Security monitoring method for preventing confidential file from being leaked

Abstract

The invention relates to the technical field of security monitoring for preventing confidential files from being leaked, and discloses a security monitoring method for preventing confidential files from being leaked. By setting the user permission matrix and the dynamic access condition set, the system finely manages user permissions, it is ensured that the user only accesses related files, and the risk of unauthorized access is reduced. The dynamic condition set includes access time, device identification, and geographic location, preventing access by unsecure devices or locations. And the system verifies the permission matching degree in real time and rejects access which does not conform to conditions in time, so that the risk of permission abuse and leakage is reduced. A detailed log is generated in each access, an operation result and rejection information are recorded, and an administrator is notified when an abnormal behavior occurs. In combination with file sensitivity evaluation and a multi-layer encryption strategy, the system takes different protection measures according to file sensitivity. Through real-time authority management and auditing, file operation compliance is monitored, and potential violation behaviors are found in time.

Description

Technical Field

[0001] The present invention relates to the technical field of security monitoring for preventing the leakage of confidential documents, and specifically provides a security monitoring method for preventing the leakage of confidential documents. Background Art

[0002] With the rapid development of information technology, the electronic management of data has gradually become the core. Especially in the management of confidential documents and sensitive data, document leakage and improper operations have become serious security risks. The leakage of confidential documents may not only lead to economic losses for companies or organizations, but also trigger major risks of legal liability and social reputation. Therefore, the security protection of confidential documents has become a key issue in the field of information security.

[0003] Currently, the protection measures against the leakage of confidential documents can be roughly divided into two categories: one is the protection technology based on the document itself, such as file encryption, permission control, and watermark technology; the other is the protection technology based on user behavior and network monitoring, such as data leakage prevention, intrusion detection systems, and behavior analysis. Although file encryption and permission control are important means to prevent the leakage of confidential documents, there are still risks in the management of encryption keys and permission allocation in existing technologies. If the encryption key is stolen or leaked, the security of the file will be severely threatened; in terms of permission control, overly loose permission allocation or un-updated permission settings may result in unauthorized access or abuse of confidential documents by unauthorized personnel. Currently, most security monitoring methods focus on one aspect of technology, such as encryption, permission management, or behavior monitoring, and lack a comprehensive solution to integrate these technologies. Such fragmented security protection measures often cannot effectively cope with complex attacks or leakage risks. For example, although behavior analysis can detect abnormal operations, it does not combine the sensitivity assessment of files for dynamic encryption and permission adjustment, thus missing the opportunity for real-time protection.

[0004] In order to better prevent the leakage of confidential documents, this document aims to propose a security monitoring method for preventing the leakage of confidential documents, which involves integrating encryption, permission management, and behavior monitoring to establish a comprehensive security system to protect confidential documents in real time from multiple perspectives and reduce the blind spots of single technologies. Summary of the Invention

[0005] The present invention provides a security monitoring method for preventing the leakage of confidential documents, which promotes the solution of the problems mentioned in the above background art.

[0006] The present invention provides the following technical solution: A security monitoring method for preventing the leakage of confidential documents, including:

[0007] Set up a user permission matrix, denoted as U, representing the set of all users, where each user U i is assigned a permission level;

[0008] Where U = [U 1 , U 2 ,..., U n , where U i represents the i-th user;

[0009] For each user U i , perform permission level assignment. The permission level calculation function is specifically:

[0010] L(U i ) ∈ {L 1 , L 2 , L 3 , L 4};

[0011] Among them, L(U i ) represents the permission level of the i-th user; L 1 is only able to view the metadata of the file; L 2 is able to view some non-sensitive content; L 3 is able to view and edit non-sensitive content and can perform some operations on the file; L 4 is full access permission;

[0012] Set the dynamic condition set when the user accesses, denoted as C k , specifically:

[0013] C k = {T k , D k , Lk, R k};

[0014] Among them, T k is the exact time when the access request is recorded; D k is the unique identifier of the device; L k is the geographical coordinate of the user's device. If the user accesses the file at an unauthorized location, the access should be rejected; R k is the unique identifier of the file, used to uniquely identify each file;

[0015] According to the user permission set L(U i ) and the access condition set C k , calculate the access matching degree;

[0016] The condition matching degree calculation function M(L(U i ), C k ) is specifically:

[0017]

[0018] If M(L(U i), C k ) = 1, access to the file is allowed; otherwise, access is denied and logged;

[0019] If the permission conditions are not met, access is denied, a log is recorded, and a denial message is returned to the user; an immediate notification is sent to the administrator for abnormal access behaviors;

[0020] A detailed access log L is generated for each access operation access , and its structure is:

[0021] L access = {U i , T k , R k , C k , operation result, reason for failure};

[0022] When the operation result is successful, the reason for failure is recorded as 0; when the operation result is a failure, the real reason for failure is obtained and recorded;

[0023] If access is denied, the reason for denial is obtained and inserted into the access log;

[0024] The file sensitivity level S is evaluated using a file sensitivity evaluation strategy f ;

[0025] The file is encrypted in multiple layers and protected at different levels;

[0026] Permission management and auditing are performed for each file operation;

[0027] Abnormal monitoring of user behavior is performed.

[0028] Optionally, the file sensitivity level S is evaluated using a file sensitivity evaluation strategy f , specifically including:

[0029] The frequency of occurrence of keywords in the file content is obtained and denoted as K d ;

[0030] The file type is obtained and denoted as T f ;

[0031] The file sharing scope is obtained and denoted as R f ;

[0032] The keyword density threshold is set and denoted as K threshold ;

[0033] The file sensitivity type set is set and denoted as T gather ;

[0034] The file sharing scope is set and denoted as R range ;

[0035] The initial sensitivity level of the file is recorded as S low ;

[0036] If the keyword occurrence frequency in the file > K threshold , the file sensitivity is increased by one level;

[0037] If the file type T f ∈T gather , the file sensitivity level is increased to S high ;

[0038] If the file sharing range then the file sensitivity level is increased to S high ;

[0039] Generate the sensitivity level S f = f(K d , T f , R F ), and the result is:

[0040] S low , ordinary file; S medium , important file; S high , highly sensitive file.

[0041] Optionally, the multi-layer encryption and hierarchical protection of the file specifically include:

[0042] According to the file sensitivity level S F , select different encryption strategies;

[0043] When the file sensitivity level is S low , use symmetric encryption and AES-128;

[0044] When the file sensitivity level is S medium , use hybrid encryption, generate a session key with RSA-2048, and then encrypt with AES-256;

[0045] When the file sensitivity level is S high , use hierarchical encryption, combining ECC elliptic curve encryption and RSA dual encryption;

[0046] Obtain the user ID, denoted as ID;

[0047] Generate a dynamic encryption key: K(t) = H(ID, R k , t, S f );

[0048] Among them, H is a hash function; t is a timestamp; S F file sensitivity level;

[0049] Recalculate and generate a key each time a user requests a file;

[0050] For S high files, the key is rotated hourly; for S medium files, the key is rotated daily;

[0051] Generate a key usage record log L enc : L enc = {R k , K(t), S f , T k};

[0052] Optionally, perform permission management and auditing on each file operation, specifically including:

[0053] Set the file operation category, denoted as O j , and the operation categories include:

[0054] O 1 , file viewing; O 2 , file editing; O 3 , file downloading; O 4 , file printing;

[0055] Map each type of operation to different permission levels:

[0056] For permission L 1 : Prohibit all operations and only allow viewing of metadata;

[0057] For permission L 2 : Allow O 1 ;

[0058] For permission L 3 : Allow O 1 and O 2 ;

[0059] For permission L 4 : Allow O 1 , O 2 , O 3 and O 4 ;

[0060] When the file sensitivity level S f ≥ S high , then disable O 3 and O 4 ;

[0061] Obtain the user's permission L(U i );

[0062] Obtain the minimum permission requirement of the file, denoted as L required ;

[0063] If the user permission L(U i ) < L required , all requests are rejected;

[0064] For the user request Req(U i , R k , O j ), the verification process is executed, specifically:

[0065] S1. Check the permission L(U i ) of U; i )

[0066] S2. Obtain the file sensitivity level S f ;

[0067] S3. Restrict the specific operation O j ;

[0068] S4. Generate a detailed operation log: L audit = {U i , R k , O j , T k , operation result, reason}, and record the user's access behavior and restriction result in the audit log.

[0069] Optionally, the abnormal monitoring of the user's behavior specifically includes:

[0070] Each time the user accesses, record the set of access behavior characteristics B(U i );

[0071] The set of characteristics includes:

[0072] The number of accesses within a unit time, denoted as B 1 (U i );

[0073] The time difference between two consecutive accesses, denoted as B 2 (U i ), B 2 (U i ) = t j+1 - t j ;

[0074] The type of file accessed, denoted as B 3 (U i );

[0075] The time spent staying each time the file is accessed, denoted as B 4 (U i );

[0076] After the access behavior is recorded, dataset B(U i ) = {B 1 (U i ), B 2 (U i ), B 3 (U i ), B 4 (U i )}, where B j (U i ) represents the j-th behavior feature of user U i ;

[0077] For each behavior feature B j (U i ), perform normalization. The normalization formula is:

[0078]

[0079] where B j (U i ) is the j-th behavior feature value of user U i ;

[0080] μ j is the mean of all users on the j-th feature, specifically:

[0081] σ j is the standard deviation of all users on the j-th feature, specifically:

[0082]

[0083] where n is the number of all users participating in behavior analysis;

[0084] Calculate the comprehensive behavior pattern of each user according to the normalized value of each behavior feature, specifically:

[0085]

[0086] where, ω j is the weight of behavior feature B j (U i ); B′ j (U i ) is the normalized behavior feature; m is the total number of elements in the feature set;

[0087] Record the behavior pattern Pattern(U i ) of each user as a vector:

[0088] Pattern(U i ) = [B′ 1(U i ),B' 2 (U i ),…,B′ m (U i )];

[0089] Use historical user data D = {B 1 (U 1 ),B 2 (U 1 ),...,B n (U n )) to train and obtain the set of behavior patterns of all users:

[0090] P = {Pattern(U 1 ),Pattern(U 2 ),…,Pattern(U n )};

[0091] For user U i 's current behavior feature B j (U i ),calculate the Euclidean distance ΔB(U i ) from the historical behavior pattern;

[0092]

[0093] Among them, Pattern j (U i ) is the jth eigenvalue of user U i in the historical behavior pattern;

[0094] Set the alarm trigger threshold, denoted as θ alert ;

[0095] When ΔB(U i ) > θ alert , then user U i has abnormal behavior and adopts an automated emergency response strategy;

[0096] Perform intelligent data desensitization and virtualization on the data.

[0097] Optionally, the intelligent data desensitization and virtualization of the data specifically includes:

[0098] Set regular expressions for sensitive data in the file;

[0099] Use regular expressions to extract the set of sensitive data in the file, denoted as: S = {s 1 , s 2 ,...,s p}, where each s iSensitive information segment;

[0100] For each sensitive data item s i Perform scrambling to generate desensitized data s' i :

[0101] s' i = s i + r, r ~ N(0, σ 2 );

[0102] where r is Gaussian noise and the standard deviation σ is the noise magnitude;

[0103] Generate a virtual view V(N) for the non-sensitive part N of the file content, where:

[0104] All sensitive fields s i Are replaced with *;

[0105] If the permission of user U i Is L 1 , only display the file title; if it is L 2 , display some non-sensitive content; if it is L 3 Or L 4 , then display the complete non-sensitive part.

[0106] Optionally, the automated emergency response strategy specifically includes:

[0107] Obtain the user ID, denoted as U ID ;

[0108] Dynamically generate an encryption key:

[0109] K'(t) = H(U ID + R k + t);

[0110] where K'(t) is an encryption key dynamically generated based on the timestamp t, the user ID U ID and the unique identifier R of the file k ; H is a hash function used to generate the key;

[0111] Use the dynamic key K'(t) to encrypt the content of file F:

[0112]

[0113] After encryption, the content of file F becomes ciphertext and the user cannot directly view it;

[0114] Downgrade the permission of the user with abnormal behavior to the lowest level L 1 ;

[0115] Continuously monitor the user's behavior. If the user's behavior is continuously abnormal, temporarily disable the user's file access permission until the administrator lifts the user's permission restriction.

[0116] The present invention has the following beneficial effects:

[0117] 1. By setting up a user permission matrix, the problem of inaccurate permission allocation is solved. By assigning different permission levels to each user, a refined permission management system is established. Specifically, the permission level of each user is customized according to their identity, position, and operation requirements, which can ensure that users at different levels only access file content related to their work. Through this method, over-authorization or overly loose unnecessary permissions are avoided, thus reducing the risk of confidential files being accessed by unauthorized users. At the same time, it also avoids problems such as operation errors or abuse of permissions caused by improper user permissions. By setting up a dynamic condition set, the problem of insecurity of user devices and access locations is solved. Setting a dynamic condition set for user access, including the time of the access request, the device unique identifier, the device geographical location, and the file unique identifier, can strictly control the user's access behavior in multiple dimensions. This method can effectively prevent unauthorized devices or unauthorized locations from accessing confidential files, further enhancing the security of file access. For example, when a user attempts to access a file from an unauthorized device or a non-designated location, the system can automatically reject the access and record the log. This avoids malicious access through insecure devices or geographical locations and reduces the risk of internal leakage. By calculating the access matching degree, the problem of untimely permission verification is solved. By calculating the matching degree between the user permission set and the access condition set, the system can immediately determine whether the user meets the access conditions and perform dynamic permission verification. If the conditions are not met, the system will immediately reject the access and record the reason for rejection. This real-time verification ensures the accuracy of permission matching and reduces the leakage risk caused by abuse of permissions or access behaviors that do not meet the conditions. Through access logs and abnormal behavior monitoring, the problem of security traceability during the file access process is solved. Each access operation generates a detailed access log and records information such as the operation result, the reason for failure, and the reason for rejection, which provides a reliable basis for subsequent audits and security analysis. When an access anomaly occurs, the log will provide a real-time alert to notify the administrator for timely handling of potential security hazards. Combining with the abnormal monitoring of user behavior, potential threats can be quickly identified when the behavior pattern deviates from the normal, enhancing the controllability and transparency of file management. Through such monitoring and recording, the traceability of file access behavior is guaranteed, and any abnormal behavior can be discovered and processed in a timely manner, thus effectively preventing potential risks brought by malicious access or misoperations. By file sensitivity assessment and multi-layer encryption, the problem of insufficiently detailed file protection is solved. Using a file sensitivity assessment strategy to dynamically assess the sensitivity of files can adopt different protection measures according to the different sensitivity levels of file content. For highly sensitive files, the system will automatically enable multi-layer encryption technology for protection to ensure that even if the file is illegally accessed or stolen, the data still cannot be read. This hierarchical protection method avoids unified encryption of all files, improves the processing efficiency, and at the same time ensures the security of highly sensitive files.Through multi-level permission management and auditing, the problem of insufficiently strict supervision of file operations is solved. Permission management and auditing are carried out for each file operation to ensure that operations such as file access, editing, and copying are all carried out under strict permission control. Through the real-time auditing function, managers can clearly understand the specific operations of each user on the file, including behaviors such as modification, viewing, and deletion. This not only improves the operation transparency but also effectively prevents and timely discovers potential violations in file operations.

[0118] 2. By obtaining the keyword occurrence frequency in the file content, the problem of judging insensitive information in the file content is solved. By counting the occurrence frequency of keywords in the file content and comparing it with the set keyword density threshold, the system can identify whether the file contains sensitive information. This method can effectively distinguish ordinary content from keywords related to confidentiality or sensitivity, so as to automatically improve the sensitivity level of the file without manual intervention. If the occurrence frequency of keywords in the file is higher than the preset threshold, the file sensitivity will be automatically increased by one level. This measure can ensure the timely identification of sensitive content, automatically increase the protection level, and reduce the risk of sensitive data being underestimated due to human negligence. By identifying the file type, the problem of insufficient identification of sensitive file types is solved. When identifying the file type, the system will automatically adjust its sensitivity level according to the type of the file. For example, for files containing content in fields such as law, finance, and medicine, the system can automatically increase the sensitivity level based on the file type, which can effectively prevent such files from being misclassified as ordinary files due to insensitive types. In this way, the system's automatic perception of the file type can accurately improve the file protection level and ensure that potential sensitive content can be properly protected under any circumstances. By setting the file sharing scope, the problem of controlling the risk of file leakage is solved. By setting the file sharing scope, the system can evaluate the sharing scope of the file and the degree of openness to external access. If the file is in an environment of extensive sharing, its sensitivity level will be increased. This method helps managers understand which files may be accessed by a large number of users or read by external personnel, so as to adjust the sensitivity and encryption protection level of the file according to the sharing scope. Especially when the file is accessed by external personnel, its sensitivity level is automatically increased, effectively avoiding the risk of file leakage caused by excessive sharing. By multi-dimensional sensitivity assessment, the problem of inaccurate assessment by a single standard is solved. The assessment of file sensitivity does not rely solely on a single standard, but combines multiple dimensions such as the keyword frequency in the file content, the file type, and the file sharing scope. This comprehensive assessment method can evaluate the sensitivity of the file more accurately than the traditional single-standard assessment. In the process of increasing the file sensitivity, through the joint analysis of keyword frequency, file type, and sharing scope, the one-sidedness brought by a single factor is avoided, and the accuracy and adaptability of sensitivity assessment are improved. By the sensitivity level generation mechanism, the problem of insufficient identification of sensitive files in file management is solved. Finally, through the generation of sensitivity levels, such as ordinary files, important files, highly sensitive files, the system assigns a clear sensitivity level to the file. The sensitivity level of the file will directly determine its subsequent protection measures, including encryption policies, access control, etc. By automatically generating and marking the sensitive level of the file, managers can more easily identify and apply the corresponding protection strategies, avoiding omissions or errors in the manual marking and judgment process. In this way, not only the security of the file is enhanced, but also the management efficiency is improved, and the potential risks brought by human factors are reduced.By comprehensively enhancing sensitivity, the problem of insufficient protection in progressive encryption is solved. As the sensitivity of the file increases, the system will automatically perform progressive encryption and enhanced protection on the file. For example, when the file sensitivity is that of an ordinary file, only basic permission control may be required, while when the file sensitivity is that of a highly sensitive file, the system will implement more stringent encryption algorithms and access control policies. This flexible sensitivity enhancement mechanism enables the system to dynamically adjust the protection level according to the specific situation of the file, thus ensuring that the file can obtain the most appropriate protection under different sensitivities.

[0119] 3. By selecting different encryption strategies according to the file sensitivity level, the problem of insufficient security caused by a single encryption method is solved. According to the sensitivity level of the file, the system selects different encryption strategies, using symmetric encryption AES-128, hybrid encryption RSA-2048 combined with AES-256, and hierarchical encryption combined with ECC and RSA respectively. The encryption methods are prior arts. This method solves the limitations of traditional encryption methods, adopts appropriate encryption schemes for files with different sensitivity levels, avoids using overly complex and resource-consuming encryption algorithms for low-sensitivity files, and at the same time ensures that highly sensitive files can be adequately protected. For example, for ordinary files, AES-128 can be used for efficient encryption, while for highly sensitive files, hierarchical encryption using ECC and RSA can provide higher security, ensuring that the files cannot be cracked even when illegally accessed. This not only optimizes the encryption efficiency but also enhances the security of the files. By generating dynamic encryption keys, the security risk caused by the leakage of fixed keys is solved. Each time a user requests a file, the system generates a new dynamic encryption key based on the file's sensitivity level, timestamp, and user ID. Through the combination of a hash function and a timestamp, it is ensured that different keys are used for each encryption, effectively avoiding the problem of encryption key leakage that may be caused by fixed keys. Even if an attacker obtains the encryption key of a certain file, they cannot crack other files or future encryption operations because the key is updated each time the file is accessed, greatly increasing the security protection level of the files. By regularly rotating the encryption keys, the security risk brought by using the same key for a long time is solved. For files with different sensitivity levels, the system reduces the risk of key leakage or abuse by regularly rotating the encryption keys, such as once per hour or once per day. This strategy ensures that even if the encryption key is leaked or cracked, the attacker can only use these keys to access the files for a short period of time, further improving the security. Through this regular key update mechanism, the system can effectively prevent potential threats caused by the long-term validity of the key, increasing the dynamicity and adaptability of security protection. By means of the key usage record log, the problem of lack of transparency and auditing in key management is solved. Each time a key is generated and rotated, a detailed key usage record log is generated in the system, recording information such as the specific time of key generation, the encryption algorithm used, and the user ID. The generation and recording of this log not only increase the transparency of key management but also provide important evidence for future security audits. If a key leakage or other security incident occurs, the administrator can quickly track the usage of the key through the log, thereby locking the source of the problem and taking preventive measures in a timely manner. This log recording mechanism can effectively ensure the traceability of the key usage process, improving the accuracy and reliability of security monitoring. By flexibly applying different encryption strategies, the balance between efficiency and security is solved. In the selection of file encryption strategies, the system adopts a flexible solution, choosing different encryption methods according to the sensitivity level of the file.For low-sensitivity files, AES-128 symmetric encryption is adopted, which not only ensures the encryption effect but also reduces the resource consumption of encryption calculations; for important files, RSA-2048 is used to generate a session key and combined with AES-256 encryption to enhance the security of encryption; for highly sensitive files, a hierarchical encryption scheme combining ECC and RSA is used to ensure extremely high security. Through this multi-level encryption strategy, the system can avoid using overly complex encryption methods for low-sensitivity files while ensuring high security, thus achieving a balance between efficiency and security.

[0120] 4. By setting up file operation categories and permission mappings, the problem of management chaos caused by unclear permissions is solved. In the solution, first, file operation categories are set up, such as viewing, editing, downloading, and printing, and each operation is mapped to different permission levels. Through this classified management, it can be ensured that the operation permissions of users are clear and easy to manage. Each permission level, such as only being able to view metadata, being able to view and edit file content, etc., corresponds to a specific operation category, making permission control more refined and transparent. Such an operation mode avoids the ambiguity of permission settings, ensures that users with different permissions can only perform operations that match their permission levels, reduces the risks of misoperations and unauthorized operations, and thus improves the overall security management efficiency. By controlling the permissions of sensitive file operations, the security risks of high-sensitive file operations are solved. For files with different sensitivities, the system sets up permission control according to the sensitivity level of the file, specifically including disabling certain operations, such as editing and downloading. For example, when the sensitivity level of the file is high, the system automatically disables the editing and downloading functions of the file. This measure effectively prevents sensitive files from being edited or downloaded by unauthorized users, ensuring the integrity and confidentiality of the files. By setting strict operation restrictions at the file management level, especially after the file sensitivity assessment, the system can automatically adjust permissions, avoiding problems such as the leakage or tampering of confidential data caused by improper operation permissions. Through fine-grained permission management, the problem of unreasonable restrictions caused by operations being too loose or too strict is solved. When setting file operation permissions, the solution adopts a fine-grained control mechanism. For example, according to user permissions, different categories of operations are allowed to be executed, and the operation permissions can be gradually released according to the permission level. This avoids a one-size-fits-all permission management method and can flexibly adjust operation permissions according to the needs of different users and the sensitivity of the files. While ensuring security, it also guarantees the normal operations of users within the authorized scope, enhancing the flexibility of file management and the user experience. By means of a permission verification process, the potential risks of permission conflicts and improper operations are solved. When each file access request is made, the system will execute a series of permission verification steps, and this verification process ensures the legality and compliance of each access and operation. Even if the user permissions change, or the file sensitivity is adjusted, the system can flexibly verify and restrict operations, avoiding the execution of improper authorizations or sensitive operations. Through this mechanism, the system can dynamically respond to different permission requirements, while ensuring the auditability and transparency of file operations. By generating detailed operation logs, the problem of imperfect file operation auditing is solved. Each file operation, including rejected operations, will generate detailed operation logs, recording the access behaviors of users and the results of operation restrictions. This not only provides transparency of operations but also provides reliable evidence for future security audits. If a file leakage or abuse event occurs, the administrator can trace the operation source through the logs and quickly find out the problem.This audit mechanism greatly enhances the traceability of file operations, ensures the continuity and operability of file security management, provides a basis for the investigation of security vulnerabilities, and improves the overall security guarantee ability. By combining permission management and auditing, the problems of permission abuse and operation auditing are solved. Through fine-grained permission control and detailed audit logs, the system realizes the organic combination of permission management and auditing. User permissions are always controlled during operations, and all operations are recorded, forming a complete operation audit chain. This mechanism effectively prevents permission abuse and ensures that every file operation has a clear record and monitoring, providing strong security guarantee for the organization. Through this integrated management and auditing method, it is ensured that file operations are both strictly controlled and traceable through auditing, guaranteeing the security and transparency of file management.

[0121] 5. By recording and standardizing user behavior characteristics, the problem of difficult anomaly recognition caused by unclear behavior patterns is solved. In the solution, the access behavior characteristic set is recorded every time a user accesses, including key characteristics such as the number of accesses per unit time, the time difference between two consecutive accesses, the type of file accessed, and the time spent staying on the file each time. These characteristics are standardized. By calculating the mean and standard deviation of each characteristic, the behavior characteristics of different users become comparable, and the natural differences in access frequency, behavior patterns, etc. of different users are eliminated. The standardized characteristics make the influence of each behavior characteristic more consistent, avoid the problem of data imbalance caused by too large a difference in the range of characteristic values, and ensure that abnormal behaviors can be accurately recognized. By calculating the comprehensive behavior pattern, the problem that a single behavior characteristic cannot comprehensively identify anomalies is solved. By calculating the weighted comprehensive behavior pattern of each user and representing it as a vector, the solution can comprehensively consider the changes of multiple behavior characteristics, avoiding the limitation of judging anomalies only through a single behavior characteristic. The weights of behavior characteristics are set according to their importance, reflecting the importance of different characteristics to the normal behavior pattern of users. On the basis of comprehensive analysis, the system can more accurately identify the behavior anomalies of users, avoiding false alarms or missed alarms that may be caused by simply relying on a certain characteristic. By calculating the Euclidean distance and comparing it with the historical behavior pattern, the limitations of traditional rule-based anomaly detection methods are solved. Traditional anomaly detection often relies on fixed rules and thresholds, while this solution calculates the Euclidean distance with the historical user behavior pattern, making the recognition of abnormal behaviors more dynamic and intelligent. The behavior characteristics of each user are compared with the historical behavior pattern, and the calculated Euclidean distance can quantify the similarity between the current behavior and the historical behavior, so as to accurately judge whether it is abnormal. This similarity-based detection method is more flexible and accurate than traditional rules and can better adapt to the changes of user behaviors. By setting an alarm trigger threshold, the problem of unclear judgment of abnormal behaviors is solved. After calculating the Euclidean distance, the solution judges whether a user has abnormal behavior by setting an alarm trigger threshold. When the Euclidean distance between the current behavior and the historical behavior pattern exceeds the set threshold, the system will trigger an alarm, indicating that the user's behavior pattern has changed abnormally. The setting of this threshold avoids possible errors in manually judging abnormal behaviors, improving the accuracy and consistency of detection results. The automatic adjustment of the alarm threshold can also be continuously optimized according to the actual situation, enabling the system to better adapt to the changes of user behaviors. By means of an automated emergency response strategy, the problem of lagging response to abnormal behaviors is solved. When the system detects that a user has abnormal behavior, an automated emergency response strategy will be immediately activated after triggering an alarm. The emergency response can include measures such as restricting access rights, freezing accounts, or forcing user authentication. These measures can respond quickly when abnormal behaviors occur, preventing potential security threats from further expanding.Through automated response, the system can react to abnormal behaviors in a timely manner, reduce the lag of human intervention, and enhance the overall security protection ability. Through intelligent data desensitization and virtualization, the potential risk of data leakage is solved. In the solution, intelligent data desensitization and virtualization are performed on user behavior data, and this step solves the potential risk of user data leakage. During the data desensitization process, sensitive information will be replaced or hidden to ensure that even if the data is accessed or leaked improperly, the user's personal sensitive information will not be disclosed. Virtualization processing analyzes by simulating user behavior data, thus avoiding exposing user privacy by using real data. In this way, both the security of the data is guaranteed and the effectiveness of data analysis and abnormal behavior monitoring is not affected.

[0122] 6. By setting regular expressions to extract sensitive data, the problem of difficult identification and isolation of sensitive information is solved. In the solution, by setting regular expressions for sensitive data in the file, the system can automatically identify and extract all sensitive information in the file. This process realizes the accurate identification and efficient extraction of sensitive data, avoiding the cumbersome and inaccurate manual screening of sensitive data. Through this automated extraction method, the management and protection of sensitive information become more systematic and intelligent, while reducing the risk of errors and omissions. By scrambling sensitive data, the risk of data leakage is solved, and data privacy protection is enhanced. After extracting sensitive data from the file, the solution scrambles each sensitive data item to generate desensitized data. Gaussian noise is used to perturb sensitive data, ensuring the security of sensitive information during storage and transmission. Through this scrambling process, sensitive data cannot be restored or identified by unauthorized personnel, thus effectively reducing the risk of data leakage and enhancing the privacy protection ability of the system. By virtualizing non-sensitive data to generate a virtual view, the need for users to view the file content without disclosing sensitive data is solved. For the part of the file that does not contain sensitive information, by generating a virtual view, the solution enables users with different permission levels to access the file content. This method effectively meets the needs of different user permissions to view the file content. For example, for users with lower permissions, only the file title is displayed; for users with higher permissions, partial or complete non-sensitive content is displayed. The generation of the virtual view avoids the improper access of sensitive data and can also display the corresponding file content according to different user permissions, ensuring the security and compliance of the data. By means of a virtual view based on user permission control, the problem of inconsistent file content display is solved. By controlling file display according to the user's permission level (such as only viewing metadata, partial non-sensitive content, or complete content), the solution realizes fine-grained file access control. For users with different permissions, the system will generate corresponding virtual views according to preset rules. For example, users with higher permissions can see the complete file content, while users with lower permissions can only see partial information. In this way, the exposure of sensitive data to low-permission users is avoided, while ensuring the normal usage experience of high-permission users. By desensitizing and virtualizing sensitive data, the challenge of protecting privacy during file sharing is solved. When a file needs to be shared or forwarded to different users, the desensitization of sensitive data and the virtualization of non-sensitive data solution ensure that even during sharing, sensitive information will not be leaked. After desensitization, sensitive information is replaced with noise or placeholders, and the non-sensitive part is virtualized and displayed according to permissions, ensuring that each user can only see the information they have permission to access. This effectively prevents privacy leakage or improper information disclosure caused by file sharing, especially in file sharing and external access scenarios, and can ensure the security and compliance of information. By Gaussian noise perturbation, the feasibility problem of restoring desensitized data is solved.The introduction of Gaussian noise scrambles sensitive data, making it difficult to restore the desensitized data to its original form even if it is maliciously obtained during transmission or storage. Since the standard deviation of the noise is set according to the requirements of the system, the perturbation intensity can be flexibly adjusted to ensure that the desensitized data can meet the privacy protection requirements without affecting subsequent data processing or analysis. This processing method avoids the problem that simple desensitization methods are easily restored, improving the security and practicality of data desensitization.

[0123] 7. By dynamically generating an encryption key and encrypting the file content, the problem of abnormal users accessing sensitive data is solved, enhancing the security of the file. In the solution, the dynamically generated encryption key is combined with the timestamp, user ID, and file unique identifier through a hash function to ensure the uniqueness and timeliness of the encryption key. Whenever a user requests access to a file, the system dynamically generates a new key based on the current time, user ID, and file identifier, effectively avoiding the risk of the key being leaked or misused. After the file content is encrypted, it becomes ciphertext and cannot be directly accessed or viewed by abnormal users, ensuring the security of sensitive data. Even users with abnormal behavior cannot obtain unauthorized file content. By downgrading the permissions of abnormal users to the lowest level, potential security threats are addressed, reducing the risk of malicious behavior. When the system detects abnormal behavior, it downgrades the permissions of the abnormal user to the lowest level through an automated emergency response strategy. This measure can effectively limit the further access and operation of sensitive data by abnormal users and prevent them from misusing access permissions to perform malicious operations. This permission downgrade operation ensures that when a security risk occurs, the system can quickly take measures to contain potential threats at the source and prevent problems such as data leakage or tampering. By continuously monitoring user behavior and disabling the file access permissions of abnormal users, the risk of continuous abnormal behavior is addressed, ensuring the security of data and the controllability of the system. When the system detects abnormal user behavior, it not only promptly downgrades their permissions but also determines whether the abnormality persists by continuously monitoring the user's behavior. If the abnormal behavior persists, the system will further take measures to temporarily disable the user's file access permissions until the administrator lifts the restriction. This process ensures continuous control over high-risk users, avoids short-term risks after a single abnormal behavior, increases the system's emergency response ability in the face of potential threats, improves the response efficiency to abnormal access, and enhances the overall security of the data. By temporarily disabling the permissions of abnormal users, the long-term impact of attacks or misoperations on the system is prevented, ensuring the normal operation of the system. When a user's behavior remains abnormal, the system automatically temporarily disables the user's file access permissions, preventing the user from continuing to operate or access the file during the abnormal behavior period and preventing their actions from having a continuous impact on the data. This mechanism can quickly isolate malicious users and prevent their actions from threatening the security of other normal users or the system. In addition, the system continuously monitors user behavior, and the administrator can lift the restriction according to specific circumstances, ensuring the flexibility and response speed of the system. By integrating the emergency response mechanism, the automation and response efficiency of the system are improved, addressing the problem of insufficient manual intervention. This solution uses an automated emergency response strategy to not only monitor user behavior in real time but also automatically generate an encryption key and encrypt the file according to abnormal behavior. This process reduces the need for manual intervention. Through a series of automated processes such as dynamic key generation, permission downgrading, and access disabling, it quickly responds to and restricts abnormal behavior.This automated process can significantly improve the efficiency of emergency response, reduce the risk of human operation errors and delays, and ensure that the system can take prompt and effective actions in the face of security threats. Brief Description of the Drawings

[0124] Figure 1 It is a schematic diagram of the process of the present invention. Detailed Embodiments

[0125] Next, the technical solutions in the embodiments of the present invention will be clearly and completely described in conjunction with the accompanying drawings in the embodiments of the present invention. Obviously, the described embodiments are only a part of the embodiments of the present invention, rather than all the embodiments. All other embodiments obtained by those of ordinary skill in the art based on the embodiments of the present invention without creative efforts shall fall within the protection scope of the present invention.

[0126] Embodiment, referring to Figure 1 , a security monitoring method for preventing the leakage of confidential documents, including:

[0127] Set up a user permission matrix, denoted as U, representing the set of all users, where each user U i is assigned a permission level;

[0128] where U = [U 1 , U 2 ,..., U n , where U i represents the i-th user;

[0129] For each user U i , perform permission level assignment. The permission level calculation function is specifically:

[0130] L(U i ) ∈ {L 1 , L 2 , L 3 , L 4};

[0131] where L(U i ) represents the permission level of the i-th user; L 1 is for only viewing the metadata of the file, such as file name, file type, creation time, etc.; L 2 is for viewing some non-sensitive content, such as the first 50 lines of a text file, excluding paragraphs containing sensitive information; L 3 is for viewing and editing non-sensitive content and performing some operations on the file, such as modifying the title and editing irrelevant parts; L 4 is for full access rights, including downloading, editing all content, printing, copying, etc.;

[0132] Set a dynamic condition set for user access, denoted as C k , specifically:

[0133] C k ={T k , D k , L k , R k};

[0134] Among them, T k is the exact time of the access request, such as 2024-12-31 08:30:15; D k is the unique identifier of the device, such as the MAC address, device model, to determine whether the access is through an authorized device; L k is the geographical coordinate of the user device, for example L k =(latitude, longitude). If the user accesses the file at an unauthorized location, the access should be rejected; R k is the unique identifier of the file, usually a UUID, used to uniquely identify each file;

[0135] According to the user permission set L(U i ) and the access condition set C k , calculate the access matching degree;

[0136] The condition matching degree calculation function M(L(U i ), C k ) is specifically:

[0137]

[0138] If M(L(U i ), C k ) = 1, allow access to the file, otherwise reject the access and record it;

[0139] If the permission conditions are not met, reject the access, record the log, and return a rejection message to the user; send an instant notification to the administrator for abnormal access behaviors;

[0140] Each access operation generates a detailed access log L access , and its structure is:

[0141] L access ={U i , T k , R k , C k , operation result, failure reason};

[0142] When the operation result is successful, the failure reason is recorded as 0; when the operation result is failed, obtain the real failure reason and record it;

[0143] If access is denied, obtain the reason for the denial and insert the reason for the denial into the access log;

[0144] Use the file sensitivity assessment policy to evaluate the file sensitivity level S f ;

[0145] Perform multi-layer encryption and hierarchical protection on the file;

[0146] Perform permission management and auditing on each file operation;

[0147] Monitor abnormal behaviors of users.

[0148] By setting up a user permission matrix, the problem of inaccurate permission allocation is solved. By assigning different permission levels to each user, a refined permission management system is established. Specifically, the permission level of each user is customized according to their identity, position, and operation requirements, which can ensure that users at different levels only access file content related to their work. Through this method, over-authorization or overly loose unnecessary permissions are avoided, thus reducing the risk of confidential files being accessed by unauthorized users. At the same time, it also avoids problems such as operation errors or abuse of permissions caused by improper user permissions. By setting up a dynamic condition set, the problem of insecurity of user devices and access locations is solved. Setting a dynamic condition set for user access, including the time of the access request, the device unique identifier, the device geographical location, and the file unique identifier, can strictly control the user's access behavior in multiple dimensions. This method can effectively prevent unauthorized devices or unauthorized locations from accessing confidential files, further enhancing the security of file access. For example, when a user attempts to access a file from an unauthorized device or a non-designated location, the system can automatically reject the access and record the log. This avoids malicious access through insecure devices or geographical locations and reduces the risk of internal leakage. By calculating the access matching degree, the problem of untimely permission verification is solved. By calculating the matching degree between the user permission set and the access condition set, the system can immediately determine whether the user meets the access conditions and conduct dynamic permission verification. If the conditions are not met, the system will immediately reject the access and record the reason for rejection. This real-time verification ensures the accuracy of permission matching and reduces the leakage risk caused by permission abuse or access behaviors that do not meet the conditions. By access logs and abnormal behavior monitoring, the problem of security traceability during the file access process is solved. Each access operation generates a detailed access log and records information such as the operation result, the reason for failure, and the reason for rejection, which provides a reliable basis for subsequent audits and security analyses. When an access anomaly occurs, the log will provide a real-time alert to notify the administrator for timely handling of potential security hazards. Combining with the abnormal monitoring of user behaviors, potential threats can be quickly identified when the behavior pattern deviates from the normal, enhancing the controllability and transparency of file management. Through such monitoring and recording, the traceability of file access behaviors is guaranteed, and any abnormal behavior can be discovered and processed in a timely manner, thus effectively preventing potential risks brought by malicious access or misoperations. By file sensitivity assessment and multi-layer encryption, the problem of insufficiently detailed file protection is solved. Using a file sensitivity assessment strategy to dynamically assess the sensitivity of files can adopt different protection measures according to the different sensitivity levels of file content. For highly sensitive files, the system will automatically enable multi-layer encryption technology for protection to ensure that even if the file is illegally accessed or stolen, the data still cannot be read. This hierarchical protection method avoids uniform encryption of all files, improves the processing efficiency, and at the same time ensures the security of highly sensitive files.Through multi-level permission management and auditing, the problem of insufficiently strict supervision of file operations is solved. Permission management and auditing are carried out for each file operation to ensure that operations such as file access, editing, and copying are all carried out under strict permission control. Through the real-time auditing function, managers can clearly understand the specific operations of each user on the file, including behaviors such as modification, viewing, and deletion. This not only improves the operation transparency but also effectively prevents and timely discovers potential violations in file operations.

[0149] Using the file sensitivity assessment strategy to evaluate the file sensitivity level S f , specifically including:

[0150] Obtain the keyword occurrence frequency in the file, denoted as K d ;

[0151] Obtain the file type, denoted as T f ;

[0152] Obtain the file sharing scope, denoted as R f ;

[0153] Set the keyword density threshold, denoted as K threshold ;

[0154] Set the file sensitive type set, denoted as T gather ;

[0155] Set the file sharing scope, denoted as R range ;

[0156] The initial sensitive level of the file is denoted as S low ;

[0157] If the keyword occurrence frequency in the file > K threshold , then the file sensitivity is increased by one level;

[0158] If the file type T f ∈T gather , then the file sensitive level is increased to S high ;

[0159] If the file sharing scope then the file sensitive level is increased to S high ;

[0160] Generate the sensitivity level S F = f(K d , T F , R F ), the result is:

[0161] S low , ordinary file; S medium , important file; S high, Highly sensitive document.

[0162] By obtaining the keyword occurrence frequency in the file content, the problem of judging insensitive information in the file content is solved. By counting the occurrence frequency of keywords in the file content and comparing it with the set keyword density threshold, the system can identify whether the file contains sensitive information. This method can effectively distinguish between ordinary content and keywords related to confidentiality or sensitivity, so as to automatically improve the sensitivity level of the file without manual intervention. If the occurrence frequency of keywords in the file is higher than the preset threshold, the file sensitivity will be automatically increased by one level. This measure can ensure the timely identification of sensitive content, automatically increase the protection level, and reduce the risk of sensitive data being underestimated due to human negligence. By identifying the file type, the problem of insufficient recognition of sensitive file types is solved. When identifying the file type, the system will automatically adjust its sensitivity level according to the file type. For example, for files containing content in fields such as law, finance, and medicine, the system can automatically increase the sensitivity level based on the file type, which can effectively prevent such files from being misclassified as ordinary files due to insensitive types. In this way, the system's automatic perception of the file type can accurately improve the file protection level and ensure that potential sensitive content can be properly protected in any situation. By setting the file sharing scope, the problem of controlling the risk of file leakage is solved. By setting the file sharing scope, the system can evaluate the sharing scope of the file and the degree of openness to external access. If the file is in an environment of extensive sharing, its sensitivity level will be increased. This method helps managers understand which files may be accessed by a large number of users or read by external personnel, so as to adjust the sensitivity and encryption protection level of the file according to the sharing scope. Especially when the file is accessed by external personnel, its sensitivity level is automatically increased, effectively avoiding the risk of file leakage caused by oversharing. By multi-dimensional sensitivity assessment, the problem of inaccurate assessment by a single standard is solved. The assessment of file sensitivity does not rely solely on a single standard, but combines multiple dimensions such as the keyword frequency in the file content, file type, and file sharing scope. This comprehensive assessment method can evaluate the sensitivity of the file more accurately than the traditional single-standard assessment. In the process of increasing the file sensitivity, through the joint analysis of keyword frequency, file type, and sharing scope, the one-sidedness brought by a single factor is avoided, and the accuracy and adaptability of sensitivity assessment are improved. By the sensitivity level generation mechanism, the problem of insufficient identification of sensitive files in file management is solved. Finally, through the generation of sensitivity levels, such as ordinary files, important files, highly sensitive files, the system assigns a clear sensitivity level to the file. The sensitivity level of the file will directly determine its subsequent protection measures, including encryption strategies, access control, etc. By automatically generating and marking the sensitive level of the file, managers can more easily identify and apply the corresponding protection strategies, avoiding omissions or errors in the manual marking and judgment process. In this way, not only the security of the file is enhanced, but also the management efficiency is improved, and the potential risks brought by human factors are reduced.By comprehensively enhancing sensitivity, the problem of insufficient protection in progressive encryption is solved. As the sensitivity of the file increases, the system will automatically perform progressive encryption and enhanced protection on the file. For example, when the file sensitivity is a normal file, only basic permission control may be required, while when the file sensitivity is a highly sensitive file, the system will implement a more stringent encryption algorithm and access control policy. This flexible sensitivity enhancement mechanism enables the system to dynamically adjust the protection level according to the specific situation of the file, thus ensuring that the file can obtain the most appropriate protection under different sensitivities.

[0163] The multi-layer encryption and hierarchical protection of the file specifically include:

[0164] According to the file sensitivity level S f , select different encryption strategies;

[0165] When the file sensitivity level is S low , use symmetric encryption and AES-128;

[0166] When the file sensitivity level is S medium , use hybrid encryption, generate a session key with RSA-2048, and then encrypt with AES-256;

[0167] When the file sensitivity level is S high , use layered encryption, combining ECC elliptic curve encryption and RSA dual encryption;

[0168] Obtain the user ID, denoted as ID;

[0169] Generate a dynamic encryption key: K(t) = H(ID, R k , t, S F );

[0170] Among them, H is a hash function; t is a timestamp; S f File sensitivity level;

[0171] Each time the user requests a file, recalculate and generate the key;

[0172] For S high files, the key is rotated every hour; for S medium files, the key is rotated daily;

[0173] Generate a key usage record log L enc : L enc = {R k , K(t), S F , T k}.

[0174] By selecting different encryption strategies according to the sensitivity level of the file, the problem of insufficient security caused by a single encryption method is solved. According to the sensitivity level of the file, the system selects different encryption strategies, using symmetric encryption AES-128, hybrid encryption RSA-2048 combined with AES-256, and hierarchical encryption combined with ECC and RSA respectively. The encryption methods are prior arts. This method solves the limitations of traditional encryption methods, adopts appropriate encryption schemes for files with different sensitivity levels, avoids using overly complex and resource-consuming encryption algorithms for low-sensitivity files, and at the same time ensures that highly sensitive files can be adequately protected. For example, for ordinary files, AES-128 can be used for efficient encryption, while for highly sensitive files, hierarchical encryption using ECC and RSA can provide higher security, ensuring that the files cannot be cracked even when illegally accessed. This not only optimizes the encryption efficiency but also enhances the security of the files. By generating dynamic encryption keys, the security risk caused by the leakage of fixed keys is solved. Each time a user requests a file, the system generates a new dynamic encryption key based on the sensitivity level of the file, timestamp, and user ID. Through the combination of the hash function and the timestamp, it is ensured that different keys are used for each encryption, effectively avoiding the problem of encryption key leakage that may be caused by fixed keys. Even if an attacker obtains the encryption key of a certain file, they cannot crack other files or future encryption operations because the key is updated each time the file is accessed, greatly increasing the security protection level of the files. By regularly rotating the encryption keys, the security risk brought by using the same key for a long time is solved. For files with different sensitivity levels, the system reduces the risk of key leakage or abuse by regularly rotating the encryption keys, such as once per hour or once per day. This strategy ensures that even if the encryption key is leaked or cracked, the attacker can only use these keys to access the files for a short time, further improving the security. Through this regular key update mechanism, the system can effectively prevent potential threats caused by the long-term validity of the key, increasing the dynamicity and adaptability of security protection. By using the key usage record log, the problem of lack of transparency and auditing in key management is solved. Each time a key is generated and rotated, a detailed key usage record log is generated in the system, recording information such as the specific time of key generation, the encryption algorithm used, and the user ID. The generation and recording of this log not only increase the transparency of key management but also provide important evidence for future security audits. If a key leakage or other security event occurs, the administrator can quickly track the usage of the key through the log, thereby locking the source of the problem and taking preventive measures in a timely manner. This log recording mechanism can effectively ensure the traceability of the key usage process, improving the accuracy and reliability of security monitoring. By flexibly applying different encryption strategies, the balance problem between efficiency and security is solved. In the selection of file encryption strategies, the system adopts a flexible solution, selecting different encryption methods according to the sensitivity level of the file.For low-sensitivity files, AES-128 symmetric encryption is used, which not only ensures the encryption effect but also reduces the resource consumption of encryption calculations; for important files, RSA-2048 is used to generate a session key and combined with AES-256 encryption to enhance the security of encryption; for highly sensitive files, a hierarchical encryption scheme combining ECC and RSA is used to ensure extremely high security. Through this multi-level encryption strategy, the system can balance high security while avoiding using overly complex encryption methods for low-sensitivity files, thus achieving a balance between efficiency and security.

[0175] Perform permission management and auditing for each file operation, specifically including:

[0176] Set the file operation category, denoted as O j , and the operation categories include:

[0177] O 1 , file viewing; O 2 , file editing; O 3 , file downloading; O 4 , file printing;

[0178] Map each type of operation to different permission levels:

[0179] For permission level L 1 : Prohibit all operations and only view metadata;

[0180] For permission level L 2 : Allow O 1 ;

[0181] For permission level L 3 : Allow O 1 and O 2 ;

[0182] For permission level L 4 : Allow O 1 、O 2 、O 3 and O 4 ;

[0183] When the file sensitivity level S f ≥S high then disable O 3 and O 4 ;

[0184] Obtain the user's permission level L(U i );

[0185] Obtain the minimum permission requirement of the file, denoted as L required ;

[0186] If the user's permission level L(Ui ) < L required When this occurs, reject all requests;

[0187] For user request Req(U i , R k , O j ), execute the verification process, specifically:

[0188] S1. Check the permissions L(U i ); i )

[0189] S2. Obtain the file sensitivity level S f ;

[0190] S3. Restrict specific operation O j ;

[0191] S4. Generate a detailed operation log: L audit = {U i , R k , O j , T k , operation result, reason}, and record the user's access behavior and restriction results in the audit log.

[0192] By setting up file operation categories and permission mappings, the problem of management chaos caused by unclear permissions is solved. In the solution, first, file operation categories are set up, such as viewing, editing, downloading, and printing, and each operation is mapped to different permission levels. Through this classification management, it can ensure that the operation permissions of users are clear and easy to manage. Each permission level, such as only being able to view metadata, being able to view and edit file content, etc., corresponds to a specific operation category, making the permission control more refined and transparent. Such an operation mode avoids the ambiguity of permission settings, ensures that users with different permissions can only perform operations that match their permission levels, reduces the risks of misoperations and unauthorized operations, and thus improves the overall security management efficiency. By controlling the permissions for sensitive file operations, the security risks of high-sensitive file operations are solved. For files with different sensitivities, the system sets up permission controls according to the sensitivity levels of the files, specifically including disabling certain operations, such as editing and downloading. For example, when the sensitivity level of a file is high, the system automatically disables the editing and downloading functions of the file. This measure effectively prevents sensitive files from being edited or downloaded by unauthorized users, ensuring the integrity and confidentiality of the files. By setting strict operation restrictions at the file management level, especially after the file sensitivity assessment, the system can automatically adjust permissions, avoiding problems such as the leakage or tampering of confidential data caused by improper operation permissions. Through fine-grained permission management, the unreasonable restriction problems caused by operations being too loose or too strict are solved. When setting file operation permissions, the solution adopts a fine-grained control mechanism. For example, according to the user's permissions, different categories of operations are allowed to be performed, and the operation permissions can be gradually released according to the permission levels. This avoids a one-size-fits-all permission management method and can flexibly adjust the operation permissions according to the needs of different users and the sensitivity of the files. While ensuring security, it also guarantees the normal operations of users within the authorized scope, improving the flexibility of file management and the user experience. By means of a permission verification process, the potential risks of permission conflicts and improper operations are solved. When each file access request is made, the system will execute a series of permission verification steps, and this verification process ensures the legality and compliance of each access and operation. Even if the user's permissions change, or the file sensitivity is adjusted, the system can flexibly verify and restrict operations, avoiding the execution of improper authorizations or sensitive operations. Through this mechanism, the system can dynamically respond to different permission requirements while ensuring the auditability and transparency of file operations. By generating detailed operation logs, the problem of imperfect file operation auditing is solved. Each file operation, including the rejected operations, will generate detailed operation logs, recording the user's access behaviors and the results of operation restrictions. This not only provides transparency of operations but also provides reliable evidence for future security audits. If a file leakage or abuse event occurs, the administrator can trace the operation source through the logs and quickly find out the problem.This audit mechanism greatly enhances the traceability of file operations, ensures the continuity and operability of file security management, provides a basis for troubleshooting security vulnerabilities, and improves the overall security guarantee ability. By combining permission management and auditing, the problems of permission abuse and operation auditing are solved. Through fine-grained permission control and detailed audit logs, the system realizes the organic combination of permission management and auditing. User permissions are always controlled during operations, and all operations are recorded to form a complete operation audit chain. This mechanism effectively prevents permission abuse and ensures that every file operation has a clear record and monitoring, providing strong security protection for the organization. Through this integrated management and auditing method, it is ensured that file operations are both strictly controlled and traceable through auditing, guaranteeing the security and transparency of file management.

[0193] The abnormal monitoring of the user's behavior specifically includes:

[0194] Each time the user accesses, record the set of behavior characteristics of the access B(U i );

[0195] The set of characteristics includes:

[0196] The number of accesses within a unit of time, denoted as B 1 (U i );

[0197] The time difference between two consecutive accesses, denoted as B 2 (U i ), B 2 (U i ) = t j+1 -t j ;

[0198] The type of file accessed, denoted as B 3 (U i );

[0199] The time spent staying when accessing the file each time, denoted as B 4 (U i );

[0200] After the access behavior is recorded, generate the data set B(U i ) = {B 1 (U i ), B 2 (U i ), B 3 (U i ), B 4 (U i )}, where B j (U i ) represents the user U iThe j-th behavioral feature;

[0201] For each behavioral feature B j (U i ) is normalized, and the normalization formula is:

[0202]

[0203] where B j (U i ) is the j-th behavioral feature value of user U i ;

[0204] μ j is the mean value of all users on the j-th feature, specifically:

[0205] σ j is the standard deviation of all users on the j-th feature, specifically:

[0206]

[0207] where n is the number of all users participating in behavioral analysis;

[0208] Calculate the comprehensive behavioral pattern of each user based on the normalized value of each behavioral feature, specifically:

[0209]

[0210] where, ω j is the weight of behavioral feature B j (U i );B' j (U i ) is the normalized behavioral feature; m is the total number of elements in the feature set;

[0211] Record the behavioral pattern Pattern(U i ) of each user as a vector:

[0212] Pattern(U i ) = [B′ 1 (U i ), B' 2 (U i ), …, B′ m (U i )];

[0213] Use historical user data D = {B 1 (U 1 ), B 2 (U 1 ),..., B n (Un ) perform training to obtain the set of behavior patterns of all users:

[0214] P = {Pattern(U 1 ), Pattern(U 2 ), …, Pattern(U n )};

[0215] For user U i with the current behavior feature B j (U i ), calculate the Euclidean distance ΔB(U i );

[0216]

[0217] where Pattern j (U i ) is the j-th eigenvalue of user U i in the historical behavior pattern;

[0218] Set the alarm trigger threshold, denoted as θ alert ;

[0219] When ΔB(U i ) > θ alert , then user U i has abnormal behavior and adopts an automated emergency response strategy;

[0220] Perform intelligent data desensitization and virtualization on the data.

[0221] By recording and standardizing user behavior characteristics, the problem of difficult anomaly recognition caused by unclear behavior patterns is solved. In the solution, the access behavior characteristic set is recorded every time a user accesses, including key characteristics such as the number of accesses per unit time, the time difference between two consecutive accesses, the type of file accessed, and the time spent staying on the file each time. These characteristics are standardized. By calculating the mean and standard deviation of each characteristic, the behavior characteristics of different users become comparable, and the natural differences in access frequencies, behavior patterns, etc. of different users are eliminated. The standardized characteristics make the influence of each behavior characteristic more consistent, avoid the problem of data imbalance caused by too large a difference in the range of characteristic values, and ensure that abnormal behaviors can be accurately recognized. By comprehensively calculating the behavior pattern, the problem that a single behavior characteristic cannot comprehensively identify anomalies is solved. By calculating the weighted comprehensive behavior pattern of each user and representing it as a vector, the solution can comprehensively consider the changes of multiple behavior characteristics, avoiding the limitation of judging anomalies only through a single behavior characteristic. The weights of the behavior characteristics are set according to their importance, reflecting the importance of different characteristics to the normal behavior pattern of users. On the basis of comprehensive analysis, the system can more accurately identify the behavior anomalies of users, avoiding false alarms or missed alarms that may be caused by simply relying on a certain characteristic. By calculating the Euclidean distance and comparing it with the historical behavior pattern, the limitations of traditional rule-based anomaly detection methods are solved. Traditional anomaly detection often relies on fixed rules and thresholds, while this solution calculates the Euclidean distance from the historical user behavior pattern, making the recognition of abnormal behaviors more dynamic and intelligent. The behavior characteristics of each user are compared with the historical behavior pattern, and the calculated Euclidean distance can quantify the similarity between the current behavior and the historical behavior, so as to accurately judge whether it is abnormal. This similarity-based detection method is more flexible and accurate than traditional rules and can better adapt to the changes in user behavior. By setting an alarm trigger threshold, the problem of unclear judgment of abnormal behaviors is solved. After calculating the Euclidean distance, the solution judges whether a user has abnormal behavior by setting an alarm trigger threshold. When the Euclidean distance between the current behavior and the historical behavior pattern exceeds the set threshold, the system will trigger an alarm, indicating that the user's behavior pattern has changed abnormally. The setting of this threshold avoids possible errors in manually judging abnormal behaviors and improves the accuracy and consistency of the detection results. The automatic adjustment of the alarm threshold can also be continuously optimized according to the actual situation, enabling the system to better adapt to the changes in user behavior. By means of an automated emergency response strategy, the problem of lagging response to abnormal behaviors is solved. When the system detects that a user has abnormal behavior, it will immediately start an automated emergency response strategy after triggering an alarm. The emergency response can include measures such as restricting access rights, freezing accounts, or forcing user authentication. These measures can respond quickly when abnormal behaviors occur and prevent potential security threats from further expanding.Through automated response, the system can react to abnormal behaviors in a timely manner, reduce the lag of human intervention, and enhance the overall security protection ability. Through intelligent data desensitization and virtualization, the potential risk of data leakage is solved. In the solution, intelligent data desensitization and virtualization are performed on user behavior data, and this step solves the potential risk of user data leakage. During the data desensitization process, sensitive information will be replaced or hidden to ensure that even if the data is accessed or leaked improperly, the user's personal sensitive information will not be disclosed. Virtualization processing analyzes by simulating user behavior data, thus avoiding exposing user privacy with real data. In this way, both the security of the data is guaranteed, and the effectiveness of data analysis and abnormal behavior monitoring is not affected.

[0222] The intelligent data desensitization and virtualization of the data specifically include:

[0223] Set regular expressions for sensitive data in the file;

[0224] Use regular expressions to extract the set of sensitive data in the file and denote it as: S = {s 1 , s 2 ,..., s p}, where each s i is a sensitive information segment;

[0225] Perform scrambling processing on each sensitive data item s i to generate desensitized data s′ i :

[0226] s′ i = s i + r, r ~ N(0, σ 2 );

[0227] Among them, r is Gaussian noise, and the standard deviation σ is the noise magnitude;

[0228] Generate a virtual view V(N) for the non-sensitive part N of the file content, where:

[0229] All sensitive fields s i are replaced with *;

[0230] If the permission of user U i is L 1 , only display the file title; if it is L 2 , display some non-sensitive content; if it is L 3 or L 4 , then display the complete non-sensitive part.

[0231] By setting regular expressions to extract sensitive data, the problem of difficult identification and isolation of sensitive information is solved. In the solution, by setting regular expressions for sensitive data in the file, the system can automatically identify and extract all sensitive information in the file. This process realizes the accurate identification and efficient extraction of sensitive data, avoiding the cumbersome and inaccurate manual screening of sensitive data. Through this automated extraction method, the management and protection of sensitive information become more systematic and intelligent, while reducing the risk of omission and error. By scrambling sensitive data, the risk of data leakage is solved and data privacy protection is enhanced. After extracting sensitive data from the file, the solution scrambles each sensitive data item to generate desensitized data. Gaussian noise is used to perturb sensitive data, ensuring the security of sensitive information during storage and transmission. Through this scrambling process, sensitive data cannot be restored or identified by unauthorized personnel, thus effectively reducing the risk of data leakage and enhancing the privacy protection ability of the system. By virtualizing non-sensitive data to generate virtual views, the need for users to view file content without disclosing sensitive data is solved. For the part of the file that does not contain sensitive information, by generating virtual views, the solution enables users with different permission levels to access the file content. This method effectively meets the needs of different user permissions to view file content. For example, for users with lower permissions, only the file title is displayed; for users with higher permissions, partial or complete non-sensitive content is displayed. The generation of virtual views avoids the improper access of sensitive data and can also display the corresponding file content according to different user permissions, ensuring the security and compliance of the data. By means of virtual views based on user permission control, the problem of inconsistent file content display is solved. By controlling file display according to the user's permission level (such as only viewing metadata, partial non-sensitive content, or complete content), the solution realizes fine-grained file access control. For users with different permissions, the system will generate corresponding virtual views according to preset rules. For example, users with higher permissions can see the complete file content, while users with lower permissions can only see partial information. In this way, the exposure of sensitive data to low-permission users is avoided, while ensuring the normal usage experience of high-permission users. By desensitizing and virtualizing sensitive data, the challenge of protecting privacy during file sharing is solved. When a file needs to be shared or forwarded to different users, the desensitization of sensitive data and the virtualization of non-sensitive data solution ensure that even during sharing, sensitive information will not be leaked. After desensitization, sensitive information is replaced with noise or placeholders, and the non-sensitive part is virtually displayed according to permissions, ensuring that each user can only see the information they have permission to access. This effectively prevents privacy leakage or improper information disclosure caused by file sharing, especially in scenarios of file sharing and external access, and can ensure the security and compliance of information. By Gaussian noise perturbation, the feasibility problem of restoring desensitized data is solved.The introduction of Gaussian noise scrambles sensitive data, making it difficult to restore desensitized data to real data during transmission or storage, even if it is maliciously obtained. Since the standard deviation of the noise is set according to the requirements of the system, the disturbance intensity can be flexibly adjusted to ensure that the desensitized data can meet the privacy protection requirements without affecting subsequent data processing or analysis. This processing method avoids the problem that simple desensitization methods are easy to restore, and improves the security and practicality of data desensitization.

[0232] The automated emergency response strategy specifically includes:

[0233] Get the user ID, denoted as U ID ;

[0234] Dynamically generate encryption keys:

[0235] K′(t)=H(U ID +R k +t);

[0236] Among them, K′(t) is based on the timestamp t, user ID U ID and the unique identifier of the file R k Dynamically generated encryption key; H is the hash function used to generate the key;

[0237] Encrypt the contents of file F using the dynamic key K′(t):

[0238]

[0239] After encryption, the content of file F becomes ciphertext and users cannot directly view it;

[0240] Downgrade the privileges of users with abnormal behavior to the lowest level L 1 ;

[0241] Continuously monitor user behavior. If user behavior continues to be abnormal, temporarily disable the user's file access rights until the administrator removes the user's permission restrictions.

[0242] By dynamically generating an encryption key and encrypting the file content, the problem of abnormal users accessing sensitive data is solved, enhancing the security of the file. In the solution, the dynamically generated encryption key is combined with the timestamp, user ID, and file unique identifier through a hash function to ensure the uniqueness and timeliness of the encryption key. Whenever a user requests access to a file, the system dynamically generates a new key based on the current time, user ID, and file identifier, effectively avoiding the risk of the key being leaked or misused. After the file content is encrypted, it becomes ciphertext and cannot be directly accessed or viewed by abnormal users, ensuring the security of sensitive data. Even users with abnormal behavior cannot obtain unauthorized file content. By downgrading the permissions of abnormal users to the lowest level, potential security threats are addressed, reducing the risk of malicious behavior. When the system detects abnormal behavior, it downgrades the permissions of the abnormal user to the lowest level through an automated emergency response strategy. This measure can effectively limit the further access and operation of the abnormal user to sensitive data and prevent them from misusing their access rights to perform malicious operations. This permission downgrade operation ensures that when a security risk occurs, the system can quickly take measures to contain potential threats at the source and prevent problems such as data leakage or tampering. By continuously monitoring user behavior and disabling the file access permissions of abnormal users, the risk of continuous abnormal behavior is addressed, ensuring the security of data and the controllability of the system. When the system detects abnormal user behavior, it not only promptly downgrades their permissions but also determines whether the abnormality persists by continuously monitoring the behavior of the user. If the abnormal behavior persists, the system will take further measures to temporarily disable the user's file access permissions until the administrator lifts the restriction. This process ensures continuous control over high-risk users, avoids short-term risks after a single abnormal behavior, increases the system's emergency response ability in the face of potential threats, improves the response efficiency to abnormal access, and enhances the overall security of the data. By temporarily disabling the permissions of abnormal users, the long-term impact of attacks or misoperations on the system is prevented, ensuring the normal operation of the system. When a user's behavior remains abnormal, the system automatically temporarily disables the user's file access permissions, preventing the user from continuing to operate or access the file during the abnormal behavior period and preventing their behavior from having a continuous impact on the data. This mechanism can quickly isolate malicious users and prevent their behavior from threatening the security of other normal users or the system. In addition, the system continuously monitors user behavior, and the administrator can lift the restriction according to specific circumstances, ensuring the flexibility and response speed of the system. By integrating an emergency response mechanism, the automation and response efficiency of the system are improved, addressing the problem of insufficient manual intervention. Through an automated emergency response strategy, this solution not only monitors user behavior in real time but also automatically generates an encryption key and encrypts the file according to abnormal behavior. This process reduces the need for manual intervention. Through a series of automated processes such as dynamic key generation, permission downgrading, and access disabling, it quickly responds to and restricts abnormal behavior.This automated processing can significantly improve the efficiency of emergency response, reduce the risk of human operation errors and delays, and ensure that the system can take prompt and effective actions when facing security threats.

[0243] It should be noted that in this article, relational terms such as first and second are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any actual relationship or order between these entities or operations. Moreover, the term "comprising", "including" or any other variant thereof is intended to cover non-exclusive inclusion, so that a process, method, article or device comprising a series of elements not only includes those elements, but also includes other elements not expressly listed, or also includes elements inherent to such process, method, article or device.

[0244] The above are only the preferred embodiments of the present invention. It should be pointed out that for those of ordinary skill in the art, without departing from the technical principle of the present invention, several improvements and refinements can be made, and these improvements and refinements should also be regarded as the protection scope of the present invention.

Claims

1. A security monitoring method for preventing confidential documents from being leaked, characterized in that: include: Set the user permission matrix, denoted as U, to represent the set of all users, where each user U i is assigned a level of authority; Where U=[U1,U2,…,U n ], where U i represents the i-th user; For each user U i To allocate permission levels, the permission level calculation function is as follows: <h2 style=";text-align:left;direction:ltr">L(U<h2 style=";text-align:left;direction:ltr"> i <h2 style=";text-align:left;direction:ltr"> )∈{L1,L2,L3,L4}; Among them, L(U i ) represents the i-th user permission level; L1 means only the user can view the metadata of the file; L2 means the user can view some non-sensitive content; L3 means the user can view and edit non-sensitive content and perform some operations in the file; L4 means full access permission; Set the dynamic condition set for user access, denoted as C k , specifically: C k ={T k ,D k ,L k ,R k }; Among them, T k To record the exact time of the access request; D k L is the unique identifier of the device; k is the geographic coordinates of the user's device. If the user accesses the file at an unauthorized location, access should be denied; R k It is the unique identifier of the file, used to uniquely identify each file; According to the user permission set L(U i ) and access condition set C k , calculate the access matching degree; Condition matching calculation function M(L(U i ),C k ) specifically: If M(L(U i ),C k )=1, then access to the file is allowed, otherwise access is denied and recorded; If the permission conditions are not met, access is denied, logs are recorded, and the denial information is returned to the user; for abnormal access behavior, an instant notification is sent to the administrator; Generate detailed access log for each access operation access , whose structure is: L access = {U i ,T k ,R k ,C k ,operation result,failure reason}; When the operation result is successful, the failure reason is recorded as 0; when the operation result is failed, the real failure reason is obtained and recorded; If access is denied, obtain the reason for the denial and insert the denial reason into the access log; Use the file sensitivity assessment strategy to assess the file sensitivity level S f ; Perform multi-layer encryption and hierarchical protection on files; Perform permission management and audit on each file operation; Monitor user behavior for abnormalities.

2. A security monitoring method for preventing confidential documents from being leaked according to claim 1, characterized in that: The file sensitivity evaluation strategy is used to evaluate the file sensitivity level S f , specifically including: Get the frequency of occurrence of keywords in the file content, denoted as K d ; Get the file type, recorded as T f ; Get the file sharing range, denoted as R f ; Set the keyword density threshold, denoted as K threshold ; Set the file sensitive type set, denoted as T gather ; Set the file sharing scope, denoted as R range ; The initial sensitivity level of the file is recorded as S low ; If the frequency of keyword occurrence in the file is greater than K threshold , the file sensitivity increases by one level; If the file type is T f ∈T gather , then the file sensitivity level is raised to S high ; If the file sharing range The file sensitivity level is raised to S high ; Generate sensitivity level S f =f(K d ,T f ,R f ), the result is: S low , ordinary file; S medium , important documents; S high , highly sensitive files.

3. A security monitoring method for preventing confidential documents from being leaked according to claim 2, characterized in that: The multi-layer encryption and hierarchical protection of files specifically includes: According to the file sensitivity level S f , choose different encryption strategies; When the file sensitivity level is S low When using symmetric encryption, use AES-128; When the file sensitivity level is S medium When using hybrid encryption, use RSA-2048 to generate the session key, and then encrypt it with AES-256; When the file sensitivity level is S high When using layered encryption, it combines ECC elliptic curve encryption and RSA double encryption; Get the user ID, recorded as ID; Generate dynamic encryption key: K(t)=H(ID,R k ,t,S f ); Among them, H is the hash function; t is the timestamp; S f Document sensitivity level; Each time a user requests a file, the key is recalculated and generated; For S high File, the key is rotated every hour; for S medium File,keys are rotated daily; Generate key usage log L enc :L enc = {R k ,K(t),S f ,T k }.

4. A security monitoring method for preventing confidential documents from being leaked according to claim 2, characterized in that: The permission management and auditing of each file operation specifically includes: Set the file operation category, marked as O j , the operation categories include: O1, file viewing; O2, file editing; O3, file downloading; O4, file printing; Map each type of operation to a different permission level: For permission L1: all operations are prohibited, only metadata can be viewed; For permission L2: allow O1; For permission L3: O1 and O2 are allowed; For permission L4: O1, O2, O3 and O4 are allowed; When the file sensitivity level is S f ≥S high When , O3 and O4 are disabled; Get user permissions L(U i ); The minimum permission requirement for obtaining a file, denoted as L required ; If the user permission L(U i ) <L required When , reject all requests; For user request Req(U i ,R k ,O j ) performs the verification process, specifically: S1. Check U i Permissions L(U i ); S2. Get the file sensitivity level S f ; S3. Restriction of specific operations j ; S4. Generate detailed operation log: L audit = {U i ,R k ,O j ,T k ,operation result, reason}, record the user's access behavior and restriction results in the audit log.

5. A security monitoring method for preventing confidential documents from being leaked according to claim 1, characterized in that: The abnormal monitoring of user behavior specifically includes: Each time a user visits, the behavioral feature set B(U i ); The feature set includes: The number of visits per unit time is recorded as B1(U i ); The time difference between two consecutive visits is denoted as B2(U i ), B2(U i ) = t j+1 -t j ; The type of access file is recorded as B3(U i ); The time spent on each file access is recorded as B4(U i ); After accessing the behavior records, the dataset B (U i )={B1(U i ),B2(U i ),B3(U i ),B4(U i )}, where B j (U i ) represents user U i The jth behavior feature of For each behavioral feature B j (U i ) is standardized, and the standardization formula is: Among them, B j (U i ) is user U i The j-th behavior characteristic value of; μ j is the mean of all users on the jth feature, specifically: σ j is the standard deviation of all users on the jth feature, specifically: Where n is the number of all users involved in the behavior analysis; The comprehensive behavior pattern of each user is calculated based on the standardized value of each behavior feature, specifically: Among them, ω j Behavioral characteristic B j (U i ) weight; B' j (U i ) is the standardized behavior feature; m is the total number of elements in the feature set; Each user's behavior pattern (U i ) is recorded as a vector: Pattern(U i )=[B'1(U i ),B'2(U i ),…,B′ m (U i )]; Use historical user data D = {B1(U1), B2(U1), ..., B n (U n )} to train and obtain the behavior pattern set of all users: P={Pattern(U1),Pattern(U2),…,Pattern(U n )}; For User U i Current Behavior Characteristics B j (U i ), calculate the Euclidean distance ΔB(U i ); Among them, Pattern j (U i ) is user U i The jth eigenvalue in the historical behavior pattern; Set the alarm trigger threshold, denoted as θ alert ; When ΔB(U i )>θ alert When user U i In case of abnormal behavior, adopt automated emergency response strategies; Intelligently desensitize and virtualize data.

6. A security monitoring method for preventing confidential documents from being leaked according to claim 5, characterized in that: The intelligent data desensitization and virtualization of data specifically includes: Set regular expressions for sensitive data in files; The sensitive data set extracted from the file using regular expressions is recorded as: S = {s1, s2, ..., s p }, where each s i For sensitive information fragments; For each sensitive data item s i Perform scrambling to generate desensitized data s' i : s′ i =s i +r,r~N(0,σ 2 ); Among them, r is Gaussian noise, and the standard deviation σ is the noise size; Generate a virtual view V(N) for the non-sensitive part N of the file content, where: All sensitive fields i Replace with *; If user U i If the permission is L1, only the file title is displayed; if it is L2, some non-sensitive content is displayed; if it is L3 or L4, the complete non-sensitive part is displayed.

7. A security monitoring method for preventing confidential documents from being leaked according to claim 5, characterized in that: The automated emergency response strategy specifically includes: Get the user ID, denoted as U ID ; Dynamically generate encryption keys: K'(t)=H(U ID +R k +t); Among them, K′(t) is based on the timestamp t, user ID U ID and the unique identifier of the file R k Dynamically generated encryption key; H is the hash function used to generate the key; Encrypt the contents of file F using the dynamic key K'(t): After encryption, the content of file F becomes ciphertext and users cannot directly view it; Downgrade the privileges of users with abnormal behaviors to the lowest level, L1; Continuously monitor user behavior. If user behavior continues to be abnormal, temporarily disable the user's file access rights until the administrator removes the user's permission restrictions.

Images