Data detection method and device, nonvolatile storage medium and electronic equipment

Abstract

The invention discloses a data detection method and device, a nonvolatile storage medium and electronic equipment. The method comprises the steps of obtaining a safety evaluation value of to-be-ferried data; comparing the safety evaluation value of the to-be-ferried data with a preset safety evaluation value, and preliminarily determining an exception type of the to-be-ferried data; according to the exception type, splitting the to-be-ferried data to obtain split to-be-ferried data; encrypting the split to-be-ferried data to obtain encrypted to-be-ferried data; and after transmitting the encrypted to-be-ferried data to the target address, detecting the data received by the target address, and determining the integrity of the to-be-ferried data transmission. According to the invention, the technical problem of low security in the data ferrying process is solved.

Description

Technical Field

[0001] The present invention relates to the technical field of data transmission in an electric power system, and in particular to a data detection method, device, non-volatile storage medium and electronic equipment. Background Art

[0002] Data ferrying refers to the process of transferring data from one place to another, usually between different systems, platforms or applications. Data ferrying includes operations such as data import, export, synchronization, and transmission. During the data ferrying process, due to low security of the transmission channel and malware attacks, the data to be ferryed may be tampered with or invaded by viruses before and during the ferrying process, resulting in security issues such as inconsistency between the data received by the target system and the data to be ferryed.

[0003] To address the above-mentioned problems, no effective solution has been proposed yet. Summary of the invention

[0004] The embodiments of the present invention provide a data detection method, device, non-volatile storage medium and electronic device to at least solve the technical problem of low security in the data ferrying process.

[0005] According to one aspect of an embodiment of the present invention, a data detection method is provided, including: obtaining a security evaluation value of data to be ferryed; comparing the security evaluation value of the data to be ferryed with a preset security evaluation value to preliminarily determine the type of abnormality existing in the data to be ferryed; splitting the data to be ferryed according to the abnormality type to obtain split data to be ferryed; encrypting the split data to be ferryed to obtain encrypted data to be ferryed; after transmitting the encrypted data to be ferryed to a target address, detecting the data received at the target address to determine the completeness of the transmission of the data to be ferryed.

[0006] Optionally, the security evaluation value of the data to be ferryed is compared with a preset security evaluation value to preliminarily determine the type of anomaly in the data to be ferryed, including: if the security evaluation value of the data to be ferryed is less than the preset security evaluation value, then the anomaly type of the data to be ferryed is preliminarily determined to be data anomaly, wherein data anomaly refers to a situation in which the data in the data to be ferryed has been modified; if the security evaluation value of the data to be ferryed is greater than the preset security evaluation value, then the anomaly type of the data to be ferryed is preliminarily determined to be data intrusion, wherein data intrusion refers to the presence of other data that does not belong to the data to be ferryed in the data to be ferryed.

[0007] Optionally, the data to be ferryed is split according to the anomaly type to obtain the split data to be ferryed, including: when it is preliminarily determined that the anomaly type of the data to be ferryed is data anomaly, the data to be ferryed is compared with historical data of the data to be ferryed to determine the location of the anomaly data, and the data to be ferryed is split according to the location of the anomaly data to obtain the split data to be ferryed; when it is preliminarily determined that the anomaly type of the data to be ferryed is data intrusion, the data to be ferryed is compared with pre-stored virus data to determine the location of the intrusion data, and the data to be ferryed is split according to the location of the intrusion data to obtain the split data to be ferryed.

[0008] Optionally, when it is preliminarily determined that the abnormal type of the data to be ferryed is a data abnormality, the data to be ferryed is compared with the historical data of the data to be ferryed, the location of the abnormal data is determined, and the data to be ferryed is split according to the location of the abnormal data to obtain the split data to be ferryed, including: determining a first similarity between the data to be ferryed and the historical data; when the first similarity is less than a preset first similarity, determining the location of the abnormal data; removing the abnormal data, and splitting the data to be ferryed according to the location of the abnormal data to obtain the split data to be ferryed; when the first similarity is greater than or equal to the preset first similarity, finally determining that there is no abnormal data in the data to be ferryed; and splitting the data to be ferryed based on a preset splitting ratio to obtain the split data to be ferryed.

[0009] Optionally, when it is preliminarily determined that the abnormal type of the data to be ferryed is data intrusion, the data to be ferryed is compared with pre-stored virus data to determine the location of the intrusion data, and the data to be ferryed is split according to the location of the intrusion data to obtain the split data to be ferryed, including: determining the second similarity between the data to be ferryed and the virus data; when the second similarity is greater than a preset second similarity, determining the location of the intrusion data; removing the intrusion data, and splitting the data to be ferryed according to the location of the intrusion data to obtain the split data to be ferryed; when the second similarity is less than or equal to the preset second similarity, finally determining that there is no intrusion data in the data to be ferryed; and splitting the data to be ferryed based on a preset splitting ratio to obtain the split data to be ferryed.

[0010] Optionally, encrypting the split data to be ferryed to obtain encrypted data to be ferryed includes: determining the data types included in the split data to be ferryed; determining the importance of the data type according to the probability of anomalies in the data belonging to the data type; determining the encryption method of the data to be ferryed based on the importance of the data type; and encrypting the data to be ferryed based on the encryption method to obtain encrypted data to be ferryed.

[0011] According to another aspect of an embodiment of the present invention, a data detection device is provided, including: a first acquisition module, used to obtain a security evaluation value of the data to be ferryed; a first comparison module, used to compare the security evaluation value of the data to be ferryed with a preset security evaluation value, and preliminarily determine the type of abnormality existing in the data to be ferryed; a first splitting module, used to split the data to be ferryed according to the abnormality type, to obtain split data to be ferryed; a first encryption module, used to encrypt the split data to be ferryed, to obtain encrypted data to be ferryed; a first detection module, used to detect the data received at the target address after transmitting the encrypted data to be ferryed to the target address, to determine the completeness of the transmission of the data to be ferryed.

[0012] According to another aspect of an embodiment of the present invention, a non-volatile storage medium is provided. The non-volatile storage medium stores a plurality of instructions, and the instructions are suitable for being loaded by a processor and executing any one of the data detection methods.

[0013] According to another aspect of an embodiment of the present invention, there is provided an electronic device, comprising: one or more processors and a memory, the memory being used to store one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors implement any one of the data detection methods.

[0014] According to yet another aspect of an embodiment of the present invention, a computer program product is provided, including a computer program, and when the computer program is executed by a processor, any one of the above data detection methods is implemented.

[0015] In an embodiment of the present invention, a security evaluation value of the data to be ferryed is obtained; the security evaluation value of the data to be ferryed is compared with a preset security evaluation value to preliminarily determine the type of anomaly existing in the data to be ferryed; the data to be ferryed is split according to the anomaly type to obtain split data to be ferryed; the split data to be ferryed is encrypted to obtain encrypted data to be ferryed; after transmitting the encrypted data to be ferryed to a target address, the data received at the target address is detected to determine the completeness of the data transmission to be ferryed, thereby solving the technical problem of low security in the data ferrying process, achieving the purpose of detecting the data to be ferryed, and further achieving the technical effect of improving the security of data ferrying. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] The drawings described herein are used to provide a further understanding of the present invention and constitute a part of this application. The exemplary embodiments of the present invention and their descriptions are used to explain the present invention and do not constitute an improper limitation of the present invention. In the drawings:

[0017] Figure 1 is a flow chart of a data detection method provided according to an embodiment of the present invention;

[0018] Figure 2 is a schematic diagram of a data detection device provided according to an embodiment of the present invention;

[0019] Figure 3 is a schematic diagram of an electronic device provided according to an embodiment of the present invention. DETAILED DESCRIPTION

[0020] In order to enable those skilled in the art to better understand the scheme of the present invention, the technical scheme in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present invention.

[0021] It should be noted that the terms "first", "second", etc. in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units that are clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0022] According to an embodiment of the present invention, a method embodiment of data detection is provided. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and although a logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0023] Figure 1 is a flow chart of a data detection method according to an embodiment of the present invention. Figure 1 As shown, the method comprises the following steps:

[0024] Step S102, obtaining the safety evaluation value of the data to be ferried.

[0025] In this step, data ferrying refers to the process of transferring data from one system or storage location to another system or storage location. Data to be ferryed refers to data that needs to be transferred or moved, usually data that needs to be transferred or synchronized between different systems. Data ferrying is usually used in scenarios such as data migration, data backup, and data synchronization to ensure the consistency and integrity of data between different systems. The security evaluation value can be determined based on the type of data to be ferryed. Specifically, the calculation formula for the security evaluation value of the data to be ferryed is:

[0026] P=β1+β2×x2+β3×x3+…β n × n +ε

[0027] Among them, P represents the safety evaluation value of the data to be ferried, β1 represents the safety value when the type of data to be ferried is one, and β n represents the safety value of each type of data in the data to be ferryed, x n represents the influence coefficient of each type of data in the data to be ferried, ε represents the error term, where n = 1, 2, 3...n. For example, β1 can represent the data type with the largest influence coefficient, such as the number of pictures output by the intelligent security device, with an influence coefficient of 1. The safety value of the data to be ferried output by the intelligent security device is determined based on the number of pictures. β2 to β n It can represent the safety value of other data types except the data type with the largest impact coefficient. n For example, the influence coefficient of temperature data may be 0.2, the influence coefficient of the number of images output by the laser foreign body removal device may be 0.3, the influence coefficient of resistance value may be 0.5, and the influence coefficient of distance value may be 0.1, and there is no specific limitation.

[0028] Step S104, comparing the safety evaluation value of the data to be ferried with a preset safety evaluation value, and preliminarily determining the abnormal type of the data to be ferried.

[0029] In this step, before the data to be ferried is transmitted, there may be abnormalities in the data to be ferried due to various reasons, including but not limited to the following reasons: (1) An error occurs during data entry, such as entering an incorrect value or format, resulting in data abnormality. (2) System failure: A system failure or error occurs, resulting in data abnormality or confusion. (3) Data intrusion: Hackers or malicious attackers invade the system through various means to tamper with data or obtain sensitive information. (4) Data processing error: An error occurs during data processing, resulting in data abnormality or incompleteness. In order to ensure the security of data transmission, before the data is transmitted, the security evaluation value of the data to be ferried can be compared with the preset security evaluation value to determine whether the data to be ferried has abnormalities, and the data to be ferried can be processed differently according to different abnormalities.

[0030] In an optional embodiment, the security evaluation value of the data to be ferryed is compared with a preset security evaluation value to preliminarily determine the type of anomaly in the data to be ferryed, including: if the security evaluation value of the data to be ferryed is less than the preset security evaluation value, then the type of anomaly in the data to be ferryed is preliminarily determined to be data anomaly, wherein data anomaly refers to the situation where the data in the data to be ferryed has been modified; if the security evaluation value of the data to be ferryed is greater than the preset security evaluation value, then the type of anomaly in the data to be ferryed is preliminarily determined to be data intrusion, wherein data intrusion refers to the presence of other data that does not belong to the data to be ferryed in the data to be ferryed.

[0031] Optionally, data anomaly and data intrusion are two types of anomalies of the data to be ferryed, and there is no relationship of inclusion and being included between the two. The security evaluation value of the data to be ferryed is determined by calculation, and the security evaluation value of the data to be ferryed is compared with the preset security evaluation value. If the security evaluation value of the data to be ferryed is less than the preset security evaluation value, it can be preliminarily determined that the type of anomaly existing in the data to be ferryed is data anomaly, that is, the amount of data has not changed, but the numerical size, nature, etc. of the data may change. If the security evaluation value of the data to be ferryed is greater than the preset security evaluation value, it can be preliminarily determined that the type of anomaly existing in the data to be ferryed is data intrusion, such as the data to be ferryed is invaded by a virus, resulting in a change in the amount of data, and other data that does not belong to the data to be ferryed appears in the data to be ferryed. After preliminarily determining the type of data anomaly existing in the data to be ferryed, different treatments can be made to the data to be ferryed according to different anomaly types.

[0032] Step S106, splitting the data to be ferried according to the abnormality type to obtain split data to be ferried.

[0033] After determining the type of anomalies in the data to be ferried, it is necessary to set different splitting ratios according to the abnormal conditions of the data to be ferried, and split the data to be ferried according to different splitting ratios to avoid interference of abnormal conditions on the data to be ferried and ensure the security of transmission of the data to be ferried.

[0034] In an optional embodiment, the data to be ferryed is split according to the anomaly type to obtain the split data to be ferryed, including: when it is preliminarily determined that the anomaly type of the data to be ferryed is data anomaly, the data to be ferryed is compared with historical data of the data to be ferryed to determine the location of the anomaly data, and the data to be ferryed is split according to the location of the anomaly data to obtain the split data to be ferryed; when it is preliminarily determined that the anomaly type of the data to be ferryed is data intrusion, the data to be ferryed is compared with pre-stored virus data to determine the location of the intrusion data, and the data to be ferryed is split according to the location of the intrusion data to obtain the split data to be ferryed.

[0035] Optionally, when data anomalies occur in the data to be ferried, it is necessary to locate the location of the data anomaly points and remove the data anomaly points to ensure the security of the data to be ferried. The method for determining the abnormal data is: compare the data to be ferried with the historical data of the data to be ferried, that is, compare each type of data in the data to be ferried with the historical data of the same type of the data to be ferried. According to the comparison result, the location of the data anomaly points can be determined, the data anomaly points can be removed or shielded, and the data to be ferried can be split at the location where the data anomaly points are removed or shielded. The purpose of removing or shielding the data anomaly points is to make the data anomaly points not be parsed when the encrypted data to be ferried is identified. When data intrusion occurs in the data to be ferried, it is necessary to locate the location of the intrusion data and remove the intrusion data to ensure the security of the data to be ferried. Data intrusion is generally caused by viruses, and the intrusion data is a single data point or a data segment. In order to remove the intrusion data, it is necessary to determine the location of the intrusion data. The method for determining the intrusion data is: compare the data to be ferried with the pre-stored virus data. According to the comparison result, the location of the intrusion data can be determined, the intrusion data can be removed, and the data to be ferried can be split at the location where the intrusion data is removed.

[0036] In an optional embodiment, when it is preliminarily determined that the abnormal type of the data to be ferryed is a data abnormality, the data to be ferryed is compared with the historical data of the data to be ferryed, the location of the abnormal data is determined, and the data to be ferryed is split according to the location of the abnormal data to obtain the split data to be ferryed, including: determining a first similarity between the data to be ferryed and the historical data; when the first similarity is less than a preset first similarity, determining the location of the abnormal data; removing the abnormal data, and splitting the data to be ferryed according to the location of the abnormal data to obtain the split data to be ferryed; when the first similarity is greater than or equal to the preset first similarity, finally determining that there is no abnormal data in the data to be ferryed; and splitting the data to be ferryed based on a preset splitting ratio to obtain the split data to be ferryed.

[0037] Optionally, the data to be ferryed is compared with the historical data of the same type for data anomaly similarity. If the data anomaly similarity is less than a preset similarity, the data to be ferryed is determined to be abnormal and the data anomaly points are determined, and the data to be ferryed is split with the data anomaly points as nodes; if the data anomaly similarity is greater than or equal to the preset similarity, the data to be ferryed is determined to have no anomalies and is split at a preset splitting ratio to parse the data to be ferryed, such as splitting at 5% of the bytes of the data to be ferryed.

[0038] In an optional embodiment, when it is preliminarily determined that the abnormal type of the data to be ferryed is data intrusion, the data to be ferryed is compared with pre-stored virus data to determine the location of the intrusion data, and the data to be ferryed is split according to the location of the intrusion data to obtain the split data to be ferryed, including: determining the second similarity between the data to be ferryed and the virus data; when the second similarity is greater than a preset second similarity, determining the location of the intrusion data; removing the intrusion data, and splitting the data to be ferryed according to the location of the intrusion data to obtain the split data to be ferryed; when the second similarity is less than or equal to the preset second similarity, finally determining that there is no intrusion data in the data to be ferryed; and splitting the data to be ferryed based on a preset splitting ratio to obtain the split data to be ferryed.

[0039] Optionally, the data to be ferried is compared with pre-set virus data for virus data similarity; if the virus data similarity is greater than the preset virus data similarity, it is determined that virus data exists in the data to be ferried and the data segments or data points containing virus data are removed before analyzing the data to be ferried; if the virus data similarity is less than or equal to the preset virus data similarity, it is determined that virus data does not exist in the data to be ferried and the data is split according to a preset split ratio.

[0040] Step S108, encrypting the split data to be ferried to obtain encrypted data to be ferried.

[0041] In this step, in order to protect the privacy and security of the data and prevent the data from being stolen, tampered or tampered with during the transmission process, the data to be ferryed can be encrypted before transmission. The encryption method is: split the data to be ferryed into multiple segments, each segment of data belongs to a different data type, and the importance of each type of data is determined according to the probability of abnormal occurrence of each data type in history. According to the importance of each type of data, the encryption method of each type of data is determined and each type of data is encrypted to obtain the encrypted data.

[0042] In an optional embodiment, the split data to be ferryed are encrypted to obtain encrypted data to be ferryed, including: determining the data types included in the split data to be ferryed; determining the importance of the data type according to the probability of abnormality in the data belonging to the data type; determining the encryption method of the data to be ferryed based on the importance of the data type; and encrypting the data to be ferryed based on the encryption method to obtain encrypted data to be ferryed.

[0043] Optionally, the types of data to be ferried are determined based on the split data to be ferried, and the importance of each type of data to be ferried is determined according to the historical probability of abnormalities in each type of data to be ferried. Specifically, the greater the historical probability of abnormalities, the higher the importance. Several encryption methods are set according to the importance of the types of data to be ferried, and the encryption level of the ferrying data treated by each encryption method is positively correlated with the importance of the type of data to be ferried, that is, the more important the data type, the higher the encryption level.

[0044] Step S110, after the encrypted data to be ferried is transmitted to the target address, the data received by the target address is detected to determine the integrity of the data to be ferried.

[0045] In this step, when the encrypted data to be transmitted arrives at the target address, it is necessary to detect the received data to confirm whether the data has been damaged or tampered with during the transmission process, so as to ensure the integrity and reliability of the data. The method for detecting the received data is: comparing the data received at the target address with the data to be ferryed, determining the integrity of the received data, if the integrity is high, it means that the data transmission is more accurate, if the integrity is low, it means that the data transmission is inaccurate, at this time, the split ratio or the preset security evaluation value can be adjusted to improve the integrity of the data transmission. The specific method of adjusting the split ratio or adjusting the preset security evaluation value can be: if the data transmission integrity is greater than or equal to the preset data transmission integrity of 98%, then it is determined that the data ferrying process meets the preset standard; if the data transmission integrity is less than the preset data transmission integrity of 98%, then it is determined that the data ferrying process does not meet the preset standard and the adjustment method for the data to be ferryed is determined based on the data transmission integrity difference. Specifically, under the condition that the data integrity difference is less than or equal to the preset data integrity difference of 3%, several adjustment methods are set for the split ratio of the data to be ferryed, and each adjustment method has a different adjustment range for the split ratio of the data to be ferryed. If the data integrity difference is less than or equal to the first preset data integrity difference of 3% and greater than the second preset data integrity difference of 2%, the first split ratio correction coefficient of 1.2 is used to correct the preset split ratio. If the data integrity difference is less than or equal to the second preset data integrity difference of 2% and greater than the third preset data integrity difference of 0, the first split ratio correction coefficient of 1.05 is used to correct the preset split ratio. If the data integrity difference is greater than the first preset data integrity difference of 3% and less than or equal to the fourth preset data integrity difference of 5%, the first security evaluation value correction coefficient of 1.1 is used to correct the preset security evaluation value; if the data integrity difference is greater than the fourth preset data integrity difference of 5%, the second security evaluation value correction coefficient of 1.15 is used to correct the preset security evaluation value.

[0046] The above method obtains the security evaluation value of the data to be ferryed; compares the security evaluation value of the data to be ferryed with the preset security evaluation value to preliminarily determine the type of anomalies in the data to be ferryed; splits the data to be ferryed according to the anomaly type to obtain split data to be ferryed; encrypts the split data to be ferryed to obtain encrypted data to be ferryed; after transmitting the encrypted data to be ferryed to the target address, detects the data received by the target address to determine the integrity of the data transmission to be ferryed. The technical problem of low security in the data ferrying process is solved, the purpose of detecting the data to be ferryed is achieved, and the technical effect of improving the security of data ferrying is achieved.

[0047] Based on the above embodiments and optional embodiments, the present invention proposes an optional implementation mode:

[0048] Step S1, obtaining the safety evaluation value of the data to be ferried.

[0049] Optionally, the calculation formula for the safety evaluation value of the data to be ferryed is:

[0050] P=β1+β2×x2+β3×x3+…β n × n +ε

[0051] Among them, P represents the safety evaluation value of the data to be ferried, β1 represents the safety value when the type of data to be ferried is one, and β n represents the safety value of each type of data in the data to be ferryed, x n represents the influence coefficient of each type of data in the data to be ferried, ε represents the error term, where n = 1, 2, 3...n. For example, β1 can represent the data type with the largest influence coefficient, such as the number of pictures output by the intelligent security device, with an influence coefficient of 1. The safety value of the data to be ferried output by the intelligent security device is determined based on the number of pictures. β2 to β n It can represent the safety value of other data types except the data type with the largest impact coefficient. n For example, the influence coefficient of temperature data may be 0.2, the influence coefficient of the number of images output by the laser foreign body removal device may be 0.3, the influence coefficient of resistance value may be 0.5, and the influence coefficient of distance value may be 0.1, and there is no specific limitation.

[0052] Step S2, comparing the security evaluation value of the data to be ferryed with the preset security evaluation value, and preliminarily determining the type of anomaly in the data to be ferryed, including: if the security evaluation value of the data to be ferryed is less than the preset security evaluation value, then preliminarily determining the type of anomaly in the data to be ferryed is data anomaly, wherein data anomaly refers to the situation where the data in the data to be ferryed has been modified; if the security evaluation value of the data to be ferryed is greater than the preset security evaluation value, then preliminarily determining the type of anomaly in the data to be ferryed is data intrusion, wherein data intrusion refers to the presence of other data that does not belong to the data to be ferryed in the data to be ferryed.

[0053] Optionally, data anomaly and data intrusion are two types of anomalies of the data to be ferryed, and there is no relationship of inclusion and being included between the two. The security evaluation value of the data to be ferryed is determined by calculation, and the security evaluation value of the data to be ferryed is compared with the preset security evaluation value. If the security evaluation value of the data to be ferryed is less than the preset security evaluation value, it can be preliminarily determined that the type of anomaly existing in the data to be ferryed is data anomaly, that is, the amount of data has not changed, but the numerical size, nature, etc. of the data will change. If the security evaluation value of the data to be ferryed is greater than the preset security evaluation value, it can be preliminarily determined that the type of anomaly existing in the data to be ferryed is data intrusion, such as the data to be ferryed is invaded by a virus, resulting in a change in the amount of data, and other data that does not belong to the data to be ferryed appears in the data to be ferryed, etc. After preliminarily determining the type of data anomaly existing in the data to be ferryed, different treatments can be made for the data to be ferryed according to different anomaly types.

[0054] Step S3, splitting the data to be ferryed according to the anomaly type to obtain the split data to be ferryed, including: when it is preliminarily determined that the anomaly type of the data to be ferryed is data anomaly, comparing the data to be ferryed with historical data of the data to be ferryed to determine the location of the anomaly data, and splitting the data to be ferryed according to the location of the anomaly data to obtain the split data to be ferryed; when it is preliminarily determined that the anomaly type of the data to be ferryed is data intrusion, comparing the data to be ferryed with pre-stored virus data to determine the location of the intrusion data, and splitting the data to be ferryed according to the location of the intrusion data to obtain the split data to be ferryed.

[0055] Optionally, when data anomalies occur in the data to be ferried, it is necessary to locate the location of the data anomaly points and remove the data anomaly points to ensure the security of the data to be ferried. The method for determining the abnormal data is: compare the data to be ferried with the historical data of the data to be ferried, that is, compare each type of data in the data to be ferried with the historical data of the same type of the data to be ferried. According to the comparison result, the location of the data anomaly points can be determined, the data anomaly points can be removed or shielded, and the data to be ferried can be split at the location where the data anomaly points are removed or shielded. The purpose of removing or shielding the data anomaly points is to make the data anomaly points not be parsed when the encrypted data to be ferried is identified. When data intrusion occurs in the data to be ferried, it is necessary to locate the location of the intrusion data and remove the intrusion data to ensure the security of the data to be ferried. Data intrusion is generally caused by viruses, and the intrusion data is a single data point or a data segment. In order to remove the intrusion data, it is necessary to determine the location of the intrusion data. The method for determining the intrusion data is: compare the data to be ferried with the pre-stored virus data. According to the comparison result, the location of the intrusion data can be determined, the intrusion data can be removed, and the data to be ferried can be split at the location where the intrusion data is removed.

[0056] Step S31, when it is preliminarily determined that the abnormal type of the data to be ferryed is a data abnormality, the data to be ferryed is compared with the historical data of the data to be ferryed, the location of the abnormal data is determined, and the data to be ferryed is split according to the location of the abnormal data to obtain the split data to be ferryed, including: determining a first similarity between the data to be ferryed and the historical data; when the first similarity is less than a preset first similarity, determining the location of the abnormal data; removing the abnormal data, and splitting the data to be ferryed according to the location of the abnormal data to obtain the split data to be ferryed; when the first similarity is greater than or equal to the preset first similarity, finally determining that there is no abnormal data in the data to be ferryed; and splitting the data to be ferryed based on a preset splitting ratio to obtain the split data to be ferryed.

[0057] Optionally, the data to be ferryed is compared with the historical data of the same type for data anomaly similarity. If the data anomaly similarity is less than a preset similarity, the data to be ferryed is determined to be abnormal and the data anomaly points are determined, and the data to be ferryed is split with the data anomaly points as nodes; if the data anomaly similarity is greater than or equal to the preset similarity, the data to be ferryed is determined to have no anomalies and is split at a preset splitting ratio to parse the data to be ferryed, such as splitting at 5% of the bytes of the data to be ferryed.

[0058] Step S32, when it is preliminarily determined that the abnormal type of the data to be ferryed is data intrusion, the data to be ferryed is compared with the pre-stored virus data to determine the location of the intrusion data, and the data to be ferryed is split according to the location of the intrusion data to obtain the split data to be ferryed, including: determining the second similarity between the data to be ferryed and the virus data; when the second similarity is greater than a preset second similarity, determining the location of the intrusion data; removing the intrusion data, and splitting the data to be ferryed according to the location of the intrusion data to obtain the split data to be ferryed; when the second similarity is less than or equal to the preset second similarity, finally determining that there is no intrusion data in the data to be ferryed; and splitting the data to be ferryed based on a preset splitting ratio to obtain the split data to be ferryed.

[0059] Optionally, the data to be ferried is compared with pre-set virus data for virus data similarity; if the virus data similarity is greater than the preset virus data similarity, it is determined that virus data exists in the data to be ferried and the data segments or data points containing virus data are removed before analyzing the data to be ferried; if the virus data similarity is less than or equal to the preset virus data similarity, it is determined that virus data does not exist in the data to be ferried and the data is split according to a preset split ratio.

[0060] Step S4, encrypting the split data to be ferryed to obtain encrypted data to be ferryed, including: determining the data types included in the split data to be ferryed; determining the importance of the data type according to the probability of abnormality in the data belonging to the data type; determining the encryption method of the data to be ferryed based on the importance of the data type; encrypting the data to be ferryed based on the encryption method to obtain encrypted data to be ferryed.

[0061] Optionally, the types of data to be ferried are determined based on the split data to be ferried, and the importance of each type of data to be ferried is determined according to the historical probability of abnormalities in each type of data to be ferried. Specifically, the greater the historical probability of abnormalities, the higher the importance. Several encryption methods are set according to the importance of the types of data to be ferried, and the encryption level of the ferrying data treated by each encryption method is positively correlated with the importance of the type of data to be ferried, that is, the more important the data type, the higher the encryption level.

[0062] Step S5, after transmitting the encrypted data to be ferried to the target address, the data received by the target address is detected to determine the integrity of the data transmission to be ferried.

[0063] Optionally, when the encrypted data to be transmitted arrives at the target address, it is necessary to detect the received data to confirm whether the data has been damaged or tampered with during the transmission process, so as to ensure the integrity and reliability of the data. The method for detecting the received data is: comparing the data received at the target address with the data to be ferried, and determining the integrity of the received data. If the integrity is high, it means that the data transmission is more accurate. If the integrity is low, it means that the data transmission is inaccurate. At this time, the integrity of the data transmission can be improved by adjusting the split ratio or adjusting the preset security evaluation value. The specific method of adjusting the split ratio or adjusting the preset security evaluation value can be: if the data transmission integrity is greater than or equal to the preset data transmission integrity of 98%, it is determined that the data ferrying process meets the preset standard; if the data transmission integrity is less than the preset data transmission integrity of 98%, it is determined that the data ferrying process does not meet the preset standard and the adjustment method for the data to be ferried is determined based on the data transmission integrity difference. Specifically, under the condition that the data integrity difference is less than or equal to the preset data integrity difference of 3%, several adjustment methods are set for the split ratio of the data to be ferried, and each adjustment method has a different adjustment range for the split ratio of the data to be ferried. If the data integrity difference is less than or equal to the first preset data integrity difference of 3% and greater than the second preset data integrity difference of 2%, the first split ratio correction coefficient of 1.2 is used to correct the preset split ratio. If the data integrity difference is less than or equal to the second preset data integrity difference of 2% and greater than the third preset data integrity difference of 0, the first split ratio correction coefficient of 1.05 is used to correct the preset split ratio. If the data integrity difference is greater than the first preset data integrity difference of 3% and less than or equal to the fourth preset data integrity difference of 5%, the first security evaluation value correction coefficient of 1.1 is used to correct the preset security evaluation value; if the data integrity difference is greater than the fourth preset data integrity difference of 5%, the second security evaluation value correction coefficient of 1.15 is used to correct the preset security evaluation value.

[0064] The above optional implementation achieves at least the following effects: solving the technical problem of low security in the data ferrying process, achieving the purpose of detecting the ferrying data, and thus achieving the technical effect of improving the security of data ferrying.

[0065] It should be noted that the steps shown in the flowcharts of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and that, although a logical order is shown in the flowcharts, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0066] In the present embodiment, a data detection device is also provided, which is used to implement the above-mentioned embodiments and preferred implementation modes, and the descriptions that have been made will not be repeated. As used below, the terms "module" and "device" can implement a combination of software and / or hardware of a predetermined function. Although the devices described in the following embodiments are preferably implemented in software, the implementation of hardware, or a combination of software and hardware is also possible and conceived.

[0067] According to an embodiment of the present invention, a device embodiment for implementing the data detection method is also provided. Figure 2 is a schematic diagram of a data detection device according to an embodiment of the present invention. Figure 2 As shown, the above-mentioned data detection device includes a first acquisition module 21, a first comparison module 22, a first splitting module 23, a first encryption module 24, and a first detection module 25. The device is described below.

[0068] The first acquisition module 21 is used to obtain the safety evaluation value of the data to be ferried;

[0069] A first comparison module 22, connected to the first acquisition module 21, is used to compare the safety evaluation value of the data to be ferried with a preset safety evaluation value, and preliminarily determine the type of abnormality existing in the data to be ferried;

[0070] The first splitting module 23 is connected to the first comparing module 22 and is used to split the data to be ferryed according to the abnormality type to obtain the split data to be ferryed;

[0071] The first encryption module 24 is connected to the first splitting module 23 and is used to encrypt the split data to be ferryed to obtain encrypted data to be ferryed;

[0072] The first detection module 25 is connected to the first encryption module 24, and is used for detecting the data received by the target address after the encrypted data to be ferried is transmitted to the target address, so as to determine the integrity of the data to be ferried.

[0073] In a data detection device provided by an embodiment of the present invention, a first acquisition module is set to obtain the security evaluation value of the data to be ferried; a first comparison module is used to compare the security evaluation value of the data to be ferried with a preset security evaluation value to preliminarily determine the abnormal type of the data to be ferried; a first splitting module is used to split the data to be ferried according to the abnormal type to obtain the split data to be ferried; a first encryption module is used to encrypt the split data to be ferried to obtain encrypted data to be ferried; a first detection module is used to detect the data received by the target address after transmitting the encrypted data to be ferried to the target address to determine the integrity of the data transmission to be ferried. The technical problem of low security in the data ferrying process is solved, the purpose of detecting the data to be ferried is achieved, and the technical effect of improving the security of data ferrying is achieved.

[0074] It should be noted that the above modules can be implemented by software or hardware. For example, for the latter, it can be implemented in the following ways: the above modules can be located in the same processor; or the above modules can be located in different processors in any combination.

[0075] It should be noted that the first acquisition module 21, the first comparison module 22, the first splitting module 23, the first encryption module 24, and the first detection module 25 correspond to steps S102 to S110 in the embodiment, and the examples and application scenarios implemented by the modules and the corresponding steps are the same, but are not limited to the contents disclosed in the above embodiments. It should be noted that the modules as part of the device can be run in a computer terminal.

[0076] It should be noted that the optional or preferred implementation of this embodiment can refer to the relevant description in the embodiment, which will not be repeated here.

[0077] The above-mentioned data detection device may also include a processor and a memory. The first acquisition module 21, the first comparison module 22, the first splitting module 23, the first encryption module 24, the first detection module 25, etc. are all stored in the memory as program units, and the processor executes the above-mentioned program units stored in the memory to realize the corresponding functions.

[0078] The processor includes a kernel, which retrieves the corresponding program unit from the memory. There can be one or more kernels. The memory may include non-permanent memory in a computer-readable medium, random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM, and the memory includes at least one storage chip.

[0079] An embodiment of the present invention provides a non-volatile storage medium on which a program is stored. When the program is executed by a processor, a data detection method is implemented.

[0080] like Figure 3 As shown, an embodiment of the present invention provides an electronic device, the electronic device 10 includes a processor, a memory, and a program stored in the memory and executable on the processor. When the processor executes the program, the following steps are implemented: the memory is used to store a computer program, wherein when the computer program is executed by the processor, the processor implements the above-mentioned data detection method. The device in this article may be a server, a PC, etc.

[0081] The present invention also provides a computer program product, which, when executed on a data processing device, is suitable for executing a program initialized with the following method steps: computer instructions are used by a processor to execute the above-mentioned data detection method.

[0082] It will be appreciated by those skilled in the art that embodiments of the present invention may be provided as methods, systems, or computer program products. Therefore, the present invention may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0083] The present invention is described with reference to flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0084] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0085] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0086] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0087] The memory may include non-permanent memory in a computer-readable medium, random access memory (RAM) and / or non-volatile memory in the form of read-only memory (ROM) or flash RAM. The memory is an example of a computer-readable medium.

[0088] Computer readable media include permanent and non-permanent, removable and non-removable media that can be implemented by any method or technology to store information. Information can be computer readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disk read-only memory (CD-ROM), digital versatile disk (DVD) or other optical storage, magnetic cassettes, magnetic tape disk storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device. As defined herein, computer readable media does not include temporary computer readable media (transitory media), such as modulated data signals and carrier waves.

[0089] It should also be noted that the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, commodity or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, commodity or device. In the absence of more restrictions, the elements defined by the sentence "comprises a ..." do not exclude the existence of other identical elements in the process, method, commodity or device including the elements.

[0090] It will be appreciated by those skilled in the art that embodiments of the present invention may be provided as methods, systems or computer program products. Therefore, the present invention may take the form of a complete hardware embodiment, a complete software embodiment or an embodiment combining software and hardware. Moreover, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program codes.

[0091] The above are only embodiments of the present invention and are not intended to limit the present invention. For those skilled in the art, the present invention may have various modifications and variations. Any modification, equivalent substitution, improvement, etc. made within the spirit and principle of the present invention should be included in the scope of the claims of the present invention.

Claims

1. A data detection method, characterized in that: include: Obtain the safety evaluation value of the data to be ferryed; Compare the safety evaluation value of the data to be ferried with a preset safety evaluation value to preliminarily determine the type of anomaly existing in the data to be ferried; According to the abnormality type, the data to be ferried is split to obtain split data to be ferried; Encrypting the split data to be ferryed to obtain encrypted data to be ferryed; After the encrypted data to be ferried is transmitted to the target address, the data received by the target address is detected to determine the integrity of the data transmission to be ferried.

2. The method according to claim 1, characterized in that The step of comparing the safety evaluation value of the data to be ferried with a preset safety evaluation value to preliminarily determine the abnormal type of the data to be ferried includes: If the safety evaluation value of the data to be ferried is less than the preset safety evaluation value, it is preliminarily determined that the abnormal type of the data to be ferried is a data abnormality, wherein the data abnormality refers to the situation that the data in the data to be ferried has been modified; If the security evaluation value of the data to be ferryed is greater than the preset security evaluation value, it is preliminarily determined that the abnormal type of the data to be ferryed is data intrusion, wherein the data intrusion refers to the presence of other data that does not belong to the data to be ferryed in the data to be ferryed.

3. The method according to claim 2, characterized in that The step of splitting the data to be ferried according to the abnormality type to obtain the split data to be ferried includes: When it is preliminarily determined that the abnormal type of the data to be ferried is the data abnormality, the data to be ferried is compared with the historical data of the data to be ferried to determine the location of the abnormal data, and the data to be ferried is split according to the location of the abnormal data to obtain the split data to be ferried; When it is preliminarily determined that the abnormal type of the data to be ferryed is the data intrusion, the data to be ferryed is compared with the pre-stored virus data to determine the location of the intrusion data, and the data to be ferryed is split according to the location of the intrusion data to obtain the split data to be ferryed.

4. The method according to claim 3, characterized in that When it is preliminarily determined that the abnormal type of the data to be ferried is the data abnormality, the data to be ferried is compared with the historical data of the data to be ferried, the location of the abnormal data is determined, and the data to be ferried is split according to the location of the abnormal data to obtain the split data to be ferried, including: Determining a first similarity between the data to be ferried and the historical data; In the case where the first similarity is less than a preset first similarity, determining the position of the abnormal data; removing the abnormal data, and splitting the data to be ferried based on the position of the abnormal data to obtain the split data to be ferried; When the first similarity is greater than or equal to the preset first similarity, it is finally determined that the abnormal data does not exist in the data to be ferried; and the data to be ferried is split based on a preset splitting ratio to obtain the split data to be ferried.

5. The method according to claim 3, characterized in that: In the case where it is preliminarily determined that the abnormal type of the data to be ferried is the data intrusion, the data to be ferried is compared with the pre-stored virus data to determine the location of the intrusion data, and the data to be ferried is split according to the location of the intrusion data to obtain the split data to be ferried, including: Determining a second similarity between the to-be-ferried data and the virus data; In the case where the second similarity is greater than a preset second similarity, determining the location of the intrusion data; removing the intrusion data, and splitting the data to be ferried according to the location of the intrusion data to obtain the split data to be ferried; When the second similarity is less than or equal to the preset second similarity, it is finally determined that the intrusion data does not exist in the data to be ferried; and the data to be ferried is split based on the preset splitting ratio to obtain the split data to be ferried.

6. The method according to claim 1, characterized in that The step of encrypting the split data to be ferried to obtain the encrypted data to be ferried includes: Determine the data types included in the split data to be ferried; Determining the importance of the data category based on the probability that the data belonging to the data category is abnormal; Determining an encryption method for the data to be ferried based on the importance of the data type; Based on the encryption method, the data to be ferried is encrypted to obtain the encrypted data to be ferried.

7. A data detection device, characterized in that: include: The first acquisition module is used to obtain the safety evaluation value of the data to be ferried; A first comparison module, used for comparing the safety evaluation value of the data to be ferried with a preset safety evaluation value, and preliminarily determining the abnormal type of the data to be ferried; A first splitting module is used to split the data to be ferryed according to the abnormal type to obtain the split data to be ferryed; A first encryption module, used for encrypting the split data to be ferryed to obtain encrypted data to be ferryed; The first detection module is used to detect the data received by the target address after transmitting the encrypted data to be ferried to the target address, so as to determine the integrity of the data transmission to be ferried.

8. A non-volatile storage medium, characterized in that: The non-volatile storage medium stores a plurality of instructions, and the instructions are suitable for being loaded by a processor and executing the data detection method described in any one of claims 1 to 6.

9. An electronic device, characterized in that: include: One or more processors and a memory, wherein the memory is used to store one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors implement the data detection method described in any one of claims 1 to 6.

10. A computer program product comprising computer instructions, characterized in that: The computer instructions are executed by a processor to execute the data detection method according to any one of claims 1 to 6.

Images