to the preset user permission rules. If the permission verification fails, the operation is blocked and relevant information is recorded;

[0049] Risk assessment step: If the permission verification is passed, further risk assessment is performed on the operation, taking into account factors such as the operation type, the importance level of the target file, and the current system environment (such as whether there is a risk of network attack, whether the system is stable, etc.), and the risk value of the operation is calculated through a pre-trained risk assessment model;

[0050] Protection strategy execution steps: According to the risk assessment results, select and execute the corresponding file protection strategy. If the risk value is low, allow the operation to proceed normally and perform regular log records; if the risk value is at a medium level, perform a second confirmation on the operation, require the user to provide additional verification information (such as passwords, verification codes, etc.), and strengthen the level of detail of log records; if the risk value is high, block the operation, temporarily lock the file, and start the backup and recovery program to back up the file to a safe storage location. The backup data is stored in an encrypted manner, and the encryption algorithm is dynamically selected according to the importance level of the file to ensure the confidentiality and integrity of the backup data;

[0051] Recovery and audit steps: After the file protection policy is executed, the file system is checked regularly. If files are found to be damaged or lost, recovery operations are performed based on the backup data. At the same time, an audit report is generated to record all operations and events during the file protection process for subsequent analysis and tracking.

[0052] Although embodiments of the present invention have been shown and described, it will be appreciated by those skilled in the art that various changes, modifications, substitutions and variations may be made to the embodiments without departing from the principles and spirit of the present invention, and that the scope of the present invention is defined by the appended claims and their equivalents.

Claims

1. A computer file protection method, characterized in that: The following steps are involved: Monitoring triggering step: Real-time monitoring of various operating behaviors in the computer system. When a specific operation that may affect file security is detected, the file protection mechanism is triggered and the relevant operation information and file metadata are transmitted to the analysis and processing module; Permission verification step: After receiving the trigger information, the analysis and processing module verifies the identity of the initiator of the operation and determines whether the initiator has the permission to perform the operation according to the preset user permission rules. If the permission verification fails, the operation is blocked and relevant information is recorded; Risk assessment step: If the permission verification is passed, the risk value of the operation is calculated through the pre-trained risk assessment model, and further risk assessment is performed on the operation; Protection strategy execution steps: Select and execute the corresponding file protection strategy based on the risk assessment results; Recovery and audit steps: After the file protection policy is executed, the file system is checked regularly and an audit report is generated to record all operations and events during the file protection process.

2. A computer file protection method according to claim 1, characterized in that: The monitoring triggering step uses system kernel hook technology to capture underlying operation information to ensure comprehensive monitoring of all file operations, including operations on hidden files and system key files. The specific operations detected in the monitoring triggering step include file modification, deletion, and access.

3. A computer file protection method according to claim 1, characterized in that: The user permission rules in the permission verification step are based on multi-factor authentication, including user role, password strength, access time limit and device fingerprint recognition.

4. A computer file protection method according to claim 1, characterized in that: The further risk assessment in the risk assessment step includes the operation type, the importance level of the target file, and the current system environment.

5. A computer file protection method according to claim 1, characterized in that: The corresponding file protection strategy in the protection strategy execution step is: If the risk value is low, allow the operation to proceed normally and perform regular logging; If the risk value is at a medium level, the operation will be reconfirmed, requiring the user to provide additional verification information, and the level of log record detail will be increased; If the risk value is high, the operation is blocked, the file is temporarily locked, and the backup and recovery process is started to back up the file to a safe storage location.

6. A computer file protection method according to claim 5, characterized in that: The additional verification information is any one of a password, a verification code, and a fingerprint, or a combination of any two of them. The backup data is stored in an encrypted manner, and the encryption algorithm is dynamically selected according to the importance level of the file to ensure the confidentiality and integrity of the backup data.

7. A computer file protection method according to claim 1, characterized in that: In the recovery and auditing steps, the audit report adopts a standardized format to facilitate integration with other security management systems, and supports customized report templates to meet the needs of different users.

8. A computer file protection system, using a computer file protection method as claimed in any one of claims 1 to 7, characterized in that: include: Data monitoring module: deeply embedded in the computer operating system kernel through system kernel hook technology, it can capture the underlying information of all file-related operations in the system in real time, and can also monitor system environment information and integrate it into complete operation event data for real-time transmission; Permission management module: responsible for managing the permission information of users and user groups, authenticating the initiator of the operation according to the multi-factor authentication rules, and upon receiving the permission verification request from the analysis and processing module, quickly determining whether the operation is allowed according to the preset permission rules, and recording the relevant information to the log management module; Risk assessment module: Uses a pre-trained machine learning risk assessment model to perform risk assessment on file operations, where the model's training data comes from a large number of historical file operation records. After receiving the file operation event data transmitted by the analysis and processing module, it comprehensively considers the operation type and calculates the risk value of the operation; Policy execution module: selects and executes corresponding file protection policies according to the risk value fed back by the risk assessment module; Backup and recovery module: When the policy execution module triggers a backup operation, it selects an appropriate backup strategy based on the importance level and risk status of the file. The backup data is stored in an encrypted manner to ensure the confidentiality and integrity of the backup data during storage and transmission; Log management module: Comprehensive and detailed records of all file operation events and related information in the system. Log data is stored in a standardized format and supports custom log report templates. Administrators can generate different types of audit reports based on their needs.

9. A computer file protection system according to claim 8, characterized in that: The risk assessment results are as follows: When the risk value is low, the file operation is allowed to proceed normally, and the log management module is notified to perform regular log recording; When the risk value is at a medium level, a secondary confirmation dialog box pops up to the initiator of the operation, requiring the user to provide additional verification information. After the verification is passed, the operation is allowed to continue. At the same time, the log management module is notified to increase the level of detail of the log record and record the additional verification information provided by the user. When the risk value is high, file operations are immediately blocked and the target file is temporarily locked to prevent further damage or tampering. At the same time, the backup and recovery module is started to back up the file to a secure storage location, and the administrator is notified to handle the risk after the backup is completed.

10. A computer file protection system according to claim 8, characterized in that: The records in the log management module include the identity information of the operation initiator, operation time, operation type, operation object, operation result, risk assessment result and protection strategy execution status.

Images