Cross-border data flow real-time monitoring method for dynamic risk perception

Abstract

The invention provides a dynamic risk awareness cross-border data flow real-time monitoring method, and relates to the technical field of data security, and the method comprises the steps: deploying a monitoring agent on terminal equipment with a data collection function, capturing original data flow in real time, and obtaining related information; analyzing the network data packet to determine a cross-border flow condition; comparing the original data with a preset format library; identifying an encryption algorithm for unmatched data through static and dynamic analysis and decrypting the unmatched data; comparing the decrypted data with the sensitive data to judge whether the decrypted data is the sensitive data or not; the transmission condition is monitored in real time, an alarm is triggered when abnormity occurs, information is recorded, and a library and rules are updated. According to the cross-border data flow monitoring method and device, the monitoring agent is deployed on the terminal equipment, and cross-border data flow is effectively monitored by means of comparison of the preset format library, static and dynamic analysis and the like.

Description

Technical Field

[0001] The present invention relates to the field of data security technology, and in particular to a method for real-time monitoring of cross-border data flows with dynamic risk perception. Background Art

[0002] With the acceleration of digitalization, global data volumes are exploding, and cross-border data flows are expanding. Business expansion, international scientific research collaboration, and other activities are driving the frequent transfer of large amounts of data between countries and regions. Furthermore, the widespread adoption of emerging technologies such as the Internet of Things and big data is diversifying data sources. The continuous emergence of smart devices is generating complex and diverse data formats. This not only increases the complexity of data management but also introduces more potential risks to cross-border data flows, raising the bar for data security monitoring.

[0003] Traditional methods for monitoring cross-border data flows rely primarily on post-event reviews, making real-time monitoring difficult. Existing tools lack the ability to effectively parse and identify the specialized data formats generated by new devices, such as encrypted binary files. Furthermore, risk assessments rely on static rules that are unable to adapt to dynamic data changes. Regarding international cooperation, data protection regulations vary widely across countries, making traditional monitoring methods difficult to coordinate. This has led to numerous loopholes in cross-border data flow regulation and the increasing risks of data leaks and illegal transmission.

[0004] Therefore, it is necessary to design a real-time monitoring method for cross-border data flows with dynamic risk perception to solve the problems in existing technologies such as non-real-time monitoring, difficulty in parsing and identifying special data formats, static risk assessment, and difficulty in coordinating international regulations. Summary of the Invention

[0005] In view of this, the present invention proposes a real-time monitoring method for cross-border data flow with dynamic risk perception, aiming to solve the problem of how to effectively monitor the risks in the process of cross-border data flow and ensure data security.

[0006] In one aspect, the present invention provides a method for real-time monitoring of cross-border data flows with dynamic risk awareness, comprising:

[0007] S1, deploys a monitoring agent on a terminal device with data collection capabilities to capture the raw data traffic generated by the device in real time and obtain network data packets and device status information;

[0008] S2, analyzes the IP address location information and domain name system data packets in network data packets to determine the existence and specific path of cross-border data flow;

[0009] S3, compares the captured raw data with the preset format library;

[0010] S4, for unknown data or encrypted binary files that do not match the format library, identify the encryption algorithm type through static analysis and dynamic analysis and use decryption tools to decrypt;

[0011] S5, comparing the decrypted data with the sensitive data and determining whether the decrypted data is sensitive data;

[0012] S6 monitors the data transmission path and content in real time, triggers an alarm when an anomaly is found, records the transmission path and device information, and updates the format library and risk rules based on the risk event processing results.

[0013] Furthermore, the construction of the preset format library includes: collecting data format and encryption algorithm features in historical data, classifying and arranging them according to data type, file extension, and encryption protocol to form a database containing data format feature values and encryption algorithm identifiers;

[0014] When the file header information, data segment structure characteristics, and encryption protocol fields of the original data are completely consistent with any characteristic value stored in the format library, the original data is determined to be in a known format and the corresponding decryption rules are called;

[0015] When the feature values of different dimensions do not match for three consecutive times, the original data is determined to be unknown format data.

[0016] Furthermore, the static analysis includes: disassembling data code, extracting characteristic character strings and hash values;

[0017] The dynamic analysis includes: simulating the data operation environment and monitoring the key calling behavior during the decryption process;

[0018] When the hash value extracted by the static analysis matches the characteristic hash value of a known malicious encryption algorithm, the original data is marked as a high-risk encryption type and an emergency alert is triggered;

[0019] When the dynamic analysis detects that the decryption process calls a preset prohibited overseas key server address, data transmission is blocked and key request source device information is recorded;

[0020] When neither the static analysis nor the dynamic analysis finds clear features, the public decryption tool library is called to perform decryption.

[0021] Furthermore, the sensitive data includes geographic information data, scientific research data, and data prohibited from leaving the country by national laws and regulations;

[0022] When a continuous set of longitude and latitude coordinates appears in the decrypted data and the coordinate range covers the boundary of the preset sensitive area, the decrypted data is determined to be sensitive geographic information data;

[0023] When the data file name contains a preset scientific research project number prefix or the data content contains restricted export technology keywords, the decrypted data will be determined to be restricted export scientific research data;

[0024] When data meets two or more sensitive data characteristics at the same time, the risk level is increased and the monitoring records are stored in encrypted form.

[0025] Furthermore, the real-time monitoring of the path and content of data transmission includes: establishing a cross-border data transmission path ledger to record the source device identification, destination IP address, transmission timestamp and data flow size of each data outbound transaction;

[0026] When the same source device transmits data to an unauthorized target IP address multiple times within a preset time period and the single traffic volume exceeds the preset traffic threshold, an abnormal transmission alarm is triggered;

[0027] When three or more different source devices transmit sensitive data to the same target IP address in succession in the transmission path ledger, the target IP address is marked as a high-risk receiving end and full-link tracking is initiated.

[0028] Furthermore, the updating of the format library and risk rules based on the risk event processing results includes: for newly identified unknown data formats, extracting their feature values and classifying them into three levels according to data type, file extension, and encryption algorithm, and adding them to the unknown format to be verified area of the format library; for verified new encryption algorithms, generating a unique algorithm identifier and associating it with the corresponding decryption tool path, and updating the encryption algorithm feature table of the format library;

[0029] When the risk event processing result shows a false alarm, the characteristic value of the false alarm data is recorded and marked as a low-risk feature in the format library; when the processing result shows a missed alarm, the unidentified features of the missed alarm data are extracted, and a new risk identification rule is generated and inserted into the extended judgment condition of the sensitive data list.

[0030] Furthermore, the device status information includes device geographic location information, data acquisition module operating status and network connection mode;

[0031] When the device's geographic location information shows that it is in a preset data outbound prohibited area, the data transmission function will be automatically blocked and a device abnormality alarm will be sent;

[0032] When the data acquisition module is in operation and unauthorized startup or abnormal parameter changes occur, the abnormal log is recorded and the device self-check program is triggered;

[0033] When the network connection mode is switched to an unauthorized virtual private network, the network connection is immediately disconnected and the connection change record is reported.

[0034] Furthermore, when analyzing the network data packet in step S2, the transport layer protocol type, port number and application layer data identifier are extracted simultaneously;

[0035] When the transport layer protocol type is the preset encryption protocol and the port number belongs to the unauthorized port range, it will be marked as a suspicious transmission path and the monitoring frequency will be increased;

[0036] When the application layer data identifier does not match the preset data outbound service identifier, the current data transmission is determined to be abnormal data flow.

[0037] Furthermore, the determination of whether the decrypted data is sensitive data includes:

[0038] Establish a regulatory mapping table to associate sensitive data characteristics with specific legal provisions;

[0039] When the data meets the important data characteristics stipulated in the Data Security Law, an additional outbound security assessment process will be triggered;

[0040] When the data involves sensitive personal information as stipulated in the Personal Information Protection Law, verify whether there is a separate user authorization document and record the authorization status.

[0041] Furthermore, the transmission path and device information include: the hardware serial number of the source device, the network interface MAC address and the domain name decryption record of the target device;

[0042] When data outbound tracing is required, the hardware serial number is used to associate the device registration information, the MAC address is used to locate the physical location of the device, and the domain name is used to decrypt the records and track the actual operating entity of the data recipient;

[0043] For source devices that have experienced multiple abnormal data flows, a device risk score is generated. When the risk score exceeds the preset score threshold, the device is forced offline and the device manager is notified to conduct a security review.

[0044] Compared with the existing technology, the beneficial effect of the present invention is that the real-time monitoring method for cross-border data flow with dynamic risk perception processes unknown and encrypted data through format library comparison and multiple analysis methods, thereby improving the ability to parse and identify special format data. By comparing decrypted data with sensitive data, risks can be accurately judged. Transmission paths and content are monitored and abnormal alarms are issued. Format libraries and risk rules can also be updated to effectively respond to changes in risks. The overall implementation of full-process and dynamic monitoring solves the problems of traditional methods such as non-real-time monitoring, difficult data parsing, and static risk assessment, effectively ensuring the security of cross-border data flow. BRIEF DESCRIPTION OF THE DRAWINGS

[0045] Various other advantages and benefits will become apparent to those skilled in the art upon reading the detailed description of the preferred embodiment below. The accompanying drawings are for illustration purposes only and are not to be considered as limiting the present invention. The same reference symbols are used throughout the drawings to represent the same components. In the drawings:

[0046] Figure 1 A flow chart of a method for real-time monitoring of cross-border data flows with dynamic risk awareness provided by an embodiment of the present invention; DETAILED DESCRIPTION

[0047] Exemplary embodiments of the present invention will be described in more detail below with reference to the accompanying drawings. Although exemplary embodiments of the present invention are shown in the accompanying drawings, it should be understood that the present invention can be implemented in various forms and should not be limited by the embodiments set forth herein. On the contrary, these embodiments are provided to enable a more thorough understanding of the present invention and to fully convey the scope of the present invention to those skilled in the art. It should be noted that, unless there is a conflict, the embodiments of the present invention and the features in the embodiments may be combined with each other. The present invention will be described in detail below with reference to the accompanying drawings and in conjunction with the implementation regulations.

[0048] Reference Figure 1 As shown, in some embodiments of the present application, a method for real-time monitoring of cross-border data flows with dynamic risk perception includes:

[0049] S1, deploys a monitoring agent on a terminal device with data collection capabilities to capture the raw data traffic generated by the device in real time and obtain network data packets and device status information;

[0050] S2, analyzes the IP address location information and domain name system data packets in network data packets to determine the existence and specific path of cross-border data flow;

[0051] S3, compares the captured raw data with the preset format library;

[0052] S4, for unknown data or encrypted binary files that do not match the format library, identify the encryption algorithm type through static analysis and dynamic analysis and use decryption tools to decrypt;

[0053] S5, comparing the decrypted data with the sensitive data and determining whether the decrypted data is sensitive data;

[0054] S6 monitors the data transmission path and content in real time, triggers an alarm when an anomaly is found, records the transmission path and device information, and updates the format library and risk rules based on the risk event processing results.

[0055] Specifically, a monitoring agent based on a lightweight data capture mechanism is deployed on terminal devices with data collection capabilities. This mechanism utilizes a real-time data collection algorithm to efficiently and comprehensively capture the raw data traffic generated by the device, obtaining network data packets and device status information. This algorithm optimizes the data capture interval and data filtering rules to achieve rapid data collection without affecting the normal operation of the device, providing a comprehensive data foundation for subsequent analysis.

[0056] It is understandable that by deploying monitoring agents on terminal devices and collecting, analyzing and monitoring data throughout the entire process, full-link coverage of cross-border data flows from capture to risk disposal is achieved, providing basic data support and process framework for dynamic risk perception.

[0057] In some embodiments of the present application, the construction of the preset format library includes: collecting data format and encryption algorithm features in historical data, classifying and arranging them according to data type, file extension, and encryption protocol, and forming a database containing data format feature values and encryption algorithm identifiers;

[0058] When the file header information, data segment structure characteristics, and encryption protocol fields of the original data are completely consistent with any characteristic value stored in the format library, the original data is determined to be in a known format and the corresponding decryption rules are called;

[0059] When the feature values of different dimensions do not match for three consecutive times, the original data is determined to be unknown format data.

[0060] Specifically, the pre-format library is constructed using a deep learning-based classification model. This model automatically extracts key features and categorizes them by learning from data formats and encryption algorithm characteristics from a large amount of historical data. When the raw data enters the comparison phase, a feature matching algorithm is used to accurately compare file header information, data segment structure characteristics, encryption protocol fields, and other features. This algorithm, based on similarity calculation principles, can quickly determine whether the raw data is in a known format. If the feature values of different dimensions do not match three times in a row, the data is considered to be in an unknown format, effectively improving the accuracy and efficiency of format determination.

[0061] Specifically, the preset format library is a database containing data format feature values and encryption algorithm identifiers that is determined by collecting data formats and encryption algorithm features that have appeared in historical data, and classifying and organizing them according to data type, file extension, and encryption protocol.

[0062] It can be understood that by classifying and sorting data formats and encryption features through a preset format library and matching features, known data types can be quickly identified and corresponding processing rules can be called, thereby improving the efficiency of automatic recognition of data formats and reducing blind spots in the processing of unknown data.

[0063] In some embodiments of the present application, the static analysis includes: disassembling data code, extracting feature strings and hash values;

[0064] The dynamic analysis includes: simulating the data operation environment and monitoring the key calling behavior during the decryption process;

[0065] When the hash value extracted by the static analysis matches the characteristic hash value of a known malicious encryption algorithm, the original data is marked as a high-risk encryption type and an emergency alert is triggered;

[0066] When the dynamic analysis detects that the decryption process calls a preset prohibited overseas key server address, data transmission is blocked and key request source device information is recorded;

[0067] When neither the static analysis nor the dynamic analysis finds clear features, the public decryption tool library is called to perform decryption.

[0068] Specifically, static analysis utilizes a disassembly tool based on a code parsing algorithm to deeply analyze data code and accurately extract characteristic strings and hash values. Dynamic analysis uses a simulated operating environment and key monitoring model. This model simulates the data operating environment and uses a monitoring algorithm for key call behavior during the decryption process to track the key call path in real time. When the hash value extracted by static analysis matches the characteristic hash value of a known malicious encryption algorithm determined based on a risk assessment algorithm, or when dynamic analysis detects that the decryption process calls a preset prohibited overseas key server address, the corresponding processing mechanism is triggered in a timely manner. If no clear characteristics are found in either case, a public decryption tool library based on an intelligent recommendation algorithm is called for decryption, improving decryption efficiency and security.

[0069] It is understandable that combining static analysis and dynamic analysis methods to conduct multi-dimensional detection of encrypted data, and graded processing of encrypted data with different characteristics (such as marking high-risk, blocking transmission, and calling decryption tools) improves the comprehensiveness of encryption algorithm identification and the flexibility of risk response.

[0070] In some embodiments of the present application, the sensitive data includes geographic information data, scientific research data, and data prohibited from leaving the country by national laws and regulations;

[0071] When a continuous set of longitude and latitude coordinates appears in the decrypted data and the coordinate range covers the boundary of the preset sensitive area, the decrypted data is determined to be sensitive geographic information data;

[0072] When the data file name contains a preset scientific research project number prefix or the data content contains restricted export technology keywords, the decrypted data will be determined to be restricted export scientific research data;

[0073] When data meets two or more sensitive data characteristics at the same time, the risk level is increased and the monitoring records are stored in encrypted form.

[0074] Specifically, to determine sensitive data, a geographic information recognition model is used to detect whether there are continuous sets of longitude and latitude coordinates in the decrypted data. A region matching algorithm is then used to determine whether the data overlaps the boundaries of a preset sensitive region, thereby determining whether it is sensitive geographic information data. For scientific research data, a text keyword matching algorithm and a number recognition algorithm are used to determine whether the data file name contains a preset scientific research project number prefix or whether restricted export technology keywords appear in the data content. When data simultaneously meets multiple sensitive data characteristics, the risk level is automatically increased through a risk level escalation algorithm and the monitoring records are encrypted and stored to ensure data security.

[0075] Specifically, the preset sensitive area boundaries are a set of geographic coordinates determined by the coordinate range of the prohibited collection area disclosed by the national geographic information management department, and the preset scientific research project number prefix is a combination of the first characters of the number determined by the list of restricted export scientific research projects issued by the national science and technology management department.

[0076] It is understandable that clarifying the specific types and judgment rules of sensitive data (such as geographic coordinates, scientific research numbers, and keyword matching) and increasing the risk level of complex feature data can achieve accurate classification and differentiated management of sensitive data and enhance the targeted nature of risk judgment.

[0077] In some embodiments of the present application, the real-time monitoring of the path and content of data transmission includes: establishing a cross-border data transmission path ledger to record the source device identifier, destination IP address, transmission timestamp, and data flow size of each data outbound transaction;

[0078] When the same source device transmits data to an unauthorized target IP address multiple times within a preset time period and the single traffic volume exceeds the preset traffic threshold, an abnormal transmission alarm is triggered;

[0079] When three or more different source devices transmit sensitive data to the same target IP address in succession in the transmission path ledger, the target IP address is marked as a high-risk receiving end and full-link tracking is initiated.

[0080] Specifically, a cross-border data transmission path ledger recording mechanism based on blockchain technology is used to monitor the paths and content of data transmission in real time. This mechanism leverages the blockchain's immutable and distributed storage characteristics to securely and reliably record the source device identifier, destination IP address, transmission timestamp, and data traffic volume of each data outbound transaction. Through an abnormal traffic detection algorithm and a multi-source data correlation analysis algorithm, when the same source device transmits data to an unauthorized destination IP address multiple times within a preset time period and the single traffic volume exceeds the preset traffic threshold, or when three or more different source devices continuously transmit sensitive data to the same destination IP address in the transmission path ledger, corresponding alarms and tracking measures are triggered in a timely manner to achieve accurate monitoring of abnormal data transmission.

[0081] Specifically, the preset time period is a time length determined by counting the time interval frequency of normal business data transmission, and the preset traffic threshold is a byte count critical value determined by analyzing the traffic peak of normal data transmission of similar devices.

[0082] It is understandable that by establishing a transmission path ledger and setting abnormal transmission trigger conditions (such as traffic thresholds, multi-device centralized transmission), it is possible to capture abnormal data flow patterns in real time, quickly locate high-risk receiving ends and initiate tracking, thereby improving the monitoring capabilities of batch illegal transmissions.

[0083] In some embodiments of the present application, the updating of the format library and risk rules based on the risk event processing results includes: for newly identified unknown data formats, extracting their feature values and classifying them into three levels according to data type, file extension, and encryption algorithm, and adding them to the unknown format to be verified area of the format library; for verified new encryption algorithms, generating a unique algorithm identifier and associating it with the corresponding decryption tool path, and updating the encryption algorithm feature table of the format library;

[0084] When the risk event processing result shows a false alarm, the characteristic value of the false alarm data is recorded and marked as a low-risk feature in the format library; when the processing result shows a missed alarm, the unidentified features of the missed alarm data are extracted, and a new risk identification rule is generated and inserted into the extended judgment condition of the sensitive data list.

[0085] Specifically, when updating the format library and risk rules based on the results of risk event processing, a data feature extraction and classification algorithm is used to extract feature values from newly identified unknown data formats. These are then classified into three levels based on data type, file extension, and encryption algorithm, and added to the unknown format verification area of the format library. For verified new encryption algorithms, a unique algorithm identifier is generated using the algorithm identification generation model and associated with the corresponding decryption tool path, which is then updated to the encryption algorithm feature table in the format library. When the risk event processing result is a false positive or false negative, the format library and risk rules are optimized and updated using the false positive data marking algorithm and the false negative rule generation algorithm, respectively, making the monitoring system more intelligent and accurate.

[0086] It is understandable that dynamically updating the format library and risk rules (such as adding unknown formats and optimizing identification rules) based on the results of risk event processing enables the system to autonomously adapt to changes in data formats and encryption technologies, reduce false alarms and missed alarms, and enhance the self-optimization capabilities of the monitoring system.

[0087] In some embodiments of the present application, the device status information includes device geographic location information, data acquisition module operating status, and network connection mode;

[0088] When the device's geographic location information shows that it is in a preset data outbound prohibited area, the data transmission function will be automatically blocked and a device abnormality alarm will be sent;

[0089] When the data acquisition module is in operation and unauthorized startup or abnormal parameter changes occur, the abnormal log is recorded and the device self-check program is triggered;

[0090] When the network connection mode is switched to an unauthorized virtual private network, the network connection is immediately disconnected and the connection change record is reported.

[0091] Specifically, a sensor fusion and status monitoring model is used to process device status information. This model integrates multiple data sources, including the device's geographic location, the operating status of the data acquisition module, and the network connection mode. Using an anomaly detection algorithm, it promptly triggers corresponding blocking, recording, self-testing, and reporting actions when the device's geographic location indicates it is in a preset prohibited data export zone, when the data acquisition module's operating status experiences unauthorized startup or abnormal parameter changes, or when the network connection mode switches to an unauthorized virtual private network, ensuring device operational safety and data transmission compliance.

[0092] Specifically, the preset prohibited data outflow areas are geographical scopes determined through the geographical restriction list issued by the national data security regulatory authorities.

[0093] It is understandable that by monitoring the device's geographic location, acquisition module status, and network connection mode, violations on the device side (such as entering prohibited areas and unauthorized network switching) can be blocked and alarmed in real time, preventing illegal data from leaving the country at the source of the device, thereby strengthening data security protection at the terminal level.

[0094] In some embodiments of the present application, when analyzing the network data packet in step S2, the transport layer protocol type, port number and application layer data identifier are extracted simultaneously;

[0095] When the transport layer protocol type is the preset encryption protocol and the port number belongs to the unauthorized port range, it is marked as a suspicious transmission path and the monitoring frequency is increased;

[0096] When the application layer data identifier does not match the preset data outbound service identifier, the current data transmission is determined to be abnormal data flow.

[0097] Specifically, when analyzing network data packets, we utilize protocol parsing and feature extraction algorithms to simultaneously extract the transport layer protocol type, port number, and application layer data identifier. Using a risk path assessment model, when the transport layer protocol type is a preset encryption protocol and the port number falls within the unauthorized port range, the transmission path is marked as suspicious and the monitoring frequency is increased. Using a data identifier matching algorithm, when the application layer data identifier does not match the preset data outbound business identifier, the current data transmission is determined to be abnormal, effectively identifying network transmission risks.

[0098] Specifically, the preset encryption protocol is a protocol type determined by the list of encryption protocols allowed for use as specified in the national cybersecurity standards, and the preset data outbound business identifier is a set of identifiers determined by the legal data outbound business types filed by the enterprise.

[0099] It is understandable that when analyzing network data packets, the transport layer protocol, port number and application layer identifier are combined to increase the monitoring frequency of suspicious transmission paths and identify abnormal data flows, thus realizing multi-level risk screening from the network layer to the application layer and improving the detection capability of hidden transmission channels.

[0100] In some embodiments of the present application, determining whether the decrypted data is sensitive data includes:

[0101] Establish a regulatory mapping table to associate sensitive data characteristics with specific legal provisions;

[0102] When the data meets the important data characteristics stipulated in the Data Security Law, an additional outbound security assessment process will be triggered;

[0103] When the data involves sensitive personal information as stipulated in the Personal Information Protection Law, verify whether there is a separate user authorization document and record the authorization status.

[0104] Specifically, when determining whether decrypted data is sensitive, a regulatory mapping table based on regulatory association and intelligent judgment models is established to link sensitive data characteristics with specific legal provisions. When the data meets the important data characteristics stipulated in the Data Security Law, an additional outbound security assessment process is triggered through the outbound assessment trigger algorithm. When the data involves personal sensitive information stipulated in the Personal Information Protection Law, an authorization document verification algorithm is used to verify the existence of a separate user authorization document and record the authorization status to ensure that data processing complies with legal and regulatory requirements.

[0105] Specifically, the regulatory mapping table is an association table determined by parsing the national data security-related laws and regulations one by one, extracting the legal article numbers and applicable conditions corresponding to the sensitive data characteristics.

[0106] It is understandable that by establishing a regulatory mapping table to associate sensitive data characteristics with legal clauses, corresponding review processes (such as security assessments and authorization verification) are triggered for different regulatory requirements to ensure that data outflow complies with national laws and regulations, thereby enhancing the level of automation of compliance management.

[0107] In some embodiments of the present application, the transmission path and device information include: the hardware serial number of the source device, the network interface MAC address, and the domain name decryption record of the target device;

[0108] When data outbound tracing is required, the hardware serial number is used to associate the device registration information, the MAC address is used to locate the physical location of the device, and the domain name is used to decrypt the records and track the actual operating entity of the data recipient;

[0109] For source devices that have experienced multiple abnormal data flows, a device risk score is generated. When the risk score exceeds the preset score threshold, the device is forced offline and the device manager is notified to conduct a security review.

[0110] Specifically, for data outflow tracing, we use a device identity association algorithm to associate device registration information with the hardware serial number, a MAC address location algorithm to locate the device's physical location, and a domain name resolution and entity tracking algorithm to track the actual operating entity of the data recipient through domain name decryption records. For source devices with repeated abnormal data flows, a risk scoring calculation model is used to generate a device risk score. When the risk score exceeds a preset threshold, the device control algorithm triggers a forced offline procedure for the device and notifies the device manager for a security review, achieving effective traceability of cross-border data flows and device management.

[0111] Specifically, the preset scoring threshold is a scoring critical value determined by counting the frequency of risk events occurring when similar equipment is operating normally.

[0112] It is understandable that by recording the device hardware identification, network address and domain name resolution information to achieve data outbound traceability, and generate risk scores and mandatory controls for high-risk devices, a complete chain of evidence is provided for investigations of violations, while also improving the closed-loop management capabilities of device-side risks.

[0113] It should be noted that:

[0114] In the description provided herein, a large number of specific details are described. However, it is understood that the embodiments of the present application can be practiced without these specific details. In some instances, well-known structures and technologies are not shown in detail so as not to obscure the understanding of this description.

[0115] Furthermore, those skilled in the art will appreciate that although some embodiments described herein include certain features and not other features included in other embodiments, the combination of features from different embodiments is meant to be within the scope of this application and to form different embodiments.

[0116] The above description is merely a preferred embodiment of the present application, but the scope of protection of the present application is not limited thereto. Any changes or substitutions that can be easily conceived by a person skilled in the art within the technical scope disclosed in this application should be included in the scope of protection of the present application. Therefore, the scope of protection of the present application should be based on the scope of protection of the claims.

Claims

1. A dynamic risk-aware real-time monitoring method for cross-border data flows, characterized by: include: S1, deploys a monitoring agent on a terminal device with data collection capabilities to capture the raw data traffic generated by the device in real time and obtain network data packets and device status information; S2, analyzes the IP address location information and domain name system data packets in network data packets to determine the existence and specific path of cross-border data flow; S3, compares the captured raw data with the preset format library; S4, for unknown data or encrypted binary files that do not match the format library, identify the encryption algorithm type through static analysis and dynamic analysis and use decryption tools to decrypt; S5, comparing the decrypted data with the sensitive data and determining whether the decrypted data is sensitive data; S6 monitors the data transmission path and content in real time, triggers an alarm when an anomaly is found, records the transmission path and device information, and updates the format library and risk rules based on the risk event processing results.

2. The method for real-time monitoring of cross-border data flows with dynamic risk perception according to claim 1 is characterized in that: The construction of the preset format library includes: collecting data format and encryption algorithm features in historical data, classifying and arranging them according to data type, file extension, and encryption protocol, and forming a database containing data format feature values and encryption algorithm identifiers; When the file header information, data segment structure characteristics, and encryption protocol fields of the original data are completely consistent with any characteristic value stored in the format library, the original data is determined to be in a known format and the corresponding decryption rules are called; When the feature values of different dimensions do not match for three consecutive times, the original data is determined to be unknown format data.

3. The method for real-time monitoring of cross-border data flows with dynamic risk perception according to claim 2 is characterized in that: The static analysis includes: disassembling data code, extracting characteristic character strings and hash values; The dynamic analysis includes: simulating the data operation environment and monitoring the key calling behavior during the decryption process; When the hash value extracted by the static analysis matches the characteristic hash value of a known malicious encryption algorithm, the original data is marked as a high-risk encryption type and an emergency alert is triggered; When the dynamic analysis detects that the decryption process calls a preset prohibited overseas key server address, data transmission is blocked and key request source device information is recorded; When neither the static analysis nor the dynamic analysis finds clear features, the public decryption tool library is called to perform decryption.

4. The method for real-time monitoring of cross-border data flows with dynamic risk perception according to claim 3 is characterized in that: Sensitive data includes geographic information data, scientific research data, and data prohibited from exporting abroad by national laws and regulations; When a continuous set of longitude and latitude coordinates appears in the decrypted data and the coordinate range covers the boundary of the preset sensitive area, the decrypted data is determined to be sensitive geographic information data; When the data file name contains a preset scientific research project number prefix or the data content contains restricted export technology keywords, the decrypted data will be determined to be restricted export scientific research data; When data meets two or more sensitive data characteristics at the same time, the risk level is increased and the monitoring records are stored in encrypted form.

5. The method for real-time monitoring of cross-border data flows with dynamic risk perception according to claim 4 is characterized in that: The real-time monitoring of the path and content of data transmission includes: establishing a cross-border data transmission path ledger to record the source device identification, destination IP address, transmission timestamp and data flow size of each data outbound transaction; When the same source device transmits data to an unauthorized target IP address multiple times within a preset time period and the single traffic volume exceeds the preset traffic threshold, an abnormal transmission alarm is triggered; When three or more different source devices transmit sensitive data to the same target IP address in succession in the transmission path ledger, the target IP address is marked as a high-risk receiving end and full-link tracking is initiated.

6. The method for real-time monitoring of cross-border data flows with dynamic risk perception according to claim 5 is characterized in that: The updating of the format library and risk rules based on the risk event processing results includes: for newly identified unknown data formats, extracting their feature values and classifying them into three levels according to data type, file extension, and encryption algorithm, and adding them to the unknown format to be verified area of the format library; for verified new encryption algorithms, generating a unique algorithm identifier and associating it with the corresponding decryption tool path, and updating the encryption algorithm feature table of the format library; When the risk event processing result shows a false alarm, the characteristic value of the false alarm data is recorded and marked as a low-risk feature in the format library; when the processing result shows a missed alarm, the unidentified features of the missed alarm data are extracted, and a new risk identification rule is generated and inserted into the extended judgment condition of the sensitive data list.

7. The method for real-time monitoring of cross-border data flows with dynamic risk perception according to claim 6 is characterized in that: The device status information includes device geographic location information, data acquisition module operating status and network connection mode; When the device's geographic location information shows that it is in a preset data outbound prohibited area, the data transmission function will be automatically blocked and a device abnormality alarm will be sent; When the data acquisition module is in operation and unauthorized startup or abnormal parameter changes occur, the abnormal log is recorded and the device self-check program is triggered; When the network connection mode is switched to an unauthorized virtual private network, the network connection is immediately disconnected and the connection change record is reported.

8. The method for real-time monitoring of cross-border data flows with dynamic risk perception according to claim 7 is characterized in that: When analyzing the network data packet in step S2, the transport layer protocol type, port number and application layer data identifier are extracted simultaneously; When the transport layer protocol type is the preset encryption protocol and the port number belongs to the unauthorized port range, it is marked as a suspicious transmission path and the monitoring frequency is increased; When the application layer data identifier does not match the preset data outbound service identifier, the current data transmission is determined to be abnormal data flow.

9. The method for real-time monitoring of cross-border data flows with dynamic risk perception according to claim 8 is characterized in that: The determination of whether the decrypted data is sensitive data includes: Establish a regulatory mapping table to associate sensitive data characteristics with specific legal provisions; When the data meets the important data characteristics stipulated in the Data Security Law, an additional outbound security assessment process will be triggered; When the data involves sensitive personal information as stipulated in the Personal Information Protection Law, verify whether there is a separate user authorization document and record the authorization status.

10. The method for real-time monitoring of cross-border data flows with dynamic risk perception according to claim 9 is characterized in that: The transmission path and device information include: the hardware serial number of the source device, the network interface MAC address and the domain name decryption record of the target device; When data outbound tracing is required, the hardware serial number is used to associate the device registration information, the MAC address is used to locate the physical location of the device, and the domain name is used to decrypt the records and track the actual operating entity of the data recipient; For source devices that have experienced multiple abnormal data flows, a device risk score is generated. When the risk score exceeds the preset score threshold, the device is forced offline and the device manager is notified to conduct a security review.

Images