Real-time data leakage protection system based on cloud security

Abstract

The invention provides a real-time data leakage protection system based on cloud security, and belongs to the technical field of information security. Comprising a data acquisition module, a data preprocessing module, a data encryption module, an access control module, a behavior analysis module, a security early warning module and a cloud security protection platform, and the data acquisition module is used for acquiring data generated by a user terminal, network equipment and an application system, including but not limited to log data, traffic data and file data; the data preprocessing module is used for carrying out cleaning, filtering and formatting preprocessing operation on the collected data and improving the data quality; and the data encryption module is used for encrypting, storing and transmitting the sensitive data. According to the system, the functions of real-time data acquisition, encryption, access control, behavior analysis, safety early warning and the like are integrated, a unified management interface is provided, all-directional real-time protection of sensitive data is realized, flexible expansion can be realized according to requirements, and data leakage is effectively prevented.

Description

Technical Field

[0001] The present invention provides a real-time data leakage protection system based on cloud security, belonging to the technical field of information security. Background Art

[0002] With the rapid development of information technology, the global data volume has grown explosively, and data has become an important strategic resource in various fields such as enterprises, governments, and scientific research institutions. Data is not only the core asset of business operations but also the key driving force for promoting innovation and decision-making. Whether it is financial transaction data, medical health records, or personal privacy information, the value and sensitivity of data are constantly increasing. However, with the prominent value of data, data leakage incidents have become increasingly frequent, posing a huge threat and loss to personal privacy, corporate interests, and national security.

[0003] Therefore, in view of this, research and improvement are carried out on the existing structure, and a real-time data leakage protection system based on cloud security is proposed to solve the above-mentioned problems. Summary of the Invention

[0004] The technical problem to be solved by the present invention is a real-time data leakage protection system based on cloud security, which integrates functions such as real-time data collection, encryption, access control, behavior analysis, and security warning, provides a unified management interface, realizes all-round real-time protection of sensitive data, and can be flexibly expanded according to requirements to effectively prevent data leakage.

[0005] In order to solve the above problems, the technical solution proposed by the present invention is: a real-time data leakage protection system based on cloud security, including a data collection module, a data preprocessing module, a data encryption module, an access control module, a behavior analysis module, a security warning module, and a cloud security protection platform.

[0006] The data collection module is used to collect data generated by user terminals, network devices, and application systems, including but not limited to log data, traffic data, and file data.

[0007] The data preprocessing module is used to perform cleaning, filtering, and formatting preprocessing operations on the collected data to improve data quality.

[0008] The data encryption module is used to encrypt and store and transmit sensitive data to prevent data from being stolen during storage and transmission.

[0009] The access control module is used to strictly control user access permissions to prevent unauthorized users from accessing sensitive data.

[0010] The behavior analysis module is used to analyze user behaviors, identify abnormal behaviors, and timely discover potential data leakage risks.

[0011] The security warning module is used to issue security warning information in a timely manner according to the behavior analysis results, reminding the administrator to take corresponding protection measures;

[0012] The cloud security protection platform is used to integrate the functions of the above-mentioned modules, providing a unified security protection interface and management interface.

[0013] Furthermore, the data collection module installs data collection agent software or configures data collection interfaces in user terminals, network devices, and application systems. By setting collection rules, it collects data from these sources regularly or in real time, and transmits the collected data to the data preprocessing module for further processing.

[0014] Furthermore, the data collection module cleans the data, removes invalid or redundant data, filters out irrelevant data, only retains security-related information, uniformly converts data in different formats into a standard format that the system can process, and stores the processed data in a data warehouse for subsequent module use.

[0015] Furthermore, the data encryption module identifies sensitive data, encrypts the sensitive data using a strong encryption algorithm, ensures the secure management of the encryption key, adopts a secure key exchange and storage mechanism, and uses the HTTPS security protocol to ensure data security during data transmission.

[0016] Furthermore, the access control module establishes a user identity authentication mechanism, including username and password, two-factor authentication, defines roles and permissions, assigns corresponding access permissions according to the user's role, implements access control policies and records access logs for auditing and traceability.

[0017] Furthermore, the behavior analysis module collects the user's behavior data, including login time, operation frequency, accessed resources, uses machine learning algorithms to establish a normal behavior model, compares real-time behavior with the normal model, detects abnormal behaviors, including abnormal logins and data exports, scores and classifies the abnormal behaviors, and provides them to the security warning module.

[0018] Furthermore, the security warning module sets a warning threshold. When the behavior score detected by the behavior analysis module exceeds the threshold, it triggers a warning, sends a warning message to the administrator via email, text message, or system notification, provides warning details, including abnormal behavior description, occurrence time, involved users and data, and supports warning handling functions, including blocking access and further investigation.

[0019] Furthermore, the cloud security protection platform provides a centralized management console where administrators can monitor the running status of the entire system. It also needs to provide a configuration interface where administrators can set data collection rules, access control policies, and warning thresholds, and provide reporting and analysis tools to help administrators understand the security situation and formulate improvement measures, and support integration with other security systems.

[0020] Due to the adoption of the above technical solutions, the beneficial effects of the real-time data leakage protection system based on cloud security of the present invention are as follows:

[0021] 1. By constructing a cloud security protection platform, the present invention realizes real-time collection, analysis, and warning of data, and timely discovers and processes data leakage risks.

[0022] 2. By combining data encryption, access control, and behavior analysis technologies, the present invention realizes comprehensive protection of sensitive data and effectively prevents information leakage.

[0023] 3. The present invention adopts a modular design and can flexibly expand function modules according to actual needs to meet the security protection requirements in different scenarios.

[0024] 4. The present invention provides a unified security protection interface and management interface, which is convenient for administrators to configure, monitor, and maintain the system. Specific Embodiments

[0025] The technical solutions in the embodiments of the present invention will be clearly and completely described below. Obviously, the described embodiments are only a part of the embodiments of the present invention, rather than all the embodiments. All other embodiments obtained by those of ordinary skill in the art based on the embodiments of the present invention without creative efforts shall fall within the protection scope of the present invention.

[0026] The present invention provides a real-time data leakage protection system based on cloud security, including a data collection module, a data preprocessing module, a data encryption module, an access control module, a behavior analysis module, a security warning module, and a cloud security protection platform.

[0027] The data collection module is used to collect data generated by user terminals, network devices, and application systems, including but not limited to log data, traffic data, and file data.

[0028] The data preprocessing module is used to perform cleaning, filtering, and formatting preprocessing operations on the collected data to improve data quality.

[0029] The data encryption module is used to encrypt and store and transmit sensitive data to prevent the data from being stolen during storage and transmission.

[0030] The access control module is used to strictly control user access permissions to prevent unauthorized users from accessing sensitive data;

[0031] The behavior analysis module is used to analyze user behaviors, identify abnormal behaviors, and timely detect potential data leakage risks;

[0032] The security warning module is used to timely send security warning messages according to the behavior analysis results to remind the administrator to take corresponding protection measures;

[0033] The cloud security protection platform is used to integrate the functions of the above modules and provide a unified security protection interface and management interface.

[0034] The data collection module installs data collection agent software or configures data collection interfaces in user terminals, network devices, and application systems, and regularly or real-time collects data from these sources by setting collection rules, and transmits the collected data to the data preprocessing module for further processing.

[0035] The data collection module cleans the data, removes invalid or redundant data, filters out irrelevant data, only retains security-related information, uniformly converts data in different formats into a standard format that can be processed by the system, and stores the processed data in a data warehouse for subsequent modules to use.

[0036] The data encryption module identifies sensitive data, encrypts sensitive data using strong encryption algorithms, ensures the secure management of encryption keys, adopts secure key exchange and storage mechanisms, and uses the HTTPS security protocol to ensure data security during data transmission.

[0037] The access control module establishes a user identity authentication mechanism, including username and password, two-factor authentication, defines roles and permissions, assigns corresponding access permissions according to the user's role, implements access control policies and records access logs for auditing and tracing.

[0038] The behavior analysis module collects user behavior data, including login time, operation frequency, accessed resources, uses machine learning algorithms to establish a normal behavior model, compares real-time behaviors with the normal model, detects abnormal behaviors, including abnormal logins, data exports, scores and classifies abnormal behaviors, and provides them to the security warning module.

[0039] The security warning module sets a warning threshold. When the behavior score detected by the behavior analysis module exceeds the threshold, it triggers a warning and sends a warning message to the administrator via email, SMS, or system notification, provides warning details, including abnormal behavior description, occurrence time, involved users and data, and supports warning handling functions, including blocking access and further investigation.

[0040] The cloud security protection platform provides a centralized management console where administrators can monitor the running status of the entire system. It also needs to provide a configuration interface where administrators can set data collection rules, access control policies, and warning thresholds, and provide reporting and analysis tools to help administrators understand the security situation and formulate improvement measures, and support integration with other security systems.

[0041] The specific usage steps are as follows:

[0042] S1. Deploy the cloud security protection platform in the cloud environment to provide a unified security protection interface and management interface.

[0043] S2. Install data collection agent software or configure data collection interfaces in user terminals, network devices, and application systems, and set collection rules, including the types of data to be collected (log data, traffic data, file data, etc.), collection frequencies (regular or real-time), and specific information about the collection sources.

[0044] S3. Configure data preprocessing rules in the cloud security protection platform, including data cleaning rules (removing invalid or redundant data), data filtering rules (retaining security-related information), and data formatting rules (uniformly converting different formats of data into a standard format), configure the data storage location, and store the processed data in a specified data warehouse.

[0045] S4. Define the identification criteria for sensitive data in the system, such as specific file types, data containing specific fields, etc., select strong encryption algorithms (such as AES, RSA), and configure the security management mechanism for encryption keys, and configure the data transmission encryption protocol, such as HTTPS, to ensure the security of data during transmission.

[0046] S5. Establish a user identity authentication mechanism, including username and password, two-factor authentication, etc., define roles and permissions, assign corresponding access permissions to users of different roles, implement access control policies, such as role-based access control (RBAC) or attribute-based access control (ABAC), and configure an access log recording mechanism to ensure that all access behaviors are traceable.

[0047] S6. The data collection module collects data from user terminals, network devices, and application systems regularly or in real-time according to the set rules, and the collected data includes log data, traffic data, file data, etc.

[0048] S7. The data preprocessing module performs operations such as cleaning, filtering, and formatting on the collected data to improve data quality. The cleaning operation removes invalid or redundant data. The filtering operation retains security-related information. The formatting operation uniformly converts data in different formats into a standard format. The processed data is stored in a data warehouse for subsequent modules to use.

[0049] S8. The data encryption module identifies sensitive data, such as files containing personal identity information or financial data, and encrypts the sensitive data using the configured encryption algorithm to ensure data security during storage and transmission. Through a secure key exchange and storage mechanism, it manages encryption keys to prevent key leakage.

[0050] S9. The access control module strictly controls user access to sensitive data according to the defined roles and permissions. It uses an identity authentication mechanism to verify user identities to ensure that only authorized users can access sensitive data. It records all access behaviors and generates access logs for easy auditing and tracing.

[0051] S10. The behavior analysis module collects users' behavior data, including login time, operation frequency, accessed resources, etc., uses machine learning algorithms to establish a normal behavior model, analyzes users' regular operation patterns, compares real-time behavior with the normal behavior model, detects abnormal behaviors, such as abnormal logins, data exports, etc., scores and classifies abnormal behaviors, and provides them to the security warning module for further processing.

[0052] S11. The security warning module sets a warning threshold based on the detection results of the behavior analysis module. When the behavior score exceeds the warning threshold, the system triggers a warning and sends a warning message to the administrator via email, SMS, or system notification, providing warning details, including descriptions of abnormal behaviors, occurrence times, involved users and data, etc., to help the administrator quickly understand the situation and support warning handling functions, such as blocking access, further investigation, etc. The administrator can take corresponding protection measures according to the situation.

[0053] S12. The cloud security protection platform provides a centralized management console. Administrators can monitor the running status of the entire system, including the operation of modules such as data collection, preprocessing, encryption, access control, behavior analysis, and security warning. It provides a configuration interface where administrators can adjust data collection rules, access control policies, warning thresholds, etc. to meet different security requirements. The platform provides reporting and analysis tools to help administrators understand the security posture of the system, including the statistics of abnormal behaviors, the analysis of access logs, etc. By analyzing historical data, administrators can formulate improvement measures to enhance the protection ability of the system. The cloud security protection platform supports integration with other security systems, such as SIEM (Security Information and Event Management) systems, to achieve more comprehensive security management. Through the API or plugin mechanism, administrators can share the data and warning information of this system with other security systems to form a joint protection.

[0054] S13. The system runs continuously, collecting, analyzing, and warning in real time, promptly discovering and handling data leakage risks to ensure the security of sensitive data. According to the system operation status and security posture report, administrators regularly optimize the system configuration, such as adjusting data collection rules, updating behavior models, strengthening encryption policies, etc., to enhance the protection ability of the system.

[0055] The above describes the present invention and its implementation manners. This description is not restrictive. Generally speaking, if those of ordinary skill in the art are inspired by it and, without departing from the gist of the present invention, design similar structural forms and embodiments to this technical solution without creative efforts, they shall fall within the protection scope of the present invention.

Claims

1. A real-time data leakage protection system based on cloud security, characterized in that: It includes data collection module, data preprocessing module, data encryption module, access control module, behavior analysis module, security warning module, and cloud security protection platform. The data collection module is used to collect data generated by user terminals, network devices, and application systems, including but not limited to log data, flow data, and file data; The data preprocessing module is used to perform cleaning, filtering, and formatting preprocessing operations on the collected data to improve data quality; The data encryption module is used to encrypt the storage and transmission of sensitive data to prevent the data from being stolen during storage and transmission; The access control module is used to strictly control user access rights to prevent unauthorized users from accessing sensitive data; The behavior analysis module is used to analyze user behavior, identify abnormal behavior, and promptly discover potential data leakage risks; The security warning module is used to issue security warning information in a timely manner according to the behavior analysis results, reminding the administrator to take corresponding protective measures; The cloud security protection platform is used to integrate the functions of the above modules and provide a unified security protection interface and management interface.

2. The real-time data leakage protection system based on cloud security according to claim 1, characterized in that: The data acquisition module installs data acquisition agent software or configures data acquisition interface in user terminals, network devices and application systems, collects data from these sources regularly or in real time by setting acquisition rules, and transmits the collected data to the data preprocessing module for further processing.

3. The real-time data leakage protection system based on cloud security according to claim 1, characterized in that: The data acquisition module cleans the data, removes invalid or redundant data, filters out irrelevant data, retains only security-related information, converts data in different formats into a standard format that can be processed by the system, and stores the processed data in a data warehouse for use by subsequent modules.

4. The real-time data leakage protection system based on cloud security according to claim 1, characterized in that: The data encryption module identifies sensitive data, encrypts sensitive data using a strong encryption algorithm, ensures secure management of encryption keys, adopts a secure key exchange and storage mechanism, and uses the HTTPS security protocol to ensure data security during data transmission.

5. The real-time data leakage protection system based on cloud security according to claim 1, characterized in that: The access control module establishes a user identity authentication mechanism, including username and password, two-factor authentication, defines roles and permissions, assigns corresponding access permissions according to user roles, implements access control policies and records access logs for auditing and tracing.

6. The real-time data leakage protection system based on cloud security according to claim 1, characterized in that: The behavior analysis module collects user behavior data, including login time, operation frequency, and accessed resources, uses a machine learning algorithm to establish a normal behavior model, compares real-time behavior with the normal model, detects abnormal behavior, including abnormal login and data export, scores and grades abnormal behavior, and provides it to the security warning module.

7. The real-time data leakage protection system based on cloud security according to claim 1, characterized in that: The security warning module sets a warning threshold. When the behavior score detected by the behavior analysis module exceeds the threshold, a warning is triggered and a warning message is sent to the administrator via email, text message, or system notification. The warning details are provided, including a description of the abnormal behavior, the time of occurrence, the users and data involved, and support for warning processing functions, including blocking access and further investigation.

8. The real-time data leakage protection system based on cloud security according to claim 1, characterized in that: The cloud security protection platform provides a centralized management console where administrators can monitor the operating status of the entire system. It also needs to provide a configuration interface where administrators can set data collection rules, access control policies, and warning thresholds, and provide reporting and analysis tools to help administrators understand the security situation, develop improvement measures, and support integration with other security systems.