Data processing method and device, terminal equipment and storage medium

Abstract

The invention provides a data processing method and device, terminal equipment and a storage medium, the method is applied to the technical field of computers, and the method comprises the following steps: monitoring an operation behavior of a file to obtain a file operation record of the file; determining file information of the file based on the file operation record, and performing sensitive word scanning on the file information to obtain a sensitive word scanning result; if the sensitive word scanning result indicates that the file information hits the sensitive word, a file processing type matched with the sensitive word is obtained based on a monitoring strategy, and the monitoring strategy is obtained and issued through server configuration; and processing the file according to the file processing type. According to the method, file monitoring can be performed in combination with the monitoring strategy issued by the server, cloud and terminal linkage is realized, and a more efficient and accurate data leakage prevention function is provided.

Description

Technical Field

[0001] This application relates to the field of computer technology, and more specifically, to data processing methods, apparatus, terminal devices and storage media in the field of computer technology. Background Technology

[0002] With the development of enterprise informatization, critical document data has become an important asset for enterprises, directly affecting their operations, decision-making, and competitiveness. Therefore, preventing the leakage of critical data and ensuring the tracking and auditing of critical document operations have become aspects that enterprises attach great importance to.

[0003] Typically, to monitor file operations, access logging is implemented at the system or application level to ensure that every time a user accesses a file, relevant access information is recorded, such as access time, user identity, and operation type. Regularly auditing these logs allows for the detection of abnormal access behavior and the implementation of appropriate measures. However, this method requires a large number of professional analysts to analyze and mine the logs, and it suffers from latency, making it difficult to promptly block unauthorized file operations upon detection of anomalies, thus posing a significant risk of critical data leakage. Summary of the Invention

[0004] This application provides a data processing method, apparatus, terminal device, and storage medium, which can effectively prevent the leakage of critical data.

[0005] Firstly, a data processing method is provided, comprising: monitoring file operation behavior to obtain file operation records of the file; determining file information of the file based on the file operation records, performing sensitive word scanning on the file information to obtain sensitive word scanning results; if the sensitive word scanning results indicate that the file information matches a sensitive word, then obtaining the file processing type matched by the sensitive word based on a monitoring strategy, wherein the monitoring strategy is obtained and issued through server configuration; and processing the file according to the file processing type.

[0006] In conjunction with the first aspect, in some possible implementations, the monitoring of file operation behavior to obtain file operation records includes: obtaining the monitoring policy issued by the server; invoking the file filtering driver to monitor the basic operation behavior of the file based on the file operation monitoring type in the monitoring policy, and obtaining file operation records.

[0007] In combination with the first aspect and the above implementation methods, in some possible implementation methods, the monitoring of file operation behavior to obtain the file operation record of the file includes: starting a monitoring process and loading a hook function, obtaining the user's call record of the target file operation interface, determining the file operation record based on the call record, wherein the hook function is associated with a set of file operation interfaces, and the set of file operation interfaces is determined according to the file operation monitoring type in the monitoring strategy issued by the server.

[0008] In combination with the first aspect and the above implementation methods, in some possible implementation methods, the monitoring of file operation behavior to obtain the file operation record of the file includes: calling the network filtering driver to monitor the network upload request of the file; in response to the redirected network upload request, obtaining the protocol type of the network upload request; parsing the network upload request according to the protocol type to obtain the file name, and generating the file operation record of the file according to the file name.

[0009] In conjunction with the first aspect and the above implementation methods, in some possible implementation methods, determining the file information of the file based on the file operation record includes: if the file operation record is a file outgoing operation, then extracting the file path and file content of the file according to the file operation record, and determining the file path and file content as the file information of the file; if the file operation record is not a file outgoing operation, then extracting the file path of the file according to the file operation record, and determining the file path as the file information of the file.

[0010] In combination with the first aspect and the above implementation methods, in some possible implementation methods, the monitoring of the operation behavior of the file, after obtaining the file operation record of the file, includes: generating a file iteration tree based on the node identifiers in the file operation record, wherein the node identifiers include one or more of the following: root node identifier, initial node identifier, following node identifier, and self node identifier.

[0011] In conjunction with the first aspect and the above implementation methods, in some possible implementation methods, generating a file iteration tree based on the node identifiers in the file operation record includes: obtaining a set of file operation nodes for the same file from the file operation record based on the root node identifier, the set of file operation nodes including at least two first file operation nodes; obtaining the number of categories of the initial node identifiers contained in the set of file operation nodes, and determining the number of paths in the file iteration tree based on the number of categories; determining a second file operation node as the root node of the file iteration tree and a third file operation node as a path branch node of the file iteration tree based on the root node identifier, initial node identifier, following node identifier, and self node identifier of each first file operation node; determining the arrangement order of the first file operation nodes based on the operation time of each first file operation node; and generating the file iteration tree based on the second file operation node, the third file operation node, the number of paths, and the arrangement order.

[0012] In combination with the first aspect and the above implementation methods, in some possible implementation methods, after generating the file iteration tree based on the node identifier in the file operation record, the process includes: in response to a file tracing instruction, obtaining the file operation record corresponding to the file tracing instruction from the file iteration tree.

[0013] In combination with the first aspect and the above implementation methods, in some possible implementation methods, processing the file based on the file processing type includes: if the file processing type is file blocking, then blocking the current operation behavior of the file.

[0014] In combination with the first aspect and the above implementation methods, in some possible implementation methods, the processing of the file based on the file processing type includes: if the file processing type is file approval, generating a file approval request; obtaining the approval result corresponding to the file approval request; if the approval result is approval passed, allowing the current operation of the file; if the approval result is approval failed, blocking the current operation of the file.

[0015] In combination with the first aspect and the above implementation methods, in some possible implementation methods, processing the file based on the file processing type includes: if the file processing type is file forensics, then uploading the file to the server.

[0016] In combination with the first aspect and the above implementation methods, in some possible implementation methods, processing the file based on the file processing type includes: if the file processing type is file auditing, then reporting the file operation record to the server.

[0017] By adopting the above technical solution, files containing sensitive information can be promptly identified and processed by monitoring file operation records and determining the file information used for sensitive word scanning. By matching the file processing type corresponding to sensitive words according to the monitoring policies issued by the server, different processing strategies can be determined according to different sensitive words, making data processing more flexible and meeting the security needs of different scenarios. By combining file monitoring with the monitoring policies issued by the server, cloud and terminal linkage is realized, achieving efficient and accurate data leakage prevention function.

[0018] Secondly, a data processing apparatus is provided, the apparatus comprising:

[0019] The monitoring unit is used to monitor the operation behavior of the file in order to obtain the file operation record of the file;

[0020] The scanning unit is used to determine the file information of the file based on the file operation record, perform sensitive word scanning on the file information, and obtain sensitive word scanning results;

[0021] The matching unit is used to obtain the file processing type matched by the sensitive word based on the monitoring strategy if the sensitive word scanning result indicates that the file information matches the sensitive word. The monitoring strategy is obtained and distributed through server configuration.

[0022] The processing unit is used to process the file according to the file processing type.

[0023] Thirdly, a terminal device is provided, comprising: a memory for storing executable program code; and a processor for calling and running the executable program code from the memory, causing the terminal device to execute the method described in the first aspect or any possible implementation thereof.

[0024] Fourthly, a computer program product is provided, comprising: computer program code, which, when run on a computer, causes the computer to perform the methods described in the first aspect or any possible implementation thereof.

[0025] Fifthly, a computer-readable storage medium is provided that stores computer program code, which, when executed on a computer, causes the computer to perform the methods described in the first aspect or any possible implementation thereof. Attached Figure Description

[0026] Figure 1 This is a system architecture diagram of a data processing method provided in an embodiment of this application;

[0027] Figure 2This is a flowchart illustrating a data processing method provided in an embodiment of this application;

[0028] Figure 3 This is a flowchart illustrating a data processing method provided in an embodiment of this application;

[0029] Figure 4 This is an example schematic diagram of a data processing method provided in an embodiment of this application;

[0030] Figure 5 This is a flowchart illustrating a data processing method provided in an embodiment of this application;

[0031] Figure 6 This is a schematic diagram of the structure of a data processing device provided in an embodiment of this application;

[0032] Figure 7 This is a schematic diagram of the structure of a terminal device provided in an embodiment of this application;

[0033] Figure 8 This is a schematic diagram of the structure of a terminal device provided in an embodiment of this application. Detailed Implementation

[0034] The technical solutions in this application will be clearly and thoroughly described below with reference to the accompanying drawings. In the description of the embodiments of this application, unless otherwise stated, " / " means "or," for example, A / B can mean A or B. "And / or" in the text is merely a description of the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent: A existing alone, A and B existing simultaneously, and B existing alone. Furthermore, in the description of the embodiments of this application, "multiple" refers to two or more than two.

[0035] Hereinafter, the terms "first" and "second" are used for descriptive purposes only and should not be construed as implying or suggesting relative importance or implicitly indicating the number of technical features indicated. Thus, a feature defined as "first" or "second" may explicitly or implicitly include one or more of that feature.

[0036] Please refer to Figure 1 , Figure 1 This is a system architecture diagram of a data processing method provided in an embodiment of this application. For example... Figure 1As shown in the embodiments of this application, a data processing system is proposed, which includes at least a server 10 and a data processing device 20. The server 10 is used to configure monitoring policies, distribute the monitoring policies to the data processing device 20, and receive data such as files and file operation records reported by the data processing device 20. The data processing device 20 is used to receive the monitoring policies distributed by the server 10; it is also used to monitor file operation behavior to obtain file operation records; determine file information based on the file operation records; perform sensitive word scanning on the file information to obtain sensitive word scanning results; if the sensitive word scanning results indicate that the file information matches a sensitive word, then obtain the file processing type matched by the sensitive word based on the monitoring policy; and process the file according to the file processing type. In this embodiment, the data processing device 20 can be a terminal, which may include, but is not limited to, mobile phones, personal computers, tablets, servers, handheld devices, vehicle-mounted devices, wearable devices, computing devices, or other processing devices connected to a wireless modem; it can also be a module on the terminal device used to implement the data processing method.

[0037] Furthermore, the data processing device 20 can also be used to generate a file iteration tree based on the node identifiers in the file operation record, wherein the node identifiers include one or more of the following: root node identifier, initial node identifier, following node identifier, and self node identifier; it can also be used to retrieve the file operation record corresponding to the file tracing instruction from the file iteration tree in response to the file tracing instruction.

[0038] Optionally, in this embodiment, the steps of generating a file iteration tree based on the node identifiers in the file operation record and obtaining the file operation record corresponding to the file tracing instruction from the file iteration tree are implemented by the data processing device 20. In other embodiments, the file operation record can also be reported to the server 10 by the data processing device 20; the server 10 receives the file operation record reported by the data processing device 10, generates a file iteration tree based on the node identifiers in the file operation record, and obtains the file operation record corresponding to the file tracing instruction from the file iteration tree in response to the file tracing instruction.

[0039] The data processing system in this embodiment monitors file operation records and determines file information for sensitive word scanning, enabling timely detection and processing of files containing sensitive information. By matching the file processing type corresponding to sensitive words according to the monitoring policy issued by the server, different processing strategies can be determined based on different sensitive words, making data processing more flexible and meeting the security needs of different scenarios. By combining the monitoring policy issued by the server for file monitoring, cloud and terminal linkage is achieved, realizing efficient and accurate data leakage prevention function.

[0040] based on Figure 1The system architecture shown below will be combined with... Figures 2-5 The data processing method provided in the embodiments of this application will be described in detail.

[0041] Please see Figure 2 This is a flowchart illustrating a data processing method provided in an embodiment of this application. Figure 2 As shown, the method in this application embodiment may include the following steps S101-S104.

[0042] S101, Monitor file operation behavior to obtain file operation records of the file;

[0043] The method provided in this application can be implemented using a computer program, which can be integrated into an application or run as a standalone utility application. This method can be applied to terminal devices such as mobile phones and personal computers, and also to vehicles or servers. This application example uses the method applied to a terminal device, where a data processing device is configured.

[0044] In some embodiments, file operations may include, but are not limited to, file creation, editing, modification, deletion, writing, moving, reading, renaming, recovery, searching, and file sharing. File sharing may include, but is not limited to, printing, USB sharing, CD burning, network sharing, Bluetooth sharing, infrared sharing, drag-and-drop sharing, clipboard sharing, instant messaging software sharing, cloud storage sharing, and network protocol sharing. File operation records refer to the historical records of various file operations, and may include, but are not limited to, information such as file operation type, operation time, file path, file size, and user identifier.

[0045] According to some embodiments, the data processing device monitors file operations to obtain file operation records. Based on the type of storage device where the file resides, files can be categorized as files stored on a local disk or files stored on an external device. The data processing device can monitor file operations on the local disk in real time, such as reading, deleting, modifying, and moving, to generate file operation records. The data processing device can also monitor file operations on external devices, which can be connected to the terminal device to which the data processing device belongs via a wired or wireless interface. When the data processing device monitors file operations such as reading, writing, modifying, or deleting from an external device, it generates corresponding file operation records.

[0046] In some embodiments, the method of monitoring file operations to obtain file operation records is, for example, that a data processing device obtains a monitoring policy issued by a server. This monitoring policy includes at least configured file operation monitoring types, where each file operation monitoring type represents a file operation behavior that needs to be monitored. The obtained monitoring policy is then sent to a file filtering driver. The file filtering driver is invoked to monitor the basic file operations according to the file operation monitoring types in the monitoring policy, thereby obtaining the monitored file operation records. These basic operations may include, but are not limited to, file creation, editing, deletion, copying, moving, reading, renaming, and restoring.

[0047] Optionally, the monitoring strategy may also include file monitoring types, which represent the files that need to be monitored. The data processing device selectively monitors files that match the file monitoring type by calling the file filtering driver, and monitors the basic operation behavior of the files that match the file monitoring type according to the file operation monitoring type, thereby obtaining the monitored file operation records.

[0048] In some embodiments, monitoring file operations to obtain file operation records can be achieved by, for example, the data processing device pre-determining the file operation monitoring types corresponding to each file operation monitoring type according to the monitoring policy issued by the server, and assembling the determined file operation interfaces into a file operation interface set. For each file operation interface included in the file operation interface set, one or more hook functions are edited, and the hook functions are associated with each file operation interface. These hook functions are used to capture call records for the file operation interfaces.

[0049] It should be noted that when users perform file-related operations, such as printing, dragging and dropping, cutting, and copying, the corresponding file operation interface needs to be invoked. Therefore, by obtaining and analyzing the call records of the file operation interface, the file operation record corresponding to that call record can be determined.

[0050] According to some embodiments, during the monitoring of user operations on files, the data processing device first starts a monitoring process and injects a hook function into the monitoring process. The hook function obtains the user's call records to the target file operation interface, analyzes these call records to obtain the file operation record corresponding to the call record, wherein the file operation record includes at least the file operation type corresponding to the call record.

[0051] In some embodiments, monitoring file operations to obtain file operation records can be achieved, for example, by generating a network upload request when a file needs to be uploaded over the network. The data processing device invokes the network filtering driver installed in kernel layer R0 to monitor the network upload request for the file. When a network upload request for the file is detected, it redirects the request to the data processing device located in application layer R3. In response to the redirected request, the data processing device obtains the protocol type of the upload request, parses it according to the protocol type to obtain the file name, and generates a file operation record based on that name.

[0052] It's important to note that kernel level R0 refers to the level at which the operating system kernel runs, possessing the highest privileges. The kernel is the core of the operating system; at R0, code can access all hardware resources and perform any operation. Application level R3 refers to the level at which user-space applications run, possessing the lowest privileges. At R3, applications need to interact with kernel level R0 through mechanisms such as system calls to request resources or services.

[0053] S102, Based on the file operation record, determine the file information of the file, perform sensitive word scanning on the file information, and obtain the sensitive word scanning result;

[0054] In some embodiments, for the obtained file operation records, file information is determined based on those records. File information is used to detect sensitive attributes of the file, and may include, but is not limited to, file name, file content, and file path. Sensitive word scanning is then performed on the determined file information to obtain the sensitivity scan results.

[0055] More specifically, the system receives monitoring policies from the server, which can be configured with sensitive rules. These sensitive rules include one or more sensitive words. When scanning file information for sensitive words, the file information is matched against the sensitive words included in the sensitive rules. If the file information matches any of the sensitive words in the sensitive rules, then the file information is determined to have matched any of the sensitive words in the sensitive rules.

[0056] In some embodiments, file information is determined based on file operation records. For example, it may be determined whether the file operation record is a file outgoing operation, where file outgoing operations may include, but are not limited to, printing, USB outgoing, network sharing outgoing, Bluetooth outgoing, network protocol uploading, etc. If the file operation record is a file outgoing operation, the file path and file content of the file are extracted from the file operation record, and the extracted file path and file content are determined as the file information of the file for sensitive word scanning.

[0057] According to some embodiments, file information is determined based on file operation records. For example, if the file operation record is not a file outgoing operation, the file path of the file is extracted from the file operation record, and the extracted file path is determined as the file information of the file for sensitive word scanning.

[0058] Optionally, after extracting the file path, the file path can be corrected. Since the file path extracted directly from the file operation record may be incomplete, by combining the file operation record with the file path to correct it, a complete and corrected file path can be obtained for sensitive word scanning.

[0059] S103, if the sensitive word scanning result indicates that the file information matches a sensitive word, then the file processing type matched by the sensitive word is obtained based on the monitoring strategy, wherein the monitoring strategy is obtained and distributed through server configuration;

[0060] In some embodiments, the monitoring policy issued by the server may also be configured with file processing types corresponding to each sensitive word. File processing types may include one or more of the following: file blocking, file approval, file forensics, file auditing, alarm, permission for file operations, and continued monitoring.

[0061] According to some embodiments, when the sensitive word scan result indicates that the file information has hit a sensitive word, the file processing type matched by the hit sensitive word is obtained from the monitoring policy issued by the server.

[0062] Optionally, a corresponding sensitivity level can be set for each sensitive word in the monitoring policy, and different file processing types can be configured for different sensitivity levels. When the sensitive word scan result indicates that the file information has matched a sensitive word, the sensitivity level corresponding to the matched sensitive word can be obtained from the monitoring policy issued by the server, and the matching file processing type can be obtained based on the sensitivity level.

[0063] S104, process the file according to the file processing type.

[0064] In some embodiments, the file is processed according to the file processing type matched by the sensitive words it contains. For example, when the file processing type is forensic analysis, the file is uploaded to the server for backup. When the file processing type is auditing, the file operations performed on the file are reported to the server for auditing.

[0065] According to some embodiments, files are processed based on their processing type. For example, when the file processing type is file blocking, the current operation on the file is blocked, such as blocking file sharing, file movement, file editing, file deletion, and file copying. When the file processing type is file approval, a file approval request is generated and sent to the terminal of the approver. When the approver's terminal returns the approval result corresponding to the file approval request, the approval result is obtained, and the current operation on the file is allowed or blocked based on the approval result.

[0066] This application embodiment monitors file operation records and determines file information for sensitive word scanning, enabling timely detection and processing of files containing sensitive information. By matching the file processing type corresponding to sensitive words according to the monitoring policy issued by the server, different processing strategies can be determined based on different sensitive words, making data processing more flexible and meeting the security needs of different scenarios. By combining the monitoring policy issued by the server for file monitoring, cloud and terminal linkage is achieved, realizing efficient and accurate data leakage prevention function.

[0067] Please see Figure 3 This is a flowchart illustrating a data processing method provided in an embodiment of this application. Figure 3 As shown, the method in this application embodiment may include the following steps S201-S214.

[0068] S201, retrieve the monitoring policy issued by the server;

[0069] S202, Invoke the file filtering driver to monitor the basic operation behavior of the file based on the file operation monitoring type in the monitoring strategy, and obtain file operation records;

[0070] S203, Start the monitoring process and load the hook function, obtain the user's call records to the target file operation interface, determine the file operation record based on the call records, the hook function is associated with the file operation interface set, and the file operation interface set is determined according to the file operation monitoring type in the monitoring strategy issued by the server;

[0071] S204, Invoke the network filtering driver to monitor the network upload requests of the file;

[0072] S205, in response to the redirected network upload request, obtain the protocol type of the network upload request;

[0073] S206, parse the network upload request according to the protocol type to obtain the file name, and generate a file operation record for the file based on the file name;

[0074] In some embodiments, the data processing device obtains a monitoring policy issued by the server. This monitoring policy includes at least configured file operation monitoring types, where each file operation monitoring type represents a file operation behavior that needs to be monitored. The obtained monitoring policy is then sent to a file filtering driver. The file filtering driver is invoked to monitor basic file operations according to the file operation monitoring types in the monitoring policy, resulting in monitored file operation records. These basic operations may include, but are not limited to, file creation, editing, deletion, copying, moving, reading, renaming, and restoring.

[0075] Optionally, the monitoring strategy may also include file monitoring types, which represent the files that need to be monitored. The data processing device selectively monitors files that match the file monitoring type by calling the file filtering driver, and monitors the basic operation behavior of the files that match the file monitoring type according to the file operation monitoring type, thereby obtaining the monitored file operation records.

[0076] Optionally, during the monitoring of user actions related to files, the data processing device can also initiate a monitoring process and inject hook functions into it. These hook functions capture records of calls to the file operation interface.

[0077] In some embodiments, the data processing device pre-determines the file operation interfaces corresponding to each file operation monitoring type based on the file operation monitoring types in the monitoring policy issued by the server, and assembles the determined file operation interfaces into a file operation interface set. For each file operation interface included in the file operation interface set, one or more hook functions are edited, and the hook functions are associated with each file operation interface. The hook function is used to capture call records for the file operation interface.

[0078] It should be noted that when users perform file-related operations, such as printing, dragging and dropping, cutting, and copying, the corresponding file operation interface needs to be invoked. Therefore, by obtaining and analyzing the call records of the file operation interface, the file operation record corresponding to that call record can be determined.

[0079] According to some embodiments, the data processing device obtains the user's call record for the target file operation interface by calling the hook function, analyzes the call record, and obtains the file operation record corresponding to the call record, wherein the file operation record includes at least the file operation type corresponding to the call record.

[0080] In some embodiments, when a file needs to be uploaded over the network, the system generates a corresponding network upload request. The data processing device can also invoke the network filtering driver installed in kernel layer R0 to monitor the network upload request for that file. When a network upload request for that file is detected, the network upload request is redirected to the data processing device located in application layer R3. In response to the redirected network upload request, the data processing device obtains the protocol type of the network upload request, parses the network upload request according to the protocol type to obtain the file name, and generates a file operation record for the file based on the file name.

[0081] According to some embodiments, the network upload request is parsed to obtain the file name based on the protocol type. For example, if the protocol type is an unencrypted protocol, the network upload request is parsed to obtain the file name contained in the network upload request. If the protocol type is an encrypted protocol, a man-in-the-middle attack technique is used to decrypt the network upload request to obtain the decrypted network upload request. Then, the decrypted network upload request is parsed to obtain the file name contained in the network upload request.

[0082] S207, if the file operation record is a file outgoing operation, then the file path and file content of the file are extracted according to the file operation record, and the file path and the file content are determined as the file information of the file;

[0083] S208, if the file operation record is not a file outgoing operation, then the file path of the file is extracted from the file operation record, and the file path is determined as the file information of the file;

[0084] S209, Perform sensitive word scanning on the file information to obtain sensitive word scanning results;

[0085] In some embodiments, the data processing device determines whether the acquired file operation record is a file outgoing operation, wherein the file outgoing operation may include, but is not limited to, printing, USB outgoing, network sharing outgoing, Bluetooth outgoing, network protocol uploading, etc. If the file operation record is a file outgoing operation, the file path and file content of the file are extracted from the file operation record, and the extracted file path and file content are determined as the file information of the file.

[0086] According to some embodiments, the file information of a file is determined based on the file operation record. For example, if the file operation record is not a file outgoing operation, the file path of the file is extracted from the file operation record, and the extracted file path is determined as the file information of the file.

[0087] Optionally, after extracting the file path, the file path can be corrected. Since the file path extracted directly from the file operation record may be incomplete, by combining the file operation record with the file path to correct it, a complete and corrected file path can be obtained for sensitive word scanning.

[0088] In some embodiments, the data processing device receives a monitoring policy from a server in advance, which may also include sensitive rules. These sensitive rules include one or more sensitive words. When scanning file information for sensitive words, the file information is matched against the sensitive words included in the sensitive rules. If the file information matches any of the sensitive words in the sensitive rules, the scanning result of the file information is determined to be a match for sensitive words.

[0089] S210, if the sensitive word scanning result indicates that the file information matches a sensitive word, then the file processing type matched by the sensitive word is obtained based on the monitoring strategy, wherein the monitoring strategy is obtained and distributed through server configuration;

[0090] For details, please refer to the description of step S103 in the above embodiment of the specification, which will not be repeated here.

[0091] S211, if the file processing type is file blocking, then block the current operation behavior of the file;

[0092] S212, if the file processing type is file approval, then generate a file approval request; obtain the approval result corresponding to the file approval request; if the approval result is approval passed, then allow the current operation of the file; if the approval result is approval failed, then block the current operation of the file.

[0093] S213, if the file processing type is file forensics, then the file is uploaded to the server;

[0094] S214, if the file processing type is file auditing, then the file operation record is reported to the server.

[0095] In some embodiments, when the file processing type is file forensics, the file is uploaded to the server for file backup. When the file processing type is file auditing, the file operation behavior is reported to the server for behavior auditing. When the file processing type is file blocking, the current operation behavior of the file is blocked, such as blocking file outgoing, file moving, file editing, file deletion, and file copying. When the file processing type is file approval, a file approval request is generated and sent to the terminal of the approver. When the approver's terminal returns the approval result corresponding to the file approval request, the approval result is obtained, and the current operation behavior of the file is allowed or blocked based on the approval result.

[0096] For example, please refer to Figure 4 A user terminal is equipped with a data processing device that monitors file operations in real time on files stored on the user terminal's local disk. The specific monitoring process is as follows: The monitoring policy issued by the server is obtained; a file filtering driver is invoked to monitor basic file operations based on the file operation monitoring type in the monitoring policy, obtaining a first file operation record; a monitoring process is started and a hook function is loaded to obtain user call records for the target file operation interface, and a second file operation record is determined based on these call records; simultaneously, a network filtering driver is invoked to monitor network upload requests for the file; when a network upload request is detected, it is redirected to the data processing device, which responds to the redirected request by obtaining the protocol type of the network upload request; the network upload request is parsed according to the protocol type to obtain the file name, and a third file operation record for that file is generated based on the file name. The monitored first, second, and / or third file operation records are obtained. Each file operation record contains file behavior operations, such as file creation, file movement, and file sharing operations.

[0097] Analyzing the acquired file operation records revealed that the file operation was an outbound file transfer operation. The file path and content were extracted from these records and identified as the file information. A sensitive word scan was performed on this information, indicating that the file information contained sensitive words. Based on monitoring strategies, the file processing type matching the matched sensitive words was determined. This file processing type includes file forensics, file auditing, file blocking, and file approval.

[0098] The file is processed according to its processing type, specifically as follows: A file evidence collection channel is opened, and the file is uploaded to the server; file auditing is enabled, and the file and its operation records are reported to the server; the file's outbound transmission is blocked, and a file approval request is generated; the file approval request is reviewed through a pre-set automatic approval program. If the automatic approval is successful, the file is released. If the automatic approval fails, the failure result is fed back to the user terminal. The user initiates a file outbound transmission request through their user terminal and sends it to the administrator's approval terminal. The data processing device receives the approval result returned by the administrator's approval terminal. If the approval result is successful, the file is released; if the approval result is unsuccessful, the file's outbound transmission is blocked. Finally, the release / non-release result of the file is reported to the server.

[0099] Please see Figure 5 This is a flowchart illustrating a data processing method provided in an embodiment of this application. Figure 5 As shown, the method in this application embodiment may include the following steps S301-S307.

[0100] S301, Monitor file operation behavior to obtain file operation records of the file;

[0101] Specifically, please refer to the description of step S101 in the above embodiment of the specification, which will not be repeated here.

[0102] In this embodiment of the application, after the data processing device in the terminal device obtains the file operation record of the file, it generates a file iteration tree based on the node identifier in the file operation record, wherein the node identifier includes one or more of the following: root node identifier, initial node identifier, following node identifier, and self node identifier.

[0103] In other embodiments, after obtaining the file operation record of a file, the data processing device in the terminal device can also report the file operation record to the server, and the data processing device configured in the server can generate a file iteration tree based on the node identifier in the file operation record.

[0104] Specifically, generating a file iteration tree based on the node identifiers in the file operation record may include steps S302-S306.

[0105] S302, obtain the file operation node set of the same file from the file operation record according to the root node identifier, the file operation node set includes at least two first file operation nodes;

[0106] In some embodiments, the file operation record may further include a node identifier, which is used to identify the file operation behavior of the file. The node identifier may include one or more of the following: root node identifier (root-uuid), first node identifier (first-uuid), last node identifier (last-uuid), and its own node identifier (uuid).

[0107] The root node identifier (root-uuid) is the node identifier that is inherited when a file is first traced and is used in all subsequent operations that modify or do not modify the file path.

[0108] The initial node identifier (first-uuid) is the node identifier that is first tracked and is inherited when subsequent actions are performed on the file without changing the file path.

[0109] The last-uuid (last-follower node identifier) ​​refers to the identifier of the previous node that this node follows, and is used to point to the node identifier of the last tracked file operation behavior.

[0110] The self-identifier (UUID) refers to the identifier of the current file operation. When the file content or attributes, such as file size and last write time, remain unchanged, the self-identifier (UUID) remains unchanged. For example, in a file read operation, the file content and attributes do not change, therefore, the self-identifier corresponding to the file read operation does not change. However, when the file content or attributes change, the self-identifier (UUID) is recalculated. For example, in a file move operation, the file path changes, i.e., the file attributes change, therefore, the self-identifier corresponding to the file move operation needs to be recalculated.

[0111] In some embodiments, the data processing device monitors one or more file operation records, which may be generated from monitoring the same file or from monitoring different files. For each file operation record and the various file operation behaviors contained within it, a root node identifier corresponding to any file operation behavior is selected. Based on the root node identifier, a first file operation node for the same file is obtained from all file operation records, wherein the number of obtained first file operation nodes is at least two. The at least two obtained first file operation nodes are combined to form a file operation node set for that file.

[0112] It is easy to understand that since all file operation nodes of the same file have the same root node identifier, all file operation nodes obtained based on the root node identifier belong to the same file.

[0113] S303, obtain the number of categories of the initial node identifiers contained in the file operation node set, and determine the number of paths in the file iteration tree based on the number of categories;

[0114] In some embodiments, for at least two first file operation nodes included in the file operation node set, the initial node identifier of each first file operation node is extracted, the extracted initial node identifiers are compared, and the number of categories of the initial node identifier is recorded. Based on the number of categories of the initial node identifier, the number of paths in the file iteration tree is determined.

[0115] It's easy to understand that when actions that change a file's path are performed, such as moving, copying, or sending a file, multiple identical files will exist in different file paths. Performing file operations on a file in one path will not affect files in other paths. Therefore, when a file operation changes its path, the initial node identifier for that operation should be recalculated, and the number of paths in the file iteration tree should be increased based on this recalculated initial node identifier.

[0116] S304, based on the root node identifier, initial node identifier, following node identifier and self node identifier of each first file operation node, determine the second file operation node as the root node of the file iteration tree, and the third file operation node as the path branch node of the file iteration tree.

[0117] In some embodiments, based on the root node identifier, initial node identifier, following node identifier, and self-node identifier of each first file operation node, the first file operation node whose root node identifier, initial node identifier, and self-node identifier are the same, and whose following node identifier is empty, is determined as the second file operation node as the root node of the file iteration tree. And the first file operation node whose root node identifier, following node identifier, and self-node identifier are the same as the previous first file operation node, and whose initial node identifier is different from the previous first file operation node, is determined as the third file operation node as a path branch node of the file iteration tree.

[0118] S305, determine the order of the first file operation nodes based on their operation times;

[0119] S306, Generate the file iteration tree based on the second file operation node, the third file operation node, the number of paths, and the arrangement order;

[0120] In some embodiments, the order of the first file operation nodes is determined based on their operation times. A file iteration tree for the file is then generated based on the determined second and third file operation nodes, the number of paths, and the order of the first file operation nodes.

[0121] S307, in response to the file tracing instruction, obtain the file operation record corresponding to the file tracing instruction from the file iteration tree.

[0122] In some embodiments, upon discovering a file leak, the user can generate a file tracing instruction via a user terminal, server, or console. In response to this file tracing instruction, the data control device retrieves the file operation record corresponding to the instruction from the generated file iteration tree.

[0123] This application's embodiments determine the number of paths in the file iteration tree based on the number of categories identified by the initial node, which helps to better understand the file's operation paths and patterns. By distinguishing between the second file operation node (the root node) and the third file operation node (the path branch node), it helps to clearly display the different stages and branches of file operations in the tree structure. By determining the order of each node in the file iteration tree based on the operation time of each first file operation node, the temporal continuity and accuracy of the tree structure are ensured, enabling the chronological tracing of file operation history during file tracing. By quickly responding to file tracing commands and directly retrieving the corresponding file operation records from the file iteration tree, the efficiency of file tracing is greatly improved, allowing for rapid problem location when file anomalies are discovered or the file source needs to be traced.

[0124] based on Figure 1 The system architecture will be discussed below in conjunction with the appendix. Figure 6 This application provides a detailed description of the data processing apparatus provided in its embodiments. It should be noted that the appendix... Figure 6 The data processing apparatus in the present application is used to execute the data processing apparatus in the present application. Figures 2-5 The methods shown in the embodiments are for illustrative purposes only, illustrating the parts relevant to the embodiments of this application. For specific technical details not disclosed, please refer to this application. Figures 2-5 The example shown.

[0125] Please see Figure 6 This diagram illustrates the structure of a data processing apparatus provided in an exemplary embodiment of this specification. The data processing apparatus can be implemented as all or part of a device through software, hardware, or a combination of both. The device 1 includes at least a monitoring unit 10, a scanning unit 20, a matching unit 30, and a processing unit 40.

[0126] Monitoring unit 10 is used to monitor file operation behavior in order to obtain file operation records of the file;

[0127] Scanning unit 20 is used to determine the file information of the file based on the file operation record, perform sensitive word scanning on the file information, and obtain sensitive word scanning results;

[0128] The matching unit 30 is used to obtain the file processing type matched by the sensitive word based on the monitoring strategy if the sensitive word scanning result indicates that the file information matches the sensitive word. The monitoring strategy is obtained and distributed through server configuration.

[0129] The processing unit 40 is used to process the file according to the file processing type.

[0130] According to some embodiments, the monitoring unit 10 may further include: a first acquisition subunit 101 and a first monitoring subunit 102, wherein, in the monitoring unit 10, when monitoring the operation behavior of a file to obtain the file operation record of the file:

[0131] The first acquisition subunit 101 is used to acquire the monitoring policy issued by the server;

[0132] The first monitoring subunit 102 is used to call the file filtering driver to monitor the basic operation behavior of the file based on the file operation monitoring type in the monitoring strategy, and obtain file operation records.

[0133] According to some embodiments, the monitoring unit 10 may further include: a second monitoring subunit 103, wherein, in the monitoring unit 10, when monitoring the operation behavior of the file to obtain the file operation record of the file:

[0134] The second monitoring subunit 103 is used to start the monitoring process and load hook functions, obtain the user's call records of the target file operation interface, and determine the file operation record based on the call records. The hook function is associated with the file operation interface set, which is determined according to the file operation monitoring type in the monitoring strategy issued by the server.

[0135] According to some embodiments, the monitoring unit 10 may further include: a third monitoring subunit 104, a redirection subunit 105, and a parsing subunit 106, wherein, in the monitoring unit 10, when monitoring the operation behavior of a file to obtain the file operation record of the file:

[0136] The third monitoring subunit 104 is used to call the network filtering driver to monitor the network upload requests of the file;

[0137] The redirection subunit 105 is used to obtain the protocol type of the network upload request in response to the redirected network upload request;

[0138] The parsing subunit 106 is used to parse the network upload request according to the protocol type, obtain the file name, and generate a file operation record of the file according to the file name.

[0139] According to some embodiments, the scanning unit 20 may further include: a first determining subunit 201 and a second determining subunit 202, wherein, when the scanning unit 20 determines the file information of the file based on the file operation record:

[0140] The first determining subunit 201 is used to extract the file path and file content of the file based on the file operation record if the file operation record is a file outgoing operation, and determine the file path and file content as the file information of the file;

[0141] The second determining subunit 202 is used to extract the file path of the file based on the file operation record if the file operation record is not a file outgoing operation, and determine the file path as the file information of the file.

[0142] According to some embodiments, the apparatus 1 may further include an iteration unit 50 and a tracing unit 60.

[0143] The iteration unit 50 is used to generate a file iteration tree based on the node identifiers in the file operation record. The node identifiers include one or more of the following: root node identifier, initial node identifier, following node identifier, and self node identifier.

[0144] The tracing unit 60 is used to retrieve the file operation record corresponding to the file tracing instruction from the file iteration tree in response to the file tracing instruction.

[0145] According to some embodiments, the iteration unit 50 may further include: a first determining subunit 201 and a second determining subunit 202, wherein, in the iteration unit 50, when generating a file iteration tree based on the node identifiers in the file operation record:

[0146] The second acquisition subunit 501 is used to acquire a set of file operation nodes for the same file from the file operation record according to the root node identifier, wherein the set of file operation nodes includes at least two first file operation nodes.

[0147] The quantity determination subunit 502 is used to obtain the number of categories of the initial node identifiers contained in the file operation node set, and determine the number of paths in the file iteration tree based on the number of categories;

[0148] The node determination subunit 503 is used to determine the second file operation node as the root node of the file iteration tree and the third file operation node as the path branch node of the file iteration tree based on the root node identifier, initial node identifier, following node identifier and self node identifier of each first file operation node.

[0149] Sequence determination subunit 504 is used to determine the arrangement order of the first file operation nodes based on the operation time of each first file operation node;

[0150] The iterative tree generation subunit 505 is used to generate the file iterative tree based on the second file operation node, the third file operation node, the number of paths, and the arrangement order.

[0151] This application embodiment monitors file operation records and determines file information for sensitive word scanning, enabling timely detection and processing of files containing sensitive information. By matching the file processing type corresponding to sensitive words according to the monitoring policy issued by the server, different processing strategies can be determined based on different sensitive words, making data processing more flexible and meeting the security needs of different scenarios. By combining the monitoring policy issued by the server for file monitoring, cloud and terminal linkage is achieved, realizing efficient and accurate data leakage prevention function.

[0152] Please see Figure 7 This document provides a schematic diagram of the structure of a terminal device according to an embodiment of this application. Figure 7 As shown, the terminal device 500 includes a processor 501 and a memory 502. The processor 501 and the memory 502 are electrically connected.

[0153] The processor 501 is the control center of the terminal device 500 and may include one or more processing cores. The processor 501 connects to various parts of the terminal device using various interfaces and lines. By running or calling computer programs stored in the memory 502, and by calling data stored in the memory 502, it executes various functions of the terminal device and processes data, thereby providing overall control of the terminal device. Optionally, the processor 501 may be implemented using at least one of the following hardware forms: Digital Signal Processing (DSP), Field-Programmable Gate Array (FPGA), and Programmable Logic Array (PLA). The processor 501 may integrate one or more of the following: CPU, Graphics Processing Unit (GPU), and modem. The CPU primarily handles the operating system, user page, and applications; the GPU is responsible for rendering and drawing the displayed content; and the modem handles wireless communication. It is understood that the modem may also not be integrated into the processor 501 and may be implemented separately using a communication chip.

[0154] The memory 502 can be used to store software programs and modules. The processor 501 executes various functional applications and data processing by running the computer programs and modules stored in the memory 502. The memory 502 may mainly include a program storage area and a data storage area. The program storage area may store the operating system, computer programs required for at least one function, etc.; the data storage area may store data created according to the use of the terminal device, etc.

[0155] Furthermore, memory 502 may include high-speed random access memory, and may also include non-volatile memory, such as at least one disk storage device, flash memory device, or other volatile solid-state storage device. Accordingly, memory 502 may also include a memory controller to provide processor 501 with access to memory 502.

[0156] In this embodiment, the processor 501 in the terminal device 500 loads the instructions corresponding to the processes of one or more computer programs into the memory 502 according to the following steps, and the processor 501 runs the computer programs stored in the memory 502 to realize various functions, as follows:

[0157] Monitor file operations to obtain file operation records;

[0158] Based on the file operation records, the file information of the file is determined, and the file information is scanned for sensitive words to obtain the sensitive word scanning results;

[0159] If the sensitive word scanning result indicates that the file information matches a sensitive word, then the file processing type matched by the sensitive word is obtained based on the monitoring strategy, which is obtained and distributed through server configuration;

[0160] The file is processed according to the file processing type.

[0161] Optionally, when the processor 501 performs operations on the monitored file to obtain the file operation record, it specifically executes the following:

[0162] Obtain the monitoring policy issued by the server;

[0163] The file filtering driver is invoked to monitor the basic operation behavior of the file based on the file operation monitoring type in the monitoring strategy, and file operation records are obtained.

[0164] Optionally, when the processor 501 performs operations on the monitored file to obtain the file operation record, it specifically executes the following:

[0165] The monitoring process is started and hook functions are loaded to obtain user call records of target file operation interfaces. Based on the call records, file operation records are determined. The hook functions are associated with a set of file operation interfaces, which are determined according to the file operation monitoring type in the monitoring strategy issued by the server.

[0166] Optionally, when the processor 501 performs operations on the monitored file to obtain the file operation record, it specifically executes the following:

[0167] The network filtering driver is invoked to monitor network upload requests for the file;

[0168] In response to a redirected network upload request, obtain the protocol type of the network upload request;

[0169] The network upload request is parsed according to the protocol type to obtain the file name, and a file operation record for the file is generated based on the file name.

[0170] Optionally, when the processor 501 determines the file information of the file based on the file operation record, it specifically performs the following:

[0171] If the file operation record is a file outgoing operation, then the file path and file content of the file are extracted from the file operation record, and the file path and file content are determined as the file information of the file;

[0172] If the file operation record is not a file outgoing operation, then the file path of the file is extracted from the file operation record, and the file path is determined as the file information of the file.

[0173] Optionally, after executing the operation behavior of the monitored file to obtain the file operation record of the file, the processor 501 may also execute:

[0174] A file iteration tree is generated based on the node identifiers in the file operation record. The node identifiers include one or more of the following: root node identifier, initial node identifier, following node identifier, and self node identifier.

[0175] Optionally, when the processor 501 generates a file iteration tree based on the node identifiers in the file operation record, it specifically performs the following:

[0176] Based on the root node identifier, a set of file operation nodes for the same file is obtained from the file operation record, wherein the set of file operation nodes includes at least two first file operation nodes;

[0177] Obtain the number of categories of the initial node identifiers contained in the file operation node set, and determine the number of paths in the file iteration tree based on the number of categories;

[0178] Based on the root node identifier, initial node identifier, following node identifier, and self node identifier of each first file operation node, the second file operation node that serves as the root node of the file iteration tree, and the third file operation node that serves as the path branch node of the file iteration tree are determined.

[0179] The order of the first file operation nodes is determined based on their operation times.

[0180] The file iteration tree is generated based on the second file operation node, the third file operation node, the number of paths, and the arrangement order.

[0181] Optionally, after generating a file iteration tree based on the node identifiers in the file operation record, processor 501 may also execute:

[0182] In response to a file tracing instruction, the file operation record corresponding to the file tracing instruction is obtained from the file iteration tree.

[0183] Optionally, when the processor 501 processes the file based on the file processing type, it specifically performs the following:

[0184] If the file processing type is file blocking, then the current operation on the file is blocked.

[0185] Optionally, when the processor 501 processes the file based on the file processing type, it specifically performs the following:

[0186] If the document processing type is document approval, then a document approval request is generated;

[0187] Obtain the approval result corresponding to the document approval request;

[0188] If the approval result is "approved", then the current operation of the document is permitted;

[0189] If the approval result is "approval not approved", then the current operation on the document will be blocked.

[0190] Optionally, when the processor 501 processes the file based on the file processing type, it specifically performs the following:

[0191] If the file processing type is file forensics, then the file is uploaded to the server.

[0192] Optionally, when the processor 501 processes the file based on the file processing type, it specifically performs the following:

[0193] If the file processing type is file auditing, then the file operation record will be reported to the server.

[0194] Please see Figure 8 This document provides a schematic diagram of the structure of a terminal device according to an embodiment of this application. Figure 8 As shown, the terminal device 500 includes: a processor 501, a memory 502, a display screen 503, a camera assembly 504, an audio circuit 505, a sensor 506, and a power supply 507. The processor 501 is electrically connected to the display screen 503, the camera assembly 504, the audio circuit 505, the sensor 506, and the power supply 507.

[0195] The display screen 503 can be used to display information input by the user or information provided to the user, as well as various graphical user interfaces of the terminal device, which can be composed of images, text, icons, videos, and any combination thereof.

[0196] The camera assembly 504 may include image processing circuitry, which may be implemented using hardware and / or software components and may include various processing units defining an image signal processing (ISP) pipeline. The image processing circuitry may include at least: multiple cameras, an image signal processor (ISP), control logic, and image memory. Each camera may include at least one or more lenses and an image sensor. The image sensor may include a color filter array (such as a Bayer filter). The image sensor acquires light intensity and wavelength information captured by each imaging pixel of the image sensor and provides a set of raw image data that can be processed by the image signal processor.

[0197] The audio circuit 505 can be used to provide an audio interface between the user and the terminal device through a speaker and a microphone. The audio circuit 505 includes a microphone. The microphone is electrically connected to the processor 501. The microphone is used to receive voice information input by the user.

[0198] Sensor 506 is used to collect information about the terminal device itself, user information, or external environmental information. For example, sensor 506 may include one or more of the following sensors: vibration sensor, temperature sensor, distance sensor, magnetic field sensor, light sensor, acceleration sensor, fingerprint sensor, Hall sensor, position sensor, gyroscope, inertial sensor, attitude sensor, barometer, heart rate sensor, etc.

[0199] The power supply 507 is used to supply power to the various components of the terminal device 500. In some embodiments, the power supply 507 can be logically connected to the processor 501 through a power management system, thereby enabling functions such as charging, discharging, and power consumption management through the power management system.

[0200] It should be understood that the apparatus provided in this application embodiment is used to perform the above-described data processing method, and therefore can achieve the same effect as the above-described implementation method.

[0201] When using integrated units, the device may include a processing module and a storage module. When applied to a terminal device, the processing module can be used to control and manage the actions of the terminal device. The storage module can be used to support the terminal device in executing corresponding program code, etc.

[0202] The processing module may be a processor or a controller, which can implement or execute the various exemplary logic blocks, modules, and circuits described in conjunction with the disclosure of this application. The processor may also be a combination of functions that implement computing capabilities, such as a combination of one or more microprocessors, a combination of digital signal processing (DSP) and a microprocessor, etc., and the storage module may be a memory.

[0203] In addition, the device provided in this application embodiment may specifically be a chip, component or module. The chip may include a connected processor and a memory. The memory is used to store instructions. When the processor calls and executes the instructions, the chip can execute a data processing method provided in the above embodiment.

[0204] This application also provides a computer-readable storage medium storing computer program code. When the computer program code is run on a computer, the computer executes the aforementioned method steps to implement a data processing method provided in the above embodiments.

[0205] This embodiment also provides a computer program product that, when run on a computer, causes the computer to perform the aforementioned related steps to implement a data processing method provided in the above embodiment.

[0206] In this embodiment, the device, computer-readable storage medium, computer program product, or chip are all used to execute the corresponding methods provided above. Therefore, the beneficial effects they can achieve can be referred to the beneficial effects in the corresponding methods provided above, and will not be repeated here.

[0207] Through the above description of the embodiments, those skilled in the art will understand that, for the sake of convenience and brevity, only the division of the above functional modules is used as an example. In actual applications, the above functions can be assigned to different functional modules as needed, that is, the internal structure of the device can be divided into different functional modules to complete all or part of the functions described above.

[0208] In the embodiments provided in this application, it should be understood that the disclosed apparatus and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative. For instance, the division of modules or units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another device, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some interfaces; the indirect coupling or communication connection between devices or units may be electrical, mechanical, or other forms.

[0209] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

Claims

1. A data processing method, characterized by, The method comprises: monitoring the operation behavior of a file to obtain file operation records of the file; determining file information of the file based on the file operation records, performing sensitive word scanning on the file information to obtain a sensitive word scanning result; if the sensitive word scanning result indicates that the file information hits a sensitive word, obtaining a file processing type matched by the sensitive word based on a monitoring strategy, the monitoring strategy being obtained and issued by a server; processing the file according to the file processing type.

2. The method of claim 1, wherein, The monitoring of the operation behavior of the file to obtain the file operation records comprises: obtaining a monitoring strategy issued by a server; calling a file filtering driver to monitor the basic operation behavior of the file based on a file operation monitoring type in the monitoring strategy to obtain file operation records.

3. The method of claim 1, wherein, The monitoring of the operation behavior of the file to obtain the file operation records comprises: starting a monitoring process and loading a hook function to obtain a call record of a target file operation interface by a user, determining file operation records based on the call record, the hook function being associated with a file operation interface set, the file operation interface set being determined according to a file operation monitoring type in a monitoring strategy issued by a server.

4. The method of claim 1, wherein, The monitoring of the operation behavior of the file to obtain the file operation records comprises: calling a network filtering driver to monitor a network upload request of the file; in response to a redirected network upload request, obtaining a protocol type of the network upload request; parsing the network upload request according to the protocol type to obtain a file name, and generating file operation records of the file according to the file name.

5. The method of claim 1, wherein, The determination of the file information of the file based on the file operation records comprises: if the file operation records are file external operation, extracting a file path and file content of the file according to the file operation records, and determining the file path and the file content as the file information of the file; if the file operation records are not file external operation, extracting a file path of the file according to the file operation records, and determining the file path as the file information of the file.

6. The method of claim 1, wherein, After the monitoring of the operation behavior of the file to obtain the file operation records, the method further comprises: generating a file iteration tree according to a node identifier in the file operation records, the node identifier comprising one or more of a root node identifier, an initial node identifier, a following node identifier and a self node identifier.

7. The method of claim 6, wherein, The generation of the file iteration tree according to the node identifier in the file operation records comprises: obtaining a file operation node set of the same file from the file operation records according to the root node identifier, the file operation node set comprising at least two first file operation nodes; obtaining a category number of an initial node identifier contained in the file operation node set, and determining a path number of the file iteration tree according to the category number; determining, according to the root node identifier, the initial node identifier, the following node identifier and the self node identifier of each first file operation node, a second file operation node as a root node of the file iteration tree and a third file operation node as a path branching node of the file iteration tree; determining, according to operation times of the first file operation nodes, an arrangement order of the first file operation nodes; generating the file iteration tree according to the second file operation node, the third file operation node, the path quantity and the arrangement order.

8. A data processing apparatus, characterized by, The apparatus comprises: a monitoring unit configured to monitor an operation behavior of a file to obtain a file operation record of the file; a scanning unit configured to determine file information of the file based on the file operation record, and perform sensitive word scanning on the file information to obtain a sensitive word scanning result; a matching unit configured to, if the sensitive word scanning result indicates that the file information hits a sensitive word, acquire a file processing type matched by the sensitive word based on a monitoring policy, the monitoring policy being obtained and issued by a server; a processing unit configured to process the file according to the file processing type.

9. A terminal device, comprising: The terminal device comprises at least one processor and a memory connected with the at least one processor in communication; wherein The memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to perform the data processing method in any one of claims 1-12.

10. A storage medium storing a computer program, characterized by The computer program, when executed by a processor, implements the steps of the data processing method in any one of claims 1-7.

Images