Non-disk file management method, electronic device and storage medium

Abstract

The application provides an un-disked file management method, an electronic device and a storage medium, and belongs to the technical field of data security. The method comprises the following steps: when a preset trigger operation on an un-disked file is monitored, replacing a target path associated with the preset trigger operation with a temporary path; saving the un-disked file to the temporary path, and monitoring the content of the un-disked file saved to the temporary path to determine the sensitive level of the un-disked file; and according to the sensitive level, performing a corresponding management policy on the un-disked file, wherein the management policy comprises execution, encryption and interruption of the preset trigger operation. The application can achieve a good balance between anti-leakage and normal office operation.

Description

Technical Field

[0001] This application relates to the field of data security technology, and in particular to a method for managing unsaved files, an electronic device, and a storage medium. Background Technology

[0002] In today's digital office environment, file leaks to USB drives and external hard drives are frequent occurrences, posing a serious threat to enterprise information security. File leaks occur in various ways, primarily including three types: first, direct copying, i.e., transferring files to the target directory through copy-paste or drag-and-drop operations; second, opening the file and using the "Save As" function to save it to the target directory; and third, creating a new blank file, editing or pasting content, and then saving it to the target directory. Of these, only the first type of leak is easily detected due to its direct operation. As for the second and third types of file leaks, since text editing software reads or edits content entirely based on memory operations and leaves no files on disk, they are difficult for existing endpoint security software to accurately identify.

[0003] Given the technical limitations of the third and second types of file leakage mentioned above, existing security software often adopts a one-size-fits-all strategy: either ignoring and not monitoring, allowing the risk of file leakage to continue, or directly blocking all related operations, indiscriminately preventing files from being saved to USB drives. This seriously disrupts users' normal work processes. Users have to perform additional operations every time they save non-sensitive content to a USB drive, first saving it locally and then copying and transferring it, which greatly increases the complexity of office operations and reduces office efficiency.

[0004] Therefore, there is an urgent need for a document leakage control solution that can strike a balance between preventing data leaks and ensuring normal office operations to fill this gap and improve the enterprise's protection system in the field of terminal document leakage prevention. Summary of the Invention

[0005] The purpose of this application is to provide a method, electronic device, and storage medium for managing unsaved files in order to solve the above-mentioned problems.

[0006] To achieve the above objectives, firstly, this application proposes a method for managing unsaved files, the method comprising:

[0007] When a preset trigger operation for an unsaved file is detected, the target path associated with the preset trigger operation is replaced with a temporary path;

[0008] The unsaved files are saved to the temporary path, and the content of the unsaved files saved to the temporary path is monitored to determine the sensitivity level of the unsaved files.

[0009] Based on the sensitivity level, a corresponding control policy is executed on the unsaved file. The control policy includes the execution, encryption, and interruption of the preset trigger operation.

[0010] In some implementations, the step of replacing the target path associated with the preset trigger operation with a temporary path when a preset trigger operation for an unsaved file is detected includes:

[0011] When a preset trigger operation for an unsaved file is detected, the preset trigger operation is encapsulated into a target request packet and the target request packet is sent to the file system filter driver;

[0012] The file system filter driver calls the callback function corresponding to the target request packet to obtain the target path of the target request packet, and replaces the target path with a temporary path.

[0013] In some implementations, the step of replacing the target path associated with the preset trigger operation with a temporary path when a preset trigger operation for an unsaved file is detected includes:

[0014] Inject preset code into the target application at the application layer, and use the preset code to monitor whether the target application has a preset trigger operation for unsaved files;

[0015] When the preset trigger operation is detected, the target path associated with the preset trigger operation is replaced with a temporary path using API Hook technology.

[0016] In some implementations, before replacing the target path associated with the preset trigger operation with a temporary path, the method further includes:

[0017] Identify the file type and storage capacity of the unsaved file;

[0018] Based on the file type and the storage capacity, determine the temporary path corresponding to the unsaved file.

[0019] In some implementations, the step of executing a corresponding control policy on the unsaved file based on the sensitivity level includes:

[0020] Obtain the user information associated with the preset trigger operation;

[0021] Query the operation records associated with the user information;

[0022] Based on the user information's node position in the preset functional architecture diagram, the operation record, and the sensitivity level, the corresponding control strategy is executed on the unsaved file.

[0023] In some implementations, the step of applying corresponding control policies to the unsaved files based on the user information's node position in a preset functional architecture graph, the operation records, and the sensitivity level includes:

[0024] Based on the node position of the user information in the preset functional architecture diagram and the operation record, the risk level of the preset triggered operation is determined;

[0025] Based on the risk level and the sensitivity level, the corresponding control strategy is implemented for the unsaved files.

[0026] In some implementations, determining the risk level of the preset triggered operation based on the user information's node position in the preset functional architecture graph and the operation record includes:

[0027] Determine the node position of the user information in the preset functional architecture map, and obtain the target functional scope corresponding to the node position;

[0028] Determine the target operation record characteristics corresponding to the operation record;

[0029] A risk estimation map is drawn based on the target functional scope and the target operation record characteristics, and the risk level of the preset trigger operation is determined based on the risk estimation map and the preset risk assessment rules.

[0030] In some implementations, after saving the unsaved file to the temporary path, the method further includes:

[0031] When an attack is detected on the temporary path within a preset time period, the unsaved file is marked as high risk, and the preset trigger operation is interrupted.

[0032] Secondly, to achieve the above objectives, this application also proposes an electronic device, comprising: one or more processors; and a memory for storing one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors execute the unsaved file management method described above.

[0033] Thirdly, to achieve the above objectives, this application also proposes a computer storage medium storing executable instructions, which, when executed by a processor, cause the processor to perform the unsaved file management method described above.

[0034] Compared with the prior art, the beneficial effects of this application include:

[0035] Firstly, addressing the limitations mentioned in the background technology regarding the difficulty of existing terminal security software in accurately identifying and controlling the second and third types of file leakage, this application replaces the target path with a temporary path when a preset trigger operation (such as "Save As" or creating a new file and saving it to an external device) is detected for an unsaved file. The content of the file is then monitored in the temporary path, thereby effectively solving the problem of the difficulty in monitoring file leakage based on memory operations in the existing technology. This achieves comprehensive control over unsaved files and fills the monitoring blind spots of the existing technology.

[0036] Secondly, this application, after saving unsaved files to a temporary path, can monitor the file content and determine its sensitivity level, and then execute corresponding control policies based on the sensitivity level, such as allowing, blocking, or performing other specific operations. This precise decision-making method based on the actual sensitivity of the file avoids excessive blocking of non-sensitive files. Furthermore, since the operation of saving unsaved files to a temporary path for content monitoring is seamless for the user, it reduces interference with normal user operations while ensuring effective protection of sensitive files, achieving a good balance between preventing data leaks and ensuring normal office operations. Attached Figure Description

[0037] To more clearly illustrate the technical solutions of the embodiments of this application, the accompanying drawings used in the embodiments will be briefly described below. It should be understood that the following drawings only show some embodiments of this application and should not be regarded as a limitation on the scope of this application.

[0038] Figure 1 This is a flowchart illustrating a method for managing unsaved files in one embodiment;

[0039] Figure 2 This is a detailed schematic diagram illustrating the process of replacing the target path associated with the preset trigger operation with a temporary path when a preset trigger operation for an unsaved file is detected in one embodiment.

[0040] Figure 3 This is a detailed schematic diagram illustrating the process of replacing the target path associated with the preset trigger operation with a temporary path when a preset trigger operation for an unsaved file is detected in another embodiment.

[0041] Figure 4 This is a flowchart illustrating how a temporary path is determined in one embodiment;

[0042] Figure 5 This is a flowchart illustrating the process of implementing corresponding control strategies for the unsaved files based on the sensitivity level in one embodiment.

[0043] Figure 6This is a schematic diagram of the electronic device involved in the unsaved file management method in the embodiments of this application. Detailed Implementation

[0044] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0045] All terms used in this application (including technical and scientific terms) have the meanings commonly understood by those skilled in the art, unless otherwise defined. It should be noted that the terms used herein should be interpreted in a manner consistent with the context of this specification, and not in an idealized or overly rigid way.

[0046] For example, the terms "first," "second," etc., used in this application may be used herein to describe various elements, but these elements are not limited by these terms. These terms are only used to distinguish the first element from another element.

[0047] For example, the terms "comprising" or "including" used in this application indicate the presence of features, steps, operations and / or components, but do not exclude the presence or addition of one or more other features, steps, operations or components.

[0048] As mentioned above, file leaks occur in various ways, mainly including three types: first, direct copying, i.e., transferring files to the target directory through copy-paste or drag-and-drop operations; second, opening the file and using the "Save As" function to save it to the target directory; and third, creating a new blank file, editing or pasting content, and then saving it to the target directory. Of these, only the first type of leak is easily detected due to its direct operation. For the second and third types of file leaks, since text editing software reads or edits content entirely based on memory operations, there are no files left on disk, making them difficult for existing endpoint security software to accurately identify. Due to the technical limitations of the second and third types of file leaks, existing security software often adopts a one-size-fits-all strategy: either ignoring them and allowing the risk of file leaks to continue, or directly blocking all related operations, indiscriminately preventing files from being saved to USB drives. This severely disrupts users' normal work processes, requiring users to perform additional operations every time they save non-sensitive content to a USB drive—first saving it locally and then copying it—significantly increasing the complexity of office operations and reducing efficiency. Therefore, there is an urgent need for a document leakage control solution that can strike a balance between preventing data leaks and ensuring normal office operations to fill this gap and improve enterprises' protection systems in the area of ​​preventing terminal document leakage. To this end, this application proposes a method for managing unsaved documents, an electronic device, and a storage medium that can achieve a good balance between preventing data leaks and ensuring normal office operations.

[0049] like Figure 1 As shown in the figure, this application provides a method for managing unsaved files, the method including the following steps:

[0050] Step S10: When a preset trigger operation for an unsaved file is detected, the target path associated with the preset trigger operation is replaced with a temporary path.

[0051] In this embodiment, an unsaved file refers to a file created or modified in memory but not yet saved to a local hard drive or external storage device. The content of such files exists only in memory and has not yet formed a persistent storage record. The preset trigger operation refers to the "Save As" operation or the operation of saving a newly created file to an external device (such as a USB flash drive, external hard drive, etc.). The target path refers to the original save path specified by the user when performing the preset trigger operation, for example, the user choosing to save the file to a specific folder path on the USB flash drive. The temporary path refers to a temporary storage location automatically generated or pre-set by the system, used to temporarily store the unsaved file before saving it to the target path, so as to monitor and analyze the content of the unsaved file.

[0052] As a feasible implementation method, when a preset trigger operation is detected for an unsaved file, the target path associated with the preset trigger operation is replaced with a temporary path. This involves deploying a file system filter driver at the operating system kernel layer. A file system filter driver is a special type of driver that can be inserted into the operating system's file system hierarchy to monitor and intercept file system operations. Figure 2 As shown, step S10 includes:

[0053] Step S11: When a preset trigger operation for an unsaved file is detected, the preset trigger operation is encapsulated into a target request packet and the target request packet is sent to the file system filter driver.

[0054] In this embodiment, when a pre-triggered operation by an application on an unsaved file is detected, the operating system encapsulates the pre-triggered operation into a target request packet and sends the target request packet to the file system filter driver. The target request packet contains a data structure or object with all necessary information about the pre-triggered operation (such as the target path of the operation, the basic attributes of the file, and information about the application initiating the operation). It is an IRP (I / O Request Packet), a data structure used in the Windows operating system for handling I / O operations.

[0055] For example, when an application calls the API to create a file, the operating system generates an IRP of type IRP_MJ_CREATE. IRP_MJ_CREATE is a type of IRP that represents a request to create a file.

[0056] Step S12: Using the file system filter driver, call the callback function corresponding to the target request packet to obtain the target path of the target request packet, and replace the target path with a temporary path.

[0057] In this embodiment, a callback function is a function called through a function pointer. That is, it enables an event-driven calling mechanism between different modules or components through predefined function interfaces. In the file system filter driver, developers can register callback functions for different types of IRPs. When the corresponding IRP arrives, the file system filter driver calls the corresponding callback function to process the IRP.

[0058] For example, in the callback function of IRP_MJ_CREATE IRP, the file system filter driver can obtain the path information of the file requested by the application to be created, which is the target path referred to in this embodiment.

[0059] As an example of replacing the target path with a temporary path, when the application initiates an operation request to "save as" an unsaved file to the USB drive path "E:\target_folder", the file system filter driver intercepts this operation request, extracts the target path "E:\target_folder" from the operation request by calling the corresponding callback function, and replaces "E:\target_folder" with a temporary path such as "C:\Temp\RandomFolderName" according to preset rules.

[0060] As another feasible implementation method, when a preset trigger operation for an unsaved file is detected, the target path associated with the preset trigger operation is replaced with a temporary path, such as... Figure 3 As shown, step S10 includes:

[0061] Step S13: Inject preset code into the target application at the application layer, and use the preset code to monitor whether the target application has a preset trigger operation for unsaved files.

[0062] In this embodiment, the operation of injecting preset code into the target application at the application layer is a technique that integrates external preset code into the target application's running process. This can be achieved using dynamic link library (DLL) injection, memory writing methods (such as using the WriteProcessMemory function in the Windows API), etc.

[0063] After being injected into the target application, the pre-defined code can periodically or in real-time scan the application's internal state, such as checking if a file save dialog box is open or if specific file operation APIs are called. For example, the pre-defined code can hook into the target application's message loop or event handler to detect whether the user clicked the save button or selected the save menu item, thereby determining whether a pre-defined trigger operation has occurred.

[0064] Step S13 injects preset code at the application layer, which can delve into the internal running environment of the application and perform fine and accurate monitoring of preset trigger operations, thereby reducing false alarms and false negatives, and providing accurate trigger signals for subsequent path replacement and file content monitoring.

[0065] Step S14: When the preset trigger operation is detected, the target path associated with the preset trigger operation is replaced with a temporary path using API Hook technology.

[0066] In this embodiment, an API (Application Programming Interface) is a series of functions provided to developers by the operating system or other software. API hooking is used to intercept and modify application calls to certain API functions. By hooking specific API functions, custom code logic can be inserted before or after the function call, so that when the target application calls these APIs, the actually executed code logic is the hooked code logic. In Windows systems, API hooking methods that can be used include using the Microsoft Detours library, setting global hooks (such as WH-API hooks), etc.

[0067] For example, API functions that may include parameter information about the target path include CreateFile and GetFileAttributes, both of which are system API functions provided by the Windows operating system. Specifically, the CreateFile function is used to create or open files, directories, devices, etc., while the GetFileAttributes function is used to retrieve attribute information of a specified file or directory.

[0068] API hooking technology allows you to intercept the target path passed to a system API interface such as CreateFile or GetFileAttributes when the target application calls the API with parameter information of the target path, and replace it with a pre-defined temporary path.

[0069] Step S20: Save the unsaved file to the temporary path, and perform content monitoring on the unsaved file saved to the temporary path to determine the sensitivity level of the unsaved file.

[0070] In this embodiment, since the unsaved files have been saved to a temporary path, their content can be detected. In some implementations, the unsaved files saved to the temporary path can be type-identified to determine their file type. The file type includes text, audio / video, and mixed types, where the mixed type refers to files containing both text and audio / video content. The corresponding sensitivity monitoring strategy is then invoked to monitor the content of the unsaved files saved to the temporary path. This sensitivity monitoring strategy includes a first monitoring strategy corresponding to the text type, a second monitoring strategy corresponding to the audio / video type, and a third monitoring strategy corresponding to the mixed type.

[0071] As a feasible implementation method for content monitoring of unsaved files stored in the temporary path and determining their sensitivity level, when the unsaved file type is text, a preset keyword dictionary is invoked. This keyword dictionary contains preset keywords for various sensitive information, such as company secrets, financial data, and customer information. The content of the unsaved file in the temporary path is matched against the keyword dictionary, and the number and category of matched keywords are counted. Based on the statistical results of the number and category of matched keywords, the sensitivity level of the unsaved file is determined according to preset judgment rules. These preset judgment rules are pre-defined rules that guide the system in determining the sensitivity level of a file based on the category and number of keywords.

[0072] For example, if an unsaved file contains 3 or more highly sensitive keywords, or 10 or more moderately sensitive keywords, it is classified as highly sensitive. If an unsaved file contains 1-2 highly sensitive keywords (such as "company core secrets" or "merger and acquisition plan"), or 3-5 moderately sensitive keywords (such as "financial statements" or "customer list"), it is classified as moderately sensitive. If an unsaved file contains only a few low-sensitivity keywords (such as "meeting minutes" or "work plan"), it is classified as low-sensitivity.

[0073] This implementation method, through keyword matching and statistics, can accurately assess the sensitivity of a file and complete the sensitivity level assessment in a short time without significantly impacting system performance, thus ensuring the real-time nature and efficiency of file management.

[0074] As another feasible implementation for content monitoring of unsaved files stored in the temporary path and determining their sensitivity level, when the unsaved file type is audio / video, the file is segmented into an audio track and video content. The audio track is used to extract audio information, and the video content is used to extract image information for each frame. Speech recognition is performed on the audio track to obtain converted text, and the sensitivity level of the corresponding audio portion is determined by matching the converted text with a keyword dictionary. Simultaneously, computer vision techniques, such as convolutional neural networks (CNN), object detection algorithms (such as YOLO, Faster R-CNN, etc.), or image classification algorithms (such as ResNet, VGG, etc.), are used to identify whether sensitive content exists in the image information contained in the video content. Sensitive content can be specific identifiers, watermarks, documents, scenes, etc., such as watermarks on confidential company documents. The sensitivity level of the video portion is determined based on the identification results. For example, if a watermark of confidential internal documents is detected in the video image, the sensitivity level of the video portion is high. Based on the sensitivity levels of the audio and video components, the highest sensitivity level among the audio and video components is taken as the sensitivity level of the unsaved file.

[0075] As another feasible implementation for content monitoring of unsaved files stored in the temporary path and determining their sensitivity level, when the file type of the unsaved file is mixed, content monitoring is performed on the unsaved file stored in the temporary path based on a third monitoring strategy to determine its sensitivity level. The third monitoring strategy is a combination of the first and second monitoring strategies for text and audio / video types, as described above, to analyze different contents within the unsaved file separately.

[0076] For example, suppose the unsaved file is an ebook containing text, audio explanations, and video demonstrations. The text portion of the ebook relates to internal corporate training materials, the audio explanations mention sensitive business strategies, and each frame of the video demonstration contains a watermark that reads "Internal Confidential Information, Do Not Distribute." The system would then separate the unsaved file into text content, audio tracks, and video content. For the text content, it would match the text against a keyword dictionary, finding multiple keywords related to internal corporate training, such as "core business processes" and "employee confidentiality obligations." Based on the matching and analysis results, the text portion would be classified as high sensitivity. For the audio tracks, it would perform speech recognition to convert the audio content into converted text. Keyword matching would identify sensitive business strategy keywords in the converted text, such as "market share expansion plan" and "competitor analysis." Based on the matching results, the audio portion would be classified as medium sensitivity. For the video content, computer vision technology would analyze each frame of the video content, identifying the "Internal Confidential Information, Do Not Distribute" watermark on each frame. Based on the identification results, the video portion would be classified as high sensitivity. Based on the sensitivity levels of the text (high), audio (medium), and video (high), the sensitivity level of the unsaved file is determined to be high.

[0077] Furthermore, in some embodiments, after saving the unsaved file to the temporary path, the method further includes: when it is detected that the temporary path is attacked within a preset time period, marking the unsaved file as high risk and interrupting the preset triggering operation.

[0078] The preset time period refers to a pre-defined time interval set by the system to detect whether the temporary path is subjected to attack operations within that period. An attack operation refers to malicious operations targeting the temporary path or files within it, such as unauthorized access, tampering, deletion, or ransomware attacks. The purpose of this implementation is to promptly detect attack operations targeting the temporary path and take corresponding measures to protect the security of unsaved files. By monitoring access to the temporary path within the preset time period, potential attack behaviors can be quickly identified, preventing unsaved files from being stolen, tampered with, or destroyed during the temporary storage phase.

[0079] For example, after saving an unsaved file to a temporary path "C:\Temp\ReportTemp", the system begins attack detection on that temporary path within a preset time period (e.g., 1 minute). During the detection process, the system uses behavior-based detection technology to discover that an unknown IP address made a large number of failed access attempts to the temporary path within a short period of time, and the access pattern matches a certain known attack behavior characteristic. Therefore, the system determines that the temporary path has been attacked. Internally, it sets a high-risk flag for the unsaved file, indicating that the file may face a high security threat. This flag can be stored in the file's metadata or in the system's security database, associated with the file. Furthermore, it stops executing the user's initial preset triggered operation (such as saving the file to an external device) to prevent the file from being leaked or subjected to further attacks.

[0080] Step S30: Based on the sensitivity level, execute the corresponding control policy on the unsaved file.

[0081] In this embodiment, the sensitivity level is the level determined in step S20 based on the sensitivity of the content of the unsaved file, and can include different levels such as low sensitivity, medium sensitivity, and high sensitivity. The control strategy refers to a series of pre-defined operational rules based on the sensitivity level of the unsaved file, used to determine how to handle the unsaved file. The control strategy includes the execution, encryption termination, and interruption of the preset trigger operations.

[0082] In some implementations, when an unsaved file is determined to be of low sensitivity, it is saved according to a preset trigger operation, that is, the file is copied from a temporary path or moved to a user-specified target path (such as a USB drive path), and an additional watermark can be added. For example, if an employee, Xiao Li, compiles a list of daily office supplies for purchase, and the content monitoring determines that it is a low-sensitivity file, the system will save it directly to a USB drive, thus meeting the user's normal file saving needs.

[0083] When an unsaved file is classified as medium sensitive, the system saves it to a local encrypted container, requiring administrator approval before it can be exported. This local encrypted container is a virtual storage area created on a local storage device (such as a hard drive), where all data stored is automatically encrypted.

[0084] When an unsaved file is deemed highly sensitive, the system will interrupt pre-set trigger operations to prevent file leakage and prohibit the file from being saved to external devices. For example, if employee Xiao Wang attempts to save a file containing core corporate financial data to an external hard drive, and the file is deemed highly sensitive, the system will immediately interrupt the save operation and send an alert to the security administrator. Simultaneously, the system will display a message on the user interface indicating that the save operation has been rejected and that the file contains highly sensitive information that cannot be stored externally.

[0085] In the method for managing unsaved files proposed in this application, firstly, addressing the limitation mentioned in the background art that existing terminal security software has difficulty in accurately identifying and managing the second and third types of file leakage, this application replaces the target path with a temporary path when a preset trigger operation (such as "Save As" or creating a new file and saving it to an external device) is detected for an unsaved file, and performs content monitoring on the file under the temporary path. This effectively solves the problem of the difficulty in monitoring file leakage based on memory operations in the prior art, achieves comprehensive management of unsaved files, and fills the monitoring blind spots of the prior art.

[0086] Secondly, this application, after saving unsaved files to a temporary path, can monitor the file content and determine its sensitivity level, and then execute corresponding control policies based on the sensitivity level, such as allowing, blocking, or performing other specific operations. This precise decision-making method based on the actual sensitivity of the file avoids excessive blocking of non-sensitive files. Furthermore, since the operation of saving unsaved files to a temporary path for content monitoring is seamless for the user, it reduces interference with normal user operations while ensuring effective protection of sensitive files, achieving a good balance between preventing data leaks and ensuring normal office operations.

[0087] In one embodiment, such as Figure 4 As shown, before replacing the target path associated with the preset trigger operation with a temporary path, the process includes:

[0088] Step S01: Identify the file type and storage capacity of the unsaved file.

[0089] In this embodiment, file type refers to the category of files, which can be categorized based on their content and format. Specifically, it can include text types (such as documents, tables, presentations, etc.), audio / video types (such as music, movies, recordings, videos, etc.), and mixed types (containing both text and audio / video content, such as some ebooks, multimedia presentations, etc.). Storage capacity refers to the amount of storage space required on the storage device for unsaved files, reflecting the size of the unsaved file's data.

[0090] As a feasible method for determining file types, the file type can be determined based on the file extension of the unsaved file. For example, a file with the extension ".docx" can be identified as a Word document (text type), a ".mp3" file can be identified as an audio file (audio-video type), and a ".mp4" file can be identified as a video file (audio-video type). By reading the file extension of the unsaved file, the system can quickly classify the file type.

[0091] As another feasible approach to determining file types, file signature identification can be used. A file signature is a specific sequence of bytes in the file header that identifies the file's format and type. Different file types have different signatures. For example, a PNG image file has the signature "89 50 4E 47 0D 0A 1A 0A", and a JPEG image file has the signature "FF D8 FF", etc. By reading and analyzing the file signatures of unsaved files, file types can be identified more accurately, even if the file extension has been modified or is missing.

[0092] In some implementations, a kernel-level file filtering driver can be used to identify the file extension and / or file signature of the unsaved file, and determine the file type corresponding to the unsaved file based on the file extension and / or file signature.

[0093] Step S02: Determine the temporary path corresponding to the unsaved file based on the file type and the storage capacity.

[0094] In this embodiment, for unsaved text files, if the storage capacity is less than a first preset threshold (e.g., less than 10MB), they can be temporarily stored in a dedicated cache area in local memory because memory read / write speed is fast and can meet the needs of rapid editing and saving. If the storage capacity is greater than or equal to the first preset threshold (e.g., greater than or equal to 10MB), they can be temporarily stored in a fast-access partition on the local hard drive to ensure the stability and speed of file storage.

[0095] For audio and video files, when the storage capacity is within the first preset range (e.g., 100MB~1GB), they can be temporarily stored in the multimedia temporary storage partition of the local hard drive. When the storage capacity is within the second preset range (e.g., more than 1GB), they can be temporarily stored in a dedicated high-speed storage device (e.g., an SSD solid-state drive partition).

[0096] For mixed-type files, the temporary path can be determined based on the proportion of text and audio / video content, as well as the overall storage capacity. For example, if the audio / video content accounts for a larger proportion than the text content in a mixed-type file, the temporary path will be determined according to the first or second preset range corresponding to the audio / video type.

[0097] In some implementations, during the temporary storage of unsaved files, if the system detects insufficient resources (such as insufficient space or slow read / write speed) at the current temporary path's storage location, it can dynamically adjust the temporary path and move the unsaved files to a more suitable storage location. For example, when the local hard drive's multimedia temporary storage partition has insufficient remaining space, the system can automatically adjust the temporary path of the unsaved files to another partition with sufficient space.

[0098] In the method for managing unsaved files proposed in this application, reasonable temporary path allocation can avoid file storage chaos, improve file access efficiency and security, and provide clear file location information for subsequent file operations and management.

[0099] In one embodiment, such as Figure 5 As shown, the step of implementing corresponding control policies for the unsaved files based on the sensitivity level includes:

[0100] Step S31: Obtain the user information associated with the preset trigger operation.

[0101] In this embodiment, the user information associated with the preset trigger operation refers to the identity and attribute information of the user who initiates the preset trigger operation, in order to identify and describe the user who performs the preset trigger operation.

[0102] As a feasible implementation method for obtaining user information associated with the preset trigger operation, information such as the username, user group, and user ID entered by the current user when logging into the operating system can be obtained by calling API functions (such as the GetUserName function in Windows system, the getlogin function in Linux system, etc.).

[0103] Step S32: Query the operation records associated with the user information.

[0104] In this embodiment, the operation record associated with user information refers to the operation record of preset triggered operations performed by the user information in the past, which can be retrieved through the event viewer or log system.

[0105] Step S33: Based on the node position of the user information in the preset functional architecture diagram, the operation record, and the sensitivity level, execute the corresponding control strategy on the unsaved file.

[0106] In this embodiment, a preset functional architecture diagram is used to reflect the organizational structure of an enterprise, such as departmental divisions, job responsibilities, and hierarchical relationships. Node positions indicate the user's specific location within the organizational structure, such as a specific position within a department.

[0107] In some implementations, the risk level of the preset triggered operation can be determined based on the user information's node position in a preset functional architecture diagram and the operation record. The risk level reflects the likelihood that the preset triggered operation may cause information security problems and can be categorized as low-risk, medium-risk, or high-risk. Based on the risk level and the sensitivity level, corresponding control policies are implemented on the unsaved file.

[0108] As a feasible implementation method for determining the risk level of the preset trigger operation, the node position of the user information in the preset functional architecture map is determined, and the target functional scope corresponding to the node position is obtained; the target operation record characteristics corresponding to the operation record are determined; a risk estimation map is drawn based on the target functional scope and the target operation record characteristics, and the risk level of the preset trigger operation is determined based on the risk estimation map and the preset risk assessment rules.

[0109] The target functional scope refers to the scope of responsibilities and permissions corresponding to the user's current node position. Target operation record characteristics refer to features extracted from the user's historical operation records that reflect the user's operational behavior patterns. These characteristics may include operation type (such as file saving, file transfer, etc.), operation frequency, operation time distribution, and operation object type (such as file type). For example, target operation record characteristics may include the number of times the user saved files to external devices in the past month, the average number of times files were saved per week, and the distribution of file types saved.

[0110] A risk estimation chart is a visual representation of the risk associated with user actions. Based on a user's target job scope and target operational record characteristics, it calculates an estimated risk value for the user's actions using specific algorithms and models, and presents it graphically. One chart format is a two-dimensional coordinate axis chart, where the horizontal axis represents operational record characteristics (such as operation frequency), and the vertical axis represents the risk weight of the job scope. Each user's operational risk can be represented by a point or a bar on the chart. Another chart format is a heatmap, which visually displays the risk level of different users under different combinations of job scopes and operational characteristics. The intensity of the color indicates the level of risk.

[0111] For example, the system generates a risk estimation chart based on user "zhangsan's" target job functions (marketing promotion planning, sales data statistics and analysis) and target operation record characteristics (main operation types include saving marketing department office documents to a USB drive, and an average of 10 file saves per week). In the coordinate chart, the horizontal axis represents the operation frequency (times / week), and the vertical axis represents the job function risk weight (saving marketing department office documents falls within the job function of a regular marketing department employee, with a risk weight of 0.1). User "zhangsan's" operation risk is represented by a blue dot on the chart, located at coordinates (10, 0.1).

[0112] Risk assessment rules guide the determination of risk levels based on risk estimation maps. These rules can include the distribution areas of various preset risk levels within the risk estimation map. For example, in a coordinate axis chart, areas with a horizontal axis operation frequency greater than 20 and a vertical axis functional scope risk weight greater than 0.5 can be classified as high-risk areas; areas with a horizontal axis operation frequency between 10 and 20 and a vertical axis functional scope risk weight between 0.3 and 0.5 can be classified as medium-risk areas; and other areas can be classified as low-risk areas. The user's risk level is determined based on their position on the risk estimation map.

[0113] As a feasible implementation method for determining control strategies, the system has a pre-set strategy library, which records control strategies under different combinations of risk and sensitivity levels. The system can search for and execute matching control strategies in the strategy library based on the assessed risk and sensitivity levels.

[0114] For example, in a low-risk and low-sensitivity situation, this preset trigger operation is performed, which allows the file to be saved normally to the target path, and an additional watermark can be added.

[0115] In low-risk but moderately sensitive, or moderate-risk and low-sensitivity situations, implement an encrypted storage control policy, which means saving unsaved files to a local encrypted container, requiring administrator approval before they can be exported.

[0116] In scenarios of low risk and high sensitivity, medium risk and medium sensitivity, medium risk and high sensitivity, high risk and low sensitivity, high risk and medium sensitivity, or high risk and high sensitivity, the preset trigger operation will be blocked, meaning the file will be prevented from being saved to an external device. Simultaneously, an alert will be sent to the security administrator, and the operation log will be recorded.

[0117] In the method for managing unsaved files proposed in this application, firstly, by combining the user's node position in the functional architecture diagram and historical operation records, the risk level of the current preset triggered operation can be assessed more comprehensively. This avoids the inaccuracy and one-sidedness that may result from risk judgment based solely on a single factor (such as sensitivity level or the user's functional scope).

[0118] Secondly, enterprises have complex and diverse internal organizational structures and business processes, with significant differences in responsibilities and authority among different departments and positions. A comprehensive risk assessment method based on node location and operation records can better adapt to this complexity, accurately identifying potentially high-risk operational scenarios, such as R&D staff attempting to save files containing core technical information to external devices, or finance staff exporting financial data in batches outside of working hours.

[0119] Thirdly, by drawing risk estimation maps, the abstract risk assessment results can be presented in an intuitive graphical way, which can quickly locate high-risk areas and high-risk users, thereby achieving real-time and visual monitoring of information security risks.

[0120] In one embodiment, a computer storage medium is provided that stores executable instructions that, when executed by a processor, cause the processor to perform the steps in the above method embodiments.

[0121] In one embodiment, an electronic device is also provided, including one or more processors; and a memory storing one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors perform the steps in the above-described method embodiments. For example, the electronic device can be any device such as the aforementioned thermal management device or computing service device.

[0122] In one embodiment, such as Figure 6 The diagram illustrates the structure of an electronic device used to implement an embodiment of this application. The electronic device 100 includes a central processing unit (CPU) 101, which can perform various appropriate actions and processes based on a program stored in a read-only memory (ROM) 102 or a program loaded from a storage portion 108 into a random access memory (RAM) 103. The RAM 103 also stores various programs and data required for the operation of the electronic device 100. The CPU 101, ROM 102, and RAM 103 are interconnected via a bus 104. An input / output (I / O) interface 105 is also connected to the bus 104.

[0123] The following components are connected to I / O interface 105: an input section 106 including a keyboard, mouse, etc.; an output section 107 including a cathode ray tube (CRT), liquid crystal display (LCD), etc., and speakers, etc.; a storage section 108 including a hard disk, etc.; and a communication section 109 including a network interface card such as a LAN card, modem, etc. The communication section 109 performs communication processing via a network such as the Internet. A drive 110 is also connected to I / O interface 105 as needed. A removable medium 111, such as a disk, optical disk, magneto-optical disk, semiconductor memory, etc., is installed on drive 110 as needed so that computer programs read from it can be installed into storage section 108 as needed.

[0124] Specifically, according to embodiments of this application, the processes described above with reference to the flowcharts can be implemented as computer software programs. For example, embodiments of this application include a computer program product comprising a computer-readable medium carrying instructions that, in such embodiments, can be downloaded and installed from a network via communication section 109, and / or installed from removable medium 111. When the instructions are executed by central processing unit (CPU) 101, the various method steps described in this application are performed.

[0125] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of this application, and are not intended to limit them. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some or all of the technical features therein. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of this application.

[0126] Furthermore, those skilled in the art will understand that although some embodiments herein include certain features included in other embodiments but not others, combinations of features from different embodiments are intended to be within the scope of this application and form different embodiments. For example, any of the embodiments or implementations claimed above can be used in any combination. The information disclosed in this background section is intended only to enhance the understanding of the general background of this application and should not be construed as an admission or in any way implying that such information constitutes prior art known to those skilled in the art.

Claims

1. A method for managing unsaved files, characterized in that, The method includes: When a preset trigger operation for an unsaved file is detected, the target path associated with the preset trigger operation is replaced with a temporary path, where the preset trigger operation refers to Save As. The unsaved files are saved to the temporary path, and the type of the unsaved files saved to the temporary path is identified to determine the file type of the unsaved files. The sensitivity monitoring strategy corresponding to the file type is called to perform content monitoring on the unsaved files saved to the temporary path to determine the sensitivity level of the unsaved files. The system retrieves user information associated with the preset trigger operation, queries operation records associated with the user information, determines the node position of the user information in a preset functional architecture graph, obtains the target functional scope corresponding to the node position, determines the target operation record characteristics corresponding to the operation record, draws a risk estimation graph based on the target functional scope and the target operation record characteristics, and determines the risk level of the preset trigger operation based on the risk estimation graph and preset risk assessment rules. Based on the risk level and the sensitivity level, the system executes corresponding control strategies on the unsaved file, including execution, encryption, and interruption of the preset trigger operation.

2. The method for managing unsaved files according to claim 1, characterized in that, When a preset trigger operation for an unsaved file is detected, replacing the target path associated with the preset trigger operation with a temporary path includes: When a preset trigger operation for an unsaved file is detected, the preset trigger operation is encapsulated into a target request packet and the target request packet is sent to the file system filter driver; The file system filter driver calls the callback function corresponding to the target request packet to obtain the target path of the target request packet, and replaces the target path with a temporary path.

3. The method for managing unsaved files according to claim 1, characterized in that, When a preset trigger operation for an unsaved file is detected, replacing the target path associated with the preset trigger operation with a temporary path includes: Inject preset code into the target application at the application layer, and use the preset code to monitor whether the target application has a preset trigger operation for unsaved files; When the preset trigger operation is detected, the target path associated with the preset trigger operation is replaced with a temporary path using API Hook technology.

4. The method for managing unsaved files according to claim 1, characterized in that, Before replacing the target path associated with the preset trigger operation with a temporary path, the method further includes: Identify the file type and storage capacity of the unsaved file; Based on the file type and the storage capacity, determine the temporary path corresponding to the unsaved file.

5. The method for managing unsaved files according to claim 1, characterized in that, After saving the unsaved file to the temporary path, the method further includes: When an attack is detected on the temporary path within a preset time period, the unsaved file is marked as high risk, and the preset trigger operation is interrupted.

6. An electronic device, characterized in that, include: One or more processors; Memory, used to store one or more programs. When the one or more programs are executed by the one or more processors, the one or more processors perform the unsaved file management method as described in any one of claims 1 to 5.

7. A computer storage medium, characterized in that, The storage medium stores executable instructions, which, when executed by a processor, cause the processor to perform the unsaved file management method as described in any one of claims 1 to 5.

Images