Data encryption detection method and device, electronic equipment and storage medium

Abstract

The invention provides a data encryption detection method and device, electronic equipment and a storage medium, relates to the technical field of data encryption detection, and is used for accurately determining whether various types of data are encrypted or not. The method comprises the following steps: acquiring to-be-detected data; extracting a plurality of evaluation features of the to-be-detected data; the plurality of evaluation features comprise: the information entropy feature is used for representing the random degree of the to-be-detected data; the coding length feature is used for representing the deviation between the actual coding length of the to-be-detected data and the theoretical coding length corresponding to the coding type of the to-be-detected data; the field semantic association feature is used for representing a matching condition of the to-be-detected data and the encrypted keyword; performing weighted fusion on the plurality of evaluation features, and determining an encryption score of the to-be-detected data; the encryption score is used for representing the probability that the to-be-detected data is encrypted data; and determining whether the to-be-detected data is encrypted data or plaintext data based on a comparison result of the encryption score of the to-be-detected data and a preset threshold value.

Description

Technical Field

[0001] This application relates to the field of data encryption detection technology, and in particular to a data encryption detection method, apparatus, electronic device and storage medium. Background Technology

[0002] With data security becoming increasingly important and privacy protection demands constantly rising, data encryption has become a fundamental security measure in many fields. However, in the entire chain of data collection, transmission, storage, and retrieval, data that should be encrypted is often leaked in plaintext due to reasons such as omissions in the encryption process, incorrect algorithm configuration, and human error. Therefore, it is essential to check whether the data is encrypted before it is sent.

[0003] Currently, there are solutions that use transmission protocols to analyze network traffic packets to determine whether data is encrypted, but this cannot be adapted to other types of data; there are also solutions that use character distribution to determine whether data is encrypted, but this is prone to misinterpreting compressed data or random strings as ciphertext.

[0004] Therefore, a solution is needed that can accurately determine whether various types of data have been encrypted. Summary of the Invention

[0005] This application provides a data encryption detection method, apparatus, electronic device, and storage medium for accurately detecting whether various types of data have been encrypted.

[0006] To achieve the above objectives, this application adopts the following technical solution: Firstly, this application provides a data encryption detection method, including: Acquire the data to be tested; Extract multiple evaluation features from the data to be detected; these features include information entropy, encoding length, and field semantic association; information entropy is used to characterize the randomness of the data to be detected; encoding length is used to characterize the deviation between the actual encoding length of the data to be detected and the theoretical encoding length corresponding to the encoding type of the data to be detected; field semantic association is used to characterize the matching between the data to be detected and the encrypted keywords. Multiple evaluation features are weighted and fused to determine the encryption score of the data to be detected; the encryption score is used to characterize the probability that the data to be detected is encrypted. Based on the comparison between the encryption score of the data to be detected and the preset threshold, the data to be detected is determined to be either encrypted data or plaintext data.

[0007] The technical solution provided in this application brings at least the following beneficial effects: For various types of data to be detected, multiple evaluation features are extracted. These features are then weighted and fused, and compared with a preset threshold to determine whether the data is plaintext or encrypted. The detection process does not distinguish between data types and can adapt to more scenarios.

[0008] Multiple evaluation features, including information entropy, encoding length, and field semantic association, are used to determine whether data is encrypted. Information entropy assesses the randomness of the data, encoding length determines whether it's encrypted based on the actual encoding length versus the theoretical encoding length, and field semantic association determines whether it matches encrypted keywords. This multi-dimensional feature fusion avoids issues like misidentifying high-entropy plaintext as encrypted based on a single feature, effectively distinguishing between true ciphertext and high-entropy plaintext. Furthermore, by using field semantic association features, it can account for cases where the data matches encrypted keywords but the actual content is plaintext, improving the accuracy of data encryption detection.

[0009] Furthermore, this application adopts a decision-making model of "weighted fusion → generating encrypted scores → threshold comparison," which not only quantifies the probability of whether the data is encrypted, making it easier for users to analyze, but also allows for adjustments to weights and thresholds to adapt to different security level requirements and situations where new encryption algorithms emerge. The overall calculation logic is quite flexible.

[0010] Optionally, the method further includes: determining the data to be detected as plaintext data if the data to be detected meets the preset plaintext conditions; extracting multiple evaluation features of the data to be detected, including: extracting multiple evaluation features of the data to be detected if the data to be detected does not meet the preset plaintext conditions; wherein the preset plaintext conditions include at least one of the following: the original byte length of the initial data ontology of the data to be detected is less than a preset length; the initial data ontology is used to characterize the payload portion of the data to be detected that carries business information; and the initial data ontology matches any rule in the preset plaintext regular expression rule base.

[0011] Optionally, multiple evaluation features are extracted from the data to be tested, including: decoding the initial data ontology into a target data ontology in binary format based on the encoding type of the data to be tested, and determining the information entropy feature based on the target data ontology; the initial data ontology is used to characterize the payload portion of the data to be tested that carries business information; determining the encoding length feature based on the deviation between the actual encoding length and the theoretical encoding length of the initial data ontology; the theoretical encoding length is determined based on the encoding type of the data to be tested; matching the field names of the data to be tested with keywords in the encrypted keyword library, and determining the semantic association features of the fields based on the obtained semantic matching results.

[0012] Optionally, the evaluation features also include a basic length feature and a format regularity feature; the basic length feature is used to characterize the original byte length of the initial data ontology of the data to be tested before it is encoded; the initial data ontology is used to characterize the payload portion of the data to be tested that carries business information; and the format regularity feature is used to characterize the degree of matching between the initial data ontology and the standard encoding format.

[0013] Optionally, multiple evaluation features of the data to be detected are extracted, including: decoding the initial data ontology into a target data ontology in binary format based on the encoding type of the data to be detected; determining the basic length feature based on the total number of bytes of the target data ontology; matching the initial data ontology with the standard encoding format in the preset standard encoding format library to obtain the format matching result; and determining the format regularity feature based on the format matching result.

[0014] Optionally, multiple evaluation features of the data to be detected are extracted, including: extracting multiple evaluation features of the data to be detected when no preset algorithm identifier is detected in the data to be detected, or when the preset algorithm identifier is detected in the data to be detected and the data to be detected does not conform to the target algorithm format; the target algorithm format corresponds to the preset algorithm identifier; the method further includes: when the preset algorithm identifier is detected in the data to be detected and the data to be detected conforms to the target algorithm format, determining that the data to be detected is encrypted data encrypted by the target algorithm corresponding to the preset algorithm identifier.

[0015] Optionally, multiple evaluation features are weighted and fused to determine the encrypted score of the data to be detected, including: determining the weight coefficients corresponding to each of the multiple evaluation features based on the analytic hierarchy process; for each evaluation feature, determining the feature score corresponding to the evaluation feature based on the evaluation feature and the weight coefficient corresponding to the evaluation feature; and summing the feature scores corresponding to multiple evaluation features to obtain the encrypted score of the data to be detected.

[0016] Secondly, this application provides a data encryption detection device, comprising: The acquisition module is used to acquire the data to be detected. The processing module is used to extract multiple evaluation features from the data to be detected. These features include information entropy, encoding length, and field semantic association. The information entropy feature is used to characterize the randomness of the data to be detected. The encoding length feature is used to characterize the deviation between the actual encoding length of the data to be detected and the theoretical encoding length corresponding to the encoding type of the data to be detected. The field semantic association feature is used to characterize the matching between the data to be detected and the encrypted keywords. The processing module is also used to perform weighted fusion of multiple evaluation features to determine the encryption score of the data to be detected; the encryption score is used to characterize the probability that the data to be detected is encrypted data; The processing module is also used to determine whether the data to be detected is encrypted or plaintext based on the comparison result between the encryption score of the data to be detected and the preset threshold.

[0017] Thirdly, this application provides an electronic device, including: a processor and a memory; the memory is used to store computer execution instructions, the processor is connected to the memory, and when the electronic device is running, the processor executes the computer execution instructions stored in the memory to cause the electronic device to perform any of the above-mentioned data encryption detection methods.

[0018] Fourthly, this application provides a computer-readable storage medium storing computer instructions that, when executed on a computer, cause the computer to perform any of the aforementioned data encryption detection methods.

[0019] Fifthly, this application provides a computer program product containing computer execution instructions, which, when run on a computer, causes the computer to execute any of the aforementioned data encryption detection methods.

[0020] In the specific implementation of this application, the names of the components of the aforementioned device do not limit the device itself. In actual implementation, these components may appear under other names. As long as the function of each component is similar to the specific implementation of this application, it falls within the scope of the claims of this application and its equivalents.

[0021] Furthermore, the technical effects of any of the design methods in aspects two through five can be found in the technical effects of the different design methods in aspect one above, and will not be repeated here. Attached Figure Description

[0022] Figure 1 A flowchart illustrating a data encryption detection method provided in an embodiment of this application; Figure 2 This is a schematic diagram of the structure of a data encryption detection device provided in an embodiment of this application; Figure 3 A schematic diagram of the hardware structure of an electronic device provided in an embodiment of this application; Figure 4 This is a schematic diagram of the hardware structure of another electronic device provided in an embodiment of this application. Detailed Implementation

[0023] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0024] In the description of this application, unless otherwise stated, "a plurality of" means two or more.

[0025] In the embodiments of this application, the terms "exemplary" or "for example" are used to indicate that something is an example, illustration, or description. Any embodiment or design that is described as "exemplary" or "for example" in the embodiments of this application should not be construed as being more preferred or advantageous than other embodiments or designs. Specifically, the use of the terms "exemplary" or "for example" is intended to present the relevant concepts in a specific manner.

[0026] As described in the background section, current methods for detecting whether data is encrypted are not accurate enough and have limited application scenarios.

[0027] To address the aforementioned issues, this application provides a data encryption detection method, comprising: acquiring data to be detected; extracting multiple evaluation features from the data to be detected; the multiple evaluation features include information entropy features, encoding length features, and field semantic association features; the information entropy feature is used to characterize the randomness of the data to be detected; the encoding length feature is used to characterize the deviation between the actual encoding length of the data to be detected and the theoretical encoding length corresponding to the encoding type of the data to be detected; the field semantic association feature is used to characterize the matching situation between the data to be detected and encrypted keywords; weightedly fusing the multiple evaluation features to determine the encryption score of the data to be detected; the encryption score is used to characterize the probability that the data to be detected is encrypted data; and based on the comparison result between the encryption score of the data to be detected and a preset threshold, determining whether the data to be detected is encrypted data or plaintext data.

[0028] For various types of data to be detected, multiple evaluation features are extracted. These features are then weighted and fused, and compared with a preset threshold to determine whether the data is plaintext or encrypted. The detection process does not distinguish between data types and can adapt to more scenarios.

[0029] Multiple evaluation features, including information entropy, encoding length, and field semantic association, are used to determine whether data is encrypted. Information entropy assesses the randomness of the data, encoding length determines whether it's encrypted based on the actual encoding length versus the theoretical encoding length, and field semantic association determines whether it matches encrypted keywords. This multi-dimensional feature fusion avoids issues like misidentifying high-entropy plaintext as encrypted based on a single feature, effectively distinguishing between true ciphertext and high-entropy plaintext. Furthermore, by using field semantic association features, it can account for cases where the data matches encrypted keywords but the actual content is plaintext, improving the accuracy of data encryption detection.

[0030] Furthermore, this application adopts a decision-making model of "weighted fusion → generating encrypted scores → threshold comparison," which not only quantifies the probability of whether the data is encrypted, making it easier for users to analyze, but also allows for adjustments to weights and thresholds to adapt to different security level requirements and situations where new encryption algorithms emerge. The overall calculation logic is quite flexible.

[0031] The data encryption detection method provided in this application can be applied to electronic devices, which are used to detect whether the data to be detected is encrypted or plaintext data.

[0032] Specifically, the electronic device acquires the data to be detected and extracts multiple evaluation features from the data. These features include information entropy, encoding length, and field semantic association. The information entropy feature characterizes the randomness of the data; the encoding length feature characterizes the deviation between the actual encoding length of the data and the theoretical encoding length corresponding to the encoding type; and the field semantic association feature characterizes the matching between the data and encrypted keywords. The multiple evaluation features are then weighted and fused to determine the encryption score of the data. The encryption score characterizes the probability that the data is encrypted. Finally, based on the comparison between the encryption score and a preset threshold, the data is determined to be either encrypted or plaintext.

[0033] In some embodiments, the electronic device can detect the data to be detected after it is generated but before it is sent out. If the data to be detected meets the encryption requirements (e.g., encryption is required and the data to be detected is actually encrypted; or, for example, no encryption is required and the data to be detected is actually plaintext), then the electronic device can control the data to be detected to be sent out.

[0034] In some embodiments, the electronic device detects historically generated data to be detected and evaluates the effectiveness of the device's encryption of the data based on the detection results.

[0035] In some embodiments, the electronic device preprocesses the data to be detected to obtain metadata such as the initial data ontology, associated attributes, and data source.

[0036] In some embodiments, the electronic device first determines whether the data to be detected meets the preset plaintext conditions. For the data to be detected that does not meet the preset plaintext conditions, evaluation features are extracted. For the data to be detected that meets the preset plaintext conditions, the detection result is directly output as plaintext data.

[0037] In some embodiments, the electronic device collects the detection results of the data to be detected and iteratively updates the feature library (e.g., regular expression library, keyword library, encoding format rule library, etc.) and weight coefficients used in the detection process.

[0038] Based on the above description, the electronic device may specifically include a preprocessing module, a plaintext filtering module, a feature extraction module, a weighted calculation module, a result determination module, an iterative update module, and a storage module. The preprocessing module preprocesses the data to be detected, extracting metadata such as the initial data ontology, associated attributes, and data source. The plaintext filtering module determines whether the data to be detected meets preset plaintext conditions, quickly filtering out explicit plaintext data. The feature extraction module extracts multiple evaluation features of the data to be detected in parallel. The weighted calculation module calculates the score of each evaluation feature and the encryption score of the data to be detected based on the weight coefficients corresponding to the evaluation features. The result determination module determines whether the data to be detected is encrypted or plaintext based on the comparison between the encryption score and a preset threshold, and also outputs the detection results, generates a feature contribution report, and records the detection log. The iterative update module collects detection cases and iteratively updates the feature library (e.g., regular expression library, keyword library, encoding format rule library, etc.) and weight coefficients used in the detection process. The storage module stores the feature library, weight coefficients, and other data used in the detection process.

[0039] Electronic devices can perform encrypted detection on data to be tested from multiple different devices.

[0040] In some embodiments, the electronic device and the device that generates the data to be detected may be independent of each other, or the electronic device may be the same device that generates the data to be detected.

[0041] In some embodiments, the electronic device may specifically be a computer, server, server cluster, or other device with data processing capabilities. This application does not limit the specific implementation of the electronic device.

[0042] The data encryption detection method provided in the embodiments of this application will be described in detail below with reference to the accompanying drawings.

[0043] Figure 1 This is a flowchart illustrating a data encryption detection method provided in an embodiment of this application, which can be executed by the aforementioned electronic device. The method includes: S101. Obtain the data to be detected.

[0044] The data to be detected is either encrypted or plaintext data. For example, if images, videos, text, audio, etc., from device A need to be transmitted to device B, device A encrypts and / or encodes the binary data representing this content to obtain the transmission data, and then transmits the data to device B. The data to be detected obtained in this application is the aforementioned transmission data. Encryption detection is performed on the transmission data to determine whether it is encrypted or plaintext data.

[0045] In some embodiments, the data to be detected contains relevant information. After the data to be detected is acquired and before subsequent processing is performed, the electronic device performs preprocessing operations on the data to be detected to obtain the initial data ontology, associated attributes and data source of the data to be detected.

[0046] The initial data ontology is used to characterize the payload portion of the data to be detected that carries business information. Specifically, the initial data ontology can be database field values, API parameter values, network traffic payloads, file content, etc. For example, if device A wants to send a message "xxxxxx" to device B, and the final data to be detected generated by device A is "XYZ", where "X" actually represents "xxxxxx", then "X" in the data to be detected is the initial data ontology. The format of the initial data ontology can be binary or text; this application embodiment does not limit this.

[0047] Association attributes are used to characterize the format and identifier of the content of the data to be detected. Association attributes include field names (or data identifiers) and encoding types. For example, if the data to be detected contains a descriptive message, the electronic device can perform keyword segmentation on this descriptive message to obtain the field names.

[0048] For example, if the data to be detected contains an encoding type identifier, the electronic device obtains the encoding type identifier by parsing the data to be detected, and determines the encoding type corresponding to the identifier as the encoding type of the data to be detected. The encoding type can be Base64, Hex, UTF-8, GBK, etc., and this application embodiment does not limit this.

[0049] The data source is used to characterize the origin of the data to be detected. The data source can represent database data, API data, network traffic, local files, etc. For example, the data source can be a device identifier; based on the device identifier, it can be determined which device generated or sent the data to be detected.

[0050] For example, the data to be detected is in Network Abstraction Layer Unit (NALU) format, which includes a NALU header and a raw byte sequence payload (RBSP). The RBSP corresponds to the initial data body. Information such as the field names, encoding type, and data source of the data to be detected is stored in the NALU header. The electronic device obtains the associated attributes and data source of the data to be detected by parsing the NALU header.

[0051] Optionally, the data to be tested may only contain the payload portion of the business information it carries, and the electronic device may obtain information such as the association attributes and data source of the data to be tested that are unrelated to the payload portion from the device that sent the data to be tested.

[0052] S102. Extract multiple evaluation features from the data to be detected.

[0053] Among them, several evaluation features include information entropy features, encoding length features, and field semantic association features.

[0054] In some embodiments, the multiple evaluation features may also include a base length feature and a format regularity feature.

[0055] 1. Information entropy features are used to characterize the randomness of the data to be detected.

[0056] Encryption algorithms aim to produce outputs indistinguishable from random sequences; that is, the encrypted ciphertext should possess a high degree of randomness. Therefore, the byte distribution of the encrypted data should be close to a uniform distribution, resulting in a high information entropy. For example, the information entropy of the encrypted data is close to 8 because a single byte has 256 possible values, and the entropy is 8 when uniformly distributed.

[0057] Unencrypted plaintext usually has specific structures and characteristics, such as natural language text, JSON, XML, etc., whose byte distribution is uneven, and certain characters (such as spaces, letters, etc.) appear frequently, thus resulting in low entropy values.

[0058] Therefore, the degree of randomness of the data to be detected can be used to evaluate whether the data is encrypted.

[0059] 2. The coding length feature is used to characterize the deviation between the actual coding length of the data to be detected and the theoretical coding length corresponding to the coding type of the data to be detected.

[0060] Encrypted data typically undergoes two transformations from generation to detection: ① Encryption transformation (plaintext is converted into binary ciphertext using an encryption algorithm); ② Encoding transformation (binary ciphertext is converted into storable / transmittable text using an encoding algorithm). Encryption algorithms require data to be processed in fixed block sizes (e.g., 16 bytes for AES encryption). Therefore, the length of the binary ciphertext is an integer multiple of the block size. Encoding algorithms also expand binary data into text according to fixed mathematical relationships. For example, Base64 encoding converts every 3 bytes of binary data into 4 bytes of text (expansion factor = 1 / 2). Hex encoding converts each byte of binary data into 2 bytes of text (with an inflation factor of 2).

[0061] The theoretical encoding length is the calculated result of the data transformation process (encryption and encoding) on ​​the length of the transformed data. For example, a piece of original data, after being encrypted using the AES encryption algorithm, has a binary ciphertext length of... (It must be a multiple of 16), and after Base64 encoding, the theoretical encoding length should be... Therefore, the final length of data encrypted with AES and encoded with Base64 must strictly conform to... This limitation, such as 24, 44, 64... bytes.

[0062] The actual encoded length is obtained by directly measuring the number of bytes in the initial data text (text string).

[0063] Therefore, the deviation between the actual encoding length and the theoretical encoding length can characterize whether the data size is accurate, and evaluate whether the data to be detected is encrypted data from the perspective of data structure.

[0064] 3. Field semantic association features are used to characterize the matching situation between the data to be detected and the encrypted keywords.

[0065] During development, developers typically assign descriptive names to fields storing sensitive or encrypted data to facilitate understanding and maintenance. Some policies also require field names to include encryption-related keywords. This way, the data to be inspected contains pre-declared information relevant to business processes.

[0066] Matching results can specifically include the number of matches, the matching ratio, and the matching frequency. For example, if the field name of the data to be tested matches three encrypted keywords, the matching result is 3.

[0067] If the data to be tested highly matches the encrypted keywords, it is highly likely that the data has been encrypted by the encryption algorithm. Therefore, the matching situation between the data to be tested and the encrypted keywords can be used to evaluate whether the data to be tested is encrypted from the perspective of "pre-declaration of data".

[0068] 4. The basic length feature is used to characterize the original byte length of the initial data body of the data to be detected before it is encoded.

[0069] The length of the encrypted binary ciphertext must be an integer multiple of the algorithm block size; this is the length constraint imposed on the data by the encryption transformation.

[0070] Therefore, the length of the original bytes can be used to evaluate whether the data to be detected is encrypted from the perspective of "encrypted data length".

[0071] 5. The format regularity feature is used to characterize the degree of matching between the initial data ontology and the standard encoding format.

[0072] Encrypted data, after undergoing standardized encoding, presents a highly regular syntax format, a regularity that is extremely difficult to achieve with naturally generated plaintext or random data.

[0073] Therefore, the degree of matching between the initial data ontology and the standard encoding format can be used to evaluate whether the data to be tested is encrypted from the perspective of "data integrity".

[0074] For the above-mentioned multiple evaluation features, step S102 can be specifically implemented as follows: 1. Based on the encoding type of the data to be detected, the initial data ontology is decoded into a target data ontology in binary format, and the information entropy feature is determined based on the target data ontology.

[0075] Specifically, the Shannon entropy formula can be used to calculate the byte distribution entropy of the target data ontology, and the byte distribution entropy of the target data ontology can be determined as the information entropy feature. The calculation formula is as follows: ; in, Let be the frequency of occurrence of the i-th byte (0-255) in the target data body.

[0076] The Shannon entropy formula measures the average uncertainty or surprise of symbols produced by an information source. When the data is completely random (ideal ciphertext), the value of each byte... ≈ The calculated entropy value H ≈ -256 × ( ×log2( =log2(256)=8, which is the maximum value of entropy. When the data has a pattern (typical plaintext), certain byte values ​​appear frequently ( Larger), some rarely occur ( (close to 0), because Due to the non-uniformity of the text, the summed entropy value H will be significantly less than 8. The stronger the regularity, the lower the entropy value. For example, the entropy value of an English text is usually between 4 and 5, while the entropy value of pure ASCII encoded XML or JSON may be even lower.

[0077] 2. Determine the coding length feature based on the deviation between the actual coding length and the theoretical coding length of the initial data ontology; the theoretical coding length is determined based on the coding type of the data to be detected.

[0078] For example, the theoretical ciphertext length of Base64 encoding = original byte length × Round up to the nearest integer.

[0079] The deviation between the actual coding length and the theoretical coding length can be characterized by the ratio between the actual coding length and the theoretical coding length.

[0080] Optionally, the deviation between the actual coding length and the theoretical coding length can be characterized by the ratio between the difference between the actual coding length and the theoretical coding length and the actual coding length (or the theoretical coding length).

[0081] 3. Match the field names of the data to be detected with the keywords in the encrypted keyword library, and determine the semantic association features of the fields based on the obtained semantic matching results.

[0082] For example, the encryption keyword library may include Chinese keywords and / or English keywords, such as "encrypt", "cipher", "secret", "key", "ciphertext", "encryption", "key", "secure", etc.

[0083] Matching the field names of the data to be tested with keywords in the encryption keyword library can specifically be done using fuzzy matching, which is based on the string edit distance algorithm. The distance between two words is calculated using the string edit distance algorithm; a match is considered successful if the distance is less than a preset value. Fuzzy matching can tolerate spelling errors, abbreviations, and mixed Chinese and English words (e.g., encrt_pwd can still match encrypt).

[0084] Semantic matching results can include the number of matches, the matching ratio, etc. For example, the semantic matching result can be the number of matches, such as "matched 2 keywords", "matched 1 keyword", or "no match".

[0085] Optionally, the encrypted keyword library corresponds to the data source of the data to be detected.

[0086] 4. Based on the encoding type of the data to be detected, decode the initial data ontology into a target data ontology in binary format; based on the total number of bytes in the target data ontology, determine the basic length feature.

[0087] Before decoding the initial data ontology into binary format, first determine whether the initial data ontology is in binary format. If it is, perform format conversion; otherwise, directly determine the initial data ontology as the target data ontology.

[0088] 5. Match the initial data ontology with the standard encoding formats in the preset standard encoding format library to obtain the format matching results; based on the format matching results, determine the format regularity characteristics.

[0089] For example, a preset standard encoding format library may include Base64 encoding format, Hex encoding format, etc. For instance, the Base64 encoding format includes a character set of "AZ, az, 0-9, +, / ", with 1-2 equal signs at the end. Another example is the Hex encoding format, which includes a character set of "0-9, AF, af", with no other special characters.

[0090] In summary, Table 1 below provides examples of how encryption algorithms constrain one or more of the five evaluation features mentioned above: Table 1 Examples of restrictions on evaluation features in encryption algorithms

[0091] S103. Perform weighted fusion of multiple evaluation features to determine the encrypted score of the data to be detected.

[0092] The encryption score is used to characterize the probability that the data to be detected is encrypted data.

[0093] In some embodiments, step S103 can be specifically implemented as follows: determining the weight coefficients corresponding to each of the multiple evaluation features based on the analytic hierarchy process; for each evaluation feature, determining the feature score corresponding to the evaluation feature based on the evaluation feature and the weight coefficients corresponding to the evaluation feature; summing the feature scores corresponding to the multiple evaluation features to obtain the encrypted score of the data to be detected.

[0094] The Analytic Hierarchy Process (AHP) is a structured, quantitative, multi-criteria decision-making method used to determine the relative weights of various influencing factors in complex decision-making.

[0095] The weight coefficients for each of the multiple evaluation features are determined using the analytic hierarchy process (AHP). Specifically, this can be achieved by: By comparing the importance of multiple evaluation features pairwise, a 1-9 scale is used for quantitative scoring: 1 indicates that both are equally important, 3 indicates that the former is slightly more important than the latter, 5 indicates that the former is significantly more important than the latter, 7 indicates that the former is strongly more important than the latter, and 9 indicates that the former is extremely more important than the latter. 2, 4, 6, and 8 are the median values ​​for the aforementioned adjacent judgments. For example, if the information entropy feature is significantly more important than the field semantic association feature, then the importance ratio of the information entropy feature relative to the field semantic association feature is scored 5, and the importance ratio of the field semantic association feature relative to the information entropy feature is scored 1. .

[0096] This method determines the importance ratio score between any two evaluation features, resulting in a judgment matrix. This judgment matrix is ​​then subjected to a consistency test, which checks whether the importance ratio scores between any two evaluation features are logically consistent. For example, if A is more important than B, and B is more important than C, then A should be more important than C.

[0097] The consistency of the judgment matrix can be checked using the consistency ratio (CR). If the CR is less than a preset value (typically 0.1), the judgment matrix is ​​considered acceptable; otherwise, it is recalculated. Once the judgment matrix passes the consistency check, the weight coefficient of each evaluation feature can be calculated based on it.

[0098] The weighting coefficients calculated using the analytic hierarchy process (AHP) can vary depending on the scenario. For example, in the case of encrypting database field data, the weighting coefficients for semantic association features of fields are relatively large, while in the case of encrypting network traffic, encoding length features and format regularity features may be more effective, and their corresponding weighting coefficients are larger.

[0099] Taking a score of 0-100 for each evaluation feature as an example, the scoring rules for each evaluation feature are shown in Table 2 below: Table 2 Individual Scoring Rules

[0100] Taking multiple evaluation features, including the above five evaluation features, with the weight coefficients of information entropy feature, encoding length feature, field semantic association feature, basic length feature and format regularity feature being 40%, 25%, 15%, 10%, and 10% respectively, as an example, the encryption score calculation formula for the data to be detected is: Encryption score = Information entropy feature score × 40% + Encoding length feature score × 25% + Field semantic association feature score × 15% + Basic length feature score × 10% + Format regularity feature score × 10%.

[0101] Optionally, the weight corresponding to the information entropy feature is greater than the weight coefficient corresponding to other evaluation features, and the other evaluation features are any evaluation features other than the information entropy feature among multiple evaluation features.

[0102] When evaluation features are used individually, this application employs weighted fusion of multiple evaluation features to mutually correct misjudgments and omissions caused by a single evaluation feature, reducing the false alarm rate and enabling more accurate detection of whether data is encrypted. Multiple evaluation features assess the data to be detected from different perspectives, making it applicable to various encryption scenarios. Even if one evaluation feature fails in certain situations, other features can still function, achieving more robust encryption data detection.

[0103] S104. Based on the comparison result between the encryption score of the data to be detected and the preset threshold, determine whether the data to be detected is encrypted data or plaintext data.

[0104] Specifically, if the encryption score of the data to be detected is greater than or equal to a preset threshold, the data to be detected is determined to be encrypted data; if the encryption score of the data to be detected is less than the preset threshold, the data to be detected is determined to be plaintext data.

[0105] For example, assuming the preset threshold is 80 points, if the encryption score of the data to be detected is ≥80, the detection result of the data to be detected is "encrypted data"; if the encryption score of the data to be detected is <80, the detection result of the data to be detected is "plaintext data".

[0106] In some embodiments, the electronic device outputs a detailed report of the detection results along with the detection results. For example, when the detection result is "encrypted data," a feature contribution report is generated and output simultaneously (e.g., "Information entropy feature score 90 (information entropy feature corresponding to a weight coefficient of 40%), encoding length feature score 100 (encoding length feature corresponding to a weight coefficient of 25%), field semantic association feature score 100 (field semantic association feature corresponding to a weight coefficient of 15%), and is comprehensively determined to be encrypted data"). As another example, when the detection result is "plaintext data," the device outputs a detection result and indicates key areas where points were deducted (e.g., "Information entropy feature score 50 (information entropy feature corresponding to a weight coefficient of 40%), encoding length feature score 12 (encoding length feature corresponding to a weight coefficient of 25%), field semantic association feature score 8 (field semantic association feature corresponding to a weight coefficient of 15%), and is comprehensively determined to be plaintext data").

[0107] In some embodiments, different preset thresholds can be set for different application scenarios. For example, the preset threshold for high-security financial scenarios can be set to 85 points, while the preset threshold for other scenarios can be set to 75 points.

[0108] In some embodiments, after the detection of the data to be detected is completed, the final detection results, evaluation features, weight coefficients, encrypted scores and other data calculated during the detection process are collected and recorded in the form of logs.

[0109] The electronic device can also periodically receive actual user verification cases and manual annotation results.

[0110] Based on logs and / or periodically received user verification cases and manual annotation results, one or more of the aforementioned preset plaintext conditions, encrypted keyword library, and weight coefficients can be iteratively optimized. For example, after iterative optimization, the preset plaintext regular expression rule library in the preset plaintext conditions may add plaintext regular expressions (such as new business field formats), delete regular expressions with low matching rates, and supplement regular expressions for high-frequency plaintext scenarios. Another example is the addition of encrypted keywords to the iteratively optimized encrypted keyword library, such as industry-specific terms like "pin_encrypt" and "sensitive information encryption." Yet another example is the addition of multiple standard encoding formats to the iteratively optimized preset standard encoding format library. Furthermore, the AHP judgment matrix can be retrained and calculated based on logs and / or periodically received user verification cases and manual annotation results to obtain updated weight coefficients. Finally, the length threshold can be updated to adapt to the ciphertext features of new encryption algorithms (such as SM4).

[0111] Figure 1 The technical solution shown brings at least the following beneficial effects: For various types of data to be detected, multiple evaluation features are extracted. These features are then weighted and fused, and compared with a preset threshold to determine whether the data is plaintext or encrypted. The detection process does not distinguish between data types and can adapt to more scenarios.

[0112] Multiple evaluation features, including information entropy, encoding length, and field semantic association, are used to determine whether data is encrypted. Information entropy assesses the randomness of the data, encoding length determines whether it's encrypted based on the actual encoding length versus the theoretical encoding length, and field semantic association determines whether it matches encrypted keywords. This multi-dimensional feature fusion avoids issues like misidentifying high-entropy plaintext as encrypted based on a single feature, effectively distinguishing between true ciphertext and high-entropy plaintext. Furthermore, by using field semantic association features, it can account for cases where the data matches encrypted keywords but the actual content is plaintext, improving the accuracy of data encryption detection.

[0113] Furthermore, this application adopts a decision-making model of "weighted fusion → generating encrypted scores → threshold comparison," which not only quantifies the probability of whether the data is encrypted, making it easier for users to analyze, but also allows for adjustments to weights and thresholds to adapt to different security level requirements and situations where new encryption algorithms emerge. The overall calculation logic is quite flexible.

[0114] In some embodiments, prior to step S102, the data to be detected may also undergo explicit plaintext detection and / or target algorithm encryption detection. These two detection processes may be performed sequentially or in parallel.

[0115] Specifically, the plaintext detection process is as follows: if the data to be detected meets the preset plaintext conditions, the data to be detected is determined to be plaintext data; if the data to be detected does not meet the preset plaintext conditions, then step S102 is executed. The preset plaintext conditions include at least one of the following: the original byte length of the initial data body of the data to be detected is less than a preset length; the initial data body matches any rule in the preset plaintext regular expression rule base.

[0116] The raw byte length of the initial data body refers to its byte length before encoding. Based on the encoding type of the data to be detected, the initial data body is decoded into a target data body in binary format. The total byte length of the target data body is the raw byte length of the initial data body of the data to be detected. For example, if the preset length is 16 bytes, and the raw byte length of the initial data body is less than 16 bytes, the data to be detected can be directly determined as plaintext data.

[0117] Encryption algorithms process data in fixed-size "blocks," with the smallest encryption block (e.g., an AES block) being 16 bytes. Even if only the letter "a" is encrypted, the resulting data length will always be greater than or equal to 16 bytes. Therefore, 16 bytes can be used as a preset length. When the original byte length of the data is less than the preset length, it is almost impossible for it to be valid ciphertext encrypted by the algorithm. Therefore, by filtering the initial data body using the preset length, unencrypted data can be quickly identified.

[0118] Data encryption is typically used for storage or transmission. However, data is usually encoded before being stored or transmitted within a system, and this encoding process can lead to increased data length. Therefore, an encoding length threshold can be set. When the actual encoded length of the initial data body is less than the threshold, it is considered unencoded data. Since unencoded data is unlikely to be encrypted, the data to be detected can be identified as plaintext data.

[0119] For example, the default plaintext regular expression rule base contains multiple rules, as shown in Table 3 below: Table 3 Examples of Preset Plaintext Regular Expression Rules

[0120] The method of using regular expression matching in conjunction with algorithms is suitable for data types that, even if the format is compliant, still require logical validation. Examples include ID card numbers, bank card numbers, and unified social credit codes.

[0121] For example, an ID card number must be 18 digits long, and its regular expression is "a string of 18 digits". If the initial data body does not conform to this regular expression, then it is definitely not an ID card number, and the initial data body is matched against other rules. For those that conform to this regular expression, the corresponding verification algorithm extracts key fields (such as digits 1-6, digits 7-14 of the ID card number), and identifies whether the key fields conform to the generation logic of the ID card number. For example, the key field digits 7-14 represent a person's birth date. If the current year is 2026, and the initial data body detects that digits 7-14 are 35111506, which is interpreted as 35111506, this is clearly inconsistent with the current time. In this case, the verification algorithm corresponding to the ID card number determines that the data to be detected is not an ID card number.

[0122] As another example, the verification algorithm for bank card numbers is the Luhn algorithm, while the verification algorithm for unified social credit codes is the national standard verification code algorithm.

[0123] Data that passes the algorithm verification can be identified as plaintext data. Data that fails the algorithm verification indicates that although the format is similar, it is an invalid number and cannot be simply identified as plaintext data. It then proceeds to step S102 and the subsequent feature determination process.

[0124] Regular expression matching is only suitable for data types with simple formats and high uniqueness, such as phone numbers, IP addresses, and MAC addresses. The initial data body is matched against regular expression rules. If a match is found, the data to be detected is directly determined to be plaintext; otherwise, other regular expression rules are applied to the initial data body.

[0125] In some embodiments, when an electronic device matches the data to be detected against rules in a preset plaintext regular expression rule base, it typically performs a traversal matching process (which can be sequential or parallel). Once any rule is successfully matched, the data to be detected is immediately determined to be plaintext data. Traversal matching eliminates the need to pre-determine the data type of the data to be detected, avoiding missed detections due to derivation errors, and also ensuring that all predefined plaintext rules can be detected.

[0126] Optionally, the electronic device determines the data type of the data to be detected based on the preprocessed metadata, and then matches the data according to the matching rules corresponding to that data type. For example, if the field name of the data to be detected contains "phone," it indicates that the data type of the data to be detected may be a mobile phone number, and the mobile phone number rule will be matched first or only. As another example, if the data source of the data to be detected is identified as an IP address, the IP address rule will be matched first. This allows the matching range to be narrowed using the metadata of the data to be detected.

[0127] In some embodiments, multiple rules in the preset plaintext regular expression rule base are divided into multiple groups, and different groups correspond to different matching priorities.

[0128] Plaintext data typically has a predictable structure. For example, sensitive data or identity data follows specific standards, industry norms, or mathematical rules. For instance, an ID card number is 18 digits long, with the first 17 digits being numbers and the 18th digit being either a number or an "X," and it conforms to the corresponding checksum algorithm. Another example is a mobile phone number, which is 11 digits long and begins with a specific range (such as 13x, 15x, 18x, etc.). Yet another example is an IP address, which consists of four sets of dotted decimal numbers, each ranging from 0 to 255. These rules can be precisely translated into regular expressions and validation algorithms.

[0129] Encrypted data is unpredictable. A well-designed encryption algorithm should output ciphertext that is statistically close to a true random sequence. Therefore, the probability that a random, high-entropy ciphertext string can perfectly match a highly structured plaintext format rule (such as a valid ID number) is extremely low, almost zero.

[0130] Once data perfectly matches a pre-defined plaintext rule, it can be identified as plaintext, not ciphertext, with a very high degree of confidence. This obvious plaintext detection process leverages the contrast between the "strong format regularity" of plaintext data and the "high randomness" of encrypted data. The pre-defined plaintext conditions are features that encrypted data is almost impossible to possess but plaintext data is very likely to have. Therefore, by pre-setting these conditions, data that is clearly plaintext can be quickly detected, avoiding the waste of resources caused by performing subsequent feature calculations on all data, improving data detection efficiency, and meeting real-time detection requirements.

[0131] The target algorithm encryption detection is specifically as follows: if the data to be detected contains a preset algorithm identifier and the data to be detected conforms to the target algorithm format, the data to be detected is determined to be encrypted data encrypted by the target algorithm corresponding to the preset algorithm identifier; the target algorithm format corresponds to the preset algorithm identifier; if the data to be detected does not contain a preset algorithm identifier, or if the data to be detected contains a preset algorithm identifier and the data to be detected does not conform to the target algorithm format, step S102 is executed.

[0132] For example, the specific process of determining whether the data to be tested conforms to the target algorithm format may include: length verification, character set verification, structure verification, and information entropy verification. Length verification checks whether the initial data body of the data to be tested conforms to the length specification of the target algorithm's encryption. For example, the hexadecimal string of the hash value obtained after encryption by the SM3 hash algorithm must be 64 bits. Character set verification verifies whether the data to be tested is composed of a specific character set. For example, the hash value obtained after encryption by the SM3 hash algorithm should consist entirely of 0-9, AF, and af. Structure verification verifies whether the initial data body of the data to be tested contains specific delimiters, header and footer markers, etc. Information entropy verification verifies whether the entropy value of the initial data body of the data to be tested is within a preset entropy value range. For example, the entropy value of the initial data body encrypted by the SM4 encryption algorithm is greater than the preset entropy value (different encryption algorithms correspond to different preset entropy values; for example, the preset entropy value for the SM4 encryption algorithm can be 7.2, and the preset entropy value for the SM3 encryption algorithm can be 7.8). Only when all verification processes pass will the data to be tested be considered to conform to the target algorithm format.

[0133] For data to be detected that contains a preset algorithm identifier, by determining whether the data to be detected conforms to the target algorithm format, it is possible not only to determine whether the data to be detected is encrypted, but also to determine whether the data to be detected is encrypted by the target algorithm corresponding to the preset algorithm identifier.

[0134] Optionally, it can detect whether the data to be detected contains a preset algorithm identifier, specifically by detecting it in the field name or the data body of the data to be detected.

[0135] The foregoing primarily describes the solution provided in this application from a methodological perspective. It is understood that, to achieve the aforementioned functions, it includes corresponding hardware structures and / or software modules for executing each function. Those skilled in the art should readily recognize that, based on the algorithmic steps of the examples described in conjunction with the embodiments disclosed herein, the present invention can be implemented in hardware or a combination of hardware and computer software. Whether a function is executed in hardware or by computer software driving hardware depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of the present invention.

[0136] like Figure 2 The diagram shown is a structural schematic of a data encryption detection device 10 provided in an embodiment of this application. The data encryption detection device 10 includes an acquisition module 101 and a processing module 102.

[0137] The module 101 is used to acquire the data to be detected. The processing module 102 is used to: extract multiple evaluation features from the data to be detected; the multiple evaluation features include information entropy features, encoding length features, and field semantic association features; the information entropy feature is used to characterize the randomness of the data to be detected; the encoding length feature is used to characterize the deviation between the actual encoding length of the data to be detected and the theoretical encoding length corresponding to the encoding type of the data to be detected; the field semantic association feature is used to characterize the matching situation between the data to be detected and the encrypted keywords; the multiple evaluation features are weighted and fused to determine the encryption score of the data to be detected; the encryption score is used to characterize the probability that the data to be detected is encrypted data; based on the comparison result of the encryption score of the data to be detected and a preset threshold, the data to be detected is determined to be encrypted data or plaintext data.

[0138] Optionally, the processing module 102 is further configured to determine that the data to be detected is plaintext data if the data to be detected meets the preset plaintext conditions; specifically, the processing module 102 is configured to extract multiple evaluation features of the data to be detected if the data to be detected does not meet the preset plaintext conditions; wherein, the preset plaintext conditions include at least one of the following: the original byte length of the initial data body of the data to be detected is less than the preset length; the initial data body is used to characterize the payload part of the data to be detected that carries business information; the initial data body matches any rule in the preset plaintext regular expression rule base.

[0139] Optionally, the processing module 102 is specifically used for: decoding the initial data ontology into a target data ontology in binary format based on the encoding type of the data to be detected, and determining the information entropy feature based on the target data ontology; the initial data ontology is used to characterize the payload part of the data to be detected that carries business information; determining the encoding length feature based on the deviation between the actual encoding length and the theoretical encoding length of the initial data ontology; the theoretical encoding length is determined based on the encoding type of the data to be detected; matching the field names of the data to be detected with the keywords in the encrypted keyword library, and determining the semantic association feature of the fields based on the obtained semantic matching result.

[0140] Optionally, the evaluation features also include a basic length feature and a format regularity feature; the basic length feature is used to characterize the original byte length of the initial data ontology of the data to be tested before it is encoded; the initial data ontology is used to characterize the payload portion of the data to be tested that carries business information; and the format regularity feature is used to characterize the degree of matching between the initial data ontology and the standard encoding format.

[0141] Optionally, the processing module 102 is specifically used to: decode the initial data ontology into a target data ontology in binary format based on the encoding type of the data to be detected; determine the basic length feature based on the total number of bytes of the target data ontology; match the initial data ontology with the standard encoding format in the preset standard encoding format library to obtain the format matching result; and determine the format regularity feature based on the format matching result.

[0142] Optionally, the processing module 102 is specifically used to extract multiple evaluation features of the data to be detected when no preset algorithm identifier is detected in the data to be detected, or when the preset algorithm identifier is detected in the data to be detected and the data to be detected does not conform to the target algorithm format; the target algorithm format corresponds to the preset algorithm identifier; the processing module 102 is also used to determine that the data to be detected is encrypted data encrypted by the target algorithm corresponding to the preset algorithm identifier when the preset algorithm identifier is detected in the data to be detected and the data to be detected conforms to the target algorithm format.

[0143] Optionally, the processing module 102 is specifically used to: determine the weight coefficients corresponding to each of the multiple evaluation features based on the analytic hierarchy process; for each evaluation feature, determine the feature score corresponding to the evaluation feature based on the evaluation feature and the weight coefficients corresponding to the evaluation feature; and sum the feature scores corresponding to the multiple evaluation features to obtain the encrypted score of the data to be detected.

[0144] This application embodiment can divide the data encryption detection device into functional modules according to the above method example. For example, each function can be divided into its own functional module, or two or more functions can be integrated into one processing module. The integrated module can be implemented in hardware or as a software functional module. Optionally, the module division in this application embodiment is illustrative and only represents one logical functional division; other division methods may be used in actual implementation.

[0145] This application also provides an electronic device, including a processor and a memory. The memory stores computer execution instructions, and the processor is connected to the memory. When the electronic device is running, the processor executes the computer execution instructions stored in the memory, so that the electronic device performs any of the data encryption detection methods provided in the above embodiments.

[0146] The hardware structure of electronic devices can be as follows: Figure 3 As shown, the electronic device includes a processor 201, a memory 202, a communication interface 203, and a bus 204. The memory 202 exists independently of the processor 201. The processor 201, the memory 202, and the communication interface 203 can be connected via the bus 204.

[0147] Processor 201 is the control center of an electronic device. It can be a single processor or a collective term for multiple processing elements. For example, processor 201 can be a general-purpose central processing unit (CPU) or other general-purpose processors. Among them, the general-purpose processor can be a microprocessor or any conventional processor.

[0148] As one embodiment, processor 201 may include one or more CPUs, for example Figure 3 CPU 0 and CPU 1 are shown in the diagram.

[0149] The memory 202 may be a read-only memory (ROM) or other type of static storage device capable of storing static information and instructions, random access memory (RAM) or other type of dynamic storage device capable of storing information and instructions, or electrically erasable programmable read-only memory (EEPROM), disk storage media or other magnetic storage devices, or any other medium capable of carrying or storing desired program code in the form of instructions or data structures and accessible by a computer, but is not limited thereto.

[0150] The memory 202 can be connected to the processor 201 via the bus 204 and is used to store instructions or program code. When the processor 201 calls and executes the instructions or program code stored in the memory 202, it can implement the data encryption detection method provided in this embodiment of the invention.

[0151] The communication interface 203 is used to connect with other devices via a communication network. The communication network can be Ethernet, a wireless access network, a wireless local area network (WLAN), etc. The communication interface 203 may include a receiving unit for receiving data and a transmitting unit for sending data.

[0152] Bus 204 can be an Industry Standard Architecture (ISA) bus, a Peripheral Component Interconnect (PCI) bus, or an Extended Industry Standard Architecture (EISA) bus, etc. This bus can be divided into address bus, data bus, control bus, etc. For ease of representation, Figure 3The bus is represented by a single thick line, but this does not mean that there is only one bus or one type of bus.

[0153] In other embodiments, the memory 202 may also be integrated with the processor 201. For example... Figure 4 As shown, the electronic device may include a processor 205 and a communication interface 206, with the processor 205 coupled to the communication interface 206.

[0154] The functions of processor 205 can be referred to the above. Figure 3 The processor 201 is described above. Furthermore, the processor 205 also has storage capabilities, which can be found in the above description. Figure 3 The function of memory 202.

[0155] The communication interface 206 is used to provide data to the processor 205. This communication interface 206 can be an internal interface of the electronic device or an external interface of the electronic device (equivalent to...). Figure 3 (Communication interface 203 in the middle).

[0156] It should be pointed out that, Figure 3 (or Figure 4 The structures shown in the document do not constitute a limitation on the electronic device, except... Figure 3 (or Figure 4 In addition to the components shown in the diagram, the electronic device may include more or fewer components than those shown, or combine certain components, or have different component arrangements.

[0157] This application also provides a computer-readable storage medium including computer-executable instructions that, when run on a computer, cause the computer to execute any of the data encryption detection methods provided in the above embodiments.

[0158] This application also provides a computer program product containing computer execution instructions, which, when run on a computer, causes the computer to execute any of the data encryption detection methods provided in the above embodiments.

[0159] In the above embodiments, implementation can be achieved, in whole or in part, through software, hardware, firmware, or any combination thereof. When implemented using software programs, implementation can be, in whole or in part, in the form of a computer program product. This computer program product includes one or more computer-executable instructions. When these computer-executable instructions are loaded and executed on a computer, all or part of the flow or function according to the embodiments of this application is generated. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer-executable instructions can be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another. For example, computer-executable instructions can be transmitted from one website, computer, server, or data center to another via wired (e.g., coaxial cable, fiber optic, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) means. The computer-readable storage medium can be any available medium accessible to a computer or a data storage device containing one or more servers, data centers, etc., that can be integrated with the medium. The available media can be magnetic media (e.g., floppy disks, hard disks, magnetic tapes), optical media (e.g., DVDs), or semiconductor media (e.g., solid-state disks, SSDs).

[0160] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any changes or substitutions within the technical scope disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

Claims

1. A data encryption detection method, characterized in that, include: Acquire the data to be tested; Extract multiple evaluation features from the data to be detected; The multiple evaluation features include information entropy features, encoding length features, and field semantic association features; the information entropy feature is used to characterize the randomness of the data to be detected; the encoding length feature is used to characterize the deviation between the actual encoding length of the data to be detected and the theoretical encoding length corresponding to the encoding type of the data to be detected. The semantic association features of the fields are used to characterize the matching situation between the data to be detected and the encrypted keywords; The multiple evaluation features are weighted and fused to determine the encryption score of the data to be detected; the encryption score is used to characterize the probability that the data to be detected is encrypted data. Based on the comparison result between the encryption score of the data to be detected and the preset threshold, the data to be detected is determined to be encrypted data or plaintext data.

2. The method according to claim 1, characterized in that, The method further includes: If the data to be detected meets the preset plaintext conditions, the data to be detected is determined to be plaintext data; The extraction of multiple evaluation features from the data to be detected includes: If the data to be detected does not meet the preset plaintext conditions, multiple evaluation features of the data to be detected are extracted. The preset plaintext conditions include at least one of the following: The original byte length of the initial data body of the data to be detected is less than the preset length; the initial data body is used to characterize the payload portion of the data to be detected that carries business information. The initial data ontology is matched with any rule in the preset plaintext regular expression rule base.

3. The method according to claim 1, characterized in that, The extraction of multiple evaluation features from the data to be detected includes: Based on the encoding type of the data to be detected, the initial data ontology is decoded into a target data ontology in binary format, and the information entropy feature is determined based on the target data ontology; the initial data ontology is used to characterize the payload portion of the data to be detected that carries business information. The coding length feature is determined based on the deviation between the actual coding length and the theoretical coding length of the initial data ontology; the theoretical coding length is determined based on the coding type of the data to be detected. The field names of the data to be detected are matched with keywords in the encrypted keyword library. Based on the semantic matching results, the semantic association features of the fields are determined.

4. The method according to claim 1, characterized in that, The multiple evaluation features also include basic length features and format regularity features; The basic length feature is used to characterize the original byte length of the initial data body of the data to be detected when it is not encoded; the initial data body is used to characterize the payload portion of the data to be detected that carries business information. The format regularity feature is used to characterize the degree of matching between the initial data ontology and the standard encoding format.

5. The method according to claim 4, characterized in that, The extraction of multiple evaluation features from the data to be detected includes: Based on the encoding type of the data to be detected, the initial data body is decoded into a target data body in binary format; The basic length feature is determined based on the total number of bytes of the target data ontology; The initial data ontology is matched with the standard encoding formats in the preset standard encoding format library to obtain the format matching result; based on the format matching result, the format regularity feature is determined.

6. The method according to claim 1, characterized in that, The extraction of multiple evaluation features from the data to be detected includes: If no preset algorithm identifier is detected in the data to be detected, or if the preset algorithm identifier is detected in the data to be detected but the data to be detected does not conform to the target algorithm format, multiple evaluation features of the data to be detected are extracted; the target algorithm format corresponds to the preset algorithm identifier. The method further includes: If the data to be detected contains a preset algorithm identifier and the data to be detected conforms to the target algorithm format, the data to be detected is determined to be encrypted data encrypted by the target algorithm corresponding to the preset algorithm identifier.

7. The method according to claim 1, characterized in that, The step of weightedly fusing the multiple evaluation features to determine the encrypted score of the data to be detected includes: The weight coefficients corresponding to each of the multiple evaluation features are determined based on the analytic hierarchy process. For each evaluation feature, a feature score corresponding to the evaluation feature is determined based on the evaluation feature and the weight coefficient corresponding to the evaluation feature. The feature scores corresponding to multiple evaluation features are summed to obtain the encrypted score of the data to be detected.

8. A data encryption detection device, characterized in that, include: The acquisition module is used to acquire the data to be detected. The processing module is used to extract multiple evaluation features from the data to be detected; The multiple evaluation features include information entropy features, encoding length features, and field semantic association features; the information entropy feature is used to characterize the randomness of the data to be detected; the encoding length feature is used to characterize the deviation between the actual encoding length of the data to be detected and the theoretical encoding length corresponding to the encoding type of the data to be detected. The semantic association features of the fields are used to characterize the matching situation between the data to be detected and the encrypted keywords; The processing module is further configured to perform weighted fusion of the multiple evaluation features to determine the encryption score of the data to be detected; the encryption score is used to characterize the probability that the data to be detected is encrypted data. The processing module is further configured to determine whether the data to be detected is encrypted data or plaintext data based on the comparison result between the encryption score of the data to be detected and a preset threshold.

9. An electronic device, characterized in that, The electronic device includes a memory and a processor; The memory and the processor are coupled; The memory is used to store computer program code, which includes computer instructions; Wherein, when the processor executes the computer instructions, the electronic device performs the method as described in any one of claims 1-7.

10. A computer storage medium, characterized in that, The computer-readable storage medium stores computer instructions that, when executed on a computer, cause the computer to perform the method as described in any one of claims 1-7.

Images