Data monitoring method and device, electronic equipment, medium and program product
By decrypting and identifying plaintext data in encrypted traffic within a trusted detection space, the problems of poor privacy protection and reliability of identification results in sensitive data monitoring of encrypted traffic are solved, enabling efficient sensitive data monitoring under user authorization.
Patent Information
- Application Number
- CN202511632949.8
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-11-07
- Publication Date
- 2026-02-13
AI Technical Summary
Existing encrypted traffic sensitive data monitoring solutions suffer from poor privacy protection and unreliable identification results. In particular, decryption and identification solutions based on man-in-the-middle agents pose a risk of privacy leakage, while AI-based ciphertext identification solutions are unreliable.
It adopts an independently deployed trusted detection space, obtains the target authorization information of the client through the monitoring instructions sent by the regulatory end, decrypts the encrypted traffic, uses a pre-trained detection model to identify plaintext data, generates feedback information and pushes it to the regulatory end, ensuring that sensitive data monitoring is carried out with user authorization.
This improves the privacy protection and reliability of the identification results of encrypted traffic sensitive data monitoring, ensuring that the regulatory authorities can reliably identify sensitive data without disclosing user data.
Smart Images
Figure CN121530644A_ABST
Abstract
Description
Technical Field
[0001] This application relates to the field of data security technology, and in particular to a data monitoring method, device, electronic device, medium, and program product. Background Technology
[0002] Monitoring and identifying sensitive data in encrypted traffic is a crucial aspect of network content governance. Relevant solutions for monitoring and identifying sensitive data in encrypted traffic include decryption and identification schemes based on man-in-the-middle proxies, and ciphertext identification schemes based on artificial intelligence.
[0003] However, decryption and identification schemes based on man-in-the-middle agents pose a risk of privacy breaches; and AI-based encrypted text recognition schemes have poor reliability in identifying sensitive data. Therefore, these schemes suffer from poor privacy protection and unreliable recognition results. Summary of the Invention
[0004] This application provides a data monitoring method, apparatus, electronic device, medium, and program product for improving privacy protection and the reliability of identification results when identifying sensitive data.
[0005] Firstly, this application provides a data monitoring method applied to a server, the server having a trusted detection space deployed therein, and the server performing the following method within the trusted detection space: Obtain monitoring instructions sent by the regulatory authority. The monitoring instructions include a list of regulated domain names and a pre-trained detection model. Receive target authorization information sent by the client according to the monitoring instructions; The encrypted traffic of the client accessing domains in the list of monitored domains is obtained, and the encrypted traffic is decrypted according to the target authorization information to obtain plaintext data. The plaintext data is identified using a detection model to obtain the identification results; the identification results are used to indicate whether there is any illegal or sensitive content in the plaintext data. Feedback information is generated based on the identification results and then pushed to the regulatory authorities.
[0006] The technical solution provided in this application offers at least the following benefits: An independently deployed trusted detection space obtains target authorization information sent by the client and encrypted traffic when the client accesses domains in the monitored domain list via monitoring commands sent by the regulatory authority. Based on the target authorization information, the encrypted traffic is decrypted to obtain plaintext data. This plaintext data is then identified using the detection model in the monitoring commands to obtain feedback information, which is then pushed to the regulatory authority. Thus, based on the independently deployed trusted detection space, sensitive data in encrypted traffic can be decrypted and identified with user authorization, making the sensitive data in encrypted traffic usable but invisible to the regulatory authority, thereby improving privacy protection. Furthermore, the identification of sensitive data based on the decrypted plaintext data improves the reliability of the identification results.
[0007] One possible implementation involves receiving target authorization information sent by the client according to the monitoring instructions, including: sending a list of monitored domains to the client, the list of monitored domains including multiple domains that need to be monitored for content; Detect whether the client needs to access domains in the regulated domain list; In response to the detection that the client needs to access a domain in the list of regulated domains, obtain the target authorization information.
[0008] Another possible implementation involves obtaining target authorization information in response to detecting that a client needs to access a domain in the regulated domain list, including: If it is detected that the client needs to access a domain in the list of monitored domains, the system receives the initial authorization information sent by the client. The initial authorization information is used to instruct the user to authorize the monitored data content, which includes the authorized domain. When a client accesses an authorized domain, the initial authorization information is updated to obtain the target authorization information.
[0009] Another possible implementation involves updating the initial authorization information, including receiving update information sent by the client, which indicates the list of decryption keys and cipher suites generated during the protocol negotiation phase. Add the decryption key list and the encryption suite to the initial authorization information to obtain the target authorization information; The decryption key list indicates the necessary parameters for generating encryption / decryption keys, while the encryption suite indicates the encryption algorithm used to generate the corresponding key.
[0010] Another possible implementation is to obtain encrypted traffic when the client accesses domains in the regulated domain list, including: encrypted traffic between the website corresponding to the domain in the regulated domain list and the client, and mirroring the encrypted traffic when it flows through the client's edge router.
[0011] Another possible implementation involves decrypting the encrypted traffic based on the target authorization information. This includes generating a corresponding decryption key based on the decryption key list and encryption suite in the target authorization information, and then using the decryption key to decrypt the encrypted traffic to obtain plaintext data.
[0012] Another possible implementation involves generating feedback information based on the recognition results, including: If the identification result indicates that there is illegal or sensitive content in the plaintext data, an alarm message is generated based on the illegal or sensitive content, and the alarm message is pushed to the regulatory end as feedback information so that the regulatory end can determine the handling measures based on the feedback information; If the identification result indicates that there is no illegal or sensitive content in the plaintext data, a normal work log is generated and pushed to the regulatory authority as feedback information.
[0013] Secondly, this application provides a data monitoring device, comprising: The acquisition module is used to acquire monitoring instructions sent by the regulatory authority. The monitoring instructions include a list of regulatory domains and a pre-trained detection model. The processing module is used to receive target authorization information sent by the client according to the monitoring instructions; The processing module is also used to obtain encrypted traffic when the client accesses domains in the list of supervised domains, and to decrypt the encrypted traffic according to the target authorization information to obtain plaintext data; The identification module is used to identify plaintext data through a detection model and obtain identification results; the identification results are used to indicate whether there is any illegal or sensitive content in the plaintext data. The identification module is also used to generate feedback information based on the identification results and push the feedback information to the regulatory end.
[0014] Thirdly, this application provides an electronic device comprising: a processor and a memory; the memory storing processor-executable instructions; when the processor is configured to execute the instructions, causing the electronic device to implement the method of the first aspect described above.
[0015] Fourthly, this application provides a computer-readable storage medium comprising: computer software instructions; which, when executed in an electronic device, cause the electronic device to implement the method described in the first aspect.
[0016] Fifthly, this application provides a computer program product comprising a computer program; when the computer program is run in an electronic device, the electronic device performs the method described in the first aspect.
[0017] The beneficial effects of the second to fifth aspects mentioned above are described in the corresponding description of the first aspect and will not be repeated here. Attached Figure Description
[0018] Figure 1 This is a schematic diagram illustrating the application environment of a data monitoring method provided in an embodiment of this application; Figure 2 A flowchart illustrating a data monitoring method provided in an embodiment of this application; Figure 3 A flowchart illustrating another data monitoring method provided in this application embodiment; Figure 4 A flowchart illustrating yet another data monitoring method provided in this application embodiment; Figure 5 A flowchart illustrating yet another data monitoring method provided in this application embodiment; Figure 6 This is a schematic diagram illustrating the composition of a data monitoring device provided in an embodiment of this application; Figure 7 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application. Detailed Implementation
[0019] The following is a detailed description of a call detail record (CDR) data recording method provided in this application, with reference to the accompanying drawings.
[0020] In this article, the term "and / or" is merely a description of the relationship between related objects, indicating that there can be three relationships. For example, A and / or B can represent three situations: A exists alone, A and B exist simultaneously, and B exists alone.
[0021] To facilitate a clear description of the technical solutions of the embodiments of this application, the terms "first" and "second" are used in the embodiments of this application to distinguish the same or similar items with essentially the same function and effect. Those skilled in the art can understand that the terms "first" and "second" are not intended to limit the quantity or execution order.
[0022] Furthermore, the terms "comprising" and "having," and any variations thereof, used in the description of this application are intended to cover non-exclusive inclusion. For example, a process, method, system, product, or apparatus that includes a series of steps or units is not limited to the steps or units listed, but may optionally include other steps or units not listed, or may optionally include other steps or units inherent to such process, method, product, or apparatus.
[0023] In the description of this application, unless otherwise stated, "a plurality of" means two or more.
[0024] With the development and popularization of the internet, user data, as a core production factor, is circulating more and more frequently in social operations, economic activities, and cultural dissemination, making its value increasingly important. However, at the same time, security incidents such as data privacy breaches, the spread of online rumors, and the proliferation of harmful information occur frequently, not only seriously infringing upon individuals' legitimate rights and interests but also posing a severe threat to public order and national information security. Therefore, real-time identification and dynamic monitoring of sensitive data based on network traffic has become an important aspect of internet content governance.
[0025] The trend towards encryption in network communication presents challenges to network content governance. Current network communications typically employ encrypted traffic protocols such as HTTPS (Hypertext Transfer Protocol Secure) to encrypt user communication privacy. While protecting user privacy, encryption also masks the content of the traffic, rendering conventional techniques like sensitive word matching and signature comparison inapplicable. This poses a challenge to identifying and monitoring sensitive data within encrypted traffic.
[0026] Solutions for monitoring and identifying sensitive data in encrypted traffic include decryption and identification schemes based on man-in-the-middle agents, and ciphertext identification schemes based on artificial intelligence.
[0027] For decryption and identification schemes based on man-in-the-middle proxies, security devices such as WAF (Web Application Firewall) and IPS (Intrusion Prevention System) are deployed at network nodes to intervene in the encrypted communication link in a serial manner. By using pre-set certificates or obtaining keys, the encrypted traffic is forcibly decrypted, and the ciphertext is restored to plaintext. Then, a manually defined sensitive word library or text feature model is used for content matching to identify sensitive data in the encrypted traffic.
[0028] For AI-based encrypted message recognition solutions, machine learning models are trained to classify and identify sensitive content by extracting statistical features of encrypted traffic, such as packet length distribution, temporal characteristics, or protocol field variations.
[0029] However, decryption and identification schemes based on man-in-the-middle proxies, by employing a transparent proxy model linked in the network link, may force users to decrypt and monitor information without their knowledge. This not only poses a risk of privacy breaches due to the unauthorized collection and misuse of personal information, but also limits their application in scenarios with stringent privacy protection requirements, such as finance and healthcare, due to the lack of a user authorization process. Therefore, decryption and identification schemes based on man-in-the-middle proxies suffer from poor privacy protection.
[0030] AI-based ciphertext recognition schemes suffer from poor reliability because even minor changes to the plaintext or key can cause drastic changes in the ciphertext, completely masking the statistical characteristics of the encrypted traffic. This makes it impossible to verify the correlation between the AI model's output based on the encrypted traffic and the actual sensitive content. This unverifiability prevents the deployed AI model from being reliably applied to the accurate interception and processing of sensitive data. Therefore, AI-based ciphertext recognition schemes exhibit poor reliability.
[0031] Therefore, solutions for monitoring and identifying sensitive data in encrypted traffic suffer from poor privacy protection and unreliable identification results.
[0032] To address the aforementioned technical issues, this application provides a data monitoring method, apparatus, electronic device, medium, and program product. An independently deployed trusted detection space receives target authorization information from a client via monitoring instructions sent by a regulatory authority. It then obtains encrypted traffic from domains accessing the regulatory domain list in the monitoring instructions, decrypts the encrypted traffic based on the target authorization information to obtain plaintext data, identifies the plaintext data using a detection model within the monitoring instructions, generates feedback information based on the identification results, and pushes the feedback information to the regulatory authority. Thus, based on an independently deployed trusted detection space, sensitive data in encrypted traffic can be decrypted and identified with user authorization. This makes sensitive data in encrypted traffic usable but invisible to the regulatory authority, improving privacy protection. Furthermore, identifying sensitive data based on the decrypted plaintext data enhances the reliability of the identification results.
[0033] The embodiments provided in this application will now be described in detail with reference to the accompanying drawings.
[0034] Figure 1 This diagram illustrates an application environment for a data monitoring method provided in an embodiment of this application. The data monitoring method provided in this application can be applied to, for example... Figure 1 The application environment shown. For example... Figure 1 As shown, the application environment includes: server 101, client 102, and monitoring terminal 103. Server 101, client 102, and monitoring terminal 103 are interconnected.
[0035] In some embodiments, a trusted detection space is independently deployed in server 101. Server 101 executes the aforementioned data monitoring method in the trusted detection space. Through the hardware-isolated trusted detection space, it is ensured that the monitoring end can only obtain plaintext detection results and cannot obtain decrypted plaintext data. The trusted detection space functions include instruction sending and receiving, key and model synchronization, traffic encryption and decryption, and data content identification.
[0036] For example, the instruction sending and receiving function is used to receive the target authorization information and session key from the client, to provide feedback to the client on the handling measures of the regulatory end, to send the identification results to the regulatory end, and to receive the monitoring instructions from the regulatory end.
[0037] For example, the key and model synchronization function is used to save and maintain the target authorization information sent by the client and the detection model sent by the supervisor.
[0038] For example, for the traffic encryption / decryption function, the associated session key is used to decrypt the client's encrypted traffic to obtain plaintext data; for the data content recognition function, the detection model sent by the supervisory end is used to perform content recognition on the plaintext data.
[0039] In some embodiments, the communication chain between server 101 and client 102 includes a first control chain and a data chain. The first control chain is used to transmit control instructions, such as authorization information, keys, and notification information, between the user of client 102 and the trusted detection space of server 101. The data chain is used to transmit encrypted traffic from the user of client 102 accessing the Internet to the trusted detection space of server 101.
[0040] In some embodiments, the communication chain between server 101 and monitoring terminal 103 includes a second control chain, wherein the second control chain is used for monitoring terminal 103 to send monitoring instructions to trusted detection space of server 101, and for trusted detection space of server 101 to push generated feedback information to monitoring terminal 103.
[0041] In some embodiments, server 101 and monitoring terminal 103 can be a single server or a server cluster consisting of multiple servers. This application embodiment does not limit the specific device form of server 101 and monitoring terminal 103. Figure 1 The example shown uses a single server as an example, where both server 101 and monitoring terminal 103 are single servers.
[0042] In some embodiments, client 102 can be a device with wireless transceiver capabilities, such as a mobile phone, tablet computer, wearable device, in-vehicle device, augmented reality (AR) / virtual reality (VR) device, laptop computer, ultra-mobile personal computer (UMPC), netbook, personal digital assistant (PDA), etc. This application embodiment does not limit the specific device form of client 102. Figure 1 The example shown is a computer terminal, with client 102 as the terminal.
[0043] In some embodiments, the trusted detection space deployed in server 101 obtains monitoring instructions sent by supervisory terminal 103, enabling server 101 to receive target authorization information sent by client according to the monitoring instructions.
[0044] In some embodiments, when the client 102 accesses a domain in the monitoring domain list in the monitoring instruction, the server 101 mirrors and obtains the encrypted traffic between the website and the client 102; the trusted detection space in the server 101 decrypts the encrypted traffic according to the target authorization information to obtain plaintext data.
[0045] In some embodiments, the trusted detection space in server 101 identifies plaintext data through the detection model in the monitoring instruction to obtain an identification result indicating whether there is any illegal sensitive content in the plaintext data; the trusted detection space in server 101 generates feedback information based on the identification result and pushes the feedback information to the supervisory terminal 103.
[0046] It should be noted that the application environment described in the embodiments of this application is for the purpose of more clearly illustrating the technical solutions of the embodiments of this application, and does not constitute a limitation on the technical solutions provided in the embodiments of this application. As those skilled in the art will know, as the application environment evolves, the technical solutions provided in the embodiments of this application are also applicable to similar technical problems.
[0047] The data monitoring method provided in the embodiments of this application will be described in detail below with reference to the accompanying drawings.
[0048] Figure 2 This is a flowchart illustrating a data monitoring method provided in an embodiment of this application. The data monitoring method provided in this embodiment is applied to... Figure 1 The trusted detection space is independently deployed in server 101 shown. Combined with... Figure 2 As shown, this data monitoring method includes the following steps: S201. Obtain monitoring instructions sent by the regulatory authority.
[0049] In some embodiments, the regulatory authority sends monitoring instructions to an independently deployed trusted detection space, wherein the monitoring instructions include a list of regulatory domain names and a pre-trained detection model.
[0050] For example, after receiving a monitoring instruction, the list of regulated domain names and the detection model in the monitoring instruction are updated and maintained. The update and maintenance refers to receiving the latest list of regulated domain names and the detection model sent by the regulatory end, and overwriting the historical list of regulated domain names and the historical detection model with the latest list of regulated domain names and the historical detection model.
[0051] S202. Receive target authorization information sent by the client according to the monitoring instructions.
[0052] In some embodiments, after receiving a monitoring instruction from the regulatory authority, the Trusted Detection Space notifies the client of the list of regulatory domains in the monitoring instruction. When the client accesses a domain in the list of regulatory domains, the client authorizes the Trusted Detection Space to access the encrypted traffic data content of the domains in the list of regulatory domains, that is, to send target authorization information to the Trusted Detection Space.
[0053] S203. Obtain the encrypted traffic when the client accesses domains in the list of monitored domains, and decrypt the encrypted traffic according to the target authorization information to obtain plaintext data.
[0054] In some embodiments, when encrypted traffic between the website and the client corresponding to a domain in the regulatory domain list flows through the client's edge router, the trusted detection space mirror obtains the encrypted traffic and decrypts it according to the key in the target authorization information.
[0055] S204. The plaintext data is identified using a detection model to obtain the identification results.
[0056] In some embodiments, after obtaining the plaintext data through decryption, the plaintext data is used as input data and fed into the detection model in the monitoring instruction. The detection model outputs the identification result. The identification result is used to indicate whether there is any illegal or sensitive content in the plaintext data. The detection model is a natural language processing model obtained through pre-training. The detection model is able to identify keywords and sensitive data categories.
[0057] S205. Generate feedback information based on the identification results and push the feedback information to the regulatory end.
[0058] In some embodiments, after obtaining the identification result, if the identification result indicates that there is illegal sensitive content in the plaintext data, an alarm message is generated based on the illegal sensitive content, and the alarm message is pushed to the regulatory end as feedback information so that the regulatory end can determine the handling measures based on the feedback information.
[0059] For example, the handling methods include webpage redirection, blocking access to URLs (Uniform Resource Locators), blocking access to IP addresses, etc., and the handling instructions regarding the handling methods are sent to the edge firewall of the client.
[0060] In some embodiments, if the identification result indicates that there is no illegal or sensitive content in the plaintext data, a normal operation log is generated and pushed to the supervisory end as feedback information. At this time, the client's edge firewall allows encrypted traffic when the client accesses domains in the supervisory domain list.
[0061] In this embodiment, the independently deployed trusted detection space receives target authorization information from the client via monitoring instructions sent by the regulatory authority. It then obtains the encrypted traffic when the client accesses domains listed in the regulatory domain list within the monitoring instructions. Based on the target authorization information, it decrypts the encrypted traffic to obtain plaintext data. This plaintext data is then identified using the detection model in the monitoring instructions, yielding an identification result. Feedback information is generated based on the identification result and pushed to the regulatory authority. Thus, based on the independently deployed trusted detection space, sensitive data in encrypted traffic is decrypted and identified with user authorization. This makes the sensitive data in encrypted traffic usable but invisible to the regulatory authority, improving privacy protection. Furthermore, the identification of sensitive data is based on the decrypted plaintext data, thereby improving the reliability of the identification results.
[0062] Figure 3 This is a flowchart illustrating another data monitoring method provided in an embodiment of this application. (In conjunction with...) Figure 3 As shown, in step S202 above, receiving the target authorization information sent by the client according to the monitoring instruction can be implemented as follows: S2021. Send a list of regulated domain names to the client.
[0063] In some embodiments, after receiving a monitoring instruction from the regulatory authority, the Trusted Detection Space sends a list of regulatory domains from the monitoring instruction to the client. The list of regulatory domains includes multiple regulatory domains that need to be monitored for content. The list of regulatory domains is shown in Table 1 below: Table 1
[0064] S2022. Detect whether the client needs to access domains in the list of regulated domains.
[0065] In some embodiments, after the client receives the list of regulated domains sent by the Trusted Detection Space, if a user of the client needs to access a website corresponding to a regulated domain in the list, the client sends initial authorization information to the Trusted Detection Space.
[0066] For example, if a user using the client does not need to access the website corresponding to the regulated domain in the regulated domain list, then the client remains silent until it needs to access the website corresponding to the regulated domain in the regulated domain list.
[0067] S2023. In response to the detection that the client needs to access a domain in the list of regulated domains, obtain the target authorization information.
[0068] In some embodiments, if a user using a client needs to access a website corresponding to a regulated domain in the list of regulated domains, the Trusted Detection Space receives the initial authorization information sent by the client, and when the client accesses the website corresponding to the regulated domain, the Trusted Detection Space obtains the target authorization information, including the key, based on the initial authorization information.
[0069] In this embodiment, by sending target authorization information to an independently deployed trusted detection space, the trusted detection space can decrypt and identify sensitive data in encrypted traffic based on the target authorization information when authorized by the user. This ensures that the user's personal data privacy is not violated, meets the regulatory requirements for the governance of sensitive data, and improves privacy protection.
[0070] Figure 4 This is a flowchart illustrating yet another data monitoring method provided in an embodiment of this application. (In conjunction with...) Figure 4 As shown, in step S2023 above, in response to detecting that the client needs to access a domain name in the list of supervised domain names, obtaining the target authorization information can be achieved through the following steps: S301. If it is detected that the client needs to access a domain in the list of supervised domains, receive the initial authorization information sent by the client.
[0071] In some embodiments, the initial authorization information is used to instruct the user to authorize the data content to be monitored. The data content to be authorized includes the authorized domain name, the user identifier, and the monitoring IP address corresponding to the authorized domain name.
[0072] For example, when user A on the client side authorizes monitoring of access to content on goo.com, the initial authorization information is shown in Table 2 below: Table 2
[0073] S302. When the client accesses the authorized domain name, the initial authorization information is updated to obtain the target authorization information.
[0074] In some embodiments, when a client user accesses a website corresponding to a regulated domain name, the client sends update information to the trusted detection space. The update information is used to indicate the decryption key list and encryption suite generated during the protocol negotiation phase. The decryption key list is used to indicate the necessary parameters for generating encryption keys and decryption keys, and the encryption suite is used to indicate the encryption algorithm for generating the corresponding key.
[0075] In some embodiments, a list of decryption keys and encryption suites are added to the initial authorization information to obtain the target authorization information.
[0076] For example, when user A accesses the goo.com domain, a decryption key list is generated during the protocol negotiation phase. The decryption key list and encryption suite are then sent to the trusted detection space as update information to update the initial authorization information, resulting in the target authorization information, as shown in Table 3 below: Table 3
[0077] The encryption suite used is the ChaCha20 authentication encryption algorithm, and the decryption key list consists of necessary parameters for generating encryption and decryption keys, such as k1 being the stream key and k2 being the initial counter.
[0078] In this embodiment of the application, by sending initial authorization information and update information to an independently deployed trusted detection space, the trusted detection space can identify sensitive data in encrypted traffic based on the initial authorization information and update information, provided that the user authorizes it, thereby ensuring that the user's personal data privacy is not violated.
[0079] Figure 5 This is a flowchart illustrating yet another data monitoring method provided in an embodiment of this application. (In conjunction with...) Figure 5 As shown, in step S203 above, decrypting the encrypted traffic based on the target authorization information can be achieved through the following steps: S2031. Generate the corresponding decryption key based on the decryption key list and encryption suite in the target authorization information.
[0080] In some embodiments, after obtaining the target authorization information, a corresponding decryption kit is determined in the algorithm database according to the encryption kit, wherein the decryption kit is used to indicate the decryption algorithm for generating the corresponding key, and the decryption key is generated by using the necessary parameters in the decryption key list in the target authorization information through the decryption kit; the algorithm database pre-associates and stores multiple sets of different encryption algorithms and decryption algorithms.
[0081] S2032. Decrypt the encrypted traffic using the decryption key to obtain plaintext data.
[0082] For example, when the decryption key for user A's access to the goo.com domain is obtained, the encrypted traffic of user A's access to the goo.com domain is decrypted using the decryption key to obtain the decrypted plaintext data.
[0083] In this embodiment, sensitive data in encrypted traffic is decrypted and identified with user authorization, and the identification of sensitive data is performed based on the decrypted plaintext data, thereby improving the reliability of the identification results.
[0084] As can be seen, the above mainly describes the solutions provided by the embodiments of this application from a methodological perspective. To achieve the above functions, the embodiments of this application provide corresponding hardware structures and / or software modules for executing each function. Those skilled in the art should readily recognize that, in conjunction with the modules and algorithm steps of the various examples described in the embodiments disclosed herein, the embodiments of this application can be implemented in hardware or a combination of hardware and computer software. Whether a function is executed by hardware or by computer software driving hardware depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this invention.
[0085] This application embodiment can divide the data monitoring device into functional modules according to the above method example. For example, each function can be divided into its own functional module, or two or more functions can be integrated into one processing module. The integrated module can be implemented in hardware or as a software functional module. Optionally, the module division in this application embodiment is illustrative and only represents one logical functional division; other division methods may be used in actual implementation.
[0086] In some embodiments, this application also provides a data monitoring device. The data monitoring device may include one or more functional modules for implementing the data monitoring method of the above method embodiments.
[0087] For example, Figure 6 This is a schematic diagram illustrating the composition of a data monitoring device provided in an embodiment of this application. Figure 6 As shown, the data monitoring device includes: an acquisition module 601, a processing module 602, and an identification module 603.
[0088] The acquisition module 601 is used to acquire monitoring instructions sent by the regulatory end. The monitoring instructions include a list of regulatory domain names and a pre-trained detection model.
[0089] The processing module 602 is used to receive target authorization information sent by the client according to the monitoring instructions.
[0090] The processing module 602 is also used to obtain encrypted traffic when the client accesses domains in the list of supervised domains, and to decrypt the encrypted traffic according to the target authorization information to obtain plaintext data.
[0091] The identification module 603 is used to identify plaintext data through a detection model and obtain identification results; the identification results are used to indicate whether there is any illegal or sensitive content in the plaintext data.
[0092] The identification module 603 is also used to generate feedback information based on the identification results and push the feedback information to the regulatory end.
[0093] In some embodiments, the processing module 602 is specifically used to send a list of monitored domains to the client, the list of monitored domains including multiple domains that need to be monitored for content. Detect whether the client needs to access domains in the regulated domain list; In response to the detection that the client needs to access a domain in the list of regulated domains, obtain the target authorization information.
[0094] In other embodiments, the processing module 602 is specifically configured to receive initial authorization information sent by the client if it is detected that the client needs to access a domain name in the list of supervised domain names. The initial authorization information is used to instruct the user to authorize supervised data content, and the authorized supervised data content includes authorized domain names. When a client accesses an authorized domain, the initial authorization information is updated to obtain the target authorization information.
[0095] In some other embodiments, the processing module 602 is specifically configured to receive update information sent by the client, the update information being used to indicate the decryption key list and encryption suite generated during the protocol negotiation phase; Add the decryption key list and encryption suite to the initial authorization information to obtain the target authorization information; The decryption key list indicates the necessary parameters for generating encryption / decryption keys, while the encryption suite indicates the encryption algorithm used to generate the corresponding key.
[0096] In some other embodiments, the processing module 602 is specifically used to mirror encrypted traffic that is exchanged between the website and the client corresponding to the domain in the regulatory domain list when it flows through the client's edge router.
[0097] In some other embodiments, the processing module 602 is specifically used to generate a corresponding decryption key based on the decryption key list and encryption suite in the target authorization information, and to decrypt the encrypted traffic using the decryption key to obtain plaintext data.
[0098] In some other embodiments, the identification module 603 is specifically used to generate alarm information based on the illegal sensitive content if the identification result indicates that there is illegal sensitive content in the plaintext data, and push the alarm information as feedback information to the regulatory end so that the regulatory end can determine the handling measures based on the feedback information. If the identification result indicates that there is no illegal or sensitive content in the plaintext data, a normal work log is generated and pushed to the regulatory authority as feedback information.
[0099] When the functionality of the integrated modules described above is implemented in hardware, Figure 7 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application. Figure 7 As shown, the electronic device includes: a processor 702, a communication interface 703, and a bus 704. Optionally, the electronic device may also include a memory 701.
[0100] Processor 702 may implement or execute various exemplary logic blocks, modules, and circuits described in conjunction with the disclosure of this application. Processor 702 may be a central processing unit, a general-purpose processor, a digital signal processor, an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA), or other programmable logic devices, transistor logic devices, hardware components, or any combination thereof. It may implement or execute various exemplary logic blocks, modules, and circuits described in conjunction with the disclosure of this application. Processor 702 may also be a combination implementing computational functions, such as including CPU0 and CPU1.
[0101] The communication interface 703 includes a receiving unit and a transmitting unit, and is used to connect with other devices via a communication network. This communication network can be Ethernet, a wireless access network, a wireless local area network (WLAN), etc.
[0102] The memory 701 may be a read-only memory (ROM) or other type of static storage device capable of storing static information and instructions, random access memory (RAM) or other type of dynamic storage device capable of storing information and instructions, or electrically erasable programmable read-only memory (EEPROM), disk storage medium or other magnetic storage device, or any other medium capable of carrying or storing desired program code in the form of instructions or data structures and accessible by a computer, but is not limited thereto.
[0103] In one possible implementation, the memory 701 can exist independently of the processor 702. The memory 701 can be connected to the processor 702 via a bus 704 and is used to store instructions or program code. When the processor 702 calls and executes the instructions or program code stored in the memory 701, it can implement the data monitoring method provided in this embodiment of the invention.
[0104] In another possible implementation, the memory 701 can also be integrated with the processor 702.
[0105] The 704 bus can be an extended industry standard architecture (EISA) bus, etc. The 704 bus can be divided into address bus, data bus, control bus, etc. For ease of representation, Figure 7 The bus is represented by a single thick line, but this does not mean that there is only one bus or one type of bus.
[0106] Through the above description of the implementation methods, those skilled in the art can clearly understand that, for the sake of convenience and brevity, only the division of the above functional modules is used as an example. In actual applications, the above functions can be assigned to different functional modules as needed, that is, the internal structure of the service calling device can be divided into different functional modules to complete all or part of the functions described above.
[0107] This application also provides a computer-readable storage medium. All or part of the processes in the above method embodiments can be executed by computer instructions instructing related hardware. The program can be stored in the aforementioned computer-readable storage medium, and when executed, it can include the processes of the above method embodiments. The computer-readable storage medium can be any of the foregoing embodiments or memory. The aforementioned computer-readable storage medium can also be an external storage device of the aforementioned service invocation device, such as a plug-in hard drive, smart media card (SMC), secure digital (SD) card, flash card, etc., equipped on the aforementioned service invocation device. Further, the aforementioned computer-readable storage medium can include both internal storage units of the aforementioned service invocation device and external storage devices. The aforementioned computer-readable storage medium is used to store the aforementioned computer program and other programs and data required by the aforementioned service invocation device. The aforementioned computer-readable storage medium can also be used to temporarily store data that has been output or will be output.
[0108] This application also provides a computer program product, which includes a computer program that, when run on a computer, causes the computer to perform any of the data monitoring methods provided in the above embodiments.
[0109] The above are merely specific embodiments of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions within the technical scope disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.
Claims
1. A data monitoring method, characterized in that, Applied to a server, the server having a trusted detection space, the server performs the following method within the trusted detection space: Obtain monitoring instructions sent by the regulatory authority, the monitoring instructions including a list of regulatory domains and a pre-trained detection model; Receive target authorization information sent by the client according to the monitoring instructions; The encrypted traffic of the client accessing domains in the list of monitored domains is obtained, and the encrypted traffic is decrypted according to the target authorization information to obtain plaintext data; The plaintext data is identified using the detection model to obtain an identification result; the identification result is used to indicate whether there is any illegal or sensitive content in the plaintext data. Feedback information is generated based on the identification results and then pushed to the monitoring terminal.
2. The method according to claim 1, characterized in that, The step of receiving target authorization information sent by the client according to the monitoring instruction includes: The list of monitored domains is sent to the client, the list of monitored domains including multiple domains that need to be monitored for content. Detect whether the client needs to access a domain in the list of monitored domains; In response to detecting that the client needs to access a domain in the list of supervised domains, the target authorization information is obtained.
3. The method according to claim 2, characterized in that, The step of obtaining the target authorization information in response to detecting that the client needs to access a domain in the list of supervised domains includes: If it is detected that the client needs to access a domain name in the list of monitored domain names, the system receives initial authorization information sent by the client. The initial authorization information is used to instruct the user to authorize monitored data content, and the authorized monitored data content includes authorized domain names. When the client accesses the authorized domain name, the initial authorization information is updated to obtain the target authorization information.
4. The method according to claim 3, characterized in that, The update of the initial authorization information includes: Receive update information sent by the client, the update information being used to indicate the list of decryption keys and encryption suites generated during the protocol negotiation phase; The decryption key list and the encryption suite are added to the initial authorization information to obtain the target authorization information; The decryption key list indicates the necessary parameters for generating encryption / decryption keys, and the encryption suite indicates the encryption algorithm used to generate the corresponding key.
5. The method according to claim 1, characterized in that, The process of obtaining encrypted traffic when the client accesses domains in the list of monitored domains includes: The encrypted traffic between the website corresponding to the domain in the list of monitored domains and the client is mirrored when it flows through the client's edge router.
6. The method according to any one of claims 1 to 5, characterized in that, The step of decrypting the encrypted traffic based on the target authorization information includes: Based on the decryption key list and the encryption suite in the target authorization information, a corresponding decryption key is generated, and the encrypted traffic is decrypted using the decryption key to obtain the plaintext data.
7. The method according to claim 1, characterized in that, The step of generating feedback information based on the recognition result includes: If the identification result indicates that there is illegal sensitive content in the plaintext data, an alarm message is generated based on the illegal sensitive content, and the alarm message is pushed to the regulatory end as feedback information so that the regulatory end can determine the handling measures based on the feedback information; If the identification result indicates that there is no illegal or sensitive content in the plaintext data, a normal work log is generated and the normal work log is pushed to the regulatory end as feedback information.
8. A data monitoring device, characterized in that, include: The acquisition module is used to acquire monitoring instructions sent by the regulatory end. The monitoring instructions include a list of regulatory domain names and a pre-trained detection model. The processing module is used to receive target authorization information sent by the client according to the monitoring instruction; The processing module is further configured to acquire encrypted traffic when the client accesses domains in the list of monitored domains, and decrypt the encrypted traffic according to the target authorization information to obtain plaintext data; The identification module is used to identify the plaintext data through the detection model and obtain an identification result; the identification result is used to indicate whether there is any illegal or sensitive content in the plaintext data. The identification module is also used to generate feedback information based on the identification result and push the feedback information to the monitoring terminal.
9. An electronic device, characterized in that, The device includes a processor and a memory, the processor being coupled to the memory; the memory is used to store computer instructions, which are loaded and executed by the processor to enable the computer device to implement the data monitoring method as described in any one of claims 1 to 7.
10. A computer-readable storage medium, characterized in that, The computer-readable storage medium includes computer-executable instructions that, when executed on a computer, cause the computer to perform the data monitoring method according to any one of claims 1 to 7.
11. A computer program product, characterized in that, The computer program product includes a computer program that, when run on an electronic device, causes the electronic device to perform the data monitoring method as described in any one of claims 1 to 7.