Identifier-based data security risk auditing element construction method and device

Abstract

The invention relates to the technical field of data security auditing, in particular to an identifier-based data security risk auditing element construction method, which comprises the following steps: constructing a security risk auditing element library wherein auditing elements carried in the security risk auditing element library cover a whole data circulation process; comprising data elements, carrier elements, user elements and operation behavior elements; and selecting a target auditing rule, and auditing the data security risk based on the security risk auditing element library, the target auditing rule being determined based on a known or presettable risk scene and an unknown risk scene. By applying the method, data auditing item missing can be avoided, the interpretability of the data element extraction process is improved, the workload is reduced, and the flexibility of data security auditing strategy configuration is improved.

Description

Technical Field

[0001] The present application relates to the technical field of data security auditing, and in particular to a method and device for constructing data security risk auditing elements based on identification. Background Art

[0002] As data openness and sharing have become a trend, data security audits, as an important means of information security protection, are becoming increasingly important and effective in industries involving personal privacy and sensitive data, such as finance, healthcare, and government. Data security audits can help identify potential security risks, help companies and organizations better manage and protect their data assets, improve data security, ensure data compliance and legality, and avoid legal risks and social impacts caused by data leakage or abuse.

[0003] The technical status of data security audit is as follows: (1) The current data security audit mainly relies on the audit method of capturing and parsing the operation logs or network traffic data of database users, and then conducting audit activities from the perspective of user behavior. However, this audit method often ignores the integrity and security of the data itself during its circulation process, resulting in obvious deficiencies in the ability to identify and prevent potential data risks; (2) In the existing data security audit system, there is a lack of systematic sorting and classification of audit needs for different audit scenarios. This leads to incomplete audit coverage in actual operations, insufficient in-depth mining and analysis of potential risks, and thus reduces the effectiveness and accuracy of the audit; (3) At present, data security audit has not yet formed a set of standardized and process-based operating specifications for the processing and analysis of audit data. This leads to the fact that when faced with data audit needs of different types and industries, auditors often need to re-determine the audit elements and audit methods to be extracted based on specific circumstances, which not only increases the complexity and workload of the audit, but also reduces the efficiency of the audit work.

[0004] In view of this, how to provide a method for constructing data security risk audit elements based on identification and to uniformly manage the elements required for security audits covering the entire life cycle of data has become a technical problem that urgently needs to be solved. Summary of the invention

[0005] The embodiments of the present application provide a method for constructing data security risk audit elements based on identification, a device for constructing data security risk audit elements based on identification, an electronic device and a computer storage medium, which are used to solve the problem of how to uniformly manage the elements required for security audits covering the entire life cycle of data.

[0006] In a first aspect of an embodiment of the present application, a method for constructing a data security risk audit element based on identification is provided, comprising:

[0007] Constructing a security risk audit element library, wherein the audit elements carried in the security risk audit element library cover the entire process of data flow, including data elements, carrier elements, user elements and operation behavior elements;

[0008] Select target audit rules and audit data security risks based on the security risk audit factor library, wherein the target audit rules are determined based on known or preset risk scenarios and unknown risk scenarios.

[0009] In a second aspect of an embodiment of the present application, a method for constructing a data security risk audit element based on identification is provided, comprising:

[0010] A construction module is configured to construct a security risk audit element library, wherein the audit elements carried in the security risk audit element library cover the entire data flow process, including data elements, carrier elements, user elements and operation behavior elements;

[0011] The audit module is configured to select target audit rules and audit data security risks based on the security risk audit element library, wherein the target audit rules are determined based on known or preset risk scenarios and unknown risk scenarios.

[0012] In a third aspect of an embodiment of the present application, a computing device is provided, including:

[0013] Memory and processor;

[0014] The memory is used to store computer-executable instructions, and the processor is used to execute the computer-executable instructions. When the computer-executable instructions are executed by the processor, the steps of the above-mentioned method for constructing data security risk audit elements based on identification are implemented.

[0015] According to a fourth aspect of an embodiment of the present application, a computer-readable storage medium is provided, which stores computer-executable instructions, and when the instructions are executed by a processor, the steps of the above-mentioned method for constructing data security risk audit elements based on identification are implemented.

[0016] The present application provides a method for constructing data security risk audit elements based on identification, comprising: first, constructing a security risk audit element library, wherein the audit elements carried in the security risk audit element library cover the entire process of data flow, including data elements, carrier elements, user elements and operation behavior elements; then, selecting target audit rules, and auditing data security risks based on the security risk audit element library, wherein the target audit rules are determined based on known or preset risk scenarios and unknown risk scenarios.

[0017] The beneficial effects of applying the identification-based data security risk audit element construction method provided in the embodiment of the present application include: on the one hand, it covers most data security audit scenarios. By combing the risk factor library, it ensures the complete closed loop of the security audit strategy, effectively avoiding the occurrence of missing items for data audit; on the other hand, it improves the interpretability of the data element extraction process. In view of the current situation of illogical selection of audit elements or formulation of audit strategies in the process of previous data security audits, this application clarifies the security audit element extraction process and reduces unnecessary workload; on the other hand, it improves the flexibility of data security audit policy configuration. By combing and uniformly managing the elements involved in the subject and operation behavior, the parsing and conversion process of log or traffic data is simplified, and the flexibility of data security audit policy configuration is improved by combining elements to form audit strategies.

[0018] The above description is only an overview of the technical solution of the present application. In order to more clearly understand the technical means of the present application, which can be implemented in accordance with the contents of the specification, and in order to make the above and other purposes, features and advantages of the present application more obvious and easy to understand, the specific implementation methods of the present application are listed below. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] Various other advantages and benefits will become apparent to those of ordinary skill in the art by reading the detailed description of the preferred embodiments below. The accompanying drawings are only for the purpose of illustrating the preferred embodiments and are not to be considered as limiting the present application. Also, the same reference symbols are used throughout the accompanying drawings to represent the same components. In the accompanying drawings:

[0020] Figure 1 A flowchart of a method for constructing data security risk audit elements based on identification provided in an embodiment of the present application;

[0021] Figure 2 A schematic diagram of the structure of data elements in a method for constructing data security risk audit elements based on identification provided in an embodiment of the present application;

[0022] Figure 3 A schematic diagram of the structure of a user element in a method for constructing data security risk audit elements based on identification provided in an embodiment of the present application;

[0023] Figure 4 A schematic diagram of the structure of a carrier element in a method for constructing data security risk audit elements based on identification provided in an embodiment of the present application;

[0024] Figure 5 A schematic diagram of the structure of the operation elements in a method for constructing data security risk audit elements based on identification provided in an embodiment of the present application;

[0025] Figure 6 A schematic diagram of combining elements in a method for constructing data security risk audit elements based on identification provided in an embodiment of the present application;

[0026] Figure 7 A schematic diagram of a process of intelligent data security audit in a method for constructing data security risk audit elements based on identification provided in an embodiment of the present application;

[0027] Figure 8 A schematic diagram of the structure of a device for constructing data security risk audit elements based on identification provided in an embodiment of the present application;

[0028] Fig. 9 A structural block diagram of a computing device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0029] The exemplary embodiments of the present disclosure will be described in more detail below with reference to the accompanying drawings. Although the exemplary embodiments of the present disclosure are shown in the accompanying drawings, it should be understood that the present disclosure can be implemented in various forms and should not be limited by the embodiments set forth herein. On the contrary, these embodiments are provided to enable a more thorough understanding of the present disclosure and to fully convey the scope of the present disclosure to those skilled in the art.

[0030] See also Figure 1 , Figure 1 A flowchart of a method for constructing data security risk audit elements based on identification provided in an embodiment of the present application. Figure 1 As shown, the specific steps include the following steps.

[0031] Step S102: Construct a security risk audit element library, wherein the audit elements carried in the security risk audit element library cover the entire data flow process, including data elements, carrier elements, user elements and operation behavior elements.

[0032] Step S104: Select target audit rules, and audit data security risks based on the security risk audit element library, wherein the target audit rules are determined based on known or preset risk scenarios and unknown risk scenarios.

[0033] In the process of data security audit, the first task is to parse out the elements that can be used for subsequent security audit from the data source sent to the audit system. These elements often reflect the characteristics of the scene, and their comprehensiveness and richness directly determine the breadth of the audit scope. Therefore, defining and clarifying the specific composition of the elements and ensuring the comprehensiveness of the elements are key issues that need to be addressed. In response to this key issue, this application constructs a security risk audit element library to uniformly manage the elements required for security audits covering the entire life cycle of data.

[0034] Data security audits should focus on the participants and their behaviors in the process of data transfer between various carriers. Therefore, audit elements should cover the data itself, carrier information, data processing participants and their behavior information, to ensure that the entire data transfer process is covered. Based on this, the security risk audit element library constructed by this application contains four types of elements: data elements, carrier elements, user elements, and operation behavior elements. Next, the specific composition of each dimension element will be introduced.

[0035] In an embodiment of the present application, a method for constructing a security risk audit element library is as follows.

[0036] Based on data identification and control elements, data elements are generated. The data identification is used to manage data throughout its life cycle. It refers to the exclusive (unique) mark given to data for the purpose of identifying, tracking and managing data, including unique identification, physical identification, semantic identification, data hash and name identification. The control elements are used to manage data throughout its life cycle, focusing on information related to data access and use, including data category and sensitivity level. Specifically, data elements include two categories, data identification and control elements. These two elements are used to ensure the management and control of data throughout its life cycle. See Figure 2 , Figure 2 A schematic diagram of the structure of data elements in a method for constructing data security risk audit elements based on identification provided in an embodiment of the present application.

[0037] Based on the using organization, using user and using application, user elements are generated, wherein the user elements are information related to the participants in the data flow process, including using organization, using user and using application, see Figure 3 , Figure 3 A schematic diagram of the structure of the user element in a method for constructing data security risk audit elements based on identification provided in an embodiment of the present application. The purpose of such classification is to ensure that the audit work meticulously checks the use, management and protection of data in different environments. The use organization is used to focus on policy organization policies, compliance and security standards; the use user is used to focus on personal access rights and behaviors; the use application is used to deeply understand the design and implementation security of the software system. This subdivision helps to identify potential risks and ensure the effectiveness of data security policies.

[0038] Generate a carrier element based on the carrier identifier, the user, the IP address, the MAC address and the carrier level, wherein the carrier element is the information of the carrier related to data storage, processing and transmission during the data flow process; the carrier identifier, the carrier level and the user are used to reflect the relevant information of the data storage carrier; the IP address and the MAC address are used to reflect the relevant information of data processing and transmission, see Figure 4 , Figure 4A structural schematic diagram of a carrier element in a method for constructing data security risk audit elements based on identification provided in an embodiment of the present application.

[0039] Based on the collection stage, transmission stage, storage stage, processing stage, exchange stage and destruction stage in the audit process, the operation behavior elements are generated, wherein the operation behavior elements are used to analyze the data operations involved in each stage. The embodiment of the present application refines the operation behavior elements into six stages of collection, transmission, storage, processing, exchange and destruction according to the whole life cycle of data flow, analyzes the data operations involved in each stage, and organizes its specific behavior element composition, see Figure 5 , Figure 5 This is a structural diagram of the operating elements in a method for constructing data security risk audit elements based on identification provided in an embodiment of the present application. Since too many elements are involved, only some of the elements are displayed.

[0040] It should be noted that the target audit rules mentioned in the embodiments of the present application include the first audit rule and the second audit rule. That is, the implementation approaches of data security audits are mainly divided into two categories: one is to audit known or preset risk scenarios based on manually formulated rules; the other is to use intelligent algorithms to learn and identify the patterns of risk scenarios and realize automated audits. The security risk audit element library can be applied to these two types of implementation approaches.

[0041] First, the risk scenario audit rules based on the security factor library are described.

[0042] In the embodiment of the present application, the target audit rule is selected to audit the data security risk based on the security risk audit element library, including:

[0043] When the current data security risk belongs to a known or preset risk scenario, a first audit rule is generated based on the combination of the contents of each element carried in the security risk audit element library, and the data security risk is audited based on the first audit rule, wherein the first audit rule is a compound audit rule, which is a rule manually formulated to audit known or preset risk scenarios.

[0044] Specifically, the combining of contents between the elements carried in the security risk audit element library to generate the first audit rule includes:

[0045] Formulate rules based on data elements to generate data class rules for the first audit risk scenario, where the first risk scenario includes but is not limited to risk scenarios such as non-compliant data identification and non-compliant data classification and grading;

[0046] Combining the user element and the data element, generating a user-data type rule for auditing a second risk scenario, wherein the second risk scenario includes but is not limited to risk scenarios such as non-compliant authority allocation and non-compliant data holding;

[0047] Combine data elements and carrier elements to generate data-carrier rules for the third audit risk scenario, where the third risk scenario includes but is not limited to risk scenarios such as inaccurate confidentiality of database tables and folders, high sensitivity and low storage, and incorrect data attribution;

[0048] Combine the data elements and the operation behavior elements to generate data-operation behavior rules for the fourth audit risk scenario, where the fourth risk scenario includes but is not limited to risk scenarios such as frequent operations on sensitive data and operations on sensitive data during abnormal time periods;

[0049] Combining the user factor, the data factor and the carrier factor, generating a user-data-carrier type rule for auditing the fifth risk scenario, wherein the fifth risk scenario includes but is not limited to risk scenarios such as risky user access;

[0050] Combining user elements, data elements and operation behavior elements, generating user-data-operation behavior rules for auditing the sixth risk scenario, wherein the sixth risk scenario includes but is not limited to risk scenarios such as unauthorized operations;

[0051] Combine data elements, carrier elements and operation behavior elements to generate data-carrier-operation behavior rules for auditing the seventh risk scenario, where the seventh risk scenario includes but is not limited to risk scenarios such as non-compliant transmission of sensitive data;

[0052] By combining data elements, user elements, carrier elements and operation behavior elements, data-user-carrier-operation behavior rules for the eighth audit risk scenario are generated, wherein the eighth risk scenario includes but is not limited to risk scenarios such as unauthorized users operating data across the network.

[0053] When the security factor library is built, the contents of each factor can be combined with the data factor as the core to form audit rules for specific risk scenarios, ensuring the comprehensiveness and pertinence of the audit. Figure 6 , Figure 6 A schematic diagram of combining elements in a method for constructing data security risk audit elements based on identification provided in an embodiment of the present application, such as Figure 6As shown in the figure, from a single data element audit rule to a composite audit rule covering users, carriers and operation behaviors, a total of 8 types of rules can be formed, namely data (D) class, user-data (UD) class, data-carrier (DC) class, data-operation behavior (DA) class, user-data-carrier (UCD) class, user-data-operation behavior (UDA) class, data-carrier-operation behavior (DCA) class, and data-user-carrier-operation behavior (DUCA) class, covering the key links and potential risk points in the data life cycle.

[0054] Then the intelligent security audit based on the security factor library is described.

[0055] In the embodiment of the present application, the target audit rule is selected to audit the data security risk based on the security risk audit element library, including:

[0056] When the current data security risk belongs to an unknown risk scenario, a target learning algorithm is used to audit the data security risk based on the security risk audit factor library, wherein the target learning algorithm automatically audits the data security risk by learning and identifying the pattern of the risk scenario.

[0057] Specifically, the target learning algorithm is used to audit data security risks based on the security risk audit factor library, including:

[0058] Adopting the target learning algorithm, in the data preprocessing stage, the initial data source is learned through the security risk audit element library to extract the audit elements used for security audit, wherein the elements carried in the audit elements cover the entire data flow process of the initial data source;

[0059] Based on the audit elements, the model is trained to generate a target audit model, and based on the target audit model, data security risks are automatically audited.

[0060] After the security audit factor library is built, machine learning and other intelligent algorithms can be used to conduct data security audits. For the specific implementation process, see Figure 7 , Figure 7 A flowchart of intelligent data security audit in a method for constructing data security risk audit elements based on identification provided in an embodiment of the present application is shown in FIG. Figure 7 As shown in the figure, the security factor library can filter out the elements that can be used for subsequent security audits from the data source during the data preprocessing stage, so that the data features extracted subsequently contain more comprehensive information, so that the intelligent algorithm can learn the patterns of risk scenarios and perform better.

[0061] The beneficial effects of applying the identification-based data security risk audit element construction method provided in the embodiment of the present application include: on the one hand, it covers most data security audit scenarios. By combing the risk factor library, it ensures the complete closed loop of the security audit strategy, effectively avoiding the occurrence of missing items for data audit; on the other hand, it improves the interpretability of the data element extraction process. In view of the current situation of illogical selection of audit elements or formulation of audit strategies in the process of previous data security audits, this application clarifies the security audit element extraction process and reduces unnecessary workload; on the other hand, it improves the flexibility of data security audit policy configuration. By combing and uniformly managing the elements involved in the subject and operation behavior, the parsing and conversion process of log or traffic data is simplified, and the flexibility of data security audit policy configuration is improved by combining elements to form audit strategies.

[0062] Corresponding to the above method embodiment, this specification also provides an embodiment of a device for constructing data security risk audit elements based on identification, Figure 8 A schematic diagram of a structure of a device for constructing data security risk audit elements based on identification provided in an embodiment of the present application. Figure 8 As shown, the device comprises:

[0063] The construction module 802 is configured to construct a security risk audit element library, wherein the audit elements carried in the security risk audit element library cover the entire data flow process, including data elements, carrier elements, user elements and operation behavior elements;

[0064] The audit module 804 is configured to select target audit rules and audit data security risks based on the security risk audit element library, wherein the target audit rules are determined based on known or preset risk scenarios and unknown risk scenarios.

[0065] In an optional embodiment, the audit module 804 is further configured to:

[0066] When the current data security risk belongs to a known or preset risk scenario, a first audit rule is generated based on the combination of the contents of each element carried in the security risk audit element library, and the data security risk is audited based on the first audit rule, wherein the first audit rule is a compound audit rule, which is a rule manually formulated to audit known or preset risk scenarios.

[0067] In an optional embodiment, the audit module 804 is further configured to:

[0068] Formulate rules based on data elements to generate data class rules for auditing the first risk scenario, wherein the first risk scenario includes non-compliance with data identification and non-compliance with data classification and grading;

[0069] Combining the user element and the data element, generating a user-data type rule for auditing a second risk scenario, wherein the second risk scenario includes non-compliant authority allocation and non-compliant data holding;

[0070] Combine data elements and carrier elements to generate data-carrier rules for the third audit risk scenario, where the third risk scenario includes inaccurate confidentiality of database tables and folders, high sensitivity and low storage, and incorrect data attribution;

[0071] Combine the data elements and the operation behavior elements to generate data-operation behavior rules for the fourth risk scenario of audit, wherein the fourth risk scenario includes frequent operations on sensitive data and operations on sensitive data during abnormal time periods;

[0072] Combining the user element, the data element and the carrier element, generating a user-data-carrier type rule for auditing the fifth risk scenario, wherein the fifth risk scenario includes risky user access;

[0073] Combining the user factor, the data factor and the operation behavior factor, generating a user-data-operation behavior class rule for auditing the sixth risk scenario, wherein the sixth risk scenario includes unauthorized operation;

[0074] Combining data elements, carrier elements and operation behavior elements, generating data-carrier-operation behavior rules for auditing the seventh risk scenario, wherein the seventh risk scenario includes non-compliant transmission of sensitive data;

[0075] By combining data elements, user elements, carrier elements and operation behavior elements, data-user-carrier-operation behavior rules for the eighth audit risk scenario are generated, wherein the eighth risk scenario includes cross-network data operations by unauthorized users.

[0076] In an optional embodiment, the audit module 804 is further configured to:

[0077] When the current data security risk belongs to an unknown risk scenario, a target learning algorithm is used to audit the data security risk based on the security risk audit factor library, wherein the target learning algorithm automatically audits the data security risk by learning and identifying the pattern of the risk scenario.

[0078] In an optional embodiment, the audit module 804 is further configured to: adopt a target learning algorithm, in the data preprocessing stage, learn the initial data source through the security risk audit element library, and extract audit elements for security audit, wherein the elements carried in the audit elements cover the entire process of data flow of the initial data source;

[0079] Based on the audit elements, the model is trained to generate a target audit model, and based on the target audit model, data security risks are automatically audited.

[0080] In an optional embodiment, the construction module 802 is further configured to:

[0081] Generate data elements based on data identification and control elements, where the data identification is used to manage data throughout the entire life cycle, and refers to the exclusive mark given to data for the purpose of identifying, tracking and managing data, including unique identification, physical identification, semantic identification, data hash and name identification; the control element is used to manage data throughout the entire life cycle, focusing on information related to data access and use, including data category and sensitivity level;

[0082] Generate user elements based on the using organization, using user and using application, wherein the user elements are information related to the participants in the data flow process, including using organization, using user and using application; the using organization is used to focus on policy organization policy, compliance and security standards; the using user is used to focus on personal access rights and behaviors; the using application is used to deepen the design and implementation security of the software system;

[0083] Generate a carrier element based on the carrier identifier, the user, the IP address, the MAC address and the carrier level, wherein the carrier element is information about the carrier related to data storage, processing and transmission during the data flow process; the carrier identifier, the carrier level and the user are used to reflect the relevant information of the data storage carrier; the IP address and the MAC address are used to reflect the relevant information of data processing and transmission;

[0084] Based on the collection stage, transmission stage, storage stage, processing stage, exchange stage and destruction stage in the audit process, operation behavior elements are generated, wherein the operation behavior elements are used to analyze the data operations involved in each stage.

[0085] The beneficial effects of applying the identification-based data security risk audit element construction device provided by the embodiment of the present application include: on the one hand, it covers most data security audit scenarios. By combing the risk factor library, it ensures the complete closed loop of the security audit strategy, effectively avoiding the occurrence of missing items for data audit; on the other hand, it improves the interpretability of the data element extraction process. In view of the current situation of illogical selection of audit elements or formulation of audit strategies in the process of previous data security audits, this application clarifies the security audit element extraction process and reduces unnecessary workload; on the other hand, it improves the flexibility of data security audit policy configuration. By combing and uniformly managing the elements involved in the subject and operation behavior, the parsing and conversion process of log or traffic data is simplified, and the flexibility of data security audit policy configuration is improved by combining elements to form audit strategies.

[0086] Each embodiment in this specification is described in a progressive manner, and the same or similar parts between the embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the device for constructing data security risk audit elements based on identification, since it is basically similar to the embodiment of the method for constructing data security risk audit elements based on identification, the description is relatively simple, and the relevant parts can be referred to the partial description of the embodiment of the method for constructing data security risk audit elements based on identification.

[0087] Fig. 9 This is a block diagram of a computing device provided in an embodiment of the present application. The components of the computing device 900 include but are not limited to a memory 910 and a processor 920. The processor 920 is connected to the memory 910 via a bus 930, and a database 950 is used to store data.

[0088] The computing device 900 also includes an access device 940, which enables the computing device 900 to communicate via one or more networks 960. Examples of these networks include a public switched telephone network (PSTN), a local area network (LAN), a wide area network (WAN), a personal area network (PAN), or a combination of communication networks such as the Internet. The access device 940 may include one or more of any type of network interface (e.g., a network interface card (NIC)) of wired or wireless, such as an IEEE 802.11 wireless local area network (WLAN) wireless interface, a world-wide interoperability for microwave access (Wi-MAX) interface, an Ethernet interface, a universal serial bus (USB) interface, a cellular network interface, a Bluetooth interface, and a near field communication (NFC).

[0089] In one embodiment of the present specification, the above components of the computing device 900 and Fig. 9 Other components not shown in the figure may also be connected to each other, for example, via a bus. It should be understood that Fig. 9 The computing device structure block diagram shown is only for the purpose of illustration, and is not intended to limit the scope of this specification. Those skilled in the art can add or replace other components as needed.

[0090] The computing device 900 may be any type of stationary or mobile computing device, including a mobile computer or mobile computing device (e.g., a tablet computer, a personal digital assistant, a laptop computer, a notebook computer, a netbook, etc.), a mobile phone (e.g., a smart phone), a wearable computing device (e.g., a smart watch, smart glasses, etc.), or other types of mobile devices, or a stationary computing device such as a desktop computer or a personal computer (PC). The computing device 900 may also be a mobile or stationary server.

[0091] Among them, the processor 920 is used to execute the following computer executable instructions, which, when executed by the processor, implement the steps of the above-mentioned method for constructing data security risk audit elements based on identification.

[0092] Each embodiment in this specification is described in a progressive manner, and the same or similar parts between the embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the computing device embodiment, since it is basically similar to the embodiment of the method for constructing data security risk audit elements based on identification, the description is relatively simple, and the relevant parts can be referred to the partial description of the embodiment of the method for constructing data security risk audit elements based on identification.

[0093] An embodiment of the present specification also provides a computer-readable storage medium storing computer-executable instructions, which, when executed by a processor, implement the steps of the above-mentioned method for constructing data security risk audit elements based on identification.

[0094] Each embodiment in this specification is described in a progressive manner, and the same or similar parts between the embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the computer-readable storage medium embodiment, since it is basically similar to the data security risk audit element construction method based on identification, the description is relatively simple, and the relevant parts can be referred to the partial description of the data security risk audit element construction method based on identification.

[0095] An embodiment of the present specification also provides a computer program, wherein when the computer program is executed in a computer, the computer is caused to execute the steps of the above-mentioned method for constructing data security risk audit elements based on identification.

[0096] Each embodiment in this specification is described in a progressive manner, and the same or similar parts between the embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the computer program embodiment, since it is basically similar to the embodiment of the method for constructing data security risk audit elements based on identification, the description is relatively simple, and the relevant parts can be referred to the partial description of the embodiment of the method for constructing data security risk audit elements based on identification.

[0097] The above is a description of a specific embodiment of the specification. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recorded in the claims can be performed in an order different from that in the embodiments and still achieve the desired results. In addition, the processes depicted in the drawings do not necessarily require the specific order or continuous order shown to achieve the desired results. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0098] The computer instructions include computer program codes, which may be in source code form, object code form, executable files or some intermediate forms, etc. The computer-readable medium may include: any entity or device capable of carrying the computer program code, recording medium, USB flash drive, mobile hard disk, magnetic disk, optical disk, computer memory, read-only memory (ROM), random access memory (RAM), electric carrier signal, telecommunication signal and software distribution medium, etc. It should be noted that the content contained in the computer-readable medium may be appropriately increased or decreased according to the requirements of legislation and patent practice in the jurisdiction. For example, in some jurisdictions, according to legislation and patent practice, computer-readable media do not include electric carrier signals and telecommunication signals.

[0099] It should be noted that the above is a description of a specific embodiment of the present specification. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recorded in the claims can be performed in an order different from that in the embodiments and still achieve the desired results. In addition, the processes depicted in the accompanying drawings do not necessarily require the specific order or continuous order shown to achieve the desired results. In some embodiments, multitasking and parallel processing are also possible or may be advantageous. Secondly, those skilled in the art should also be aware that the embodiments described in the specification are all preferred embodiments, and the actions and modules involved are not necessarily required by the embodiments of the present specification.

[0100] In the above embodiments, the description of each embodiment has its own emphasis. For parts that are not described in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0101] The preferred embodiments of this specification disclosed above are only used to help explain this specification. The optional embodiments do not describe all the details in detail, nor do they limit the invention to only the specific implementation methods described. Obviously, many modifications and changes can be made according to the content of the embodiments of this specification. This specification selects and specifically describes these embodiments in order to better explain the principles and practical applications of the embodiments of this specification, so that technicians in the relevant technical field can well understand and use this specification. This specification is only limited by the claims and their full scope and equivalents.

Claims

1. A method for constructing data security risk audit elements based on identification, characterized in that: include: Constructing a security risk audit element library, wherein the audit elements carried in the security risk audit element library cover the entire process of data flow, including data elements, carrier elements, user elements and operation behavior elements; Select target audit rules and audit data security risks based on the security risk audit factor library, wherein the target audit rules are determined based on known or preset risk scenarios and unknown risk scenarios.

2. The method according to claim 1, characterized in that The target audit rules include first audit rules and second audit rules; The target audit rule is selected to audit data security risks based on the security risk audit element library, including: When the current data security risk belongs to a known or preset risk scenario, a first audit rule is generated based on the combination of the contents of each element carried in the security risk audit element library, and the data security risk is audited based on the first audit rule, wherein the first audit rule is a compound audit rule, which is a rule manually formulated to audit known or preset risk scenarios.

3. The method according to claim 2, characterized in that The step of combining the contents of the various elements carried in the security risk audit element library to generate the first audit rule includes: Formulate rules based on data elements to generate data class rules for auditing the first risk scenario, wherein the first risk scenario includes non-compliance with data identification and non-compliance with data classification and grading; Combining the user element and the data element, generating a user-data type rule for auditing a second risk scenario, wherein the second risk scenario includes non-compliant authority allocation and non-compliant data holding; Combine data elements and carrier elements to generate data-carrier rules for the third audit risk scenario, where the third risk scenario includes inaccurate confidentiality of database tables and folders, high sensitivity and low storage, and incorrect data attribution; Combine the data elements and the operation behavior elements to generate data-operation behavior rules for the fourth risk scenario of audit, wherein the fourth risk scenario includes frequent operations on sensitive data and operations on sensitive data during abnormal time periods; Combining the user element, the data element and the carrier element, generating a user-data-carrier type rule for auditing the fifth risk scenario, wherein the fifth risk scenario includes risky user access; Combining the user factor, the data factor and the operation behavior factor, generating a user-data-operation behavior class rule for auditing the sixth risk scenario, wherein the sixth risk scenario includes unauthorized operation; Combining data elements, carrier elements and operation behavior elements, generating data-carrier-operation behavior rules for auditing the seventh risk scenario, wherein the seventh risk scenario includes non-compliant transmission of sensitive data; By combining data elements, user elements, carrier elements and operation behavior elements, data-user-carrier-operation behavior rules for the eighth audit risk scenario are generated, wherein the eighth risk scenario includes cross-network data operations by unauthorized users.

4. The method according to claim 2, characterized in that: The target audit rule is selected to audit the data security risk based on the security risk audit element library, including: When the current data security risk belongs to an unknown risk scenario, a target learning algorithm is used to audit the data security risk based on the security risk audit factor library, wherein the target learning algorithm automatically audits the data security risk by learning and identifying the pattern of the risk scenario.

5. The method according to claim 4, characterized in that The target learning algorithm is used to audit data security risks based on the security risk audit element library, including: Adopting the target learning algorithm, in the data preprocessing stage, the initial data source is learned through the security risk audit element library to extract the audit elements used for security audit, wherein the elements carried in the audit elements cover the entire data flow process of the initial data source; Based on the audit elements, the model is trained to generate a target audit model, and based on the target audit model, data security risks are automatically audited.

6. The method according to claim 1, characterized in that Construct a security risk audit element library, including: Generate data elements based on data identification and control elements, where the data identification is used to manage data throughout the entire life cycle, and refers to the exclusive mark given to data for the purpose of identifying, tracking and managing data, including unique identification, physical identification, semantic identification, data hash and name identification; the control element is used to manage data throughout the entire life cycle, focusing on information related to data access and use, including data category and sensitivity level; Generate user elements based on the using organization, using user and using application, wherein the user elements are information related to the participants in the data flow process, including using organization, using user and using application; the using organization is used to focus on policy organization policy, compliance and security standards; the using user is used to focus on personal access rights and behaviors; the using application is used to deepen the design and implementation security of the software system; Generate a carrier element based on the carrier identifier, the user, the IP address, the MAC address and the carrier level, wherein the carrier element is information about the carrier related to data storage, processing and transmission during the data flow process; the carrier identifier, the carrier level and the user are used to reflect the relevant information of the data storage carrier; the IP address and the MAC address are used to reflect the relevant information of data processing and transmission; Based on the collection stage, transmission stage, storage stage, processing stage, exchange stage and destruction stage in the audit process, operation behavior elements are generated, wherein the operation behavior elements are used to analyze the data operations involved in each stage.

7. A method for constructing data security risk audit elements based on identification, characterized in that: include: A construction module is configured to construct a security risk audit element library, wherein the audit elements carried in the security risk audit element library cover the entire data flow process, including data elements, carrier elements, user elements and operation behavior elements; The audit module is configured to select target audit rules and audit data security risks based on the security risk audit element library, wherein the target audit rules are determined based on known or preset risk scenarios and unknown risk scenarios.

8. A computing device comprising: Memory and processor; The memory is used to store computer-executable instructions, and the processor is used to execute the computer-executable instructions. When the computer-executable instructions are executed by the processor, the steps of the method described in any one of claims 1 to 6 are implemented.

9. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores an implementation program for information transmission, and when the program is executed by a processor, the steps of the method described in any one of claims 1 to 6 are implemented.

Images