HTTP message sensitive data identification method and system

Abstract

The invention relates to an HTTP message sensitive data identification method and system, and the method comprises the steps: carrying out the structured analysis of a non-standard field in a captured HTTP message, and generating structured data comprising a field path, a field value and a sensitive type; the non-standard field comprises at least one of a JSON (JavaScript Object Notation) nested field, an HTML (Hypertext Markup Language) non-form field and an XML custom tag; performing sensitive data identification on the structured data by adopting a multi-dimensional collaborative identification model to obtain an identification result; the multi-dimensional collaborative recognition model comprises at least two recognition dimensions of path matching, semantic matching and pattern matching. According to the method and the device, structured analysis can be performed on the non-standard field of the HTTP message, and sensitive data identification is performed on the analyzed structured data by fusing multiple identification dimensions, so that the problem that the sensitive data of the HTTP non-standard field cannot be accurately identified is solved.

Description

Technical Field

[0001] This application relates to the field of Internet technology, and in particular to a method and system for identifying sensitive data in HTTP messages. Background Technology

[0002] With the widespread adoption of Web and mobile applications, the HTTP (Hypertext Transfer Protocol) protocol has become the core carrier for data interaction, and the transmitted data contains a large amount of sensitive information (such as user ID numbers, corporate financial account information, etc.).

[0003] Existing dynamic data masking technologies are mostly based on preset lists of sensitive fields or regular expression pattern matching. Data is considered sensitive and masked or blocked only when a field name in the HTTP message exactly matches a name in the list and the field value conforms to a preset pattern. However, modern applications widely use flexible data structures such as JSON and XML. Traditional methods, when dealing with these non-standard HTTP fields, fail to accurately identify sensitive data due to their variable locations and lack of standardized field names, easily leading to sensitive data leaks.

[0004] There is currently no effective solution to the problem that related technologies cannot accurately identify sensitive data in non-standard HTTP fields. Summary of the Invention

[0005] Therefore, it is necessary to provide a method and system for identifying sensitive data in HTTP messages that can accurately identify sensitive data in non-standard HTTP fields, in response to the above-mentioned technical problems.

[0006] Firstly, this embodiment provides a method for identifying sensitive data in HTTP messages, including:

[0007] The non-standard fields in the captured HTTP messages are parsed in a structured manner to generate structured data including field paths, field values, and sensitive types; the non-standard fields include at least one of JSON nested fields, HTML non-form fields, and XML custom tags;

[0008] A multidimensional collaborative recognition model is used to identify sensitive data in the structured data to obtain recognition results; the multidimensional collaborative recognition model includes at least two recognition dimensions among path matching, semantic matching and pattern matching.

[0009] In some embodiments, the step of performing structured parsing on non-standard fields in the captured HTTP message to generate structured data including field paths, field values, and sensitive types includes:

[0010] For the nested JSON fields, a tree structure model is constructed and traversed to extract the field paths and values, and sensitive types are determined based on the field name mapping mechanism;

[0011] For the HTML non-form fields, by performing word segmentation and keyword weight analysis on the text node content, the path of the node where the identified sensitive information is located is used as the field path, the node text content is used as the field value, and the sensitivity type is determined based on the keywords.

[0012] For the aforementioned XML custom tags, by parsing the tag structure, the path and content of the XML element are respectively used as field path and field value, and the sensitive type is determined based on the tag semantic mapping mechanism.

[0013] In some embodiments, the use of a multi-dimensional collaborative recognition model to identify sensitive data in the structured data and obtain recognition results includes:

[0014] Based on the structured data, a multi-dimensional collaborative recognition model is used to calculate the confidence level of each recognition dimension.

[0015] Based on the preset weights corresponding to the identification dimensions, the confidence scores are weighted and calculated to obtain a comprehensive confidence score.

[0016] The identification result of sensitive data in the structured data is determined by comparing the comprehensive confidence score with the preset threshold.

[0017] In some embodiments, the step of calculating the confidence level of each recognition dimension based on the structured data using a multi-dimensional collaborative recognition model includes:

[0018] Based on the query matching results of the field path in the prefix tree, and combined with the incrementally learned path similarity information, the confidence level of the path matching is obtained.

[0019] In some embodiments, the step of calculating the confidence level of each recognition dimension based on the structured data using a multi-dimensional collaborative recognition model includes:

[0020] Based on a well-trained natural language processing model, the confidence level of the semantic matching is obtained by inputting the field values ​​and scene information.

[0021] In some embodiments, the step of calculating the confidence level of each recognition dimension based on the structured data using a multi-dimensional collaborative recognition model includes:

[0022] The field values ​​are matched with the dynamic pattern library learned by incremental pattern learning to obtain the matching pattern;

[0023] The confidence level of the pattern matching is obtained based on the priority of the matching pattern.

[0024] In some embodiments, the method further includes:

[0025] Based on the identification results, the sensitive data is processed for format adaptation and desensitization.

[0026] The desensitization process includes:

[0027] For the nested JSON fields, based on the tree structure model, the field values ​​of the sensitive data are replaced with nodes;

[0028] For the HTML non-form fields, perform partial text replacement on the field paths of the sensitive data;

[0029] For the XML custom tags, sensitive values ​​are replaced in the tag attribute mapping table of the sensitive data.

[0030] In some embodiments, the method further includes:

[0031] Capture bidirectional HTTP traffic using port mirroring;

[0032] By establishing a TLS session, the HTTP traffic is decrypted to obtain plaintext HTTP messages.

[0033] Secondly, this embodiment provides an HTTP message sensitive data identification system, including:

[0034] A data security gateway is used to execute the HTTP message sensitive data identification method described in the first aspect;

[0035] The target HTTP server communicates with the data security gateway to respond to access requests and return corresponding HTTP messages.

[0036] In some of these embodiments, it also includes:

[0037] The client is communicatively connected to the data security gateway and is used to initiate the access request to the target HTTP server and receive the identification result obtained by the HTTP message sensitive data identification method.

[0038] Network devices are used to enable network connections and data transmission between the client, data security gateway, and target HTTP server.

[0039] Compared with related technologies, the HTTP message sensitive data identification method and system provided in this embodiment generates structured data including field paths, field values, and sensitive types by performing structured parsing on non-standard fields in captured HTTP messages. The non-standard fields include at least one of JSON nested fields, HTML non-form fields, and XML custom tags. A multi-dimensional collaborative identification model is used to identify sensitive data in the structured data, obtaining the identification result. The multi-dimensional collaborative identification model includes at least two identification dimensions: path matching, semantic matching, and pattern matching. Through this embodiment, structured parsing of non-standard fields in HTTP messages can be performed, and the parsed structured data can be integrated with multiple identification dimensions for sensitive data identification, solving the problem of inaccurate identification of sensitive data in non-standard HTTP fields.

[0040] Details of one or more embodiments of this application are set forth in the following drawings and description to make other features, objects and advantages of this application more readily apparent. Attached Figure Description

[0041] The accompanying drawings, which are included to provide a further understanding of this application and form part of this application, illustrate exemplary embodiments and are used to explain this application, but do not constitute an undue limitation of this application. In the drawings:

[0042] Figure 1 This is a hardware structure block diagram of the terminal for an HTTP message sensitive data identification method in one embodiment;

[0043] Figure 2 This is a flowchart of a method for identifying sensitive data in HTTP messages in one embodiment;

[0044] Figure 3 This is a flowchart illustrating the structured parsing of non-standard fields in one embodiment;

[0045] Figure 4 This is a flowchart illustrating the multi-dimensional identification process in one embodiment;

[0046] Figure 5 This is a schematic diagram of the real-time desensitization process in one embodiment;

[0047] Figure 6 This is a flowchart illustrating a method for identifying sensitive data in HTTP messages in one embodiment;

[0048] Figure 7 This is a schematic diagram of the structure of an HTTP message sensitive data identification system in one embodiment;

[0049] Figure 8 This is a schematic diagram of multi-terminal interaction of an HTTP message sensitive data identification system in one embodiment.

[0050] In the diagram: 102, processor; 104, memory; 106, transmission device; 108, input / output device; 10, data security gateway; 20, target HTTP server; 30, client; 40, network device. Detailed Implementation

[0051] To better understand the purpose, technical solution, and advantages of this application, the application is described and explained below in conjunction with the accompanying drawings and embodiments.

[0052] Unless otherwise defined, the technical or scientific terms used in this application shall have the general meaning understood by one of ordinary skill in the art to which this application pertains. Words such as “a,” “an,” “an,” “the,” “the,” and “these” used in this application do not indicate quantitative limitation and may be singular or plural. The terms “comprising,” “including,” “having,” and any variations thereof used in this application are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or device that comprises a series of steps or modules (units) is not limited to the listed steps or modules (units) but may include steps or modules (units) not listed, or may include other steps or modules (units) inherent to these processes, methods, products, or devices. Words such as “connected,” “linked,” and “coupled” used in this application are not limited to physical or mechanical connections but may include electrical connections, whether direct or indirect. “Multiple” used in this application refers to two or more. “And / or” describes the relationship between related objects, indicating that three relationships may exist; for example, “A and / or B” can represent: A alone, A and B simultaneously, and B alone. Normally, the character " / " indicates that the objects before and after it are in an "or" relationship. The terms "first," "second," "third," etc., used in this application are merely to distinguish similar objects and do not represent a specific order of objects.

[0053] The method embodiments provided in this example can be executed on a terminal, computer, or similar computing device. For example, it can run on a terminal. Figure 1 This is a hardware structure block diagram of the terminal for the HTTP message sensitive data identification method in this embodiment. For example... Figure 1 As shown, a terminal may include one or more ( Figure 1 Only one is shown in the diagram. A processor 102 and a memory 104 for storing data are also included. The processor 102 may be, but is not limited to, a microprocessor (MCU) or a programmable logic device (FPGA). The terminal may also include a transmission device 106 for communication functions and an input / output device 108. Those skilled in the art will understand that… Figure 1 The structure shown is for illustrative purposes only and does not limit the structure of the terminal described above. For example, the terminal may also include components that are larger than... Figure 1 The more or fewer components shown, or having the same Figure 1 The different configurations shown are illustrated.

[0054] The memory 104 can be used to store computer programs, such as application software programs and modules, like the computer program corresponding to the HTTP message sensitive data identification method in this embodiment. The processor 102 executes various functional applications and data processing by running the computer program stored in the memory 104, thereby implementing the above-described method. The memory 104 may include high-speed random access memory, and may also include non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory 104 may further include memory remotely located relative to the processor 102, and these remote memories can be connected to the terminal via a network. Examples of such networks include, but are not limited to, the Internet, corporate intranets, local area networks, mobile communication networks, and combinations thereof.

[0055] The transmission device 106 is used to receive or send data via a network. This network includes a wireless network provided by the terminal's communication provider. In one example, the transmission device 106 includes a Network Interface Controller (NIC), which can connect to other network devices via a base station to communicate with the Internet. In another example, the transmission device 106 can be a Radio Frequency (RF) module used for wireless communication with the Internet.

[0056] This embodiment provides a method for identifying sensitive data in HTTP messages. Figure 2 This is a flowchart of the HTTP message sensitive data identification method in this embodiment, as follows: Figure 2 As shown, the method includes the following steps:

[0057] Step S201: Perform structured parsing on the non-standard fields in the captured HTTP message to generate structured data including field paths, field values, and sensitive types; non-standard fields include at least one of JSON nested fields, HTML non-form fields, and XML custom tags.

[0058] Specifically, a data security gateway deployed between the client device and the target HTTP server serves as the core control node for data traffic, capturing HTTP messages between the client device and the target HTTP server it intends to access. Since the captured HTTP messages contain not only standard fields with fixed data structure locations and uniform field names, but also flexible data structures widely using JSON and XML, these non-standard fields in HTTP messages have variable locations and no uniform field names. For these non-standard fields, a core approach of syntax tree construction and semantic association mapping is used to adaptively perform structured parsing based on the type of the non-standard fields. This overcomes the limitations of existing fixed-format parsing, generating structured data including field paths, field values, and sensitive types. For example, {Path: "user.info.id_no", Value: "1101XXXXX011234", Suspected Type: "ID Number"}). The sensitive type is the inferred suspected type, which can be used as a reference in subsequent sensitive data identification, assisting the multi-dimensional collaborative identification model in its identification process.

[0059] This embodiment analyzes three common non-standard fields in HTTP messages, including at least one of the following: JSON nested fields, HTML non-form fields, and XML custom tags. JSON nested fields refer to data fields in JSON data format that are multi-layered and organized using objects or arrays; their key characteristic is a hierarchical structure, such as the nested path `user.info.id_no`. HTML non-form fields refer to fields in HTML documents that are not explicitly defined by a JSON object or array. <input> , <textarea> Instead of using standard form tags, it uses ordinary text nodes (such as...)< / textarea> , , User data dynamically displayed or embedded within tags (such as text within tags), its key characteristic is unstructured natural language text, for example, "Customer ID: XX"; XML custom tags refer to non-generic tags defined by the business system or developers in the XML data format, unlike HTML predefined tags (such as...). Unlike other tags, the semantics and structure of custom tags are entirely determined by a specific schema or convention. Their key characteristic is extensible, business-specific tag semantics. For example, <cust-id>.

[0060] Step S202: A multi-dimensional collaborative recognition model is used to identify sensitive data in structured data to obtain recognition results; the multi-dimensional collaborative recognition model includes at least two recognition dimensions among path matching, semantic matching and pattern matching.

[0061] Specifically, a multi-dimensional collaborative recognition model is designed with multi-feature fusion decision-making as the core. The structured data obtained in the above steps is input into the multi-dimensional collaborative recognition model, and the structured data is sensitively recognized from each recognition dimension built into the model. The final recognition results of each recognition dimension are output collaboratively through a weighted voting mechanism to solve the problem of high misjudgment rate of single-dimensional recognition.

[0062] The multidimensional collaborative recognition model includes at least two recognition dimensions: path matching, semantic matching, and pattern matching. Preferably, all three recognition dimensions can be built into the model to form a three-dimensional collaborative recognition model, further improving recognition accuracy. Path matching associates a dynamic path tree with a sensitive path database, inferring the frequently occurring sensitive types based on the database. Semantic matching (lightweight BERT) utilizes an HTTP contextualized semantic vector model to determine sensitive types with highly similar semantic values. Pattern matching uses a dynamic pattern database and incremental learning algorithms to infer sensitive types by verifying formats that conform to the sensitive types.

[0063] Existing sensitive data identification technologies are mostly based on preset fixed fields (such as "idCard" and "bankCard") or simple regular expression matching, which cannot handle non-standard HTTP fields. These non-standard fields, due to their variable locations and lack of standardized field names, are often overlooked by existing technologies, leading to sensitive data leakage. Through the steps described in this embodiment, the non-standard field types are first adaptively parsed in a structured manner, overcoming the limitations of existing fixed-format parsing to generate structured data including field paths, field values, and sensitive types. Then, through a multi-dimensional collaborative identification model, sensitive data identification is performed on the structured data. This can accurately identify sensitive data within non-standard fields such as JSON nested fields, HTML non-form fields, and XML custom tags in HTTP transmissions. This expands the sensitive data identification scenario to more than three times that of existing technologies, significantly improving the identification accuracy and resolving the risk of sensitive data leakage from non-standard fields.

[0064] In some embodiments, the method further includes the following steps:

[0065] By using port mirroring, bidirectional HTTP traffic is captured; by establishing a TLS session, the HTTP traffic is decrypted to obtain plaintext HTTP messages.

[0066] Specifically, the gateway's gigabit / 10-gigabit Ethernet ports enable bidirectional capture of HTTP traffic, both "inbound (client) → server" and "outbound (server → client)". Simultaneously, non-HTTP traffic is filtered based on TCP port and HTTP protocol signatures (such as GET / POST headers), reducing the overhead of processing invalid data. The captured raw packets are temporarily stored in the gateway's high-speed memory using a unique identifier of "flow ID + timestamp," avoiding disk I / O latency and laying the foundation for subsequent real-time processing.

[0067] The gateway acts as a "TLS man-in-the-middle," importing a trusted CA certificate (issued by an enterprise or third-party CA) in advance. When a client initiates an HTTPS connection, the gateway establishes a TLS session with the client (the client trusts the gateway certificate), and simultaneously establishes a TLS session with the target HTTPS server. After receiving encrypted traffic from the client / server, the gateway decrypts the TLS data packets using the locally stored certificate private key and extracts the plaintext HTTP messages (request headers, request bodies, response headers, and response bodies).

[0068] This embodiment ensures data integrity through bidirectional traffic capture, overcomes the challenge of HTTPS encrypted traffic analysis by SSL offloading, provides the necessary data foundation for all subsequent analysis functions, and offers a lossless and reliable plaintext data acquisition solution.

[0069] In some embodiments, step S201 above involves performing structured parsing on non-standard fields in the captured HTTP message to generate structured data including field paths, field values, and sensitive types, including the following steps:

[0070] For JSON nested fields, a tree structure model is constructed and traversed to extract field paths and values, and sensitive types are determined based on a field name mapping mechanism. For HTML non-form fields, the text node content is segmented and keyword weighted to determine the path of the node containing the identified sensitive information as the field path and the node text content as the field value, and sensitive types are determined based on keywords. For XML custom tags, the tag structure is parsed to determine the path and content of the XML element as the field path and field value, respectively, and sensitive types are determined based on a tag semantic mapping mechanism.

[0071] Specifically, Figure 3 This is a flowchart illustrating the structured parsing of non-standard fields in this embodiment, as shown below. Figure 3 As shown, the configuration parameter module provides alias libraries, pattern libraries, and desensitization strategies for the format adaptive parsing of non-standard field parsing modules.

[0072] For nested JSON fields, a depth-first search (DFS) approach is first used to parse the JSON message, generating a tree structure model containing the hierarchical relationships between fields. This is then used to construct a JSON syntax tree, such as an abstract syntax tree (AST). Each node in the syntax tree stores the field name, parent node path, and field value type. A pruning optimization algorithm (e.g., skipping nodes with value types "null" or "empty array") is used to improve parsing efficiency and avoid redundant nodes consuming memory. A sensitive field alias library is established (using key-value pairs, such as "id_no→ID card number" and "identity code→ID card number"). During parsing, fuzzy matching is performed on the field names of the AST leaf nodes (supporting prefix / suffix matching, such as "phone_138" matching "phone"). Simultaneously, an edit distance algorithm (e.g., Levenshtein edit distance less than or equal to 2) is used to correct spelling errors in field names (e.g., "idcard" matching "idCard"), ensuring that non-standard field names are accurately mapped to sensitive types. Finally, the JSON field paths, field values, and mapped sensitive types are output as structured data.

[0073] For non-form fields in HTML, Jsoup is used to generate a DOM tree for filtering. <style>和<script>等非文本节点，保留等文本节点，实现DOM树过滤。对文本节点内容进行分词与权重排序，如基于IKAnalyzer中文分词器，提取包含敏感关键词（如身份证、银行卡）的短语；为每个敏感关键词设置权重（如"身份证号”权重为5，"身份证”权重为3），对分词后的短语计算关键词权重和，仅保留权重和大于等于3的短语（过滤"身份证复印件”等非敏感短语）；同时记录短语所在DOM节点的XPath路径（如 / html / body / div[2] / span[1]），输出Xpath路径和关键词-数值对，将XPath路径作为字段路径，实现敏感文本的精准定位，节点文本作为字段值，基于"银行卡号”、"联系电话”等关键词推断敏感类型为银行卡号、手机号，作为结构化数据。

[0074] 对于XML自定义标签，先进行Scheme适配验证，支持加载管理员预设的XML自定义标签Schema（定义自定义标签与敏感类型的关联，如<cust-id>→身份证号），解析时通过Schema验证判断XML标签是否为自定义敏感标签；若未预设Schema，自动提取标签名的语义特征（如"bank-card”包含"bank”，关联"银行卡号”）；并且，采用增量加载机制，管理员更新自定义标签规则时，无需重启模块，通过热更新接口将新规则写入内存缓存，确保解析规则实时生效，适应业务场景中标签格式的动态变化。最终输出XML标签路径、内容及标签语义映射的敏感类型，作为结构化数据。

[0075] 通过本实施例中针对三种主流非标准格式，提供了具体、自适应的解析策略，确保了从非标准字段中均能有效提取出位置、内容和初步敏感类型这三项关键信息，为后续高精度识别提供了统一的、高质量的结构化数据输入。

[0076] 在其中的一些实施例中，上述步骤S202中采用多维协同识别模型，对结构化数据进行敏感数据识别，得到识别结果，包括以下步骤：

[0077] 基于结构化数据，采用多维协同识别模型分别计算各识别维度的置信度；基于识别维度对应的预设权重，对置信度进行加权计算，得到综合置信度评分；通过对比综合置信度评分和预设阈值，确定结构化数据中敏感数据的识别结果。

[0078] 具体地，图4是本实施例中多维度识别的流程示意图，如图4所示，通过配置参数模块为多维度识别提供规则（如别名库、模式库和脱敏策略）。

[0079] 采用多维协同识别模型，至少对结构化数据进行两个识别维度的计算，并输出敏感或非敏感的判定及置信度，并根据每个识别维度对应的预设权重，对所有置信度进行加权计算，得到综合置信度评分。最后对比综合置信度评分和预设阈值，确定结构化数据中敏感数据位置、敏感类型和综合置信度评分的识别结果，进一步的，还可以设置多档预设阈值，通过对比多档预设阈值和综合置信度评分，输出包含敏感级别的识别结果。

[0080] 示例性的，为路径匹配、语义匹配、模式匹配三个识别维度分别设置权重0.3、0.4和0.3，每个维度输出"敏感 / 非敏感”判定及置信度，计算加权置信度和（如路径置信度（0.9x0.3）、语义置信度（0.8x0.4）、模式置信度（0.9x0.3）之和为0.86），综合置信度评分大于预设阈值（如0.7），则最终判定为敏感数据。

[0081] 进一步的，在以上基础上引入HTTP语境校验（如请求方法为"POST”且URL含" / pay”，则降低金融类敏感数据的判定阈值），通过场景动态调整各识别维度的权重（如提升金融场景模式权重），进一步降低误判率。

[0082] 通过本实施例中引入置信度加权决策机制，显著提升了决策的科学性和可解释性，并能通过调整阈值平衡误报率与漏报率，使系统在不同安全要求的场景下均能保持优异识别性能。

[0083] 参考图4，以下作为一种具体实施方式，基于字段路径在前缀树中进行查询匹配的结果，结合增量学习到的路径相似度信息，得到路径匹配的置信度。其中，具体包括前缀树构建和敏感路径前缀匹配：将结构化数据的字段（如user.info.id_no）构建为前缀树（Trie树），每个路径节点关联敏感类型（如user.info节点关联"个人信息”）；查询时可以通过前缀匹配快速定位路径所属敏感类型，将匹配相似度作为置信度（0至1），相比传统哈希表查询效率能够提升50%（尤其适用于长路径字段）；另外，采用增量学习，当识别到新的敏感路径（如user.contact.phone_138）时，自动计算该路径与现有敏感路径的相似度（基于路径层级结构），若相似度大于阈值（如80%），则将新路径归入同类敏感类别，无需人工配置。

[0084] 参考图4，以下作为一种具体实施方式，基于训练完备的自然语言处理模型，输入字段值和场景信息，得到语义匹配的置信度。其中，具体包括语义向量特征提取和轻量化自然语言处理模型BERT模型推理：结构化数据中的字段值（如"客户身份证：110101XXX”）转换为语义向量，特征包括关键词（身份证）、数值长度（18位）、数值格式（数字+X），此外同时还融入HTTP场景特征（如请求URL含" / user / auth”，则"身份信息”语义权重提升）；基于标注的HTTP非标准字段样本（覆盖电商、金融、政务等场景），训练轻量化BERT模型（参数量可以小于等于100M，以适配网关硬件资源），模型输出字段值属于敏感类型的置信度（0至1），置信度大于阈值（如0.8）判断为敏感数据。

[0085] 参考图4，以下作为一种具体实施方式，将字段值与增量模式学习的动态模式库进行匹配，得到匹配模式；根据匹配模式的优先级，得到模式匹配的置信度。其中，具体包括动态模式库匹配和增量模式学习：预设敏感数据格式模式（采用正则表达式与长度约束，如银行卡号：正则^[0-9]{16,19}$（匹配16-19位纯数字，覆盖通用银行卡格式）与长度约束"19位”（针对业务场景中需重点防护的储蓄卡，精准限定长度））；同时支持管理员自定义模式（如企业社保登记号：正则^[0-9A-Z]{10,20}$（匹配10-20位数字与大写字母）与长度约束"18位”（限定本地企业登记号的固定长度））；模式库采用优先级排序（精确模式优先级高于模糊模式，如"19位银行卡号（正则+长度约束）”优先级高于"16-19位银行卡号（仅正则）”），输出精确模式的置信度1或者模糊模式的置信度0；当识别到未匹配现有模式但路径 / 语义判定为敏感的字段值（如"13800138000”），自动提取其格式特征（11位数字、以"138”开头），生成新模式并计算模式置信度（基于同类字段值的重复次数，重复≥5次则置信度≥0.9），置信度达标则加入模式库。

[0086] 通过本实施例中针对非标准字段，分别从各个识别维度进行敏感识别，并且最终协同各个识别维度得到敏感数据的识别结果，显著提高了识别准确性，解决单一维度识别误判率高的问题。

[0087] 在其中的一些实施例中，在获得敏感数据的识别结果后，进一步对非标准字段中的敏感数据进行脱敏处理，具体包括以下步骤：

[0088] 根据识别结果，对敏感数据进行格式适配的脱敏处理；其中，脱敏处理包括：对于JSON嵌套字段，基于树形结构模型，对敏感数据的字段值进行节点替换；对于HTML非表单字段，对敏感数据的字段路径进行局部文本替换；对于XML自定义标签，对敏感数据的标签属性映射表进行敏感值替换。

[0089] 具体地，以脱敏规则与HTTP语法兼容为核心，设计格式适配脱敏算法，克服现有脱敏破坏报文结构的问题，同时通过硬件加速保障实时性。

[0090] 图5是本实施例中实时脱敏的流程示意图，如图5所示，通过配置参数模块为实时脱敏提供规则（如别名库、模式库和脱敏策略），具体采用以下格式适配脱敏算法，得到重组HTTP完整报文：

[0091] 对JSON嵌套字段，基于树形结构模型（如AST），对敏感数据的字段值进行节点替换 / 屏蔽，保留字段名和层级结构，同时采用语法树重写技术，避免直接字符串替换导致的语法错误（如将"id_no:110101199”替换为"id_no: 1101&&&99”，不修改JSON逗号、引号等语法符号）。最终输出脱敏后的JSON片段，并重组为HTTP完整报文。

[0092] 对于HTML非表单字段，记录的DOM节点XPath路径，定位敏感文本所在节点后，采用局部文本替换（仅替换敏感数值，保留关键词与标签结构），同时还通过DOM节点更新接口直接修改节点文本，无需重构整个HTML报文，降低处理开销。最终输出脱敏后的HTTP片段，并重组为HTTP完整报文。

[0093] 对于XML自定义标签，基于解析XML标签时生成标签属性映射表（记录标签名、属性名和值位置），脱敏时仅替换标签内的敏感值，保留标签名与属性，确保XML Schema的兼容性。最终输出脱敏后的XML片段，并重组为HTTP完整报文。

[0094] 进一步的，利用硬件加速和增量缓存策略，保障脱敏处理的实时性和业务可用性。具体是利用网关多核心CPU的并行处理能力，将"解析-识别-脱敏”拆分为三个子任务，通过任务调度算法（基于流量负载动态分配核心）实现并行执行，单核心处理能力提升至1000条 / 秒；同时采用SSD存储配置参数（如别名库、模式库、脱敏策略），将参数读取延迟降低至1ms以内；此外，对重复出现的非标准字段路径（如user.info.id_no），缓存其解析结果与脱敏规则，后续相同路径字段直接调用缓存，无需重复解析识别，缓存命中率大于等于80%时，全流程耗时可降至5ms以内。

[0095] 通过本实施例中实现了对非标准字段格式的精准脱敏，仅在数据内容层面进行修改，完全保留报文原有的语法和结构，这确保了脱敏后的报文仍能被客户端或服务端正常解析和处理，避免了因脱敏破坏报文，从而影响业务。

[0096] 下面通过优选实施例对本实施例进行描述和说明。

[0097] 本实施例中提供了一种HTTP报文敏感数据识别方法，该方法包括以下步骤：

[0098] 步骤S601，通过端口镜像方式，捕获双向HTTP流量；通过建立TLS会话，解密所述HTTP流量，获取明文HTTP报文。

[0099] 步骤S602，对捕获的HTTP报文中的非标准字段进行结构化解析，生成包括字段路径、字段值和敏感类型的结构化数据。

[0100] 步骤S603，基于结构化数据，采用多维协同识别模型分别计算各识别维度的置信度。

[0101] 步骤S604，基于识别维度对应的预设权重，对置信度进行加权计算，得到综合置信度评分；通过对比综合置信度评分和预设阈值，确定结构化数据中敏感数据的识别结果。

[0102] 步骤S605，根据识别结果，对敏感数据进行格式适配的脱敏处理，得到重组HTTP报文。

[0103] 图6是本实施例中HTTP报文敏感数据识别方法的流程示意图，如图6所示，在数据交互模块中，采用双端口镜像与流量过滤技术，捕获双向HTTP流量；并通过卸载SSL，获取HTTP报文。对HTTP报文进行非标准字段解析，得到结构化数据，其中包括JSON嵌套字段、HTML非表单字段和XML自定义标签。将结构化数据输入多维协同识别模型进行多规则匹配，具体包括路径匹配、语义匹配和模式匹配，若匹配失败，说明不包含敏感数据，传输原始数据并记录日志；若匹配成功，标记敏感数据位置和内容（含非标准字段格式和路径信息），再获取访问场景与用户角色，输入实时脱敏模块进行脱敏处理，传输脱敏后的HTTP报文数据，并记录日志。

[0104] 通过本实施例中覆盖JSON嵌套、HTML非表单、XML自定义标签等非标准字段的多维协同识别，能够将识别场景拓展至现有技术的3倍以上，识别准确率提升至98%，彻底解决非标准字段敏感数据泄露风险，并且通过格式适配脱敏算法确保JSON路径、HTML标签、XML结构完整，报文完整性保持率100%，脱敏后数据可被客户端正常解析，无业务中断。

[0105] 需要说明的是，在上述流程中或者附图的流程图中示出的步骤可以在诸如一组计算机可执行指令的计算机系统中执行，并且，虽然在流程图中示出了逻辑顺序，但是在某些情况下，可以以不同于此处的顺序执行所示出或描述的步骤。

[0106] 在本实施例中还提供了一种HTTP报文敏感数据识别系统，该系统用于实现上述实施例及优选实施方式，已经进行过说明的不再赘述。以下所使用的术语"模块”、"单元”、"子单元”等可以实现预定功能的软件和 / 或硬件的组合。尽管在以下实施例中所描述的装置较佳地以软件来实现，但是硬件，或者软件和硬件的组合的实现也是可能并被构想的。

[0107] 图7是本实施例HTTP报文敏感数据识别系统的结构示意图，如图7所示，该系统包括：

[0108] 数据安全网关10，用于执行以上实施例中的HTTP报文敏感数据识别方法；

[0109] 目标HTTP服务端20，与数据安全网关通信连接，用于响应访问请求，并返回相应的HTTP报文。

[0110] 具体地，数据安全网关10部署于客户端30与目标HTTP服务端20之间，集成Web管理模块与本地数据存储模块，作为数据流量的核心管控节点。其硬件配置采用专用硬件网关设备，搭载多核心高性能处理器（如Intel Xeon D系列、ARM架构高性能芯片）、16GB及以上高速内存（支持数据实时处理）、500GB及以上SSD本地存储（用于存储脱敏规则、分级分类标准、访问策略、操作日志等配置数据），配备千兆 / 万兆以太网端口（支持大流量HTTP数据并发处理）。并且能够作为独立运行单元，内置Web管理界面（供管理员侧配置规则、查看日志），同时具备HTTP数据捕获、非标准字段解析、多维度识别、实时脱敏等核心处理能力，无需依赖外部服务器即可完成全流程数据安全管控。

[0111] 目标HTTP服务端20为客户端30实际需要访问的HTTP服务所在服务器，包括目标应用服务器和目标数据服务器。其中，目标应用服务器用于部署客户端30需访问的业务应用，接收经数据安全网关10转发的请求，处理业务逻辑，并将原始响应数据返回给数据安全网关10；目标数据服务器用于存储目标应用服务器运行所需的业务数据，为目标应用服务器提供数据支撑，与数据安全网关10无直接交互，仅通过目标应用服务器间接参与数据流转。

[0112] 通过本实施例中提供的系统，系统组件协同严格遵循技术方案链路，数据安全网关集中实现"捕获-解析-识别-脱敏”全流程，无需在服务端额外部署处理模块，降低系统改造成本；并且能够将整套方法产品化、系统化，形成一个独立部署、透明串行的安全防护节点，在不修改现有应用架构和代码的前提下，提供了HTTP层敏感数据防护能力。

[0113] 作为一种具体实施例方式，如图7所示，上述系统还包括：

[0114] 客户端30，与数据安全网关通信连接，用于向目标HTTP服务端发起访问请求，以及接收通过HTTP报文敏感数据识别方法得到的识别结果；

[0115] 网络设备40，用于实现客户端、数据安全网关、目标HTTP服务端之间的网络连接与数据传输。

[0116] 具体地，客户端30是用户发起HTTP访问请求的终端设备，包括个人计算机（Window / MacOS / Linux）、移动智能设备等。客户端设备具备网络连接能力，通过浏览器或专用客户端应用，向数据安全网关10发送访问目标HTTP服务端20的请求，并接收经网关处理后的响应数据。

[0117] 网络设备40包括千兆 / 万兆以太网交换机、企业级路由器，用于实现客户端30、数据安全网关10、目标HTTP服务端20之间的网络连接与数据传输。交换机负责设备局域网通信，路由器保障跨网段 / 广域网访问稳定性，同时可配合数据安全网关实现基础网络隔离（如划分VLAN）。

[0118] 在其中的一些实施例中，图8是本实施例中HTTP报文敏感数据识别系统的多端交互示意图，如图8所示，多端包括客户端（浏览器 / 移动APP）、数据安全网关和目标HTTP服务端（包括目标应用服务器和目标数据服务器），数据安全网关包括数据交互模块、非标准字段解析模块、多维度识别模块和实时脱敏模块。

[0119] 其中，用户通过客户端向目标HTTP服务端发起HTTPS请求，请求经网络设备转发至数据安全网关；数据安全网关的数据交互模块将原始HTTP请求传输至目标HTTP服务器，同时捕获HTTP响应报文，传输至非标准字段解析模块进行解析，解析输出字段路径、字段值、敏感类型的结构化数据，传输至多维度识别模块；多维度识别模块基于解析后的结构化数据，执行路径匹配、语义匹配、模式匹配的三维协同识别，输出敏感数据位置、类别和级别的识别结果，并传输至实时脱敏模块；实时脱敏模块基于识别结果，获取访问场景与用户角色信息，采用HTTP格式适配脱敏算法对非标准字段脱敏后，将脱敏后数据返回至数据交互模块；数据交互模块将脱敏后数据传输至客户端，同时保存日志信息（记录原始值、脱敏值、场景、角色和时间）供用户查看，客户端接收并展示脱敏后数据。

[0120] 需要说明的是，上述各个模块可以是功能模块也可以是程序模块，既可以通过软件来实现，也可以通过硬件来实现。对于通过硬件来实现的模块而言，上述各个模块可以位于同一处理器中；或者上述各个模块还可以按照任意组合的形式分别位于不同的处理器中。

[0121] 此外，结合上述实施例中提供的HTTP报文敏感数据识别方法，在本实施例中还可以提供一种存储介质来实现。该存储介质上存储有计算机程序；该计算机程序被处理器执行时实现上述实施例中的任意一种HTTP报文敏感数据识别方法。

[0122] 需要说明的是，本申请所涉及的用户信息（包括但不限于用户设备信息、用户个人信息等）和数据（包括但不限于用于分析的数据、存储的数据、展示的数据等），均为经用户授权或者经过各方充分授权的信息和数据。

[0123] 应该明白的是，这里描述的具体实施例只是用来解释这个应用，而不是用来对它进行限定。根据本申请提供的实施例，本领域普通技术人员在不进行创造性劳动的情况下得到的所有其它实施例，均属本申请保护范围。

[0124] 显然，附图只是本申请的一些例子或实施例，对本领域的普通技术人员来说，也可以根据这些附图将本申请适用于其他类似情况，但无需付出创造性劳动。另外，可以理解的是，尽管在此开发过程中所做的工作可能是复杂和漫长的，但是，对于本领域的普通技术人员来说，根据本申请披露的技术内容进行的某些设计、制造或生产等更改仅是常规的技术手段，不应被视为本申请公开的内容不足。

[0125] "实施例”一词在本申请中指的是结合实施例描述的具体特征、结构或特性可以包括在本申请的至少一个实施例中。该短语出现在说明书中的各个位置并不一定意味着相同的实施例，也不意味着与其他实施例相互排斥而具有独立性或可供选择。本领域的普通技术人员能够清楚或隐含地理解的是，本申请中描述的实施例在没有冲突的情况下，可以与其他实施例结合。

[0126] 以上所述实施例仅表达了本申请的几种实施方式，其描述较为具体和详细，但并不能因此而理解为对专利保护范围的限制。应当指出的是，对于本领域的普通技术人员来说，在不脱离本申请构思的前提下，还可以做出若干变形和改进，这些都属于本申请的保护范围。因此，本申请的保护范围应以所附权利要求为准。< / style> ,

Claims

1. A method for identifying sensitive data in HTTP messages, characterized in that, include: The non-standard fields in the captured HTTP messages are parsed in a structured manner to generate structured data including field paths, field values, and sensitive types. The non-standard fields include at least one of the following: JSON nested fields, HTML non-form fields, and XML custom tags; A multidimensional collaborative recognition model is used to identify sensitive data in the structured data to obtain recognition results; the multidimensional collaborative recognition model includes at least two recognition dimensions among path matching, semantic matching and pattern matching.

2. The method for identifying sensitive data in HTTP messages according to claim 1, characterized in that, The process of performing structured parsing on non-standard fields in the captured HTTP messages to generate structured data including field paths, field values, and sensitive types includes: For the nested JSON fields, a tree structure model is constructed and traversed to extract the field paths and values, and sensitive types are determined based on the field name mapping mechanism; For the HTML non-form fields, by performing word segmentation and keyword weight analysis on the text node content, the path of the node where the identified sensitive information is located is used as the field path, the node text content is used as the field value, and the sensitivity type is determined based on the keywords. For the aforementioned XML custom tags, by parsing the tag structure, the path and content of the XML element are respectively used as field path and field value, and the sensitive type is determined based on the tag semantic mapping mechanism.

3. The method for identifying sensitive data in HTTP messages according to claim 1, characterized in that, The multi-dimensional collaborative identification model is used to identify sensitive data in the structured data, and the identification results are obtained, including: Based on the structured data, a multi-dimensional collaborative recognition model is used to calculate the confidence level of each recognition dimension. Based on the preset weights corresponding to the identification dimensions, the confidence scores are weighted and calculated to obtain a comprehensive confidence score. The identification result of sensitive data in the structured data is determined by comparing the comprehensive confidence score with the preset threshold.

4. The method for identifying sensitive data in HTTP messages according to claim 3, characterized in that, Based on the structured data, a multi-dimensional collaborative recognition model is used to calculate the confidence level of each recognition dimension, including: Based on the query matching results of the field path in the prefix tree, and combined with the incrementally learned path similarity information, the confidence level of the path matching is obtained.

5. The method for identifying sensitive data in HTTP messages according to claim 3, characterized in that, Based on the structured data, a multi-dimensional collaborative recognition model is used to calculate the confidence level of each recognition dimension, including: Based on a well-trained natural language processing model, the confidence level of the semantic matching is obtained by inputting the field values ​​and scene information.

6. The method for identifying sensitive data in HTTP messages according to claim 3, characterized in that, Based on the structured data, a multi-dimensional collaborative recognition model is used to calculate the confidence level of each recognition dimension, including: The field values ​​are matched with the dynamic pattern library learned by incremental pattern learning to obtain the matching pattern; The confidence level of the pattern matching is obtained based on the priority of the matching pattern.

7. The method for identifying sensitive data in HTTP messages according to claim 2, characterized in that, The method further includes: Based on the identification results, the sensitive data is processed for format adaptation and desensitization. The desensitization process includes: For the nested JSON fields, based on the tree structure model, the field values ​​of the sensitive data are replaced with nodes; For the HTML non-form fields, perform partial text replacement on the field paths of the sensitive data; For the XML custom tags, sensitive values ​​are replaced in the tag attribute mapping table of the sensitive data.

8. The method for identifying sensitive data in HTTP messages according to claim 1, characterized in that, The method further includes: Capture bidirectional HTTP traffic using port mirroring; By establishing a TLS session, the HTTP traffic is decrypted to obtain plaintext HTTP messages.

9. A system for identifying sensitive data in HTTP messages, characterized in that, include: A data security gateway is used to execute the HTTP message sensitive data identification method according to any one of claims 1 to 8; The target HTTP server communicates with the data security gateway to respond to access requests and return corresponding HTTP messages.

10. The HTTP message sensitive data identification system according to claim 9, characterized in that, Also includes: The client is communicatively connected to the data security gateway and is used to initiate the access request to the target HTTP server and receive the identification result obtained by the HTTP message sensitive data identification method. Network devices are used to enable network connections and data transmission between the client, data security gateway, and target HTTP server.

Images