A security monitoring method for preventing the leakage of confidential documents

Abstract

The present invention relates to the technical field of security monitoring for preventing the leakage of confidential documents, and discloses a security monitoring method for preventing the leakage of confidential documents. By setting up a user permission matrix and a dynamic access condition set, the system manages user permissions in a refined manner, ensuring that users only access relevant documents, reducing the risk of unauthorized access. The dynamic condition set includes access time, device identification, and geographical location to prevent access from insecure devices or locations. The system verifies the permission matching degree in real time, promptly rejects access that does not meet the conditions, and reduces the risks of permission abuse and information leakage. Each access generates a detailed log, recording the operation results and rejection information, and notifying the administrator when abnormal behavior occurs. Combining file sensitivity assessment with a multi-layer encryption strategy, the system adopts different protection measures according to the file sensitivity. Through real-time permission management and auditing, the system monitors the compliance of file operations and promptly discovers potential violations.

Description

Technical Field

[0001] The present invention relates to the technical field of security monitoring for preventing the leakage of confidential documents, and specifically to a security monitoring method for preventing the leakage of confidential documents. Background Art

[0002] With the rapid development of information technology, the electronic management of data has gradually become the core. Especially in the management of confidential documents and sensitive data, document leakage and improper operations have become serious security risks. The leakage of confidential documents may not only lead to economic losses for companies or organizations, but also trigger major risks of legal liability and social reputation. Therefore, the security protection of confidential documents has become a key issue in the field of information security.

[0003] Currently, the protective measures against the leakage of confidential documents are roughly divided into two categories: one is the protection technology based on the document itself, such as file encryption, permission control, and watermark technology; the other is the protection technology based on user behavior and network monitoring, such as data leakage prevention, intrusion detection systems, behavior analysis, etc. Although file encryption and permission control are important means to prevent the leakage of confidential documents, there are still risks in the management of encryption keys and permission allocation in existing technologies. If the encryption key is stolen or leaked, the security of the file will be seriously threatened; in terms of permission control, overly loose permission allocation or un-updated permission settings may lead to unauthorized access or abuse of confidential documents by unauthorized personnel. Currently, most security monitoring methods focus on a certain aspect of technology, such as encryption, permission management, or behavior monitoring, and lack a comprehensive solution to integrate these technologies. Such fragmented security protection measures often cannot effectively cope with complex attacks or leakage risks. For example, although behavior analysis can detect abnormal operations, it does not combine the sensitivity assessment of files for dynamic encryption and permission adjustment, thus missing the opportunity for real-time protection.

[0004] In order to better prevent the leakage of confidential documents, the present invention aims to propose a security monitoring method for preventing the leakage of confidential documents, which involves integrating encryption, permission management, and behavior monitoring to establish a comprehensive security system to protect confidential documents in real time from multiple perspectives and reduce the blind spots of single technologies. Summary of the Invention

[0005] The present invention provides a security monitoring method for preventing the leakage of confidential documents, which promotes the solution of the problems mentioned in the above background art.

[0006] The present invention provides the following technical solution: A security monitoring method for preventing the leakage of confidential documents, including:

[0007] Set up a user permission matrix, denoted as U, representing the set of all users, where each user U i is assigned a permission level;

[0008] where U = [U1, U2,..., U n , where U i represents the i-th user;

[0009] For each user U i perform permission level assignment. The permission level calculation function is specifically:

[0010] L(U i ) ∈ {L1, L2, L3, L4};

[0011] where L(U i ) represents the permission level of the i-th user; L1 is only able to view the metadata of the file; L2 is able to view some non-sensitive content; L3 is able to view and edit non-sensitive content and can perform some operations on the file; L4 is full access permission;

[0012] Set the dynamic condition set for user access, denoted as C k , specifically:

[0013] C k = {T k , D k , Lk, R k};

[0014] where T k is the exact time when the access request is recorded; D k is the unique identifier of the device; L k is the geographical coordinate of the user's device. If the user accesses the file at an unauthorized location, the access should be rejected; R k is the unique identifier of the file, used to uniquely identify each file;

[0015] According to the user permission set L(U i ) and the access condition set C k , calculate the access matching degree;

[0016] The condition matching degree calculation function M(L(U i ), C k ) is specifically:

[0017]

[0018] If M(L(U i ), C k ) = 1, then allow access to the file, otherwise reject access and record;

[0019] If the permission conditions are not met, reject access, record the log, and return a rejection message to the user; send an immediate notification to the administrator for abnormal access behaviors;

[0020] Each access operation generates a detailed access log L access , whose structure is as follows:

[0021] L access ={U i , T k , R k , C k , operation result, failure reason};

[0022] When the operation result is successful, the failure reason is recorded as 0; when the operation result is a failure, obtain the real failure reason and record it;

[0023] If access is denied, obtain the reason for denial and insert the reason for denial into the access log;

[0024] Evaluate the file sensitivity level S using a file sensitivity evaluation strategy f ;

[0025] Perform multi-layer encryption and hierarchical protection on the file;

[0026] Perform permission management and auditing on each file operation;

[0027] Monitor abnormal behaviors of users.

[0028] Optionally, the evaluation of the file sensitivity level S using the file sensitivity evaluation strategy f specifically includes:

[0029] Obtain the frequency of occurrence of keywords in the file content, denoted as K d ;

[0030] Obtain the file type, denoted as T f ;

[0031] Obtain the file sharing scope, denoted as R f ;

[0032] Set the keyword density threshold, denoted as K threshold ;

[0033] Set the set of file sensitive types, denoted as T gather ;

[0034] Set the file sharing scope, denoted as R range ;

[0035] The initial file sensitivity level is denoted as S low ;

[0036] If the frequency of occurrence of keywords in the file > K threshold , then the file sensitivity is increased by one level;

[0037] If the file type is T f ∈T gather , then the file sensitivity level is raised to S high ;

[0038] If the file sharing scope then the file sensitivity level is raised to S high ;

[0039] Generate the sensitivity level S f = f(K d , T f , R F ), and the result is:

[0040] S low , ordinary file; S medium , important file; S high , highly sensitive file.

[0041] Optionally, the multi-layer encryption and hierarchical protection of the file specifically include:

[0042] According to the file sensitivity level S F , select different encryption strategies;

[0043] When the file sensitivity level is S low , symmetric encryption is adopted, and AES-128 is used;

[0044] When the file sensitivity level is S medium , hybrid encryption is adopted, and RSA-2048 is used to generate a session key, and then AES-256 is used for encryption;

[0045] When the file sensitivity level is S high , hierarchical encryption is adopted, combining ECC elliptic curve encryption and RSA double encryption;

[0046] Obtain the user ID, denoted as ID;

[0047] Generate a dynamic encryption key: K(t) = H(ID, R k , t, S f );

[0048] where H is a hash function; t is a timestamp; S F is the file sensitivity level;

[0049] Each time the user requests a file, recalculate and generate the key;

[0050] For S high files, the key is rotated every hour; for S medium files, the key is rotated daily;

[0051] Generate a key usage record log L enc : L enc = {R k , K(t), S f , T k}.

[0052] Optionally, perform permission management and auditing on each file operation, specifically including:

[0053] Set the file operation category, denoted as O j , and the operation categories include:

[0054] O1, file viewing; O2, file editing; O3, file downloading; O4, file printing;

[0055] Map each type of operation to different permission levels:

[0056] For permission level L1: Prohibit all operations and only view metadata;

[0057] For permission level L2: Allow O1;

[0058] For permission level L3: Allow O1 and O2;

[0059] For permission level L4: Allow O1, O2, O3, and O4;

[0060] When the file sensitivity level S f ≥ S high , then disable O3 and O4;

[0061] Obtain the user's permission L(U i );

[0062] Obtain the minimum permission requirement of the file, denoted as L required ;

[0063] If the user's permission L(U i ) < L required , reject all requests;

[0064] Execute a verification process on the user request Req(U i , R k , O j ), specifically:

[0065] S1, Check the permission L(U i ) of U i ;

[0066] S2, Obtain the file sensitivity level S f ;

[0067] S3, Restrict specific operations O j ;

[0068] S4. Generate a detailed operation log: L audit ={U i , R k , O j , T k , operation result, reason}, and record the user's access behavior and restriction result into the audit log.

[0069] Optionally, the abnormal monitoring of the user's behavior specifically includes:

[0070] Each time the user accesses, record the set of behavior characteristics of the access B(U i );

[0071] The set of characteristics includes:

[0072] The number of accesses within a unit time, denoted as B1(U i );

[0073] The time difference between two consecutive accesses, denoted as B2(U i ), B2(U i ) = t j+1 -t j ;

[0074] The type of file accessed, denoted as B3(U i );

[0075] The time spent staying when accessing the file each time, denoted as B4(U i );

[0076] After the access behavior is recorded, generate a data set B(U i ) = {B1(U i ), B2(U i ), B3(U i ), B4(U i )}, where B j (U i ) represents the jth behavior characteristic of user U i ;

[0077] Perform normalization processing on each behavior characteristic B j (U i ), and the normalization formula is:

[0078]

[0079] where, B j (U i ) is the jth behavior characteristic value of user U i ;

[0080] μj is the mean value of all users on the j-th feature, specifically:

[0081] σ j is the standard deviation of all users on the j-th feature, specifically:

[0082]

[0083] where n is the number of all users participating in behavior analysis;

[0084] Calculate the comprehensive behavior pattern of each user according to the standardized value of each behavior feature, specifically:

[0085]

[0086] where, ω j is the weight of the behavior feature B j (U i ); B′ j (U i ) is the standardized behavior feature; m is the total number of elements in the feature set;

[0087] Record the behavior pattern Pattern(U i ) of each user as a vector:

[0088] Pattern(U i ) = [B′1(U i ), B'2(U i ), …, B′ m (U i )];

[0089] Use the historical user data D = {B1(U1), B2(U1),..., B n (U n )) to train and obtain the set of behavior patterns of all users:

[0090] P = {Pattern(U1), Pattern(U2), …, Pattern(U n )};

[0091] For the current behavior feature B i of user U j (U i ), calculate the Euclidean distance ΔB(U i ) from the historical behavior pattern;

[0092]

[0093] where, Pattern j(U i ) is the j-th eigenvalue of user U i in the historical behavior pattern;

[0094] Set the alarm trigger threshold, denoted as θ alert ;

[0095] When ΔB(U i ) > θ alert , then user U i has abnormal behavior and adopts an automated emergency response strategy;

[0096] Perform intelligent data desensitization and virtualization on the data.

[0097] Optionally, the intelligent data desensitization and virtualization of the data specifically includes:

[0098] Set regular expressions for sensitive data in the file;

[0099] Use regular expressions to extract the set of sensitive data in the file, denoted as: S = {s1, s2,..., s p}, where each s i is a sensitive information segment;

[0100] Perform scrambling processing on each sensitive data item s i to generate desensitized data s′ i :

[0101] s′ i = s i + r, r ∼ N(0, σ 2 );

[0102] where r is Gaussian noise and the standard deviation σ is the noise magnitude;

[0103] Generate a virtual view V(N) for the non-sensitive part N of the file content, where:

[0104] All sensitive fields s i are replaced with *;

[0105] If the permission of user U i is L1, only the file title is displayed; if it is L2, some non-sensitive content is displayed; if it is L3 or L4, the complete non-sensitive part is displayed.

[0106] Optionally, the automated emergency response strategy specifically includes:

[0107] Obtain the user ID, denoted as U ID ;

[0108] Dynamically generate an encryption key:

[0109] K′(t)=H(U ID +R k +t);

[0110] Among them, K′(t) is based on the timestamp t, user ID U ID and the unique identifier R of the file k Dynamically generated encryption key; H is the hash function used to generate the key;

[0111] Encrypt the contents of file F using the dynamic key K′(t):

[0112]

[0113] After encryption, the content of file F becomes ciphertext and cannot be viewed directly by users;

[0114] Downgrade the privileges of users with abnormal behavior to the lowest level, L1;

[0115] Continuously monitor user behavior. If user behavior persists, temporarily disable the user's file access permissions until the administrator removes the user's permission restrictions.

[0116] The present invention has the following beneficial effects:

[0117] 1. By setting up a user permission matrix, the problem of inaccurate permission allocation is solved. By assigning different permission levels to each user, a refined permission management system is established. Specifically, the permission level of each user is customized according to their identity, position, and operation requirements, which can ensure that users at different levels only access file content related to their work. Through this method, over-authorization or overly lenient unnecessary permissions are avoided, thereby reducing the risk of confidential files being accessed by unauthorized users. At the same time, it also avoids problems such as operation errors or abuse of permissions caused by improper permissions. By setting up a dynamic condition set, the problem of insecurity of user devices and access locations is solved. Setting a dynamic condition set for user access, including the time of the access request, the device unique identifier, the device geographical location, and the file unique identifier, can strictly control the access behavior of users in multiple dimensions. This method can effectively prevent unauthorized devices or unauthorized locations from accessing confidential files, further enhancing the security of file access. For example, when a user attempts to access a file from an unauthorized device or a non-designated location, the system can automatically reject the access and record the log. This avoids malicious access through insecure devices or geographical locations and reduces the risk of internal leakage. By calculating the access matching degree, the problem of untimely permission verification is solved. By calculating the matching degree between the user permission set and the access condition set, the system can immediately determine whether the user meets the access conditions and perform dynamic permission verification. If the conditions are not met, the system will immediately reject the access and record the reason for rejection. This real-time verification ensures the accuracy of permission matching and reduces the leakage risk caused by abuse of permissions or access behaviors that do not meet the conditions. By means of access logs and abnormal behavior monitoring, the problem of security traceability in the file access process is solved. Each access operation generates a detailed access log and records information such as the operation result, the reason for failure, and the reason for rejection, which provides a reliable basis for subsequent audits and security analyses. When an access anomaly occurs, the log will provide a real-time alert to notify the administrator for timely handling of potential security hazards. Combining with the abnormal monitoring of user behaviors, potential threats can be quickly identified when the behavior pattern deviates from the normal, enhancing the controllability and transparency of file management. Through such monitoring and recording, the traceability of file access behaviors is guaranteed, and any abnormal behavior can be discovered and processed in a timely manner, thus effectively preventing potential risks brought by malicious access or misoperations. By means of file sensitivity assessment and multi-layer encryption, the problem of insufficiently detailed file protection is solved. Using a file sensitivity assessment strategy to dynamically assess the sensitivity of files can adopt different protection measures according to the different sensitivity levels of file content. For highly sensitive files, the system will automatically enable multi-layer encryption technology for protection to ensure that even if the file is illegally accessed or stolen, the data still cannot be read. This hierarchical protection method avoids uniform encryption of all files, improves the processing efficiency, and at the same time ensures the security of highly sensitive files.Through multi-level permission management and auditing, the problem of insufficiently strict supervision of file operations is solved. Permission management and auditing are carried out for each file operation to ensure that operations such as file access, editing, and copying are all carried out under strict permission control. Through the real-time auditing function, managers can clearly understand the specific operations of each user on the file, including behaviors such as modification, viewing, and deletion. This not only improves the operation transparency but also effectively prevents and timely discovers potential violations in file operations.

[0118] 2. By obtaining the keyword occurrence frequency in the file content, the problem of judging insensitive information in the file content is solved. By counting the occurrence frequency of keywords in the file content and comparing it with the set keyword density threshold, the system can identify whether the file contains sensitive information. This method can effectively distinguish between ordinary content and keywords related to confidentiality or sensitivity, so as to automatically improve the sensitivity level of the file without manual intervention. If the occurrence frequency of keywords in the file is higher than the preset threshold, the file sensitivity will be automatically increased by one level. This measure can ensure the timely identification of sensitive content, automatically increase the protection level, and reduce the risk of sensitive data being underestimated due to human negligence. By identifying the file type, the problem of insufficient identification of sensitive file types is solved. When identifying the file type, the system will automatically adjust its sensitivity level according to the type of the file. For example, for files containing content in fields such as law, finance, and medicine, the system can automatically increase the sensitivity level based on the file type, which can effectively prevent such files from being misclassified as ordinary files due to insensitive types. In this way, the system's automatic perception of the file type can accurately improve the file protection level and ensure that potential sensitive content can be properly protected under any circumstances. By setting the file sharing scope, the problem of controlling the risk of file leakage is solved. By setting the file sharing scope, the system can evaluate the sharing scope of the file and the degree of openness to external access. If the file is in an environment of extensive sharing, its sensitivity level will be increased. This method helps managers understand which files may be accessed by a large number of users or read by external personnel, so as to adjust the sensitivity and encryption protection level of the file according to the sharing scope. Especially when the file is accessed by external personnel, its sensitivity level is automatically increased, effectively avoiding the risk of file leakage caused by excessive sharing. By multi-dimensional sensitivity assessment, the problem of inaccurate assessment by a single standard is solved. The assessment of file sensitivity does not rely solely on a single standard, but combines multiple dimensions such as the keyword frequency in the file content, the file type, and the file sharing scope. This comprehensive assessment method can evaluate the sensitivity of the file more accurately than the traditional single-standard assessment. In the process of increasing the file sensitivity, through the joint analysis of keyword frequency, file type, and sharing scope, the one-sidedness brought by a single factor is avoided, and the accuracy and adaptability of sensitivity assessment are improved. By the sensitivity level generation mechanism, the problem of insufficient identification of sensitive files in file management is solved. Finally, through the generation of sensitivity levels, such as ordinary files, important files, highly sensitive files, the system assigns a clear sensitivity level to the file. The sensitivity level of the file will directly determine its subsequent protection measures, including encryption policies, access control, etc. By automatically generating and marking the sensitivity level of the file, managers can more easily identify and apply the corresponding protection strategies, avoiding omissions or errors in the manual marking and judgment process. In this way, not only the security of the file is enhanced, but also the management efficiency is improved, and the potential risks brought by human factors are reduced.By comprehensively enhancing sensitivity, the problem of insufficient progressive encryption protection is solved. As the sensitivity of the file increases, the system will automatically perform progressive encryption and enhanced protection on the file. For example, when the file sensitivity is a normal file, only basic permission control may be required, while when the file sensitivity is a highly sensitive file, the system will implement more stringent encryption algorithms and access control policies. This flexible sensitivity enhancement mechanism enables the system to dynamically adjust the protection level according to the specific situation of the file, thus ensuring that the file can obtain the most appropriate protection under different sensitivities.

[0119] 3. By selecting different encryption strategies according to the file sensitivity level, the problem of insufficient security caused by a single encryption method is solved. According to the sensitivity level of the file, the system selects different encryption strategies, and respectively uses symmetric encryption AES-128, hybrid encryption RSA-2048 combined with AES-256, and hierarchical encryption combined with ECC and RSA. The encryption method is the prior art. This method solves the limitations of traditional encryption methods, adopts appropriate encryption schemes for files with different sensitivity levels, avoids using overly complex and resource-consuming encryption algorithms for low-sensitivity files, and at the same time ensures that highly sensitive files can be adequately protected. For example, for ordinary files, AES-128 can be used for efficient encryption, while for highly sensitive files, hierarchical encryption using ECC and RSA can provide higher security, ensuring that the files cannot be cracked even when illegally accessed. This not only optimizes the encryption efficiency but also enhances the security of the files. By generating dynamic encryption keys, the security risk caused by the leakage of fixed keys is solved. Each time a user requests a file, the system generates a new dynamic encryption key according to the file's sensitivity level, timestamp, and user ID. Through the combination of the hash function and the timestamp, it is ensured that different keys are used for each encryption, which effectively avoids the problem of encryption key leakage that may be caused by fixed keys. Even if an attacker obtains the encryption key of a certain file, they cannot crack other files or future encryption operations because the key is updated each time the file is accessed, greatly increasing the security protection level of the files. By regularly rotating the encryption keys, the security risk brought by using the same key for a long time is solved. For files with different sensitivity levels, the system reduces the risk of key leakage or abuse by regularly rotating the encryption keys, such as once an hour or once a day. This strategy ensures that even if the encryption key is leaked or cracked, the attacker can only use these keys to access the files for a short time, further improving the security. Through this regular key update mechanism, the system can effectively prevent potential threats caused by the long-term validity of the key, increasing the dynamicity and adaptability of security protection. By means of the key usage record log, the problem of lack of transparency and auditing in key management is solved. Each time a key is generated and rotated, a detailed key usage record log is generated in the system, recording information such as the specific time of key generation, the encryption algorithm used, and the user ID. The generation and recording of this log not only increase the transparency of key management but also provide important evidence for future security audits. If a key leakage or other security incident occurs, the administrator can quickly track the usage of the key through the log, thereby locking the source of the problem and taking preventive measures in a timely manner. This log recording mechanism can effectively ensure the traceability of the key usage process, improving the accuracy and reliability of security monitoring. By the flexible application of different encryption strategies, the balance problem between efficiency and security is solved. In the selection of file encryption strategies, the system adopts a flexible solution and selects different encryption methods according to the file's sensitivity level.For low-sensitivity files, AES-128 symmetric encryption is adopted, which not only ensures the encryption effect but also reduces the resource consumption of encryption calculations; for important files, RSA-2048 is used to generate a session key and combined with AES-256 encryption to enhance the security of encryption; for highly sensitive files, a hierarchical encryption scheme combining ECC and RSA is used to ensure extremely high security. Through this multi-level encryption strategy, the system can avoid using overly complex encryption methods for low-sensitivity files while ensuring high security, thus achieving a balance between efficiency and security.

[0120] 4. By setting up file operation categories and permission mappings, the problem of management chaos caused by unclear permissions is solved. In the solution, first, file operation categories are set up, such as viewing, editing, downloading, and printing, and each operation is mapped to different permission levels. Through this classification management, it can be ensured that the operation permissions of users are clear and easy to manage. Each permission level, such as only being able to view metadata, being able to view and edit file content, etc., corresponds to a specific operation category, making the permission control more refined and transparent. Such an operation mode avoids the ambiguity of permission settings, ensures that users with different permissions can only perform operations that match their permission levels, reduces the risks of misoperations and unauthorized operations, and thus improves the overall security management efficiency. By controlling the permissions for sensitive file operations, the security risks of high-sensitive file operations are solved. For files with different sensitivities, the system sets permission controls according to the sensitivity levels of the files, specifically including disabling certain operations, such as editing and downloading. For example, when the sensitivity level of a file is high, the system automatically disables the editing and downloading functions of the file. This measure effectively prevents sensitive files from being edited or downloaded by unauthorized users, ensuring the integrity and confidentiality of the files. By setting strict operation restrictions at the file management level, especially after the file sensitivity assessment, the system can automatically adjust permissions, avoiding the leakage or tampering of confidential data caused by improper operation permissions. Through fine-grained permission management, the problem of unreasonable restrictions caused by overly loose or overly strict operations is solved. When setting file operation permissions, the solution adopts a fine-grained control mechanism. For example, according to user permissions, different categories of operations are allowed to be performed, and the operation permissions can be gradually released according to the permission level. This avoids a one-size-fits-all permission management method and can flexibly adjust operation permissions according to the needs of different users and the sensitivity of files. While ensuring security, it also guarantees the normal operations of users within the authorized scope, improving the flexibility of file management and the user experience. By means of a permission verification process, the potential risks of permission conflicts and improper operations are solved. When each file access request is made, the system will execute a series of permission verification steps, and this verification process ensures the legality and compliance of each access and operation. Even if the user permissions change, or the file sensitivity is adjusted, the system can flexibly verify and restrict operations, avoiding the execution of improper authorizations or sensitive operations. Through this mechanism, the system can dynamically respond to different permission requirements while ensuring the auditability and transparency of file operations. By generating detailed operation logs, the problem of imperfect file operation auditing is solved. Each file operation, including rejected operations, will generate detailed operation logs, recording the access behaviors of users and the results of operation restrictions. This not only provides transparency of operations but also provides reliable evidence for future security audits. If a file leakage or abuse event occurs, the administrator can trace the operation source through the logs and quickly find out the problem.This audit mechanism greatly enhances the traceability of file operations, ensures the continuity and operability of file security management, provides a basis for security vulnerability detection, and improves the overall security protection ability. By combining permission management and auditing, it solves the problems of permission abuse and operation auditing. Through fine-grained permission control and detailed audit logs, the system realizes the organic combination of permission management and auditing. User permissions are always controlled during operations, and all operations are recorded to form a complete operation audit chain. This mechanism effectively prevents permission abuse and ensures that every file operation has a clear record and monitoring, providing strong security protection for the organization. Through this integrated management and auditing method, it ensures that file operations are both strictly controlled and traceable through auditing, guaranteeing the security and transparency of file management.

[0121] 5. By recording and standardizing user behavior characteristics, the problem of difficult anomaly recognition caused by unclear behavior patterns is solved. In the solution, the access behavior feature set is recorded each time a user accesses, including key features such as the number of accesses per unit time, the time difference between two consecutive accesses, the type of file accessed, and the time spent on each accessed file. These features are standardized by calculating the mean and standard deviation of each feature, making the behavior characteristics of different users comparable and eliminating the natural differences in access frequencies and behavior patterns of different users. The standardized features make the influence of each behavior feature more consistent, avoiding the problem of data imbalance caused by too large differences in feature value ranges and ensuring that abnormal behaviors can be accurately recognized. By calculating the comprehensive behavior pattern, the problem that a single behavior feature cannot comprehensively identify anomalies is solved. By calculating the weighted comprehensive behavior pattern of each user and representing it as a vector, the solution can comprehensively consider the changes of multiple behavior features, avoiding the limitation of judging anomalies only through a single behavior feature. The weights of the behavior features are set according to their importance, reflecting the importance of different features to the normal behavior pattern of users. On the basis of comprehensive analysis, the system can more accurately identify the behavior anomalies of users, avoiding the false alarm or missed alarm problems that may be caused by simply relying on a certain feature. By calculating the Euclidean distance and comparing it with the historical behavior pattern, the limitations of traditional rule-based anomaly detection methods are solved. Traditional anomaly detection often relies on fixed rules and thresholds, while this solution calculates the Euclidean distance with the historical user behavior pattern, making the recognition of abnormal behaviors more dynamic and intelligent. The behavior characteristics of each user are compared with the historical behavior pattern, and the calculated Euclidean distance can quantify the similarity between the current behavior and the historical behavior, so as to accurately judge whether it is abnormal. This similarity-based detection method is more flexible and accurate than traditional rules and can better adapt to the changes of user behaviors. By setting an alarm trigger threshold, the problem of unclear judgment of abnormal behaviors is solved. After calculating the Euclidean distance, the solution judges whether a user has abnormal behavior by setting an alarm trigger threshold. When the Euclidean distance between the current behavior and the historical behavior pattern exceeds the set threshold, the system will trigger an alarm, indicating that the user's behavior pattern has changed abnormally. The setting of this threshold avoids possible errors in manually judging abnormal behaviors and improves the accuracy and consistency of detection results. The automatic adjustment of the alarm threshold can also be continuously optimized according to the actual situation, enabling the system to better adapt to the changes of user behaviors. By adopting an automated emergency response strategy, the problem of lagging response to abnormal behaviors is solved. When the system detects that a user has abnormal behavior, it will immediately start an automated emergency response strategy after triggering an alarm. The emergency response can include measures such as restricting access rights, freezing accounts, or forcing user authentication. These measures can respond quickly when abnormal behaviors occur and prevent potential security threats from further expanding.Through automated response, the system can react to abnormal behaviors in a timely manner, reduce the lag of human intervention, and enhance the overall security protection ability. Through intelligent data desensitization and virtualization, the potential risk of data leakage is solved. In the solution, intelligent data desensitization and virtualization processing are carried out on user behavior data, and this step solves the potential risk of user data leakage. During the data desensitization process, sensitive information will be replaced or hidden to ensure that even if the data is accessed or leaked improperly, the user's personal sensitive information will not be disclosed. Virtualization processing analyzes by simulating user behavior data, thus avoiding exposing user privacy by using real data. In this way, both the security of the data is guaranteed and the effectiveness of data analysis and abnormal behavior monitoring is not affected.

[0122] 6. By setting regular expressions to extract sensitive data, the problem of difficult identification and isolation of sensitive information is solved. In the solution, by setting regular expressions for sensitive data in the file, the system can automatically identify and extract all sensitive information in the file. This process realizes the accurate identification and efficient extraction of sensitive data, avoiding the cumbersome and inaccurate manual screening of sensitive data. Through this automated extraction method, the management and protection of sensitive information become more systematic and intelligent, while reducing the risk of omission and error. By scrambling sensitive data, the risk of data leakage is solved and data privacy protection is enhanced. After extracting sensitive data from the file, the solution scrambles each sensitive data item to generate de-sensitized data. Gaussian noise is used to perturb the sensitive data, ensuring the security of sensitive information during storage and transmission. Through this scrambling process, sensitive data cannot be restored or identified by unauthorized personnel, thus effectively reducing the risk of data leakage and enhancing the privacy protection ability of the system. By virtualizing non-sensitive data to generate a virtual view, the need for users to view the file content without disclosing sensitive data is solved. For the part of the file that does not contain sensitive information, by generating a virtual view, the solution enables users with different permission levels to access the file content. This method effectively meets the needs of different user permissions to view the file content. For example, for users with lower permissions, only the file title is displayed; for users with higher permissions, partial or complete non-sensitive content is displayed. The generation of the virtual view avoids the improper access of sensitive data and can also display the corresponding file content according to different user permissions, ensuring the security and compliance of the data. By means of a virtual view based on user permission control, the problem of inconsistent display of file content is solved. By controlling the file display according to the user's permission level (such as only viewing metadata, partial non-sensitive content, or complete content), the solution realizes fine-grained file access control. For users with different permissions, the system will generate corresponding virtual views according to preset rules. For example, users with higher permissions can see the complete file content, while users with lower permissions can only see partial information. In this way, the exposure of sensitive data to low-permission users is avoided, while ensuring the normal usage experience of high-permission users. By desensitization and virtualization of sensitive data, the challenge of protecting privacy during file sharing is solved. When the file needs to be shared or forwarded to different users, the desensitization of sensitive data and the virtualization of non-sensitive data solution ensure that even during sharing, sensitive information will not be leaked. After desensitization, sensitive information is replaced with noise or placeholders, and the non-sensitive part is virtualized and displayed according to permissions, ensuring that each user can only see the information they are authorized to access. This effectively prevents privacy leakage or improper information disclosure caused by file sharing, especially in file sharing and external access scenarios, and can ensure the security and compliance of information. By Gaussian noise perturbation, the feasibility problem of restoring de-sensitized data is solved.The introduction of Gaussian noise scrambles sensitive data, making it difficult to restore the desensitized data to its original form even if it is maliciously obtained during transmission or storage. Since the standard deviation of the noise is set according to the requirements of the system, the perturbation intensity can be flexibly adjusted to ensure that the desensitized data can meet the privacy protection requirements without affecting subsequent data processing or analysis. This processing method avoids the problem that simple desensitization methods are easily restored, improving the security and practicality of data desensitization.

[0123] 7. By dynamically generating an encryption key and encrypting the file content, the problem of unauthorized users accessing sensitive data is solved, enhancing the security of the file. In the solution, the dynamically generated encryption key is combined with the timestamp, user ID, and file unique identifier through a hash function to ensure the uniqueness and timeliness of the encryption key. Whenever a user requests access to a file, the system dynamically generates a new key based on the current time, user ID, and file identifier, effectively avoiding the risk of key leakage or abuse. After the file content is encrypted into ciphertext, it cannot be directly accessed or viewed by unauthorized users, ensuring the security of sensitive data. Even for users with abnormal behavior, they cannot obtain unauthorized file content. By downgrading the permissions of unauthorized users to the lowest level, potential security threats are addressed, reducing the risk of malicious behavior. When the system detects abnormal behavior, it downgrades the permissions of the unauthorized user to the lowest level through an automated emergency response strategy. This can effectively limit the further access and operation of the unauthorized user to sensitive data and prevent them from abusing their access rights to perform malicious operations. This permission downgrade operation ensures that when a security risk occurs, the system can quickly take measures to contain potential threats at the source and prevent problems such as data leakage or tampering. By continuously monitoring user behavior and disabling the file access permissions of unauthorized users, the risk of continuous abnormal behavior is addressed, ensuring the security of data and the controllability of the system. When the system detects abnormal user behavior, it not only promptly downgrades their permissions but also determines whether the abnormality persists by continuously monitoring the user's behavior. If the abnormal behavior persists, the system will further take measures to temporarily disable the user's file access permissions until the administrator lifts the restriction. This process ensures continuous control over high-risk users, avoids short-term risks after a single abnormal behavior, increases the system's emergency response ability in the face of potential threats, improves the response efficiency to abnormal access, and enhances the overall security of the data. By temporarily disabling the permissions of unauthorized users, the long-term impact of attacks or misoperations on the system is prevented, ensuring the normal operation of the system. When a user's behavior remains abnormal, the system automatically temporarily disables the user's file access permissions, preventing the user from continuing to operate or access the file during the abnormal behavior and preventing their actions from having a continuous impact on the data. This mechanism can quickly isolate malicious users and prevent their actions from threatening the security of other normal users or the system. In addition, the system continuously monitors user behavior, and the administrator can lift the restriction according to specific circumstances, ensuring the flexibility and response speed of the system. By integrating an emergency response mechanism, the automation and response efficiency of the system are improved, addressing the problem of insufficient manual intervention. This solution, through an automated emergency response strategy, not only monitors user behavior in real time but also automatically generates an encryption key and encrypts the file according to abnormal behavior. This process reduces the need for manual intervention. Through a series of automated processes such as dynamic key generation, permission downgrading, and access disabling, it quickly responds to and restricts abnormal behavior.This automated process can significantly improve the efficiency of emergency response, reduce the risk of human operation errors and delays, and ensure that the system can take prompt and effective actions when facing security threats. BRIEF DESCRIPTION OF THE DRAWINGS

[0124] Figure 1 It is a schematic flow diagram of the present invention. DETAILED DESCRIPTION OF THE INVENTION

[0125] The technical solutions in the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings in the embodiments of the present invention. Obviously, the described embodiments are only a part of the embodiments of the present invention, rather than all the embodiments. All other embodiments obtained by those of ordinary skill in the art based on the embodiments of the present invention without creative efforts shall fall within the protection scope of the present invention.

[0126] Example, refer to Figure 1 , a security monitoring method for preventing the leakage of confidential documents, including:

[0127] Set up a user permission matrix, denoted as U, representing the set of all users, where each user U i is assigned a permission level;

[0128] where U = [U1, U2,..., U n , where U i represents the i-th user;

[0129] For each user U i perform permission level assignment, and the permission level calculation function is specifically:

[0130] L(U i ) ∈ {L1, L2, L3, L4};

[0131] where L(U i ) represents the permission level of the i-th user; L1 is only able to view the metadata of the file, such as file name, file type, creation time, etc.; L2 is able to view some non-sensitive content, such as the first 5 lines of a text file, excluding paragraphs containing sensitive information; L3 is able to view and edit non-sensitive content, and can perform some operations on the file, such as modifying the title, editing irrelevant parts; L4 is full access permission, including downloading, editing all content, printing, copying, etc.;

[0132] Set up a dynamic condition set when the user accesses, denoted as C k , specifically:

[0133] C k = {T k , D k , L k, R k};

[0134] Among them, T k is the exact time when the access request is recorded, such as 2024-12-31 08:30:15; D k is the unique identifier of the device, such as the MAC address, device model, to determine whether the access is through an authorized device; L k is the geographical coordinate of the user device, for example L k =(latitude, longitude), if the user accesses the file at an unauthorized location, the access should be rejected; R k is the unique identifier of the file, usually a UUID, used to uniquely identify each file;

[0135] According to the user permission set L(U i ) and the access condition set C k , calculate the access matching degree;

[0136] The condition matching degree calculation function M(L(U i ), C k ) is specifically:

[0137]

[0138] If M(L(U i ), C k ) = 1, allow access to the file, otherwise reject access and record;

[0139] If the permission condition is not met, reject access, record the log, and return a rejection message to the user; send an immediate notification to the administrator for abnormal access behavior;

[0140] Each access operation generates a detailed access log L access , and its structure is:

[0141] L access ={U i , T k , R k , C k , operation result, failure reason};

[0142] When the operation result is successful, the failure reason is recorded as 0; when the operation result is failure, obtain the real failure reason and record it;

[0143] If the access is rejected, obtain the rejection reason and insert the rejection reason into the access log;

[0144] Use the file sensitivity evaluation strategy to evaluate the file sensitivity level S f ;

[0145] Perform multi-layer encryption and hierarchical protection on files;

[0146] Perform permission management and auditing on each file operation;

[0147] Monitor abnormal behaviors of users.

[0148] By setting up a user permission matrix, the problem of inaccurate permission allocation is solved. By assigning different permission levels to each user, a refined permission management system is established. Specifically, the permission level of each user is customized according to their identity, position, and operation requirements, which can ensure that users at different levels only access file content related to their work. Through this method, over-authorization or overly loose unnecessary permissions are avoided, thus reducing the risk of confidential files being accessed by unauthorized users. At the same time, it also avoids problems such as operation errors or abuse of permissions caused by improper user permissions. By setting up a dynamic condition set, the problem of insecurity of user devices and access locations is solved. Setting a dynamic condition set for user access, including the time of the access request, the device unique identifier, the device geographical location, and the file unique identifier, can strictly control the user's access behavior in multiple dimensions. This method can effectively prevent unauthorized devices or unauthorized locations from accessing confidential files, further enhancing the security of file access. For example, when a user attempts to access a file from an unauthorized device or a non-designated location, the system can automatically reject the access and record the log. This avoids malicious access through insecure devices or geographical locations and reduces the risk of internal leakage. By calculating the access matching degree, the problem of untimely permission verification is solved. By calculating the matching degree between the user permission set and the access condition set, the system can immediately determine whether the user meets the access conditions and perform dynamic permission verification. If the conditions are not met, the system will immediately reject the access and record the reason for rejection. This real-time verification ensures the accuracy of permission matching and reduces the leakage risk caused by permission abuse or access behavior that does not meet the conditions. By means of access logs and abnormal behavior monitoring, the problem of security traceability during the file access process is solved. Each access operation generates a detailed access log and records information such as the operation result, the reason for failure, and the reason for rejection, which provides a reliable basis for subsequent auditing and security analysis. When an access anomaly occurs, the log will provide a real-time alert to notify the administrator for timely handling of potential security hazards. Combining with the abnormal monitoring of user behavior, potential threats can be quickly identified when the behavior pattern deviates from the normal, enhancing the controllability and transparency of file management. Through such monitoring and recording, the traceability of file access behavior is guaranteed, and any abnormal behavior can be promptly discovered and processed, thus effectively preventing potential risks brought by malicious access or misoperation. By means of file sensitivity assessment and multi-layer encryption, the problem of insufficiently detailed file protection is solved. Using a file sensitivity assessment strategy to dynamically assess the sensitivity of files can adopt different protection measures according to the different sensitivity levels of file content. For highly sensitive files, the system will automatically enable multi-layer encryption technology for protection to ensure that even if the file is illegally accessed or stolen, the data still cannot be read. This hierarchical protection method avoids unified encryption of all files, improves the processing efficiency, and at the same time ensures the security of highly sensitive files.Through multi-level permission management and auditing, the problem of insufficiently strict supervision of file operations is solved. Permission management and auditing are carried out for each file operation to ensure that operations such as file access, editing, and copying are all carried out under strict permission control. Through the real-time auditing function, managers can clearly understand the specific operations of each user on the file, including behaviors such as modification, viewing, and deletion. This not only improves the operation transparency but also effectively prevents and timely discovers potential violations in file operations.

[0149] Using the file sensitivity assessment strategy to assess the file sensitivity level S f , specifically including:

[0150] Obtain the keyword occurrence frequency in the file, denoted as K d ;

[0151] Obtain the file type, denoted as T f ;

[0152] Obtain the file sharing scope, denoted as R f ;

[0153] Set the keyword density threshold, denoted as K threshold ;

[0154] Set the file sensitive type set, denoted as T gather ;

[0155] Set the file sharing scope, denoted as R range ;

[0156] The initial sensitive level of the file is denoted as S low ;

[0157] If the keyword occurrence frequency in the file > K threshold , the file sensitivity is increased by one level;

[0158] If the file type T f ∈T gather , the file sensitive level is increased to S high ;

[0159] If the file sharing scope then the file sensitive level is increased to S high ;

[0160] Generate the sensitivity level S F = f(K d , T F , R F ), the result is:

[0161] S low , ordinary file; S medium , important file; S high, Highly sensitive document.

[0162] By obtaining the keyword occurrence frequency in the file content, the problem of judging insensitive information in the file content is solved. By counting the occurrence frequency of keywords in the file content and comparing it with the set keyword density threshold, the system can identify whether the file contains sensitive information. This method can effectively distinguish ordinary content from keywords related to confidentiality or sensitivity, so as to automatically improve the sensitivity level of the file without manual intervention. If the occurrence frequency of keywords in the file is higher than the preset threshold, the file sensitivity will be automatically increased by one level. This measure can ensure the timely identification of sensitive content, automatically increase the protection level, and reduce the risk of sensitive data being underestimated due to human negligence. By identifying the file type, the problem of insufficient identification of sensitive file types is solved. When identifying the file type, the system will automatically adjust its sensitivity level according to the type of the file. For example, for files containing content in fields such as law, finance, and medicine, the system can automatically increase the sensitivity level based on the file type, which can effectively prevent such files from being misclassified as ordinary files due to insensitive types. In this way, the system's automatic perception of the file type can accurately improve the file protection level and ensure that potential sensitive content can be properly protected under any circumstances. By setting the file sharing scope, the problem of controlling the risk of file leakage is solved. By setting the file sharing scope, the system can evaluate the sharing scope of the file and the degree of openness to external access. If the file is in an environment of extensive sharing, its sensitivity level will be increased. This method helps managers understand which files may be accessed by a large number of users or read by external personnel, so as to adjust the sensitivity and encryption protection level of the file according to the sharing scope. Especially when the file is accessed by external personnel, its sensitivity level is automatically increased, effectively avoiding the risk of file leakage caused by excessive sharing. By multi-dimensional sensitivity assessment, the problem of inaccurate assessment by a single standard is solved. The assessment of file sensitivity does not rely solely on a single standard, but combines multiple dimensions such as the keyword frequency in the file content, the file type, and the file sharing scope. This comprehensive assessment method can evaluate the sensitivity of the file more accurately than the traditional single-standard assessment. In the process of increasing the file sensitivity, through the joint analysis of keyword frequency, file type, and sharing scope, the one-sidedness brought by a single factor is avoided, and the accuracy and adaptability of sensitivity assessment are improved. By the sensitivity level generation mechanism, the problem of insufficient identification of sensitive files in file management is solved. Finally, through the generation of sensitivity levels, such as ordinary files, important files, highly sensitive files, the system assigns a clear sensitivity level to the file. The sensitivity level of the file will directly determine its subsequent protection measures, including encryption strategies, access control, etc. By automatically generating and marking the sensitive level of the file, managers can more easily identify and apply the corresponding protection strategies, avoiding omissions or errors in the manual marking and judgment process. In this way, not only the security of the file is enhanced, but also the management efficiency is improved, and the potential risks brought by human factors are reduced.By comprehensively enhancing sensitivity, the problem of insufficient protection in progressive encryption is solved. As the sensitivity of the file increases, the system will automatically perform progressive encryption and enhanced protection on the file. For example, when the file sensitivity is a normal file, only basic permission control may be required, while when the file sensitivity is a highly sensitive file, the system will implement more stringent encryption algorithms and access control policies. This flexible sensitivity enhancement mechanism enables the system to dynamically adjust the protection level according to the specific situation of the file, thus ensuring that the file can obtain the most appropriate protection at different sensitivities.

[0163] The multi-layer encryption and hierarchical protection of the file specifically include:

[0164] According to the file sensitivity level S f , select different encryption strategies;

[0165] When the file sensitivity level is S low , use symmetric encryption and AES-128;

[0166] When the file sensitivity level is S medium , use hybrid encryption, generate a session key with RSA-2048, and then encrypt with AES-256;

[0167] When the file sensitivity level is S high , use hierarchical encryption, combining ECC elliptic curve encryption and RSA double encryption;

[0168] Obtain the user ID, denoted as ID;

[0169] Generate a dynamic encryption key: K(t) = H(ID, R k , t, S F );

[0170] where H is a hash function; t is a timestamp; S f is the file sensitivity level;

[0171] Each time the user requests the file, recalculate and generate the key;

[0172] For S high files, the key is rotated every hour; for S medium files, the key is rotated daily;

[0173] Generate a key usage record log L enc : L enc = {R k , K(t), S F , T k}.

[0174] By selecting different encryption strategies according to the file sensitivity level, the problem of insufficient security caused by a single encryption method is solved. According to the sensitivity level of the file, the system selects different encryption strategies, using symmetric encryption AES-128, hybrid encryption RSA-2048 combined with AES-256, and hierarchical encryption combined with ECC and RSA respectively. The encryption methods are prior arts. This method solves the limitations of traditional encryption methods, adopts appropriate encryption schemes for files with different sensitivity levels, avoids using overly complex and resource-consuming encryption algorithms for low-sensitivity files, and at the same time ensures that highly sensitive files can be adequately protected. For example, for ordinary files, AES-128 can be used for efficient encryption, while for highly sensitive files, hierarchical encryption using ECC and RSA can provide higher security, ensuring that the files cannot be cracked even when illegally accessed. This not only optimizes the encryption efficiency but also enhances the security of the files. By generating dynamic encryption keys, the security risk caused by the leakage of fixed keys is solved. Each time a user requests a file, the system generates a new dynamic encryption key based on the file's sensitivity level, timestamp, and user ID. Through the combination of a hash function and a timestamp, it is ensured that different keys are used for each encryption, effectively avoiding the problem of encryption key leakage that may be caused by fixed keys. Even if an attacker obtains the encryption key of a certain file, they cannot crack other files or future encryption operations because the key is updated each time the file is accessed, greatly increasing the security protection level of the files. By regularly rotating the encryption keys, the security risk brought by using the same key for a long time is solved. For files with different sensitivity levels, the system reduces the risk of key leakage or abuse by regularly rotating the encryption keys, such as once per hour or once per day. This strategy ensures that even if the encryption key is leaked or cracked, the attacker can only use these keys to access the files for a short period of time, further improving the security. Through this regular key update mechanism, the system can effectively prevent potential threats caused by the long-term validity of the key, increasing the dynamicity and adaptability of security protection. By means of the key usage record log, the problem of lack of transparency and auditing in key management is solved. Each time a key is generated and rotated, a detailed key usage record log is generated in the system, recording information such as the specific time of key generation, the encryption algorithm used, and the user ID. The generation and recording of this log not only increase the transparency of key management but also provide important evidence for future security audits. If a key leakage or other security incident occurs, the administrator can quickly track the usage of the key through the log, thereby locking the source of the problem and taking preventive measures in a timely manner. This log recording mechanism can effectively ensure the traceability of the key usage process, improving the accuracy and reliability of security monitoring. By flexibly applying different encryption strategies, the balance problem between efficiency and security is solved. In the selection of file encryption strategies, the system adopts a flexible solution, choosing different encryption methods according to the sensitivity level of the file.For low-sensitivity files, AES-128 symmetric encryption is adopted, which not only ensures the encryption effect but also reduces the resource consumption of encryption calculations; for important files, RSA-2048 is used to generate a session key and combined with AES-256 encryption to enhance the security of encryption; for highly sensitive files, a hierarchical encryption scheme combining ECC and RSA is used to ensure extremely high security. Through this multi-level encryption strategy, the system can avoid using overly complex encryption methods for low-sensitivity files while ensuring high security, thus achieving a balance between efficiency and security.

[0175] Perform permission management and auditing on each file operation, specifically including:

[0176] Set the file operation category, denoted as O j , and the operation categories include:

[0177] O1, file viewing; O2, file editing; O3, file downloading; O4, file printing;

[0178] Map each type of operation to different permission levels:

[0179] For permission level L1: Prohibit all operations and only view metadata;

[0180] For permission level L2: Allow O1;

[0181] For permission level L3: Allow O1 and O2;

[0182] For permission level L4: Allow O1, O2, O3, and O4;

[0183] When the file sensitivity level S f ≥S high , then disable O3 and O4;

[0184] Obtain the user's permission L(U i );

[0185] Obtain the minimum permission requirement of the file, denoted as L required ;

[0186] If the user's permission L(U i ) < L required , reject all requests;

[0187] Execute a verification process for the user request Req(U i , R k , O j ), specifically as follows:

[0188] S1. Check the permission L(U i ) of U i );

[0189] S2. Obtain the file sensitivity level S f ;

[0190] S3. Restrict specific operation O j ;

[0191] S4. Generate a detailed operation log: L audit ={U i , R k , O j , T k , operation result, reason}, and record the user's access behavior and restriction result into the audit log.

[0192] By setting up file operation categories and permission mappings, the problem of management chaos caused by unclear permissions is solved. In the solution, first, file operation categories are set up, such as viewing, editing, downloading, and printing, and each operation is mapped to different permission levels. Through this classified management, it can be ensured that the operation permissions of users are clear and easy to manage. Each permission level, such as only being able to view metadata, being able to view and edit file content, etc., corresponds to a specific operation category, making permission control more refined and transparent. Such an operation mode avoids the ambiguity of permission settings, ensures that users with different permissions can only perform operations that match their permission levels, reduces the risks of misoperation and unauthorized operation, and thus improves the overall security management efficiency. By controlling the permissions for sensitive file operations, the security risks of high-sensitive file operations are solved. For files with different sensitivities, the system sets permission control according to the sensitivity level of the file, specifically including disabling certain operations, such as editing and downloading. For example, when the sensitivity level of the file is high, the system automatically disables the editing and downloading functions of the file. This measure effectively prevents sensitive files from being edited or downloaded by unauthorized users, ensuring the integrity and confidentiality of the files. By setting strict operation restrictions at the file management level, especially after the sensitivity assessment of the file, the system can automatically adjust permissions, avoiding the problem of leakage or tampering of confidential data caused by improper operation permissions. Through fine-grained permission management, the problem of unreasonable restrictions caused by overly loose or overly strict operations is solved. When setting file operation permissions, the solution adopts a fine-grained control mechanism. For example, according to the user's permissions, different categories of operations are allowed to be performed, and the operation permissions can be gradually released according to the permission level. This avoids a one-size-fits-all permission management method and can flexibly adjust operation permissions according to the needs of different users and the sensitivity of the files. While ensuring security, it also guarantees the normal operations of users within the authorized scope, enhancing the flexibility of file management and the user experience. By means of a permission verification process, the potential risks of permission conflicts and improper operations are solved. When each file access request is made, the system will execute a series of permission verification steps, and this verification process ensures the legality and compliance of each access and operation. Even if the user's permissions change, or the file sensitivity is adjusted, the system can flexibly verify and restrict operations, avoiding the execution of improper authorization or sensitive operations. Through this mechanism, the system can dynamically respond to different permission requirements, while ensuring the auditability and transparency of file operations. By generating detailed operation logs, the problem of imperfect file operation auditing is solved. Each file operation, including the rejected operations, will generate detailed operation logs, recording the user's access behavior and the results of operation restrictions. This not only provides transparency of operations but also provides reliable evidence for future security audits. If a file leakage or abuse event occurs, the administrator can trace the operation source through the logs and quickly find out the problem.This audit mechanism greatly enhances the traceability of file operations, ensures the continuity and operability of file security management, provides a basis for detecting security vulnerabilities, and improves the overall security guarantee ability. By combining permission management and auditing, the problems of permission abuse and operation auditing are solved. Through fine-grained permission control and detailed audit logs, the system realizes the organic combination of permission management and auditing. User permissions are always controlled during operations, and all operations are recorded to form a complete operation audit chain. This mechanism effectively prevents permission abuse and ensures that every file operation has a clear record and monitoring, providing strong security protection for the organization. Through this integrated management and auditing method, it ensures that file operations are both strictly controlled and traceable through auditing, guaranteeing the security and transparency of file management.

[0193] The abnormal monitoring of the user's behavior specifically includes:

[0194] Each time the user accesses, record the set of behavior characteristics of the access B(U i );

[0195] The set of characteristics includes:

[0196] The number of accesses within a unit of time, denoted as B1(U i );

[0197] The time difference between two consecutive accesses, denoted as B2(U i ), B2(U i ) = t j+1 -t j ;

[0198] The type of file accessed, denoted as B3(U i );

[0199] The time spent staying when accessing the file each time, denoted as B4(U i )7];

[0200] After the access behavior is recorded, generate the data set B(U i ) = {B1(U i ), B2(U i ), B3(U i ), B4(U i )}, where B j (U i ) represents the jth behavior characteristic of user U i ;

[0201] Perform standardization processing on each behavior characteristic B j (U i ), and the standardization formula is:

[0202]

[0203] Among them, B j (U i ) is the j-th behavior eigenvalue of user U i .

[0204] μ j is the mean value of all users on the j-th feature, specifically:

[0205] σ j is the standard deviation of all users on the j-th feature, specifically:

[0206]

[0207] where n is the number of all users participating in behavior analysis;

[0208] Calculate the comprehensive behavior pattern of each user according to the standardized value of each behavior feature, specifically:

[0209] [[ID=३३]]

[0210] Among them, ω j is the weight of behavior feature B j (U i ); B' j (U i ) is the standardized behavior feature; m is the total number of elements in the feature set;

[0211] Record the behavior pattern Pattern(U i ) of each user as a vector:

[0212] Pattern(U i ) = [B′1(U i ), B'2(U i ), …, B′ m (U i )];

[0213] Use the historical user data D = {B1(U1), B2(U1),..., B n (U n )) to train and obtain the behavior pattern set of all users:

[0214] P = {Pattern(U1), Pattern(U2), …, Pattern(U n )};

[0215] For user U i 's current behavior feature B j(U i ), calculate the Euclidean distance ΔB(U i );

[0216]

[0217] Among them, Pattern j (U i ) is the j-th eigenvalue of user U i in the historical behavior pattern;

[0218] Set the alarm trigger threshold, denoted as θ alert ;

[0219] When ΔB(U i ) > θ alert , then user U i has abnormal behavior and adopts an automated emergency response strategy;

[0220] Perform intelligent data desensitization and virtualization on the data.

[0221] By recording and standardizing user behavior characteristics, the problem of difficult anomaly recognition caused by unclear behavior patterns is solved. In the solution, the access behavior characteristic set is recorded every time a user accesses, including key characteristics such as the number of accesses per unit time, the time difference between two consecutive accesses, the type of file accessed, and the time spent staying on the file each time. These characteristics are standardized. By calculating the mean and standard deviation of each characteristic, the behavior characteristics of different users become comparable, and the natural differences in access frequencies, behavior patterns, etc. of different users are eliminated. The standardized characteristics make the influence of each behavior characteristic more consistent, avoid the problem of data imbalance caused by too large a difference in the range of characteristic values, and ensure that abnormal behaviors can be accurately recognized. By calculating the comprehensive behavior pattern, the problem that a single behavior characteristic cannot comprehensively identify anomalies is solved. By calculating the weighted comprehensive behavior pattern of each user and representing it as a vector, the solution can comprehensively consider the changes of multiple behavior characteristics, avoiding the limitation of judging anomalies only through a single behavior characteristic. The weights of behavior characteristics are set according to their importance, reflecting the importance of different characteristics to the normal behavior pattern of users. On the basis of comprehensive analysis, the system can more accurately identify the behavior anomalies of users, avoiding false alarms or missed alarms that may be caused by simply relying on a certain characteristic. By calculating the Euclidean distance and comparing it with the historical behavior pattern, the limitations of traditional rule-based anomaly detection methods are solved. Traditional anomaly detection often relies on fixed rules and thresholds, while this solution calculates the Euclidean distance with the historical user behavior pattern, making the recognition of abnormal behaviors more dynamic and intelligent. The behavior characteristics of each user are compared with the historical behavior pattern, and the calculated Euclidean distance can quantify the similarity between the current behavior and the historical behavior, so as to accurately judge whether it is abnormal. This similarity-based detection method is more flexible and accurate than traditional rules and can better adapt to the changes in user behavior. By setting an alarm trigger threshold, the problem of unclear judgment of abnormal behaviors is solved. After calculating the Euclidean distance, the solution judges whether a user has abnormal behavior by setting an alarm trigger threshold. When the Euclidean distance between the current behavior and the historical behavior pattern exceeds the set threshold, the system will trigger an alarm, indicating that the user's behavior pattern has changed abnormally. The setting of this threshold avoids possible errors in manually judging abnormal behaviors and improves the accuracy and consistency of detection results. The automatic adjustment of the alarm threshold can also be continuously optimized according to the actual situation, enabling the system to better adapt to the changes in user behavior. By means of an automated emergency response strategy, the problem of lagging response to abnormal behaviors is solved. When the system detects that a user has abnormal behavior, it will immediately start an automated emergency response strategy after triggering an alarm. The emergency response can include measures such as restricting access rights, freezing accounts, or forcing user authentication. These measures can respond quickly when abnormal behaviors occur and prevent potential security threats from further expanding.Through automated response, the system can respond to abnormal behaviors in a timely manner, reduce the lag of human intervention, and enhance the overall security protection ability. Through intelligent data desensitization and virtualization, the potential risk of data leakage is solved. In the solution, intelligent data desensitization and virtualization processing are performed on user behavior data, and this step solves the potential risk of user data leakage. During the data desensitization process, sensitive information will be replaced or hidden to ensure that even if the data is accessed or leaked improperly, the user's personal sensitive information will not be disclosed. Virtualization processing analyzes by simulating user behavior data, thus avoiding exposing user privacy by using real data. In this way, both the security of the data is guaranteed and the effectiveness of data analysis and abnormal behavior monitoring is not affected.

[0222] The intelligent data desensitization and virtualization of the data specifically include:

[0223] Set regular expressions for sensitive data in the file;

[0224] Use regular expressions to extract the set of sensitive data in the file and denote it as: S = {s1, s2,..., s p}, where each s i is a sensitive information segment;

[0225] For each sensitive data item s i perform scrambling processing to generate desensitized data s′ i :

[0226] s′ i = s i + r, r ~ N(0, σ 2 );

[0227] Among them, r is Gaussian noise, and the standard deviation σ is the noise magnitude;

[0228] Generate a virtual view V(N) for the non-sensitive part N of the file content, where:

[0229] All sensitive fields s i are replaced with *;

[0230] If the permission of user U i is L1, only the file title is displayed; if it is L2, some non-sensitive content is displayed; if it is L3 or L4, the complete non-sensitive part is displayed.

[0231] By setting regular expressions to extract sensitive data, the problem of difficult identification and isolation of sensitive information is solved. In the solution, by setting regular expressions for sensitive data in the file, the system can automatically identify and extract all sensitive information in the file. This process realizes the accurate identification and efficient extraction of sensitive data, avoiding the cumbersome and inaccuracy of manually screening sensitive data. Through this automated extraction method, the management and protection of sensitive information become more systematic and intelligent, while reducing the risk of omission and error. By scrambling sensitive data, the risk of data leakage is solved, and data privacy protection is enhanced. After extracting sensitive data from the file, the solution scrambles each sensitive data item to generate desensitized data. Gaussian noise is used to perturb sensitive data, ensuring the security of sensitive information during storage and transmission. Through this scrambling process, sensitive data cannot be restored or identified by unauthorized personnel, thus effectively reducing the risk of data leakage and enhancing the privacy protection ability of the system. By virtualizing non-sensitive data to generate a virtual view, the need for users to view the file content without disclosing sensitive data is solved. For the part of the file that does not contain sensitive information, by generating a virtual view, the solution enables users with different permission levels to access the file content. This method effectively meets the needs of different user permissions to view the file content. For example, for users with lower permissions, only the file title is displayed; for users with higher permissions, partial or complete non-sensitive content is displayed. The generation of the virtual view avoids the improper access of sensitive data and can also display the corresponding file content according to different user permissions, ensuring the security and compliance of the data. By means of a virtual view based on user permission control, the problem of inconsistent display of file content is solved. By controlling file display according to the user's permission level (such as only viewing metadata, partial non-sensitive content, or complete content), the solution realizes fine-grained file access control. For users with different permissions, the system will generate corresponding virtual views according to preset rules. For example, users with higher permissions can see the complete file content, while users with lower permissions can only see partial information. In this way, the exposure of sensitive data to low-permission users is avoided, while ensuring the normal usage experience of high-permission users. By desensitizing and virtualizing sensitive data, the challenge of protecting privacy during file sharing is solved. When the file needs to be shared or forwarded to different users, the desensitization of sensitive data and the virtualization of non-sensitive data solution ensure that even during sharing, sensitive information will not be leaked. After desensitization, sensitive information is replaced with noise or placeholders, and the non-sensitive part is virtually displayed according to permissions, ensuring that each user can only see the information they are authorized to access. This effectively prevents privacy leakage or improper information disclosure caused by file sharing, especially in file sharing and external access scenarios, and can guarantee the security and compliance of information. By Gaussian noise perturbation, the feasibility problem of restoring desensitized data is solved.The introduction of Gaussian noise scrambles sensitive data, making it difficult to restore the desensitized data to its true form during transmission or storage, even if maliciously accessed. Because the standard deviation of the noise is set based on system requirements, the perturbation intensity can be flexibly adjusted, ensuring that the desensitized data meets privacy requirements while not affecting subsequent data processing or analysis. This approach avoids the vulnerability of simpler desensitization methods to reversible data, improving the security and practicality of data desensitization.

[0232] The automated emergency response strategy specifically includes:

[0233] Get the user ID, recorded as U ID ;

[0234] Dynamically generate encryption keys:

[0235] K′(t)=H(U ID +R k +t);

[0236] Among them, K′(t) is based on the timestamp t, user ID U ID and the unique identifier R of the file k Dynamically generated encryption key; H is the hash function used to generate the key;

[0237] Encrypt the contents of file F using the dynamic key K′(t):

[0238]

[0239] After encryption, the content of file F becomes ciphertext and cannot be viewed directly by users;

[0240] Downgrade the privileges of users with abnormal behavior to the lowest level, L1;

[0241] Continuously monitor user behavior. If user behavior persists, temporarily disable the user's file access permissions until the administrator removes the user's permission restrictions.

[0242] By dynamically generating an encryption key and encrypting the file content, the problem of abnormal users accessing sensitive data is solved, enhancing the security of the file. In the solution, the dynamically generated encryption key is combined with the timestamp, user ID, and file unique identifier through a hash function, ensuring the uniqueness and timeliness of the encryption key. Whenever a user requests access to a file, the system dynamically generates a new key based on the current time, user ID, and file identifier, effectively avoiding the risk of key leakage or abuse. After the file content is encrypted, it becomes ciphertext and cannot be directly accessed or viewed by abnormal users, ensuring the security of sensitive data. Even users with abnormal behavior cannot obtain unauthorized file content. By downgrading the permissions of abnormal users to the lowest level, potential security threats are addressed, reducing the risk of malicious behavior. When the system detects abnormal behavior, it downgrades the permissions of the abnormal user to the lowest level through an automated emergency response strategy. This measure can effectively limit the further access and operation of sensitive data by abnormal users, preventing them from abusing their access rights to perform malicious operations. This permission downgrade operation ensures that when a security risk occurs, the system can quickly take measures to contain potential threats at the source, preventing problems such as data leakage or tampering. By continuously monitoring user behavior and disabling the file access permissions of abnormal users, the risk of continuous abnormal behavior is addressed, ensuring the security of data and the controllability of the system. When the system detects abnormal user behavior, it not only promptly downgrades their permissions but also determines whether the abnormality persists by continuously monitoring the behavior of the user. If the abnormal behavior persists, the system will further take measures to temporarily disable the user's file access permissions until the administrator lifts the restriction. This process ensures continuous control over high-risk users, avoiding short-term risks after a single abnormal behavior, increasing the system's emergency response ability in the face of potential threats, and enhancing the response efficiency to abnormal access and the overall security of data. By temporarily disabling the permissions of abnormal users, the long-term impact of attacks or misoperations on the system is prevented, ensuring the normal operation of the system. When a user's behavior remains abnormal, the system automatically temporarily disables the user's file access permissions, preventing the user from continuing to operate or access the file during the abnormal behavior period and preventing their actions from having a continuous impact on the data. This mechanism can quickly isolate malicious users, preventing their actions from threatening the security of other normal users or the system. In addition, the system continuously monitors user behavior, and the administrator can lift the restriction according to specific circumstances, ensuring the flexibility and response speed of the system. By integrating an emergency response mechanism, the automation and response efficiency of the system are improved, addressing the problem of insufficient manual intervention. This solution uses an automated emergency response strategy to not only monitor user behavior in real time but also automatically generate an encryption key and encrypt the file according to abnormal behavior. In this process, the need for manual intervention is reduced, and through a series of automated processes such as dynamic key generation, permission downgrading, and access disabling, abnormal behavior is quickly responded to and restricted.This automated processing can significantly improve the efficiency of emergency response, reduce the risk of human operation errors and delays, and ensure that the system can take prompt and effective actions when facing security threats.

[0243] It should be noted that in this article, relational terms such as first and second are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any actual relationship or order between these entities or operations. Moreover, the term "comprising", "including" or any other variant thereof is intended to cover non-exclusive inclusion, so that a process, method, article or device comprising a series of elements not only includes those elements, but also includes other elements not expressly listed, or also includes elements inherent to such process, method, article or device.

[0244] The above are only the preferred embodiments of the present invention. It should be pointed out that for those of ordinary skill in the art, without departing from the technical principle of the present invention, several improvements and refinements can be made, and these improvements and refinements should also be regarded as the protection scope of the present invention.

Claims

1. A security monitoring method for preventing the leakage of confidential documents, characterized in that, including: Set up a user permission matrix, denoted as U, representing the set of all users, where each user U i is assigned a permission level; where U = [U1, U2, …, U n , where U i represents the i-th user; For each user U i permission level assignment is performed, and the permission level calculation function is specifically as follows: L(U i ) ∈ {L1, L2, L3, L4}; Among them, L(U i ) represents the i-th user permission level; L1 is the ability to only view the metadata of the file; L2 is the ability to view some non-sensitive content; L3 is the ability to view and edit non-sensitive content and perform some operations on the file; L4 is the full access permission; Set a dynamic condition set for user access, denoted as C k , specifically: C k = {T k , D k , L k , R k}; Among them, T k is the exact time for recording the access request; D k is the unique device identifier; L k is the geographical coordinates of the user device. If the user accesses the file at an unauthorized location, the access should be refused; R k is the unique identifier of the file, which is used to uniquely identify each file; According to the user permission set L(U i ), and the access condition set C k , calculate the access matching degree; Condition matching degree calculation function M(L(U i ), C k ) is specifically as follows: If M(L(U i ), C k ) = 1, access to the file is permitted; otherwise, access is denied and logged. When the permission conditions are not met, access is denied, a log is recorded, and a rejection message is returned to the user; an instant notification is sent to the administrator for abnormal access behavior; Each access operation generates a detailed access log L access , and its structure is as follows: L access = {U i , T k , R k , C k , operation result, failure reason}; When the operation result is successful, the failure reason is recorded as 0; when the operation result is a failure, the real failure reason is obtained and recorded; If access is denied, the reason for denial is obtained and inserted into the access log; Evaluate the file sensitivity level S using the file sensitivity evaluation strategy f ; Perform multi-layer encryption and hierarchical protection on files; Perform permission management and auditing on each file operation; Monitor abnormal behavior of users.

2. The security monitoring method for preventing leakage of confidential documents according to claim 1, characterized in that Evaluating the file sensitivity level S using the file sensitivity evaluation strategy f , which specifically includes: Obtain the keyword occurrence frequency of the file content, denoted as K d ; Obtain the file type, denoted as T f ; Obtain the file sharing range, denoted as R f ; Set the keyword density threshold, denoted as K threshold ; Set the set of sensitive file types, denoted as T gather ; Set the file sharing range, denoted as R range ; The initial sensitivity level of the document is recorded as S low ; If the keyword occurrence frequency in the file > K threshold , then the file sensitivity is increased by one level; If the file type is T f ∈ T gather , then raise the file sensitivity level to S high ; If the file sharing scope then raise the file sensitivity level to S high ; Generate sensitivity level S f = f(K d , T f , R f ), and the result is: S low , ordinary document; S medium , important document; S high , highly sensitive document.

3. The security monitoring method for preventing the leakage of confidential documents according to claim 2, wherein, The multi-layer encryption and hierarchical protection of files specifically includes: According to the file sensitivity level S f , select different encryption strategies; When the file sensitivity level is S low Symmetric encryption is used, with AES-128; When the file sensitivity level is S medium Hybrid encryption is used. The session key is generated using RSA-2048 and then encrypted using AES-256; When the file sensitivity level is S high Hierarchical encryption is adopted, combined with double encryption of ECC elliptic curve encryption and RSA; Obtain the user ID and record it as ID; Generate a dynamic encryption key: K(t) = H(ID, R k , t, S f ); Among them, H is a hash function; t is a timestamp; S f sensitive level of the file; Each time a user requests a file, a key is recalculated and generated; For S high documents, the key is rotated hourly; for S medium documents, the key is rotated daily; Generate the key usage record log L enc : L enc ={R k , K(t), S f , T k}} 4. A security monitoring method for preventing leakage of confidential documents according to claim 2, characterized in that, The permission management and auditing of each file operation specifically includes: Set the file operation category, denoted as O j , and the operation categories include: O1, file viewing; O2, file editing; O3, file downloading; O4, file printing; Map each type of operation to different permission levels: For permission level L1: All operations are prohibited, and only metadata can be viewed; For permission level L2: O1 is allowed; For permission level L3: O1 and O2 are allowed; For permission level L4: O1, O2, O3, and O4 are allowed; When the file sensitivity level S f ≥ S high then O3 and O4 are disabled; Obtain user permission L(U i ); Obtain the lowest permission requirement for the file, denoted as L required ; If the user permission L(U i ) < L required When, reject all requests; Execute a verification process for the user request Req(U i ,R k ,O j ), specifically as follows: S1. Check the permissions of U i L(U i ); S2. Obtain the file sensitivity level S f ; S3. Restrict specific operation O j ; S4. Generate a detailed operation log: L audit ={U i ,R k ,O j ,T k , operation result, reason}, and record the user's access behavior and restriction results into the audit log.

5. A security monitoring method for preventing the leakage of confidential documents according to claim 1, characterized in that, The monitoring of abnormal behavior of users specifically includes: Each time a user accesses, record the set of behavioral characteristics B(U i ); The feature set includes: The number of accesses per unit time is denoted as B1(U i ); The time difference between two consecutive accesses, denoted as B2(U i ), B2(U i ) = t j+1 - t j ; The type of the accessed file, denoted as B3(U i ); The time spent when accessing the file each time, denoted as B4(U i ); After the access behavior is recorded, a data set B(U i ) = {B1(U i ), B2(U i ), B3(U i ), B4(U i )}, where B j (U i ) represents the j-th behavioral feature of user U i . For each behavioral feature B j (U i ) is normalized, and the normalization formula is: Among them, B j (U i ) is the j-th behavioral eigenvalue of user U i ; μ j is the mean value of all users on the j-th feature, specifically: σ j is the standard deviation of all users on the j-th feature, specifically: where n is the number of all users participating in behavior analysis; Calculate the comprehensive behavior pattern of each user according to the standardized value of each behavior feature, specifically: Among them, ω j is the weight of behavior feature B j (U i ); B' j (U i ) is the behavior feature after standardization; m is the total number of elements in the feature set; Denote the behavior pattern Pattern(U i ) of each user as a vector: Pattern(U i ) = [B'1(U i ), B'2(U i ), …, B′ m (U i )]; Using historical user data D = {B1(U1), B2(U1), …, B n (U n )} for training to obtain the set of behavior patterns of all users: P = {Pattern(U1), Pattern(U2), …, Pattern(U n )}; For user U i The current behavioral feature B j (U i ), calculate the Euclidean distance ΔB(U i ) from the historical behavior pattern; Among them, Pattern j (U i ) is the j-th eigenvalue of user U i in the historical behavior pattern; Set the alarm trigger threshold, denoted as θ alert ; When ΔB(U i ) > θ alert then the user U i has abnormal behavior and an automated emergency response strategy is adopted; Perform intelligent data desensitization and virtualization on the data.

6. The security monitoring method for preventing the leakage of confidential documents according to claim 5, characterized in that, The intelligent data desensitization and virtualization of the data specifically includes: The set of sensitive data extracted from a file using regular expressions is denoted as: S = {s1, s2, …, s p}, where each s i is a sensitive information segment; For each sensitive data item s i perform scrambling to generate desensitized data s' i : s′ i = s i + r, r ~ N(0, σ 2 ) Set regular expressions for sensitive data in the file; where r is Gaussian noise and the standard deviation σ is the noise magnitude; All sensitive fields s i Replace with *; If user U i has the permission level of L1, only the file title is displayed; if it is L2, some non-sensitive content is displayed; if it is L3 or L4, the entire non-sensitive part is displayed.

7. A security monitoring method for preventing the leakage of confidential documents according to claim 5, characterized in that, Generate a virtual view V(N) for the non-sensitive part N of the file content, where: Obtain the user ID, denoted as U ID ; The automated emergency response strategy specifically includes: K'(t) = H(U ID + R k + t); Among them, K′(t) is an encryption key dynamically generated according to the timestamp t, the user IDU ID and the unique identifier R of the file k ; H is a hash function used to generate the key; Dynamically generate an encryption key: Use the dynamic key K'(t) to encrypt the content of the file F: After encryption, the content of the file F becomes ciphertext and cannot be directly viewed by the user; Demote the user's permission with abnormal behavior to the lowest level L1; Continuously monitor the behavior of the user. If the user's behavior remains abnormal, temporarily disable the user's file access permission until the administrator lifts the user's permission restriction.

Images