A data governance processing method and system

Abstract

The application is suitable for the technical field of data management, and particularly relates to a data management processing method and system, which comprises the following steps: receiving an access request uploaded by a user into an internal network, identifying a risk level, accessing a buffer zone in the internal network, configuring a plurality of virtual containers in the buffer zone, and obtaining at least a first container, a second container and a root container; when the risk level of the access request is greater than a threshold, the access request is imported into the first container, a target address corresponding to the access request is parsed and located, and random disturbance processing is performed to obtain a plurality of pseudo addresses. Through identification of risk characteristics, the application can perform early defense, timely discover and block potential attack behaviors, reduce the probability of security incidents, greatly improve the processing efficiency and security of data management, and ensure the safe and reliable exchange of internal and external network data and smooth connection.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of data governance, in particular to a data governance processing method and system. BACKGROUND

[0002] Data governance refers to the management rules established within an enterprise or organization to ensure data quality, which includes the standardized management of data collection, storage, processing, sharing and use.

[0003] Data governance is particularly important in the process of data interaction between the internal network and the external network. When data is transmitted across networks, it may face various risks such as unauthorized data access, sensitive information leakage or virus intrusion. Strict control and detection of data flow between the internal network and the external network can reduce potential security risks and ensure the security and reliability of enterprise data assets.

[0004] Therefore, the technical problem to be solved by the present application is how to detect and induce access requests. SUMMARY

[0005] The present application aims to provide a data governance processing method and system to solve the problem of how to detect and induce access requests in the background art.

[0006] To achieve the above-mentioned purpose, the present application provides the following technical solutions:

[0007] A data governance processing method, the method comprising:

[0008] Receiving an access request uploaded by a user into an internal network, identifying a risk level, accessing a buffer zone in the internal network, and configuring a plurality of virtual containers in the buffer zone, at least obtaining a first container, a second container and a root container;

[0009] When the risk level of the access request is greater than a threshold value, the access request is imported into the first container, the target address corresponding to the access request is parsed and located, and random disturbance processing is performed to obtain a plurality of pseudo addresses, wherein the pseudo addresses at least include a first pseudo address and a second pseudo address, the pseudo addresses are written into the corresponding virtual containers, and an identification field is embedded;

[0010] Selecting a hash function, hashing the first pseudo address to generate a first hash value, and inserting the first hash value into the second pseudo address, hashing the second pseudo address to obtain a second hash value, and writing the second hash value into a third pseudo address, and so on, until an nth pseudo address is obtained, the number of hash operations is calculated, and a corresponding relationship between the number of hash operations and the risk level is established;

[0011] sequentially using all the virtual containers to process the access request, and initializing all the virtual containers after obtaining the processing result;

[0012] determining whether there is a risk feature in the processing result, if yes, marking the access request as a malicious request and triggering a pre-constructed security alarm rule, if no, backtracking the access request via the hash value and the identification field, importing the access request and the target address into the root container, determining a real result, identifying the type of the real result, creating a disposal rule corresponding to the type, disassembling the processing result, and returning to the intranet.

[0013] Further, the step of receiving the access request uploaded by the user into the intranet and identifying the risk level includes:

[0014] when the risk level is greater than a threshold, defining the corresponding access request as a sensitive request;

[0015] selecting a high-risk container from the virtual containers, and importing the sensitive request into the high-risk container.

[0016] Further, the step of receiving the access request uploaded by the user into the intranet and identifying the risk level includes:

[0017] building a behavior detection mechanism of the access request to obtain a behavior track, wherein the behavior track at least includes: access frequency, instruction mode and data packet feature;

[0018] building a risk database, wherein the risk database is composed of a behavior track item and a risk level item, and the risk database is used to dynamically adjust the risk level.

[0019] Further, the step of importing the access request into the first container when the risk level of the access request is greater than a threshold includes:

[0020] establishing a one-to-one correspondence between the hash number and the risk level;

[0021] collecting attribute data of the access request, wherein the attribute data at least includes: IP, type and risk level, and the hash number is adjusted via the attribute data and the behavior track.

[0022] Further, the step of sequentially using all the virtual containers to process the access request, and initializing all the virtual containers after obtaining the processing result includes:

[0023] Record all the hash values corresponding to each access request, establish a mapping between the hash values and the virtual containers, and integrate to generate a verification set;

[0024] Send the verification set to the root container and embed a verification mechanism.

[0025] Further, the step of creating a one-to-one correspondence between the type and the disposal rule, packaging the processing result, and returning it to the intranet includes:

[0026] Identify the target end of the processing result and set the priority of each target end;

[0027] After the return is completed, generate a security log and send it to a preset terminal.

[0028] Further, the method further includes:

[0029] Determine the source terminal of each access request via the attribute data;

[0030] Based on the security log and the processing result, draw a risk portrait, where each source terminal corresponds to a risk portrait.

[0031] Further, the system includes:

[0032] A receiving module for receiving an access request uploaded by a user to an intranet, identifying a risk level, accessing a buffer zone in the intranet, and configuring a plurality of virtual containers in the buffer zone, at least obtaining a first container, a second container, and a root container;

[0033] An embedding module for importing the access request into the first container when the risk level of the access request is greater than a threshold, parsing and locating the target address corresponding to the access request, and performing random disturbance processing to obtain a plurality of pseudo addresses, wherein the pseudo addresses include at least a first pseudo address and a second pseudo address, writing the pseudo addresses into the corresponding virtual containers, and embedding an identification field;

[0034] An initialization module for selecting a hash function, hashing the first pseudo address to generate a first hash value and inserting it into the second pseudo address, hashing the second pseudo address to obtain a second hash value and writing it into a third pseudo address, and so on until the nth pseudo address is obtained, calculating the number of hashings, establishing a corresponding relationship between the number of hashings and the risk level, processing the access request using all the virtual containers in turn, and initializing all the virtual containers after obtaining the processing result;

[0035] The back transmission module is used for judging whether there is a risk feature in the processing result, if yes, marking the access request as a malicious request and triggering a pre-constructed security alarm rule, if not, backtracking the access request via the hash value and the identification field, importing the access request and the target address into the root container, determining the real result, identifying the type of the real result, creating a disposal rule corresponding to the type, packing the processing result and transmitting it to the intranet.

[0036] Further, the receiving module comprises:

[0037] The definition unit is configured to define the corresponding access request as a sensitive request when the risk level is greater than the threshold value.

[0038] The access unit is configured to select a high-risk container from the virtual container and access the sensitive request to the high-risk container.

[0039] The acquisition unit is configured to construct a behavior detection mechanism of the access request and acquire a behavior track, wherein the behavior track at least comprises an access frequency, an instruction mode and a data packet feature.

[0040] The adjustment unit is configured to construct a risk database, wherein the risk database is composed of a behavior track item and a risk level item, and the risk level is dynamically adjusted by using the risk database.

[0041] Further, the embedding module comprises:

[0042] The establishment unit is configured to establish a one-to-one correspondence between the hash number and the risk level.

[0043] The hash unit is configured to collect attribute data of the access request, wherein the attribute data at least comprises an IP, a type and a risk level, and the hash number is adjusted via the attribute data and the behavior track.

[0044] Compared with the prior art, the present application has the following beneficial effects:

[0045] The application can isolate the core area by creating a buffer area, reduce the risk of direct attack or lateral diffusion of the internal network, and can perform threat detection and analysis, further enhance the isolation effect by deploying a virtual container in the buffer area, execute suspicious requests in the virtual container, monitor its behavior, facilitate detection of unknown threats, cross-verify access requests by connecting them to different numbers of virtual containers, further improve the security of data processing, hide the real topology and reduce the attack surface by generating pseudo addresses, prevent sensitive information leakage, and facilitate analysis, delay attacks and collect threat intelligence, hash the pseudo address to ensure that the evolution trajectory of the pseudo address is irreversible and unforgeable, facilitate complete restoration of the processing link of the access request, meet the audit and evidence collection needs, greatly improve the security of data processing, initialize the virtual container to prevent sensitive information leakage and ensure the independence of each access request verification environment, identify risk features to perform early defense, discover and block potential attack behavior in a timely manner, reduce the probability of security incidents, greatly improve the processing efficiency and security of data governance, and ensure the safe and reliable exchange of internal and external network data. BRIEF DESCRIPTION OF DRAWINGS

[0046] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the following will briefly introduce the drawings needed to be used in the embodiments or prior art description. Obviously, the drawings in the following description are only some embodiments of the present application.

[0047] Figure 1 The flow chart of the data governance processing method provided by the embodiment of the present application.

[0048] Figure 2 The first sub-flow chart of the data governance processing method provided by the embodiment of the present application.

[0049] Figure 3 The second sub-flow chart of the data governance processing method provided by the embodiment of the present application.

[0050] Figure 4 The third sub-flow chart of the data governance processing method provided by the embodiment of the present application.

[0051] Figure 5 The fourth sub-flow chart of the data governance processing method provided by the embodiment of the present application.

[0052] Figure 6 The composition block diagram of the data governance processing system provided by the embodiment of the present application.

[0053] Figure 7 The composition block diagram of the receiving module in the data governance processing system provided by the embodiment of the present application.

[0054] Figure 8 The composition block diagram of the embedded module in the data governance processing system provided by the embodiment of the application is shown.

[0055] Figure 9 The composition block diagram of the initialization module in the data governance processing system provided by the embodiment of the application is shown.

[0056] Figure 10 The composition block diagram of the initialization module in the data governance processing system provided by the embodiment of the application is shown. DETAILED DESCRIPTION

[0057] In embodiment 1, Figure 1 The implementation flow of the data governance processing method provided by the embodiment of the application is shown, and the following is described in detail as follows:

[0058] S100: receiving an access request uploaded by a user into an internal network, identifying a risk level, accessing a buffer zone in the internal network, and configuring a plurality of virtual containers in the buffer zone to obtain at least a first container, a second container and a root container.

[0059] An access request uploaded by a user into an internal network is received and identified, and a corresponding risk level is determined according to the source, access frequency and request parameters of the access request. The specific determination method of the risk level can be that a one-to-one risk value is set for the source and access frequency, the risk values of each access request are superimposed to obtain a total, and the total is divided into a plurality of intervals, each interval corresponding to a risk level. A buffer zone is created between the internal network and the external network, and the access request is imported into the buffer zone located between the internal network and the external network. The buffer zone is a security isolation layer, which is a secure isolation and transfer environment located between the internal network and the external network. Its main function is to temporarily store, process and risk isolate external access requests. A plurality of virtual containers are deployed in the buffer zone. The virtual container is a logical isolation processing unit. It is neither a physical server nor a traditional application container, but a virtualized environment unit that constitutes the buffer zone. Each virtual container runs independently. The buffer zone is composed of at least a first container, a second container and a root container. All virtual containers are arranged in a chain, that is, the first container is connected with the second container, and the root container is connected at the tail of all virtual containers.

[0060] S200: when the risk level of the access request is greater than a threshold value, the access request is imported into the first container, the target address corresponding to the access request is parsed and located, and random disturbance processing is performed to obtain a plurality of pseudo addresses, wherein the pseudo addresses at least include a first pseudo address and a second pseudo address, the pseudo addresses are written into the corresponding virtual containers, and an identification field is embedded.

[0061] If the risk level of the access request is greater than the threshold value, the access request is transferred into the first container, and the access request is fully parsed to determine specific source information, access parameters, and target resources, and the like, and random perturbation processing is performed on the target address to generate a plurality of pseudo addresses. The random perturbation processing refers to random fine-tuning of the access path, the request parameter, and the access time, and the like. A pseudo address is set for each virtual container, and the corresponding pseudo address is inserted into the virtual container. The pseudo address in each virtual container is used to process the access request (the program or terminal corresponding to the pseudo address is used to detect the risk of the access request). Each virtual container performs a specific operation on the access request according to the pseudo address, such as simulation access, data verification, hash calculation, or security analysis. In the entire processing process, the virtual containers are logically isolated, and the processing operations are tracked and associated through embedded identification fields, so that the source and processing track of the access request can be accurately traced back, and the safe isolation, effective verification, and dynamic protection of high-risk requests are realized. Each pseudo address corresponds to a point (program or terminal) for anomaly detection, and the access request is detected for anomaly through the point, and it is judged whether there is suspicious behavior.

[0062] S300: A hash function is selected, the first pseudo address is hashed to generate a first hash value, and the first hash value is inserted into the second pseudo address. The second pseudo address is hashed to obtain a second hash value, and the second hash value is written into the third pseudo address. In this way, the nth pseudo address is obtained, the number of hash operations is calculated, the correspondence between the number of hash operations and the risk level is established, all virtual containers are used to process the access request, and all virtual containers are initialized after the processing result is obtained.

[0063] In addition to recording and associating the verification process through the identification field, the association relationship can also be enhanced through hashing. A hash function (SHA-256 and SHA-1, etc.) is selected, the first pseudo address is hashed, the obtained hash value is defined as the first hash value, and the first hash value is written into the second pseudo address. The hash function is used to continue hashing the new second pseudo address to obtain a second hash value, and the second hash value is continuously written into the third pseudo address. In this way, all pseudo addresses are adjusted through chain marking. The advantage of this is that the authenticity of the nth pseudo address is verified to determine whether the access request passes the verification of all virtual containers, and the pseudo address can also be prevented from being tampered with to ensure the authenticity and reliability of the verification process.

[0064] In the present application, if the risk level of the access request is high, a greater number of hash operations are performed, and more virtual containers are used to process and detect the access request. If the risk level is low, fewer processing and detection operations are performed.

[0065] The number of times of recording the hash is established to correspond to the risk level of the access request, so that a high-risk request corresponds to more hash times, each virtual container performs independent analysis, verification, disturbance and security analysis operations on the access request through the internal configuration of the pseudo address, and judges whether there is a risk feature; after determining the judgment result, the initialization operation is performed on each virtual container, the temporary data is cleared, the pseudo address and the identification field are reset, and the processing environment is restored.

[0066] S400: determining whether there is a risk feature in the processing result, if yes, marking the access request as a malicious request, and triggering the pre-constructed security alarm rule, if no, backtracking the access request via the hash value and the identification field, importing the access request and the target address into the root container, determining the real result, identifying the type of the real result, creating a disposal rule corresponding to the type, packing the processing result, and returning to the intranet.

[0067] determining whether there is a risk feature in the processing result, if yes, marking the corresponding access request as a malicious request, and triggering the security alarm rule, the security alarm rule including: real-time notification of the security management platform, recording detailed event logs, isolating related virtual containers, and blocking further propagation of suspicious requests; if there is no risk feature in the processing result, backtrack the access request via the hash value and the identification field, import the access request and the corresponding target address into the root container in the buffer area, and further analyze the access request in the root container to determine the real result, the real result refers to "processing the access request with the real access address (target address), and the result obtained", determine the type corresponding to the real result, for example, data access, query operation, control instruction or log recording, etc. Different categories can also be classified according to the type of data to be written into the intranet (video, picture and text, etc.). For each type, a corresponding disposal rule is created, the disposal rule including: data distribution, alarm triggering, log recording and policy execution, etc. The root container packs the processing result to ensure that the data format conforms to the receiving specification of the intranet, embeds necessary security identification and tracking information, and returns the access request to the intranet; for example, an access request contains video data, and the disposal rule corresponding to the video type is to store the video data in a network disk and only return the sharing link of the video to the intranet.

[0068] In embodiment 2, Figure 2 The processing method implementation flow of the data governance provided by the embodiment of the application is shown, and the steps of receiving the access request uploaded by the user to the intranet, identifying the risk level, accessing the buffer area in the intranet, and configuring a plurality of virtual containers in the buffer area are described in detail as follows:

[0069] S101: define the corresponding access request as a sensitive request when the risk level is greater than a threshold value.

[0070] If the risk level of the access request is greater than the threshold value, the corresponding access request is defined as a sensitive request.

[0071] S102: select a high-risk container from the virtual container, and connect the sensitive request to the high-risk container.

[0072] From the virtual container, a high-risk container is identified and selected, and the high-risk container is specially used for processing sensitive requests, and the internal environment has strict security isolation mechanism and independent processing logic.

[0073] In embodiment 3, Figure 2 The processing method implementation flow of the data governance provided by the embodiment of the application is shown, and the steps of receiving the access request uploaded by the user into the intranet and identifying the risk level are described in detail as follows:

[0074] S103: build an access request behavior detection mechanism to obtain a behavior track, wherein the behavior track at least includes: access frequency, instruction mode and data packet characteristics.

[0075] The behavior detection mechanism is built, wherein the behavior detection mechanism refers to a collection of methods for real-time capturing, analyzing and evaluating access request behaviors, recording behavior data of the access request, and generating a corresponding behavior track, and the behavior track includes three core dimensions of access frequency, instruction mode and data packet characteristics. The access frequency is used to measure the access frequency and access rhythm of the access request in a unit of time, to identify abnormal high frequency or low frequency access behavior; the instruction mode is used to analyze the operation type, calling sequence and instruction structure carried by the request, to identify potential malicious operation or abnormal instruction combination; and the data packet characteristics include data packet size, packet header information, protocol type, load characteristics and encryption method, etc., which are used to detect abnormal patterns in data transmission.

[0076] S104: build a risk database, wherein the risk database is composed of a behavior track item and a risk level item, and the risk database is used to dynamically adjust the risk level.

[0077] The risk database is created, and the risk database is specially used for storing and managing the risk characteristics of the access request. The risk database is composed of a behavior track item and a risk level item, in other words, each access request corresponds to a behavior track, and each behavior track corresponds to a risk level.

[0078] In embodiment 4, Figure 3The processing method for data governance provided by the embodiment of the present application is shown in the following implementation flowchart, and the step of importing the access request into the first container when the risk level of the access request is greater than the threshold value is described in detail as follows:

[0079] S201: Establishing a one-to-one correspondence between the number of hashings and the risk level.

[0080] The number of hashings refers to the number of times of hashing the pseudo address by using the hash function; each risk level corresponds to a number of hashings.

[0081] S202: Collecting attribute data of the access request, wherein the attribute data at least includes IP, type and risk level, and adjusting the number of hashings via the attribute data and the behavior track.

[0082] In addition to adjusting the number of hashings according to the risk level, the attribute of the access request should also be referred to, wherein the attribute includes IP information and type information of the access request, etc., wherein the IP is used to identify the source address of the access request, and can identify suspicious sources or abnormal regions of the request; the second is the type information, which is used to define the specific category of the access request, such as file transmission request, instruction execution request and data reading request, etc.

[0083] In embodiment 5, Figure 4 The processing method for data governance provided by the embodiment of the present application is shown in the following implementation flowchart, and the step of processing the access request by using all the virtual containers in turn and initializing all the virtual containers after obtaining the processing result is described in detail as follows:

[0084] S301: Recording all the hash values corresponding to each access request, establishing a mapping between the hash values and the virtual containers, and integrating to generate a verification set.

[0085] The hash values corresponding to each access request are stored, and the mapping corresponding to each hash value is determined, and a verification set is integrated and generated, wherein the verification set is mainly used for backtracking the data governance process.

[0086] For example, a certain access request is hashed for three times, the first pseudo address and the corresponding identification field are integrated, and the new first pseudo address is hashed to obtain the first hash value, the first hash value is inserted into the second pseudo address and hashed to obtain the second hash value, the second hash value is inserted into the third pseudo address and hashed, and the first, second and third pseudo addresses are written into the first, second and third containers respectively, and the access request is detected by using the program or terminal in each virtual container pseudo address, and the detection results of all the hash values and the virtual containers corresponding to the access request are integrated to obtain a verification set.

[0087] S302: send the verification set to the root container and embed the verification mechanism.

[0088] The verification set is sent to the root container and the verification mechanism is embedded; specifically, the root container serves as the final determination unit, which verifies and analyzes the detection results of each virtual container after receiving the verification set, judges whether there is a defect, and if not, accesses the access request to the target address.

[0089] In embodiment 5, Figure 5 The processing method implementation flow of the data governance provided by the embodiment of the application is shown, and the steps of creating the treatment rule corresponding to the type, packing the processing result, and returning to the intranet are described in detail as follows:

[0090] S401: identify the target end of the processing result, and set the priority of each target end.

[0091] The target end corresponding to the processing result is identified, that is, the business node, application module or storage unit etc. to which the access request finally needs to be delivered is determined, and a corresponding priority is set for each target end. The priority can be divided into high, medium and low.

[0092] S402: after the return is completed, a security log is generated and sent to a preset terminal.

[0093] After the return is completed, a security log is generated, which is used to record the whole process information of the access request, and the security log is sent to a preset terminal, wherein the preset terminal refers to the terminal of the data governance administrator.

[0094] In embodiment 6, different from embodiment 1, the method further comprises:

[0095] Determine the source terminal of each access request via the attribute data;

[0096] Draw a risk portrait based on the security log and the processing result, wherein each source terminal corresponds to a risk portrait.

[0097] According to the IP information in the attribute data of each access request, the source terminal of each access request is determined, the behavior characteristics, abnormal event records and risk levels etc. shown by the access request in the intranet access process are extracted, and a risk portrait is drawn, wherein the risk portrait can represent the potential threat tendency of each source terminal.

[0098] Figure 6 The composition structure block diagram of the data governance processing system provided by the embodiment of the application is shown, and the data governance processing system 1 comprises:

[0099] The receiving module 11 is used for receiving an access request uploaded by a user into an intranet, identifying a risk level, accessing a buffer zone in the intranet, and configuring a plurality of virtual containers in the buffer zone, at least a first container, a second container and a root container;

[0100] The embedding module 12 is used for, when the risk level of the access request is greater than a threshold value, importing the access request into the first container, parsing and locating a target address corresponding to the access request, and performing random disturbance processing to obtain a plurality of pseudo addresses, wherein the pseudo addresses at least include a first pseudo address and a second pseudo address, writing the pseudo addresses into corresponding virtual containers, and embedding an identification field;

[0101] The initialization module 13 is used for selecting a hash function, hashing the first pseudo address to generate a first hash value and inserting the first hash value into the second pseudo address, hashing the second pseudo address to obtain a second hash value and writing the second hash value into a third pseudo address, and so on until an nth pseudo address is obtained, calculating a hash number, establishing a corresponding relationship between the hash number and the risk level, processing the access request by using all the virtual containers in turn, and initializing all the virtual containers after a processing result is obtained.

[0102] The back transmission module 14 is used for judging whether a risk feature exists in the processing result, if yes, marking the access request as a malicious request and triggering a security alarm rule constructed in advance, if not, backtracking the access request via the hash value and the identification field, importing the access request and the target address into the root container, determining a real result, identifying a type of the real result, creating a disposal rule corresponding to the type, packaging the processing result, and back transmitting the processing result to the intranet.

[0103] Figure 7 A component structure block diagram of a processing system of data governance provided by an embodiment of the application is shown, and the receiving module 11 includes:

[0104] The definition unit 111 is used for defining the corresponding access request as a sensitive request when the risk level is greater than a threshold value.

[0105] The access unit 112 is used for selecting a high-risk container from the virtual containers and accessing the sensitive request into the high-risk container.

[0106] The acquisition unit 113 is used for constructing a behavior detection mechanism of the access request and acquiring a behavior track, wherein the behavior track at least includes an access frequency, an instruction mode and a data packet feature.

[0107] An adjusting unit 114 is configured to construct a risk database, wherein the risk database is composed of a behavior track item and a risk level item, and the risk level is dynamically adjusted by using the risk database.

[0108] Figure 8 A component structure block diagram of a processing system of data governance provided by the embodiment of the application is shown, and the embedding module 12 comprises:

[0109] An establishing unit 121 is configured to establish a one-to-one correspondence between the hash number and the risk level;

[0110] A hash unit 122 is configured to collect attribute data of an access request, wherein the attribute data at least comprises IP, type and risk level, and the hash number is adjusted by using the attribute data and the behavior track.

[0111] Figure 9 A component structure block diagram of a processing system of data governance provided by the embodiment of the application is shown, and the initialization module 13 comprises:

[0112] A recording unit 131 is configured to record all hash values corresponding to each access request, establish a mapping between the hash value and the virtual container, and integrate to generate a verification set;

[0113] A sending unit 132 is configured to send the verification set to the root container and embed a verification mechanism.

[0114] Figure 10 A component structure block diagram of a processing system of data governance provided by the embodiment of the application is shown, and the back transmission module 14 comprises:

[0115] An identifying unit 141 is configured to identify a target end of a processing result and set a priority of each target end;

[0116] A generating unit 142 is configured to generate a security log after back transmission is completed and send the security log to a preset terminal.

[0117] The receiving module 11 is mainly used for completing step S100, the embedding module 12 is mainly used for completing step S200, the initialization module 13 is mainly used for completing step S300, and the back transmission module 14 is mainly used for completing step S400;

[0118] The defining unit 111 is mainly used for completing step S101, the access unit 112 is mainly used for completing step S102, the obtaining unit 113 is mainly used for completing step S103, and the adjusting unit 114 is mainly used for completing step S104;

[0119] The establishing unit 121 is mainly used for completing step S201, and the hash unit 122 is mainly used for completing step S202;

[0120] The recording unit 131 is mainly configured to complete the step S301, and the sending unit 132 is mainly configured to complete the step S302.

[0121] The identifying unit 141 is mainly configured to complete the step S401, and the generating unit 142 is mainly configured to complete the step S402.

[0122] The above merely describes the preferred embodiments of the present application, but the patent scope of the present application is not limited to the above, and any equivalent structure or equivalent flow transformation according to the content of the present application specification and drawings, or direct or indirect application in other related technical fields, are also included in the patent protection scope of the present application.

Claims

1. A processing method of data governance, characterized by, The method comprises: Receiving a user uploading an access request into an internal network, identifying a risk level, accessing a buffer zone in the internal network, and configuring a plurality of virtual containers in the buffer zone, at least obtaining a first container, a second container, and a root container; When the risk level of the access request is greater than a threshold, the access request is imported into the first container, the target address corresponding to the access request is parsed and located, and random disturbance processing is performed to obtain a plurality of pseudo addresses, wherein the pseudo addresses at least include a first pseudo address and a second pseudo address, the pseudo addresses are written into the corresponding virtual containers, and an identification field is embedded; A hash function is selected, the first pseudo address is hashed to generate a first hash value, and the first hash value is inserted into the second pseudo address, the second pseudo address is hashed to obtain a second hash value, and the second hash value is written into a third pseudo address, and so on, until an nth pseudo address is obtained, the number of hashings is calculated, and a corresponding relationship between the number of hashings and the risk level is established; All virtual containers are used in turn to process the access request, and after obtaining the processing result, all virtual containers are initialized; It is judged whether there is a risk feature in the processing result. If yes, the access request is marked as a malicious request, and a pre-constructed security alarm rule is triggered. If not, the access request is traced back through the hash value and the identification field, the access request and the target address are imported into the root container, the real result is determined, the type of the real result is identified, a disposal rule corresponding to the type is created, the processing result is packaged, and the processing result is returned to the internal network.

2. The data governance processing method of claim 1, wherein, The step of receiving a user uploading an access request into an internal network, identifying a risk level, accessing a buffer zone in the internal network, and configuring a plurality of virtual containers in the buffer zone comprises: When the risk level is greater than a threshold, the corresponding access request is defined as a sensitive request; A high-risk container is selected from the virtual containers, and the sensitive request is accessed into the high-risk container.

3. The data governance processing method of claim 2, wherein, The step of receiving a user uploading an access request into an internal network, identifying a risk level comprises: An access request behavior detection mechanism is constructed, and a behavior track is obtained, wherein the behavior track at least includes access frequency, instruction mode, and data packet feature; A risk database is constructed, wherein the risk database is composed of a behavior track item and a risk level item, and the risk level is dynamically adjusted by using the risk database.

4. The data governance processing method of claim 3, wherein, The step of importing the access request into the first container when the risk level of the access request is greater than a threshold comprises: A one-to-one corresponding relationship between the number of hashings and the risk level is established; Attribute data of the access request is collected, wherein the attribute data at least includes IP, type, and risk level, and the number of hashings is adjusted by using the attribute data and the behavior track.

5. The data governance processing method of claim 1, wherein, The step of using all virtual containers in turn to process the access request, and initializing all virtual containers after obtaining the processing result comprises: All hash values corresponding to each access request are recorded, a mapping between the hash values and the virtual containers is established, and a verification set is integrated and generated; The verification set is sent to the root container and an embedding verification mechanism is embedded.

6. The data governance processing method of claim 4, wherein, The step of creating a one-to-one correspondence between the type and the processing rule, packing the processing result, and returning to the intranet comprises: A target end of the processing result is identified, and a priority of each target end is set; When the returning is completed, a security log is generated and sent to a preset terminal.

7. The data governance processing method of claim 6, wherein, The method further comprises: A source terminal of each access request is determined via the attribute data; Based on the security log and the processing result, a risk portrait corresponding to each source terminal is drawn.

8. A processing system for data governance, characterized by, The system comprises: A receiving module is configured to receive an access request uploaded by a user to an intranet, identify a risk level, access a buffer zone in the intranet, and configure a plurality of virtual containers in the buffer zone, at least a first container, a second container, and a root container. An embedding module is configured to, when the risk level of the access request is greater than a threshold, import the access request into the first container, parse and locate a target address corresponding to the access request, and perform random disturbance processing to obtain a plurality of pseudo addresses, wherein the pseudo addresses at least include a first pseudo address and a second pseudo address, write the pseudo addresses into the corresponding virtual containers, and embed an identification field. An initialization module is configured to select a hash function, hash the first pseudo address to generate a first hash value and insert the first hash value into the second pseudo address, hash the second pseudo address to obtain a second hash value and write the second hash value into a third pseudo address, and so on until an nth pseudo address is obtained, calculate a hash number, establish a corresponding relationship between the hash number and the risk level, process the access request using all the virtual containers in turn, and initialize all the virtual containers after obtaining the processing result. A returning module is configured to determine whether there is a risk feature in the processing result, if yes, mark the access request as a malicious request and trigger a pre-constructed security alarm rule, if no, backtrack the access request via the hash value and the identification field, import the access request and the target address into the root container, determine a real result, identify a type of the real result, create a one-to-one correspondence between the type and a processing rule, pack the processing result, and return to the intranet.

9. The data governance processing system of claim 8, wherein, The receiving module comprises: A defining unit is configured to define the corresponding access request as a sensitive request when the risk level is greater than the threshold. An access unit is configured to select a high-risk container from the virtual containers and access the sensitive request to the high-risk container. An acquisition unit is configured to construct a behavior detection mechanism of the access request and acquire a behavior track, wherein the behavior track at least includes an access frequency, an instruction mode, and a data packet feature. An adjustment unit is configured to construct a risk database, wherein the risk database is composed of a behavior track item and a risk level item, and the risk database is used to dynamically adjust the risk level.

10. The data governance processing system of claim 9, wherein, The embedding module comprises: An establishing unit is configured to establish a one-to-one correspondence between the hash number and the risk level. A hash unit is configured to collect attribute data of an access request, wherein the attribute data at least includes IP, type and risk level, and the hash times are adjusted via the attribute data and behavior track.

Images