File outgoing detection method and system

Abstract

The invention discloses a file outgoing detection method and system, and the method comprises the steps: positioning and monitoring terminal equipment corresponding to a target detection file; calling a behavior information storage library, wherein the behavior information storage library is stored in a remote end distributed account book corresponding to the terminal equipment; searching file read-write behavior information of the target user within a first preset time interval based on the information storage library, the file read-write behavior information being whether the target user has a file read-write behavior within the first preset time interval; s4, if the file read-write behavior exists, calling an interaction log of the target user through the interaction software within a first preset time interval, and obtaining information transmission state characteristics of each file transmission channel corresponding to the terminal equipment within a second preset time interval after the file read-write behavior occurs; and S5, according to the interaction log and the information transmission state feature, judging whether the target user has a file out-of-issue behavior. Therefore, file outgoing detection can be accurately and reliably carried out.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of file sending detection, and particularly relates to a file sending detection method and a file sending detection system. BACKGROUND

[0002] In an office environment, some confidential files are usually stored in corresponding terminal devices / network disks, and office personnel usually read and write the confidential files based on the terminal devices when the office personnel need to call the confidential files. However, when the office personnel read and write, the confidential files may be sent out for selfish interests, thereby seriously damaging the interests of the company.

[0003] In the related art, when file sending detection is performed, it is usually detected whether sensitive content exists in the sent file, and then the file with the sensitive content is intercepted. However, when the file sending detection is performed in this way, the accuracy and reliability are low. SUMMARY

[0004] The present application provides a file sending detection method, which can accurately and reliably perform file sending detection.

[0005] The technical scheme adopted by the present application is as follows: A file sending detection method comprises the following steps: S1, positioning and monitoring a terminal device corresponding to a target detection file, wherein the terminal device is used to read the target detection file; S2, after receiving a first behavior detection command, calling a behavior information storage library; wherein the behavior information storage library is stored in a remote end distributed ledger corresponding to the terminal device; S3, setting a first preset time interval, and searching file read-write behavior information of a target user in the first preset time interval based on the information storage library, wherein the file read-write behavior information is whether the target user has file read-write behavior in the first preset time interval; S4, if the file read-write behavior exists, calling an interaction log of the target user through interactive software in the first preset time interval, and obtaining information transmission state features of each file transmission channel corresponding to the terminal device in a second preset time interval after the file read-write behavior occurs; S5, judging whether the target user has file sending behavior according to the interaction log and the information transmission state features.

[0006] In one embodiment of the present application, before step S2, the file sending detection method further comprises the following steps: S11, when the target user reads the target detection file based on the terminal device, transmitting a file reading indication to the remote end at the same time; S12, according to the file reading indication, saving user information of the target user and detailed time data of the target user from clicking to read the target detection file to closing the target detection file, and generating time mark data according to the detailed time data; S13, and building the information repository according to the time mark data and the corresponding user information.

[0007] In one embodiment of the present application, step S5 specifically comprises the following steps: S510, using a text processing technique to extract core words and attitude tendencies in the interaction log, and classifying the interaction log into office logs and non-office logs according to the core words and the attitude tendencies; S520, calculating a ratio of the non-office logs to the office logs in the first preset time interval; S530, if the ratio of the non-office logs to the office logs is greater than a preset ratio, determining whether the target user has a file sending behavior according to the information transmission state feature.

[0008] In one embodiment of the present application, step S530 specifically comprises the following steps: S531, calculating a pulse count value of the mth file transmission channel according to the information transmission state feature of the mth file transmission channel; S532, calculating a throughput of the mth file transmission channel according to the pulse count value of the mth file transmission channel; S533, if the throughput of the mth file transmission channel is less than or equal to a preset throughput, determining that the target user has a file sending behavior.

[0009] In one embodiment of the present application, the information transmission state feature comprises a time for which information has been transmitted on the mth file transmission channel, and step S531 specifically comprises calculating the pulse count value by the following formula: , wherein, is a clock frequency, is the time for which information has been transmitted on the mth file transmission channel, is the pulse count value of the mth file transmission channel.

[0010] In one embodiment of the present application, step S532 specifically comprises calculating the throughput by the following formula: , wherein, is the throughput of the mth file transmission channel at the kth moment, An information amount delivered by the terminal device to the network at the k moment for the mth file transmission channel, An information amount delivered by the network to the terminal device at the k moment for the mth file transmission channel, A pulse count value at the k moment for the mth file transmission channel.

[0011] A file external sending detection system, comprising: a positioning module, used for positioning and monitoring a terminal device corresponding to a target detection file, wherein the terminal device is used for reading the target detection file; a calling module, used for calling a behavior information repository after receiving a first behavior detection command; wherein the behavior information repository is stored in a remote end distributed ledger corresponding to the terminal device; a searching module, used for setting a first preset time interval, and searching file read-write behavior information of a target user within the first preset time interval based on the information repository, wherein the file read-write behavior information is whether the target user has file read-write behavior within the first preset time interval; an obtaining module, used for calling an interactive log of the target user through interactive software within the first preset time interval when the file read-write behavior exists, and obtaining information transmission state features of each file transmission channel corresponding to the terminal device within a second preset time interval after the file read-write behavior occurs; and a judging module, used for judging whether the target user has file external sending behavior according to the interactive log and the information transmission state features.

[0012] A computer device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the file external sending detection method described above when executing the computer program.

[0013] A non-transitory computer readable storage medium, having a computer program stored thereon, the program being executable by a processor to implement the file external sending detection method described above.

[0014] The beneficial effects of the present application are: (1) The present application stores an information repository in a distributed ledger of a remote end corresponding to a terminal device, which can meet the calling demand in real time, and can effectively avoid the situation that user behavior cannot be accurately obtained due to terminal device logs being artificially modified; (2) The present application uses interactive logs and information transmission state features to determine whether a target user has file external sending behavior, which can greatly improve the accuracy and reliability of detection. BRIEF DESCRIPTION OF DRAWINGS

[0015] Figure 1 A flowchart of the file external sending detection method of the embodiments of the present application; Figure 2 A block schematic diagram of a file sending-out detection system according to an embodiment of the present application. DETAILED DESCRIPTION

[0016] The technical solutions in the embodiments of the present application will be clearly and completely described with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are only a part of the embodiments of the present application, but not all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by a person of ordinary skill in the art without creative work fall within the protection scope of the present application.

[0017] Figure 1 A flowchart of a file sending-out detection method according to an embodiment of the present application.

[0018] As shown in Figure 1 the file sending-out detection method according to an embodiment of the present application can include the following steps: S1, positioning and monitoring a terminal device corresponding to a target detection file. The terminal device is used to read the target detection file.

[0019] In particular, the internal employee can enter the address where the target detection file is stored by verifying the identity, and read the target detection file.

[0020] S2, after receiving a first behavior detection command, calling a behavior information repository. The behavior information repository is stored in a remote end distributed ledger corresponding to the terminal device.

[0021] In the prior art, when a user performs a series of operations based on a terminal device, the user behavior can be monitored by checking logs. However, in actual application, the logs are easy to be considered as modified, so that the user behavior cannot be accurately obtained by checking the logs. Therefore, the present application can accurately obtain the behavior track of the target user by calling the behavior information repository stored in the remote end distributed ledger corresponding to the terminal device, and querying the user behavior from the behavior information database.

[0022] In particular, before calling the behavior information repository, the information repository can be built. That is, in an embodiment of the present application, before step S2, the file sending-out detection method further includes the following steps: S11, when the target user reads the target detection file based on the terminal device, simultaneously transmitting a file reading instruction to the remote end.

[0023] S12, according to the file reading and writing instruction, save the user profile of the target user and detailed time data from the target user clicking to read the target detection file to closing the target detection file, and generate time mark data according to the detailed time data.

[0024] The time mark data can be a time interval, wherein the start time of the time mark data is the time when the target user clicks to read the target detection file, and the end time of the time mark data is the time when the target user closes the target detection file. The time interval corresponding to the time mark data can be represented by the time corresponding to each moment, for example, 2025-01-01 01:01:01~2025-01-01 01:15:01.

[0025] S13, according to the time mark data and the corresponding user profile, build an information repository.

[0026] Specifically, the time mark data and the user profile can be corresponded and stored in the information repository, that is, the information repository can store information about the specific user's file reading and writing behavior at what time.

[0027] Therefore, the information repository stored in the distributed ledger of the remote end corresponding to the terminal device can meet the calling demand in real time, and the situation that the user behavior cannot be accurately obtained due to the terminal device log being artificially modified can be effectively avoided.

[0028] S3, set a first preset time interval, and search for file reading and writing behavior information of the target user in the first preset time interval based on the information repository, wherein the file reading and writing behavior information is whether the target user has file reading and writing behavior in the first preset time interval.

[0029] The first preset time interval can be calibrated according to actual conditions.

[0030] S4, if there is file reading and writing behavior, call the interaction log of the target user through the interaction software in the first preset time interval, and obtain the information transmission state characteristics of each file transmission channel corresponding to the terminal device in a second preset time interval after the file reading and writing behavior occurs.

[0031] S5, according to the interaction log and the information transmission state characteristics, judge whether the target user has file sending behavior.

[0032] In an embodiment of the present application, step S5 specifically includes the following steps: S510, using text processing technology to extract core words and attitude tendency in the interaction log, and according to the core words and attitude tendency, the interaction log is summarized as office log and non-office log.

[0033] Specifically, the text processing technology is a core technology in the prior art for text / document processing and text processing. Not only can it cluster / classify texts according to core words and themes in the texts, but also can analyze the attitude tendency of the texts according to the core words. For example, "Hello, the project file will be modified according to your modification suggestions", "The project is progressing very smoothly, thank you for the leadership cultivation", through the text processing technology, the core words "project progress", "modification suggestion", "hello", "leadership" and "cultivation" are extracted, among which, according to "hello", "leadership" and "cultivation", it can be judged that the attitude tendency of this part of the interactive log is serious and respectful, and according to the attitude tendency and the core words "project progress" and "modification suggestion", it can be judged that this part of the interactive log is an office log, and the content in the interactive log other than the office log is a non-office log.

[0034] S520, calculating the ratio of the non-office log to the office log in the first preset time interval.

[0035] S530, if the ratio of the non-office log to the office log is greater than a preset ratio, determining whether the target user has a file external sending behavior according to the information transmission state characteristics.

[0036] Specifically, the behavior of the target user in the first preset time interval is analyzed by judging the ratio of the non-office log to the office log in the first preset time interval. If the ratio of the non-office log to the office log is less than or equal to a preset ratio, it means that the target user is in office hours in the first preset time interval, therefore, even if the target user has a file external sending behavior in the time interval, it is to meet the office needs, and it is determined as internal file transmission, and no interception / warning is needed; if the ratio of the non-office log to the office log is greater than the preset ratio, it means that the target user is in non-office hours in the first preset time interval, and if the target user has a file external sending behavior in the time interval, it is highly likely that the target detection file is sent to external personnel, therefore, it is necessary to determine whether the target user has a file external sending behavior according to the information transmission state characteristics. Specifically, in an embodiment of the present application, step S530 specifically comprises the following steps: S531, calculating the pulse count value of the mth file transmission channel according to the information transmission state characteristics of the mth file transmission channel.

[0037] In an embodiment of the present application, the information transmission state characteristics include the time when the information has been transmitted on the mth file transmission channel. The time when the information has been transmitted on the mth file transmission channel is the time difference between the current transmission time and the initial transmission time in the process of transmitting the information on the mth file transmission channel. Step S531 specifically comprises calculating the pulse count value by the following formula: , wherein, is a clock frequency, is a time when information has been delivered on the mth file transfer channel, is a pulse count value of the mth file transfer channel.

[0038] S532, according to the pulse count value of the mth file transfer channel, calculating the throughput of the mth file transfer channel.

[0039] In an embodiment of the present application, step S532 specifically comprises calculating the throughput by the following formula: , wherein, is the throughput of the mth file transfer channel at k time, is the amount of information delivered by the terminal device to the network at k time of the mth file transfer channel, is the amount of information delivered by the network to the terminal device at k time of the mth file transfer channel, is the pulse count value of the mth file transfer channel at k time.

[0040] S533, if the throughput of the mth file transfer channel is less than or equal to the preset throughput, it is judged that the target user exists file external sending behavior.

[0041] Therefore, before judging whether the target user exists file external sending behavior, the present application first judges whether the target user is in office behavior state or in non-office behavior state when file reading and writing behavior occurs, if in office behavior state, no file external sending behavior detection is needed in the second preset time interval, if in non-office behavior state, file external sending behavior detection is performed in the second preset time interval, so that the situation that all external sending files are intercepted by traditional file external sending detection and thus normal office demand is affected can be effectively avoided. And when the target user is in non-office behavior state, according to information delivery state characteristics, whether the target user exists file external sending behavior is judged in the second preset time interval, if file external sending behavior exists, prewarning is performed, or the target detection file is intercepted, compared with the traditional way of detecting external sending file by detecting whether sensitive content exists in the external sending file, the situation that accurate detection cannot be performed due to external sending file disguising can be effectively avoided, compared with the traditional detection way, the accuracy and reliability of the present application are higher.

[0042] In summary, according to the file sending-out detection method of the embodiment of the present application, the terminal device corresponding to the target detection file is located and monitored, wherein the terminal device is used to read the target detection file, and the behavior information repository is called after receiving the first behavior detection command; wherein the behavior information repository is stored in the remote end distributed ledger corresponding to the terminal device, a first preset time interval is set, and the file read-write behavior information of the target user within the first preset time interval is searched based on the information repository, wherein the file read-write behavior information is whether the target user has file read-write behavior within the first preset time interval, if the file read-write behavior exists, the interaction log of the target user through the interaction software within the first preset time interval is called, and the information transmission state characteristics of each file transmission channel corresponding to the terminal device within a second preset time interval after the file read-write behavior occurs are obtained, and whether the target user has file sending-out behavior is determined according to the interaction log and the information transmission state characteristics. Therefore, the file sending-out detection can be accurately and reliably performed.

[0043] Corresponding to the file sending-out detection method of the above embodiment, the present application further provides a file sending-out detection system.

[0044] As shown in Figure 2 , the file sending-out detection system of the embodiment of the present application can include a locating module 100, a calling module 200, a searching module 300, an obtaining module 400 and a judging module 500.

[0045] The locating module 100 is used to locate and monitor the terminal device corresponding to the target detection file, wherein the terminal device is used to read the target detection file; the calling module 200 is used to call the behavior information repository after receiving the first behavior detection command; wherein the behavior information repository is stored in the remote end distributed ledger corresponding to the terminal device; the searching module 300 is used to set a first preset time interval, and search the file read-write behavior information of the target user within the first preset time interval based on the information repository, wherein the file read-write behavior information is whether the target user has file read-write behavior within the first preset time interval; the obtaining module 400 is used to call the interaction log of the target user through the interaction software within the first preset time interval when the file read-write behavior exists, and obtain the information transmission state characteristics of each file transmission channel corresponding to the terminal device within a second preset time interval after the file read-write behavior occurs; and the judging module 500 is used to determine whether the target user has file sending-out behavior according to the interaction log and the information transmission state characteristics.

[0046] In one embodiment of the present application, the calling module 200 is specifically configured to: when the target user reads the target detection file based on the terminal device, simultaneously transmit a file reading instruction to the remote end; according to the file reading and writing instruction, save user information of the target user and detailed time data of the target user from clicking to read the target detection file to closing the target detection file, and generate time mark data according to the detailed time data; and build an information storage library according to the time mark data and the corresponding user information.

[0047] In one embodiment of the present application, the judging module 500 is specifically configured to: extract core words and attitude tendencies in the interaction log by using a text processing technology, and classify the interaction log into an office log and a non-office log according to the core words and the attitude tendencies; calculate a ratio of the non-office log to the office log in the first preset time interval; and if the ratio of the non-office log to the office log is greater than a preset ratio, determine whether the target user has a file external sending behavior according to the information transmission state feature.

[0048] In one embodiment of the present application, the judging module 500 is specifically configured to: calculate a pulse count value of the mth file transmission channel according to the information transmission state feature of the mth file transmission channel; calculate a throughput of the mth file transmission channel according to the pulse count value of the mth file transmission channel; and if the throughput of the mth file transmission channel is less than or equal to a preset throughput, determine that the target user has a file external sending behavior.

[0049] In one embodiment of the present application, the information transmission state feature includes a time for which information has been transmitted on the mth file transmission channel, and the judging module 500 is specifically configured to calculate the pulse count value by the following formula: , wherein, is a clock frequency, is the time for which information has been transmitted on the mth file transmission channel, is the pulse count value of the mth file transmission channel.

[0050] In one embodiment of the present application, the judging module 500 is specifically configured to calculate the throughput by the following formula: , wherein, is the throughput of the mth file transmission channel at the kth moment, is an amount of information transmitted by the terminal device to the network at the kth moment of the mth file transmission channel, is an amount of information transmitted by the network to the terminal device at the kth moment of the mth file transmission channel, is the pulse count value of the mth file transmission channel at the kth moment.

[0051] It should be noted that the details of the file sending-out detection system of the embodiments of the present application are not disclosed, please refer to the details disclosed in the above-mentioned file sending-out detection method, and the details will not be described here in detail.

[0052] According to the file sending-out detection system of the embodiments of the present application, the terminal device corresponding to the target detection file is positioned and monitored by the positioning module, wherein the terminal device is used to read the target detection file, the behavior information repository is called by the calling module after receiving the first behavior detection command; wherein the behavior information repository is stored in the remote end distributed ledger corresponding to the terminal device; the first preset time interval is set by the searching module, and the file reading and writing behavior information of the target user within the first preset time interval is searched based on the information repository, wherein the file reading and writing behavior information is whether the target user has file reading and writing behavior within the first preset time interval, the interaction log of the target user through the interactive software within the first preset time interval is called by the obtaining module when the file reading and writing behavior exists, and the information transmission state characteristics of each file transmission channel corresponding to the terminal device within the second preset time interval after the file reading and writing behavior occurs are obtained, and the target user whether exists file sending-out behavior is judged by the judging module according to the interaction log and the information transmission state characteristics. Therefore, the file sending-out detection can be accurately and reliably performed.

[0053] Corresponding to the above-mentioned embodiments, the present application further proposes a computer device, comprising a memory, a processor and a computer program stored on the memory and executable on the processor, wherein the processor executes the computer program to realize the above-mentioned file sending-out detection method.

[0054] According to the computer device of the embodiments of the present application, the file sending-out detection can be accurately and reliably performed.

[0055] Corresponding to the above-mentioned embodiments, the present application further proposes a non-transitory computer readable storage medium, which stores a computer program, and the program is executed by a processor to realize the above-mentioned file sending-out detection method.

[0056] According to the non-transitory computer readable storage medium of the embodiments of the present application, the file sending-out detection can be accurately and reliably performed.

[0057] In the description of the present application, the terms "first", "second" are only used for description purpose, and cannot be understood as indicating or implying relative importance or implicitly indicating the number of indicated technical features. Therefore, the features limited by "first", "second" can explicitly or implicitly include one or more features. The meaning of "a plurality of" is two or more, unless otherwise specifically limited.

[0058] In the present application, unless specifically defined otherwise and limited, the terms "mount", "connected", "connection", "fixed", and the like should be construed as being broadly, for example, it can be fixed connection, or detachable connection, or integrated; it can be mechanical connection, or electrical connection; it can be directly connected, or indirectly connected through an intermediate medium, or it can be the internal communication of two elements or the interaction relationship between two elements. For those skilled in the art, the specific meaning of the above terms in the present application can be understood according to the specific circumstances.

[0059] In the present application, unless specifically defined otherwise and limited, the first feature is "on" or "under" the second feature. The first and second features can be in direct contact, or the first and second features can be indirectly in contact through an intermediate medium. Moreover, the first feature "above", "over" and "on" the second feature can be the first feature directly above or obliquely above the second feature, or only indicates that the horizontal height of the first feature is higher than that of the second feature. The first feature "below", "under" and "under" the second feature can be the first feature directly below or obliquely below the second feature, or only indicates that the horizontal height of the first feature is less than that of the second feature.

[0060] In the description of the present application, the description of the terms "one embodiment", "some embodiments", "example", "specific example", or "some examples" means that the specific features, structures, materials or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the present application. In the present application, the illustrative description of the above terms does not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described can be combined in any appropriate manner in any one or more embodiments or examples. In addition, those skilled in the art can combine and combine different embodiments or features of different embodiments or examples described in the present application without contradiction.

[0061] In addition, each functional unit in each embodiment of the present application can be integrated in one processing module, or each unit can be physically present separately, or two or more units can be integrated in one module. The integrated module can be realized in the form of hardware or in the form of a software function module. The integrated module, if realized in the form of a software function module and sold or used as an independent product, can also be stored in a computer readable storage medium.

[0062] Although the embodiments of the present application have been shown and described above, it should be understood that the above embodiments are exemplary and cannot be construed as limiting the present application, and those skilled in the art can make changes, modifications, replacements and variations to the above embodiments within the scope of the present application.

Claims

1. A method for detecting file outreach, characterized in that, Includes the following steps: S1, Locate and monitor the terminal device corresponding to the target detection file, wherein the terminal device is used to read the target detection file; S2, after receiving the first behavior detection command, invoke the behavior information repository; wherein, the behavior information repository is stored in the remote distributed ledger corresponding to the terminal device; S3, set a first preset time interval, and search for the target user's file read / write behavior information within the first preset time interval based on the information repository, wherein the file read / write behavior information is whether the target user has file read / write behavior within the first preset time interval; S4, if the file read / write behavior exists, retrieve the interaction log of the target user through the interactive software within the first preset time interval, and obtain the information transmission status characteristics of each file transmission channel corresponding to the terminal device within the second preset time interval after the file read / write behavior occurs. S5, determine whether the target user has engaged in file outreach behavior based on the interaction log and the information transmission status characteristics.

2. The method for detecting outward transmission of documents according to claim 1, characterized in that, Before step S2, the file outgoing detection method further includes the following steps: S11, when the target user reads the target detection file based on the terminal device, a file reading instruction is simultaneously transmitted to the remote end; S12, according to the file read / write instruction, save the user information of the target user and the detailed time data of the target user from clicking to read the target detection file to closing the target detection file, and generate time stamp data based on the detailed time data; S13, construct the information repository based on the timestamp data and the corresponding user information.

3. The method for detecting outward transmission of documents according to claim 1, characterized in that, Step S5 specifically includes the following steps: S510, using text processing technology to extract the core words and attitudes in the interaction log, and categorizing the interaction log into office logs and non-office logs based on the core words and attitudes. S520, Calculate the ratio of the non-office log to the office log within the first preset time interval; S530, if the ratio of the non-office log to the office log is greater than a preset ratio, then determine whether the target user has engaged in file outreach behavior based on the information transmission status characteristics.

4. The method for detecting outward transmission of documents according to claim 3, characterized in that, Step S530 specifically includes the following steps: S531, calculate the pulse count value of the m-th file transmission channel based on the information transmission status characteristics of the m-th file transmission channel; S532, calculate the throughput of the m-th file transfer channel based on the pulse count value of the m-th file transfer channel; S533, if the throughput of the m-th file transfer channel is less than or equal to the preset throughput, then it is determined that the target user has engaged in file transfer behavior.

5. The method for detecting outward transmission of documents according to claim 4, characterized in that, The information transmission status feature includes the time that the information has been transmitted on the m-th file transmission channel. Step S531 specifically includes calculating the pulse count value using the following formula: ， in, For clock frequency, Let m be the time that the information has been transmitted on the m-th file transfer channel. The pulse count value is the value of the m-th file transfer channel.

6. The method for detecting outward transmission of documents according to claim 5, characterized in that, Step S532 specifically includes calculating the throughput using the following formula: ， in, Let m be the throughput of the m-th file transfer channel at time k. Let m be the amount of information transmitted by the terminal device to the network at time k in the m-th file transfer channel. Let m be the amount of information transmitted from the network to the terminal device at time k via the m-th file transfer channel. Let be the pulse count value of the m-th file transfer channel at time k.

7. A document outreach detection system, characterized in that, include: A positioning module is used to locate and monitor the terminal device corresponding to the target detection file, wherein the terminal device is used to read the target detection file; The calling module is used to call the behavior information repository after receiving the first behavior detection command; wherein the behavior information repository is stored in the remote distributed ledger corresponding to the terminal device; The search module is used to set a first preset time interval and search for the file read and write behavior information of the target user within the first preset time interval based on the information repository. The file read and write behavior information refers to whether the target user has file read and write behavior within the first preset time interval. The acquisition module is used to retrieve the interaction log of the target user through the interactive software within the first preset time interval when the file read / write behavior exists, and to obtain the information transmission status characteristics of each file transmission channel corresponding to the terminal device within the second preset time interval after the file read / write behavior occurs. The judgment module is used to determine whether the target user has engaged in file outreach behavior based on the interaction log and the information transmission status characteristics.

8. A computer device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the computer program, it implements the file outgoing detection method according to any one of claims 1-6.

9. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that, When the program is executed by the processor, it implements the file outbound detection method according to any one of claims 1-6.

Images