Data security event processing method and device, equipment, medium and program product

Abstract

The invention provides a data security event processing method and device, equipment, a medium and a program product, which can be applied to the field of privacy computing. The data security event processing method comprises the steps of obtaining fields included in data security event information under the condition that a data security event occurs; based on a preset sensitive data standard set and fields, data standard information corresponding to the fields is determined, and the sensitive data standard set comprises multiple fields and data standard information corresponding to the multiple fields; generating a first sensitive data feature of the data security event information based on data standard information corresponding to the field; a target database statement corresponding to the data security event information is determined based on a historical query log, the historical query log comprises a database statement subjected to database query operation and a second sensitive data feature of the database statement, and the first sensitive data feature is matched with the second sensitive data feature of the target database statement.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of privacy computing and the field of financial technology, and in particular to a data security event processing method, device, equipment, medium and program product. BACKGROUND

[0002] Users or staff of a financial institution can flexibly process data of the financial institution through ad hoc queries. However, when the data of the ad hoc query is leaked, there is a problem that it is difficult to track and trace the leaked data. SUMMARY

[0003] In view of the above problems, the present application provides a data security event processing method, device, equipment, medium and program product.

[0004] According to a first aspect of the present application, a data security event processing method is provided, comprising: in the case of a data security event, acquiring a field included in data security event information; determining data standard information corresponding to the field based on a preset sensitive data standard set and the field, the sensitive data standard set including a plurality of fields and data standard information corresponding to each of the plurality of fields, the data standard information being a unified specification name of the field; generating a first sensitive data feature of the data security event information based on the data standard information corresponding to the field; determining a target database statement corresponding to the data security event information based on a historical query log, the historical query log including a database statement that has performed a database query operation and a second sensitive data feature of the database statement, the first sensitive data feature matching the second sensitive data feature of the target database statement.

[0005] According to an embodiment of the present application, the first sensitive data feature is a hexadecimal data feature, and the generating the first sensitive data feature of the data security event information based on the data standard information corresponding to the field comprises: generating a target binary data based on the data standard information corresponding to the field, the target binary data including a plurality of binary bits, the binary bits of the target binary data corresponding one-to-one to the data standard information in the sensitive data standard set, and the binary bit corresponding to the data standard information corresponding to the field in the target binary data being 1; and performing a base conversion on the target binary data feature to obtain the first sensitive data feature.

[0006] According to an embodiment of the present application, the target database statement corresponding to the data security event information is determined based on the historical query log, including: obtaining target binary data corresponding to the first sensitive data feature and binary data corresponding to the second sensitive data feature in the historical query log; performing similarity calculation on the target binary data and the binary data corresponding to the second sensitive data feature to determine a similarity score between the first sensitive data feature and the second sensitive data feature; selecting at least one second sensitive data feature with the highest similarity score, and taking the database statement corresponding to the at least one second sensitive data feature as the target database statement.

[0007] According to an embodiment of the present application, the database statement of the historical query log has corresponding user information, and the method further includes: determining the source database statement and the source user that leak the data security event information based on the target database statement and the user information corresponding to the target database statement.

[0008] According to an embodiment of the present application, the method further includes: in response to a query using a database statement, obtaining a query result field of the database statement and determining a source table field associated with the query result field; detecting data standard information of the source table field; in a case where the data standard information corresponding to the source table field is detected, setting the data standard information corresponding to the query result field as the data standard information corresponding to the source table field; and generating a second sensitive data feature of the database statement based on the data standard information corresponding to the query result field.

[0009] According to an embodiment of the present application, the binary bits have similarity weights, and the similarity calculation on the target binary data and the binary data corresponding to the second sensitive data feature to determine the similarity score between the first sensitive data feature and the second sensitive data feature includes: determining binary bits that are both 1 in the target binary data and the binary data corresponding to the second sensitive data feature; determining similarity weights of the binary bits that are both 1, and performing weighted summation on the binary bits that are both 1 based on the similarity weights to obtain the similarity score between the target binary data and the binary data corresponding to the second sensitive data feature.

[0010] The second aspect of the present application provides a data security event processing apparatus, comprising: an acquisition module configured to acquire fields included in data security event information in the case of occurrence of a data security event; a determination module configured to determine data standard information corresponding to the fields based on a preset sensitive data standard set and the fields, the sensitive data standard set including a plurality of fields and data standard information corresponding to each of the plurality of fields, the data standard information being a unified standard name of a field; a generation module configured to generate a first sensitive data feature of the data security event information based on the data standard information corresponding to the fields; and a processing module configured to determine a target database statement corresponding to the data security event information based on a historical query log, the historical query log including a database statement having performed a database query operation and a second sensitive data feature of the database statement, the first sensitive data feature matching the second sensitive data feature of the target database statement.

[0011] The third aspect of the present application provides an electronic device, comprising: one or more processors; a memory for storing one or more computer programs, wherein the one or more processors execute the one or more computer programs to implement the steps of the method.

[0012] The fourth aspect of the present application further provides a computer-readable storage medium having stored thereon a computer program or instructions, wherein the computer program or instructions are executed by a processor to implement the steps of the method.

[0013] The fifth aspect of the present application further provides a computer program product comprising a computer program or instructions, wherein the computer program or instructions are executed by a processor to implement the steps of the method. BRIEF DESCRIPTION OF DRAWINGS

[0014] The above and other objects, features and advantages of the present application will become more apparent from the following description of embodiments of the present application taken with reference to the accompanying drawings, in which:

[0015] Figure 1 An application scenario diagram of the data security event processing method and apparatus according to an embodiment of the present application is schematically shown;

[0016] Figure 2 A flowchart of the data security event processing method according to an embodiment of the present application is schematically shown;

[0017] Figure 3 A flowchart of the generation of the second sensitive data feature according to an embodiment of the present application is schematically shown;

[0018] Figure 4 A structural block diagram of the data security event processing apparatus according to an embodiment of the present application is schematically shown; and

[0019] Figure 5 A block diagram of an electronic device suitable for implementing a data security event processing method according to embodiments of the present application is shown schematically. DETAILED DESCRIPTION

[0020] Hereinafter, embodiments of the present application will be described with reference to the accompanying drawings. It should be understood, however, that the description which follows is merely illustrative and is not intended to limit the scope of the application. In the following detailed description of embodiments of the present application, numerous specific details are set forth in order to provide a thorough understanding of the present application. However, it will be apparent to one skilled in the art that one or more embodiments of the present application can be practiced without these specific details. In other instances, well-known structures and functions have not been described in detail in order to avoid obscuring aspects of the present application.

[0021] The terminology used herein is for the purpose of describing particular embodiments only and is not intended to be limiting of the present application. As used herein, the term "including" "comprising" and the like are meant to be inclusive and to mean that there can be additional elements or steps in addition to those specifically recited.

[0022] All terms used herein including technical and scientific terms have the meanings commonly understood by one of ordinary skill in the art unless otherwise defined. It should be noted that the terms used herein are defined as having meanings that are consistent with the context of the specification in which they are used, and should not be interpreted in an overly idealized or overly formal way.

[0023] In situations where the expression "at least one of A, B, and C, etc." is used, it is typically meant that the expression includes at least one of A, B, or C, but not necessarily including more than one of A, B, or C (e.g., a system that has A; a system that has B; a system that has C; etc.).

[0024] In the process of big data, ad-hoc query based on structured query language is a key means of data analysis and business decision. Ad-hoc query allows users to flexibly explore, filter, aggregate and associate massive data sets according to real-time needs, using written structured query language, involving single or multiple data tables. However, ad-hoc query also brings significant data security challenges. In the process of executing ad-hoc query, sensitive information may be unintentionally or maliciously accessed, extracted and exported from the query result set, and if sensitive data is leaked, it will cause serious legal, reputation and financial risks.

[0025] In the related art, mainly through auditing based on the log of the database, the content of the recorded query statement and the access behavior are detected to find the query statement that will cause the data security event to occur. However, the related art cannot detect the content in the log of the database that represents the structural features of the query result set, such as the result field after complex calculation or multi-table association. There is no sensitive attribute combination in the log that can represent the content of the result set.

[0026] In another related art, mainly data watermark or mark is embedded in the data, and when a data security event occurs, data tracing is performed based on the data watermark or mark in the leaked data. However, pre-processing of the original sensitive data to embed the mark or watermark in a large and dynamic data environment has the problem of high implementation cost and difficult to maintain. In addition, it is difficult to generate data watermark or mark for all possible sensitive data types, and in the ad hoc query scene, complex data conversion including aggregation, calculation and function processing can easily destroy or blur the original watermark information, resulting in failure of tracing.

[0027] Based on this, the embodiments of the present application provide a data security event processing method, comprising: in the case of occurrence of a data security event, obtaining a field included in data security event information; determining data standard information corresponding to the field based on a preset sensitive data standard set and the field, the sensitive data standard set including a plurality of fields and data standard information corresponding to each of the plurality of fields; generating a first sensitive data feature of the data security event information based on the data standard information corresponding to the field; determining a target database statement corresponding to the data security event information based on a historical query log, the historical query log including a database statement that has performed a database query operation and a second sensitive data feature of the database statement, and the first sensitive data feature and the second sensitive data feature of the target database statement match. By classifying different fields into data standard information, it is avoided that the same information is represented by different fields in different data tables, ensuring effective identification of sensitive data information and improving multi-table association tracing capability.

[0028] It should be noted that the data security event processing method and device determined by the present application can be used in the field of privacy computing and the field of financial technology, and can also be used in any field other than the field of privacy computing and the field of financial technology. The application field of the data security event processing method and device of the present application is not limited.

[0029] In the technical solution of this application, the user information (including but not limited to user personal information, user image information, user device information, such as location information) and data (including but not limited to data used for analysis, stored data, and displayed data) involved are all information and data authorized by the user or fully authorized by all parties. Furthermore, the collection, storage, use, processing, transmission, provision, disclosure, and application of related data all comply with relevant laws, regulations, and standards, take necessary confidentiality measures, do not violate public order and good morals, and provide corresponding operation entry points for users to choose to authorize or refuse.

[0030] In scenarios where personal information is used for automated decision-making, the code detection method, device, and system provided in this application all offer users corresponding operation entry points, allowing them to choose to agree to or reject the automated decision-making result; if the user chooses to reject, the process proceeds to the expert decision-making stage. Here, "automated decision-making" refers to the activity of automatically analyzing and evaluating an individual's behavioral habits, interests, or economic, health, and credit status through computer programs, and then making a decision. Here, "expert decision-making" refers to the activity of making decisions by personnel who specialize in a particular field, possess specialized experience, knowledge, and skills, and have reached a certain level of professional expertise.

[0031] Figure 1 The illustration shows an application scenario of the data security incident handling method and apparatus according to embodiments of this application.

[0032] like Figure 1 As shown, application scenario 100 according to this embodiment may include a first terminal device 101, a second terminal device 102, a third terminal device 103, a network 104, and a server 105. The network 104 serves as a medium for providing a communication link between the first terminal device 101, the second terminal device 102, the third terminal device 103, and the server 105. The network 104 may include various connection types, such as wired or wireless communication links, or fiber optic cables, etc.

[0033] Users can use the first terminal device 101, the second terminal device 102, and the third terminal device 103 to interact with the server 105 via the network 104 to receive or send messages, etc. Various communication client applications can be installed on the first terminal device 101, the second terminal device 102, and the third terminal device 103, such as shopping applications, web browser applications, search applications, instant messaging tools, email clients, social media platform software, etc. (for example only).

[0034] The first terminal device 101, the second terminal device 102, and the third terminal device 103 can be various electronic devices with displays and support web browsing, including but not limited to smartphones, tablets, laptops, and desktop computers.

[0035] Server 105 can be a server that provides various services, such as a backend management server that supports websites browsed by users using the first terminal device 101, the second terminal device 102, and the third terminal device 103 (this is just an example). The backend management server can analyze and process data such as received user requests, and feed back the processing results (such as web pages, information, or data obtained or generated according to user requests) to the terminal devices.

[0036] It should be noted that the data security incident handling method provided in this application embodiment can generally be executed by server 105. Correspondingly, the data security incident handling device provided in this application embodiment can generally be located in server 105. The data security incident handling method provided in this application embodiment can also be executed by a server or server cluster that is different from server 105 and capable of communicating with the first terminal device 101, the second terminal device 102, the third terminal device 103, and / or server 105. Correspondingly, the data security incident handling device provided in this application embodiment can also be located in a server or server cluster that is different from server 105 and capable of communicating with the first terminal device 101, the second terminal device 102, the third terminal device 103, and / or server 105.

[0037] It should be understood that Figure 1 The number of terminal devices, networks, and servers shown is merely illustrative. Depending on implementation needs, any number of terminal devices, networks, and servers can be included.

[0038] The following will be based on Figure 1 The described scene, through Figures 2-3 The data security incident handling method according to the embodiments of this application will be described in detail.

[0039] Figure 2 A flowchart illustrating a data security incident handling method according to an embodiment of this application is shown.

[0040] like Figure 2 As shown, the data security incident handling method in this embodiment includes operations S210 to S240. For ease of understanding, structured query statements can also be called database statements.

[0041] In operation S210, in the event of a data security incident, the fields included in the data security incident information are retrieved.

[0042] Data security incident information refers to data query results that have been illegally leaked to the outside world after being obtained using database statements. Data security incident information may include at least some fields output by the database statements and the corresponding field information.

[0043] In operation S220, based on the preset set of sensitive data standards and fields, the data standard information corresponding to the fields is determined.

[0044] The sensitive data standard set includes multiple fields and their corresponding data standard information. The data standard information is the standardized name of the field.

[0045] It should be understood that multiple sets of sensitive data standards can be generated based on different criteria. If a field has corresponding data standard information in different sets of sensitive data standards, then that field can be set to correspond to multiple different data standard information.

[0046] If a field exists in the leaked data, and the data standard information corresponding to that field is not included in the sensitive data standard set, then the field is determined not to be sensitive data.

[0047] For example, a preset set of sensitive data standards can be configured to include some information as shown in Table 1. Table 1 includes different field names and their corresponding data standard information. If a field is found to have corresponding data standard information in the sensitive data standard set, then the corresponding data standard information for that field is determined; if no corresponding data standard information for a field is found in the sensitive data standard set, or if the detected data standard information for a field is "none," then that field is determined not to be sensitive data and no corresponding data standard information exists.

[0048] Table 1

[0049]

[0050] In operation S230, the first sensitive data feature of data security event information is generated based on the data standard information corresponding to the field.

[0051] The data standard information corresponding to the fields included in the leaked data information can be aggregated, and the aggregated data standard information can be used as the first sensitive data feature to characterize the data standard information included in the data security incident information.

[0052] In operation S240, based on historical query logs, the target database statement corresponding to the data security event information is determined.

[0053] The historical query log includes the database statements that have been used for database queries, as well as the second sensitive data characteristics of those statements. It should be understood that, based on business needs, the historical query log can also be configured to include other information, such as the query results of the database statements.

[0054] The first sensitive data feature is matched with the second sensitive data feature of the target database statement. A matching algorithm can be used to determine the degree of matching between the data standard information represented by the first and second sensitive data features, and the database statement corresponding to the second sensitive data feature with the highest degree of matching with the first sensitive data feature is selected as the target data statement.

[0055] The target data statement can serve as the data source for data security incident information. If the target data statement includes multiple data statements, secondary verification can be performed on the target data statement to determine the data source of the data security incident information.

[0056] By using a pre-defined set of sensitive data standards, the data standard information corresponding to the fields included in the data security incident information is determined. This enables the classification of flexibly set result fields in ad-hoc queries when a data security incident occurs, the determination of the data source corresponding to the result field, the determination of the unified standard name of the result field, and the accurate determination of whether the result field is sensitive data through the unified standard name, i.e., the data standard information. This solves the problem of difficulty in judging whether the result field is a sensitive attribute in the ad-hoc query process.

[0057] Furthermore, by using the data standard information corresponding to the fields included in the data security incident information, a first sensitive data feature is generated. By matching the first sensitive data feature in the historical query log, the database statement that matches the data standard information included in the historical query log with the data standard information included in the leaked data information is determined as the target database statement. This eliminates the need to parse all information in the leaked data information and the historical query log, enabling rapid and accurate tracing of leaked data and reducing the complexity of tracking and processing leaked data.

[0058] The second sensitive data characteristic of database statements in historical query logs can be generated during the data query process using those database statements. Result fields in a database statement can be related to fields in the queried data table, and fields in the database statement can inherit the data standard information of the related fields.

[0059] In embodiments of this application, the method further includes: in response to performing a query using a database statement, obtaining the query result fields of the database statement and determining the source table fields associated with the query result fields; detecting the data standard information of the source table fields; if the data standard information corresponding to the source table fields is detected, setting the data standard information corresponding to the query result fields as the data standard information corresponding to the source table fields; and generating a second sensitive data feature of the database statement based on the data standard information corresponding to the query result fields.

[0060] For example, if a database statement combines information from the first and second fields and outputs the combined information as a query result field, then the query result field is related to the first and second fields, which are the source table fields of the query result field. If it is detected that the first field corresponds to the first data standard information and the second field corresponds to the second data standard information, then the data standard information corresponding to the query result field is determined to be the first data standard information and the second data standard information.

[0061] The process of generating the second sensitive data feature of a database statement based on the data standard information corresponding to the fields of the query results is the same as the process of generating the first sensitive data feature of a data security event based on the data standard information corresponding to the fields of the leaked data information.

[0062] By analyzing the relationship between the query result fields and the source table fields, the query result fields can inherit the data standard information of the source fields. This solves the problem of determining the data standard information of query result fields in ad-hoc queries, including multi-table join queries, and improves the accuracy of tracing query result fields in ad-hoc queries.

[0063] Figure 3 A flowchart illustrating the generation of a second sensitive data feature according to an embodiment of this application is shown.

[0064] In operation S310, a database statement is generated. The database statement is used to query the first non-null value in the second and third fields of the first data table as the fourth field, and to query the fifth field of the second data table as the sixth field, and to use the fourth and sixth fields as the query result fields. The query result fields are then output.

[0065] In this database statement, the first and second data tables are joined using the first field, resulting in data where the values ​​of the first field in both tables are the same. A NOT NULL function can be used to filter for non-null values ​​in the second and third fields, with the second field being checked first for non-nullability. This NOT NULL function retrieves the value of the first field detected as non-null. A temporary alias can be used to generate a statement that assigns the output of the NOT NULL function as the value of the fourth field. Similarly, a temporary alias can be used to assign the value of the fifth field as the value of the sixth field. The data from the fourth and sixth fields are then output as the query result fields.

[0066] In operation S320A, in response to determining that the second field corresponds to the first data standard information, the third field corresponds to the second data standard information, and the data standard information corresponding to the fourth field is determined to be the first data standard information and the second data standard information.

[0067] The value of the fourth field is determined based on the second or third field. In this case, the second and third fields are the source table fields of the fourth field. The fourth field can inherit the data standard information of the second and third fields. That is, the data standard information corresponding to the fourth field is the first data standard information and the second data standard information.

[0068] In operation S320B, in response to determining that the fifth field corresponds to the third data standard information, the data standard information corresponding to the sixth field is determined to be the third data standard information.

[0069] In operation S330, the binary data of the database statement is determined. The binary data represents the database statement and includes first data standard information, second data standard information and third data standard information.

[0070] It is possible to construct a bitmap corresponding to the query result fields of a database statement, and set the binary bits corresponding to the first data flag information, the second data standard information, and the third data standard information in the bitmap to 1 to obtain the binary data of the database statement.

[0071] In operation S340, the second sensitive data feature of the database statement is generated.

[0072] Convert the bitmap to hexadecimal data and use it as the second sensitive data feature for database statements.

[0073] Binary data features can be used to represent data security event information and data standard information included in fields in historical query logs, respectively. Furthermore, binary data features can be converted to different number systems to obtain data features with a number system greater than two, which can then be used as sensitive data features.

[0074] The following section uses hexadecimal data characteristics for sensitive data and takes the generation of the first sensitive data characteristic for data security incident information as an example to explain the generation process of sensitive data characteristics.

[0075] In embodiments of this application, the first sensitive data feature can be hexadecimal data. Generating the first sensitive data feature of data security event information based on the data standard information corresponding to the field includes: generating target binary data based on the data standard information corresponding to the field; the target binary data includes multiple binary bits, and the binary bits of the target binary data correspond one-to-one with the data standard information in the sensitive data standard set; the binary bits in the target binary data corresponding to the data standard information corresponding to the field are 1; and converting the target binary data to a different base to obtain the first sensitive data feature.

[0076] A fixed-length binary data set can be pre-defined, containing bits that correspond one-to-one with data standard information in the sensitive data standard set, with the default value of the bits corresponding to the data standard information set to 0. When data standard information corresponding to a field of leaked data is detected, the bit in the binary data corresponding to that data standard information is set to 1. In response to completing the operation of determining the data standard information for all fields of the leaked data, the resulting binary data is used as the target binary data corresponding to the leaked data.

[0077] Binary data can be, for example, binary numbers, binary data features, or bitmaps. This application does not limit the format of binary data.

[0078] For example, a preset set of sensitive data standards can be configured, including some information as shown in Table 2. This set includes data standard information and its corresponding index number, which represents the binary bits corresponding to that data standard information. In Table 2, if a field in the leaked data is detected to have data standard information that is the first data standard information, then the first binary bit in the binary data corresponding to the leaked data information is set to 1.

[0079] Table 2

[0080]

[0081] It should be understood that the index number and the corresponding binary bit can be different. Bit information can be included in the sensitive data standard set to determine the binary bit corresponding to the index number.

[0082] By converting the target binary data into hexadecimal data, the number of effective bits in the data is reduced while maintaining the same amount of information. This achieves a unified, efficient, and low-storage-occupancy digital representation of the characteristics of sensitive data.

[0083] In addition, binary data has the characteristic of being easy to perform logical operations. In the process of determining the target database statement that matches the data security incident information, the first sensitive data feature and the second sensitive data feature can be converted into binary data to determine the similarity between the first sensitive data feature and the second sensitive data feature.

[0084] In the embodiments of this application, determining the target database statement corresponding to data security event information based on historical query logs includes: obtaining target binary data corresponding to a first sensitive data feature and binary data corresponding to a second sensitive data feature in the historical query logs; performing similarity calculation on the target binary data and the binary data corresponding to the second sensitive data feature to determine the similarity score between the first sensitive data feature and the second sensitive data feature; selecting at least one second sensitive data feature with the highest similarity score, and using the database statement corresponding to at least one second sensitive data feature as the target database statement.

[0085] The method for calculating the similarity between the target binary data and the binary data corresponding to the second sensitive data feature can be common bit calculation, cosine similarity calculation, or logical bit operation.

[0086] Taking the calculation of the common bit count between the target binary data and the binary data corresponding to the second sensitive data feature as an example, firstly, a bitwise AND operation can be performed on the target binary data and the binary data corresponding to the second sensitive data feature to obtain the result representing the number of binary bits that are both 1 in the target binary data and the binary data corresponding to the second sensitive data feature. Then, the Hamming weight of the calculation result is determined to obtain the number of binary bits that are both 1 in the target binary data and the binary data corresponding to the second sensitive data feature, i.e., the common bit count.

[0087] By using binary data of the sensitive data characteristics of leaked data information and database statements in historical query logs to perform similarity calculations, compared to using data in other bases for similarity calculations, it is possible to quickly and accurately filter out the suspected source database statements with the closest sensitive data characteristics from historical query logs.

[0088] Furthermore, similarity weights can be assigned to each binary bit to characterize the importance of the corresponding data standard information in similarity calculation. The similarity score between the first and second sensitive data features is then determined through a weighted summation of similarities.

[0089] In embodiments of this application, similarity calculation is performed on the target binary data and the binary data corresponding to the second sensitive data feature to determine the similarity score between the first sensitive data feature and the second sensitive data feature. This includes: determining the binary bits that are both 1 in the target binary data and the binary data corresponding to the second sensitive data feature; determining the similarity weight of the binary bits that are both 1; and weighting and summing the binary bits that are both 1 based on the similarity to obtain the similarity score between the target binary data and the binary data corresponding to the second sensitive data feature.

[0090] The similarity weight of binary bits can be a pre-set static value or a value dynamically determined based on the requirements of business scenario rules.

[0091] By using binary bit similarity weights and referencing the importance of different data standard information in similarity judgments, the accuracy of identifying database statements similar to data security incident information is improved.

[0092] Furthermore, similarity calculations can be performed using sensitive data features generated based on data standard information corresponding to fields to obtain target database statements that match data security incident information. Moreover, based on other information about the target database statements, further filtering can be applied to narrow down the scope of data security incident sources and obtain detailed information about the source of the data security incident. For example, fine-grained similarity analysis can be performed on the target database statements, or abnormal behavior of users associated with the target database statements can be audited.

[0093] In the embodiments of this application, the database statements in the historical query logs contain corresponding user information. The user information corresponding to the database statements is used to identify the user who performed the database query using that statement. It also includes: determining the source database statement and the source user of the leaked data information based on the target database statement and the user information corresponding to the target database statement.

[0094] Based on the user information corresponding to the target database statement, the system can query other database statements for that user in the historical query log and analyze whether the user has engaged in any data security incident behavior. For example, if a large number of database statements querying the same data are detected for that user information, or if the user information uses non-compliant database statements for data queries, then the target database statement and the corresponding user are identified as high-probability sources of the leaked data.

[0095] By using leaked data and sensitive data features of database statements in historical query logs for initial screening, the workload of secondary screening is reduced. The target database statements are then identified, and secondary screening is performed using the corresponding user information to further narrow down the sources of the leaked data, improving the accuracy of identifying the source database statements and users.

[0096] Based on the above-described data security incident handling method, this application also provides a data security incident handling apparatus. The following will be combined with... Figure 4 The device is described in detail.

[0097] Figure 4 A schematic block diagram of a data security incident processing apparatus according to an embodiment of this application is shown.

[0098] like Figure 4 As shown, the data security event processing device 400 of this embodiment includes an acquisition module 410, a determination module 420, a generation module 430, and a processing module 440.

[0099] The acquisition module 410 is used to acquire the fields included in the data security event information in the event of a data security event.

[0100] The determination module 420 is used to determine the data standard information corresponding to the fields based on a preset set of sensitive data standards and fields. The set of sensitive data standards includes multiple fields and the data standard information corresponding to each field. The data standard information is the unified standard name of the field.

[0101] The generation module 430 is used to generate the first sensitive data feature of data security event information based on the data standard information corresponding to the field.

[0102] The processing module 440 is used to determine the target database statement corresponding to the data security event information based on the historical query log. The historical query log includes the database statement that has been queried and the second sensitive data feature of the database statement. The first sensitive data feature matches the second sensitive data feature of the target database statement.

[0103] In the embodiments of this application, the first sensitive data feature is hexadecimal data. The generation module 430 generates the first sensitive data feature of the data security event information based on the data standard information corresponding to the field in the following manner: Based on the data standard information corresponding to the field, target binary data is generated. The target binary data includes multiple binary bits. The binary bits of the target binary data correspond one-to-one with the data standard information in the sensitive data standard set. The binary bits in the target binary data corresponding to the data standard information corresponding to the field are 1. The target binary data feature is converted to a base to obtain the first sensitive data feature.

[0104] In the embodiments of this application, the processing module 440 determines the target database statement corresponding to the data security event information based on the historical query log in the following manner: obtaining the target binary data corresponding to the first sensitive data feature and the binary data corresponding to the second sensitive data feature in the historical query log; performing similarity calculation on the target binary data and the binary data corresponding to the second sensitive data feature to determine the similarity score between the first sensitive data feature and the second sensitive data feature; selecting at least one second sensitive data feature with the highest similarity score, and using the database statement corresponding to at least one second sensitive data feature as the target database statement.

[0105] In the embodiments of this application, the database statements in the historical query logs contain corresponding user information. The device 400 also includes a secondary processing module, which is used to: determine the source database statement and the source user of the leaked data security event information based on the target database statement and the user information corresponding to the target database statement.

[0106] In embodiments of this application, the apparatus further includes a second sensitive data feature generation module, which is configured to: in response to a query using a database statement, obtain the query result fields of the database statement and determine the source table fields associated with the query result fields; detect the data standard information of the source table fields; if the data standard information corresponding to the source table fields is detected, set the data standard information corresponding to the query result fields as the data standard information corresponding to the source table fields; and generate a second sensitive data feature of the database statement based on the data standard information corresponding to the query result fields.

[0107] In the embodiments of this application, binary bits have similarity weights. Similarity calculation is performed on the target binary data and the binary data corresponding to the second sensitive data feature. The generation module 430 determines the similarity score between the first sensitive data feature and the second sensitive data feature in the following way: determining the binary bits that are both 1 in the binary numbers corresponding to the target binary data and the second sensitive data feature; determining the similarity weight of the binary bits that are both 1, and weighting and summing the binary bits that are both 1 based on the similarity to obtain the similarity score between the target binary data and the binary data corresponding to the second sensitive data feature.

[0108] According to embodiments of this application, any multiple modules among the acquisition module 410, determination module 420, generation module 430, and processing module 440 can be combined into one module, or any one of these modules can be split into multiple modules. Alternatively, at least part of the functionality of one or more of these modules can be combined with at least part of the functionality of other modules and implemented in one module. According to embodiments of this application, at least one of the acquisition module 410, determination module 420, generation module 430, and processing module 440 can be at least partially implemented as hardware circuitry, such as a field-programmable gate array (FPGA), programmable logic array (PLA), system-on-a-chip, system-on-a-substrate, system-on-package, application-specific integrated circuit (ASIC), or any other reasonable means of integrating or packaging circuitry, or implemented in software, hardware, or firmware, or in any appropriate combination of any of these three implementation methods. Alternatively, at least one of the acquisition module 410, determination module 420, generation module 430, and processing module 440 can be at least partially implemented as a computer program module, which can perform corresponding functions when the computer program module is run.

[0109] Figure 5 A block diagram schematically illustrates an electronic device suitable for implementing a data security incident handling method according to an embodiment of this application.

[0110] like Figure 5As shown, an electronic device 500 according to an embodiment of this application includes a processor 501, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 502 or a program loaded from a storage portion 508 into a random access memory (RAM) 503. The processor 501 may include, for example, a general-purpose microprocessor (e.g., a CPU), an instruction set processor and / or an associated chipset and / or a special-purpose microprocessor (e.g., an application-specific integrated circuit (ASIC)), etc. The processor 501 may also include onboard memory for caching purposes. The processor 501 may include a single processing unit or multiple processing units for performing different actions of the method flow according to an embodiment of this application.

[0111] RAM 503 stores various programs and data required for the operation of electronic device 500. Processor 501, ROM 502, and RAM 503 are interconnected via bus 504. Processor 501 executes various operations of the method flow according to embodiments of this application by executing programs in ROM 502 and / or RAM 503. It should be noted that programs may also be stored in one or more memories other than ROM 502 and RAM 503. Processor 501 may also execute various operations of the method flow according to embodiments of this application by executing programs stored in one or more memories.

[0112] According to embodiments of this application, the electronic device 500 may further include an input / output (I / O) interface 505, which is also connected to a bus 504. The electronic device 500 may also include one or more of the following components connected to the input / output (I / O) interface 505: an input section 506 including a keyboard, mouse, etc.; an output section 507 including a cathode ray tube (CRT), liquid crystal display (LCD), etc., and a speaker, etc.; a storage section 508 including a hard disk, etc.; and a communication section 509 including a network interface card such as a LAN card, modem, etc. The communication section 509 performs communication processing via a network such as the Internet. A drive 510 is also connected to the input / output (I / O) interface 505 as needed. A removable medium 511, such as a disk, optical disk, magneto-optical disk, semiconductor memory, etc., is installed on the drive 510 as needed so that computer programs read from it can be installed into the storage section 508 as needed.

[0113] This application also provides a computer-readable storage medium, which may be included in the device / apparatus / system described in the above embodiments; or it may exist independently and not assembled into the device / apparatus / system. The computer-readable storage medium carries one or more programs, which, when executed, implement the method according to the embodiments of this application.

[0114] According to embodiments of this application, the computer-readable storage medium can be a non-volatile computer-readable storage medium, such as including but not limited to: portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof. In this application, the computer-readable storage medium can be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, apparatus, or device. For example, according to embodiments of this application, the computer-readable storage medium may include ROM 502 and / or RAM 503 and / or one or more memories other than ROM 502 and RAM 503 described above.

[0115] Embodiments of this application also include a computer program product comprising a computer program containing program code for performing the methods shown in the flowchart. When the computer program product is run on a computer system, the program code enables the computer system to implement the data security event handling method provided in the embodiments of this application.

[0116] When the computer program is executed by the processor 501, it performs the functions defined in the system / apparatus of this application embodiment. According to the embodiments of this application, the systems, apparatuses, modules, units, etc., described above can be implemented by computer program modules.

[0117] In one embodiment, the computer program may rely on a tangible storage medium such as an optical storage device or a magnetic storage device. In another embodiment, the computer program may also be transmitted and distributed in the form of signals over a network medium, and may be downloaded and installed via the communication section 509, and / or installed from a removable medium 511. The program code contained in the computer program can be transmitted using any suitable network medium, including but not limited to: wireless, wired, etc., or any suitable combination thereof.

[0118] In such an embodiment, the computer program can be downloaded and installed from a network via communication section 509, and / or installed from removable medium 511. When the computer program is executed by processor 501, it performs the functions defined in the system of this application embodiment. According to embodiments of this application, the systems, devices, apparatuses, modules, units, etc., described above can be implemented by computer program modules.

[0119] According to embodiments of this application, program code for executing the computer programs provided in the embodiments of this application can be written in any combination of one or more programming languages. Specifically, these computational programs can be implemented using high-level procedural and / or object-oriented programming languages, and / or assembly / machine languages. Programming languages ​​include, but are not limited to, languages ​​such as Java, C++, Python, "C", or similar programming languages. The program code can be executed entirely on the user's computing device, partially on the user's device, partially on a remote computing device, or entirely on a remote computing device or server. In cases involving remote computing devices, the remote computing device can be connected to the user's computing device via any type of network, including a local area network (LAN) or a wide area network (WAN), or it can be connected to an external computing device (e.g., via the Internet using an Internet service provider).

[0120] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of this application. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in a block diagram or flowchart, and combinations of blocks in a block diagram or flowchart, may be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.

[0121] Those skilled in the art will understand that the features described in the various embodiments of this application can be combined and / or combined in various ways, even if such combinations or combinations are not explicitly described in this application. In particular, the features described in the various embodiments of this application can be combined and / or combined in various ways without departing from the spirit and teachings of this application. All such combinations and / or combinations fall within the scope of this application.

Claims

1. A method for handling data security incidents, characterized in that, The method includes: In the event of a data security incident, the fields included in obtaining data security incident information; Based on a preset set of sensitive data standards and the field, the data standard information corresponding to the field is determined. The set of sensitive data standards includes multiple fields and the data standard information corresponding to each of the multiple fields. The data standard information is the unified standard name of the field. Based on the data standard information corresponding to the field, the first sensitive data feature of the data security event information is generated; Based on historical query logs, the target database statement corresponding to the data security event information is determined. The historical query logs include database statements that have been used for database queries and the second sensitive data feature of the database statements. The first sensitive data feature matches the second sensitive data feature of the target database statement.

2. The method according to claim 1, characterized in that, The first sensitive data feature is hexadecimal data. The step of generating the first sensitive data feature of the data security event information based on the data standard information corresponding to the field includes: Based on the data standard information corresponding to the field, target binary data is generated. The target binary data includes multiple binary bits. The binary bits of the target binary data correspond one-to-one with the data standard information in the sensitive data standard set. The binary bits in the target binary data that correspond to the data standard information corresponding to the field are 1. The target binary data feature is converted into a number system to obtain the first sensitive data feature.

3. The method according to claim 2, characterized in that, The step of determining the target database statement corresponding to the data security event information based on historical query logs includes: Obtain the target binary data corresponding to the first sensitive data feature and the binary data corresponding to the second sensitive data feature in the historical query log; The similarity between the target binary data and the binary data corresponding to the second sensitive data feature is calculated to determine the similarity score between the first sensitive data feature and the second sensitive data feature. Select at least one second sensitive data feature with the highest similarity score, and use the database statement corresponding to the at least one second sensitive data feature as the target database statement.

4. The method according to claim 1, characterized in that, The database statements in the historical query log contain corresponding user information, and the method further includes: Based on the target database statement and the user information corresponding to the target database statement, the source database statement and the source user that leaked the data security incident information are determined.

5. The method according to claim 1, characterized in that, The method further includes: In response to a query performed using a database statement, the query result fields of the database statement are obtained, and the source table fields associated with the query result fields are determined; Detect the data standard information of the fields in the source table; If the data standard information corresponding to the source table field is detected, the data standard information corresponding to the query result field is set as the data standard information corresponding to the source table field. Based on the data standard information corresponding to the fields in the query results, a second sensitive data feature of the database statement is generated.

6. The method according to claim 3, characterized in that, The binary bits have similarity weights. The step of calculating the similarity between the target binary data and the binary data corresponding to the second sensitive data feature, and determining the similarity score between the first sensitive data feature and the second sensitive data feature, includes: Determine the binary bits that are both 1 in the binary numbers corresponding to the target binary data and the second sensitive data feature; The similarity weights of the binary bits that are both 1 are determined, and the binary bits that are both 1 are weighted and summed based on the similarity to obtain the similarity score between the target binary data and the binary data corresponding to the second sensitive data feature.

7. A data security incident handling device, characterized in that, The device includes: The acquisition module is used to acquire the fields included in the data security incident information in the event of a data security incident. The determination module is used to determine the data standard information corresponding to the field based on a preset set of sensitive data standards and the field. The set of sensitive data standards includes multiple fields and the data standard information corresponding to each of the multiple fields. The data standard information is the unified standard name of the field. The generation module is used to generate the first sensitive data feature of the data security event information based on the data standard information corresponding to the field; The processing module is used to determine the target database statement corresponding to the data security event information based on historical query logs. The historical query logs include database statements that have been used for database queries and a second sensitive data feature of the database statements. The first sensitive data feature matches the second sensitive data feature of the target database statement.

8. An electronic device, comprising: One or more processors; Memory, used to store one or more computer programs. The characteristic feature is that the one or more processors execute the one or more computer programs to implement the steps of the method according to any one of claims 1-6.

9. A computer-readable storage medium having a computer program or instructions stored thereon, characterized in that, When the computer program or instructions are executed by a processor, they implement the steps of the method according to any one of claims 1-6.

10. A computer program product, comprising a computer program or instructions, characterized in that, When the computer program or instructions are executed by a processor, they implement the steps of the method according to any one of claims 1-6.

Images