File leakage protection method and device, electronic equipment, and storage medium

Abstract

The present invention provides a file leakage protection method and device, electronic equipment, and storage medium, wherein the method comprises: selecting files that can be detected and killed in the company's current EDR environment as malicious file samples; extracting the hard-coded malicious file samples and saving them as initial features; deleting invalid characters in the initial features to generate protection features; adding the protection features to a whitelist; inserting the protection features into a controlled file without affecting the file's own functions; and issuing the controlled file for use after the insertion is complete. This method utilizes the company's existing EDR capabilities for expanded applications. By actively inserting malicious features into normal files, the deletion of specified files can be achieved without the need for any equipment to be added or set up, nor does it require excessive maintenance by maintenance personnel. This makes it more convenient to control the spread of files in an intranet environment.

Description

Technical Field

[0001] The present invention relates to the field of data security, and in particular to a file leakage protection method and device, electronic equipment, and storage medium designed based on EDR virus detection and killing capabilities. Background Art

[0002] Currently, enterprises primarily use data leakage prevention (DLP) systems, digital watermarking, and access control technologies to prevent document leaks and control their distribution. However, these technologies often suffer from the following drawbacks in practical applications:

[0003] 1) When implementing the above solution, since the operating system does not include the capabilities of the above means, it is necessary to purchase corresponding equipment separately to supplement the system's own capability deficiencies, which is too costly.

[0004] 2) DLP systems rely on complex rules and pattern matching to identify and filter file content within the system. When a rule matches a sensitive file, it encrypts it and decrypts it for the user within an authorized environment. DLP rules rely on the vendor's experience and capabilities, and may mistakenly label non-sensitive data as sensitive, disrupting normal business operations or leaking sensitive data. DLP also monitors file content changes in real time, performing operations on the entire document when encrypting it, causing system lags and impacting employee productivity.

[0005] 3) Digital watermarks make documents traceable by inserting identification information or traceability marks into the file. Once the document is leaked, the leaker can be quickly located through the inserted digital watermark. However, the disadvantage is that it cannot actively prevent the leakage of sensitive files and can only be used for tracking.

[0006] 4) Access Control Measures: Leveraging the system's own access control capabilities or access control software, access control rules are set for files. These rules restrict user access rights to files. However, setting up access control rules is complex, requiring certain skills from system administrators, and is costly to manage and maintain. Furthermore, large-scale deployments are prone to errors, leading to numerous major breaches of critical files due to incorrect permission settings.

[0007] 5) Some systems have limited integration capabilities across platforms or cloud environments, making it difficult to effectively cover multiple operating systems and applications. For example, access control rules set in a Windows system will become invalid once they leave the current Windows environment. Summary of the Invention

[0008] In order to solve the above problems, the present invention combines the enterprise's own EDR virus detection and killing capabilities, combines feature writing and EDR policy configuration, and can achieve document dissemination range control without adding and setting up any equipment, nor does it require excessive maintenance by subsequent personnel.

[0009] In a first aspect, the present invention provides a method for preventing file leakage, which specifically includes:

[0010] Select files that may be detected by EDR and deliver them to the company's current EDR environment. Select identifiable files as malicious file samples.

[0011] Save the hard-coded signature of the malicious file sample as the initial signature;

[0012] Delete invalid characters in the initial feature and use the simplified initial feature as the protection feature;

[0013] Add the protection feature to the whitelist;

[0014] Inserting protection features into controlled documents without affecting the functionality of the document itself;

[0015] After the insertion is completed, the controlled file can be distributed for use. At this time, the allowed users can use it normally after downloading the file. Once it is transmitted to other hosts, it will be deleted by EDR as a malicious file due to the lack of a whitelist.

[0016] To prevent the distributed controlled files from being maliciously modified, the file permissions can be modified before the controlled files are distributed to remove the user's write permissions.

[0017] For different batches of controlled files, such as those with different permissions and scopes of application, corresponding protection features can be set separately for the batches of controlled files.

[0018] For controlled files with higher importance and priority, the protection performance of the controlled files can be improved by increasing the number of protection features or selecting more complex protection features.

[0019] For confidential documents that need to be automatically destroyed, the corresponding protection features in the whitelist can be deleted after expiration to achieve automatic destruction.

[0020] In a second aspect, the present invention provides a device for preventing file leakage, comprising:

[0021] A protection feature generation unit, configured to obtain a malicious file sample and generate a protection feature based on the malicious file sample;

[0022] A protection feature adding unit, used for inserting protection features into a controlled file without affecting the function of the file itself;

[0023] The file management unit is used to set up whitelists and handle the issuance and destruction of controlled files.

[0024] In a third aspect, the present invention provides an electronic device, comprising:

[0025] at least one processor; and,

[0026] A memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to execute any of the above-mentioned file leakage protection methods.

[0027] In a fourth aspect, the present invention provides a computer-readable storage medium storing computer instructions for enabling a computer to execute any of the above-mentioned file leakage protection methods.

[0028] The effects provided in the summary of the invention are only the effects of the embodiments, not all the effects of the invention. One of the above technical solutions has the following advantages or beneficial effects:

[0029] The advantage of the present invention is that it utilizes the capabilities of the company's existing EDR for expanded applications. As a centralized system, EDR itself has the ability to be centrally managed. EDR supports issuing instructions to the client installed with the Agent through the server program, which can be used to control the file leakage prevention strategy. At the same time, EDR includes the function of detecting and killing malicious files. Once a new file is created or the original file is modified, EDR will automatically detect its static content or dynamic features. If it is identified as a malicious file, it will be forcibly deleted and ordinary users cannot restore it. This solution utilizes the characteristics of EDR for detecting and killing static files. By actively inserting malicious features into normal files, EDR can identify the file as a malicious file and delete the specified file.

[0030] At the same time, because EDR client processes are generally high-priority and high-privilege, clients are usually driver-level processes that have administrative privileges over all file processes on the computer. Driver-level processes are inaccessible to users by default, making their operations difficult to influence. Furthermore, EDR itself includes management features such as device management, device grouping, and whitelisting (exclusions), making it ideal for expanding its capabilities into other management solutions. This solution primarily leverages these EDR features to control the spread of files within the intranet environment by proactively inserting malicious signatures.

[0031] The above description is only an overview of the technical solution of the present disclosure. In order to more clearly understand the technical means of the present disclosure, it can be implemented in accordance with the contents of the specification. In order to make the above and other purposes, features and advantages of the present disclosure more obvious and easy to understand, the following specifically cites preferred embodiments and describes them in detail with reference to the accompanying drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0032] In order to more clearly illustrate the technical solutions of the embodiments of the present disclosure, the following briefly introduces the drawings required for use in the embodiments. Obviously, the drawings described below are only some embodiments of the present disclosure. For ordinary technicians in this field, other drawings can be obtained based on these drawings without any creative work.

[0033] Figure 1 This is a flow chart of a file leakage protection method provided by the present invention;

[0034] Figure 2 It is a schematic diagram of the principle of generating protection features in the method of the present invention;

[0035] Figure 3 is a schematic diagram of the principle of inserting protection features in the method of the present invention;

[0036] Figure 4 This is a schematic structural diagram of a document leakage protection device provided by the present invention;

[0037] Figure 5 It is a structural schematic diagram of an electronic device provided by the present invention. DETAILED DESCRIPTION

[0038] The embodiments of the present disclosure are described in detail below with reference to the accompanying drawings.

[0039] It should be clear that the following embodiments of the present disclosure are described through specific concrete examples, and those skilled in the art can easily understand other advantages and effects of the present disclosure from the contents disclosed in this specification. Obviously, the described embodiments are only a part of the embodiments of the present disclosure, rather than all the embodiments. The present disclosure can also be implemented or applied through other different specific embodiments, and the details in this specification can also be modified or changed in various ways based on different viewpoints and applications without departing from the spirit of the present disclosure. It should be noted that the following embodiments and features in the embodiments can be combined with each other in the absence of conflict. Based on the embodiments in the present disclosure, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present disclosure.

[0040] It should be noted that various aspects of the embodiments within the scope of the appended claims are described below. It should be apparent that the aspects described herein can be embodied in a wide variety of forms, and any specific structure and / or function described herein is merely illustrative. Based on this disclosure, it should be understood by those skilled in the art that an aspect described herein can be implemented independently of any other aspect, and two or more of these aspects can be combined in various ways. For example, any number of aspects described herein can be used to implement the device and / or practice the method. In addition, other structures and / or functionalities other than one or more of the aspects described herein can be used to implement this device and / or practice this method.

[0041] It should also be noted that the illustrations provided in the following embodiments are only schematic illustrations of the basic concept of the present disclosure. The illustrations only show components related to the present disclosure and are not drawn according to the number, shape and size of components in actual implementation. In actual implementation, the type, quantity and proportion of each component can be changed at will, and the component layout type may also be more complicated.

[0042] Additionally, in the following description, specific details are provided to provide a thorough understanding of the examples. However, one skilled in the art will appreciate that the aspects described can be practiced without these specific details.

[0043] Glossary:

[0044] Endpoint Detection and Response (EDR) is a security solution that continuously monitors endpoint devices (such as computers and mobile devices), uses behavioral analysis and machine learning technologies to detect threats in real time, and combines automated response mechanisms to quickly isolate and eliminate attacks.

[0045] See also Figure 1 The present invention provides a method for preventing file leakage, the method comprising:

[0046] 1) Select files that can be detected and killed in the company's current EDR environment as malicious file samples. Specifically, collect malicious file samples publicly available on the Internet, such as the ransomware program WannaCry, malicious file samples publicly available daily in the Weibu Cloud Sandbox, the memory analysis tool Rubeus, backdoor files (exe files automatically generated using the backdoor generation function in penetration frameworks such as MSF and Cobalt Strike), Webshell Trojans (such as PHP one-sentence Trojans), vulnerability exploits (such as EXP program files for the MS17010 vulnerability), and other files that may be detected and killed by EDR, and deliver them to the current EDR environment. If the file is identified as malicious, retain it as a malicious file sample.

[0047] 2) Extract the hard-coded information of the malicious file sample and save it as the initial feature.

[0048] 3) Delete the invalid characters in the initial feature and generate the protection feature. For the specific principle, see Figure 2 , the initial signature is deleted starting from the first character. If the file is still considered malicious by EDR after deletion, the character is deleted; otherwise, the character is retained. From the first character to the last character, the modified string is retained as the protection signature.

[0049] For example, a simplified example of the memory analysis tool Rubeus:

[0050] 0x5A4D 658C8B7F-3664-4A95-9572-A3E5871DFC06.

[0051] A simplified example of the EXE backdoor generated by MSF:

[0052] * MACRO CODE .exe" = Environ("USERPROFILE") * PAYLOAD DATA.

[0053] One-sentence Trojan<?php eval($_REQUEST['cmd']); ?> Simplified example:

[0054] <?phpeval($_REQUEST[ 。

[0055] A simplified example of the WannaCry version of the MS17010 exploit:

[0056] PC NETWORK PROGRAM 1.0 LANMAN1.0 Windows for Workgroups 3.1a __TREEID__PLACEHOLDER____USERID__PLACEHOLDER__h6agLCqPqVyXi2VSQ8O6Yb9ijBX54jh54WfF9cGigWFEx92bzmOd0UOaZlMtpGFEoLOU6+5I78Toh / nHs / RAP.

[0057] 4) Add the protection signature to the whitelist.

[0058] 5) Insert protection features into controlled files without affecting the functionality of the files themselves, see Figure 3 , the principle adopted is as follows:

[0059] Determine the hard disk format. In enterprises, the system information of each terminal is often recorded, which will include the hard disk format information. If not, the hard disk format can be viewed through system commands, such as executing fsutil in Windows or lsblk command in Linux.

[0060] For systems using the NTFS hard disk format, insert code features into the ADS of the file. For example, use the Windows command echo <?phpeval($_REQUEST[ > confidential document.txt. ADS is usually used to store hidden information. This part is generally not read by normal processes and does not affect the original file. The PE file still executes normally, and non-PE files can still be parsed normally.

[0061] For systems using hard disk formats with extended attributes such as ex4, Btrfs, APFS, and HFS+, add features to the extended attributes. For example, in Linux, use the command setfattr -n Signature -v "<?phpeval($_REQUEST" myfile.zip to add the Signature attribute with the value of <?phpeval($_REQUEST to myfile.zip.

[0062] For other types of hard disk formats, since there are no extended attributes for storing additional information, the original file can only be modified without affecting the file function. If it is a PE file, the execution result of the file cannot be affected. If it is a non-PE file, the integrity and availability of the file information cannot be changed.

[0063] For PE files, features can be inserted by adding resource information. For example, download and install PE Explorer, open the PE file WxWork-Internal.exe that needs to be modified, navigate to the "Resources" section, add a new string to insert the feature information <?phpeval($_REQUEST[; and insert and save the file.

[0064] For non-PE files, first determine the file type. Some known file types support adding extended data, which can modify the file without affecting the availability and integrity of the original file, such as adding a certain feature. Currently, features can be added to the following known file types:

[0065] Insert features into the EXIF data of image files. For example, use C# to make the MetadataExtractor library read EXIF data from images, and then add the feature string "Signature:<?phpeval($_REQUEST[;" to the ImageDescription field, or insert it automatically through a program. After opening and loading a PE file, add a new section and save malicious features in the new section, and then save the PE file. For example, there is a normal file psexec.exe with a file size of 6,101,973 bytes. Use the malicious feature <?phpeval($_REQUEST[ with a feature size of 21 bytes. To ensure compatibility and avoid multiple adjustments to the PE file, allocate 0x4000. Then parse the PE header structure to determine that the position of the last section is 7. Insert the feature 40 bytes after the 7th section.

[0066] For files supported in the Office suite, including documents, spreadsheets, or presentations, features can be added in the macro. For example, there is a document named test.docm. Open it with Word to create a macro function EvilSign, and then insert the feature WinExec("cmd.exe / c whoami", SW_HIDE) in the function.

[0067] For files such as Pdf that contain extended information, features can be added in the first 4030 bytes or the last 4030 bytes of the file, and the extended information can be found through the additional information keyword. The extended information does not affect the use of the original file. For example, there is a file named xx white paper.pdf. The extended information starts to be stored from the 275th byte of the file, and it is found that the Creator keyword starts to be stored at the 275th byte. Creator represents the creator of the file. Then insert the malicious feature <?phpeval($_REQUEST[ at the 275th byte.

[0068] For other file types, if metadata exists, insert the metadata; otherwise, do not process it temporarily and add rules later to avoid affecting the usability of the original file after modification.

[0069] 6) After insertion, distribute the controlled files for use. When a permitted user downloads them, they can be used normally. Once transferred to other hosts, they will be deleted as malicious files by EDR because there is no whitelist. If they are leaked, once the file is copied to a new terminal and there is an antivirus software or EDR, it will be recognized as a malicious file and deleted, achieving the purpose of automatic destruction.

[0070] For security reasons, before distributed controlled files, file permissions must be modified to remove the user's write permission to prevent added features from being deleted or modified. For example, if you have a document called "internal learning materials.docm" to distribute, the original file permissions are: User readable and writable; Administrators readable and writable; System readable and writable. Change these permissions to User readable; Administrators readable; System readable and writable. Modifying permissions can be done by right-clicking the file in Windows. Numerous existing tools and open source code allow this, so the detailed implementation principles will not be discussed here.

[0071] For confidential documents that need to be automatically destroyed, the whitelist can be deleted after expiration to achieve automatic destruction.

[0072] For example, the R&D department has issued version 1.0 of the "Windows Host Baseline Management Regulations" document in PDF format. This document may be upgraded to version 1.0 or higher. Therefore, malicious signatures can be inserted before distribution. Since all R&D hosts use NTFS-formatted Windows servers, a command can be issued to insert malicious signatures into the document's ADS. For example, for one host, the command echo [autorun] shellexecute=.exe action=Openfoldertoviewfile > Windows Host Baseline Management Regulations v1.0.pdf:ads is used, where the file name is "Windows Host Baseline Management Regulations v1.0.pdf" and the malicious signature is [autorun] shellexecute=.exe action=Openfoldertoviewfile. Then, the exclusion item c:\public\downloads\Windows Host Baseline Management Regulations v1.0.pdf is distributed to all R&D hosts. Assuming the document needs to be updated to version 1.1 in 10 days, the previously issued exclusion item can be manually deleted in the EDR management interface after 10 days, or a scheduled task can be added to delete the previously added exclusion item after 10 days.

[0073] It is important to emphasize that for different batches of controlled files, such as those with different permissions or scopes of application, corresponding protection features can be set for each batch of controlled files. In theory, each controlled file can be individually set with a corresponding protection feature.

[0074] In addition, for controlled files with higher importance and priority, the protection performance of the controlled files can be improved by increasing the number of protection features or selecting protection features with higher complexity.

[0075] Scenario Example 1: Automatic deletion of files distributed on the company's intranet

[0076] Our company's office environment is currently deployed in an AD domain, with all office computers managed by the AD domain. This week, the Operations and Maintenance Department needs to distribute a document, "Operation and Maintenance Redline Notes.docm," for internal access only. This restriction is due to the fact that the document is internally created by the Operations and Maintenance Department. Before release, malicious signatures were inserted using PowerShell code. This code first loads the Word.Application object and opens the docm file. It then accesses the VBProject object and adds a VBComponents standard module. Finally, the CodeModule.AddFromString function is used to insert and save the malicious signature string: [autorun]shellexecute=.exeaction=Openfoldertoviewfile. Since all office computers are currently managed by the AD domain, permissions configured on any host in the AD domain apply to all computers in the domain. Therefore, permissions can be configured before distributing the document: Domain Admins have full control permissions; Domain Users have read permissions. The default download path for the file is C:\public\downloads\Operation and Maintenance Redline Notes.docm. In the EDR, select all hosts under the Operations and Maintenance Department by department and add this path to the exclusions.

[0077] Because EDR exclusions were configured, people within the Operations and Maintenance department could download and view the Word document normally. However, if the document was transferred to other departments via the intranet, the EDR would immediately delete the downloaded document because those devices were not on the whitelist. Since ordinary users lacked EDR management privileges, they were unable to restore the document.

[0078] Scenario Example 2: Internal Leakage

[0079] Continuing with the above scenario, if the document is distributed or leaked outside the company, if the other party's terminal has antivirus software or EDR software, the document will be deleted as malicious. Because it is an internal document, it is difficult for outsiders to verify its legitimacy. Once the antivirus software or EDR software identifies it as malicious, outsiders are unlikely to take the risk of continuing to execute it.

[0080] Scenario Example 3: Destroying the Old Version of the App

[0081] Continuing with the above scenario, since the old version of the document requires version iteration, in order to prevent the old version of the document from being misused and causing work errors, the old version of the document can be deleted uniformly after the new version of the document is released. By deleting the exclusion item C:\public\downloads\Operation and Maintenance Red Line Notes.docm previously configured for the Operation and Maintenance Department, after deleting the exclusion item, EDR will identify the path as a malicious file and automatically delete it.

[0082] On the other hand, refer to Figure 4 The present invention provides a device for preventing file leakage, comprising:

[0083] A protection feature generation unit, configured to obtain a malicious file sample and generate a protection feature based on the malicious file sample;

[0084] A protection feature adding unit, used for inserting protection features into a controlled file without affecting the function of the file itself;

[0085] The file management unit is used to set up whitelists and handle the issuance and destruction of controlled files.

[0086] The above units are all used to implement the file leakage protection method. The specific steps and principles have been mentioned in the file leakage protection method, so they are not repeated here.

[0087] An electronic device according to an embodiment of the present disclosure includes a memory and a processor. The memory is used to store non-transitory computer-readable instructions. Specifically, the memory may include one or more computer program products, which may include various forms of computer-readable storage media, such as volatile memory and / or non-volatile memory. The volatile memory may, for example, include random access memory (RAM) and / or cache memory (cache), etc. The non-volatile memory may, for example, include a read-only memory (ROM), a hard disk, a flash memory, etc.

[0088] The processor may be a central processing unit (CPU) or other form of processing unit with data processing capabilities and / or instruction execution capabilities, and may control other components in the electronic device to perform desired functions. In one embodiment of the present disclosure, the processor is configured to execute the computer-readable instructions stored in the memory, causing the electronic device to execute all or part of the steps of the multi-user space file leakage prevention method described in the aforementioned embodiments of the present disclosure.

[0089] Those skilled in the art should understand that in order to solve the technical problem of how to obtain a good user experience, this embodiment may also include well-known structures such as a communication bus and an interface, and these well-known structures should also be included in the scope of protection of this disclosure.

[0090] like Figure 5The present invention provides a schematic structural diagram of an electronic device according to an embodiment of the present invention, which is suitable for implementing the electronic device according to an embodiment of the present invention. Figure 5 The electronic device shown is only an example and should not limit the functions and scope of use of the embodiments of the present disclosure.

[0091] like Figure 5 As shown, the electronic device may include a processor (such as a central processing unit, a graphics processing unit, etc.), which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) or a program loaded from a storage device into a random access memory (RAM). In the RAM, various programs and data required for the operation of the electronic device are also stored. The processor, ROM, and RAM are connected to each other through a bus. The input / output (I / O) interface is also connected to the bus. Typically, the following devices can be connected to the I / O interface: input devices such as sensors or visual information acquisition devices; output devices such as display screens; storage devices such as tapes, hard disks, etc.; and communication devices. The communication device can allow the electronic device to communicate with other devices (such as edge computing devices) wirelessly or by wire to exchange data. Although Figure 5 The electronic device is shown with various devices, but it should be understood that it is not required to implement or possess all of the devices shown. More or fewer devices may be implemented or possessed instead.

[0092] In particular, according to an embodiment of the present disclosure, the process described above with reference to the flowchart can be implemented as a computer software program. For example, an embodiment of the present disclosure includes a computer program product, which includes a computer program carried on a non-transitory computer-readable medium, and the computer program includes a program code for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from a network via a communication device, or installed from a storage device, or installed from a ROM. When the computer program is executed by a processor, all or part of the steps of the multi-user space file leakage prevention method of the embodiment of the present disclosure are executed.

[0093] For detailed description of this embodiment, please refer to the corresponding description in the aforementioned embodiments, which will not be repeated here.

[0094] According to the computer-readable storage medium of the embodiment of the present disclosure, non-transitory computer-readable instructions are stored thereon. When the non-transitory computer-readable instructions are executed by a processor, all or part of the steps of the multi-user space file leakage prevention method of each embodiment of the present disclosure are executed.

[0095] The above-mentioned computer-readable storage media include, but are not limited to, optical storage media (e.g., CD-ROMs and DVDs), magneto-optical storage media (e.g., MOs), magnetic storage media (e.g., magnetic tapes or mobile hard disks), media with built-in rewritable non-volatile memory (e.g., memory cards), and media with built-in ROM (e.g., ROM cartridges).

[0096] For detailed description of this embodiment, please refer to the corresponding description in the aforementioned embodiments, which will not be repeated here.

[0097] The basic principles of the present disclosure have been described above in conjunction with specific embodiments. However, it should be noted that the advantages, strengths, and effects mentioned in this disclosure are merely illustrative and not restrictive, and should not be construed as necessarily possessed by each embodiment of the present disclosure. Furthermore, the specific details disclosed above are provided for illustrative purposes and to facilitate understanding, rather than as limitations. These details do not limit the present disclosure to necessarily being implemented using these specific details.

[0098] In the present disclosure, relational terms such as first and second, etc. are merely used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply that there is any such actual relationship or order between these entities or operations. The block diagrams of the devices, devices, equipment, and systems involved in the present disclosure are merely illustrative examples and are not intended to require or imply that they must be connected, arranged, or configured in the manner shown in the block diagrams. As will be appreciated by those skilled in the art, these devices, devices, equipment, and systems can be connected, arranged, or configured in any manner. Words such as "including," "comprising," "having," and the like are open-ended words, meaning "including but not limited to," and can be used interchangeably therewith. The words "or" and "and" used herein refer to the words "and / or" and can be used interchangeably therewith, unless the context clearly indicates otherwise. The word "such as" used herein refers to the phrase "such as but not limited to," and can be used interchangeably therewith.

[0099] Additionally, as used herein, "or" used in a list of items beginning with "at least one" indicates a separate list, so that, for example, a list of "at least one of A, B, or C" means A or B or C, or AB or AC or BC, or ABC (i.e., A and B and C). Furthermore, the word "exemplary" does not mean that the example described is preferred or better than other examples.

[0100] It should also be noted that in the system and method of the present disclosure, each component or each step can be decomposed and / or recombined. Such decomposition and / or recombination should be regarded as equivalent solutions of the present disclosure.

[0101] Various changes, substitutions, and modifications may be made to the technology described herein without departing from the teachings defined by the appended claims. Moreover, the scope of the claims of this disclosure is not limited to the specific aspects of the processes, machines, manufactures, compositions of things, means, methods, and actions described above. Currently existing or later developed processes, machines, manufactures, compositions of things, means, methods, or actions that perform substantially the same function or achieve substantially the same results as the corresponding aspects described herein may be utilized. Accordingly, the appended claims include within their scope such processes, machines, manufactures, compositions of things, means, methods, or actions.

[0102] The above description of the disclosed aspects is provided to enable any person skilled in the art to make or use the present disclosure. Various modifications to these aspects will be readily apparent to those skilled in the art, and the general principles defined herein may be applied to other aspects without departing from the scope of the present disclosure. Therefore, the present disclosure is not intended to be limited to the aspects shown herein, but rather to be accorded the widest scope consistent with the principles and novel features disclosed herein.

[0103] The above description has been provided for the purpose of illustration and description. In addition, this description is not intended to limit the embodiments of the present disclosure to the forms disclosed herein. Although a number of example aspects and embodiments have been discussed above, those skilled in the art will recognize certain variations, modifications, alterations, additions, and sub-combinations thereof.

[0104] Although the present invention has been described in detail in the specification, drawings and embodiments, it should be understood by those skilled in the art that the present invention may still be modified or replaced by equivalents; and all technical solutions and improvements thereto that do not depart from the spirit and scope of the present invention are included in the scope of protection of the patent for the present invention.

Claims

1. A file leakage protection method, characterized in that: The method includes: Select files that can be detected and killed in the company's current EDR environment as malicious file samples; Extract the hard-coded information of the malicious file sample and save it as the initial feature; Delete invalid characters from the initial feature and generate the protection feature. The specific implementation method is as follows: Delete the initial signature starting from the first character. If the file is still considered malicious by EDR after the character is deleted, delete the character; otherwise, keep the character. Traverse from the first character to the last character and use the retained string as the protection feature; Add protection features to the whitelist; Inserting protection features into controlled documents without affecting the functionality of the document itself; After the insertion is completed, the controlled file will be sent for use.

2. The file leakage protection method according to claim 1, characterized in that: Before the controlled file is issued, the file permissions are modified to delete the user's write permissions.

3. The file leakage protection method according to claim 1, characterized in that: For confidential documents that need to be automatically destroyed, the protection features corresponding to the confidential documents in the whitelist will be deleted after the expiration date through automatic timing or manual operation.

4. The file leakage protection method according to any one of claims 1 to 3, characterized in that: The files that can be checked and killed in the enterprise's current EDR environment include but are not limited to: The ransomware WannaCry and the Weibo Cloud Sandbox publish malicious file samples, backdoor files, Webshell Trojans, and vulnerability exploits every day.

5. The file leakage protection method according to any one of claims 1 to 3, characterized in that: The specific implementation method of inserting protection features into a controlled file is: For systems using NTFS hard disk format, insert protection features into the ADS of the file; For systems using ex4, Btrfs, APFS, and HFS+ hard disk formats with extendable attributes, protection features are added to the extended attributes. For PE files, protection features are inserted by adding resource information; For image files, insert protection features into EXIF data; For files supported by Office suite, add protection features to macros; For non-PE files that contain extended information, add protection features in the first 4030 bytes or the last 4030 bytes of the file, and find the extended information using the additional information keyword; For other file types, if metadata exists, the protection feature is inserted into the metadata; otherwise, no processing is performed for the time being.

6. The device for preventing document leakage is characterized in that: include: A protection feature generation unit, configured to obtain a malicious file sample and generate a protection feature based on the malicious file sample; The specific implementation method for generating protection features based on malicious file samples is as follows: Delete the initial signature starting from the first character. If the file is still considered malicious by EDR after the character is deleted, delete the character; otherwise, keep the character. Traverse from the first character to the last character and use the retained string as the protection feature; A protection feature adding unit, used for inserting protection features into a controlled file without affecting the function of the file itself; The file management unit is used to set up whitelists and handle the issuance and destruction of controlled files.

7. An electronic device, characterized in that: The electronic device comprises: at least one processor; and, A memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, the instructions being executed by the at least one processor so as to enable the at least one processor to execute the file leakage protection method described in any one of claims 1-5.

8. A computer-readable storage medium, characterized in that The computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a computer to execute the file leakage protection method according to any one of claims 1 to 5.

Images