A data leakage tracing method and device

Abstract

The application relates to the technical field of data tracing, and particularly provides a data leakage tracing method and device, which comprises the following steps: when a tracing request is received, real-time transaction volume information of a financial transaction system is acquired, and a tracing task is generated according to the tracing request; the system busy degree level is acquired according to the real-time transaction volume information and a preset conversion relationship; the mapping relationship table about the busy degree level, resource quota and tracing mode is inquired according to the system busy degree level, so as to determine the tracing resource quota and the tracing mode of the tracing task; the log data of the financial transaction system is subjected to tracing analysis based on the tracing resource quota and the tracing mode, so as to acquire the evidence chain corresponding to the tracing task; the method can effectively solve the problem that resource competition exists between the tracing operation and high-concurrency transaction due to too much resource quota occupied by the tracing operation, and the transaction stability and response speed of the financial transaction system are reduced.

Description

Technical Field

[0001] This application relates to the field of data tracing technology, and more specifically, to a method and apparatus for tracing data leaks. Background Technology

[0002] Because of the advantages of cloud-native architecture, such as high concurrency and elastic scalability, existing financial institutions typically build their financial transaction systems based on cloud-native architecture. Under cloud-native architecture, the log data of financial transaction systems is characterized by massive volume, distribution, and dynamic changes. In the event of a data breach, financial institutions need to trace the source of the incident and generate a chain of evidence. Current technologies use centralized log analysis methods (collecting, storing, and analyzing log data distributed across different microservice nodes in the same way) for tracing. However, centralized log analysis methods consume a large amount of the financial transaction system's resource quota. Therefore, existing technologies suffer from resource competition between tracing operations and high-concurrency transactions due to excessive resource consumption, leading to a decrease in the stability and response speed of the financial transaction system. This decrease in transaction stability and response speed is particularly noticeable during peak trading periods.

[0003] Currently, there is no effective technical solution to the above-mentioned problems. It should be noted that the information disclosed in this section is only for understanding the background of the present invention and therefore may include information that does not constitute prior art. Summary of the Invention

[0004] The purpose of this application is to provide a data leakage tracing method and apparatus that can effectively solve the problem of resource competition between tracing operations and high-concurrency transactions, which leads to a decrease in the transaction stability and response speed of financial transaction systems due to excessive resource quotas occupied by tracing operations.

[0005] Firstly, this application provides a data breach tracing method, applied to a financial transaction system using a cloud-native architecture. The data breach tracing method includes the following steps:

[0006] S1. Upon receiving a tracing request, obtain real-time transaction volume information from the financial transaction system and generate a tracing task based on the tracing request.

[0007] S2. Obtain the system busy level based on real-time transaction volume information and preset conversion relationships;

[0008] S3. Based on the system busy level, query the pre-built mapping table of busy level, resource quota and tracing mode to determine the tracing resource quota and tracing mode of the tracing task;

[0009] S4. Based on the traceability resource quota and traceability mode, perform traceability analysis on the log data of the financial transaction system to obtain the evidence chain corresponding to the traceability task.

[0010] This application provides a data leakage tracing method. First, it determines the system's busy level based on real-time trading volume information of the financial trading system. Then, it determines the tracing resource quota and tracing mode for the tracing task based on the system busy level. Finally, it performs tracing analysis on the log data of the financial trading system based on the tracing resource quota and tracing mode. Since the tracing resource quota and tracing mode of this application match the real-time trading volume information, this application can essentially provide a method for dynamically adjusting the resource quota and tracing mode of the tracing operation based on the real-time trading volume of the financial trading system. This avoids the situation where the tracing operation occupies too much resource quota under the current real-time trading volume information. That is, even during peak trading periods, this application will not have resource competition between the tracing operation and high-concurrency trading, thereby effectively solving the problem of resource competition between the tracing operation and high-concurrency trading caused by excessive resource quota occupied by the tracing operation, resulting in a decrease in the trading stability and response speed of the financial trading system.

[0011] Optionally, the real-time trading volume information includes at least one set of trading type information and its corresponding trading volume information. Step S2 includes:

[0012] S21. Query the pre-built mapping table of transaction type and resource demand based on the transaction type information to obtain at least one resource demand information. Each transaction type information corresponds to one transaction resource demand information.

[0013] S22. Calculate the preliminary resource requirement based on the resource requirement information and transaction volume information corresponding to the transaction type information. The resource requirement is the product of the resource requirement information and the transaction volume information. Each transaction type information corresponds to a preliminary resource requirement.

[0014] S23. Calculate the total transaction resource demand based on all preliminary resource demands, and calculate the transaction resource utilization rate based on the total transaction resource demand and the total resource quota of the financial transaction system.

[0015] S24. Query the pre-built mapping table of resource utilization and busy level based on the transaction resource utilization rate to obtain the system busy level. The mapping table of resource utilization and busy level is a preset conversion relationship.

[0016] Optionally, the transaction resource demand information includes CPU resource transaction demand value, memory resource transaction demand value and IO resource transaction demand value, the total resource quota includes total CPU resource quota, total memory resource quota and total IO resource quota, and the traceable resource quota includes CPU resource traceable quota, memory resource traceable quota and IO resource quota.

[0017] Optionally, the tracing request includes data breach event parameters, which include the degree of impact of the data breach. Step S3 includes:

[0018] S31. Query the pre-built mapping table of busy level, resource quota and traceability mode according to the system busy level to obtain the first preliminary traceability resource quota and determine the traceability mode of the traceability task.

[0019] S32. Based on the impact of the data breach, query the pre-built mapping table between the impact of the breach and the resource quota adjustment coefficient to obtain the source resource quota adjustment coefficient;

[0020] S33. Calculate the traceability resource quota for the traceability task based on the first preliminary traceability resource quota and the traceability resource quota adjustment coefficient.

[0021] Optionally, step S33 includes:

[0022] S331. Calculate the second preliminary traceability resource quota based on the first preliminary traceability resource quota and the traceability resource quota adjustment coefficient;

[0023] S332. Obtain the total demand for trading resources and the total quota of resources of the financial trading system, and calculate the remaining resources based on the total quota of resources, the total demand for trading resources, and the second preliminary traceability quota of resources;

[0024] S333. Analyze whether the remaining resource amount is greater than the preset resource amount threshold. If not, use the second preliminary traceability resource quota as the traceability resource quota for the traceability task. If not, reduce the second preliminary traceability resource quota until the remaining resource amount is greater than the preset resource amount threshold. Then use the second preliminary traceability resource quota at this time as the traceability resource quota for the traceability task.

[0025] Optionally, step S333 includes:

[0026] A1. Query the pre-built mapping table between the system busy level and the resource threshold according to the system busy level to obtain the preset resource threshold;

[0027] A2. Analyze whether the remaining resource amount is greater than the preset resource amount threshold. If not, use the second preliminary traceability resource quota as the traceability resource quota for the traceability task. If not, reduce the second preliminary traceability resource quota until the remaining resource amount is greater than the preset resource amount threshold. Then use the second preliminary traceability resource quota at this time as the traceability resource quota for the traceability task.

[0028] Optionally, the data breach event parameters also include the sensitivity of the breached data, and step S31 includes:

[0029] S311. Analyze whether the sensitivity of the leaked data is greater than the preset sensitivity threshold. If yes, proceed to step S312; otherwise, proceed to step S313.

[0030] S312. Set the tracing mode of the tracing task to deep tracing mode, and query the pre-built mapping table of busy level, resource quota and tracing mode according to the system busy level to obtain the first preliminary tracing resource quota. The deep tracing mode is to perform a comprehensive analysis of all log data of the financial transaction system.

[0031] S313. Query the pre-built mapping table of busy level, resource quota and traceability mode according to the system busy level to obtain the first preliminary traceability resource quota and determine the traceability mode of the traceability task.

[0032] Optionally, the tracing mode includes a fast tracing mode and a deep tracing mode. The fast tracing mode involves sampling and analyzing the log data of the financial transaction system, while the deep tracing mode involves a comprehensive analysis of all log data of the financial transaction system.

[0033] Optionally, the default conversion relationship is a mapping table or function relationship about transaction volume and busy level.

[0034] Secondly, this application also provides a data breach tracing device, which is applied in a financial transaction system using a cloud-native architecture. The data breach tracing device includes:

[0035] The data processing module is used to obtain real-time transaction volume information of the financial transaction system when a traceability request is received, and to generate a traceability task based on the traceability request.

[0036] The system busy level acquisition module is used to obtain the system busy level based on real-time transaction volume information and a first preset conversion relationship;

[0037] The resource allocation and mode confirmation module is used to query pre-built information about the system's busy level, resource quotas, and tracing mode to determine the tracing resource quotas and tracing mode for the tracing task. The tracing modes include fast tracing mode and deep tracing mode.

[0038] The tracing module is used to perform tracing analysis on the log data of the financial transaction system based on tracing resource quotas and tracing modes in order to obtain the evidence chain corresponding to the tracing task.

[0039] This application provides a data leakage tracing device. First, it determines the system's busy level based on real-time trading volume information. Then, it determines the tracing resource quota and tracing mode for the tracing task based on the system busy level. Finally, it performs tracing analysis on the log data of the financial trading system based on the tracing resource quota and tracing mode. Because the tracing resource quota and tracing mode of this application match the real-time trading volume information, this application is equivalent to providing a method for dynamically adjusting the resource quota and tracing mode of the tracing operation based on the real-time trading volume of the financial trading system. This avoids the situation where the tracing operation occupies too many resource quotas under the current real-time trading volume information. That is, even during peak trading periods, this application will not cause resource competition between the tracing operation and high-concurrency trading, thus effectively solving the problem of resource competition between the tracing operation and high-concurrency trading, and the resulting decrease in the trading stability and response speed of the financial trading system due to excessive resource quota occupation by the tracing operation.

[0040] As can be seen from the above, the data leakage tracing method and apparatus provided in this application first determines the system busy level based on the real-time trading volume information of the financial trading system, then determines the tracing resource quota and tracing mode of the tracing task based on the system busy level, and finally performs tracing analysis on the log data of the financial trading system based on the tracing resource quota and tracing mode. Since the tracing resource quota and tracing mode of this application match the real-time trading volume information, this application can be equivalent to providing a method for dynamically adjusting the resource quota and tracing mode of the tracing operation based on the real-time trading volume of the financial trading system, so as to avoid the situation where the tracing operation occupies too much resource quota under the current real-time trading volume information. That is, even during the peak trading period, this application will not have the situation of resource competition between the tracing operation and high-concurrency trading, thereby effectively solving the problem of resource competition between the tracing operation and high-concurrency trading caused by the excessive resource quota occupied by the tracing operation, resulting in a decrease in the trading stability and response speed of the financial trading system. Attached Figure Description

[0041] Figure 1 A flowchart illustrating a data leakage tracing method provided in this application embodiment.

[0042] Figure 2 This is a schematic diagram of a data leakage tracing device provided in an embodiment of this application.

[0043] Attached reference numerals: 1. Data processing module; 2. Busyness level acquisition module; 3. Resource allocation and pattern confirmation module; 4. Source tracing module. Detailed Implementation

[0044] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. The components of the embodiments of this application described and shown in the accompanying drawings can be arranged and designed in various different configurations. Therefore, the following detailed description of the embodiments of this application provided in the accompanying drawings is not intended to limit the scope of the claimed application, but merely represents selected embodiments of this application. All other embodiments obtained by those skilled in the art based on the embodiments of this application without inventive effort are within the scope of protection of this application.

[0045] It should be noted that similar reference numerals and letters in the following figures indicate similar items; therefore, once an item is defined in one figure, it does not need to be further defined and explained in subsequent figures. Furthermore, in the description of this application, terms such as "first," "second," etc., are used only to distinguish descriptions and should not be construed as indicating or implying relative importance.

[0046] Firstly, such as Figure 1 As shown, this application provides a data breach tracing method, applied to a financial transaction system using a cloud-native architecture. The data breach tracing method includes the following steps:

[0047] S1. Upon receiving a tracing request, obtain real-time transaction volume information from the financial transaction system and generate a tracing task based on the tracing request.

[0048] S2. Obtain the system busy level based on real-time transaction volume information and preset conversion relationships;

[0049] S3. Based on the system busy level, query the pre-built mapping table of busy level, resource quota and tracing mode to determine the tracing resource quota and tracing mode of the tracing task;

[0050] S4. Based on the traceability resource quota and traceability mode, perform traceability analysis on the log data of the financial transaction system to obtain the evidence chain corresponding to the traceability task.

[0051] The tracing request in step S1 can be generated by the user using a terminal device after discovering a data breach. This terminal device can be an existing mobile phone, tablet, or computer. It should be understood that generating a tracing request is existing technology, and its generation process and principles will not be discussed in detail here. Specifically, the financial transaction system in this embodiment includes a transaction data monitoring module, which is a module in existing financial transaction systems. This module is used to collect transaction data from the financial transaction system in real time. This transaction data can be the number of transactions. Therefore, upon receiving a tracing request, this embodiment can utilize the transaction data monitoring module to obtain real-time transaction volume information of the financial transaction system. Preferably, this real-time transaction volume information is the number of transactions at the current moment. Step S1 can utilize existing task generation methods to generate a tracing task based on the tracing request. This tracing task preferably includes parameters of the tracing request, which can be keywords related to the data breach event or the time range of the data breach event.

[0052] The preset conversion relationship in step S2 can be a pre-built data table. This data table preferably defines the correspondence between transaction volume ranges and system busy levels. For example, when the transaction volume is 0-1000 transactions / second, the system busy level is low; when the transaction volume is 1000-5000 transactions / second, the system busy level is medium; and when the transaction volume is above 5000 transactions / second, the system busy level is high. Therefore, this embodiment can obtain the system busy level through data query based on real-time transaction volume information and the preset conversion relationship. Since the busy level of the financial trading system (system busy level) and the resource quota occupied by data transactions in the financial trading system are both positively correlated with real-time transaction volume information, the system busy level obtained in step S2 can reflect the resource quota occupied by data transactions in the financial trading system.

[0053] The mapping table in step S3 regarding the busy level, resource quota, and tracing mode pre-sets a corresponding resource quota and tracing mode for each busy level. The resource quota refers to the resources that can be allocated to the tracing task under the current busy level. These resources can be computing resources (e.g., number of CPU cores) and / or storage resources (e.g., memory size). Since the system busy level reflects the resource quota occupied by data transactions in the financial trading system, and the total resource quota of the financial trading system is a known value, the system busy level in this embodiment can also reflect the available resource quota in the financial trading system. Therefore, this embodiment can obtain the corresponding tracing mode based on the system busy level to perform tracing analysis on the log data. Specifically, this tracing mode reflects the strategy for tracing and analyzing log data in a financial transaction system. For example, a higher busy level indicates fewer available resource quotas in the financial transaction system. In this case, a tracing mode with lower analysis precision can be selected to analyze the log data. For instance, at a high busy level, the tracing mode analyzes only a portion of the log data distributed across different microservice nodes. Conversely, a lower busy level indicates more available resource quotas in the financial transaction system. In this case, a tracing mode with higher analysis precision can be selected to analyze the log data. For instance, at a low busy level, the tracing mode analyzes all log data distributed across different microservice nodes. Step S3 is equivalent to allocating appropriate resource quotas and selecting a suitable tracing mode based on the system busy level for the tracing task.

[0054] Step S4, source tracing analysis, involves retrieving, filtering, and performing correlation analysis on the log data of the financial transaction system to find clues related to the data breach incident and generate a chain of evidence based on those clues. It should be understood that the specific process of performing source tracing analysis on log data and generating a data chain in step S4 is preferably the same as the existing technology for performing source tracing analysis on log data and generating a data chain, and will not be discussed in detail here.

[0055] This application provides a data leakage tracing method. First, it determines the system's busy level based on real-time trading volume information of the financial trading system. Then, it determines the tracing resource quota and tracing mode for the tracing task based on the system busy level. Finally, it performs tracing analysis on the log data of the financial trading system based on the tracing resource quota and tracing mode. Since the tracing resource quota and tracing mode of this application match the real-time trading volume information, this application can essentially provide a method for dynamically adjusting the resource quota and tracing mode of the tracing operation based on the real-time trading volume of the financial trading system. This avoids the situation where the tracing operation occupies too much resource quota under the current real-time trading volume information. That is, even during peak trading periods, this application will not have resource competition between the tracing operation and high-concurrency trading, thereby effectively solving the problem of resource competition between the tracing operation and high-concurrency trading caused by excessive resource quota occupied by the tracing operation, resulting in a decrease in the trading stability and response speed of the financial trading system.

[0056] In some specific implementations, assuming the real-time transaction volume of the financial trading system is 6000 transactions / second, a preset conversion relationship defines a system busy level of 5000 transactions / second as high. Under this high system busy level, step S3 sets the traceability resource quota to a lower level (equivalent to allocating less CPU and memory resources for traceability operations) and sets the traceability mode to perform traceability analysis only on a small portion of the log data. This reduces the resource consumption of the financial trading system by traceability operations and ensures the stable operation of the financial trading system under high-concurrency trading conditions. Alternatively, assuming the real-time transaction volume of the financial trading system is 500 transactions / second, a preset conversion relationship defines a system busy level of 2000 transactions / second or less as low. Under this low system busy level, step S3 sets the traceability resource quota to a higher level (equivalent to allocating more CPU and memory resources for traceability operations) and sets the traceability mode to perform traceability analysis only on a large portion of the log data.

[0057] In some preferred embodiments, the real-time transaction volume information includes at least one set of transaction type information and its corresponding transaction volume information, and step S2 includes:

[0058] S21. Query the pre-built mapping table of transaction type and resource demand based on the transaction type information to obtain at least one resource demand information. Each transaction type information corresponds to one transaction resource demand information.

[0059] S22. Calculate the preliminary resource requirement based on the resource requirement information and transaction volume information corresponding to the transaction type information. The resource requirement is the product of the resource requirement information and the transaction volume information. Each transaction type information corresponds to a preliminary resource requirement.

[0060] S23. Calculate the total transaction resource demand based on all preliminary resource demands, and calculate the transaction resource utilization rate based on the total transaction resource demand and the total resource quota of the financial transaction system.

[0061] S24. Query the pre-built mapping table of resource utilization and busy level based on the transaction resource utilization rate to obtain the system busy level. The mapping table of resource utilization and busy level is a preset conversion relationship.

[0062] The transactions in this embodiment can be categorized into types such as transfers, investments, or consumption. The transaction type information in this embodiment refers to the type of transaction data. Since there are multiple transaction data entries in a financial transaction system, the number of transaction volume type information entries is at least one. The transaction volume information in this embodiment refers to the number of transaction data entries of the same type. The mapping relationship table between transaction type and resource requirement in this embodiment can be in the form of a database table. This mapping relationship table uses transaction type as an index and resource requirement as the data value. This embodiment can query the pre-built mapping relationship table between transaction type and resource requirement based on the transaction type information to obtain resource requirement information. The preliminary resource requirement in step S22 reflects the resource quota required for the corresponding transaction type. Step S23 calculates the total transaction resource demand by summing all preliminary resource demands. This total transaction resource demand reflects the sum of resource quotas required for all transaction types. The formula for calculating the transaction resource occupancy rate in this embodiment is: Transaction Resource Occupancy Rate = Total Transaction Resource Demand ÷ Total Resource Quota of the Financial Transaction System. It should be understood that the total resource quota of the financial transaction system is a known value, and the transaction resource occupancy rate reflects the extent to which transaction activities occupy the financial transaction system's resource quota. The mapping table between resource occupancy rate and busy level in this embodiment defines the correspondence between resource occupancy rate and busy level. For example, the mapping table can be: when the resource occupancy rate is less than or equal to 0.3, the busy level is low; when the resource occupancy rate is greater than 0.3 and less than or equal to 0.6, the busy level is medium; and when the resource occupancy rate is greater than 0.6, the busy level is high. Since different transaction types require different resource quotas, this embodiment first determines the resource demand information corresponding to different transaction types, then calculates the total resource demand and transaction resource occupancy rate based on the resource demand information and its corresponding transaction volume information, and finally determines the system busy level based on the transaction resource occupancy rate. Therefore, this embodiment is equivalent to considering the impact of different types of transactions on resource quota occupancy when determining the system busy level. Thus, this embodiment can effectively improve the accuracy of the assessment of the system busy level, thereby effectively improving the reliability of traceability resource quotas and traceability modes, and further avoiding resource competition between traceability operations and high-concurrency transactions.

[0063] In some preferred embodiments, the transaction resource demand information includes CPU resource transaction demand values, memory resource transaction demand values, and I / O resource transaction demand values. The total resource quota includes the total CPU resource quota, total memory resource quota, and total I / O resource quota. The traceability resource quota includes the CPU resource traceability quota, memory resource traceability quota, and I / O resource quota. This embodiment is equivalent to considering the different impacts of different types of resources on system performance, so as to more accurately reflect the true load status of the financial trading system, thereby further improving the reliability of traceability resource quotas and traceability modes.

[0064] In some preferred embodiments, the tracing request includes data breach event parameters, which include the degree of impact of the data breach. Step S3 includes:

[0065] S31. Query the pre-built mapping table of busy level, resource quota and traceability mode according to the system busy level to obtain the first preliminary traceability resource quota and determine the traceability mode of the traceability task.

[0066] S32. Based on the impact of the data breach, query the pre-built mapping table between the impact of the breach and the resource quota adjustment coefficient to obtain the source resource quota adjustment coefficient;

[0067] S33. Calculate the traceability resource quota for the traceability task based on the first preliminary traceability resource quota and the traceability resource quota adjustment coefficient.

[0068] The data breach impact level in this embodiment can be information obtained after a user assesses the data breach event upon learning of it. Alternatively, it can be information obtained by inputting the data breach event into a pre-trained breach impact assessment module. This data breach impact level reflects the severity of the data breach event. The mapping table between the breach impact level and the resource quota adjustment coefficient in this embodiment defines the correspondence between them. For example, this embodiment divides the data breach impact level into three levels: "low," "medium," and "high," each corresponding to a different resource quota adjustment coefficient. Since the data breach impact level reflects the severity of the data breach event, and the higher the severity of the data breach event, the higher the efficiency requirement for tracing the source of the data breach event, the breach impact level in this embodiment is preferably positively correlated with the resource quota adjustment coefficient. That is, this embodiment is equivalent to allocating more resource quota for tracing operations on data breach events with higher severity to improve tracing efficiency. Step S33 can calculate the tracing resource quota for the tracing task by multiplying the first preliminary tracing resource quota and the tracing resource quota adjustment coefficient. This embodiment dynamically adjusts the resource allocation for tracing operations by comprehensively considering the busyness of the financial transaction system and the impact of the data breach, thereby improving the efficiency of tracing high-impact data breaches. After the tracing operation is completed, those skilled in the art can perform relevant processing on the data breach. Therefore, this embodiment can reduce the impact of data breaches by improving the efficiency of tracing. Preferably, this embodiment adjusts the tracing mode based on the impact of the data breach. For example, the higher the impact of the data breach, the more log data is set to be analyzed for tracing. That is, this embodiment is equivalent to improving the tracing effect of high-impact data breaches, making the final generated chain of evidence more complete and reliable.

[0069] In some preferred embodiments, step S33 includes:

[0070] S331. Calculate the second preliminary traceability resource quota based on the first preliminary traceability resource quota and the traceability resource quota adjustment coefficient;

[0071] S332. Obtain the total demand for trading resources and the total quota of resources of the financial trading system, and calculate the remaining resources based on the total quota of resources, the total demand for trading resources, and the second preliminary traceability quota of resources;

[0072] S333. Analyze whether the remaining resource amount is greater than the preset resource amount threshold. If not, use the second preliminary traceability resource quota as the traceability resource quota for the traceability task. If not, reduce the second preliminary traceability resource quota until the remaining resource amount is greater than the preset resource amount threshold. Then use the second preliminary traceability resource quota at this time as the traceability resource quota for the traceability task.

[0073] Step S332 calculates the remaining resource quantity by subtracting the total transaction resource demand and the second preliminary traceability resource quota from the total resource quota. This remaining resource quantity reflects the available resource quota of the financial transaction system when simultaneously executing transaction activities and traceability operations. The preset resource quantity threshold in this embodiment can be a value set by those skilled in the art based on experience or actual needs. If the remaining resource quantity is less than or equal to the preset resource quantity threshold, it indicates that the available resource quota of the financial transaction system after performing traceability operations is too small. Therefore, it is necessary to reduce the second preliminary traceability resource quota until the remaining resource quantity is greater than the preset resource quantity threshold. Because the real-time trading volume of a financial trading system fluctuates, if the available resource quota is insufficient when the system is simultaneously executing trading activities and traceability operations, the available resource quota may not be able to meet the needs of the trading activities. This embodiment first calculates the remaining resource amount, and then determines the traceability resource quota for the traceability task based on the remaining resource amount and a preset resource threshold. Therefore, this embodiment can effectively avoid situations where a sudden increase in the real-time trading volume of the financial trading system leads to insufficient available resource quota after the traceability operation, resulting in insufficient resource quota to meet the resource quota requirements of the trading activities, and resource competition between the traceability operation and high-concurrency trading, thus maintaining the trading stability and response speed of the financial trading system. It should be understood that after reducing the second preliminary traceability resource quota in step S333, it is necessary to recalculate the remaining resource amount and compare the new remaining resource amount with the preset resource threshold.

[0074] In some preferred embodiments, step S333 includes:

[0075] A1. Query the pre-built mapping table between the system busy level and the resource threshold according to the system busy level to obtain the preset resource threshold;

[0076] A2. Analyze whether the remaining resource amount is greater than the preset resource amount threshold. If not, use the second preliminary traceability resource quota as the traceability resource quota for the traceability task. If not, reduce the second preliminary traceability resource quota until the remaining resource amount is greater than the preset resource amount threshold. Then use the second preliminary traceability resource quota at this time as the traceability resource quota for the traceability task.

[0077] This embodiment is equivalent to dynamically adjusting a preset resource threshold based on the busy level of the financial trading system. Therefore, this embodiment can effectively avoid situations where the resource utilization rate of the financial trading system decreases due to an excessively large preset resource threshold, or where resource competition occurs between traceability operations and high-concurrency transactions due to an excessively small preset resource threshold. This further improves the trading stability and ensures the response speed of the financial trading system. Specifically, the mapping table between the busy level and the resource threshold in this embodiment can be set as follows: when the busy level is "high", the resource threshold is 20%; when the busy level is "medium", the resource threshold is 10%; when the busy level is "low", the resource threshold is 5%. If the current system busy level is "medium", then the obtained preset resource threshold is 10%.

[0078] In some preferred embodiments, the data breach event parameters also include the sensitivity of the breached data, and step S31 includes:

[0079] S311. Analyze whether the sensitivity of the leaked data is greater than the preset sensitivity threshold. If yes, proceed to step S312; otherwise, proceed to step S313.

[0080] S312. Set the tracing mode of the tracing task to deep tracing mode, and query the pre-built mapping table of busy level, resource quota and tracing mode according to the system busy level to obtain the first preliminary tracing resource quota. The deep tracing mode is to perform a comprehensive analysis of all log data of the financial transaction system.

[0081] S313. Query the pre-built mapping table of busy level, resource quota and traceability mode according to the system busy level to obtain the first preliminary traceability resource quota and determine the traceability mode of the traceability task.

[0082] The data leakage sensitivity in this embodiment can be information obtained by assessing the sensitivity of the leaked data after a user becomes aware of the data breach. Alternatively, it can be information obtained by inputting the data breach event into a pre-trained data leakage sensitivity assessment module, reflecting the severity of the data breach. The preset sensitivity threshold in this embodiment is a pre-defined boundary value used to distinguish between high and low data sensitivity. The size of the preset sensitivity threshold can be adjusted according to actual application scenarios and security requirements, and can also be adjusted according to the specific security strategies and risk tolerance of financial institutions. Since this embodiment sets the tracing mode of the source tracing task to deep tracing mode when the data leakage sensitivity exceeds the preset sensitivity threshold, it performs a comprehensive analysis of all log data in the financial transaction system. This is equivalent to a comprehensive and in-depth source tracing analysis of high-sensitivity data breach events to avoid missing suspicious clues during the tracing analysis process. Therefore, this embodiment can improve the tracing depth of high-sensitivity data breach events while reasonably utilizing the resource quota of the financial transaction system, thereby effectively improving the tracing effect of high-sensitivity data breach events. It should be understood that since step S312 directly sets the tracing mode of the tracing task to deep tracing mode, when querying the pre-built mapping table of busy level, resource quota and tracing mode according to the system busy level, this embodiment only needs to query the resource quota and does not need to query the tracing mode.

[0083] In some preferred embodiments, the tracing modes include a rapid tracing mode and a deep tracing mode. The rapid tracing mode involves sampling and analyzing the log data of the financial transaction system, while the deep tracing mode involves a comprehensive analysis of all log data of the financial transaction system. This embodiment includes both rapid and deep tracing modes. Since the rapid tracing mode involves sampling and analyzing the log data of the financial transaction system, while the deep tracing mode involves a comprehensive analysis of all log data, the data analysis volume of the rapid tracing mode is less than that of the deep tracing mode. In other words, the tracing efficiency of the rapid tracing mode is greater than that of the deep tracing mode, but the tracing accuracy of the rapid tracing mode is less than that of the deep tracing mode. Therefore, the rapid tracing mode of this embodiment is suitable for scenarios with high requirements for tracing efficiency but relatively low requirements for the accuracy of the tracing results (e.g., peak trading periods or the initial investigation stage). The deep tracing mode of this embodiment is suitable for scenarios with high requirements for the accuracy of the tracing results (e.g., the in-depth investigation and evidence collection stage of a data breach).

[0084] In some preferred embodiments, the number of tracing requests is multiple, the number of tracing tasks generated in step S1 is multiple, and each tracing request corresponds to a tracing task and a data leakage sensitivity. The data leakage tracing method also includes steps performed between steps S3 and S4:

[0085] B1. Normalize the sensitivity of all leaked data to obtain the resource allocation for each source tracing task. The resource allocation is the value of the corresponding leaked data sensitivity after normalization.

[0086] B2. Calculate the traceability resource sub-quota corresponding to each traceability task based on the traceability resource quota and resource allocation ratio;

[0087] Step S4 includes:

[0088] S41. Based on the traceability resource sub-quota and traceability mode, perform traceability analysis on the log data of the financial transaction system to obtain the evidence chain corresponding to each traceability task.

[0089] The specific process for normalizing the sensitivity of all leaked data in this embodiment can be as follows: scale all leaked data sensitivity values ​​to the range of 0 to 1, and then use the normalized leaked data sensitivity as its corresponding resource allocation. For example, if there are 3 source tracing tasks, and the leaked data sensitivities of the 3 source tracing tasks are 20, 30, and 50, respectively, after normalizing all leaked data sensitivity, the resource allocation corresponding to the source tracing task with a leaked data sensitivity of 20 is 0.2, the resource allocation corresponding to the source tracing task with a leaked data sensitivity of 30 is 0.3, and the resource allocation corresponding to the source tracing task with a leaked data sensitivity of 50 is 0.5. That is, the resource allocation in this embodiment can reflect the importance of the corresponding source tracing task among all source tracing tasks. Because this embodiment first obtains the resource allocation ratio for each tracing task by normalizing the sensitivity of all leaked data, and then calculates the tracing resource sub-quota corresponding to each tracing task based on the tracing resource quota and resource allocation ratio, this embodiment is equivalent to allocating more resources to tracing tasks with high importance and less resources to tracing tasks with low importance, thereby effectively improving the rationality of resource quota allocation for multiple tracing tasks and ensuring the tracing efficiency of tracing tasks with high importance.

[0090] In some preferred embodiments, the preset conversion relationship is a mapping table or function relating transaction volume and activity level. In the preset mapping table, the activity level can be set as follows: when the transaction volume is less than or equal to 1000 transactions / second, the activity level is low; when the transaction volume is greater than 1000 transactions / second but less than or equal to 5000 transactions / second, the activity level is medium; and when the transaction volume is greater than or equal to 5000 transactions / second, the activity level is high. The function in this embodiment can be a pre-defined function, where the independent variable is transaction volume and the dependent variable is the activity level.

[0091] As can be seen from the above, the data leakage tracing method provided in this application first determines the system's busy level based on the real-time trading volume information of the financial trading system, then determines the tracing resource quota and tracing mode of the tracing task based on the system busy level, and finally performs tracing analysis on the log data of the financial trading system based on the tracing resource quota and tracing mode. Since the tracing resource quota and tracing mode of this application match the real-time trading volume information, this application can essentially provide a method for dynamically adjusting the resource quota and tracing mode of the tracing operation based on the real-time trading volume of the financial trading system. This avoids the situation where the tracing operation occupies too much resource quota under the current real-time trading volume information. That is, even during peak trading periods, this application will not have a situation where the tracing operation competes with high-concurrency trading for resources, thereby effectively solving the problem of resource competition between the tracing operation and high-concurrency trading caused by excessive resource quota occupied by the tracing operation, resulting in a decrease in the trading stability and response speed of the financial trading system.

[0092] Secondly, such as Figure 1 As shown, this application also provides a data breach tracing device, applied in a financial transaction system using a cloud-native architecture. The data breach tracing device includes:

[0093] Data processing module 1 is used to obtain real-time transaction volume information of the financial transaction system when a traceability request is received, and to generate a traceability task based on the traceability request.

[0094] Busyness Level Acquisition Module 2 is used to acquire the system busyness level based on real-time transaction volume information and a first preset conversion relationship;

[0095] The resource allocation and mode confirmation module 3 is used to query the pre-built information on the system busy level, resource quota, and tracing mode to determine the tracing resource quota and tracing mode of the tracing task. The tracing mode includes fast tracing mode and deep tracing mode.

[0096] The tracing module 4 is used to perform tracing analysis on the log data of the financial transaction system based on the tracing resource quota and tracing mode in order to obtain the evidence chain corresponding to the tracing task.

[0097] The data leakage tracing device provided in this application includes a data processing module 1, a busy level acquisition module 2, a resource allocation and pattern confirmation model 3, and a tracing module 4. The data leakage tracing device provided in this embodiment is used to perform the steps in the data leakage tracing method provided in the first aspect above. The principle of the data leakage tracing device provided in this embodiment is the same as the principle of the data leakage tracing method provided in the first aspect above, and will not be discussed in detail here.

[0098] As can be seen from the above, the data leakage tracing method and apparatus provided in this application first determines the system busy level based on the real-time trading volume information of the financial trading system, then determines the tracing resource quota and tracing mode of the tracing task based on the system busy level, and finally performs tracing analysis on the log data of the financial trading system based on the tracing resource quota and tracing mode. Since the tracing resource quota and tracing mode of this application match the real-time trading volume information, this application can be equivalent to providing a method for dynamically adjusting the resource quota and tracing mode of the tracing operation based on the real-time trading volume of the financial trading system, so as to avoid the situation where the tracing operation occupies too much resource quota under the current real-time trading volume information. That is, even during the peak trading period, this application will not have the situation of resource competition between the tracing operation and high-concurrency trading, thereby effectively solving the problem of resource competition between the tracing operation and high-concurrency trading caused by the excessive resource quota occupied by the tracing operation, resulting in a decrease in the trading stability and response speed of the financial trading system.

[0099] In the embodiments provided in this application, it should be understood that the disclosed apparatus and method can be implemented in other ways. The apparatus embodiments described above are merely illustrative. For example, the division of the above units is only a logical functional division, and there may be other division methods in actual implementation. Furthermore, multiple units or components may be combined or integrated into another robot, or some features may be ignored or not executed. Additionally, the coupling or direct coupling or communication connection shown or discussed may be through some communication interface; the indirect coupling or communication connection between devices or units may be electrical, mechanical, or other forms.

[0100] In addition, the functional modules in the various embodiments of this application can be integrated together to form an independent part, or each module can exist independently, or two or more modules can be integrated to form an independent part.

[0101] In this document, relational terms such as first and second are used only to distinguish one entity or operation from another entity or operation, without necessarily requiring or implying any such actual relationship or order between these entities or operations.

[0102] The above description is merely an embodiment of this application and is not intended to limit the scope of protection of this application. Various modifications and variations can be made to this application by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the scope of protection of this application.

Claims

1. A data breach tracing method applied in a financial transaction system using a cloud-native architecture, characterized in that, The data breach tracing method includes the following steps: S1. Upon receiving a source tracing request, obtain the real-time transaction volume information of the financial transaction system and generate a source tracing task based on the source tracing request. The source tracing request includes data leakage event parameters, which include the degree of impact of the data leakage and the keywords of the data leakage event or the time range of the data leakage event. S2. Obtain the system busy level based on the real-time transaction volume information and the preset conversion relationship; S3. Based on the system busy level, query the pre-built mapping table of busy level, resource quota and tracing mode to determine the tracing resource quota and tracing mode of the tracing task; S4. Based on the traceability resource quota and the traceability mode, perform traceability analysis on the log data of the financial transaction system to obtain the evidence chain corresponding to the traceability task; Step S3 includes: S31. Query the pre-built mapping table of busy level, resource quota and tracing mode according to the system busy level to obtain the first preliminary tracing resource quota and determine the tracing mode of the tracing task. S32. Based on the degree of impact of the data leak, query the pre-built mapping table between the degree of impact of the leak and the resource quota adjustment coefficient to obtain the source resource quota adjustment coefficient; S33. Calculate the traceability resource quota for the traceability task based on the first preliminary traceability resource quota and the traceability resource quota adjustment coefficient; the traceability resource quota includes CPU resource traceability quota, memory resource traceability quota and IO resource quota; Step S33 includes: S331. Calculate the second preliminary traceability resource quota based on the first preliminary traceability resource quota and the traceability resource quota adjustment coefficient; S332. Obtain the total demand for transaction resources and the total quota of resources of the financial transaction system, and calculate the remaining resources based on the total quota of resources, the total demand for transaction resources and the second preliminary traceability quota of resources; S333. Analyze whether the remaining resource amount is greater than the preset resource amount threshold. If so, use the second preliminary traceability resource quota as the traceability resource quota for the traceability task. If not, reduce the second preliminary traceability resource quota until the remaining resource amount is greater than the preset resource amount threshold. Then, use the second preliminary traceability resource quota at this time as the traceability resource quota for the traceability task. Step S333 includes: A1. Query the pre-built mapping table between the system busy level and the resource threshold according to the system busy level to obtain the preset resource threshold; the higher the busy level, the higher the resource threshold. A2. Analyze whether the remaining resource amount is greater than the preset resource amount threshold. If so, use the second preliminary traceability resource quota as the traceability resource quota for the traceability task. If not, reduce the second preliminary traceability resource quota until the remaining resource amount is greater than the preset resource amount threshold. Then, use the second preliminary traceability resource quota at this time as the traceability resource quota for the traceability task. The data breach event parameters also include the sensitivity of the breached data. Step S31 includes: S311. Analyze whether the sensitivity of the leaked data is greater than a preset sensitivity threshold. If yes, proceed to step S312; otherwise, proceed to step S313. S312. Set the tracing mode of the tracing task to deep tracing mode, and query the pre-built mapping table of busy level, resource quota and tracing mode according to the system busy level to obtain the first preliminary tracing resource quota. The deep tracing mode is to perform a comprehensive analysis of all log data of the financial transaction system. S313. Query the pre-built mapping table of busy level, resource quota, and tracing mode according to the system busy level to obtain the first preliminary tracing resource quota and determine the tracing mode of the tracing task; The tracing mode includes a fast tracing mode and a deep tracing mode. When the system's busy level is high, the tracing mode is the fast tracing mode, which analyzes a portion of the log data distributed across different microservice nodes. When the system's busy level is low, the tracing mode is the deep tracing mode, which performs a comprehensive analysis of all log data from the financial transaction system.

2. The data breach attribution method of claim 1, wherein, The real-time transaction volume information includes at least one set of transaction type information and its corresponding transaction volume information. Step S2 includes: S21. Query a pre-built mapping table of transaction type and resource demand based on the transaction type information to obtain at least one resource demand information, where each transaction type information corresponds to one resource demand information. S22. Calculate the preliminary resource requirement based on the resource requirement information and transaction volume information corresponding to the transaction type information. The resource requirement is the product of the resource requirement information and the transaction volume information. Each transaction type information corresponds to one preliminary resource requirement. S23. Calculate the total transaction resource demand based on all the preliminary resource demands, and calculate the transaction resource utilization rate based on the total transaction resource demand and the total resource quota of the financial transaction system. S24. Based on the transaction resource occupancy rate, query the pre-built mapping relationship table between resource occupancy rate and busy level to obtain the system busy level. The mapping relationship table between resource occupancy rate and busy level is a preset conversion relationship.

3. The data breach attribution method of claim 2, wherein, The resource demand information includes CPU resource transaction demand value, memory resource transaction demand value and IO resource transaction demand value, and the total resource quota includes total CPU resource quota, total memory resource quota and total IO resource quota.

4. The data leakage tracing method according to claim 1, characterized in that, The preset conversion relationship is a mapping table or function relationship between transaction volume and busy level.

5. A data breach tracing device, applied in a financial transaction system using a cloud-native architecture, characterized in that, The data breach tracing device is used to perform the steps in the data breach tracing method according to any one of claims 1-4, and the data breach tracing device comprises: The data processing module is used to obtain the real-time transaction volume information of the financial transaction system when a tracing request is received, and to generate a tracing task according to the tracing request. The system busy level acquisition module is used to acquire the system busy level based on the real-time transaction volume information and the first preset conversion relationship. The resource allocation and mode confirmation module is used to query the pre-built information on the busy level, resource quota, and tracing mode to determine the tracing resource quota and tracing mode of the tracing task. The tracing mode includes a fast tracing mode and a deep tracing mode. The tracing module is used to perform tracing analysis on the log data of the financial transaction system based on the tracing resource quota and the tracing mode, so as to obtain the evidence chain corresponding to the tracing task.

Images