Data security behavior auditing method and system based on field classification adapter

Abstract

The invention relates to the technical field of digital security, in particular to a data security behavior auditing method and system based on a field classification adapter. The data security behavior auditing method comprises the following steps: acquiring and processing a document operation log of a terminal; based on a field classification adapter, performing multi-layer progressive classification processing on the document operation logs to obtain classification results of different dimensions; fusing the classification results of different dimensions to obtain a multi-dimensional classification label of the document operation log; and establishing and storing a mapping relationship between the document operation log and the multi-dimensional classification tag thereof. And for classification processing of each dimension, classification is started from the processing layer with the lowest calculation complexity, and classification is performed on the processing layers with higher calculation complexity in sequence if classification fails. Most of conventional and simple document operation log classifications are quickly filtered, a small number of complex document operation logs are transmitted to a processing layer with high calculation complexity to be processed, and batch document operation logs can be processed at low average cost.

Description

Technical Field

[0001] This invention relates to the field of digital security technology, and in particular to a data security behavior auditing method and system based on a field classification adapter. Background Technology

[0002] With the rapid development of informatization and digitalization, enterprises and government agencies increasingly rely on networks and information systems to conduct business activities, involving a wide variety of sensitive data, including personal privacy data, corporate trade secrets, financial information, research and development results, and government data. Data leakage has become one of the core risks in the field of information security. In daily operation and maintenance and security audits, document operation logs are key evidence for discovering abnormal behavior and locating the root cause of problems. Therefore, it is necessary to classify and tag document operation logs for subsequent querying in daily operation and maintenance and security audits.

[0003] However, faced with massive amounts of document operation logs, each containing multiple dimensions of information such as process information, file type, target drive letter, file source, whether it is encrypted, system name, user account, and IP address, the sheer volume of data to be processed makes reducing the average processing cost a pressing issue. Summary of the Invention

[0004] The main objective of this invention is to provide a data security behavior auditing method and system based on field classification adapters, aiming to reduce the average processing cost of handling massive amounts of document operation logs.

[0005] To achieve the above objectives, the present invention proposes a data security behavior auditing method based on a field classification adapter, comprising the following steps: Collect and process the terminal's document operation logs; Based on a field classification adapter, the processed document operation logs undergo multi-layer progressive classification processing to obtain classification results in different dimensions. The field classification adapter comprises several sequentially connected processing layers, each capable of multi-dimensional classification of the document operation logs. Each processing layer handles the same dimensions, and for any two adjacent processing layers, the computational complexity of the latter is higher than that of the former. The multi-layer progressive classification process works as follows: when a dimension is successfully classified in any processing layer, the classification result for that dimension is output, and classification processing for that dimension in subsequent processing layers is stopped; otherwise, classification processing for that dimension proceeds to the next processing layer. By integrating classification results from different dimensions, multi-dimensional classification labels for document operation logs are obtained; Establish and store the mapping relationship between document operation logs and their multi-dimensional category tags.

[0006] In the above-mentioned data security behavior auditing method based on field classification adapter, the field classification adapter includes at least the following two processing layers; The first processing layer performs classification processing based on cache queries; The second processing layer performs classification processing based on string comparison. The third processing layer performs classification processing based on pre-compiled regular expression strings; The computational complexity of the first processing layer is less than that of the second processing layer, and the computational complexity of the second processing layer is less than that of the third processing layer. The first, second, and third processing layers all classify the document operation logs in multiple dimensions according to a preset rule system. The preset rule system includes classification libraries of different dimensions. Each classification library has its own set of rules. Each rule in the set of rules contains a classification name, a matching priority, and matching characters for the matching items.

[0007] In the above data security behavior auditing method based on field classification adapter, the first processing layer performs multi-dimensional classification processing on document operation logs, including the following steps: Based on the matching items in each category library, extract the content corresponding to the matching items in the document operation log; The contents of matching items from the same category library are concatenated, and a hash operation is performed on the concatenated string to obtain the cache key corresponding to each dimension; Query the classification result corresponding to each cache key in the local cache, wherein the local cache stores the mapping relationship between frequently accessed cache keys and classification results; If the cache key corresponding to a certain dimension category is matched, the classification result of that dimension category is returned, and the subsequent processing layer for that dimension category is skipped. If the cache key lookup for a certain category fails, the default category result corresponding to the category failure will be output.

[0008] In the above data security behavior auditing method based on field classification adapter, the second processing layer performs multi-dimensional classification processing on document operation logs, including the following steps: Based on the matching items in each category library, extract the content corresponding to the matching items in the document operation log; Based on string comparison, the content corresponding to the matching item is matched with the matching characters in each rule in the corresponding classification library; For each dimension classification library, select the rule with the highest matching priority from all successfully matched rules, and output the classification name in that rule as the classification result for that dimension; if there is no successfully matched rule, the classification for that dimension fails, and output the default classification result corresponding to the classification failure.

[0009] In the above-mentioned data security behavior auditing method based on field classification adapter, the third processing layer performs multi-dimensional classification processing on document operation logs, including the following steps: For each dimension classification library, the matching characters containing wildcards in the rules are converted into equivalent regular expression strings; The converted regular expression string is pre-compiled and cached to obtain a pre-compiled regular expression string; Based on the matching items in each category library, extract the content corresponding to the matching items in the document operation log; Match the content corresponding to the matched item with the cached pre-compiled regular expression string; For each dimension classification library, select the rule with the highest matching priority from all successfully matched rules, and output the classification name in that rule as the classification result for that dimension; if there is no successfully matched rule, the classification for that dimension fails, and output the default classification result corresponding to the classification failure.

[0010] In the above-mentioned data security behavior auditing method based on field classification adapter, the field classification adapter further includes a fourth processing layer. The fourth processing layer performs multi-dimensional classification processing on document operation logs based on a deep learning classification model. If the classification of all dimensions still fails after multi-layer progressive classification processing, the classification processing of the fourth processing layer is performed.

[0011] In the above-mentioned data security behavior auditing method based on field classification adapter, the fourth processing layer performs multi-dimensional classification processing on document operation logs, including the following steps: Extract the content corresponding to the matching items in the document operation log and construct a unified feature vector of the corresponding dimension; The unified feature vector is input into the trained classification model. The classification model outputs the confidence probability of each category in this dimension. If the highest confidence probability is lower than the confidence threshold, the classification result of this dimension is the default classification result corresponding to the classification failure. Otherwise, the category corresponding to the highest confidence probability is taken as the classification result of this dimension.

[0012] In the above-mentioned data security behavior auditing method based on field classification adapter, each rule in the rule set contains multiple matching items. When a matching item is successfully matched, the rule is successfully matched. There is a preset matching order among the matching items of the rule. In the process of classifying document operation logs, matching is performed according to the preset matching order, and if the current matching item is successfully matched, the matching process of the next matching item is not executed.

[0013] In the above-mentioned data security behavior auditing method based on field classification adapter, the preset rule system includes any one or more of the following: process classification library, document classification library, network communication classification library, file source classification library, and operation time classification library; The matching items for each rule in the process classification library include the process name and the process path; The matching items for each rule in the document classification library include a set of extensions, path features, and file keywords; The matching items for each rule in the network communication classification library include CIDR address range, domain name characteristics, and specified port; The matching items for each rule in the file source classification library include path prefix, mount point, and device identifier; The matching items for each rule in the operation time classification library include weekday matching and time interval matching.

[0014] The second aspect of this invention discloses a data security behavior auditing system based on a field classification adapter, applied to the aforementioned data security behavior auditing method based on a field classification adapter, comprising: The data acquisition module is used to collect and process the terminal's document operation logs; A field classification adapter is used to perform multi-level progressive classification processing on processed document operation logs to obtain classification results in different dimensions. The field classification adapter contains several sequentially connected processing layers. Each processing layer can perform multi-dimensional classification processing on the document operation logs. The classification dimensions processed by each processing layer are the same. Among any two adjacent processing layers, the computational complexity of the later processing layer is higher than that of the earlier processing layer. The multi-level progressive classification processing is as follows: when a certain dimension is successfully classified in the classification processing of any processing layer, the classification result of that dimension is output, and the classification processing of that dimension in subsequent processing layers is stopped; otherwise, the classification processing of the dimension is carried out in the next processing layer. The fusion module is used to merge classification results from different dimensions to obtain multi-dimensional classification labels for document operation logs; The storage module is used to establish and store the mapping relationship between document operation logs and their multi-dimensional classification tags.

[0015] The technical solution provided by this invention may include the following beneficial effects: In the data security behavior auditing method based on field classification adapter provided by this invention, the processed document operation logs undergo multi-layer progressive classification processing. For each dimension of classification, classification begins at the processing layer with the lowest computational complexity; if classification fails, it proceeds sequentially to processing layers with higher computational complexity. This allows for the rapid filtering of most common and simple document operation log classifications, while relegating a few complex logs to processing layers with higher computational complexity, enabling batch processing of document operation logs at a low average cost. Attached Figure Description

[0016] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on the structures shown in these drawings without creative effort.

[0017] Figure 1 This is a schematic diagram of the data security behavior auditing method based on field classification adapter of the present invention; Figure 2 This is a flowchart illustrating the process of collecting and processing document operation logs from the terminal according to the present invention. Figure 3 This is a schematic diagram of the multi-level progressive classification processing in the field classification adapter of the present invention; Figure 4 This is a structural framework diagram of the data security behavior auditing system based on the field classification adapter of the present invention. Detailed Implementation

[0018] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only a part of the embodiments of the present invention, and not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those of ordinary skill in the art without creative effort are within the scope of protection of the present invention.

[0019] In one embodiment, such as Figure 1 As shown, a data security behavior auditing method based on a field classification adapter is provided. This embodiment illustrates the application of this method to a terminal. It is understood that this method can also be applied to a server, and to a system including both a terminal and a server, and implemented through interaction between the terminal and the server. In this embodiment, the method includes the following steps: Step S1: Collect and process the terminal's document operation logs; Step S2: Based on the field classification adapter, perform multi-layer progressive classification processing on the processed document operation logs to obtain classification results in different dimensions. The field classification adapter contains several sequentially connected processing layers. Each processing layer can perform multi-dimensional classification processing on the document operation logs. The classification dimensions processed by each processing layer are the same. For any two adjacent processing layers, the computational complexity of the later processing layer is higher than that of the earlier processing layer. The multi-layer progressive classification processing is as follows: when a certain dimension is successfully classified in the classification processing of any processing layer, the classification result of that dimension is output, and the classification processing of that dimension in subsequent processing layers is stopped; otherwise, the classification processing of that dimension is performed in the next processing layer. For example, the earlier processing layer performs classification processing using preset rules, and the later processing layer uses machine learning or neural networks for classification processing.

[0020] Step S3: Merge the classification results from different dimensions to obtain multi-dimensional classification labels for document operation logs; Step S4: Establish and store the mapping relationship between document operation logs and their multi-dimensional category tags. In subsequent daily operations and security audits, the corresponding document operation logs can be retrieved by entering a query command containing the category tags. This eliminates the reliance on the underlying fields in the document operation logs, making it easier for inexperienced users to perform queries. For example, the query command can be a combination of multiple tags, such as "Working Hours + External Network Communication + Document Distribution," or it can use logical conditions such as AND, OR, NOT, and priority filtering for the query.

[0021] In the data security behavior auditing method based on field classification adapter provided by this invention, the processed document operation logs undergo multi-layer progressive classification processing. For each dimension of classification, classification begins at the processing layer with the lowest computational complexity; if classification fails, it proceeds sequentially to processing layers with higher computational complexity. This allows for the rapid filtering of most common and simple document operation logs, while relegating a few complex logs to processing layers with higher computational complexity, thus enabling the processing of batch document operation logs at a low average cost.

[0022] For example, such as Figure 2 As shown, the document operation logs of the terminal are collected and processed by the terminal acquisition layer, log synchronization layer, intelligent log sharding strategy module, pipeline processing engine, and data writing and completion marker.

[0023] In the terminal acquisition layer, the IP-guard system collects document operation logs from terminal devices daily. These logs include log ID, terminal ID, document name, document name hash, file keywords, file content summary, operation type (e.g., create, upload, copy, move, delete), process name, process name hash, document operation source path, document operation source device (e.g., local disk, network disk, or removable disk), document operation target path, document operation target device, document category, operation time, and operation terminal. The file name hash refers to the file name being converted into a fixed-length string identifier using a hash algorithm. Similarly, the process name hash refers to the process name being converted into a fixed-length string identifier using a hash algorithm. The collection results are stored in the database on a daily basis.

[0024] In the log synchronization layer, the IP-guard system categorizes logs according to "terminal + log type," systematically classifying document operation logs from different sources and of different types. For example: Server A - security audit logs, Terminal B - operation logs. A unique segment identifier is generated for each document operation log entry to ensure the synchronization process is traceable and verifiable. Furthermore, during data loading, a doubleMap caching structure can be used for batch loading to reduce the performance overhead of frequent I / O operations. During full synchronization, document operation logs within a specified time range are divided by day, and two threads are started to execute the synchronization task in parallel using an alternating "odd and even day" approach. For example, when synchronizing data from March 1st to March 31st, thread A handles odd-numbered days, and thread B handles even-numbered days. This segmentation method effectively avoids the problem of severely uneven log distribution caused by long holidays such as May Day, National Day, and Spring Festival concentrating within a certain half-month. The two threads strictly adhere to the "cannot read simultaneously" mutual exclusion principle during execution. That is, when one thread reads logs from the source system database, the other thread enters a waiting state. Once the reading is complete, it immediately switches to writing to the analysis system database, and another thread resumes the reading operation. The two threads cycle in a "read-write-alternate" rhythm, significantly reducing the time required for full synchronization while ensuring the safety of the source database. Simultaneously, the system monitors the memory usage of the source system database in real time and intelligently adjusts the number of log reads per operation based on the memory level. This prevents excessive memory pressure on the source system database due to a large instantaneous data read, which could even lead to a crash. Ultimately, this achieves high concurrency, high efficiency, and high stability in log synchronization.

[0025] The intelligent log sharding strategy module uses a "segment identifier + offset table" as its core control unit. During synchronization task initialization, the logs are logically segmented according to time intervals or data volume, and a unique segment identifier is generated for each segment. During synchronization, after each successful synchronization of a batch of data, the synchronization offset corresponding to that segment is updated in real time and persistently stored. This allows for reliable continuation from the previous offset position after task interruption or abnormal restart, achieving reliable breakpoint resume. Each "read-transfer-write" process is counted as a synchronization step and its time consumption is statistically analyzed. The system uses a sliding window or exponential weighting method to smoothly calculate historical time consumption, obtaining the actual synchronization performance index for the current stage. Based on this, the intelligent sharding algorithm periodically collects network bandwidth, disk I / O throughput, and CPU load as feedback parameters. When idle resources are detected, the single batch size is automatically increased to improve throughput. When network jitter, I / O blocking, or excessive CPU load is detected, the batch size is actively reduced and the synchronization interval is extended. This achieves an adaptive balance between "maximizing efficiency" and "system stability," ultimately realizing dynamic optimal control of synchronization speed, resource consumption, and system security.

[0026] The pipelined processing engine employs a multi-queue pipeline structure to process log data in stages and in a decoupled manner. The overall structure is divided into a parsing queue, a verification queue, a cleaning queue, and an ingestion queue. Log data first enters the parsing queue for format parsing and field breakdown. After parsing, it is submitted to the verification queue for integrity, consistency, and rule validity checks. Data that passes verification then enters the cleaning queue for dirty data filtering, anomaly correction, and field standardization. Finally, the ingestion queue is responsible for batch writing to the analysis system database. The queues are connected through high-performance blocking queues or lock-free queues, forming a "production-consumption" pipeline processing model. Each queue is consumed by an independent thread pool, achieving multi-stage parallel processing. Meanwhile, the engine has a built-in automatic monitoring mechanism for queue status and system load, which collects key indicators such as queue length, backlog duration, and server CPU, memory, and disk I / O in real time. When a queue is detected to be continuously backlogged, the system will automatically expand the number of working threads in the corresponding stage or increase the batch processing frequency to achieve adaptive speed-up. When the overall server load is detected to be too high or the I / O bottleneck is obvious, some thread resources will be dynamically reclaimed, the delivery rate will be reduced, or the single processing batch will be reduced to achieve automatic speed-down adjustment. This ensures processing efficiency while avoiding system overload and ensures long-term stable and efficient operation of the pipeline processing process.

[0027] During the data writing and completion marking phase, the system writes the parsed, verified, and cleaned log data to the log analysis database in batches to reduce I / O overhead from individual writes and improve overall data storage performance. Once a batch of data is successfully stored, the system immediately updates the segment offset corresponding to this task, persistently recording the current completed position to ensure accurate connection of subsequent synchronizations and avoid duplicate reads and writes. At the same time, the system also outputs the processing results of this synchronization task in a unified manner, including key statistical information such as the amount of synchronized data in this batch, the number of successful and failed entries, the overall execution status, and the cumulative time consumed in each stage, providing a reliable basis for subsequent performance analysis, troubleshooting, and scheduling optimization.

[0028] Optionally, the field classification adapter includes at least the following two processing layers: The first processing layer performs classification processing based on cache queries; The second processing layer performs classification processing based on string comparison. The third processing layer performs classification processing based on pre-compiled regular expression strings.

[0029] The computational complexity of cached queries is lower than that of string comparison, which in turn is lower than that of regular expression strings. In other words, the computational complexity of the first processing layer is lower than that of the second processing layer, which in turn is lower than that of the third processing layer. In this invention, the field classification adapter may include a first processing layer and a second processing layer, or it may include both a first and a third processing layer, or it may include both a second and a third processing layer. Alternatively, the field classification adapter may include a first, a second, and a third processing layer.

[0030] The first, second, and third processing layers all classify document operation logs in multiple dimensions according to a preset rule system. The preset rule system includes classification libraries of different dimensions, each classification library has its own rule set, and each rule in the rule set contains a classification name, matching priority, and matching characters for the matching item.

[0031] In some optional embodiments, the preset rule system includes any one or more of the following: process classification library, document classification library, network communication classification library, file source classification library, and operation time classification library.

[0032] The rule set in the process classification library is as follows: Any rule in the rule set Includes process name: Path keywords: Matching priority: Category name: .

[0033] The set of rules in the document classification library is as follows: Any rule in the rule set Includes a set of file extensions: Path characteristics: Filename keyword characteristics: Matching priority: Category name: .

[0034] The rule set in the network communication classification library is as follows: Any rule in the rule set Includes CIDR (Classless Inter-Domain Routing) address ranges: Domain characteristics: Specify port: Matching priority: Category name: .

[0035] The rule set in the document source classification library is as follows: Any rule in the rule set Includes path prefix: Mounting point: Equipment identification: Matching priority: Category name: .

[0036] The rule set in the operation time classification library is as follows: Any rule in the rule set Includes the set of days in effect: Start time: End time: Matching priority: Category name: .

[0037] Specifically, based on the aforementioned preset rule system, the first processing layer performs multi-dimensional classification processing of document operation logs, including the following steps: Based on the matching items in each category library, extract the content corresponding to the matching items in the document operation log. For example, based on the matching items in the process category library, the extracted content includes the process name: process_name and process path: process_path. Based on the matching items in the document category library, the extracted content includes the extension: ext, the file name: filename, and the file path: filepath. Based on the matching items in the network communication category library, the extracted content includes the communication IP: ip, the domain name: domain, and the port: port. Based on the matching items in the file source category library, the extracted content includes the file path: filepath, the mount point: mount, and the device identifier: device_flag. Based on the matching items in the operation time category library, the extracted content includes the event time: HH:MM and the weekday: weekday.

[0038] The contents of matching items in the same category library are concatenated, and a hash operation is performed on the concatenated string to obtain the cache key corresponding to each dimension. For example: the cache key for the process category is: hash(process_name + process_path); the cache key for the document category is: hash(ext + filename + filepath); the cache key for the network communication category is: hash(ip + domain + port); the cache key for the file source category is: hash(filepath + mount + device_flag); and the cache key for the operation time category is: hash(weekday + HH:MM).

[0039] The classification result corresponding to each cache key is queried in the local cache, wherein the local cache stores the mapping relationship between frequently accessed cache keys and classification results; for example, when the document operation log appears more than a first preset value (e.g., 50 times, 100 times), the content corresponding to the matching item in the document operation log is hashed, the hash calculation result is used as the cache key, and the local cache stores the classification result of the document operation log, as well as the mapping relationship between the cache key and the classification result.

[0040] If the cache key corresponding to a certain dimension category is matched, the classification result of that dimension category is returned, and the subsequent processing layer for that dimension category is skipped. If the cache key lookup for a certain dimension category fails, the default category result corresponding to the category failure will be output, for example, "unknown".

[0041] This reduces the overhead of frequently occurring duplicate matching of document operation logs, thereby improving overall throughput performance.

[0042] Furthermore, in the aforementioned preset rule system, the process classification library includes process name matching formulas and path keyword matching formulas.

[0043] The process name matching formula is: ; Representation rules The process name matching value, =1 indicates a rule The process name match was successful. =0 indicates a rule The process name match failed. `process_name` represents the extracted process name. The prefix of the extracted process name (process_name) is a rule. Matching process name in . This indicates that the extracted process name (process_name) has a suffix that follows a rule. Matching process name in .

[0044] The formula for matching path keywords is: ; Representation rules Path keyword matching value, =1 indicates a rule The path keyword match was successful. =0 indicates a rule The path keyword match failed. This indicates the process path to be extracted.

[0045] Under the same rule In, any or If the value is 1, then the rule Match successful.

[0046] The aforementioned preset rule system includes a document classification library containing extension matching formulas, path feature matching formulas, and filename keyword matching formulas.

[0047] The formula for matching file extensions is: ; Representation rules The extension matches the value. =1 indicates a rule The Chinese extension matched successfully. =0 indicates a rule The file extension match failed; ext represents the extracted file extension.

[0048] The path feature matching formula is: ; Representation rules Path feature matching value, =1 indicates a rule Path feature matching successful. =0 indicates a rule Path feature matching failed. Indicates the path to the extracted file.

[0049] Filename keyword matching formula: ; Representation rules Filename keyword matching value, =1 indicates a rule The filename keyword match was successful. =0 indicates a rule Filename keyword match failed. Indicates the filename of the extracted file.

[0050] Under the same rule In, any , or If the value is 1, then the rule Match successful.

[0051] The aforementioned preset rule system includes a network communication classification library containing CIDR matching formulas, domain name matching formulas, and port keyword matching formulas.

[0052] The CIDR matching formula is: ; Representation rules CIDR matching value, =1 indicates a rule CIDR match successful. =0 indicates a rule CIDR matching failed. This indicates the extracted communication IP address.

[0053] The domain name matching formula is: ; Representation rules Domain name matching value, =1 indicates a rule Chinese domain name matched successfully. =0 indicates a rule Domain name matching failed. This indicates domain prefix tree matching, which includes built-in domain reversal processing. For example, if the domain is sub.abcom, it becomes com.basub after reversal, thus transforming the suffix matching problem into a prefix matching problem. This indicates the domain name to be extracted.

[0054] The port matching formula is: ; Representation rules Domain name matching value, =1 indicates a rule The middle port was successfully matched. =0 indicates a rule Port matching failed. Indicates the port to be extracted.

[0055] Under the same rule In, any , or If the value is 1, then the rule Match successful.

[0056] In the aforementioned preset rule system, the document source classification library includes path prefix matching formulas, mount point matching formulas, and device identifier matching formulas.

[0057] The formula for path prefix matching is: ; Representation rules Path prefix matching value, =1 indicates a rule The path prefix match was successful. =0 indicates a rule Path prefix matching failed. File paths are indicated by a path prefix: As a beginning, Indicates the path to the extracted file.

[0058] The mount point matching formula is: ; Representation rules Mount point matching value, =1 indicates a rule Mount point matching successful. =0 indicates a rule Mount point matching failed. This indicates the mount point to be extracted.

[0059] The device identifier matching formula is: ; Representation rules The device identifier matching value, =1 indicates a rule Device identifier matching successful. =0 indicates a rule Device identifier matching failed. Indicates the device identifier to be extracted. This indicates that the extracted device identifier contains rules. Device identification in: .

[0060] Under the same rule In, any , or If the value is 1, then the rule Match successful.

[0061] In the aforementioned preset rule system, the operation time classification library includes weekday matching formulas and time interval matching formulas.

[0062] The formula for matching the day of the week is: ; Representation rules The weekday matching value, =1 indicates a rule The weekday was successfully matched. =0 indicates a rule The weekday match failed; weekday indicates the weekday being extracted.

[0063] The time interval matching formula includes: Normal time interval: Then we have: ; Representation rules Time interval matching value, =1 indicates a rule The time interval match was successful. =0 indicates a rule The time interval matching failed.

[0064] Time range spanning multiple days: Then we have: ; Under the same rule In the middle, satisfy =1 and When =1, this rule applies. Match successful.

[0065] Based on the matching formula described above, the second processing layer performs multi-dimensional classification processing of document operation logs, including the following steps: Based on the matching items in each category library, extract the content corresponding to the matching items in the document operation log; Based on string comparison, the content corresponding to the matching item is matched against the matching characters in each rule of the corresponding category library; for example, in the process category library, based on string comparison, the extracted process name: process_name is matched against the matching process name in each rule: Perform string comparison. If there is an exact match, or if the process name (process_name) prefix or process name (process_name) suffix matches the process name: If a match is found, the process name is successfully matched. For example, the process path (process_path) can be matched against the matching path keyword in each rule. Perform a string comparison; if the process path (process_path) contains a matching path keyword: The match is successful.

[0066] For each dimension classification library, select the rule with the highest matching priority from all successfully matched rules, and output the classification name in that rule as the classification result for that dimension; if there is no successfully matched rule, the classification for that dimension fails, and output the default classification result corresponding to the classification failure, for example, output "unknown".

[0067] Based on the above matching formula, the third processing layer performs multi-dimensional classification processing of document operation logs, including the following steps: For each dimension classification library, matching characters containing wildcards in the rules are converted into equivalent regular expression strings; for example, in the process classification library, if a rule includes process paths containing wildcards (such as * / ProgramFiles / *), then "*" is converted to ".*", "?" is converted to ".", and path separators and special characters are escaped to convert them into equivalent regular expression forms.

[0068] The converted regular expression string is pre-compiled and cached to obtain a pre-compiled regular expression string, in order to avoid the additional overhead caused by repeated compilation at runtime. Based on the matching items in each category library, extract the content corresponding to the matching items in the document operation log; Match the content corresponding to the matched item with the cached pre-compiled regular expression string; For each dimension classification library, select the rule with the highest matching priority from all successfully matched rules, and output the classification name in that rule as the classification result for that dimension; if there is no successfully matched rule, the classification for that dimension fails, and output the default classification result corresponding to the classification failure.

[0069] Furthermore, in the process classification library, document classification library, network communication classification library, and file source classification library, each rule in the rule set contains multiple matching items, and the matching order between the matching items can be preset. During the classification of document operation logs by the second or third processing layer, matching is performed according to the preset matching order, and if a rule for the current matching item is successfully matched, the matching process for another matching item is not executed. This reduces the amount of computation involved in matching. Specifically, in the process classification library, the matching order is: process name first, process path. In the document classification library, the matching order is: extension first, path feature first, path feature first, filename keyword first. In the network communication classification library, the matching order is: CIDR address range first, domain name feature first, domain name feature first, specified port first. In the file source classification library, path prefix first, mount point first, mount point first, device identifier first.

[0070] Furthermore, such as Figure 3 As shown, the field classification adapter also includes a fourth processing layer, which performs multi-dimensional classification processing on the document operation log based on the trained classification model; the computational complexity of the fourth processing layer is greater than that of the third processing layer. If the classification result of a certain dimension still fails after multiple classification processes, it will enter the fourth processing layer for classification processing.

[0071] The fourth processing layer performs multi-dimensional classification processing of document operation logs, including the following steps: Extract the content corresponding to the matching items in the document operation log and construct a unified feature vector of the corresponding dimension; For example, for process content, by embedding the process name into a vectorized representation, and combining this with the structured encoding of the process path (PathEncode) and the log time (TimeFeature) to construct a unified feature vector Vec, we have: Vec = Embed(process_name) + PathEncode(process_path)+ TimeFeature For example, for document content, by vectorizing the filename and combining it with the structured encoding of the file path, the vectorized embedding of the extension, and the log time, a unified feature vector Vec is constructed, resulting in: Vec=Embed(filename)+PathEncode(filepath)+Embed(ext)+TimeFeature.

[0072] For network communication content, the domain name is vectorized and embedded. Combining the numerical conversion of the communication IP (IP2Vector), the one-hot encoding of the port (PortOneHot), and the one-hot encoding of the protocol (ProtocolOneHot), a unified feature vector Vec is constructed, resulting in: Vec = Embed(domain) + IP2Vector(ip) + PortOneHot + ProtocolOneHot.

[0073] For the file source content, combining the structured encoding of the file path, the one-hot encoding of the device identifier (DeviceFlagOneHot), and the mount point encoding (MountPointEncode), a unified feature vector Vec is constructed, resulting in: Vec=PathEncode(filepath)+DeviceFlagOneHot+MountPointEncode The unified feature vector is input into the trained classification model. The classification model outputs the confidence probability of each category in that dimension. If the highest confidence probability is lower than the confidence threshold, the classification result for that dimension is the default classification result corresponding to classification failure. Otherwise, the category corresponding to the highest confidence probability is used as the classification result for that dimension. In this way, the fourth processing layer automatically identifies document operation logs not covered by the rules.

[0074] In an optional embodiment, the trained classification model is trained using the LightGBM (Light Gradient Boosting Machine) algorithm. Manually labeled log data is used as the training set. The log data is used to construct a unified feature vector according to different contents in the above manner, which is used as the input of the classification model. The classification model outputs the confidence probability of each category in each dimension.

[0075] like Figure 4As shown, a second aspect of the present invention also discloses a data security behavior auditing system based on a field classification adapter, applied to the above-mentioned data security behavior auditing method based on a field classification adapter, comprising: The acquisition module 301 is used to acquire and process the terminal's document operation logs; The field classification adapter 302 is used to perform multi-level progressive classification processing on document operation logs to obtain classification results in different dimensions. The field classification adapter includes several sequentially connected processing layers. Each processing layer can perform multi-dimensional classification processing on the document operation logs. The classification processing dimensions of each processing layer are the same. For any two adjacent processing layers, the computational complexity of the later processing layer is higher than that of the earlier processing layer. The multi-level progressive classification processing is as follows: when a certain dimension is successfully classified in the classification processing of any processing layer, the classification result of that dimension is output, and the classification processing of that dimension in subsequent processing layers is stopped; otherwise, the classification processing of the dimension is carried out in the next processing layer. The fusion module 303 is used to fuse classification results from different dimensions to obtain multi-dimensional classification labels for document operation logs; Storage module 304 is used to establish and store the mapping relationship between document operation logs and their multi-dimensional classification tags.

[0076] The above description is only a preferred embodiment of the present invention and does not limit the patent scope of the present invention. All equivalent structural transformations made under the concept of the present invention using the contents of the present invention specification and drawings, or direct / indirect applications in other related technical fields, are included within the patent protection scope of the present invention.

Claims

1. A data security behavior auditing method based on field classification adapter, characterized in that: Includes the following steps: Collect and process the terminal's document operation logs; Based on a field classification adapter, the processed document operation logs undergo multi-layer progressive classification processing to obtain classification results in different dimensions. The field classification adapter comprises several sequentially connected processing layers, each capable of multi-dimensional classification of the document operation logs. Each processing layer handles the same dimensions, and for any two adjacent processing layers, the computational complexity of the latter is higher than that of the former. The multi-layer progressive classification process works as follows: when a dimension is successfully classified in any processing layer, the classification result for that dimension is output, and classification processing for that dimension in subsequent processing layers is stopped; otherwise, classification processing for that dimension proceeds to the next processing layer. By integrating classification results from different dimensions, multi-dimensional classification labels for document operation logs are obtained; Establish and store the mapping relationship between document operation logs and their multi-dimensional category tags.

2. The data security behavior auditing method based on field classification adapter according to claim 1, characterized in that: The field classification adapter includes at least the following two processing layers; The first processing layer performs classification processing based on cache queries; The second processing layer performs classification processing based on string comparison. The third processing layer performs classification processing based on pre-compiled regular expression strings; The computational complexity of the first processing layer is less than that of the second processing layer, and the computational complexity of the second processing layer is less than that of the third processing layer. The first, second, and third processing layers all classify the document operation logs in multiple dimensions according to a preset rule system. The preset rule system includes classification libraries of different dimensions. Each classification library has its own set of rules. Each rule in the set of rules contains a classification name, a matching priority, and matching characters for the matching items.

3. The data security behavior auditing method based on field classification adapter according to claim 2, characterized in that: The first processing layer performs multi-dimensional classification processing on the document operation logs, including the following steps: Based on the matching items in each category library, extract the content corresponding to the matching items in the document operation log; The contents of matching items from the same category library are concatenated, and a hash operation is performed on the concatenated string to obtain the cache key corresponding to each dimension; Query the classification result corresponding to each cache key in the local cache, wherein the local cache stores the mapping relationship between frequently accessed cache keys and classification results; If the cache key corresponding to a certain dimension category is matched, the classification result of that dimension category is returned, and the subsequent processing layer for that dimension category is skipped. If the cache key lookup for a certain category fails, the default category result corresponding to the category failure will be output.

4. The data security behavior auditing method based on field classification adapter according to claim 2, characterized in that: The second processing layer performs multi-dimensional classification processing on the document operation logs, including the following steps: Based on the matching items in each category library, extract the content corresponding to the matching items in the document operation log; Based on string comparison, the content corresponding to the matching item is matched with the matching characters in each rule in the corresponding classification library; For each dimension classification library, select the rule with the highest matching priority from all successfully matched rules, and output the classification name in that rule as the classification result for that dimension; if there is no successfully matched rule, the classification for that dimension fails, and output the default classification result corresponding to the classification failure.

5. The data security behavior auditing method based on field classification adapter according to claim 2, characterized in that: The third processing layer performs multi-dimensional classification processing on the document operation logs, including the following steps: For each dimension classification library, the matching characters containing wildcards in the rules are converted into equivalent regular expression strings; The converted regular expression string is pre-compiled and cached to obtain a pre-compiled regular expression string; Based on the matching items in each category library, extract the content corresponding to the matching items in the document operation log; Match the content corresponding to the matched item with the cached pre-compiled regular expression string; For each dimension classification library, select the rule with the highest matching priority from all successfully matched rules, and output the classification name in that rule as the classification result for that dimension; if there is no successfully matched rule, the classification for that dimension fails, and output the default classification result corresponding to the classification failure.

6. The data security behavior auditing method based on field classification adapter according to claim 2, characterized in that: The field classification adapter also includes a fourth processing layer, which performs multi-dimensional classification processing on the document operation log based on the trained classification model; the computational complexity of the fourth processing layer is greater than that of the third processing layer.

7. The data security behavior auditing method based on field classification adapter according to claim 6, characterized in that: The fourth processing layer performs multi-dimensional classification processing of document operation logs, including the following steps: Extract the content corresponding to the matching items in the document operation log and construct a unified feature vector of the corresponding dimension; The unified feature vector is input into the trained classification model. The classification model outputs the confidence probability of each category in this dimension. If the highest confidence probability is lower than the confidence threshold, the classification result of this dimension is the default classification result corresponding to the classification failure. Otherwise, the category corresponding to the highest confidence probability is taken as the classification result of this dimension.

8. The data security behavior auditing method based on field classification adapter according to claim 4 or 5, characterized in that: Each rule in the rule set contains multiple matching items. When a matching item is successfully matched, the rule is considered to be successfully matched. There is a preset matching order among the matching items of the rule. During the classification of document operation logs, matching is performed according to the preset matching order, and if the current matching item is successfully matched, the matching process of the next matching item will not be executed.

9. The data security behavior auditing method based on field classification adapter according to claim 2, characterized in that: The preset rule system includes any one or more of the following: process classification library, document classification library, network communication classification library, file source classification library, and operation time classification library; The matching items for each rule in the process classification library include the process name and the process path; The matching items for each rule in the document classification library include a set of extensions, path features, and file keywords; The matching items for each rule in the network communication classification library include CIDR address range, domain name characteristics, and specified port; The matching items for each rule in the file source classification library include path prefix, mount point, and device identifier; The matching items for each rule in the operation time classification library include weekday matching and time interval matching.

10. A data security behavior auditing system based on a field classification adapter, characterized in that, The data security behavior auditing method based on a field classification adapter, applied to any one of claims 1-9, includes: The data acquisition module is used to collect and process the terminal's document operation logs; A field classification adapter is used to perform multi-level progressive classification processing on processed document operation logs to obtain classification results in different dimensions. The field classification adapter contains several sequentially connected processing layers. Each processing layer can perform multi-dimensional classification processing on the document operation logs. The classification dimensions processed by each processing layer are the same. Among any two adjacent processing layers, the computational complexity of the later processing layer is higher than that of the earlier processing layer. The multi-level progressive classification processing is as follows: when a certain dimension is successfully classified in the classification processing of any processing layer, the classification result of that dimension is output, and the classification processing of that dimension in subsequent processing layers is stopped; otherwise, the classification processing of the dimension is carried out in the next processing layer. The fusion module is used to merge classification results from different dimensions to obtain multi-dimensional classification labels for document operation logs; The storage module is used to establish and store the mapping relationship between document operation logs and their multi-dimensional classification tags.

Images