Method and device for realizing information leakage prevention, equipment, storage medium and product

Abstract

The invention relates to the technical field of information security, and provides a method, a device, equipment, a storage medium and a product for realizing information leakage prevention, and the method comprises the steps: setting an initial access authority for a target user based on a preset role access control model, and verifying the identity of the target user through a standard authorization protocol; after the target user passes the identity verification, monitoring a real-time operation behavior executed by the target user on the pre-encrypted sensitive information; inputting the real-time operation behavior into an anomaly detection model to obtain an anomaly score output by the anomaly detection model; the abnormal score is used for representing a behavior abnormal risk of the real-time operation behavior; and when the abnormal score meets a preset response condition, automatically executing a dynamic protection strategy corresponding to the abnormal score level. Through multi-dimensional technology fusion, the real-time performance of information leakage prevention can be remarkably improved, internal permission abuse and data leakage are effectively restrained based on role setting permission and an anomaly detection model, and the protection efficiency is improved.

Description

Technical Field

[0001] This application relates to the field of information security technology, and in particular to methods, apparatus, equipment, storage media and products for preventing information leakage. Background Technology

[0002] In today's highly digitalized world, information security is of paramount importance. Personal information includes names, ID numbers, and contact details, while corporate trade secrets include technical solutions, customer information, and financial data. The leakage of this information can have serious consequences.

[0003] To address the issue of information leakage, traditional data loss prevention (DLP) solutions are constantly evolving. One approach employs a centralized management platform + client-side + DLP strategy to achieve secure file transmission control and prevent data leaks. Another approach combines similarity entropy calculation to determine data sensitivity and then uses different encryption methods based on sensitivity, improving the efficiency of sensitive data encryption and storage. Other methods involve centrally managing internal enterprise servers through security software systems, deploying protection endpoints on each terminal, and centrally deploying DLP strategies to ensure secure file transmission; or using web crawlers to capture document data, encrypting and storing it based on sensitivity, and verifying user identity before data retrieval.

[0004] However, these existing technologies have many shortcomings. In terms of access control, they lack granular control and cannot effectively restrict user access to sensitive resources, leading to frequent abuse of permissions. Behavioral monitoring and analysis methods are outdated, making it difficult to capture abnormal operations in real time, and they lack effective anomaly detection mechanisms to accurately identify potential threats. Protection strategies are mostly static rules, unable to be dynamically adjusted according to real-time threats, significantly reducing their effectiveness. Summary of the Invention

[0005] This application provides methods, devices, equipment, storage media, and products for preventing information leakage. Based on the integration of multiple technologies such as preset role access control models, real-time operation monitoring, anomaly detection models, and dynamic protection strategies, it can make up for the shortcomings of existing technologies and provide more comprehensive and efficient protection for information security.

[0006] This application provides a method for preventing information leakage, comprising: setting initial access permissions for target users based on a preset role-based access control model, and verifying the identity of target users through a standard authorization protocol; after the target user passes authentication, monitoring the real-time operation behavior performed by the target user on pre-encrypted sensitive information; inputting the real-time operation behavior into an anomaly detection model to obtain an anomaly score output by the anomaly detection model; the anomaly score is used to characterize the behavioral anomaly risk of the real-time operation behavior; when the anomaly score meets preset response conditions, automatically executing a dynamic protection strategy corresponding to the anomaly score level.

[0007] According to the method for preventing information leakage provided in this application, before monitoring the real-time operation behavior of the target user on pre-encrypted sensitive information after the target user has been authenticated, the method further includes: encrypting the content of the sensitive information itself using the AES-256 symmetric encryption algorithm; and encrypting and protecting the key used for the AES-256 symmetric encryption algorithm using the RSA-2048 asymmetric encryption algorithm to achieve hybrid encryption.

[0008] According to the method for preventing information leakage provided in this application, initial access permissions are set for target users based on a preset role access control model, and the identity of target users is verified through a standard authorization protocol. The method includes: assigning a preset role to the target user in the preset role access control model to grant the target user initial access permissions; and using the OAuth 2.0 protocol as the standard authorization protocol to authenticate the target user and issue an access token.

[0009] According to the method for preventing information leakage provided in this application, the anomaly detection model is used to perform the following steps: by analyzing historical operation behavior data, a feature vector as a baseline behavior pattern for the target user is established; the Euclidean distance algorithm is used to calculate the distance between the real-time operation behavior and the feature vector of the baseline behavior pattern in the feature space to determine the similarity; the real-time operation behavior and the similarity are input into the isolated forest algorithm model for calculation to obtain an anomaly score.

[0010] According to a method for preventing information leakage provided in this application, the dynamic protection strategy includes dynamic access control and / or dynamic isolation; dynamic access control includes temporarily or permanently adjusting the access permissions of the target user; dynamic isolation includes performing dynamic encryption isolation on sensitive information associated with real-time operational behavior.

[0011] According to the method for preventing information leakage provided in this application, the steps of performing dynamic encryption isolation specifically include: when the anomaly score exceeds a preset isolation threshold, generating a temporary isolation encryption key; wherein, the isolation encryption key is unrelated to the original key; using the isolation encryption key, the sensitive information that has been abnormally operated on is encrypted a second time, so that the sensitive information after the second encryption cannot be decrypted under normal permissions.

[0012] This application also provides a device for preventing information leakage, comprising: a verification module for setting initial access permissions for a target user based on a preset role-based access control model and verifying the identity of the target user through a standard authorization protocol; a monitoring module for monitoring the real-time operation behavior performed by the target user on pre-encrypted sensitive information after the target user has passed authentication; an anomaly detection module for inputting the real-time operation behavior into an anomaly detection model to obtain an anomaly score output by the anomaly detection model; the anomaly score is used to characterize the behavioral anomaly risk of the real-time operation behavior; and a dynamic protection module for automatically executing a dynamic protection strategy corresponding to the anomaly score level when the anomaly score meets preset response conditions.

[0013] This application also provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the information leakage prevention method as described above.

[0014] This application also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the method for preventing information leakage as described above.

[0015] This application also provides a computer program product, including a computer program that, when executed by a processor, implements the information leakage prevention method as described above.

[0016] This application provides a method, apparatus, device, storage medium, and product for preventing information leakage. The method includes: setting initial access permissions for target users based on a preset role-based access control model and verifying the target user's identity through a standard authorization protocol; monitoring the real-time operational behavior of the target user on pre-encrypted sensitive information after the target user's authentication; inputting the real-time operational behavior into an anomaly detection model to obtain an anomaly score output by the anomaly detection model; the anomaly score is used to characterize the abnormal risk of the real-time operational behavior; and automatically executing a dynamic protection strategy corresponding to the anomaly score level when the anomaly score meets preset response conditions. Through the above methods, this application significantly improves the real-time performance of information leakage prevention by integrating multi-dimensional technologies; it achieves refined permissions based on role-based access control and generates anomaly scores based on anomaly detection models to classify abnormal behaviors and identify threats, thereby effectively controlling and curbing internal permission abuse and data leakage, and improving protection efficiency. Attached Figure Description

[0017] To more clearly illustrate the technical solutions in this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0018] Figure 1 This is a flowchart illustrating the method for preventing information leakage provided in the embodiments of this application.

[0019] Figure 2 This is a schematic diagram of the structure of the device for preventing information leakage provided in the embodiments of this application.

[0020] Figure 3 This is a schematic diagram of the physical structure of the electronic device provided in the embodiments of this application. Detailed Implementation

[0021] To make the objectives, technical solutions, and advantages of this application clearer, the technical solutions of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0022] In the description of this specification, the references to terms such as "one embodiment," "some embodiments," "example," "specific example," or "some examples," etc., refer to specific features, structures, materials, or characteristics described in connection with that embodiment or example, which are included in at least one embodiment or example of the embodiments of this application. In this specification, the illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in one or more embodiments or examples. Moreover, without contradiction, those skilled in the art can combine and integrate the different embodiments or examples described in this specification, as well as the features of different embodiments or examples.

[0023] It should be noted that all actions involving the acquisition of signals, information, or data in this application are carried out in compliance with the relevant data protection laws and policies of the country where the application is located, and with the authorization granted by the owner of the relevant device.

[0024] This application provides a method for preventing information leakage. Please refer to [link / reference]. Figure 1 , Figure 1This is a flowchart illustrating a method for preventing information leakage provided in an embodiment of this application. In this embodiment, the method for preventing information leakage may include steps S110 to S140, and the specific steps are as follows: S110: Set initial access permissions for target users based on a preset role access control model, and verify the identity of target users through a standard authorization protocol.

[0025] The preset role-based access control model is a model that assigns access permissions based on user roles. Different roles are assigned different sets of access permissions. This model allows you to set initial access permissions for target users, determining the scope of resources and types of operations they can access based on their role in the system.

[0026] A standard authorization protocol is a standardized authentication mechanism. Using a standard authorization protocol to verify the identity of a target user ensures the security and reliability of the verification process. Verification confirms whether the target user has the legitimate right to access sensitive information.

[0027] S120: After the target user is authenticated, monitor the real-time actions performed by the target user on pre-encrypted sensitive information.

[0028] After a target user is authenticated, their real-time actions on pre-encrypted sensitive information can be monitored. The pre-encryption of sensitive information is to protect its security during data storage and transmission.

[0029] Monitoring real-time user behavior can reveal specific actions users take when accessing sensitive information, such as whether they frequently download large amounts of sensitive data or access sensitive information outside of working hours.

[0030] S130: Input the real-time operational behavior into the anomaly detection model to obtain the anomaly score output by the anomaly detection model; the anomaly score is used to characterize the behavioral anomaly risk of the real-time operational behavior.

[0031] In this embodiment, the anomaly detection model is a trained machine learning model that can analyze and evaluate input operational behaviors and output an anomaly score. The anomaly score characterizes the risk of behavioral anomalies in real-time operational behaviors.

[0032] For example, if a user makes multiple attempts to access sensitive information outside their authorized scope within a short period of time, the anomaly detection model may give a higher anomaly score.

[0033] S140: When the anomaly score meets the preset response conditions, the dynamic protection strategy corresponding to the anomaly score level is automatically executed.

[0034] When the anomaly score meets the preset response conditions, a dynamic protection strategy corresponding to the anomaly score level can be automatically executed.

[0035] Optionally, the preset response condition can be a specific anomaly score threshold, for example, when the anomaly score exceeds 80 points, the response condition is considered to be met.

[0036] Dynamic protection strategies can be categorized based on the level of anomaly scores. For example, when the anomaly score is low, measures such as warning the user can be taken; when the anomaly score is high, the user's access permissions can be restricted or even the user's session can be terminated.

[0037] In summary, this application embodiment, through a preset role-based access control model and standard authorization protocol, strictly manages and verifies the access permissions and identities of target users, preventing unauthorized users from accessing sensitive information at the source. Simultaneously, it monitors and detects anomalies in users' real-time operational behavior, enabling timely identification of potential abnormal behaviors and the implementation of corresponding protective measures, further enhancing information security. By executing dynamic protection strategies based on anomaly score levels, different protective measures can be taken according to different risk levels, improving the targeting and effectiveness of protection. This allows for adaptation to various security threat scenarios and timely response to various potential information leakage risks. The entire information leakage prevention process is automated; from identity verification, operational behavior monitoring, anomaly score calculation to dynamic protection strategy execution, everything can be completed automatically by the system. This not only improves management efficiency and reduces the workload of manual intervention but also lowers the security risks caused by human factors.

[0038] In some embodiments, the steps prior to monitoring the real-time actions performed by the target user on pre-encrypted sensitive information after the target user has been authenticated may further include: The AES-256 symmetric encryption algorithm is used to encrypt the content of the sensitive information itself; the RSA-2048 asymmetric encryption algorithm is used to encrypt and protect the key used for the AES-256 symmetric encryption algorithm, so as to achieve hybrid encryption.

[0039] AES is a symmetric encryption algorithm that uses the same key for both encryption and decryption. AES-256 indicates that encryption is performed using a 256-bit key. In this embodiment, AES-256 is used to encrypt the content of the sensitive information itself, converting the sensitive information into ciphertext form. This method offers fast encryption speed and ensures security.

[0040] RSA is an asymmetric encryption algorithm that uses a pair of keys: a public key and a private key. The public key can be made public and used to encrypt data; the private key needs to be kept secret and used to decrypt data. RSA-2048 indicates that a 2048-bit key length is used.

[0041] While the AES symmetric encryption algorithm itself offers high security, the secure transmission and storage of the key remains a critical issue. Therefore, in this embodiment, RSA-2048 is used to encrypt and protect the key used in the AES-256 symmetric encryption algorithm. By using the RSA asymmetric encryption algorithm to encrypt the AES key, the public-key encryption and private-key decryption features can be utilized to ensure the security of the AES key during transmission and storage.

[0042] In this embodiment, hybrid encryption is achieved by combining AES-256 symmetric encryption and RSA-2048 asymmetric encryption algorithms. Different encryption algorithms are used to protect sensitive information and the encryption key, significantly improving information security. This embodiment first uses AES-256 to encrypt the sensitive information, and then uses RSA-2048 to encrypt the AES key. This leverages both the efficiency of the AES symmetric encryption algorithm and the advantages of the RSA asymmetric encryption algorithm in key management, improving the overall security and performance of the encryption system.

[0043] In some embodiments, the steps of setting initial access permissions for target users based on a preset role-based access control model and verifying the identity of target users through a standard authorization protocol may specifically include: In the preset role access control model, preset roles are assigned to target users to grant them initial access permissions; the OAuth 2.0 protocol is used as the standard authorization protocol to authenticate target users and issue access tokens.

[0044] In this embodiment, the preset role-based access control model employs a preset role-based access control (RBAC) algorithm, associating access permissions with roles rather than directly with users. In this model, a series of roles are predefined, each with a specific set of access permissions. These permissions specify which resources a user can access and what operations they can perform on those resources, such as reading, writing, modifying, or deleting.

[0045] Based on the target user's role and responsibilities within the organization or business processes, one or more preset roles are assigned to them within a pre-defined role-based access control model. By assigning roles to target users, various system settings and all user data can be managed, indirectly granting the target user corresponding initial access permissions.

[0046] In this embodiment, the standard authorization protocol is OAuth 2.0, which allows third-party applications to access resources stored by the user at another service provider with the user's authorization, without requiring the user's username and password to be provided to the third-party application. This protocol implements authorization by issuing access tokens, which are credentials representing the user's authorization.

[0047] As described above, this application embodiment, through a preset role-based access control model, can centrally manage roles and permissions. When a user's role changes, their access permissions can be quickly adjusted simply by changing their role assignment. The OAuth 2.0 protocol provides a secure authorization mechanism, preventing users from directly providing their usernames and passwords to third-party applications and reducing the risk of user accounts being stolen. Simultaneously, the use of access tokens allows the system to perform fine-grained control over user access; only requests carrying valid access tokens and with the required permission scope are allowed to access protected resources, further enhancing security.

[0048] In some embodiments, the anomaly detection model is used to perform the following steps: By analyzing historical operational behavior data, a feature vector is established as a baseline behavioral pattern for the target user. The Euclidean distance algorithm is used to calculate the distance between the real-time operational behavior and the feature vector of the baseline behavioral pattern in the feature space to determine the similarity. The real-time operational behavior and similarity are input into the Isolation Forest algorithm model for calculation to obtain an anomaly score.

[0049] In this embodiment, historical operational behavior data of the target user can be collected. This data includes various operations performed by the user on sensitive information over a past period, such as the time of the operation, the frequency of the operation, the type of the operation (e.g., reading, modifying, deleting), and the scope of sensitive information involved. Then, by analyzing and processing this historical data, key features that represent the user's normal behavioral patterns are extracted, and these features are combined into a feature vector. This feature vector serves as the target user's baseline behavioral pattern, reflecting the user's operational habits and behavioral characteristics under normal circumstances.

[0050] Euclidean distance is a commonly used distance metric used to calculate the distance between two points in a feature space. In this scenario, real-time operational behavior is also converted into a point in the feature space. The similarity between the real-time operational behavior and the baseline behavioral pattern is measured by calculating the Euclidean distance between this point and the point represented by the feature vector of the baseline behavioral pattern. The smaller the Euclidean distance, the more similar the real-time operational behavior and the baseline behavioral pattern are; conversely, the larger the distance, the lower the similarity.

[0051] Isolation Forest is a tree-based anomaly detection algorithm that partitions data by constructing multiple decision trees. During the decision tree construction process, anomalous data points are more easily isolated, meaning their path length within the decision trees is typically shorter than that of normal data points. The algorithm assesses the anomalousness of a data point by calculating its average path length across all decision trees; the shorter the path length, the higher the anomalous score.

[0052] Specifically, the feature vector of the real-time operation behavior and the previously calculated similarity are used as inputs into the Isolation Forest algorithm model. The model calculates anomaly scores for the real-time operation behavior based on this input data. Anomaly scores are typically values ​​between 0 and 1; the closer the score is to 1, the more abnormal the real-time operation behavior; the closer the score is to 0, the more normal the real-time operation behavior.

[0053] In the embodiments described above, by establishing feature vectors for baseline behavioral patterns for each target user, the anomaly detection model can perform anomaly detection based on the user's personalized operating habits. Different users may exhibit significant differences in their operational behaviors; using personalized baseline patterns can more accurately identify each user's abnormal behavior and reduce the possibility of misjudgment. The combined use of the Euclidean distance algorithm and the isolated forest algorithm allows for the analysis and evaluation of real-time operational behavior from different perspectives. The Euclidean distance algorithm can quickly measure the similarity between real-time operational behavior and the baseline behavioral pattern, providing basic information for subsequent anomaly scoring calculations; the isolated forest algorithm, with its unique tree structure, can effectively identify abnormal behaviors that deviate from normal patterns, improving the accuracy of anomaly detection. Furthermore, the anomaly detection model can dynamically adjust the baseline behavioral pattern as the target user's historical operational behavior data is continuously updated, thereby adapting to changes in the target user's operating habits. This enables the model to maintain good anomaly detection performance under different business scenarios and user behavior patterns.

[0054] In some embodiments, dynamic protection strategies include dynamic access control and / or dynamic isolation; dynamic access control includes temporarily or permanently adjusting the access permissions of a target user; dynamic isolation includes performing dynamic encrypted isolation on sensitive information associated with real-time operational behavior.

[0055] In this embodiment, when a target user's real-time operational behavior is detected to have a certain abnormal risk, but it cannot be determined whether the behavior is malicious, their access permissions can be temporarily adjusted.

[0056] It should be noted that this adjustment is based on the current abnormal situation and is intended to limit the potential harm that users may cause, without completely depriving users of their operational capabilities, so that a decision can be made on whether to restore or further adjust permissions after further observation and confirmation.

[0057] When comprehensive analysis confirms that a target user's actions pose a serious security risk or violate relevant security regulations, their access permissions can be permanently adjusted. This adjustment is to prevent users from exploiting their existing high privileges for malicious operations, thus ensuring the security of the system and sensitive information.

[0058] Dynamic isolation is used to protect sensitive information associated with real-time operational activities by performing dynamic encryption isolation on this information. When abnormal real-time operational activities are detected, the relevant sensitive information can be encrypted and isolated from other normal data, preventing abnormal operations from directly accessing or tampering with this sensitive information. Encryption isolation can be performed simultaneously during data storage and transmission, ensuring that sensitive information is effectively protected at every stage.

[0059] In this embodiment, the dynamic access control and dynamic isolation strategies can dynamically adjust protective measures based on the real-time operational behavior of the target user, and respond promptly to various potential security threats. By temporarily or permanently adjusting access permissions, the operational scope of abnormal users can be restricted, reducing the possibility of them causing damage to the system and sensitive information; dynamic encryption isolation can ensure that sensitive information is protected in a timely manner under abnormal circumstances, preventing data leakage and tampering.

[0060] In some embodiments, the steps of performing dynamic encrypted isolation specifically include: When the anomaly score exceeds the preset isolation threshold, a temporary isolation encryption key is generated; the isolation encryption key is independent of the original key; the isolation encryption key is used to re-encrypt the sensitive information that has been abnormally operated on, so that the re-encrypted sensitive information cannot be decrypted under normal permissions.

[0061] The preset isolation threshold is a boundary value pre-set by the system to determine whether real-time operational behavior is abnormal enough to require dynamic encryption isolation. When the anomaly score exceeds this threshold, it indicates that the real-time operational behavior poses a high security risk, and the dynamic encryption isolation mechanism needs to be activated.

[0062] To ensure the secure isolation of sensitive information compromised by abnormal operations, the system generates a temporary isolation encryption key. This key is independent of the original key used to encrypt the sensitive information, and its purpose is to increase the security and independence of the encryption. Even if an attacker obtains the original key, they still cannot decrypt the double-encrypted sensitive information due to the independence of the isolation encryption key.

[0063] Alternatively, the isolation encryption key can be generated using a secure random number generation algorithm.

[0064] The generated isolation encryption key is used to re-encrypt sensitive information that has been subjected to abnormal operations. This secondary encryption is performed on top of the original encryption, further enhancing the security of the sensitive information. After secondary encryption, the sensitive information cannot be decrypted with normal permissions (i.e., with only the original key); only authorized personnel who also possess the isolation encryption key can decrypt it.

[0065] As described above, this embodiment of the application, through dynamic encryption isolation, ensures that even if the original encryption key is leaked, attackers cannot obtain sensitive information that has been abnormally manipulated because the secondary encryption uses an independent isolation encryption key. This dual encryption mechanism greatly improves data security and effectively prevents data leakage and tampering. When the anomaly score exceeds the preset isolation threshold, an isolation encryption key can be quickly generated and sensitive information can be encrypted a second time, achieving a timely response to abnormal operations.

[0066] In the field of information security, related technologies have certain limitations. Some technologies utilize security software systems to centrally manage internal enterprise servers, deploy protection endpoints on various terminals, and centrally deploy data leakage prevention strategies through these security software systems to achieve confidential file transmission control and thus prevent data leaks. However, these technologies have significant shortcomings: their encryption methods are simplistic, and their access control lacks granular configuration. They do not employ multiple computational methods to dynamically adjust user behavior and access permissions, making it difficult to effectively address complex and ever-changing security threats.

[0067] Some technologies combine similarity entropy to calculate data sensitivity and then use different encryption methods based on the sensitivity. This improves the efficiency of encryption and storage of sensitive data to some extent and significantly reduces the risk of data leakage. However, these technologies do not combine threat intelligence data to encrypt and isolate highly sensitive information, nor do they utilize information entropy analysis to generate visualized risk reports, which is not conducive to security managers' intuitive and rapid understanding of the security situation.

[0068] Based on this, the embodiments of this application propose a comprehensive and efficient information security protection scheme, which comprehensively improves upon the shortcomings of related technologies and constructs a multi-layered, all-round information security protection system, significantly enhancing information security. Specifically: In terms of encryption mechanisms, this invention employs the AES-256 symmetric encryption algorithm and the RSA-2048 asymmetric encryption algorithm. The two work together to ensure the reliability of the encryption process and the security of the key, providing a solid foundation for information security.

[0069] In terms of access control, a comprehensive system has been built based on the RBAC model and the OAuth 2.0 protocol, achieving fine-grained access control and accurate user authentication. This mechanism effectively prevents abuse of permissions, ensuring that only authorized users can access information within the prescribed scope of permissions.

[0070] In terms of behavior monitoring and anomaly detection, real-time behavior monitoring and Euclidean distance similarity calculation can accurately capture abnormal user actions. Simultaneously, utilizing the Isolation Forest algorithm for anomaly detection can efficiently classify normal and abnormal behaviors, significantly improving the accuracy of threat identification.

[0071] In terms of dynamic protection, permissions and protection rules are adjusted in real time based on anomaly scores, giving the system strong adaptive capabilities and enabling it to respond quickly to various security threats.

[0072] In terms of data isolation, dynamic encryption isolation mechanisms can effectively isolate data associated with abnormal behavior, further reducing the risk of data leakage.

[0073] In terms of threat intelligence processing, the threat intelligence update mechanism integrates internal and external data to optimize security rules. Furthermore, it generates risk visualization reports through information entropy analysis, helping administrators quickly identify and respond to potential threats, thus comprehensively improving information leakage prevention capabilities.

[0074] The information leakage prevention method described in this application solves the problems of existing technologies having a single method and insufficient security. The specific technical solution can be broken down into the following functions: (1) Information encryption: Sensitive information is encrypted using the AES-256 symmetric encryption algorithm and the encryption key is protected by the RSA-2048 asymmetric encryption algorithm.

[0075] (2) Access control: Assign role permissions based on the RBAC model and verify user identity through the OAuth 2.0 protocol.

[0076] (3) Behavior monitoring: Real-time recording of user operation logs, including file access, copying, modification and network transmission behaviors.

[0077] (4) Behavior analysis: Euclidean distance is used to calculate the similarity between user behavior and the baseline pattern.

[0078] (5) Anomaly detection: Anomaly scores are generated using the isolated forest algorithm to classify normal and abnormal behaviors.

[0079] (6) Dynamic protection: Dynamically adjust the permission policy and update the protection rule base according to the anomaly score.

[0080] (7) Information isolation: Dynamically encrypt and isolate the data associated with abnormal behavior.

[0081] (8) Threat intelligence update: integrate internal and external threat data to optimize security rules and generate risk visualization reports based on information entropy analysis.

[0082] The specific implementation process is as follows: (1) Information Encryption: Sensitive information is encrypted using the AES-256 encryption algorithm, and the encryption key is protected by the RSA-2048 asymmetric encryption algorithm. The AES-256 encryption process must meet the following requirements: C = E(K, P); where K ∈ {0, 1} 256 P∈{0,1} n .

[0083] RSA-2048 key protection must meet the following requirements: C=P e mod n; where n = p × q, p and q ∈ prime numbers, |n| = 2048 bits.

[0084] The characters are explained below:

[0085] (2) Access control The access control module aims to ensure that user access to the system and sensitive data resources is controlled and secure. Its core implementation relies on two key technologies: a role-based access control (RBAC) model for permission allocation, and the OAuth 2.0 protocol for user authentication.

[0086] ① Assigning role permissions based on the RBAC model Role Definition: System administrators must predefine roles in the security software's management console. These roles should reflect the organizational structure or business functions.

[0087] Permission Association: Associate permissions with each defined role. Permissions grant permission to perform specific operations on specific resources (such as files, directories, database tables, and API interfaces). For example: The finance specialist role can be granted "read" permissions to files in the company's financial directory.

[0088] The R&D engineer role can be granted "read", "write", and "download" permissions to the project's source code repository.

[0089] The administrator role may be granted all permissions (including management configuration permissions).

[0090] Regular employees may only have "read / write" permissions for personal files and "read" permissions for some shared documents.

[0091] External auditors may only be granted "read" access to specific audit reports.

[0092] User Assignment: Assign one or more roles to each user in the system. A user's account information (UserID) is associated with a list of roles they possess.

[0093] The authorization decision-making process is exemplified as follows: When a user (e.g., Zhang San) attempts to access a resource (such as "Project A source code"): 1. The system checks which roles Zhang San has been assigned ("R&D Engineer").

[0094] 2. The system checks which permissions the "R&D Engineer" role has.

[0095] 3. The system checks whether the current operation (such as "download") is within the set of permissions that the "R&D Engineer" role has for "Project A source code" (allowing "download").

[0096] 4. Decision: Based on the above inspection results, the system decides whether to allow or deny this access.

[0097] ② Verify user identity via OAuth 2.0 protocol The OAuth 2.0 protocol is used in scenarios that require single sign-on or grant limited access to third-party applications, and can serve as a secure authentication method for internal user login.

[0098] The main participants may include the following: Resource owner: The end user who has access to the protected resource.

[0099] Client: Security software or its components that need to access protected resources, such as remote collaboration plugins or API gateways.

[0100] Authorization server: Responsible for authenticating user identity and issuing access tokens. It can be a system component or an external service, such as a company's self-built IAM system or a cloud identity provider.

[0101] Resource server: A backend service or system module that holds or manages sensitive information / protected resources, and receives and verifies access tokens in response to client requests.

[0102] The authorization process, taking the typical authorization code model as an example, is as follows: 1. Initiate authorization request: The security software client component detects that user authentication is required and redirects the user to the authorization server login page, along with information such as the client ID and request scope.

[0103] 2. User Login and Authorization: Users verify their identity on the authorization server login page, and after successful login, confirm and agree to the list of permissions requested.

[0104] 3. Issuing the authorization code: The authorization server redirects the user back to the client's security callback address, along with the authorization code.

[0105] 4. Request an access token: The client backend requests an access token from the authorization server using the authorization code, client ID, and key.

[0106] 5. Token Verification and Issuance: After the authorization server verifies that the information matches and has not expired, it issues an access token (and optional refresh token). The token generation or signing / verification logic is as follows: Token=HMAC_SHA256(SecretKey, UserID∥Timestamp) to ensure integrity and trustworthy source.

[0107] 6. Accessing protected resources: When a client sends an access request to a resource server, it includes an access token in the HTTP request header.

[0108] 7. Token Verification and Authorization: The resource server verifies the token signature, checks the UserID and Scopes claims, and combines them with fine-grained access control rules to determine whether access is allowed.

[0109] For example, the RBAC permission allocation matrix is ​​defined as follows: ; Here, A(u, r) is a permission allocation matrix. A(u, r) = 1 indicates that user u has access to resource r (i.e., the user has the role), otherwise it is 0 (i.e., the user does not have the role).

[0110] For example, the access token generated by the OAuth 2.0 protocol satisfies: Token=HMAC_SHA256(SecretKey, UserID∥Timestamp).

[0111] The rules for generating access tokens are as follows: The UserID and Timestamp are concatenated sequentially, encrypted using the HMAC_SHA256 algorithm, and then signed using the SecretKey. The final output is the token. This formula reflects the OAuth 2.0 security design principle that "the token must carry the user's identity and have tamper-proof capabilities."

[0112] (3) Behavioral monitoring Record user operation logs in real time, including file access, copying, modification, and network transmission behaviors.

[0113] (4) Behavioral analysis Similarity calculation: The similarity between user behavior and the baseline pattern is calculated using Euclidean distance. The formula is as follows: , ; in d represents the feature weight; d represents the number of features, i.e., the total number of behavioral indicators monitored by the system, such as the number of login attempts, file operation attempts, and access time periods; x represents the feature weight. i y represents the numerical value of the user's current behavior on the i-th feature; i This represents the normal reference value of the baseline pattern on the i-th feature.

[0114] (5) Anomaly detection The path length is calculated using the Isolation Forest algorithm: , H(k)=ln(k)+γ(γ≈0.5772).

[0115] Where c(m) represents the path length correction constant when the number of samples is m. Because the algorithm uses a binary tree structure, the randomly generated path baseline lengths are different under different dataset sizes (m). c(m) is used to correct this effect so that the path lengths under different m are comparable.

[0116] H(k) represents the harmonic series, with a value of 1 + 1 / 2 + ... + 1 / k. It is used to estimate the theoretical average path length when constructing a binary tree from k samples. Essentially, it is the average number of comparisons that fail in a binary tree search.

[0117] M represents the total number of samples in the current subset. When the algorithm recursively partitions the data, the size of the dataset on each node will change, and m refers to the number of samples in the current node to be processed.

[0118] γ represents Euler's constant, which is the approximate constant for calculating the harmonic series H(k) (since H(k)≈ln(k)+γ).

[0119] It's important to note that when calculating the path length of a specific node using the Isolation Forest algorithm, the relationship between H(k) and H(m-1) is involved. Here, k is taken as m-1, which is the number of samples (m) of the current node minus 1. When the algorithm constructs a subtree based on m samples, the path length estimation needs to refer to the harmonic number H(m-1) corresponding to the subtree constructed with (m-1) samples.

[0120] Because outlier data points differ significantly from the normal population, they are more quickly "isolated" in a randomly partitioned binary tree, meaning their paths are shorter. Based on this characteristic, this embodiment uses the Isolation Forest algorithm for anomaly detection, and the specific process is as follows: 1. Construct an "isolated tree" (iTree): A subset of user behavior samples is randomly selected, and the data space is recursively partitioned by randomly selecting features and cut values ​​to construct a binary tree. The path length h(x) from the root node to the leaf node represents the number of cuts required to separate a sample from other samples, i.e., the degree of "isolation".

[0121] 2. Calculate the anomaly score s: For target user behavior data x, calculate its average path length E(h(x)) across multiple isolated trees. Combining the sample size m and the correction constant c(m), calculate the score using the formula s≈2^(-E(h(x)) / c(m)).

[0122] Among them, a score close to 1 indicates that the path is extremely short and the probability of an anomaly is high; a score close to 0 indicates that the path is close to the average value and the probability of normality is high; and a score of about 0.5 indicates that there are no obvious abnormal characteristics.

[0123] 3. Classification Decision: Set a threshold (usually 0.6, which can be adjusted based on data). If the score s is greater than the threshold, the user's behavior is considered abnormal, triggering an alarm or blocking the access; if the score s is less than or equal to the threshold, it is considered normal, and access is allowed.

[0124] (6) Dynamic protection The permission policy is dynamically adjusted based on the anomaly score, and the update formula is as follows: , α∈[0.1, 0.5].

[0125] in, Pnew represents the gradient impact (instantaneous rate of change) of threat intelligence T on the information leakage risk Risk; Pnew represents the updated set of protection policies, such as access rules and permission configurations, used for dynamically adjusted new policies to defend against information leakage risks in real time; Pold represents the baseline state of the current protection policy, serving as the initial benchmark for policy updates.

[0126] α represents the policy update step size coefficient (learning rate), used to control the magnitude of policy adjustments. The smaller α is, the more conservative the policy update (avoiding frequent changes due to misjudgments); the larger α is, the more aggressive the policy response (quickly responding to high-risk threats).

[0127] In this embodiment, Used to quantify the impact of external threat intelligence on the current risk level. When threat intelligence indicates an increased risk... A value greater than 0 indicates that the policy will tighten permissions; when threat intelligence is mitigated, If the value is less than 0, the strategy will be appropriately relaxed.

[0128] It should also be noted that the dynamic permission policy is a temporary permission rule automatically generated based on real-time anomaly scoring, designed to impose tiered restrictions on user operations when risks occur. A detailed description follows: Triggering condition: When the user's abnormal behavior score s exceeds the preset threshold (e.g., s>0.6), the dynamic permission policy is triggered.

[0129] Rule generation: The system will automatically match preset rules. For example, when s>0.8, users will be prohibited from performing sensitive operations.

[0130] Rule enforcement: The generated dynamic permission rules will override the user's original role-based access control (RBAC) permissions in real time. For example, a user may have had delete permissions before, but now only viewing is allowed and deletion is prohibited.

[0131] Policy cancellation: When the risk disappears, that is, when the abnormal score falls back below the threshold, the dynamic permission policy will automatically become invalid.

[0132] It's also worth noting that dynamic permission policies and RBAC together construct a complete access control system, ensuring effective permission management in different scenarios. RBAC is the foundation, defining users' daily permissions and establishing the basic framework for permission management, enabling the system to operate orderly under normal conditions. Dynamic permission policies are an enhanced supplement. In the event of a risk, dynamic permission policies have higher priority and can temporarily override RBAC permissions, imposing tiered restrictions on user operations and improving system security. The two complement each other; under normal circumstances, RBAC takes the lead, while dynamic policies strengthen control in abnormal situations, jointly ensuring the system's permission management.

[0133] (7) Information isolation The key update cycle for dynamic encryption isolation satisfies: .

[0134] Where Throughput is the system throughput (MB / s). T update The key update cycle is defined as the time interval between two key changes, measured in seconds. KeyLength represents the length of the encryption key, measured in bits. Throughput represents the system's data encryption / decryption throughput, indicating system performance, measured in MB / s (megabytes per second). 8×10 6 It is a unit conversion factor (a fixed constant) that converts Throughput (MB / s) to bits / second.

[0135] In this embodiment, information isolation revolves around "abnormal behavior-related data." Abnormal behavior-related data refers to the specific data involved in the abnormal operation, such as files accessed without authorization by the user or database content abnormally leaked.

[0136] The primary function of the information isolation module is to dynamically encrypt and isolate data associated with abnormal behavior. This process relies on a key update cycle to implement the dynamic encryption logic. Specifically, a dedicated encryption key is generated for the isolated data. It should be clarified that the key itself is not the isolated object, but rather a tool used to encrypt the data. To ensure long-term data security and prevent data breaches due to key leakage, the key needs to be updated periodically.

[0137] The entire information isolation process is illustrated below: First, abnormal behavior is detected; once an anomaly is detected, the associated data is locked; then, the data is dynamically encrypted and isolated through the information isolation module; subsequently, the encryption key is updated according to a predetermined period; finally, continuous protection of the data is achieved.

[0138] (8) Threat intelligence update Threat intelligence fusion weighting coefficients are calculated using the following formula: .

[0139] Where σ² represents the confidence variance of the threat data, and λ represents the fusion weight coefficient of internal and external threat data, with a value range of 0 to 1. The closer λ is to 1, the more dominant the internal data is; the closer λ is to 0, the more dominant the external data is.

[0140] This represents the confidence variance of the data source for internal threats. It measures the volatility / reliability of internal data (such as system logs and audit records); a low variance indicates stable and reliable data, while a high variance indicates high noise and low reliability.

[0141] This represents the confidence variance of external threat data sources. It measures the volatility / reliability of external data (such as third-party vulnerability databases and threat intelligence platforms): low variance indicates strong intelligence authority (e.g., the official CVE vulnerability database); high variance indicates controversial or outdated intelligence (e.g., attack characteristics scraped by unofficial sources).

[0142] Ultimately, this is used to eliminate low-quality intelligence interference, ensuring that security rules are optimized to accurately respond to real threats.

[0143] It should be noted that the weighting coefficient (λ) is used to dynamically quantify the credibility weights of internal and external threat data. It is the variance of confidence level for internal threat data; This refers to the confidence variance of external threat data. If internal data has low fluctuation and a large λ, internal data should be used first; if external data is more stable and a small λ, external data should be used first.

[0144] Risk entropy is used to quantify the degree of disorder in the threats a system faces. The higher the entropy value, the more dispersed and unpredictable the threat types are, and the more vulnerable the system is. The lower the entropy value, the more concentrated the threat types are (such as only DDoS attacks), and the risks can be addressed in a targeted manner.

[0145] It should be noted that the embodiments of this application utilize internal and external threat data to optimize security rules, with two major mechanisms ensuring network security. These two mechanisms work together to build a comprehensive and dynamic security protection system, as detailed below: 1. Data fusion drives rule updates: Internal and external data are fused with λ weights to generate a high-confidence threat feature library, which is then input into AI model training and outputs dynamic protection strategies, such as adjusting access control thresholds and encryption algorithm strength.

[0146] 2. Entropy-Driven Visualization and Decision Making: Entropy values ​​are mapped to heatmaps (red indicates high risk) to pinpoint vulnerable modules. High entropy values ​​can generate global hardening suggestions, such as shortening the key update cycle; low entropy values ​​can generate targeted action guidelines, such as blocking high-risk IPs.

[0147] The calculation of the information leakage risk entropy value satisfies: , .

[0148] Wherein, the total number of threat categories τ is the number of independent threat types defined by the system (e.g., the total number of major categories such as DDoS, ransomware, and SQL injection). The threat category index i is the internal counting variable in the formula that iterates through all threat categories. The frequency p of the i-th threat category... i It represents the proportion of the number of times the i-th type of threat event occurs out of all threat events.

[0149] In summary, this application's embodiments utilize multiple mechanisms to comprehensively enhance information leakage prevention capabilities. First, sensitive information is encrypted using the AES-256 symmetric encryption algorithm, and the encryption key is protected using the RSA-2048 asymmetric encryption algorithm, ensuring the security of information transmission and storage. Second, role-based permissions are assigned based on the RBAC model, combined with OAuth2.0 protocol verification of user identity, achieving fine-grained access control and preventing permission abuse. Real-time behavior monitoring records user operation logs, including file access, copying, modification, and network transmission behaviors, providing a data foundation for subsequent analysis. Euclidean distance is used to calculate the similarity between user behavior and baseline patterns, combined with the isolated forest algorithm to generate anomaly scores, accurately classifying normal and abnormal behaviors and improving the accuracy of threat identification. Dynamic protection adjusts permission policies and updates the protection rule base in real time based on anomaly scores, enhancing the system's adaptability. Dynamic encryption isolation is implemented for data associated with abnormal behavior, further reducing the risk of data leakage.

[0150] Furthermore, embodiments of this application can also integrate internal and external threat data to optimize security rules, generate risk visualization reports based on information entropy analysis, help administrators quickly identify and respond to potential threats, and comprehensively improve information leakage prevention capabilities.

[0151] The advantage of this application's embodiments lies in its comprehensive enhancement of information leakage prevention capabilities through multiple mechanisms, specifically as follows: (1) Sensitive information is encrypted using the AES-256 symmetric encryption algorithm and the encryption key is protected by the RSA-2048 asymmetric encryption algorithm to ensure the security of information transmission and storage.

[0152] (2) Assign role permissions based on the RBAC model and verify user identity in conjunction with the OAuth2.0 protocol to achieve fine-grained access permission management and prevent permission abuse.

[0153] (3) Real-time behavior monitoring records user operation logs, including file access, copying, modification and network transmission behaviors, to provide a data foundation for subsequent analysis.

[0154] (4) The similarity between user behavior and the baseline pattern is calculated by Euclidean distance and combined with the isolated forest algorithm to generate anomaly scores, accurately classifying normal and abnormal behaviors and improving the accuracy of threat identification.

[0155] (5) Dynamic protection adjusts the permission policy and updates the protection rule base in real time based on the anomaly score, enhancing the system's adaptability.

[0156] (6) Implement dynamic encryption and isolation for data associated with abnormal behavior to further reduce the risk of data leakage.

[0157] (7) Integrate internal and external threat data to optimize security rules, generate risk visualization reports based on information entropy analysis, help administrators quickly identify and respond to potential threats, and comprehensively improve information leakage prevention capabilities.

[0158] This application also provides an apparatus for preventing information leakage. The apparatus for preventing information leakage provided in this application will be described below. The apparatus for preventing information leakage described below can be referred to in correspondence with the method for preventing information leakage described above.

[0159] Please see Figure 2 , Figure 2 This is a schematic diagram of the structure of the device for preventing information leakage provided in this embodiment. In this embodiment, the device for preventing information leakage includes a verification module 210, a monitoring module 220, an anomaly detection module 230, and a dynamic protection module 240.

[0160] The verification module 210 is used to set initial access permissions for target users based on a preset role access control model and to verify the identity of target users through a standard authorization protocol.

[0161] The monitoring module 220 is used to monitor the real-time operations performed by the target user on pre-encrypted sensitive information after the target user has been authenticated.

[0162] The anomaly detection module 230 is used to input real-time operation behavior into the anomaly detection model and obtain the anomaly score output by the anomaly detection model; the anomaly score is used to characterize the behavioral anomaly risk of real-time operation behavior.

[0163] The dynamic protection module 240 is used to automatically execute a dynamic protection strategy corresponding to the anomaly score level when the anomaly score meets the preset response conditions.

[0164] In some embodiments, the device for preventing information leakage further includes an encryption module, which is specifically used for: The AES-256 symmetric encryption algorithm is used to encrypt the content of the sensitive information itself; the RSA-2048 asymmetric encryption algorithm is used to encrypt and protect the key used for the AES-256 symmetric encryption algorithm, so as to achieve hybrid encryption.

[0165] In some embodiments, the verification module 210 is specifically used for: In the preset role access control model, preset roles are assigned to target users to grant them initial access permissions; the OAuth 2.0 protocol is used as the standard authorization protocol to authenticate target users and issue access tokens.

[0166] In some embodiments, the anomaly detection model is used to perform the following steps: by analyzing historical operational behavior data, a feature vector is established for the target user as a baseline behavioral pattern; the Euclidean distance algorithm is used to calculate the distance between the real-time operational behavior and the feature vector of the baseline behavioral pattern in the feature space to determine the similarity; the real-time operational behavior and the similarity are input into the Isolation Forest algorithm model for calculation to obtain an anomaly score.

[0167] In some embodiments, dynamic protection strategies include dynamic access control and / or dynamic isolation; dynamic access control includes temporarily or permanently adjusting the access permissions of a target user; dynamic isolation includes performing dynamic encrypted isolation on sensitive information associated with real-time operational behavior.

[0168] In some embodiments, the steps of performing dynamic encryption isolation specifically include: when the anomaly score exceeds a preset isolation threshold, generating a temporary isolation encryption key; wherein the isolation encryption key is unrelated to the original key; using the isolation encryption key, the sensitive information that has been abnormally operated on is re-encrypted, so that the re-encrypted sensitive information cannot be decrypted under normal permissions.

[0169] On the other hand, this application also provides an electronic device, please refer to... Figure 3 , Figure 3 This is a schematic diagram of the physical structure of the electronic device provided in the embodiments of this application, such as... Figure 3 As shown, the electronic device may include a memory 320, a processor 310, and a computer program stored in the memory 320 and executable on the processor 310. When the processor 310 executes the program, it can implement a method for preventing information leakage, which may include: Initial access permissions are set for target users based on a preset role-based access control model, and the identity of target users is verified through a standard authorization protocol. After the target user is authenticated, the real-time operation behavior performed by the target user on pre-encrypted sensitive information is monitored. The real-time operation behavior is input into an anomaly detection model to obtain an anomaly score output by the anomaly detection model. The anomaly score is used to characterize the behavioral anomaly risk of the real-time operation behavior. When the anomaly score meets the preset response conditions, the dynamic protection strategy corresponding to the anomaly score level is automatically executed.

[0170] Optionally, the electronic device may further include a communication bus 330 and a communication interface 340, wherein the processor 310, the communication interface 340, and the memory 320 communicate with each other through the communication bus 330. The processor 310 can call the computer program in the memory 320 to execute the methods for preventing information leakage provided by the above methods.

[0171] Furthermore, the logical instructions in the aforementioned memory 320 can be implemented as software functional units and, when sold or used as independent products, can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or a part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0172] On the other hand, this application also provides a computer program product, which includes a computer program that can be stored on a non-transitory computer-readable storage medium. When the computer program is executed by a processor, the computer can perform the methods for preventing information leakage provided by the above methods. The steps and principles of these methods have been described in detail in the above methods and will not be repeated here.

[0173] In another aspect, this application also provides a non-transitory computer-readable storage medium storing a computer program thereon. When the computer program is executed by a processor, it implements the methods for preventing information leakage provided by the above methods. The steps and principles of these methods have been described in detail in the above methods and will not be repeated here.

[0174] Non-transitory computer-readable storage media can be any available medium or data storage device that can be accessed by a processor, including but not limited to magnetic storage (e.g., floppy disks, hard disks, magnetic tapes, magneto-optical disks (MOs), etc.), optical storage (e.g., CDs, DVDs, BDs, HVDs, etc.), and semiconductor storage (e.g., ROMs, EPROMs, EEPROMs, non-volatile memory (NAND flash), solid-state drives (SSDs)).

[0175] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs. Those skilled in the art can understand and implement this without any creative effort.

[0176] Through the above description of the embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus necessary general-purpose hardware platforms, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solutions, in essence or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the methods described in the various embodiments or some parts of the embodiments.

[0177] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of this application, and are not intended to limit them. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of this application.

Claims

1. A method for preventing information leakage, characterized in that, include: Initial access permissions are set for target users based on a preset role access control model, and the identity of the target users is verified through a standard authorization protocol; After the target user is authenticated, the system monitors the real-time actions performed by the target user on pre-encrypted sensitive information. The real-time operational behavior is input into the anomaly detection model to obtain an anomaly score output by the anomaly detection model; the anomaly score is used to characterize the behavioral anomaly risk of the real-time operational behavior. When the anomaly score meets the preset response conditions, a dynamic protection strategy corresponding to the anomaly score level is automatically executed.

2. The method for preventing information leakage according to claim 1, characterized in that, Before monitoring the real-time actions performed by the target user on pre-encrypted sensitive information after the target user has been authenticated, the method further includes: The AES-256 symmetric encryption algorithm is used to encrypt the content of the sensitive information itself; The key used in the AES-256 symmetric encryption algorithm is encrypted and protected using the RSA-2048 asymmetric encryption algorithm to achieve hybrid encryption.

3. The method for preventing information leakage according to claim 1, characterized in that, The process of setting initial access permissions for target users based on a preset role-based access control model and verifying the identity of target users through a standard authorization protocol includes: In the preset role access control model, a preset role is assigned to the target user to grant the target user initial access rights; The OAuth 2.0 protocol is used as the standard authorization protocol to authenticate the target user and issue access tokens.

4. The method for preventing information leakage according to claim 1, characterized in that, The anomaly detection model is used to perform the following steps: By analyzing historical operational behavior data, a feature vector is established for the target user as a baseline behavioral pattern. The Euclidean distance algorithm is used to calculate the distance between the feature vector of the real-time operation behavior and the feature vector of the baseline behavior pattern in the feature space to determine the similarity. The real-time operational behavior and the similarity are input into the Isolation Forest algorithm model for calculation to obtain the anomaly score.

5. The method for preventing information leakage according to any one of claims 1 to 4, characterized in that, The dynamic protection strategy includes dynamic access control and / or dynamic isolation; The dynamic access restrictions include temporarily or permanently adjusting the access permissions of the target user; The dynamic isolation includes performing dynamic encrypted isolation on the sensitive information associated with the real-time operational behavior.

6. The method for preventing information leakage according to claim 5, characterized in that, The steps for performing dynamic encrypted isolation specifically include: When the anomaly score exceeds a preset isolation threshold, a temporary isolation encryption key is generated; wherein, the isolation encryption key is unrelated to the original key; Using the aforementioned isolation encryption key, sensitive information subjected to abnormal operations is re-encrypted, making the re-encrypted sensitive information undecryptable under normal permissions.

7. A device for preventing information leakage, characterized in that, include: The verification module is used to set initial access permissions for target users based on a preset role access control model and to verify the identity of the target users through a standard authorization protocol. The monitoring module is used to monitor the real-time operation behavior of the target user on pre-encrypted sensitive information after the target user has been authenticated. An anomaly detection module is used to input the real-time operation behavior into an anomaly detection model and obtain an anomaly score output by the anomaly detection model; the anomaly score is used to characterize the behavioral anomaly risk of the real-time operation behavior. The dynamic protection module is used to automatically execute a dynamic protection strategy corresponding to the anomaly score level when the anomaly score meets the preset response conditions.

8. An electronic device comprising a memory, a processor, and a computer program stored in the memory and running on the processor, characterized in that, When the processor executes the computer program, it implements the method for preventing information leakage as described in any one of claims 1 to 6.

9. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by the processor, it implements the method for preventing information leakage as described in any one of claims 1 to 6.

10. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by the processor, it implements the method for preventing information leakage as described in any one of claims 1 to 6.

Images