Data stealing detection method and device

Abstract

The invention discloses a data stealing detection method and device, and belongs to the technical field of information security. The method comprises the steps that IO operation information of multiple IO requests is obtained, the multiple IO requests are IO requests for accessing a file system, and the IO operation information comprises operation information of IO operation requested to be executed by each IO request in the multiple IO requests; according to the IO operation information of the IO requests, whether a target IO request exists in the IO requests or not is detected, and the target IO request is an IO request for stealing data in the file system. According to the method, a plurality of IO requests for accessing the file system are detected at a time, so that the aim of taking the relationship (or association degree) among the IO requests as reference information for detecting / identifying the data stealing behavior can be fulfilled, the capability of detecting the data stealing behavior can be enhanced, the accuracy and reliability of detecting the data stealing behavior can be improved, and the data stealing behavior detection efficiency can be improved. And the false detection rate and the missing detection rate during data stealing behavior detection are reduced.

Description

Technical Field

[0001] This application relates to the field of information security technology, and in particular to a method and apparatus for detecting data theft. Background Technology

[0002] With the rapid development of the information age, data has become a vital asset for businesses and individuals. However, cybersecurity threats have also increased, especially the proliferation of malware and ransomware, posing a significant threat to data security. For example, in recent years, ransomware has not only been able to extort users by encrypting their data, but it has also been able to steal user data through viruses and then threaten to release that data to extort money from users, causing them huge economic and reputational losses. Therefore, to ensure the security of data assets, how to quickly detect data theft has become an urgent problem to be solved. Summary of the Invention

[0003] This application provides a method and apparatus for detecting data theft, which can quickly and accurately detect data theft behavior.

[0004] The technical solution provided in this application is as follows.

[0005] Firstly, this application provides a method for detecting data theft. The method includes: acquiring I / O operation information of multiple input / output (I / O) requests; and, based on the I / O operation information of the multiple I / O requests, detecting whether a target I / O request exists among the multiple I / O requests, wherein the target I / O request is an I / O request that steals data from a file system. The multiple I / O requests are I / O requests to access the file system, and the I / O operation information includes operation information of the I / O operation requested by each of the multiple I / O requests.

[0006] The method provided in this application detects the IO operation information of multiple IO requests (denoted as the unit under inspection) accessing the file system at once. This achieves the purpose of using the relationship (or correlation) between multiple IO requests in the unit under inspection as reference information for detecting / identifying data theft behavior. This enhances the ability to detect data theft, improves the accuracy and reliability of data theft detection, and reduces the false positive and false negative rates. Furthermore, when the clients initiating IO requests in the unit under inspection are all the same client, the correlation between the IO operations indicated by the IO requests accessing the file system by the same client within a certain period is stronger due to the temporal correlation. Therefore, the accuracy and reliability of detecting whether there are IO requests for data theft in the unit under inspection based on the IO operation information of the IO requests contained in the unit under inspection are higher.

[0007] In one possible design, detecting the existence of a target IO request among multiple IO requests based on their IO operation information includes: using a detection model to detect the existence of a target IO request among the multiple IO requests based on their IO operation information. The detection model includes a first network and a fourth network. The first network extracts behavioral features based on the IO operation information, and the fourth network infers whether a target IO request exists among the multiple IO requests based on the behavioral features. This possible design achieves the goal of detecting the IO operation information of the IO requests contained in the unit to be inspected using a pre-trained detection model.

[0008] In another possible design approach, the IO operation information includes one or more of the following: the IO operation type requested by each IO request, the IO operation time, the metadata of the file requested by each IO request, or the performance information of the storage node storing data in the file system. This possible design allows for greater flexibility in selecting the IO operation information when implementing the solution in this application.

[0009] In another possible design approach, when at least one IO write request exists among multiple IO requests, the method further includes: obtaining the file content requested to be written to the file system by each IO write request. In this case, detecting whether a target IO request exists among the multiple IO requests based on the IO operation information of the multiple IO requests includes: detecting whether a target IO request exists among the multiple IO requests based on the IO operation information and file content of the multiple IO requests.

[0010] This possible design implements multiple I / O requests from client accessing the file system as inspection units. Based on the I / O operation information of the I / O requests within each inspection unit and the file content indicated by these requests to be written to the file system, it detects whether any I / O requests within the inspection unit are intended for data theft. This possible design adds reference analysis to the file content indicated by the I / O requests within the inspection unit when detecting data theft, thus enhancing its detection capability.

[0011] In another possible design approach, the detection of the existence of a target IO request among multiple IO requests based on IO operation information and file content includes: determining behavioral characteristics of the multiple IO requests based on IO operation information, whereby behavioral characteristics characterize the features of the IO operations indicated by the multiple IO requests; determining semantic features based on file content, where semantic features characterize the semantics of the file content; fusing the behavioral and semantic features to obtain a fused feature; and detecting the existence of a target IO request among the multiple IO requests based on the fused feature. Thus, the purpose of detecting whether there is an IO request for data theft in the inspected unit is achieved based on the IO operation information of the IO requests contained in the inspected unit and the file content indicated by the IO requests in the inspected unit for writing to the file system.

[0012] In another possible design approach, the detection of the existence of a target IO request among multiple IO requests based on IO operation information and file content includes: using a detection model to detect the existence of a target IO request among multiple IO requests based on the IO operation information and file content of the multiple IO requests. In this design approach, the detection model includes a first network, a second network, a third network, and a fourth network. The first network is used to extract behavioral features based on IO operation information, the second network is used to extract semantic features based on file content, the third network is used to fuse behavioral and semantic features, and the fourth network is used to infer the existence of a target IO request among the multiple IO requests based on the fused features. This possible design achieves the goal of using a pre-trained detection model to detect the IO operation information and file content of the IO requests contained in the unit to be inspected.

[0013] In another possible design, the first network is the encoder network in the transformer model (a type of deep learning model).

[0014] In another possible design approach, the second network is a language model.

[0015] In another possible design approach, the third network is a gated network.

[0016] In another possible design approach, the fourth network is a multi-layer perceptron (MLP) network.

[0017] Through the above-mentioned possible designs, the network structure for constructing the detection model in this application is a mature network structure that is easy to implement.

[0018] In another possible design approach, the above-mentioned determination of semantic features based on file content includes: identifying suspicious file content in the file content, the suspicious file content having the characteristics of a ransom note; segmenting the suspicious file content into words to obtain the segmentation results of the suspicious file content; and learning the segmentation results through a second network to obtain semantic features.

[0019] With this possible design, compared to using the semantic features of the entire file content for subsequent theft detection, using the semantic features of the suspicious file content identified in the file content for subsequent theft detection can reduce the computational load of the second network in the detection model, thereby saving the computing power of the detection device.

[0020] In another possible design approach, the aforementioned identification of suspicious file content within the file content includes: identifying suspicious file content based on the metadata of the file to which the file content belongs; or, identifying suspicious file content based on the file content and a knowledge base (the knowledge base being constructed based on keywords from historically collected ransom notes); or, identifying initial suspicious file content based on the metadata of the file to which the file content belongs; or, identifying suspicious file content within the initial suspicious file content based on the initial suspicious file content and the knowledge base. Through these possible designs, the goal of identifying suspicious file content within the file content can be achieved in multiple ways, providing flexibility.

[0021] In another possible design approach, when detecting whether a target IO request exists among multiple IO requests using a detection model, the above method further includes: comparing a confidence threshold with the confidence level output by the detection model to obtain a comparison result, which indicates whether the target IO request exists among the multiple IO requests.

[0022] In another possible design approach, when the detection result indicates the presence of a target IO request among multiple IO requests, the method further includes: determining the degree of influence of the multiple IO requests on the detection result; identifying the target IO request among the multiple IO requests; and identifying the file requested by the target IO request as the stolen file. This possible design achieves the identification of stolen data at the file level.

[0023] In another possible design approach, the above determination of the impact of multiple IO requests on the detection results includes: using a gradient-based feature attribution method to determine the impact of each IO request on the detection results.

[0024] In another possible design approach, the above method further includes generating an attack report, which includes a description of the target I / O request and metadata of the stolen file. The description of the target I / O request includes, but is not limited to, the network address of the client initiating the target I / O request, the time the target I / O request was received, and the type of I / O operation requested by the target I / O request. The metadata of the file requested by the target I / O request (i.e., the stolen file) includes, but is not limited to, the filename, file extension, file size, and number of files.

[0025] Since the target I / O request is a detected I / O request used to steal data, its description can be seen as a profile of the attacker's attack pattern. The stolen file is the target of the attack, so its metadata can be seen as a profile of the target. Therefore, this design allows for the generation of a detailed attack report, including both attacker and target profiles. Based on this report, users can take appropriate actions to protect their data assets.

[0026] In another possible design approach, the attack report also includes alerts for high-risk files. High-risk files are those whose semantic fingerprints in the file system are less than or equal to a threshold distance from the semantic fingerprints of the stolen files. Semantic fingerprints are used to identify files.

[0027] In another possible design approach, the attack report also includes an access control policy, which is used to instruct access control for high-risk files.

[0028] By using the two possible designs described above, high-risk files that pose a risk of theft can be predicted. Furthermore, by controlling access to these high-risk files, the security of this file data can be guaranteed.

[0029] In another possible design approach, multiple IO requests access the file system based on the network attached storage (NAS) protocol.

[0030] Secondly, this application provides a data theft detection device. This detection device is used to execute any of the methods provided in the first aspect. This application can divide the detection device into functional modules according to any of the methods provided in the first aspect. For example, each function can be divided into its own functional modules, or two or more functions can be integrated into one processing module. For example, this application can divide the detection device into an acquisition unit and a detection unit, etc., according to function. The descriptions of possible technical solutions and beneficial effects of the above-described functional modules can be found in the solutions provided in the first aspect and any possible design method within the first aspect, and will not be repeated here.

[0031] Thirdly, this application provides a data theft detection device. The detection device includes: a memory, a communication interface, and one or more processors. The one or more processors receive or transmit data through the communication interface, and are configured to read program instructions stored in the memory to execute the methods provided by the first aspect and any possible design of the first aspect.

[0032] The detection device described in the second or third aspect may be, for example, a computing device that communicates with the file system layer of the file system and has computing capabilities, or a functional module within that computing device, or a chip used to implement some or all of the operations described in any of the above aspects and in any possible design. In one possible design, the detection device is implemented as a management server / management device / management node / management module for managing the file system.

[0033] Fourthly, this application provides a computer-readable storage medium that is a non-volatile computer-readable storage medium, the computer-readable storage medium including computer program instructions, which, when executed by a processor, cause the processor or a device including the processor to perform the method provided by the first aspect and any possible design of the first aspect.

[0034] Fifthly, this application provides a computer program product containing instructions that, when executed by a processor, cause the processor or a device including the processor to perform the methods provided by the first aspect and any possible design of the first aspect.

[0035] Sixthly, this application provides a chip that includes a processor for running program instructions or code. The chip or a device including the chip can be used to perform methods provided by the first aspect and any possible design embodiment within the first aspect. Exemplarily, the chip further includes an input interface, an output interface, and a memory. The chip's input interface, output interface, processor, and memory are connected via internal interconnection paths. The memory in the chip stores program instructions or code executed by the processor, and the input and output interfaces are used for communication and connection between the chip and other chips or devices.

[0036] It is understood that any of the data theft detection devices, computer-readable storage media, computer program products or chips provided above can be applied to the corresponding methods provided above. Therefore, the beneficial effects they can achieve can be referred to the beneficial effects in the corresponding methods, and will not be repeated here.

[0037] In this application, the names of the aforementioned data theft detection devices, etc., do not limit the devices or functional modules themselves. In actual implementation, these devices or functional modules may appear under other names. As long as the functions of each device or functional module are similar to those in this application, they all fall within the protection scope of this application. Attached Figure Description

[0038] Figure 1a This is a schematic diagram of an implementation environment for the method provided in the embodiments of this application;

[0039] Figure 1b This is a schematic diagram illustrating the deployment relationship between the file system layer and the storage system used to store data in the file system provided in this application embodiment;

[0040] Figure 2 This is a schematic diagram of a training and detection model provided in an embodiment of this application;

[0041] Figure 3 This is a flowchart illustrating a data theft detection method provided in an embodiment of this application;

[0042] Figure 4 This is a schematic diagram illustrating the process by which a detection device, according to an embodiment of this application, learns and infers from a received embedding vector using a detection model and outputs a confidence score.

[0043] Figure 5 This is a flowchart illustrating another data theft detection method provided in an embodiment of this application;

[0044] Figure 6 This is a schematic diagram illustrating the process of determining suspicious file content using method 3 and determining semantic features characterizing the semantics of suspicious file content based on the suspicious file content, as provided in the embodiments of this application.

[0045] Figure 7 This is a schematic diagram illustrating a process for obtaining fusion features and confidence levels according to an embodiment of this application;

[0046] Figure 8 This is a schematic diagram illustrating the process of determining a target I / O request and locating a stolen file in a unit to be inspected, as provided in an embodiment of this application.

[0047] Figure 9 This is another flowchart illustrating the data theft detection method provided in the embodiments of this application;

[0048] Figure 10 This is a schematic diagram of the structure of a data theft detection device provided in an embodiment of this application;

[0049] Figure 11 This is a schematic diagram of the structure of a computing device provided in an embodiment of this application. Detailed Implementation

[0050] To make the objectives, technical solutions, and advantages of this application clearer, the embodiments of this application will be described in further detail below with reference to the accompanying drawings.

[0051] To facilitate understanding, the technologies and background involved in the embodiments of this application will be explained below.

[0052] 1) Stealing viruses and ransom notes.

[0053] Traditional ransomware typically extorts money by encrypting victims' files, demanding a ransom to unlock them. However, with advancements in antivirus software and data backup technology, simply encrypting files has become less effective. Attackers have therefore begun employing a more covert and efficient ransomware method: data theft. Data theft ransomware involves attackers stealing the victim's confidential data, sending this data to their own servers, and then threatening to release it publicly in exchange for ransom.

[0054] Attackers typically obtain victims' confidential data by spreading stealing viruses to the victim's host. For example, after spreading the stealing virus, the virus runs on the victim's host, and the running virus program performs data-stealing operations to steal the victim's confidential data. This data-stealing operation generally includes the following steps: data filtering and collection, file aggregation, and data outreach. Data filtering and collection refers to screening files according to preset rules (e.g., filtering files by directory or file type) to locate and read confidential data. File aggregation refers to encoding and compressing the stolen data / files before storing them in a preset directory. Data outreach refers to reading all the file data stored in the preset directory and sending it to the attacker's host or server.

[0055] It should be understood that in scenarios where attackers use "data theft" as a ransom tactic to demand ransom from victims, attackers typically generate a ransom note containing ransom information and payment demands on the victim's system where the stolen data / files are stored. The ransom information is the threat the attacker presents to the victim. For example, the ransom note might claim that the attacker has obtained the victim's confidential information, such as account passwords, photos, or videos, and threatens to release this information in exchange for ransom payment, specifying the exact ransom amount and promising not to take threatening action in exchange for the ransom. The payment demands are the ransom requests made by the attacker to the victim. For example, the payment demands might include the attacker's provided payment method (such as a digital currency payment method) and the account to receive the ransom (such as a digital currency account).

[0056] 2) Time-series model

[0057] A time series model is a model used to analyze and predict time series data. Time series data consists of data collected at different times, used to describe how a phenomenon changes over time. This type of data reflects the state or extent of change of a thing or phenomenon over time.

[0058] Optionally, the temporal model can be a deep learning model. For example, the temporal model can be a machine learning model based on an attention mechanism: the transformer model.

[0059] 3) Self-attention mechanism and self-attention block

[0060] Self-attention is a special type of attention mechanism that allows a model to consider the relationship between each element in a sequence and all other elements when processing a sequence. This mechanism helps models using self-attention better understand the contextual information within the sequence by calculating the correlation (or weight) between each element and other elements, thus processing sequence data more accurately.

[0061] In other words, in models employing self-attention, the model calculates the correlation between each element in the sequence and all other elements; these correlations reflect the relationships between the elements. For example, in language models using self-attention, the self-attention mechanism can reflect the semantic correlation between words.

[0062] Typically, self-attention mechanisms require training on large amounts of data to effectively establish accurate global relationships.

[0063] Self-attention blocks are modules or neural network structures used to implement the self-attention mechanism in models that employ it. Thus, self-attention blocks can capture the correlation between elements in the input sequence.

[0064] 4) Sparse self-attention mechanism

[0065] Sparse self-attention mechanism is a method to reduce computational complexity in self-attention mechanism by sparsification.

[0066] Sparsity reduction is a technique that reduces the number of non-zero elements in a dataset, making the data more sparse. By leveraging the sparsity of data, sparsity reduction removes irrelevant information, retaining only the most meaningful parts, effectively reducing the dimensionality of the data and thus reducing noise. Therefore, by reducing data dimensionality, sparsity reduction can improve computational efficiency, accelerate data processing, and reduce storage space consumption.

[0067] 5) Embedding vector

[0068] An embedded vector refers to a representation that maps high-dimensional data to a low-dimensional vector space through embedding encoding. Embedding encoding can also be understood as the vectorization of data.

[0069] MLP is a neural network model that typically consists of multiple fully connected layers and is used to map multiple input datasets to a single output dataset.

[0070] 7) Gradient shapley additive explanations (SHAP), self-attention mapping (map), and integrated gradients.

[0071] Gradient SHAP, self-attention map, and ensemble gradient are all methods used to interpret the prediction results of deep learning models. They are generally interpreted by calculating the contribution of input features to the prediction results.

[0072] 8) Semantic fingerprint

[0073] Semantic fingerprinting refers to the unique identifier generated by analyzing text content to uniquely identify the text content, and it is usually used for text similarity detection.

[0074] 9) NAS

[0075] A NAS (Network Attached Storage) is a storage system specifically designed for storing and sharing files. NAS systems are typically connected to a local area network (LAN) and provide users with efficient storage and data sharing services via network protocols. Thus, a NAS system can act as a file server, allowing multiple users to access and share files stored on the NAS system over a network.

[0076] NAS systems support a variety of file protocols, such as Network File System (NFS), Server Messages Block (SMB) / Common Internet File System (CIFS), and File Transfer Protocol (FTP). These protocols enable file sharing and access between different operating systems and devices.

[0077] Currently, on the one hand, because thieving viruses typically employ various code obfuscation techniques and junk code, they increase the difficulty for antivirus tools to detect and remove them. Code obfuscation is a technique that alters the form and structure of code, making it more difficult to understand and reverse engineer. Junk code, also known as obfuscated code or dirty bytes, refers to inserting junk code into the actual code without affecting program execution, thereby affecting the normal operation of the disassembler and interfering with the static analysis of reverse engineers, thus increasing the difficulty and time of analysis. On the other hand, data theft operations (or data theft behaviors) caused by thieving viruses are usually hidden within the victim's normal file data processing I / O operations, and the data theft behavior does not modify the files. Therefore, victims cannot detect data theft events in a timely manner after they occur, making it difficult to assess the extent of data loss and respond quickly to the data theft. Therefore, data theft behaviors are characterized by their high degree of concealment. On the other hand, the methods of spreading stolen viruses include, but are not limited to, email, Trojan programs, and malicious websites. As stolen viruses continue to evolve and develop, the number of variants of stolen viruses is constantly emerging. Therefore, stolen viruses are highly resistant, which poses a huge threat to users' data assets.

[0078] Therefore, compared to encryption-based ransomware, data-stealing viruses are more difficult to detect, more stealthy, and more resistant to attack. To effectively detect and defend against data theft caused by data-stealing viruses and ensure the security of users' data assets, the following related technologies can be used for protection against such viruses.

[0079] In one related technology, protection software, threat intelligence services, and / or automated alarm systems are deployed on a user's host (hereinafter referred to as the user host) to detect and alert on stolen viruses. The protection software can be based on artificial intelligence (AI) technology using active learning. The user host can detect unrunning virus programs in real time through the protection software. The threat intelligence service is used to detect the characteristics of running programs on the user host using a threat intelligence database, thereby determining whether a running virus program exists on the user host. The threat intelligence database includes information such as the characteristics and attack methods of known threats. The automated alarm system uses models (such as behavior tree models) to detect endpoint logs (e.g., logs recorded by the endpoint including registry entries and file operations) to discover traces of data theft behavior in the endpoint logs, and based on the detected traces, detects and alerts on data theft behavior. Compared to manually detecting and analyzing endpoint logs to detect threats and issue alerts, the automated alarm system can reduce the false alarm rate by 90%.

[0080] Another related technology involves deploying a deep learning-based detection model in a storage system used to store user data. This model is trained on IO access logs recorded by the storage system. This detection model can then inspect every IO access log entry recorded by the storage system to identify and alert on abnormal IO access behavior.

[0081] In another related technology, a user and entity behavior analytics (UEBA) model is deployed on the storage system used to store user data or on the network side where the user's host is connected to the network. The UEBA model detects abnormal access behavior targeting important user data, and when such abnormal access behavior is detected, it issues an alarm and blocks the transmission of the important user data. The UEBA model is trained based on access behavior targeting pre-labeled important user data.

[0082] In another related technology, simulated adversarial exercises are continuously launched against storage systems used to store user data, thereby discovering and fixing security vulnerabilities in the storage system and improving the overall accessibility and leakage prevention capabilities of the storage system.

[0083] The aforementioned technologies can all improve the protection against data theft to some extent. However, due to the strong concealment of the theft virus itself, the accuracy of these technologies in detecting theft viruses is not high. That is, the false detection rate and / or false negative rate of these technologies are still relatively high.

[0084] Based on this, embodiments of this application provide a data theft detection method. This method uses multiple IO requests accessing the file system as the unit to be inspected, and detects whether any IO requests for data theft exist among the multiple IO requests based on the IO data contained in the unit to be inspected. Optionally, the multiple IO requests may be IO requests for accessing the file system initiated by the same client. Thus, by detecting multiple IO requests accessing the file system at once, the relationship (or correlation) between the multiple IO requests can be used as reference information for detecting / identifying data theft behavior, thereby enhancing the ability to detect data theft, improving the accuracy and reliability of data theft detection, and reducing the false detection rate and false negative rate when detecting data theft. Embodiments of this application do not specifically limit the storage system used to store file system data. This storage system may be, for example, a block storage system based on a storage area network (SAN), or a NAS system.

[0085] Optionally, multiple I / O requests to access the file system are I / O requests to access the file system based on the NAS protocol.

[0086] refer to Figure 1a , Figure 1a A schematic diagram of an implementation environment for the method provided in the embodiments of this application is shown. Figure 1a As shown, the implementation environment includes a file system and multiple clients accessing the file system, such as client 1, ..., client n, where n is an integer greater than 1. This application embodiment does not specifically limit the storage system used to store the file system data; the storage system can be, for example, a SAN-based block storage system or a NAS system. Furthermore, this application embodiment does not specifically limit the storage architecture of the storage system; for example, it can be a centralized storage architecture or a distributed storage architecture.

[0087] In this embodiment of the application, the deployment location of the storage system used to store file system data is not specifically limited.

[0088] In one example, the storage system used to store file system data is deployed on an internal corporate network. In this case, by applying the methods provided in the embodiments of this application to the file system, it is possible to achieve real-time monitoring, detection, and response to potential data theft in the internal corporate file system, thereby protecting the company's critical data assets.

[0089] In another example, the storage system used to store file system data is the same storage system that a storage service provider offers storage services to external users. In this case, by applying the method provided in this application embodiment to the file system, malicious attacks and data breaches targeting the storage service provider's tenant data can be prevented, thereby enhancing the storage service provider's ability to protect tenant data. Here, a tenant refers to a user using the storage services provided by the storage service provider. In this example, when the method provided in this application embodiment is applied to the file system that the storage service provider offers storage services to external users, the storage service provider can add the data theft detection function implemented by the method provided in this application embodiment as a security detection function to its storage products, thereby increasing the diversity and competitiveness of the storage service provider's storage products.

[0090] In another example, the storage system used to store file system data is a storage system deployed in a data center (DC) or a storage system provided by a data hosting service provider. When the method provided in this application is applied to the file system of a DC or the file system of a data hosting service provider, data theft protection can be achieved efficiently and accurately.

[0091] It should be understood that when the method provided in the embodiments of this application is applied to... Figure 1a When the file system is shown, it can detect data theft behavior against the file system in a timely and accurate manner based on the client's IO requests to access the file system, so that users can respond to and deal with the data theft behavior in a timely manner, thereby achieving protection of file system data.

[0092] It should be understood that a file system includes a file system layer, which involves the specific implementation of the file system. The file system layer includes operations such as file organization, storage, and access control. The file system layer typically includes specific details such as file naming rules, directory structure, and how to locate files via paths. This application embodiment does not specifically limit the deployment relationship between the file system layer and the storage system used to store data in the file system. Reference Figure 1b , Figure 1b This diagram illustrates the deployment relationship between the file system layer of a file system and the storage system used to store data within the file system.

[0093] like Figure 1bAs shown in (a), the file system layer of the file system resides on the client side, and the data in the file system is stored on the disk of the block storage system. In this case, the block storage system is, for example, a SAN-based storage system. In this implementation, the client application communicates with the file system layer through the file system interface; this communication is internal client communication. Furthermore, the IO requests sent by the client application to the file system layer through the file system interface are the client IO requests for accessing the file system as described in this embodiment. In addition, communication between the file system layer and the storage system can be achieved through a network, which includes, but is not limited to, a user's internal network, the Internet, or a SAN network.

[0094] like Figure 1b As shown in (b), the file system layer of the file system resides in the storage system, and the data in the file system is stored on the disk of the storage system. In this case, the storage system is, for example, a NAS system. In this implementation, the client application communicates with the file system layer in the storage system through the file system interface. This communication is network communication, which includes, but is not limited to, internal user network communication or internet communication. Furthermore, the IO requests sent by the client application to the file system layer in the storage system through the file system interface are the client IO requests for accessing the file system as described in this embodiment.

[0095] It should be understood that the above content is an exemplary description of the implementation environment of the method provided in the embodiments of this application, and does not constitute a limitation on the implementation environment of the method. As those skilled in the art know, the implementation environment can be adjusted according to application requirements as business needs change, and the embodiments of this application do not list them one by one.

[0096] This application also provides a data theft detection device, which is deployed in the file system layer of the file system and is used to execute the data theft detection method provided in this application.

[0097] Optionally, the detection device can be any computing device with data processing capabilities, or a functional module within a computing device; there is no limitation in this regard. For example, the computing device can be a general-purpose computer, laptop, tablet, or other computing device. As another example, the computing device can be implemented as a management server / management device / management node / management module for managing a file system; there is no limitation in this regard.

[0098] Optionally, in this embodiment of the application, the detection device is pre-set with a detection model, which is used to detect multiple IO requests for accessing the file system at one time, so as to determine whether there is a target IO request for stealing data among the multiple IO requests.

[0099] The detection model includes a first network and a fourth network. In this case, for multiple IO requests to be detected, the first network extracts behavioral features of the multiple IO requests based on their IO operation information. This IO operation information includes the operation information of the IO operation requested by each IO request, which includes one or more of the following: IO operation type, IO operation time, metadata of the IO operation object, or performance information of the storage node storing data in the file system. Here, for the file system, the operation object is generally a file; therefore, the metadata of the operation object includes, but is not limited to, filename, file extension, file size, and directory. Performance information of the storage node storing data in the file system includes, for example, central processing unit (CPU) utilization. The fourth network performs inference detection based on the behavioral features determined by the first network to determine whether there are any target IO requests for stealing data among the multiple IO requests to be tested.

[0100] Optionally, the detection model may further include a second network and a third network. Thus, when at least one IO write request exists among the multiple IO requests to be detected, the second network can extract semantic features of the file content requested to be written to the file system by the at least one IO write request. The third network is then used to fuse the behavioral features determined by the first network and the semantic features determined by the second network to obtain fused features. Furthermore, a fourth network is used to perform inference detection on the fused features to determine whether there is a target IO request for stealing data among the multiple IO requests to be tested.

[0101] For example, the first network in the detection model is the encoder network in the transformer model, the second network is the language model, the third network is the gating network, and the fourth network is the MLP network.

[0102] The training process of the preset detection model in the detection device of this application embodiment will be described below.

[0103] Taking the detection model architecture provided in this application embodiment, which includes a first network, a second network, a third network, and a fourth network, as an example, refer to... Figure 2 , Figure 2 This diagram illustrates a process for training a detection model according to an embodiment of this application. Optionally, this process can be performed by the detection device provided in this embodiment, or by any other computing device with data processing capabilities; there is no limitation on this. For ease of description, the following description uses a detection model trained by a computing device as an example. Figure 2 As shown, the process includes the following steps 101 to 102.

[0104] Step 101: The computing device acquires training samples.

[0105] The training samples include IO data parsed from IO requests to access the file system from the client when the client is running a virus-stealing program, and IO data parsed from IO requests to access the file system from the client when the client is not running a virus-stealing program. The IO data includes IO operation information for the IO request, which includes operation information of the IO operation requested by the IO request. This operation information includes one or more of the following: IO operation type, IO operation time, metadata of the IO operation object, or performance information of the storage node storing data in the file system. Optionally, when the IO request used to parse the IO data contains an IO write request indicating that data should be written to the file system, the IO data also includes the file content carried by the IO write request, indicating that the data should be written to the file system.

[0106] In one example, this embodiment of the application designates samples obtained when the stealing virus is running on the client as positive samples, and samples obtained when the stealing virus is not running on the client as negative samples. In this case, the training samples include positive and negative samples, where positive samples include IO data parsed from IO requests to access the file system from the client when the stealing virus is running on the client, and negative samples include IO data parsed from IO requests to access the file system from the client when the stealing virus is not running on the client.

[0107] In this embodiment, each training sample includes IO data parsed from multiple IO requests from client accessing the file system. For example, taking any one of the training samples, such as the first sample, the first sample includes IO data parsed from multiple IO requests from client accessing the file system. While this embodiment does not limit the specific value of "multiple," in the following text of this embodiment, "multiple" always refers to the same number.

[0108] In addition, each training sample also includes a sample label. Taking the first sample as an example, the first sample includes not only the IO data parsed from multiple IO requests accessing the file system from the client, but also a sample label. When the first sample is a positive sample, the sample label of the first sample is: the target IO request exists among the multiple IO requests that obtained the IO data in the first sample. When the first sample is a negative sample, the sample label of the first sample is: the target IO request does not exist among the multiple IO requests that obtained the IO data in the first sample. In other words, when the multiple IO requests that obtained the IO data in the first sample are IO requests that access the file system when the client is running a virus-stealing program, the sample label of the first sample is: the target IO request exists among these multiple IO requests. When the multiple IO requests that obtained the IO data in the first sample are IO requests that access the file system when the client is not running a virus-stealing program, the sample label of the first sample is: the target IO request does not exist among these multiple IO requests.

[0109] It should be noted that the clients making IO requests to access the file system, whether or not they are running the virus-stealing software, can be the same client or different clients. Since there is no correlation between the IO operations indicated by IO requests from different clients accessing the file system, but there is a temporal correlation between the IO operations indicated by IO requests from the same client accessing the file system over a period of time, the IO data in a training sample can optionally be IO data parsed from multiple IO requests from the same client accessing the file system.

[0110] Specifically, the computing device acquires training samples by obtaining training samples through IO logs recorded when accessing the file system. The IO logs include multiple IO requests made by the client when running a virus-stealing application, simulating user IO behavior to access the file system. In this case, by parsing these multiple IO requests, IO logs can be recorded based on the parsing results, designated as the first IO log. The IO logs also include multiple IO requests made by the client when not running a virus-stealing application, simulating user IO behavior to access the file system. In this case, by parsing these multiple IO requests, IO logs can be recorded based on the parsing results, designated as the second IO log. Here, this embodiment does not limit the entity performing the IO log recording. For example, in conjunction with... Figure 1b If the file system layer of the file system is located on the client side, then the entity responsible for recording the IO logs is the client. If the file system layer of the file system is located on the storage system, then the entity responsible for recording the IO logs is the storage system.

[0111] In one possible embodiment, the computing device obtains training samples through IO logs recorded when accessing the file system, including: the computing device obtaining a first IO log and a second IO log recorded when accessing the file system; the computing device extracting a first IO dataset from the first IO log and a second IO dataset from the second IO log, wherein the first IO dataset includes IO data of multiple IO requests recorded in the first IO log, and the second IO dataset includes IO data of multiple IO requests recorded in the second IO log; the computing device slices the first IO dataset into multiple groups of IO data according to the operation time of each IO request in the first IO dataset to obtain multiple positive samples, and the computing device slices the second IO dataset into multiple groups of IO data according to the operation time of each IO request in the second IO dataset to obtain multiple negative samples. Each group of IO data contains IO data of multiple IO requests recorded in the IO log, and therefore, each group of IO data is a training sample.

[0112] Step 102: The computing device uses training samples to iteratively train the detection model to be trained, and obtains the target detection model.

[0113] The target detection model is the detection model pre-installed in the detection device described in the embodiments of this application.

[0114] The detection model to be trained has a preset network structure, which includes a first network, a second network, a third network, and a fourth network. Taking any training sample, such as the first sample, as an example, the first network extracts behavioral features based on the IO operation information contained in the IO data of the first sample. These behavioral features are the characteristics of the IO operations indicated by the multiple IO requests used to obtain the IO data in the first sample. The second network determines semantic features based on the file content contained in the IO data of the first sample. This file content is the file content indicated by the IO write request among the multiple IO requests used to obtain the IO data in the first sample, and this semantic feature is the semantic feature of the file content. The third network fuses the behavioral features determined by the first network and the semantic features determined by the second network to obtain a fused feature. The fourth network then performs inference detection on the fused feature to obtain the detection result of the first sample. In this case, the network structure of the target detection model obtained by the computing device after iteratively training the detection model to be trained using training samples also includes the first, second, third, and fourth networks. For example, the first network is the encoder network in the transformer model, the second network is the language model, the third network is the gating network, and the fourth network is the MLP network.

[0115] It should be noted that the aforementioned preset network structure includes the first and fourth networks, but excludes the second and third networks. Taking the first sample as an example, the first network extracts behavioral features based on the IO operation information contained in the IO data of the first sample. These behavioral features are the characteristics of the IO operations indicated by the multiple IO requests used to obtain the IO data in the first sample. The fourth network performs inference detection on the behavioral features determined by the first network to obtain the detection result of the first sample. In this case, when the computing device obtains the training sample in step 101, it does not need to obtain the file content contained in the IO data of the training sample. Therefore, the network structure of the target detection model obtained by the computing device using the training sample to iteratively train the detection model to be trained includes the first and fourth networks, but excludes the second and third networks.

[0116] Specifically, the computing device uses training samples to iteratively train the detection model to be trained, obtaining a target detection model. This includes: the computing device inputs any training sample (such as the first sample) into the initial detection model to be trained (denoted as the first detection model) to obtain a first detection result. The computing device calculates the loss based on the first detection result and the sample label of the first sample, and adjusts the network parameters of the first detection model according to the calculation result to obtain a second detection model to be trained. Then, the computing device inputs the second sample from the training samples into the second detection model to obtain a second detection result. The second sample and the first sample can be the same training sample or different training samples; this is not limited. Subsequently, the computing device calculates the loss based on the second calculation result and the sample label of the second sample, and adjusts the network parameters of the second detection model according to the calculation result to obtain a third detection model to be trained. This process continues, with the computing device iteratively training the detection model to be trained multiple times to finally obtain the target detection model. In one example, when the computing device determines that the number of iterations for iterative training the detection model to be trained exceeds a threshold, it determines the detection model obtained after the current adjustment of network parameters as the target detection model. In another example, the computing device determines the current detection model to be trained as the target detection model when the loss calculated by the detection result obtained after detecting the training sample based on the current detection model to be trained and the sample label of the training sample is less than a threshold.

[0117] In the process of iteratively training the detection model, the processing flow of the detection model to be trained for each training sample can be referred to in step 202 or step 302 below, which will not be repeated here.

[0118] Optionally, during the iterative training of the detection model by the computing device, the computing device can acquire training samples while training the detection model. Of course, the computing device can also train the detection model using all the training samples after acquiring them; this embodiment of the application does not limit this approach.

[0119] Thus, through steps 101 to 102, the computing device can train the detection model pre-set in the detection device according to the embodiments of this application.

[0120] The implementation process of the data theft detection method provided in the embodiments of this application will be described below.

[0121] refer to Figure 3 , Figure 3 A schematic flowchart of a data theft detection method provided in an embodiment of this application is shown. Optionally, this method can be applied to... Figure 1a The implementation environment is shown, and it is executed by a detection device deployed in the file system layer of the file system. For example... Figure 3 As shown, the method includes the following steps 201 to 202.

[0122] Step 201: The detection device acquires IO operation information for multiple IO requests.

[0123] Among these, multiple IO requests are IO requests to access the file system. Optionally, these multiple IO requests are IO requests from clients with the same network address to access the file system.

[0124] The IO operation information of the aforementioned multiple IO requests includes operation information of the IO operation requested by each IO request. This operation information includes one or more of the following: IO operation type, IO operation time, metadata of the IO operation object, or performance information of the storage node of the storage file system. In this embodiment, the multiple IO requests are treated as a single unit to be inspected.

[0125] Specifically, the detection device obtains IO operation information for multiple IO requests, including: the detection device obtains multiple log records from the IO logs recorded when the client accesses the file system, and extracts IO operation information from each of the multiple log records to obtain IO operation information for multiple IO requests; or, the detection device obtains multiple log records containing the same network address from the IO logs recorded when the client accesses the file system, and extracts IO operation information from each of the multiple log records to obtain IO operation information for multiple IO requests.

[0126] It is understandable that each IO request from the client to access the file system corresponds to one log record in the IO log. Therefore, the detection device obtains multiple log records from the IO log and extracts IO operation information from each of the multiple log records. The extracted IO operation information is the IO operation information of each IO request among the multiple IO requests for those multiple log records.

[0127] In addition, the multiple log records containing the same network address obtained by the detection device from the IO log are obtained from multiple IO request records of the same client accessing the file system based on the same network address. Furthermore, the IO operation information extracted by the detection device from each of the multiple log records is the IO operation information of each IO request in the multiple IO requests of the multiple log records.

[0128] In one example, when the storage system used to store file system data is deployed on an enterprise intranet, a data center (DC), or a data hosting provider, the same client represented by the same network address can be any terminal host accessing the file system. This is because, to protect user data assets (such as enterprise data assets), it is necessary to detect every IO request from each client accessing the file system to determine whether the IO request is a target IO request used to steal enterprise data. Therefore, in this example, for every multiple log records in the IO log, the detection device acquires these multiple log records and extracts IO operation information from them to obtain the IO operation information of a unit under inspection. Alternatively, for every multiple log records in the IO log containing the same network address, the detection device acquires these multiple log records containing the same network address and extracts IO operation information from them to obtain the IO operation information of a unit under inspection.

[0129] In another example, when the storage system used to store file system data is a storage system provided by a storage service provider, the aforementioned "same client" referring to the same network address means the client of the tenant selected by the storage service provider to use the solution provided in this application embodiment to protect data asset security. Therefore, in this example, for every multiple log records containing the same specific network address in the IO log, the detection device acquires these multiple log records containing the same specific network address and extracts IO operation information from them, thereby obtaining the IO operation information of a unit to be inspected. Here, the same specific network address refers to the network address of a specific tenant's client, and the specific tenant refers to the tenant selected by the storage service provider to use the solution provided in this application embodiment to protect data asset security.

[0130] Step 202: The detection device detects whether there is a target IO request for stealing data among the multiple IO requests based on the IO operation information of the multiple IO requests.

[0131] The detection device detects whether there is a target IO request for stealing data among the multiple IO requests based on the IO operation information of the IO requests. It can also be understood that the detection device detects whether there is a target IO request in the unit under inspection based on the IO operation information of the unit under inspection.

[0132] Specifically, the detection device detects whether there is a target IO request for stealing data among the multiple IO requests based on the IO operation information of the multiple IO requests, including: the detection device determines the behavioral characteristics of the multiple IO requests based on the IO operation information of the multiple IO requests, the behavioral characteristics being used to characterize the features of the IO operations indicated by the multiple IO requests; the detection device detects whether there is a target IO request among the multiple IO requests based on the behavioral characteristics.

[0133] For example, the detection device first embeds and encodes the IO operation information of multiple IO requests, thereby obtaining multiple embedding vectors representing the IO operations indicated by the multiple IO requests. Since the detection device can obtain an embedding vector with a preset length (or preset dimension) after embedding and encoding the IO operation information of one IO request, the multiple embedding vectors are equivalent to multiple matrices of quantity × preset length. For example, when "multiple" is 500 and the preset length (i.e., preset dimension) is 64, the detection device can obtain 500 embedding vectors of length 64 (or 64-dimensional) after embedding and encoding the IO operation information of 500 IO requests, which is equivalent to a 500×64 matrix. Each of these 500 embedding vectors of length 64 (i.e., one row element in the 500×64 matrix) is used to represent the IO operation indicated by one IO request.

[0134] The process of embedding and encoding IO operation information is essentially the process of vectorizing IO operation information. In one example, the process of embedding and encoding IO operation information of an IO request by the detection device includes: for any type of information in the IO operation information, such as the IO operation type, the detection device first maps the IO operation type to a preset value according to a preset strategy (or can be understood as assigning a preset value), and then maps the preset value to a multi-dimensional vector; then, the detection device superimposes or concatenates the multi-dimensional vectors obtained by mapping each type of information in the IO operation information to obtain the embedding vector representing the IO operation indicated by the IO request.

[0135] Next, the detection device inputs the obtained multiple embedding vectors into the preset detection model in the detection device. The detection model learns and infers from the received embedding vectors and outputs a confidence score to determine whether the target IO request exists among the multiple IO requests.

[0136] In this embodiment, the detection model includes a first network and a fourth network. Therefore, after the detection device inputs the embedding vector into the detection model, the detection model inputs the embedding vector into the first network. The first network learns the relationships between elements in the embedding vector and outputs behavioral features, which are the features of the IO operations indicated by the multiple IO requests used to obtain the aforementioned embedding vector. Next, the detection model inputs the behavioral features output by the first network into the fourth network, performs detection inference on the behavioral features through the fourth network, and outputs a confidence score to determine whether a target IO request exists among the multiple IO requests.

[0137] It should be understood that when the first network is the encoder network in a transformer model, it includes multiple sparse self-attention layers employing a sparse self-attention mechanism. Therefore, when processing the received embedding vector to obtain behavioral features through the first network, each element in the embedding vector can be quantized using the sparse self-attention layers in the first network. This achieves sparsity processing of the embedding vector, thereby filtering out noise and enhancing the behavioral features obtained after learning the embedding vector through the first network.

[0138] It should also be understood that for a single unit to be inspected, the detection model receives multiple embedding vectors, meaning that the number of embedding vectors input to the first network in the detection model is multiple. Therefore, the multiple embedding vectors received by the first network in the detection model can be viewed as multiple matrices of a predetermined number multiplied by a predefined length. Thus, after the first network learns the relationships between the elements in this matrix, the output behavioral features are represented by multiple matrices of a predetermined number multiplied by a predefined length.

[0139] Optionally, before inputting the embedding vector into the detection model, the detection device can first perform layer normalization on the embedding vector, which can improve the computational complexity of the detection model when learning and inferring the embedding vector. This embodiment of the application does not describe in detail the process of layer normalization of the embedding vector by the detection device, nor does it limit the normalization range. For example, the normalization range can be [0,1] or [0,100].

[0140] The following description uses an example where the first network is the encoder network in a transformer model and the fourth network is an MLP network to illustrate the process by which the detection device learns and infers from the received embedding vectors using the detection model, thereby outputting a confidence score to determine whether a target IO request exists among multiple IO requests. (Reference) Figure 4 , Figure 4 This illustration shows a process by which a detection device according to an embodiment of this application learns and infers from a received embedding vector using a detection model and outputs a confidence score.

[0141] like Figure 4 As shown in (a), the detection device embeds and encodes the IO operation information of the unit under test to obtain an embedding vector representing the IO operations indicated by multiple IO requests in the unit under test. The detection device performs layer normalization on the obtained embedding vector and inputs the layer-normalized embedding vector into the first network. The first network learns the relationship between the elements in the received embedding vector, thereby outputting the behavioral features of the unit under test. It should be understood that the behavioral features of the unit under test are the features of the IO operations indicated by the multiple IO requests contained in the unit under test. The unit under test contains multiple IO requests, and the IO operation information of each IO request includes: the IO operation time requested by the IO request, the IO operation type, the metadata of the operation file of the IO operation, and the performance information of the storage node in the data storage file system. The metadata of the operation file includes the file name, file extension, file size, and other metadata of the operation file. The first network includes M self-attention blocks, including self-attention block 1 to self-attention block M, where M is an integer greater than 1. Each self-attention block sequentially includes a sparse self-attention layer, an ADD&Norm layer, a position feedforward layer, and an ADD&Norm layer. Here, ADD stands for residual connection, and Norm stands for layer normalization.

[0142] like Figure 4 As shown in (b), the detection model inputs the behavioral features of the unit to be inspected from the output of the first network into the fourth network, such as the MLP network. The fourth network infers and detects the behavioral features, thereby outputting a confidence level to indicate whether there is a target IO request in the unit to be inspected.

[0143] Furthermore, the detection device determines whether a target I / O request exists in the unit under inspection based on the confidence level output by the detection model.

[0144] Specifically, the detection device determines whether a target I / O request exists in the unit under inspection based on the confidence level output by the detection model. This includes comparing the confidence level output by the detection model with a confidence threshold to obtain a comparison result, which indicates whether a target I / O request exists in the unit under inspection. For example, if the comparison result indicates that the confidence level output by the detection model is greater than the confidence threshold, then it is determined that a target I / O request exists in the unit under inspection. If the comparison result indicates that the confidence level output by the detection model is less than the confidence threshold, then it is determined that no target I / O request exists in the unit under inspection. This application does not specifically limit the case where the comparison result indicates that the confidence level output by the detection model is equal to the confidence threshold. For example, in this case, the detection device can determine whether a target I / O request exists in the unit under inspection or whether a target I / O request does not exist in the unit under inspection.

[0145] It should be understood that the detection device has a preset confidence threshold. Optionally, the preset confidence threshold in the detection device is determined based on historical experience and remains unchanged. Optionally, the detection device can also dynamically adjust the confidence threshold during operation based on the confidence level of historical inference and the user's security needs; the comparison is not limited. For example, the detection device can adjust the confidence threshold based on the confidence level of historical inference using sigma rules or empirical Bayesian methods.

[0146] The method described in steps 201-202 uses multiple IO requests from client accessing the file system as inspection units, and detects whether there are IO requests for data theft within the inspection unit based on the behavioral characteristics of the IO requests contained in the inspection unit. Thus, by detecting multiple IO requests accessing the file system at once, the relationship between these multiple IO requests can be used as reference information for detecting / identifying data theft behavior, thereby enhancing the ability to detect data theft, improving the accuracy and reliability of data theft detection, and reducing the false positive and false negative rates when detecting data theft.

[0147] Furthermore, when the IO requests included in the unit under inspection are IO requests from the same client accessing the file system, the correlation between the multiple IO requests in the unit under inspection is closer. Therefore, when detecting whether there are IO requests for stealing data in the unit under inspection based on the behavioral characteristics of the IO requests contained in the unit under inspection, the accuracy and reliability are higher.

[0148] In other embodiments, when the multiple IO requests included in the unit under inspection include at least one IO write request, to further improve the ability to detect data theft, semantic analysis and detection of ransom notes can be added when detecting data theft based on the behavioral characteristics of multiple IO requests. Thus, by covering more theft features, the detection device's ability to detect data theft can be enhanced.

[0149] refer to Figure 5 , Figure 5 A flowchart illustrating another data theft detection method provided in an embodiment of this application is shown. Optionally, this method can be applied to... Figure 1a The implementation environment is shown, and it is executed by a detection device deployed in the file system layer of the file system. For example... Figure 5 As shown, the method includes the following steps 301 to 302.

[0150] Step 301: The detection device acquires IO operation information of multiple IO requests, and acquires the file content to be written to the file system indicated by the multiple IO requests.

[0151] Optionally, multiple IO requests are IO requests from clients with the same network address accessing the file system.

[0152] For a detailed explanation of how the detection device acquires IO operation information for multiple IO requests, please refer to the description of step 201, which will not be repeated here.

[0153] In this embodiment, the unit under inspection includes at least one IO write request among the multiple IO requests. The IO write request is used to instruct the writing of file content to the file system, and this file content is generally carried by the IO write request. Therefore, the detection device also obtains the file content that each of the at least one IO write request indicates to be written to the file system.

[0154] Optionally, when the IO log records file content carried by IO write requests that indicates writing to the file system, the detection device can obtain the file content carried by each of the at least one IO write requests that indicates writing to the file system from the IO log.

[0155] Optionally, when the IO log records the storage address and / or file path in the file system of the file content carried by the IO write request, indicating that the file content to be written to the file system is located therein, the detection device can obtain the storage address and / or file path in the file system of each of the at least one IO write requests carried by the IO log, indicating that the file content to be written to the file system is located therein, and read the file content requested to be written to the file system by each IO write request from the obtained storage address and / or file path.

[0156] Step 302: The detection device detects whether there is a target IO request for stealing data among the multiple IO requests based on the IO operation information of the multiple IO requests and the file content to be written to the file system indicated by each IO write request in the multiple IO requests.

[0157] For ease of description, the "file content requested by the IO request to be written to the file system" will be referred to as "the file content of the IO request" in the following text.

[0158] Specifically, the detection device detects whether there is a target IO request for stealing data among the multiple IO requests based on the IO operation information of multiple IO requests and the file content to be written to the file system indicated by each IO write request in the multiple IO requests. This includes: the detection device determining the behavioral characteristics of the multiple IO requests based on the IO operation information of the multiple IO requests, the behavioral characteristics being used to characterize the characteristics of the IO operations indicated by the multiple IO requests; the detection device determining semantic characteristics based on the file content to be written to the file system indicated by each IO write request in the multiple IO requests, the semantic characteristics being used to characterize the semantics of the file content; the detection device fusing the behavioral characteristics and semantic characteristics to obtain a fused characteristic; and the detection device detecting whether there is a target IO request among the aforementioned multiple IO requests based on the fused characteristic.

[0159] For example, the detection device can embed and encode the IO operation information of multiple IO requests contained in the unit to be detected, thereby obtaining multiple embedding vectors representing the IO operations indicated by the multiple IO requests. A detailed description of this process can be found in the relevant description of step 202, and will not be repeated here.

[0160] Optionally, the detection device performs text segmentation on the file content of each acquired IO write request to obtain a first segmentation result. In this embodiment, the segmentation algorithm used by the detection device for each IO write request is not specifically limited.

[0161] Then, the detection device inputs the obtained embedding vector and the first word segmentation result into the detection model. The detection model learns and infers from the received embedding vector and the first word segmentation result, and outputs a confidence score to determine whether the target IO request exists in the unit to be detected. Figure 5 In the described embodiment, the detection model includes a first network, a second network, a third network, and a fourth network. Specifically, the detection device inputs the embedding vector obtained based on the unit to be inspected into the first network of the detection model, processes it through the first network, and outputs behavioral features. These behavioral features are used to characterize the IO operations indicated by the multiple IO requests contained in the unit to be inspected. A detailed description of this process can be found in the relevant description of step 202. The detection device inputs the first word segmentation result into the second network of the detection model, learns the semantic features of the first word segmentation result through the second network, and outputs semantic features through the second network. These semantic features are used to characterize the semantics of the file content of each IO write request in the unit to be inspected.

[0162] In this embodiment, the semantic features output by the second network can be represented as a sequence, the length of which is also the preset length described above. Furthermore, the number of semantic features output by the second network is at least one, and each semantic feature is used to characterize the file content of an IO write request in the unit under inspection.

[0163] Optionally, the detection device can identify suspicious file content within the file content of each acquired IO write request, and then perform text segmentation on the suspicious file content to obtain a second segmentation result (or the segmentation result of the suspicious file content). Suspicious file content refers to file content possessing ransom note characteristics. Ransom note characteristics include keywords in common ransom note filenames, common ransom note file extensions, and frequently occurring keywords in ransom notes. Furthermore, this embodiment of the application does not specifically limit the segmentation algorithm used by the detection device when performing text segmentation on the suspicious file content.

[0164] Furthermore, the detection device inputs the embedding vector and the second word segmentation result obtained based on the unit to be inspected into the detection model. The detection model learns and infers from the received embedding vector and the second word segmentation result, and outputs a confidence score to determine whether a target IO request exists in the unit to be inspected. Specifically, the detection device inputs the obtained embedding vector into the first network of the detection model, processes it through the first network, and outputs behavioral features. These behavioral features are used to characterize the features of the IO operations indicated by the multiple IO requests contained in the unit to be inspected. A detailed description of this process can be found in the relevant description of step 202, and will not be repeated here. The detection device inputs the second word segmentation result into the second network of the detection model, learns the semantics of the second word segmentation result through the second network, and outputs semantic features to characterize the semantics of the second word segmentation result. That is, these semantic features are used to characterize the semantics of the suspicious file content.

[0165] It should be noted that when the detection device first identifies suspicious file content in the file content of each IO write request in the unit under inspection, and then learns the semantic features of the suspicious file content through the second network, thereby obtaining semantic features that characterize the semantics of the suspicious file content, and using these semantic features for subsequent theft detection reasoning, this method reduces the computational load of the second network in the detection model compared to using the semantic features that characterize the semantics of the file content of each IO write request in the unit under inspection for subsequent theft detection reasoning, thus saving the computing power of the detection device.

[0166] The process by which the detection device identifies suspicious file content in the file content of each acquired IO write request can be implemented in the following three ways.

[0167] Method 1: The detection device identifies suspicious file content in the file content of each IO write request based on the metadata of the file to which the file content belongs.

[0168] The file's metadata includes, but is not limited to, information such as filename, file extension, file size, and directory where the file is located.

[0169] In this method, the detection device is pre-loaded with a first knowledge base, which includes metadata of historically collected ransomware, such as keywords and file extensions in the filenames of historically collected ransomware. For example, keywords in the filenames of historically collected ransomware may be "Attention!", "Attention!", etc., and file extensions may be ".txt", ".html", ".lha", ".lzh", etc.

[0170] In this case, the detection device obtains the metadata of the file to which the file content of each IO write request belongs, and queries the first knowledge base based on the obtained metadata, thereby identifying the file content whose metadata includes knowledge from the first knowledge base as suspicious file content.

[0171] Method 2: The detection device determines suspicious file content in the file content of each IO write request based on the file content of each IO write request and a knowledge base (denoted as the second knowledge base).

[0172] In this method, the detection device has a pre-installed second knowledge base, which is built based on keywords from historically collected ransomware messages. These keywords include frequently occurring words from historically collected ransomware messages, or words characteristic of ransomware messages. Words characteristic of ransomware messages are those that generally appear only in ransomware messages and not in ordinary documents. For example, ransomware messages typically demand cryptocurrency payments, therefore, terms related to cryptocurrency payments will appear in ransomware messages.

[0173] In this scenario, the detection device performs word segmentation on the file content of each IO write request, obtaining the word segmentation result for each IO write request. The detection device then queries a second knowledge base based on the word segmentation result of each IO write request to identify suspicious file content. Here, the word segmentation result of the suspicious file content includes ransom note keywords recorded in the second knowledge base. At this point, the word segmentation result of the suspicious file content is the second word segmentation result.

[0174] Method 3: The detection device determines the initial suspicious file content in the file content of each IO write request based on the metadata of the file to which the file content belongs, and determines the suspicious file content in the initial suspicious file content based on the initial suspicious file content and the knowledge base (i.e., the second knowledge base).

[0175] In this method, the detection device is pre-configured with a first knowledge base and a second knowledge base. A detailed description of the first knowledge base is given in Method 1, and a detailed description of the second knowledge base is given in Method 2; these details will not be repeated here. Optionally, the first and second knowledge bases can be implemented as a single knowledge base. Optionally, the first and second knowledge bases can be implemented as two independent knowledge bases; this is not limited.

[0176] In this case, the detection device can first determine the initial suspicious file content in the file content of each IO write request through the process described in Method 1, and then determine the suspicious file content in the initial suspicious file content through the process described in Method 2. The detailed explanation will not be repeated here.

[0177] As can be seen, in method 3, the detection device needs to query the first knowledge base first, and then the second knowledge base. Since the first and second knowledge bases are implemented as a single knowledge base, the size of this single knowledge base is larger than both the first and second knowledge bases. Therefore, compared to implementing the first and second knowledge bases as a single knowledge base, implementing them as two independent knowledge bases improves the efficiency of the detection device in querying both knowledge bases, thereby improving the efficiency of the detection device in detecting data theft.

[0178] refer to Figure 6 , Figure 6 This illustration shows a process in which method 3 is used in an embodiment of this application to determine the content of a suspicious document and to determine semantic features that characterize the semantics of the suspicious document content. Figure 6 As shown, file content 1 to file content 4 are the file contents of the four IO write request instructions contained in the unit under inspection, indicating that they are to be written to the file system. After obtaining file content 1 to file content 4, the detection device determines the initial suspicious file content from file content 1 to file content 4 using method 1, and then determines the suspicious file content from the initial suspicious file content using method 2. Then, the detection device inputs the word segmentation results of the suspicious file content into the second network to obtain semantic features representing the semantics of the suspicious file content. Specifically, when the detection device determines the initial suspicious file content from file content 1 to file content 4 using method 1, it needs to use a first knowledge base built based on historically collected ransom notes. When the detection device determines the suspicious file content from the initial suspicious file content using method 2, it needs to use a second knowledge base built based on historically collected ransom notes.

[0179] Subsequently, the detection model inputs the behavioral features output by the first network and the semantic features output by the second network into the third network. The third network then fuses the behavioral and semantic features to obtain fused features, which are then output through the third network.

[0180] It should be noted that, since the behavioral features output by the first network are represented by multiple matrices of quantity × preset length, and the semantic features output by the second network have a preset length but a quantity that is necessarily less than the number of IO requests included in the unit under inspection (i.e., "multiple"), and one semantic feature is used to characterize the file content of one IO write request in the unit under inspection, the detection model sets the semantic features with a value of 0 for IO requests in the unit under inspection that have not had their semantic features extracted, so that the semantic features input to the third network are also represented by multiple matrices of quantity × preset length.

[0181] Optionally, the detection model uses a third network to perform weighted fusion of the behavioral features output by the first network and the semantic features output by the second network to obtain fused features, which are then output through the third network. For example, the third network may be a gating network. In this case, the detection model uses a gating network to adaptively perform weighted fusion of the behavioral features output by the first network and the semantic features output by the second network to obtain fused features, which are then output through the gating network.

[0182] Next, the detection model inputs the fused features output by the third network into the fourth network, performs inference detection on the fused features through the fourth network, and outputs the confidence level used to determine whether there is a target IO request in the unit under inspection.

[0183] Taking a third network as a gating network and a fourth network as an MLP network as an example, refer to... Figure 7 , Figure 7 This illustration shows a process for obtaining fusion features and confidence levels according to an embodiment of this application.

[0184] like Figure 7 As shown, in the feature sequence fusion layer based on the gated network in the detection model, the detection model inputs the behavioral features output from the first network and the semantic features output from the second network into the gated network. The sigmoid function (an activation function) in the gated network adaptively determines the weights of the behavioral features (denoted as weight 1) and the semantic features (denoted as weight 2). Then, the gated network performs a weighted sum of the behavioral and semantic features based on weight 1 and weight 2 to obtain the fused features.

[0185] Continue to refer to Figure 7 In the detection model, a data theft detection layer based on an MLP network is used. The detection model inputs the fused features into the MLP network, and the MLP network performs inference detection on the fused features, thereby outputting a confidence level to determine whether there is a target IO request in the unit under inspection.

[0186] Furthermore, the detection device determines whether the target I / O request exists among the multiple I / O requests contained in the unit under inspection based on the confidence level output by the detection model. A detailed explanation of this process can be found in the relevant description of step 202, and will not be repeated here.

[0187] Thus, through Figure 5 The described method uses multiple I / O requests from client accessing the file system as inspection units, and detects whether there are I / O requests for data theft in the inspection unit based on the behavioral characteristics of the I / O requests contained in the inspection unit and the semantic characteristics of the file content indicated by the I / O requests in the inspection unit to be written to the file system. Compared with the embodiments of this application... Figure 3 The method shown in the embodiments of this application Figure 5 The method shown adds reference analysis of the semantic features of file content when detecting data theft, thus making it more effective.

[0188] In some other embodiments, after the detection device detects a target I / O request for data theft in the unit under inspection, the detection device further identifies the target I / O request and locates the stolen file in the unit under inspection so that the user can respond to the data theft.

[0189] refer to Figure 8 , Figure 8 This illustration shows a process for determining a target I / O request and locating a stolen file in a unit under inspection, according to an embodiment of this application. Optionally, this method can be applied to... Figure 1a The implementation environment is shown, and it is executed by a detection device deployed in the file system layer of the file system. For example... Figure 8 As shown, after the detection device completes steps 201 to 202, or after completing steps 301 to 302, it also performs steps 401 to 404 as described below.

[0190] Step 401: The detection device determines the degree of influence of each IO request contained in the unit under test on the detection result, and determines the target IO request in the unit under test according to the degree of influence.

[0191] For example, the detection device determines the degree of influence of each IO request contained in the unit under test on the confidence level output by the detection model, and determines the target IO request in the unit under test based on the degree of influence.

[0192] Optionally, the detection device may employ gradient-based feature attribution techniques to determine the degree of influence of each IO request contained in the unit under inspection on the confidence score output by the detection model, and determine the target IO request in the unit under inspection based on the degree of influence. As an example, gradient-based feature attribution techniques include, but are not limited to, self-attention mapping, ensemble gradients, or gradient SHAP.

[0193] In one example, the detection device has a pre-installed explanatory model implemented using gradient-based feature attribution technology, which is trained alongside the detection model described above. Based on this, after the detection model detects a target IO request in the unit under inspection, the device inputs the IO data of multiple IO requests contained in the unit under inspection into the explanatory model to obtain the degree of influence (or contribution) of each IO request in the unit under inspection on the confidence score output by the detection model. Furthermore, the detection device sorts the IO requests by influence from largest to smallest, and identifies the top k IO requests as target IO requests; alternatively, the detection device identifies IO requests with influence greater than a threshold as target IO requests. Here, k is a positive integer.

[0194] It can be seen that the number of target IO requests in the unit under inspection is at least one.

[0195] Step 402: The detection device identifies the file requested by the target IO request as the stolen file.

[0196] As can be seen, the granularity of the stolen data determined in this application embodiment is the file granularity.

[0197] Step 403: The detection device collects description information of the target IO request and metadata of the stolen file.

[0198] For example, the descriptive information of the target I / O request includes, but is not limited to, the network address of the client that initiated the target I / O request, the time the target I / O request was received, and the type of I / O operation requested by the target I / O request. This information can all be extracted from the log records recorded after parsing the target I / O request.

[0199] For example, the metadata of the file (i.e. the stolen file) requested by the target IO request includes, but is not limited to, the file name, file extension, file size, number of files, etc.

[0200] Step 404: The detection device generates an attack report based on the description information of the target IO request and the metadata of the stolen file.

[0201] It should be understood that since the target I / O request is an I / O request detected by the detection device for the purpose of stealing data, the description information of the target I / O request can be regarded as a profile of the attacker's attack pattern. The stolen file is the object of the attack, so the metadata of the stolen file can be regarded as a profile of the object of the attack.

[0202] Therefore, based on the collected description information of the target IO requests and the metadata of the stolen files, the detection device can generate an attack report that includes an attack pattern profile and an attack target profile.

[0203] Optionally, the detection device outputs an attack report and sends an alert to the user. In response, the user receives the alert and takes action based on the attack report to address the detected data theft, such as blocking the outward transmission of the stolen files.

[0204] Optionally, the attack report generated by the detection device may also include alerts for high-risk files to remind users to increase security protection for these files. High-risk files are those identified by the detection device based on detected data theft activities and are highly likely to be stolen subsequently. In this case, such as... Figure 8 As shown, the detection device performs step 404a before performing step 404.

[0205] Step 404a: The detection device determines the fingerprint distance between the semantic fingerprint of the stolen file and the semantic fingerprint of other files in the file system, and identifies high-risk files based on the fingerprint distance.

[0206] Semantic fingerprints are used to identify files. In this embodiment, a semantic fingerprint is pre-calculated for each file based on its metadata in the file system.

[0207] In this way, after the detection device identifies the stolen file, it compares the semantic fingerprint of the stolen file with the semantic fingerprints of other files in the file system. Files in the file system whose semantic fingerprint distance from the stolen file is less than or equal to a threshold are identified as high-risk files. In other words, high-risk files are those whose semantic fingerprint distance from the stolen file is less than or equal to the threshold. Thus, high-risk files are those with a high degree of similarity to the stolen file. Because of the high similarity between high-risk files and the stolen file, they are highly likely to be targeted for theft by attackers.

[0208] Of course, if the stolen file is a file created by an IO request in the unit to be inspected, the detection device first calculates the semantic fingerprint of the stolen file based on the file metadata of the stolen file after determining that the stolen file has been stolen. Then, the detection device compares the fingerprint distance between the semantic fingerprint of the stolen file and the semantic fingerprint of other files in the file system, and identifies files in the file system whose fingerprint distance with the semantic fingerprint of the stolen file is less than or equal to the threshold as high-risk files.

[0209] Optionally, the attack report generated by the detection device also includes an access control policy, which is used to instruct access control for high-risk files. The detection device can formulate an access control policy for high-risk files based on the description information of the target IO request. For example, if the file system receives the target IO request during non-working hours, meaning the target IO request accesses the file system during non-working hours, then the access control policy formulated by the detection device for the high-risk file is: prohibit the client initiating the target IO request from accessing the high-risk file during non-working hours. It can be seen that, compared to related technologies that restrict access to the file system at the network address or client level, this application embodiment achieves finer-grained (i.e., file-level) access control for high-risk files in the file system.

[0210] Thus, through steps 401 to 404, after accurately detecting IO requests for data theft in the inspected unit using the detection model, the detection device can also accurately identify the IO requests for data theft from the inspected unit, identify the stolen file, and discover high-risk files based on the stolen file. Therefore, the detection device can output an attack report including an attack pattern profile, an attack target profile, high-risk file alerts, and access control policies for high-risk files. This detailed attack report helps users take timely countermeasures against data theft, thereby reducing data asset risks. Furthermore, this embodiment of the application improves the efficiency and effectiveness of overall file system security protection by automating the detection of data theft and generating detailed attack reports.

[0211] To enhance understanding of the methods provided in the embodiments of this application, the following will be explained... Figure 9 The illustrated process further describes the method described in the embodiments of this application. (Refer to...) Figure 9 , Figure 9 This illustration shows another flowchart of the data theft detection method provided in this application. Figure 9As shown, during the client's access to the file system, for each unit under inspection with multiple IO requests used to access the file system, the detection device first extracts the behavioral features and semantic features of the unit under inspection. Next, the detection device fuses the extracted behavioral and semantic features to obtain a fused feature, and then detects the fused feature to determine whether there is a target IO request for data theft in the unit under inspection. This process is described in steps 301-302 above and will not be repeated here. Subsequently, when the detection device determines that a target IO request exists in the unit under inspection, it performs attack tracing and generates an attack report (refer to steps 401-404), and outputs the attack report and data theft alarm to the user. Attack tracing refers to the process of obtaining an attack pattern profile and a profile of the attacked object. Detailed descriptions of the attack pattern profile and the profile of the attacked object can be found in step 404 and will not be repeated here.

[0212] It is understood that the method described above can also be applied to the field of communications to ensure the security of communication data. For example, in mobile communication networks or wireless fidelity (Wi-Fi) networks, the logic of the method described in this application can be used to extract transmission features (behavioral features corresponding to IO requests) from multiple communication packets (corresponding to the unit under inspection), and to identify the content features of the communication data transmitted in the communication packets of the unit under inspection (semantic features of the file content corresponding to IO requests), thereby detecting potential malicious behavior in the unit under inspection based on the transmission and content features of the unit under inspection. The mobile communication network is, for example, a 5G network. The communication packets can be communication packets between a base station and a user terminal in a mobile communication network, or communication packets between an access point device and a terminal device in a Wi-Fi network; this is not limited. Malicious behavior can be, for example, ransomware or data theft; this is not limited.

[0213] The above mainly describes the solution provided by the embodiments of this application from a methodological perspective.

[0214] To achieve the above functions, such as Figure 10 As shown, Figure 10 A schematic diagram of a data theft detection device according to an embodiment of this application is shown. The data theft detection device 1000 is used to execute the data theft detection method described above, for example, to execute... Figure 3 , Figure 5 or Figure 8 The method shown. The data theft detection device 1000 may include an acquisition unit 1001 and a detection unit 1002.

[0215] The acquisition unit 1001 is used to acquire IO operation information of multiple requests, wherein the multiple IO requests are IO requests to access the file system, and the IO operation information includes the operation information of the IO operation requested by each IO request. The detection unit 1002 is used to detect whether there is a target IO request among the multiple IO requests based on the IO operation information of the multiple IO requests, wherein the target IO request is an IO request that steals data from the file system.

[0216] As an example, combined Figure 3 The acquisition unit 1001 can be used to execute step 201, and the detection unit 1002 can be used to execute step 202.

[0217] Optionally, the detection unit 1002 is specifically used to detect whether a target IO request exists among the multiple IO requests based on the IO operation information of the multiple IO requests using a detection model. The detection model includes a first network and a fourth network. The first network is used to extract behavioral features based on the IO operation information, and the fourth network is used to infer whether a target IO request exists among the multiple IO requests based on the behavioral features.

[0218] Optionally, the IO operation information includes one or more of the following: the IO operation type, IO operation time, metadata of the file to be operated on by each IO request, or performance information of the storage node storing data in the file system.

[0219] Optionally, when at least one IO write request exists among multiple IO requests, the acquisition unit 1001 is further configured to acquire the file content requested to be written to the file system by each IO write request among the at least one IO write request. The detection unit 1002 is further configured to detect whether a target IO request exists among the multiple IO requests based on the IO operation information and file content of the multiple IO requests.

[0220] As an example, combined Figure 5 The acquisition unit 1001 can be used to execute step 301, and the detection unit 1002 can be used to execute step 302.

[0221] Optionally, the data theft detection device 1000 further includes a determining unit 1003. The determining unit 1003 is configured to: determine behavioral characteristics of multiple IO requests based on IO operation information, the behavioral characteristics being used to characterize the features of the IO operations indicated by the multiple IO requests; determine semantic features based on file content, the semantic features being used to characterize the semantics of the file content; and fuse the behavioral characteristics and semantic features to obtain a fused feature. The detection unit 1002 is specifically configured to detect whether a target IO request exists among the multiple IO requests based on the fused feature.

[0222] Optionally, the detection unit 1002 is specifically used to detect whether a target IO request exists among the multiple IO requests based on the IO operation information and file content of the multiple IO requests using a detection model. In this implementation, the detection model includes a first network, a second network, a third network, and a fourth network. The first network is used to extract behavioral features based on the IO operation information, the second network is used to extract semantic features based on the file content, the third network is used to fuse the behavioral features and semantic features, and the fourth network is used to infer whether a target IO request exists among the multiple IO requests based on the fused features.

[0223] Optionally, the first network is the encoder network in the transformer model.

[0224] Optionally, the second network is a language model.

[0225] Optionally, the third network is a gated network.

[0226] Optionally, the fourth network is an MLP network.

[0227] Optionally, the determining unit 1003 is specifically used to: determine suspicious file content in the file content, the suspicious file content having the characteristics of a ransom note; perform word segmentation on the suspicious file content to obtain the word segmentation result of the suspicious file content; and learn the word segmentation result through a second network to obtain semantic features.

[0228] Optionally, the determining unit 1003 is specifically used to: determine suspicious file content in the file content based on the metadata of the file to which the file content belongs; or, determine suspicious file content in the file content based on the file content and a knowledge base, wherein the knowledge base is a knowledge base constructed based on keywords of ransom letters collected in history; or, determine initial suspicious file content in the file content based on the metadata of the file to which the file content belongs; or determine suspicious file content in the initial suspicious file content based on the initial suspicious file content and the knowledge base.

[0229] Optionally, when the detection model detects whether a target IO request exists among multiple IO requests, the determining unit 1003 is also used to compare the confidence threshold and the confidence level output by the detection model to obtain a comparison result, which indicates whether a target IO request exists among multiple IO requests.

[0230] Optionally, when the detection result indicates that a target IO request exists among multiple IO requests, the determining unit 1003 is further configured to: determine the degree of influence of the multiple IO requests on the detection result, identify the target IO request among the multiple IO requests, and determine the file requested by the target IO request as the stolen file.

[0231] As an example, combined Figure 8The determination unit 1003 can be used to perform steps 401 and 402.

[0232] Optionally, the determining unit 1003 is specifically used to determine the degree of influence of each IO request on the detection result using a gradient-based feature attribution method.

[0233] Optionally, the determining unit 1003 is also used to generate an attack report, which includes a description of the target IO request and metadata of the stolen file.

[0234] As an example, combined Figure 8 Unit 1003 can be used to execute step 404.

[0235] Optionally, the attack report may also include alerts for high-risk files. High-risk files are those in the file system whose semantic fingerprints are less than or equal to a threshold distance from the semantic fingerprints of the stolen files. Semantic fingerprints are used to identify files.

[0236] Optionally, the attack report may also include access control policies, which are used to instruct access control for high-risk files.

[0237] Optionally, the aforementioned multiple IO requests can access the file system based on the NAS protocol.

[0238] For a detailed description of the above-mentioned optional methods, please refer to the foregoing method embodiments, which will not be repeated here. Furthermore, the explanation of any of the data theft detection devices 1000 provided above, as well as the description of their beneficial effects, can be found in the corresponding method embodiments described above, and will not be repeated here.

[0239] As an example, in conjunction with the following description Figure 11 The function implemented by the acquisition unit 1001 in the data theft detection device 1000 can be achieved through... Figure 11 The communication interface 1103 shown is implemented. The functions implemented by the detection unit 1002 and the determination unit 1003 in the data theft detection device 1000 can be achieved through... Figure 11 Processor 1101 in the middle executes Figure 11 The program code is implemented in memory 1102.

[0240] Those skilled in the art will readily recognize that, based on the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein, the functions implemented in the embodiments of this application can be implemented in hardware or a combination of hardware and computer software. Whether a function is implemented in hardware or by computer software driving hardware depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0241] It should be noted that, Figure 10 The module / unit division shown is illustrative and represents only one logical functional division; in actual implementation, other division methods are possible. For example, two or more functions can be integrated into a single processing module. These integrated modules can be implemented either in hardware or as software functional modules.

[0242] This application provides a computing device or a functional module therein for implementing some or all of the functions of the data theft detection method provided in this application.

[0243] Figure 11 This is a schematic diagram of the structure of a computing device provided in an embodiment of this application. Figure 11 As shown, the computing device 1100 includes a processor 1101, a memory 1102, a communication interface 1103, and a bus 1104. The processor 1101, memory 1102, and communication interface 1103 are interconnected via the bus 1104.

[0244] Processor 1101 may include a general-purpose processor and / or a dedicated hardware chip. The general-purpose processor may include a CPU, a microprocessor, or a graphics processing unit (GPU). The CPU may be a single-core processor or a multi-core processor. The dedicated hardware chip is a high-performance processing hardware module. The dedicated hardware chip includes at least one of the following: digital signal processing (DSP), data processing unit (DPU), application-specific integrated circuit (ASIC), field-programmable gate array (FPGA), other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, neural processing unit (NPU), tensor processing unit (TPU), artificial intelligence chip, or network processor (NP). Processor 1101 may also be an integrated circuit chip with signal processing capabilities. In implementation, some or all of the functions of the methods provided in this application embodiment may be implemented through integrated logic circuits in the hardware of processor 1101 or through software instructions.

[0245] Memory 1102 is used to store computer programs, including an operating system 1102a and executable code (i.e., program instructions) 1102b. Memory 1102 may be, for example, read-only memory (ROM), programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), flash memory, or other types of static storage devices capable of storing static information and instructions; or, for example, static RAM (SRAM), dynamic random access memory (DRAM), synchronous dynamic random access memory (SDRAM), double data rate synchronous dynamic random access memory (DDRSDRAM), enhanced synchronous dynamic random access memory (ESDRAM), or synchronous linked dynamic random access memory (SDRAM). DRAM (SLDRAM) or other types of dynamic storage devices capable of storing information and instructions, such as read-only optical discs or other optical disc storage, optical disc storage (including compressed optical discs, laser discs, optical discs, digital universal optical discs, Blu-ray discs, etc.), magnetic disk storage media or other magnetic storage devices, or any other medium capable of carrying or storing desired executable code in the form of instructions or data structures and accessible by a computer, but not limited thereto. For example, memory 1102 is used to store IO logs, etc. Memory 1102 may exist independently and be connected to processor 1101 via bus 1104. Alternatively, memory 1102 and processor 1101 may be integrated together. Memory 1102 can store executable code. When the executable code stored in memory 1102 is executed by processor 1101, processor 1101 performs some or all of the functions of the data theft detection method provided in the embodiments of this application. Please refer to the relevant descriptions in the foregoing embodiments for the implementation of the process by processor 1101. Memory 1102 may also include software modules and data required by other running processes, such as operating systems.

[0246] Communication interface 1103 uses a transceiver module, such as, but not limited to, a transceiver, to enable communication with other devices or communication networks. For example, communication interface 1103 can be any one or any combination of the following devices: communication interfaces (such as Ethernet interfaces), wireless network cards, and other devices with network access capabilities. Communication interface 1103 includes a receiving unit for receiving data / messages and a sending unit for sending data / messages.

[0247] Bus 1104 is any type of communication bus used to interconnect internal devices (e.g., memory 1102, processor 1101, communication interface 1103) of computing device 1100. For example, a system bus. This embodiment illustrates the interconnection of the aforementioned devices within computing device 1100 via bus 1104. Optionally, the aforementioned devices within computing device 1100 can also communicate with each other using other connection methods besides bus 1104; for example, the aforementioned devices within computing device 1100 can be interconnected via internal logic interfaces.

[0248] It should be noted that the aforementioned devices can be disposed on separate chips, or at least partially or entirely on the same chip. Whether to dispose of the devices independently on different chips or integrate them on one or more chips often depends on the needs of the product design. This application does not limit the specific implementation of the aforementioned devices. Furthermore, the descriptions of the processes corresponding to the various figures above each have their own emphasis; for parts of a process not described in detail in one figure, please refer to the relevant descriptions of other processes.

[0249] In the above embodiments, the implementation can be achieved, in whole or in part, through software, hardware, firmware, or any combination thereof. When implemented in software, it can be implemented, in whole or in part, in the form of a computer program product. The computer program product providing the program development platform includes one or more computer instructions. When these computer program instructions are loaded and executed on the computing device 1100, they implement, in whole or in part, some or all of the functions of the data theft detection method provided in the embodiments of this application.

[0250] Furthermore, computer instructions can be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another. For example, computer instructions can be transmitted from one website, computer, server, or data center to another via wired (e.g., coaxial cable, fiber optic, digital subscriber line) or wireless (e.g., infrared, wireless, microwave, etc.) means. The computer-readable storage medium stores computer program instructions that provide a program development platform.

[0251] This application also provides a computer-readable storage medium, which is a non-volatile computer-readable storage medium. The computer-readable storage medium includes computer program instructions. When the computer program instructions are executed by a processor or a computing device or computer system including a processor, the computing device, computer system, or processor executes the data theft detection method provided in this application.

[0252] This application also provides a computer program product containing instructions that, when executed by a processor or a computing device or computer system including a processor, cause the computing device, computer system, or processor to implement the data theft detection method provided in this application.

[0253] A computer system is a system with computational processing capabilities. A computer system generally includes a processor and memory. The processor retrieves and executes instructions stored in memory to enable the computer system to implement the data theft detection method described above. Optionally, a computer system may also include at least one of an input interface or an output interface. The processor, memory, input interface, and output interface of the computer system are interconnected via internal connection paths.

[0254] Those skilled in the art will understand that all or part of the steps of the above embodiments can be implemented by hardware, or by a program instructing the relevant hardware to implement them. The program can be stored in a computer-readable storage medium, such as a read-only memory, a disk, or an optical disk.

[0255] It should be noted that the information (including but not limited to user device information, user personal information, etc.), data (including but not limited to data used for analysis, data stored, data displayed, etc.) and signals involved in this application are all authorized by the user or fully authorized by all parties, and the collection, use and processing of related data must comply with the relevant laws, regulations and standards of the relevant countries and regions.

[0256] This application also provides a chip that includes a processor for running program instructions or code. The chip or a device containing the chip can be used to execute the data theft detection method provided in this application. Exemplarily, the chip further includes an input interface, an output interface, and a memory. The chip's input interface, output interface, processor, and memory are connected via internal interconnection paths. The memory in the chip stores program instructions or code executed by the processor, and the input and output interfaces are used for communication between the chip and other chips or devices.

[0257] In the embodiments of this application, the terms "first," "second," and "third" are used for descriptive purposes only and should not be construed as indicating or implying relative importance. The term "at least one" refers to one or more, and the term "multiple" refers to at least two, unless otherwise expressly defined.

[0258] In this application, the term "and / or" is merely a description of the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent: A existing alone, A and B existing simultaneously, or B existing alone. Additionally, the character " / " in this document generally indicates that the preceding and following related objects have an "or" relationship.

[0259] It should be understood that the terminology used in the description of the various examples herein is for the purpose of describing particular examples only and is not intended to be limiting. As used in the description of the various examples and the appended claims, the singular forms “a” and “the” are intended to include the plural forms as well, unless the context clearly indicates otherwise.

[0260] It should be understood that determining B based on A does not mean determining B solely based on A; B can also be determined based on A and / or other information.

[0261] It should be understood that the term "comprising" (also referred to as "includes", "including", "comprises" and / or "comprising") as used in this specification specifies the presence of the stated features, integers, steps, operations, elements, and / or components, but does not exclude the presence or addition of one or more other features, integers, steps, operations, elements, components, and / or groups thereof.

[0262] It should also be understood that, in the various embodiments of this application, the sequence number of each process does not imply the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of this application.

[0263] The above description is merely an optional embodiment of this application and is not intended to limit this application. Any modifications, equivalent substitutions, improvements, etc., made within the concept and principles of this application should be included within the protection scope of this application.

[0264] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the protection scope of the technical solutions of the embodiments of the present invention.

Claims

1. A method for detecting data theft, characterized in that, The method includes: Obtain IO operation information for multiple input / output IO requests, wherein the multiple IO requests are IO requests to access the file system, and the IO operation information includes the operation information of the IO operation requested to be performed by each of the multiple IO requests; Based on the IO operation information of the multiple IO requests, detect whether there is a target IO request among the multiple IO requests, the target IO request being an IO request that steals data from the file system.

2. The method as described in claim 1, characterized in that, When at least one IO write request exists among the plurality of IO requests, the method further includes: Obtain the file content requested to be written to the file system by each of the at least one IO write requests; The step of detecting whether a target IO request exists among the multiple IO requests based on the IO operation information of the multiple IO requests includes: Based on the IO operation information of the multiple IO requests and the file content, detect whether the target IO request exists among the multiple IO requests.

3. The method as described in claim 2, characterized in that, The step of detecting whether the target IO request exists among the multiple IO requests based on the IO operation information of the multiple IO requests and the file content includes: The behavioral characteristics of the plurality of I / O requests are determined based on the I / O operation information, and the behavioral characteristics are used to characterize the features of the I / O operations indicated by the plurality of I / O requests. Semantic features are determined based on the file content, and the semantic features are used to characterize the semantics of the file content; The behavioral features and semantic features are fused to obtain the fused features; The target IO request is detected among the multiple IO requests based on the fusion features.

4. The method as described in claim 3, characterized in that, The step of detecting whether the target IO request exists among the multiple IO requests based on the IO operation information of the multiple IO requests and the file content includes: Based on the IO operation information of the multiple IO requests and the file content, a detection model is used to detect whether the target IO request exists among the multiple IO requests. The detection model includes a first network, a second network, a third network, and a fourth network. The first network is used to extract the behavioral features based on the IO operation information, the second network is used to extract the semantic features based on the file content, the third network is used to fuse the behavioral features and the semantic features, and the fourth network is used to infer whether the target IO request exists among the multiple IO requests based on the fused features.

5. The method as described in claim 3 or 4, characterized in that, The step of determining semantic features based on the file content includes: Suspicious file content was identified within the file content, and the suspicious file content exhibited characteristics of a ransom note. The content of the suspicious file is segmented into words to obtain the segmentation results of the suspicious file content; The semantic features are obtained by learning the word segmentation results through a second network.

6. The method as described in claim 5, characterized in that, The step of identifying suspicious file content in the file content includes: Based on the metadata of the file to which the file content belongs, determine the suspicious file content within the file content; or... Based on the document content and the knowledge base, the suspicious document content is determined from the document content, where the knowledge base is constructed based on keywords from historically collected ransom notes; or, Based on the metadata of the file to which the file content belongs, initial suspicious file content is determined in the file content; based on the initial suspicious file content and the knowledge base, the suspicious file content is determined in the initial suspicious file content.

7. The method according to any one of claims 1 to 6, characterized in that, When the detection result indicates that the target IO request exists among the plurality of IO requests, the method further includes: Based on the degree of influence of the multiple IO requests on the detection results, the target IO request is determined from the multiple IO requests; The file requested by the target I / O request is identified as the stolen file.

8. The method according to any one of claims 1 to 7, characterized in that, The IO operation information includes one or more of the following: the IO operation type, IO operation time, metadata of the file to be operated on by each IO request, or performance information of the storage node storing data in the file system.

9. The method according to any one of claims 1 to 8, characterized in that, The multiple IO requests access the file system based on the Network Attached Storage (NAS) protocol.

10. A data theft detection device, characterized in that, The device includes: The acquisition unit is used to acquire I / O operation information of multiple input / output I / O requests, wherein the multiple I / O requests are I / O requests to access the file system, and the I / O operation information includes operation information of the I / O operation requested to be performed by each of the multiple I / O requests; The detection unit is used to detect whether there is a target IO request among the multiple IO requests based on the IO operation information of the multiple IO requests. The target IO request is an IO request that steals data in the file system.

11. The apparatus as claimed in claim 10, characterized in that, When at least one IO write request exists among the multiple IO requests. The acquisition unit is further configured to acquire the file content requested to be written to the file system by each of the at least one IO write requests; The detection unit is specifically used to detect whether the target IO request exists among the multiple IO requests based on the IO operation information of the multiple IO requests and the file content.

12. The apparatus as claimed in claim 11, characterized in that, The device includes: A determining unit is configured to: determine behavioral characteristics of the plurality of I / O requests based on the I / O operation information, wherein the behavioral characteristics characterize the features of the I / O operations indicated by the plurality of I / O requests; determine semantic features based on the file content, wherein the semantic features characterize the semantics of the file content; and fuse the behavioral characteristics and the semantic features to obtain a fused feature. The detection unit is specifically used to detect whether the target IO request exists among the multiple IO requests based on the fusion features.

13. The apparatus as claimed in claim 12, characterized in that, The detection unit is specifically used to detect whether the target IO request exists among the multiple IO requests based on the IO operation information of the multiple IO requests and the file content, using a detection model. The detection model includes a first network, a second network, a third network, and a fourth network. The first network is used to extract the behavioral features based on the IO operation information. The second network is used to extract the semantic features based on the file content. The third network is used to fuse the behavioral features and the semantic features. The fourth network is used to infer whether the target IO request exists among the multiple IO requests based on the fused features.

14. The apparatus as claimed in claim 12 or 13, characterized in that, The determining unit is specifically used for: Suspicious file content was identified within the file content, and the suspicious file content exhibited characteristics of a ransom note. The content of the suspicious file is segmented into words to obtain the segmentation results of the suspicious file content; The semantic features are obtained by learning the word segmentation results through a second network.

15. The apparatus as claimed in claim 14, characterized in that, The determining unit is specifically used for: Based on the metadata of the file to which the file content belongs, determine the suspicious file content within the file content; or... Based on the file content and the knowledge base, the suspicious file content is determined in the file content, and the knowledge base is a knowledge base built based on keywords of historically collected ransom letters; or, Based on the metadata of the file to which the file content belongs, initial suspicious file content is determined in the file content; based on the initial suspicious file content and the knowledge base, the suspicious file content is determined in the initial suspicious file content.

16. The apparatus as claimed in any one of claims 10 to 15, characterized in that, The device also includes a determining unit. The determining unit is used to determine the target IO request among the plurality of IO requests based on the degree of influence of the plurality of IO requests on the detection result when the detection result indicates that the target IO request exists among the plurality of IO requests. In addition, the file requested by the target IO request is identified as the stolen file.

17. The apparatus as claimed in any one of claims 10 to 16, characterized in that, The IO operation information includes one or more of the following: the IO operation type, IO operation time, metadata of the file to be operated on by each IO request, or performance information of the storage node storing data in the file system.

18. The apparatus as claimed in any one of claims 10 to 17, characterized in that, The multiple IO requests access the file system based on the Network Attached Storage (NAS) protocol.

19. A data theft detection device, characterized in that, The apparatus includes: a memory, a communication interface, and one or more processors, the one or more processors receiving or transmitting data through the communication interface, the one or more processors being configured to read program instructions stored in the memory to perform the method as described in any one of claims 1 to 9.

20. A computer program product containing instructions, characterized in that, When the instructions are executed by the processor, the processor or a device including the processor performs the method as described in any one of claims 1 to 9.

21. A computer-readable storage medium, characterized in that, It includes computer program instructions, which, when executed by a processor, cause the processor or a device including the processor to perform the method as described in any one of claims 1 to 9.

Images