Method and system for processing outgoing data of bank

Abstract

The invention discloses a processing method and system for bank outgoing data, and relates to the technical field of financial data. When it is determined that the outgoing operation exists in the target equipment, obtaining to-be-sent data from the outgoing operation, and analyzing the to-be-sent data to obtain a data label; if the data tag is the sensitive tag, suspending the outgoing operation and pushing an identity verification request; if the identity information passes verification, user information of the current operator is confirmed; obtaining a file extension name of the to-be-sent data, and processing the to-be-sent data to obtain an initial file type; analyzing the file extension name according to the initial file type to determine a target file type; selecting a corresponding watermark type according to the target file type, processing and embedding the structured text character string into the to-be-sent data through a preset algorithm according to the watermark type, and generating watermark to-be-sent data; and replacing the to-be-sent data with the watermark to-be-sent data, and recovering the suspended outgoing operation. By implementing the technical scheme provided by the invention, the problem that the file type is identified only by depending on the extension name is solved.

Description

Technical Field

[0001] This application relates to the field of financial data, specifically to a method and system for processing bank outbound data. Background Technology

[0002] With the rapid development of fintech and the deepening digital transformation of banking operations, data has become a core asset for banks. In daily operations, bank employees frequently need to transmit and share various types of data. However, ensuring data security while maintaining efficient data flow has become a crucial issue that banks urgently need to address.

[0003] Currently, banks widely employ data encryption and digital watermarking technologies to protect the security of outgoing data. Specifically, when data is sent out, the system automatically encrypts the data and embeds digital watermark information. This watermark information typically includes basic information such as timestamps and the device used, used for subsequent data leakage tracing and location. Simultaneously, file type recognition technology is used to employ different watermark embedding strategies for different file formats.

[0004] However, when identifying file types for outgoing data, the system relies solely on file extensions. Since file extensions are easily modified, this single method is easily circumvented, leading the system to choose incorrect watermarking strategies. For example, an operator might change the file extension of a document containing sensitive information to an image format before sending it out. In this case, the system will incorrectly use an image watermarking strategy, resulting in poor watermarking effects or even failure to embed the watermark, thus affecting the effectiveness of user data security control for outgoing data. Summary of the Invention

[0005] This application provides a method and system for processing bank outbound data. The method is based on the identification of file content features, which can detect file type spoofing behavior and select an appropriate watermarking strategy to solve the problem of relying solely on file extension for file type identification in the prior art, and ensure the embedding effect of the watermark.

[0006] Firstly, this application provides a method for processing bank outbound data. The method includes: when it is determined that an outbound operation is occurring on a target device, capturing account information, device information, and timestamp information of the outbound operation to be performed from the operating system environment of the target device; obtaining the data to be sent from the outbound operation and parsing the data to be sent to obtain data tags; if the data tag is a sensitive tag, automatically pausing the outbound operation and pushing an authentication request to the target device based on the sensitive tag; receiving the identity information submitted by the user after responding to the authentication request, and confirming the user information of the current operator if the identity information is verified successfully; when the user information matches the preset user information corresponding to the account information, then transferring the account information and device information... The system formats the data and timestamp information into a structured text string; it obtains the file extension of the data to be sent, calculates the information entropy of the data, and analyzes the value of each byte in the data to obtain the number of times each byte appears; it determines the initial file type based on the information entropy and the number of times each byte appears; it analyzes the file extension based on the initial file type to determine the target file type; it selects the corresponding watermark type based on the target file type, processes the structured text string according to the watermark type using a preset algorithm, and generates watermark data; it embeds the watermark data into the data to be sent, generating watermarked data to be sent; it replaces the data to be sent in the outgoing operation with the watermarked data to be sent, and resumes the execution of the suspended outgoing operation.

[0007] By adopting the above technical solution, account, device, and timestamp information in the operating environment is automatically captured when outbound operations are detected. Combined with sensitivity level identification and identity verification of the data to be sent, unauthorized data outbound behavior is effectively prevented. When sensitive data is detected, outbound operations are automatically paused and identity verification is performed, ensuring the controllability of sensitive data outbound. After confirming the operator's legitimacy, the file type is identified by calculating information entropy and analyzing byte distribution characteristics. The identification result is compared and analyzed with the file extension, effectively solving the technical problem of relying solely on the extension for file type identification in existing technologies. This identification method based on file content characteristics can accurately detect file type spoofing behavior and then select an appropriate watermarking strategy. By embedding traceability information into the data after processing it according to different watermark types, both the embedding effect of the watermark is guaranteed and the entire data usage is traceable, thereby improving the effectiveness of bank data outbound security control.

[0008] Optionally, the initial file type is determined based on information entropy and the frequency of byte occurrences. Specifically, this includes: counting the total number of bytes in the data to be sent and iterating through all bytes in the data to be sent; accumulating the counter corresponding to each byte value; obtaining the count value of each counter and dividing each count value by the total number of bytes to obtain a byte frequency distribution histogram constructed from multiple byte frequencies; appending the information entropy to the byte frequency distribution histogram for combination to obtain a file content feature vector; calculating the similarity between the file content feature vector and multiple standard content feature vectors to obtain multiple similarity scores; selecting the target similarity score corresponding to the maximum value from the multiple similarity scores; if the target similarity score is greater than or equal to a preset confidence threshold, then retrieving the preset file type that is pre-associated with the target standard content feature vector in the preset file type library and using the preset file type as the initial file type.

[0009] By employing the aforementioned technical solution, the byte distribution in the file is statistically analyzed, and the frequency of each byte is calculated to form a frequency distribution histogram, reflecting the characteristic differences in byte usage among different file types. By combining information entropy with byte frequency distribution, a more complete file content feature vector is constructed, considering both the randomness of the data and the statistical characteristics of byte usage, thus more accurately describing the file's content characteristics. The obtained feature vector is compared with a pre-established standard feature vector library for similarity calculation. By selecting the maximum similarity score and comparing it with a preset confidence threshold, the true type of the file can be identified. This identification method based on file content features overcomes the limitations of traditional methods that rely solely on file extensions. Even if the file extension is manually modified, its actual type can still be accurately identified by analyzing the file's content characteristics, providing a reliable basis for selecting an appropriate watermarking strategy and ensuring effective watermark embedding.

[0010] Optionally, the initial file type includes image file type, document file type, and text file type. Based on the initial file type, the file extensions are analyzed to determine the target file type. Specifically: if the initial file type is a document file type, a table of document extensions matching the document file type is obtained; if the file extension exists in the file extension table, the initial file type is determined as the target file type; if the file extension does not exist in the document extension table, the risk status of the data to be sent is determined as high risk of document spoofing. If the initial file type is an image file type, a table of image extensions matching the image file type is obtained; if the image extension exists in the image extension table, the initial file type is determined as the target file type; if the file extension does not exist in the image extension table, the risk status of the data to be sent is determined as medium risk of image spoofing. If the initial file type is a text file type, a table of text extensions matching the text file type is obtained; if the text extension exists in the text extension table, the initial file type is determined as the target file type; if the text extension does not exist in the text extension table, the risk status of the data to be sent is determined as low risk of text spoofing.

[0011] By adopting the above technical solution, a file extension lookup table is established for three types of files: documents, images, and text. The initial file types identified based on content features are matched and verified against the actual file extensions used. When a discrepancy is found between the actual file extension and its content features, based on the sensitivity of different file types, documents that may contain sensitive information are marked as high-risk if a non-document extension is found. Image and text files are assigned medium and low risk levels, respectively. This differentiated risk assessment mechanism based on the importance of file types helps the system take appropriate protective measures in subsequent processing, thereby more effectively preventing security risks during data outflow.

[0012] Optionally, the corresponding watermark type can be selected based on the target file type. Specifically, this includes: determining whether the target file type is any one of the following: high-risk document spoofing, medium-risk image spoofing, or low-risk text spoofing; if so, the watermark type is determined to be an explicit, robust watermark; if not, the user department is queried based on user information, including core sensitive departments or ordinary business departments; the recipient address is obtained from the outbound operation, and a risk assessment is performed on the recipient address to obtain the risk assessment result; when the user department is a core sensitive department and the risk assessment result is high-risk, the watermark type is determined to be an explicit, robust watermark; when the user department is a core sensitive department and the risk assessment result is a trusted recipient, or when the user department is an ordinary business department and the risk assessment result is high-risk, the watermark type is determined to be an implicit, standard robust watermark; when the user department is an ordinary business department and the risk assessment result is a trusted recipient, the watermark type is determined to be an implicit, basic watermark.

[0013] By adopting the above technical solution and comprehensively considering multiple factors such as file spoofing risk, user department attributes, and recipient trustworthiness, refined control of the watermarking strategy is achieved. When file spoofing is detected, an explicit, robust watermark is directly applied. This mandatory protection measure effectively prevents attempts to circumvent watermarking by disguising file types. For files without spoofing, the risk level of the user's department and the recipient is further assessed. Explicit, robust watermarks are also used for high-risk outbound operations from core sensitive departments, while implicit standard robust watermarks or implicit basic watermarks are used for lower-risk scenarios. This scenario-based differentiated watermarking strategy ensures the security of high-risk data transmission while avoiding excessive security restrictions on low-risk businesses, thus balancing data security with business processing convenience. Through an intelligent watermark type selection mechanism, the protection strength can be adaptively adjusted according to specific business scenarios and risk levels, thereby achieving precision and effectiveness in data outbound security control.

[0014] Optionally, the recipient address is obtained from the outbound operation, and a risk assessment is performed on the recipient address to obtain the risk assessment result. Specifically, this includes: resolving the root domain name and IP address of the recipient address from the outbound operation; querying the root domain name and IP address to obtain the domain name registration duration, IP address reputation status, and certificate validity status; comparing the domain name registration duration with a preset duration threshold to determine the domain name risk score based on the duration comparison result; determining the corresponding reputation risk score based on the IP address reputation status; determining the corresponding certificate risk score based on the certificate validity status; assigning corresponding weights to the domain name risk score, reputation risk score, and certificate risk score; and weighting and summing the domain name risk score, reputation risk score, and certificate risk score with their respective weights to obtain the total risk value; when the total risk value is greater than or equal to the high-risk threshold, the risk assessment result is confirmed as high-risk; when the total risk value is less than the high-risk threshold, the risk assessment result is confirmed as a trusted recipient.

[0015] By employing the aforementioned technical solution, the root domain name and IP address information of the recipient are parsed from outbound operations. This information is then used to obtain security indicators such as domain registration duration, IP address reputation status, and certificate validity status. By comparing the domain registration duration with a preset threshold, newly registered suspicious domain names can be effectively identified; by checking the IP address reputation status, potential malicious addresses can be discovered; and by verifying the certificate status, the reliability of the communication channel can be ensured. These three risk indicators are quantified and scored, and a comprehensive risk assessment value is obtained through weighted calculation with appropriate weight allocation. This multi-dimensional weighted assessment method considers the importance of different security factors and allows for flexible adjustment of the influence weights of each factor, resulting in a more accurate risk assessment. Finally, the obtained risk assessment value is compared with a high-risk threshold to reliably determine the trustworthiness of the recipient.

[0016] Optionally, the structured text string is processed according to the watermark type using a preset algorithm to generate watermark data. Specifically, this includes: when the watermark type is an explicit, robust watermark, rendering the structured text string into an initial watermark image containing text information; performing array replication on the initial watermark image to generate a background texture; adjusting the transparency of the background texture and overlaying the adjusted background texture with a preset security grid pattern to generate watermark data; when the watermark type is an implicit, standard, robust watermark, converting the structured text string into a binary bit sequence; applying a preset error correction coding algorithm to the binary bit sequence to generate an enhanced bit sequence; using a pseudo-random number generator to spread the enhanced bit sequence to obtain a pseudo-random noise pattern, and using the pseudo-random noise pattern as watermark data; when the watermark type is an implicit, basic watermark, converting the structured text string into an original binary bit sequence; repeatedly concatenating the original binary bit sequence multiple times to obtain a cyclic redundancy sequence, and using the cyclic redundancy sequence as watermark data.

[0017] By adopting the above technical solutions, for high-risk scenarios, an explicit, robust watermark is used. This involves rendering the traceability information as an initial watermark image and performing array replication to form a background texture with visual cues. This texture is then overlaid with a security grid pattern, providing a clear warning while ensuring the integrity and anti-interference capabilities of the watermark information. For medium-risk scenarios, an implicit, standard robust watermark is used. The traceability information is converted into a binary sequence, and error correction coding enhances its anti-interference capabilities. A pseudo-random number generator is used for spread spectrum processing to generate a concealed watermark with strong anti-attack capabilities, ensuring the reliability of the watermark information without affecting normal data use. For low-risk scenarios, an implicit basic watermark is used. Simple cyclic redundancy processing is applied to the binary sequence, reducing processing complexity while maintaining basic traceability functionality. This differentiated watermark generation mechanism meets the protection requirements of different security levels while ensuring watermark effectiveness and processing efficiency.

[0018] Optionally, data to be sent can be obtained from the outgoing operation, and the data to be sent can be parsed to obtain data tags. Specifically, this includes: extracting text content from the data to be sent, scanning the text content using a preset regular expression pattern to obtain the scan result, where the preset regular expression pattern is used to identify bank card numbers, ID card numbers, and mobile phone numbers; counting the number of target strings in the scan result, comparing the number of target strings with a preset threshold, and determining the first sensitivity level based on the comparison result; performing a hash calculation on the text content to obtain the target hash value; inputting the target hash value into a preset sensitivity database for matching to obtain the second sensitivity level; if the first sensitivity level is greater than the second sensitivity level, then the first sensitivity level is determined as the data tag; if the first sensitivity level is less than the second sensitivity level, then the second sensitivity level is determined as the data tag; if the first sensitivity level is equal to the second sensitivity level, then either the first sensitivity level or the second sensitivity level is determined as the data tag.

[0019] By employing the above technical solution, text content is scanned using a preset regular expression pattern to specifically identify typical sensitive information such as bank card numbers, ID card numbers, and mobile phone numbers. The frequency of occurrence of this sensitive information is statistically analyzed and compared with a preset threshold to obtain a sensitivity level assessment result based on feature matching. Furthermore, the text content is hashed, and the result is matched against a preset sensitive database. This database-based matching method can identify content that does not conform to a fixed format but possesses sensitive characteristics. By comparing the sensitivity levels obtained from these two methods and selecting the higher level as the final data label, the potential for missed detections due to a single identification method is avoided, and a more comprehensive assessment of the data's sensitivity is achieved, significantly improving the accuracy and reliability of sensitive information identification.

[0020] The second aspect of this application provides a system for processing bank outbound data. The system includes an acquisition unit, a processing unit, and a sending unit. The acquisition unit, when determining that an outbound operation is occurring on a target device, captures account information, device information, and timestamp information of the outbound operation to be performed from the target device's operating system environment; obtains the data to be sent from the outbound operation and parses the data to obtain data tags. The processing unit, if the data tag is a sensitive tag, automatically pauses the outbound operation and pushes an authentication request to the target device based on the sensitive tag; receives the identity information submitted by the user after responding to the authentication request; if the identity information is verified, confirms the user information of the current operator; when the user information matches the preset user information corresponding to the account information... The system formats account information, device information, and timestamp information into a structured text string; obtains the file extension of the data to be sent, calculates the information entropy of the data to be sent, and analyzes the value of each byte in the data to be sent to obtain the number of times each byte appears; determines the initial file type based on the information entropy and the number of times each byte appears; analyzes the file extension based on the initial file type to determine the target file type; selects the corresponding watermark type based on the target file type, processes the structured text string according to the watermark type using a preset algorithm to generate watermark data; embeds the watermark data into the data to be sent to generate watermarked data to be sent; and in the sending unit, replaces the data to be sent in the outgoing operation with the watermarked data to be sent and resumes the execution of the suspended outgoing operation.

[0021] In a third aspect, this application provides an electronic device including a processor, a memory, a user interface, and a network interface. The memory is used to store instructions, the user interface and the network interface are used to communicate with other devices, and the processor is used to execute the instructions stored in the memory, causing the electronic device to perform any of the methods described above in this application.

[0022] In a fourth aspect, this application provides a computer-readable storage medium storing instructions that, when executed, perform any of the methods described above in this application.

[0023] In summary, one or more technical solutions provided in the embodiments of this application have at least the following technical effects or advantages: 1. Upon detecting outbound operations, the system automatically captures account, device, and timestamp information within the operational environment. Combined with sensitivity level identification and identity verification of the data to be sent, this effectively prevents unauthorized data outbound activities. When sensitive data is detected, the outbound operation is automatically paused and identity verification is performed, ensuring the controllability of sensitive data outbound transmission. After confirming the operator's legitimacy, the system identifies file types by calculating information entropy and analyzing byte distribution characteristics. The identification results are compared and analyzed with file extensions, effectively solving the technical problem of relying solely on extensions for file type identification in existing technologies. This identification method based on file content characteristics can accurately detect file type spoofing and then select an appropriate watermarking strategy. By embedding traceability information into the data after processing it according to different watermark types, both the watermark embedding effect and the full traceability of data usage are ensured, thereby improving the effectiveness of bank data outbound security control.

[0024] 2. Parse the recipient's root domain and IP address information from outbound operations. Query this information to obtain security indicators such as domain registration duration, IP address reputation status, and certificate validity status. By comparing the domain registration duration with a preset threshold, newly registered suspicious domains can be effectively identified; by checking the IP address's reputation status, potential malicious addresses can be discovered; and by verifying the certificate status, the reliability of the communication channel can be ensured. The risk indicators in these three dimensions are quantified and scored, and a comprehensive risk assessment value is obtained through weighted calculation with reasonable weight allocation. This multi-dimensional weighted assessment method considers the importance of different security factors and allows for flexible adjustment of the influence weight of each factor, resulting in a more accurate risk assessment result. Finally, comparing the obtained risk assessment value with a high-risk threshold reliably determines the recipient's trustworthiness. Attached Figure Description

[0025] Figure 1 This is a flowchart illustrating a method for processing outgoing bank data provided in an embodiment of this application; Figure 2 This is a schematic diagram of the structure of a system for processing outgoing bank data provided in an embodiment of this application; Figure 3 This is a schematic diagram of the structure of an electronic device disclosed in an embodiment of this application.

[0026] Explanation of reference numerals in the attached drawings: 201, acquisition unit; 202, processing unit; 203, transmission unit; 300, electronic device; 301, processor; 302, memory; 303, user interface; 304, network interface; 305, communication bus. Detailed Implementation

[0027] To enable those skilled in the art to better understand the technical solutions in this specification, the technical solutions in the embodiments of this specification will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments.

[0028] In the description of the embodiments of this application, the words "for example" or "for instance" are used to indicate examples, illustrations, or explanations. Any embodiment or design that is described as "for example" or "for instance" in the embodiments of this application should not be construed as being more preferred or advantageous than other embodiments or design options. Rather, the use of the words "for example" or "for instance" is intended to present the relevant concepts in a specific manner.

[0029] In the description of the embodiments of this application, the term "multiple" means two or more. For example, multiple systems means two or more systems, and multiple screen terminals means two or more screen terminals. Furthermore, the terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the indicated technical features. Thus, a feature defined with "first" or "second" may explicitly or implicitly include one or more of that feature. The terms "comprising," "including," "having," and variations thereof all mean "including but not limited to," unless otherwise specifically emphasized.

[0030] Therefore, how to solve the problem of poor watermark embedding effect caused by relying solely on file extensions for file type identification in existing technologies is an urgent issue to be addressed. This application provides a method for processing outgoing bank data, applied in a server. The server in this application can be a platform providing outgoing data monitoring services for banking enterprises. Figure 1 This is a flowchart illustrating a method for processing outgoing bank data provided in an embodiment of this application. (Refer to...) Figure 1 The method includes the following steps S101-S109.

[0031] S101: When it is determined that the target device has an outbound operation, capture the account information, device information and timestamp information of the outbound operation to be executed from the target device's operating system environment.

[0032] In the above S101 scenario, in a banking business scenario, the target devices are typically desktop computers, laptops, and other terminal devices used by bank employees for daily office work. The server pre-installs a security management client on these target devices. This client registers system call hook functions at the operating system kernel layer to monitor system calls such as file operations and network communications in real time.

[0033] When a user attempts to perform outbound operations via email, USB copying, or cloud storage upload, the security control client immediately extracts the currently logged-in employee account information from the operating system's process context, including employee ID, department, and other identity information. Simultaneously, it acquires the target device's hardware characteristics, such as device asset number, MAC address, and terminal IP address. Additionally, it records operation timestamps accurate to the millisecond. This information collection process is implemented at the operating system level, imperceptible and tamper-proof to ordinary employees, ensuring the authenticity of the information. The reason for collecting this information in the operating system environment is that tracing outbound bank data requires accurately pinpointing the specific operator, device, and time of operation; this information constitutes a complete chain of responsibility. By mandating information collection at the operating system level, the risk of application-level collection being circumvented is avoided, while ensuring the accuracy and immutability of the collected information. This provides reliable traceability information for subsequent watermark embedding, effectively supporting the security control requirements for outbound bank data.

[0034] S102: Obtain the data to be sent from the outgoing operation, parse the data to be sent to obtain the data tag; if the data tag is a sensitive tag, automatically pause the outgoing operation, and push an authentication request to the target device according to the sensitive tag.

[0035] In step S102 above, when an outbound operation is detected, the security management client first intercepts the file handle or data stream of the data to be sent. For file-type data, it reads the file's metadata information, including the file extension and MIME type; for non-file-type data such as clipboard content, it parses the content. During parsing, it extracts the text content from the data, uses preset regular expression patterns to identify sensitive information features such as bank account numbers and ID card numbers, calculates the hash value of the data and matches it with a preset sensitive data feature library, and comprehensively evaluates to obtain data tags.

[0036] In addition, data to be sent is obtained from outbound operations, and the data to be sent is parsed to obtain data tags. Specifically, this includes: extracting text content from the data to be sent, scanning the text content using a preset regular expression pattern to obtain the scan results, the preset regular expression pattern being used to identify bank card numbers, ID card numbers, and mobile phone numbers; counting the number of target strings in the scan results, comparing the number of target strings with a preset threshold, and determining the first sensitivity level based on the comparison result; performing hash calculation on the text content to obtain the target hash value; inputting the target hash value into a preset sensitivity database for matching to obtain the second sensitivity level; if the first sensitivity level is greater than the second sensitivity level, the first sensitivity level is determined as the data tag; if the first sensitivity level is less than the second sensitivity level, the second sensitivity level is determined as the data tag; if the first sensitivity level is equal to the second sensitivity level, either the first sensitivity level or the second sensitivity level is determined as the data tag.

[0037] Specifically, in scenarios involving the outward transmission of bank data, sensitivity analysis of the data to be transmitted is required. The content of the data to be transmitted is read through a file parsing module. If the data is an image, OCR technology can be used to extract the text information carried within the image. Then, data in different formats, such as documents, tables, and images, is uniformly converted into plain text. For the extracted text content, different methods are used to identify sensitive information, starting with feature recognition based on regular expressions. A pre-defined library of regular expression patterns specifically for identifying sensitive information in banking operations is used, including 16-19 digit feature patterns for bank card numbers, 18 digit and letter combination feature patterns for ID card numbers, and 11 digit feature patterns for mobile phone numbers. The scanning engine uses these pre-defined regular expression patterns to scan the text content line by line, recording the matching results for each type of sensitive information. Then, the number of occurrences of each type of sensitive information in the text is counted. Based on pre-set threshold values ​​for different levels of sensitivity (e.g., 1-2 occurrences of sensitive information is low sensitivity, 3-5 occurrences is medium sensitivity, and more than 5 occurrences is high sensitivity), the first sensitivity level is determined by comparing the number of occurrences with the threshold values. The text content is then segmented, and a cryptographic hash value, such as SHA-256, is calculated for each segment to generate a target hash value. Simultaneously, the bank has pre-established a sensitive data feature database, storing the feature hash values ​​of various sensitive documents, reports, customer information, etc., and labeling them with different sensitivity levels. The calculated target hash value is matched against the feature database; if a match is found, the corresponding sensitivity level is extracted as the second sensitivity level. Finally, the results of these two identification methods are combined to determine the final data label. When the first sensitivity level is greater than the second sensitivity level, it indicates that the text contains a large number of sensitive information features, requiring stricter control; therefore, the first sensitivity level is selected as the final data label. When the first sensitivity level is less than the second sensitivity level, it indicates that although there are not many sensitive information features in the text, the overall content falls within the bank's predefined sensitive range, and the second sensitivity level should be used as the data label. When the two levels are equal, it indicates that the two identification methods have yielded consistent evaluation results; in this case, either level can be selected as the data label.

[0038] This dual identification mechanism can discover discrete sensitive information through feature matching and identify complete sensitive documents through overall matching, greatly improving the accuracy and reliability of sensitive information identification. At the same time, by selecting a higher sensitivity level as the final label, it reflects the principle of strict control and effectively prevents the risk of sensitive information being leaked.

[0039] Furthermore, data tags can be understood as sensitivity level tags, with sensitive tags corresponding to higher sensitivity levels and non-sensitive tags corresponding to lower sensitivity levels. After determining the data tag corresponding to the data to be sent, if the data tag is non-sensitive, the appropriate watermark embedding method is selected based on the file type of the data to be sent, and the embedded data is then sent. If the data tag is sensitive, the security management client will immediately call the operating system's process control interface to suspend the current outgoing operation process. Simultaneously, based on the sensitivity level of the tag, an authentication request of the corresponding level is pushed to the target device, which may include employee two-factor authentication, supervisor approval confirmation, and other authentication methods. This mechanism of sensitivity identification and verification before data outgoing can effectively prevent the accidental outgoing of sensitive information, while ensuring compliant authorization of outgoing operations through authentication. Through an automated sensitive information identification and verification process, the compliance of data outgoing is guaranteed, and unauthorized outgoing of sensitive information can be blocked in a timely manner, improving the effectiveness of bank data security management.

[0040] S103: Receive the identity information submitted by the user after responding to the authentication request. If the identity information is verified, confirm the user information of the current operator. When the user information is consistent with the preset user information corresponding to the account information, format the account information, device information and timestamp information into a structured text string.

[0041] In step S103 above, after pushing an identity verification request to the user, the security management client opens the identity verification interface, requiring the user to submit identity information. This identity information may include dynamic passwords, biometric features such as fingerprints, or digital certificate information. This information is submitted to the bank's unified identity authentication system for verification. Upon successful verification, the system obtains the current operator's user information, including employee ID, department, and job title. Subsequently, it queries the bank's human resources database to retrieve preset user information associated with the current account information, comparing the two to ensure that the current operator is indeed the legitimate holder of the account, thus preventing the risk of account theft.

[0042] Once the user's identity is verified, the previously acquired account information, device information, and timestamp information are standardized and organized into a structured text string according to a predefined format template. For example, a format template like "Employee ID_Department Code_Device ID_Timestamp" can be used to ensure that this information is organized in a uniform format, facilitating subsequent watermark embedding and extraction. This strict identity verification and information formatting mechanism not only ensures the legitimacy of outgoing operations but also provides a standardized information carrier for subsequent watermark traceability, improving the security, controllability, and traceability of the entire data outgoing process.

[0043] S104: Obtain the file extension of the data to be sent, calculate the information entropy of the data to be sent, and analyze the value of each byte in the data to be sent to obtain the number of times the byte appears; determine the initial file type based on the information entropy and the number of times the byte appears.

[0044] In step S104 above, the file extension is extracted from the file attributes of the data to be sent. To prevent circumvention of control by modifying the extension, deep file type identification is performed on the data to be sent. Specifically, the binary content of the data to be sent is read and the data is processed into blocks by bytes. For each byte, its frequency of occurrence in the entire data is calculated to obtain the distribution of byte occurrences. At the same time, information entropy is calculated based on these byte frequencies, specifically using the formula H=-∑(Pi*log2(Pi)), where Pi represents the probability of the i-th byte value occurring.

[0045] Furthermore, the initial file type is determined based on information entropy and the frequency of byte occurrences. Specifically, this includes: counting the total number of bytes in the data to be sent and iterating through all bytes in the data to be sent; accumulating the counter corresponding to each byte value; obtaining the count value of each counter and dividing each count value by the total number of bytes to obtain a byte frequency distribution histogram constructed from multiple byte frequencies; appending the information entropy to the byte frequency distribution histogram for combination to obtain a file content feature vector; calculating the similarity between the file content feature vector and multiple standard content feature vectors to obtain multiple similarity scores; selecting the target similarity score corresponding to the maximum value among the multiple similarity scores; if the target similarity score is greater than or equal to a preset confidence threshold, then retrieving the preset file type that is pre-associated with the target standard content feature vector in the preset file type library, and using the preset file type as the initial file type.

[0046] Specifically, a comprehensive byte-level statistical analysis is performed on the data to be sent. The data is opened in binary mode via a file reading interface, and the total number of bytes in the file is counted. Then, a counter array of size 256 is created to record the frequency of each possible byte value (0-255). Each byte in the data to be sent is read sequentially, and the counter for the corresponding byte value is incremented by 1, completing the traversal and statistical analysis of all bytes in the file. Next, a feature vector for the file needs to be constructed. The count of each byte value is divided by the total number of bytes to obtain the frequency of each byte value. These frequency values ​​form a 256-dimensional frequency distribution histogram. Simultaneously, information entropy is calculated using these frequency values: H = -∑(Pi*log2(Pi)), where Pi is the frequency of the i-th byte value. The calculated information entropy is appended as the 257th dimension feature to the frequency distribution histogram to form a complete file content feature vector. Feature vectors for various standard file types are stored in a preset file type library; these feature vectors are obtained through statistical analysis of a large number of sample files. For example, plain text files show a higher frequency of visible ASCII characters in their feature vectors, while image files exhibit a more even byte distribution, and document files show a moderate distribution. The cosine similarity algorithm is used to calculate the similarity between the feature vector of the data to be sent and a preset standard feature vector, thus obtaining a similarity score between the data to be sent and each standard file type. The maximum value among all similarity scores is selected as the target similarity score, representing the file type to which the data to be sent is most likely belongs. The target similarity score is compared with a preset reliability threshold (usually set between 0.85 and 0.95). If the target similarity score exceeds the preset reliability threshold, the file type judgment is considered reliable, and the corresponding preset file type is determined as the initial file type. If the target similarity score is less than the preset reliability threshold, the data to be sent can be marked as an unknown type or a high-risk type, triggering a preset high-strength security strategy, such as explicit and robust watermarking.

[0047] File type identification methods based on byte statistics and feature vector matching can deeply analyze the content characteristics of files, without relying on superficial features such as file extensions, and can effectively identify disguised file types. For example, even if the extension of an encrypted file is changed to .txt, its true type can still be accurately determined because its byte distribution characteristics are significantly different from those of a standard text file.

[0048] S105: Analyze the file extensions based on the initial file type to determine the target file type.

[0049] In step S105 above, the initial file types include image file types, document file types, and text file types. Based on the initial file type, the file extensions are analyzed to determine the target file type. Specifically, this includes: if the initial file type is a document file type, obtaining a table of document extensions matching the document file type; if a file extension exists in the file extension table, the initial file type is determined as the target file type; if no file extension exists in the document extension table, the risk status of the data to be sent is determined as high-risk document spoofing. If the initial file type is an image file type, obtaining a table of image extensions matching the image file type; if a file extension exists in the image extension table, the initial file type is determined as the target file type; if no file extension exists in the image extension table, the risk status of the data to be sent is determined as medium-risk image spoofing. If the initial file type is a text file type, obtaining a table of text extensions matching the text file type; if a file extension exists in the text extension table, the initial file type is determined as the target file type; if no file extension exists in the text extension table, the risk status of the data to be sent is determined as low-risk text spoofing.

[0050] Specifically, in the control of data outflow from banks, it is necessary to accurately identify and classify the risks of disguised files of different types. First, three standard file extension tables are established: a document extension table including office document formats such as {.doc, .docx, .pdf, .ppt, .pptx, .xls, .xlsx}; an image extension table including common image formats such as {.jpg, .jpeg, .png, .gif, .bmp}; and a text extension table including plain text formats such as {.txt, .log, .csv, .xml}. When the initial file type is determined to be a document file type through deep feature analysis, the document extension table is retrieved from the configuration library. The actual file extension of the data to be sent is matched with the document extension table. If a match is found, it means the actual file type matches the extension, and the initial file type is directly determined as the target file type. However, if the actual extension is not in the document extension table, for example, renaming a Word document to .jpg, it is judged as a high-risk document disguise. In this case, the file is very likely a sensitive file attempting to circumvent document outflow review through disguise, requiring the strictest control measures. When the initial file type is an image file, the image file extension table is retrieved for verification. If the actual extension exists in the image file extension table, it is confirmed as a normal image file; if it does not exist, for example, if the image file is renamed to .doc, it is considered a medium-risk image spoofing. Although this spoofing behavior also poses security risks, the risk level is relatively low, and appropriate control measures can be taken. When the initial file type is a text file, the text file extension table is retrieved for verification. If the actual extension exists in the text file extension table, it is confirmed as a plain text file; if it does not exist in the table, for example, if the text file is renamed to .png, it is considered a low-risk text spoofing. Considering that plain text files have relatively low sensitivity, basic security control measures can be taken in this case.

[0051] A tiered control mechanism based on cross-validation of file type and extension can accurately identify spoofing behavior of different file types and determine different risk levels according to the sensitivity of the file type. For example, disguising documents containing customer information as images for external transmission is considered high-risk, while changing the extension of ordinary log files is considered low-risk. This differentiated risk assessment mechanism provides precise control basis for subsequent watermarking, effectively improving the accuracy and reliability of bank data transmission control.

[0052] S106: Select the corresponding watermark type based on the target file type.

[0053] In S106 above, after determining the target file type according to the aforementioned steps, the corresponding watermark type is selected based on the target file type. Specifically, this includes: determining whether the target file type is any one of the following: high-risk document spoofing, medium-risk image spoofing, and low-risk text spoofing; if so, the watermark type is determined to be an explicit, robust watermark; if not, the user department is queried based on the user information, including core sensitive departments or ordinary business departments; the recipient address is obtained from the outbound operation, and a risk assessment is performed on the recipient address to obtain the risk assessment result; when the user department is a core sensitive department and the risk assessment result is high-risk, the watermark type is determined to be an explicit, robust watermark; when the user department is a core sensitive department and the risk assessment result is a trusted recipient, or when the user department is an ordinary business department and the risk assessment result is high-risk, the watermark type is determined to be an implicit, standard robust watermark; when the user department is an ordinary business department and the risk assessment result is a trusted recipient, the watermark type is determined to be an implicit, basic watermark.

[0054] Specifically, first check if the target file type falls under the category of high-risk spoofing. If the target file type is determined to be high-risk for document spoofing, medium-risk for image spoofing, or low-risk for text spoofing, then directly select the explicit, robust watermark type. This type of watermark has strong anti-tampering capabilities; even if the file undergoes format conversion, re-encoding, or other operations, the watermark information remains intact, and the watermark has a certain degree of visibility, serving as a deterrent.

[0055] If the target file type does not fall under the category of disguised risk, further analysis is conducted on the user's department attributes and the recipient's risk level. First, the human resources database is queried based on user information to determine the user's department. Internally, banks categorize departments into core sensitive departments (such as the treasury transaction department and risk management department) and ordinary business departments (such as the sales department and logistics department). Simultaneously, the recipient's email address or IP address is extracted from outbound operations. Risk assessment is performed by querying external institution credit ratings and historical cooperation records, classifying recipients into high-risk and trusted recipients. When the user is from a core sensitive department and the recipient is assessed as high-risk, considering the potentially significant impact of data leakage, an explicit, robust watermark is selected. This watermark uses a multi-layered encryption algorithm, embedding watermark information simultaneously in multiple locations within the file to ensure the watermark's security and traceability. When the user is from a core sensitive department but the recipient is a trusted recipient, or when the user is from an ordinary business department but the recipient is high-risk, the system selects an implicit, standard robust watermark. This type of watermark maintains good robustness while offering strong concealment, ensuring no impact on the normal use of the file, yet still allowing for watermark information extraction for traceability when needed. When the user is from a regular business department and the recipient is a trusted party, an implicit basic watermark is chosen. This watermark employs a lightweight watermarking algorithm, primarily serving a basic traceability function, minimizing the impact on file performance while ensuring security.

[0056] This multi-dimensional watermark type selection mechanism enables differentiated watermarking based on risk levels. For example, when the risk control department sends sensitive reports to unknown institutions, a strong, explicit watermark is used; while when the branch office sends routine business documents to partner banks, a basic, implicit watermark is used. This refined watermark control ensures secure traceability in high-risk scenarios while avoiding unnecessary impact on normal business operations, thus improving the accuracy and practicality of the bank's data outbound control.

[0057] Furthermore, the recipient's address is obtained from the outbound operation, and a risk assessment is performed on the recipient's address to obtain the risk assessment result. Specifically, this includes: resolving the root domain name and IP address of the recipient's address from the outbound operation; querying the root domain name and IP address to obtain the domain name registration duration, IP address reputation status, and certificate validity status; comparing the domain name registration duration with a preset duration threshold to determine the domain name risk score based on the duration comparison result; determining the corresponding reputation risk score based on the IP address reputation status; determining the corresponding certificate risk score based on the certificate validity status; assigning corresponding weights to the domain name risk score, reputation risk score, and certificate risk score; and weighting and summing the domain name risk score, reputation risk score, and certificate risk score with their respective weights to obtain the total risk value; when the total risk value is greater than or equal to the high-risk threshold, the risk assessment result is confirmed as high-risk; when the total risk value is less than the high-risk threshold, the risk assessment result is confirmed as a trusted recipient.

[0058] Specifically, key information is extracted from the target address of the outbound operation. The root domain (e.g., example.com) of the recipient's email address or website is parsed using regular expressions or string splitting methods, and the corresponding IP address is obtained through DNS resolution. The WHOIS query interface is called to obtain the domain's registration information, including registration time and expiration time; the IP address's historical behavior records and blacklist markings are queried through an IP reputation database; and the validity of the domain certificate and the issuing authority are checked through an SSL certificate verification interface. In the domain risk assessment stage, the domain's registration duration is compared with a preset duration threshold (usually set to 6 months or 1 year). If the registration time is short, it may be a temporarily registered phishing domain, and a higher domain risk score (e.g., 90 points) will be assigned; if the registration time exceeds the threshold and there is a stable usage history, a lower risk score (e.g., 30 points) will be assigned. In the IP reputation assessment stage, the reputation risk score is determined based on the IP address's reputation status. If the IP address appears in a known list of spam sources or attack sources, a higher reputation risk score (e.g., 85 points) will be assigned; if the IP address belongs to a trusted commercial network or institutional network segment, a lower risk score (e.g., 25 points) will be assigned. In the certificate evaluation stage, the validity status of the SSL certificate is checked. If the certificate has expired or was issued by an untrusted organization, a higher risk score (e.g., 80 points) is assigned; if the certificate is valid and issued by an authoritative organization, a lower risk score (e.g., 20 points) is assigned. Different weights are then assigned to these three risk scores to reflect their importance in the overall risk assessment. For example, the domain risk weight is 0.4, the IP reputation weight is 0.35, and the certificate risk weight is 0.25. The total risk value is calculated using a weighted average: Total Risk Value = Domain Risk Score × 0.4 + IP Reputation Risk Score × 0.35 + Certificate Risk Score × 0.25. The calculated total risk value is compared with a preset high-risk threshold (e.g., 75 points). When the total risk value is greater than or equal to the high-risk threshold, the recipient is considered a high-risk recipient, and stricter data outflow control measures may be required. When the total risk value is less than the high-risk threshold, the recipient is considered a trusted recipient, and a more lenient control strategy can be adopted.

[0059] This multi-dimensional recipient risk assessment mechanism can effectively identify potentially dangerous recipients. For example, when a recipient is detected using a newly registered domain name, originating from an untrusted IP address, and exhibiting abnormal certificates, it will be identified as a high-risk recipient, preventing the risk of data leakage in a timely manner. Meanwhile, for long-term partner organizations, their stable domain name records, trustworthy IP reputation, and valid security certificates can also help them obtain assessment results as trusted recipients, ensuring that normal business transactions are not affected.

[0060] S107: Process the structured text string according to the watermark type using a preset algorithm to generate watermark data.

[0061] In S107 above, watermark generation processing is performed on the structured text string containing user identity, device information and timestamp, according to the watermark type selected in the preceding steps. The structured text string is processed according to the watermark type using a preset algorithm to generate watermark data. Specifically, this includes: when the watermark type is an explicit, robust watermark, rendering the structured text string into an initial watermark image containing text information; array copying the initial watermark image to generate a background texture; adjusting the transparency of the background texture and overlaying the adjusted background texture with a preset security grid pattern to generate watermark data; when the watermark type is an implicit, standard, robust watermark, converting the structured text string into a binary bit sequence; applying a preset error correction coding algorithm to the binary bit sequence to generate an enhanced bit sequence; using a pseudo-random number generator to spread the enhanced bit sequence to obtain a pseudo-random noise pattern, which is then used as watermark data; when the watermark type is an implicit, basic watermark, converting the structured text string into the original binary bit sequence; repeatedly concatenating the original binary bit sequence to obtain a cyclic redundancy sequence, which is then used as watermark data.

[0062] Specifically, for explicit and robust watermarks, the structured text string containing user identification, device information, and timestamps is first converted into a high-resolution initial watermark image using a font rendering engine. An anti-tampering font and a specific text layout style are employed to ensure the text is clearly legible. Then, the initial watermark image is array-copied according to preset row and column spacing to generate a background texture covering the entire file area. To balance watermark visibility and file readability, the opacity of the background texture is adjusted to approximately 30%, and then overlaid with a pre-designed security grid pattern with special visual effects to generate watermark data that serves as a clear warning without affecting the normal use of the file.

[0063] For implicit standard robust watermarking, the structured text string is converted into a binary bit sequence. To improve the watermark's resistance to interference, error-correcting coding algorithms such as Reed-Solomon coding or BCH coding are used to process the binary bit sequence, generating an enhanced bit sequence with error detection and correction capabilities. Then, a key-based pseudo-random number generator is used to expand the enhanced bit sequence into a longer pseudo-random sequence. This spreading process improves the watermark's resistance to detection and attacks. The final generated pseudo-random noise pattern serves as the watermark data and can be stably embedded into the file in the frequency or spatial domain.

[0064] For implicit basic watermarking, the structured text string is converted into a raw binary bit sequence using UTF-8 or ASCII encoding. To increase the redundancy and reliability of the watermark, this bit sequence is concatenated end-to-end according to a preset number of repetitions (usually 3-5 times), generating a sequence with cyclic redundancy. This cyclic redundancy design ensures that even if the watermark information in part of the file is destroyed, the complete watermark information can still be extracted from other intact areas.

[0065] Based on differentiated processing mechanisms for different watermark types, watermark data of appropriate strength can be generated according to actual security needs. This ensures the security and reliability of watermarks in high-risk scenarios while avoiding excessive interference with low-risk business operations, effectively improving the accuracy and practicality of bank data outbound control. For example, when core departments send sensitive documents to high-risk recipients, explicit and robust watermarks can serve as a deterrent through clearly visible watermark markings; when ordinary departments conduct routine business transactions, implicit basic watermarks can achieve basic traceability functions without affecting document usage.

[0066] S108: Embed the watermark data into the data to be sent, generate watermarked data to be sent, replace the data to be sent in the outgoing operation with the watermarked data to be sent, and resume the execution of the suspended outgoing operation.

[0067] In step S108 above, watermark data is embedded into the data to be sent using corresponding embedding strategies based on different watermark types. For explicit, robust watermarks, the generated watermark pattern is superimposed onto a designated location in the data to be sent, such as the visible area of ​​a document header / footer or image, according to preset coverage rules; simultaneously, watermark verification information is written into the file's metadata area for subsequent integrity verification. For implicit, standard robust watermarks, pseudo-random noise patterns are embedded into the frequency domain of the data to be sent using methods such as discrete cosine transform or wavelet transform to ensure that the watermark information can resist common file processing operations. For implicit, basic watermarks, cyclic redundancy sequences are embedded into the spatial domain of the data to be sent using methods such as least significant bit substitution or quantization modulation to achieve basic information hiding functionality.

[0068] After watermark embedding is complete, the generated watermarked data to be sent undergoes integrity verification to ensure that the watermark information is correctly embedded and does not affect the normal opening and use of the file. Then, the original data to be sent in the outbound operation is replaced with the watermarked data, and the previously paused outbound operation is resumed by calling a system interface, allowing the file with the traceable watermark to be sent normally to the recipient. This seamless watermark embedding and operation recovery mechanism ensures the security and controllability of the data outbound process without affecting the user's normal business operations, effectively improving the practicality and ease of use of bank data outbound management.

[0069] A system for processing outbound data from banks. Figure 2 This is a schematic diagram of the structure of a system for processing outgoing bank data provided in an embodiment of this application. (Refer to...) Figure 2 The system includes an acquisition unit 201, a processing unit 202, and a sending unit 203. When the acquisition unit 201 determines that the target device has an outgoing operation, it captures the account information, device information and timestamp information of the outgoing operation to be executed from the operating system environment of the target device; it obtains the data to be sent from the outgoing operation and parses the data to be sent to obtain data tags; Processing unit 202 automatically pauses outbound operations if the data tag is a sensitive tag, and pushes an authentication request to the target device based on the sensitive tag; receives the identity information submitted by the user after responding to the authentication request, and confirms the user information of the current operator if the identity information is verified; when the user information is consistent with the preset user information corresponding to the account information, confirms that the account information, device information, and timestamp information are formatted into a structured text string; obtains the file extension of the data to be sent, calculates the information entropy of the data to be sent, and analyzes the value of each byte in the data to be sent to obtain the number of times the byte appears; determines the initial file type based on the information entropy and the number of times the byte appears; analyzes the file extension based on the initial file type to determine the target file type; selects the corresponding watermark type based on the target file type, processes the structured text string according to the watermark type using a preset algorithm to generate watermark data; and embeds the watermark data into the data to be sent to generate watermarked data to be sent. The sending unit 203 replaces the data to be sent in the outgoing operation with the watermarked data to be sent, and resumes the execution of the suspended outgoing operation.

[0070] In one possible implementation, the processing unit 202 is used to count the total number of bytes in the data to be sent, and traverse all bytes in the data to be sent; increment the counter corresponding to each byte value according to the byte; the acquisition unit 201 is used to acquire the count value in each counter, divide each count value by the total number of bytes, and obtain a byte frequency distribution histogram constructed from multiple byte frequencies; the processing unit 202 is used to append the information entropy to the byte frequency distribution histogram for combination, and obtain a file content feature vector; calculate the similarity between the file content feature vector and multiple standard content feature vectors to obtain multiple similarity scores; select the target similarity score corresponding to the maximum value from the multiple similarity scores; if the target similarity score is greater than or equal to a preset confidence threshold, then retrieve the preset file type that is pre-associated with the target standard content feature vector in the preset file type library, and use the preset file type as the initial file type.

[0071] In one possible implementation, the acquisition unit 201 is used to acquire a table of document extensions matching the document file type if the initial file type is a document file type; the processing unit 202 is used to determine the initial file type as the target file type when a file extension exists in the file extension table; and to determine the risk status of the data to be sent as high-risk document spoofing when no file extension exists in the document extension table; the acquisition unit 201 is used to acquire a table of image extensions matching the image file type if the initial file type is an image file type; the processing unit 202 is used to determine the initial file type as the target file type when a file extension exists in the image extension table; and to determine the risk status of the data to be sent as medium-risk image spoofing when no file extension exists in the image extension table; the acquisition unit 201 is used to acquire a table of text extensions matching the text file type if the initial file type is a text file type; the processing unit 202 is used to determine the initial file type as the target file type when a file extension exists in the text extension table; and to determine the risk status of the data to be sent as low-risk text spoofing when no file extension exists in the text extension table.

[0072] In one possible implementation, the processing unit 202 is used to determine whether the target file type is any one of high-risk document spoofing, medium-risk image spoofing, and low-risk text spoofing; if so, the watermark type is determined to be an explicit, robust watermark; if not, the user department is queried according to the user information, including core sensitive departments or ordinary business departments; the acquisition unit 201 is used to obtain the recipient address from the outgoing operation, perform a risk assessment on the recipient address, and obtain a risk assessment result; the processing unit 202 is used to determine the watermark type to be an explicit, robust watermark when the user department is a core sensitive department and the risk assessment result is high-risk; when the user department is a core sensitive department and the risk assessment result is a trusted recipient, or when the user department is an ordinary business department and the risk assessment result is high-risk, the watermark type is determined to be an implicit, standard robust watermark; when the user department is an ordinary business department and the risk assessment result is a trusted recipient, the watermark type is determined to be an implicit, basic watermark.

[0073] In one possible implementation, the acquisition unit 201 is used to parse the root domain name and IP address of the recipient address from the outgoing operation, query the root domain name and IP address to obtain the domain name registration duration, IP address reputation status, and certificate validity status; the processing unit 202 is used to compare the domain name registration duration with a preset duration threshold, and determine the domain name risk score based on the duration comparison result; determine the corresponding reputation risk score based on the IP address reputation status, and determine the corresponding certificate risk score based on the certificate validity status; assign corresponding weights to the domain name risk score, reputation risk score, and certificate risk score, and perform a weighted sum of the domain name risk score, reputation risk score, and certificate risk score with their respective weights to obtain the total risk value; when the total risk value is greater than or equal to the high-risk threshold, the risk assessment result is confirmed as high-risk; when the total risk value is less than the high-risk threshold, the risk assessment result is confirmed as a trusted recipient.

[0074] In one possible implementation, the processing unit 202 is configured to: render a structured text string into an initial watermark image containing text information when the watermark type is an explicit, robust watermark; perform array copying on the initial watermark image to generate a background texture; adjust the transparency of the background texture and overlay the adjusted background texture with a preset security grid pattern to generate watermark data; when the watermark type is an implicit, standard, robust watermark, convert the structured text string into a binary bit sequence; apply a preset error correction coding algorithm to the binary bit sequence to generate an enhanced bit sequence; use a pseudo-random number generator to spread the enhanced bit sequence to obtain a pseudo-random noise pattern, and use the pseudo-random noise pattern as watermark data; when the watermark type is an implicit, basic watermark, convert the structured text string into an original binary bit sequence; repeatedly concatenate the original binary bit sequence to obtain a cyclic redundancy sequence, and use the cyclic redundancy sequence as watermark data.

[0075] In one possible implementation, the acquisition unit 201 is used to extract text content from the data to be sent, scan the text content using a preset regular expression pattern to obtain the scan result, the preset regular expression pattern being a regular expression pattern for recognizing bank card numbers, ID card numbers, and mobile phone numbers; the processing unit 202 is used to count the number of target strings in the scan result, compare the number of target strings with a preset threshold, and determine a first sensitivity level based on the comparison result; perform hash calculation on the text content to obtain the target hash value; input the target hash value into a preset sensitivity database for matching to obtain a second sensitivity level; if the first sensitivity level is greater than the second sensitivity level, then the first sensitivity level is determined as a data tag; if the first sensitivity level is less than the second sensitivity level, then the second sensitivity level is determined as a data tag; if the first sensitivity level is equal to the second sensitivity level, then either the first sensitivity level or the second sensitivity level is determined as a data tag.

[0076] It should be noted that the system provided in the above embodiments is only illustrated by the division of the above functional modules. In actual applications, the above functions can be assigned to different functional modules as needed, that is, the internal structure of the device can be divided into different functional modules to complete all or part of the functions described above. In addition, the system and method embodiments provided in the above embodiments belong to the same concept, and the specific implementation process can be found in the method embodiments, which will not be repeated here.

[0077] This application also discloses an electronic device. (See reference...) Figure 3 , Figure 3 This application provides a schematic diagram of the structure of an electronic device. The electronic device 300 may include: at least one processor 301, at least one network interface 304, a user interface 303, a memory 302, and at least one communication bus 305.

[0078] The communication bus 305 is used to enable communication between these components.

[0079] The user interface 303 may include a display screen and a camera. Optionally, the user interface 303 may also include a standard wired interface and a wireless interface.

[0080] The network interface 304 may optionally include a standard wired interface or a wireless interface (such as a Wi-Fi interface).

[0081] The processor 301 may include one or more processing cores. The processor 301 connects to various parts of the server using various interfaces and lines, and performs various server functions and processes data by running or executing instructions, programs, code sets, or instruction sets stored in memory 302, and by calling data stored in memory 302. Optionally, the processor 301 may be implemented using at least one hardware form of Digital Signal Processing (DSP), Field-Programmable Gate Array (FPGA), or Programmable Logic Array (PLA). The processor 301 may integrate one or a combination of several of the following: Central Processing Unit (CPU), Graphics Processing Unit (GPU), and modem. The CPU primarily handles the operating system, user interface, and application requests; the GPU is responsible for rendering and drawing the content required for display; and the modem handles wireless communication. It is understood that the modem may also not be integrated into the processor 301 and may be implemented as a separate chip.

[0082] The memory 302 may include random access memory (RAM) or read-only memory. Optionally, the memory 302 may include a non-transitory computer-readable storage medium. The memory 302 may be used to store instructions, programs, code, code sets, or instruction sets. The memory 302 may include a program storage area and a data storage area. The program storage area may store instructions for implementing an operating system, instructions for at least one function (such as touch functionality, sound playback functionality, image playback functionality, etc.), instructions for implementing the various method embodiments described above, etc. The data storage area may store data involved in the various method embodiments described above. Optionally, the memory 302 may also be at least one storage device located remotely from the aforementioned processor 301.

[0083] like Figure 3 As shown, the memory 302, which serves as a computer storage medium, may include an operating system, a network communication module, a user interface module, and an application program for processing outgoing bank data.

[0084] exist Figure 3In the electronic device 300 shown, the user interface 303 is mainly used to provide an interface for users to input data and obtain user input data; while the processor 301 can be used to call the application program stored in the memory 302 for processing bank outgoing data. When executed by one or more processors, the electronic device performs one or more of the methods described in the above embodiments.

[0085] It should be noted that, for the sake of simplicity, the foregoing method embodiments are all described as a series of actions. However, those skilled in the art should understand that this application is not limited to the described order of actions, as some steps may be performed in other orders or simultaneously according to this application. Furthermore, those skilled in the art should also understand that the embodiments described in the specification are preferred embodiments, and the actions and modules involved are not necessarily essential to this application.

[0086] In the above embodiments, the descriptions of each embodiment have different focuses. For parts not described in detail in a certain embodiment, please refer to the relevant descriptions in other embodiments.

[0087] In the several embodiments provided in this application, it should be understood that the disclosed apparatus can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative; for instance, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the displayed or discussed mutual couplings, direct couplings, or communication connections may be through some service interfaces; indirect couplings or communication connections between devices or units may be electrical or other forms.

[0088] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0089] Furthermore, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0090] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage device (CMD). Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a memory and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this application. The aforementioned memory includes various media capable of storing program code, such as USB flash drives, portable hard drives, magnetic disks, or optical disks.

[0091] The above description is merely an exemplary embodiment of this disclosure and should not be construed as limiting the scope of this disclosure. Any equivalent changes and modifications made in accordance with the teachings of this disclosure shall still fall within the scope of this disclosure. Those skilled in the art will readily conceive of other embodiments of this disclosure upon considering the specification and the disclosure of practical truths. This application is intended to cover any variations, uses, or adaptations of this disclosure that follow the general principles of this disclosure and include common knowledge or customary techniques in the art not described in this disclosure.

Claims

1. A method for processing bank outbound data, characterized in that, The method includes: When it is determined that the target device has an outbound operation, the account information, device information and timestamp information of the outbound operation to be executed are captured from the operating system environment of the target device; Data to be sent is obtained from the outgoing operation, and data tags are obtained by parsing the data to be sent. If the data tag is a sensitive tag, the outgoing operation will be automatically paused, and an authentication request will be pushed to the target device based on the sensitive tag; Receive the identity information submitted by the user after responding to the identity verification request. If the identity information is verified successfully, confirm the user information of the current operator. When the user information matches the preset user information corresponding to the account information, the account information, the device information, and the timestamp information are formatted into a structured text string. Obtain the file extension of the data to be sent, calculate the information entropy of the data to be sent, and analyze the value of each byte in the data to be sent to obtain the number of times the byte appears; The initial file type is determined based on the information entropy and the number of times the byte appears. The file extensions are analyzed based on the initial file type to determine the target file type; Select the corresponding watermark type according to the target file type, process the structured text string according to the watermark type using a preset algorithm to generate watermark data; The watermark data is embedded into the data to be sent to generate watermarked data to be sent. Replace the data to be sent in the outgoing operation with the watermarked data to be sent, and resume the execution of the suspended outgoing operation.

2. The method according to claim 1, characterized in that, The step of determining the initial file type based on the information entropy and the number of occurrences of the byte specifically includes: Count the total number of bytes in the data to be sent, and iterate through all bytes in the data to be sent; The counter corresponding to each byte value is incremented according to the byte; Obtain the count value from each of the counters, divide each count value by the total number of bytes, and obtain a byte frequency distribution histogram constructed from multiple byte frequencies; The information entropy is appended to the byte frequency distribution histogram and combined to obtain the file content feature vector; The similarity score is calculated between the file content feature vector and multiple standard content feature vectors. Select the target similarity score corresponding to the maximum value from the multiple similarity scores; If the target similarity score is greater than or equal to a preset reliability threshold, then a preset file type that is pre-associated with the target standard content feature vector in a preset file type library is retrieved, and the preset file type is used as the initial file type.

3. The method according to claim 1, characterized in that, The initial file types include image file types, document file types, and text file types. Based on the initial file types, the file extensions are analyzed to determine the target file type, specifically including: If the initial file type is the document file type, then obtain the document extension table that matches the document file type; when the file extension exists in the file extension table, the initial file type is determined as the target file type; When the file extension is not found in the document extension table, the risk status of the data to be sent is determined to be high risk of document spoofing; If the initial file type is the image file type, then obtain the image extension table that matches the image file type; when the file extension exists in the image extension table, the initial file type is determined as the target file type; When the file extension is not found in the image extension table, the risk status of the data to be sent is determined to be risky in image spoofing; If the initial file type is the text file type, then obtain the text extension table that matches the text file type; when the file extension exists in the text extension table, the initial file type is determined as the target file type; When the file extension is not found in the text extension table, the risk status of the data to be sent is determined to be low risk of text spoofing.

4. The method according to claim 3, characterized in that, The step of selecting the corresponding watermark type based on the target file type specifically includes: Determine whether the target file type is any one of the following: high-risk document spoofing, medium-risk image spoofing, and low-risk text spoofing; If so, the watermark type is determined to be an explicit and robust watermark; If not, then query the user's department based on the user information. The user department includes core sensitive departments or ordinary business departments. Obtain the recipient address from the outgoing operation, perform a risk assessment on the recipient address, and obtain the risk assessment result; When the user department is the core sensitive department and the risk assessment result is high risk, the watermark type will be determined as the explicit and robust watermark. When the user department is the core sensitive department and the risk assessment result is a trusted recipient, or when the user department is the ordinary business department and the risk assessment result is high risk, the watermark type will be determined as an implicit standard robust watermark. When the user department is the ordinary business department and the risk assessment result is the trusted recipient, the watermark type is determined to be an implicit basic watermark.

5. The method according to claim 4, characterized in that, The step of obtaining the recipient's address from the outbound operation, performing a risk assessment on the recipient's address, and obtaining the risk assessment result specifically includes: The root domain name and IP address of the recipient address are parsed from the outgoing operation. The root domain name and IP address are queried to obtain the domain name registration duration, IP address reputation status, and certificate validity status. The domain name risk score is determined by comparing the domain name registration duration with a preset duration threshold and based on the duration comparison result. The corresponding reputation risk score is determined based on the reputation status of the IP address, and the corresponding certificate risk score is determined based on the validity status of the certificate. Assign corresponding weights to the domain name risk score, the reputation risk score, and the certificate risk score, and then sum the domain name risk score, reputation risk score, and certificate risk score with their respective weights to obtain the total risk value. When the total risk value is greater than or equal to the high risk threshold, the risk assessment result is confirmed as high risk. When the total risk value is less than the high-risk threshold, the risk assessment result is confirmed as the trusted recipient.

6. The method according to claim 4, characterized in that, The step of processing the structured text string according to the watermark type using a preset algorithm to generate watermark data specifically includes: When the watermark type is the explicit strong robust watermark, the structured text string is rendered into an initial watermark image containing text information. The initial watermark image is array-copied to generate a background texture; the transparency of the background texture is adjusted, and the adjusted background texture is superimposed on a preset security grid pattern to generate the watermark data; When the watermark type is the implicit standard robust watermark, the structured text string is converted into a binary bit sequence; A preset error correction coding algorithm is applied to the binary bit sequence to generate an enhanced bit sequence; The enhanced bit sequence is spread using a pseudo-random number generator to obtain a pseudo-random noise pattern, which is then used as the watermark data. When the watermark type is the implicit basic watermark, the structured text string is converted into the original binary bit sequence; The original binary bit sequence is repeatedly spliced ​​to obtain a cyclic redundancy sequence, which is then used as the watermark data.

7. The method according to claim 1, characterized in that, The step of obtaining the data to be sent from the outgoing operation and parsing the data to be sent to obtain data tags specifically includes: Text content is extracted from the data to be sent, and the text content is scanned using a preset regular expression pattern to obtain the scanning result. The preset regular expression pattern is used to identify the regular expression pattern of bank card number, ID card number and mobile phone number. The number of target strings in the scan results is counted, and the number of target strings is compared with a preset threshold. Based on the comparison result, a first sensitivity level is determined. Perform a hash calculation on the text content to obtain the target hash value; The target hash value is input into a preset sensitive database for matching to obtain the second sensitivity level; If the first sensitivity level is greater than the second sensitivity level, then the first sensitivity level is determined as the data tag; If the first sensitivity level is lower than the second sensitivity level, then the second sensitivity level is determined as the data tag; If the first sensitivity level is equal to the second sensitivity level, then the first sensitivity level or the second sensitivity level is determined as the data tag.

8. A system for processing outgoing bank data, characterized in that, The system includes an acquisition unit, a processing unit, and a sending unit. When the acquisition unit determines that the target device has an outgoing operation, it captures the account information, device information, and timestamp information of the outgoing operation to be executed from the operating system environment of the target device; it obtains the data to be sent from the outgoing operation and parses the data to be sent to obtain data tags. If the data tag is a sensitive tag, the processing unit automatically pauses the outgoing operation and pushes an authentication request to the target device based on the sensitive tag. Receive the identity information submitted by the user after responding to the identity verification request. If the identity information is verified successfully, confirm the user information of the current operator. When the user information matches the preset user information corresponding to the account information, the account information, the device information, and the timestamp information are formatted into a structured text string. Obtain the file extension of the data to be sent, calculate the information entropy of the data to be sent, and analyze the value of each byte in the data to be sent to obtain the number of times the byte appears; determine the initial file type based on the information entropy and the number of times the byte appears; The file extension is analyzed based on the initial file type to determine the target file type; the corresponding watermark type is selected based on the target file type, and the structured text string is processed according to the watermark type using a preset algorithm to generate watermark data; the watermark data is embedded into the data to be sent to generate watermarked data to be sent. The sending unit replaces the data to be sent in the outgoing operation with the watermarked data to be sent, and resumes the execution of the suspended outgoing operation.

9. An electronic device, characterized in that, The device includes a processor, a memory, a user interface, and a network interface. The memory is used to store instructions, the user interface and the network interface are used to communicate with other devices, and the processor is used to execute the instructions stored in the memory to cause the electronic device to perform the method as described in any one of claims 1-7.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores instructions that, when executed, perform the method as described in any one of claims 1-7.

Images