Data detection strategy generation method and system, electronic equipment and storage medium

Abstract

The invention discloses a data detection strategy generation method and system, electronic equipment and a storage medium, and relates to the field of data security. The method comprises the steps of obtaining a to-be-processed file; calling a data processing model, and determining a universal category, a sensitive index and a keyword of the to-be-processed file; determining a recommendation level of a to-be-generated detection rule based on the general category and the sensitivity index, generating a rule name of the detection rule based on the keyword, and generating detection logic information of the detection rule at least based on the general category, the sensitivity index and the keyword; and generating a detection strategy of the client according to the recommendation level, the rule name and the detection logic information. The technical problem that the generation efficiency of the data detection strategy is low is solved.

Description

Technical Field

[0001] This application relates to the field of data security, and more specifically, to a method, system, electronic device, and storage medium for generating a data detection strategy. Background Technology

[0002] Currently, for the classification and grading issues in the field of data security, there is a need to automatically generate detection strategies with high accuracy in order to provide automated digital solutions.

[0003] In related technologies, the detection strategy is written by collecting keywords from the files to be processed and defining regular expressions, which takes a long time to generate. In addition, as new categories of files to be processed emerge, a lot of manpower is needed to maintain the generated detection strategy, which is costly and slow in response time, resulting in low efficiency in generating data detection strategies.

[0004] There is currently no effective solution to the above problems. Summary of the Invention

[0005] This application provides a method, system, electronic device, and storage medium for generating data detection strategies, to at least solve the technical problem of low efficiency in generating data detection strategies.

[0006] According to one aspect of the embodiments of this application, a method for generating a data detection strategy is provided. The method may include: acquiring a file to be processed, wherein the file to be processed includes log data to be detected generated by a client during operation; invoking a data processing model to determine a general category, sensitivity index, and keywords of the file to be processed, wherein the data processing model is trained based on at least a large model, the general category represents a category with general meaning, the sensitivity index represents the sensitivity of text in the file to be processed, and the keywords describe the text structure; determining a recommendation level for a detection rule to be generated based on the general category and sensitivity index, generating a rule name for the detection rule based on the keywords, and generating detection logic information for the detection rule based at least on the general category, sensitivity index, and keywords, wherein the detection rule represents a rule for security detection of the client, the recommendation level represents the priority of recommending the detection rule, and the detection logic information represents the logic used by the detection rule during execution; and generating a detection strategy for the client by combining the recommendation level, rule name, and detection logic information, wherein the detection strategy represents the generated detection rule.

[0007] According to another aspect of the embodiments of this application, a method for generating a data detection strategy is provided. The method may include: obtaining files to be processed from a client's data assets, wherein the categories of the data assets correspond to the client's data usage scenarios, and the files to be processed include log data to be detected generated by the client during operation in the data usage scenarios; calling a classification model to classify the files to be processed to obtain general categories; calling a sensitivity assessment model to perform sensitivity assessment on the files to be processed to obtain sensitivity indicators; and calling a data recognition model to extract keywords from the files to be processed. The classification model is obtained by training a corresponding deep learning model using samples of the general categories, where the general categories represent categories with general meanings; the sensitivity assessment model is obtained by training a corresponding deep learning model using samples of the sensitivity indicators, where the sensitivity indicators are used to represent categories with general meanings. The sensitivity of the text in the file to be processed is represented by the data recognition model, which is trained based on a large language model. Keywords are used to describe the text structure. Based on the general category and sensitivity index, the recommendation level of the detection rule to be generated is determined. Based on the keywords, the rule name of the detection rule is generated. At least based on the general category, sensitivity index and keywords, the detection logic information of the detection rule is generated. Here, the detection rule is used to represent the rule for security detection of the client, the recommendation level is used to represent the priority of the recommended detection rule, and the detection logic information is used to represent the logic adopted by the detection rule in the execution process. The recommendation level, rule name and detection logic information are used to generate the client detection strategy. Here, the detection strategy is used to represent the generated detection rule.

[0008] According to another aspect of the embodiments of this application, a method for generating a data detection strategy is provided. The method may include: obtaining a file to be processed by calling a first interface, wherein the first interface includes a first parameter, the value of which is the file to be processed, and the file to be processed includes log data to be detected generated by the client during operation; calling a data processing model to determine the general category, sensitivity index, and keywords of the file to be processed, wherein the data processing model is trained based on at least a large model, the general category is used to represent a category with general meaning, the sensitivity index is used to represent the sensitivity of the text in the file to be processed, and the keywords are used to describe the text structure; determining the recommendation level of the detection rule to be generated based on the general category and the sensitivity index, generating the rule name of the detection rule based on the keywords, and generating the detection logic information of the detection rule based at least on the general category, the sensitivity index, and the keywords, wherein the detection rule is used to represent the rule for security detection of the client, the recommendation level is used to represent the priority of the recommended detection rule, and the detection logic information is used to represent the logic adopted by the detection rule during execution; generating a detection strategy for the client by combining the recommendation level, the rule name, and the detection logic information, wherein the detection strategy is used to represent the generated detection rule; and outputting the detection strategy by calling a second interface, wherein the second interface includes a second parameter, the value of which is the detection strategy.

[0009] According to another aspect of the embodiments of this application, a data detection strategy generation system is provided. The system may include: a client for uploading a file to be processed, wherein the file to be processed includes log data to be detected generated by the client during operation; a server for invoking a data processing model to determine the general category, sensitivity index, and keywords of the file to be processed, wherein the data processing model is trained at least on a large model, the general category represents a category with general meaning, the sensitivity index represents the sensitivity of the text in the file to be processed, and the keywords describe the text structure; based on the general category and sensitivity index, determining the recommendation level of the detection rule to be generated; based on the keywords, generating the rule name of the detection rule; and at least based on the general category, sensitivity index, and keywords, generating detection logic information of the detection rule, wherein the detection rule represents the rule for security detection of the client, the recommendation level represents the priority of the recommended detection rule, and the detection logic information represents the logic used by the detection rule during execution; and generating a detection strategy for the client by combining the recommendation level, rule name, and detection logic information, wherein the detection strategy represents the generated detection rule.

[0010] According to another aspect of the embodiments of this application, an electronic device is also provided, which may include a memory and a processor: the memory is used to store computer-executable instructions, and the processor is used to execute the computer-executable instructions, wherein when the computer-executable instructions are executed by the processor, a method for generating a data detection strategy that implements any of the above is provided.

[0011] According to another aspect of the embodiments of this application, a processor is also provided, which is used to run a program, wherein the method for generating a data detection strategy of any of the above is executed when the program is running.

[0012] According to another aspect of the embodiments of this application, a computer-readable storage medium is also provided, the computer-readable storage medium including a stored program, wherein, when the program is running, a method for generating a data detection strategy that controls the device where the storage medium is located to execute any of the above-mentioned methods is provided.

[0013] According to another aspect of the embodiments of this application, a computer program product is also provided, including a non-volatile computer-readable storage medium storing a computer program, wherein when the computer program is executed by a processor, a method for generating a data detection strategy that implements any of the above-mentioned methods is provided.

[0014] In this embodiment, the files to be processed are classified into general categories with universally defined characteristics; a sensitivity assessment is performed on the files to be processed to obtain sensitivity indicators; and keywords are extracted from the files to be processed. Furthermore, based on the general categories, sensitivity indicators, and keywords, the recommendation level, rule name, and detection logic information of the detection rules to be generated are determined. Finally, the recommendation level, rule name, and detection logic information are used to generate a detection strategy, which can be used to represent the generated detection rules. Since the generated detection rules include recommendation level, rule name, and detection logic information, the detection rules can realize functions such as data classification, grading, and detection logic, thereby achieving the purpose of customized batch automatic generation of detection strategies. Customization is reflected in the aforementioned classification, grading, and detection logic; batch processing is reflected in the ability to process a batch of files to be processed, and processing each file to be processed can produce hundreds of detection rules. This application embodiment uses a large model base to train a data processing model, which can determine the general category, sensitivity index and keywords of the file to be processed. Without relying on manual annotation of samples, it can automatically generate detection strategies with high accuracy, greatly shorten the generation cycle and manpower cost of detection strategies, and thus achieve the technical effect of improving the generation efficiency of data detection strategies, solving the technical problem of low generation efficiency of data detection strategies.

[0015] It is worth noting that the general description above and the detailed description that follow are merely for illustrative purposes and do not constitute a limitation on this application. Attached Figure Description

[0016] The accompanying drawings, which are included to provide a further understanding of this application and form part of this application, illustrate exemplary embodiments of this application and are used to explain this application, but do not constitute an undue limitation of this application. In the drawings:

[0017] Figure 1 This is a schematic diagram illustrating an application scenario of a data detection strategy generation method according to an embodiment of this application;

[0018] Figure 2 This is a flowchart of a method for generating a data detection strategy according to an embodiment of this application;

[0019] Figure 3 This is a flowchart of a method for generating another data detection strategy according to an embodiment of this application;

[0020] Figure 4 This is a flowchart of a method for generating a data detection strategy according to an embodiment of this application;

[0021] Figure 5 This is a schematic diagram of a data detection strategy generation system according to an embodiment of this application;

[0022] Figure 6 This is a schematic diagram of a detection rule according to an embodiment of this application;

[0023] Figure 7 This is a schematic diagram of a generation detection rule according to an embodiment of this application;

[0024] Figure 8 This is a structural block diagram of the computing environment for a data detection strategy generation method according to an embodiment of this application;

[0025] Figure 9 This is a schematic diagram of a data detection strategy generation device according to an embodiment of this application;

[0026] Figure 10 This is a schematic diagram of a data detection strategy generation apparatus according to an embodiment of this application;

[0027] Figure 11 This is a schematic diagram of a data detection strategy generation apparatus according to an embodiment of this application;

[0028] Figure 12 This is a structural block diagram of a computer terminal according to an embodiment of this application;

[0029] Figure 13 This is a block diagram of an electronic device for generating a data detection strategy according to an embodiment of this application;

[0030] Figure 14 This is a hardware structure block diagram of a computer terminal (or mobile device) for implementing a data detection strategy generation method according to an embodiment of this application. Detailed Implementation

[0031] To enable those skilled in the art to better understand the present application, the technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present application, and not all embodiments. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative effort should fall within the scope of protection of the present application.

[0032] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this application are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of this application described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0033] First, some nouns or terms that appear in the description of the embodiments of this application shall be interpreted as follows:

[0034] A Large Language Model (LLM) is an artificial intelligence (AI) model with a large number of parameters, primarily used to understand and generate human language. By training on massive amounts of text data, this model can learn the complex structures and patterns of language, thereby enabling natural language processing tasks such as automatic summarization, machine translation, text generation, and dialogue understanding.

[0035] A prompt, also known as a command or hint, refers to a pre-defined text or signal in the field of artificial intelligence that guides an AI system to generate a specific type of response or content.

[0036] The Chain of Thought Prompting (COT) algorithm is an AI technology that aims to enable machine learning models to solve problems step by step and logically, similar to the human thought process.

[0037] The automated chain of thought promotion (AutoCOT) algorithm can automatically generate prompts.

[0038] A multilayer perceptron (MLP) is a basic form of neural network, consisting of multiple linear layers.

[0039] OnePassCluster, also known as a single-pass clustering algorithm, is an efficient clustering algorithm for large datasets. The main idea of ​​this algorithm is to complete the clustering task by performing one pass (or as few passes as possible) on the dataset. It is particularly suitable for streaming data processing and large-scale datasets. It has the advantages of high speed, low memory usage, and no need to specify the number of clusters in advance.

[0040] Convolutional Neural Network (CNN) is a deep learning model widely used in image processing and computer vision. CNN automatically detects local features in input data by using a series of filters (or convolutional kernels).

[0041] Embedding, also known as vector representation, is commonly used in machine learning and natural language processing. It is a technique that converts data (such as text, images, or sound) into digital vectors, enabling computers to better understand and process this data.

[0042] CoSENT (Contextualized Similarity Enhanced by Negative Sampling and Translation Equivariance) is a language model pre-trained using Bidirectional Encoder Representations from Transformers (BERT).

[0043] Text-to-Vector (Text2vec) is a method for converting natural language text into numerical vector representations that computers can understand. Based on the CoSENT method, Text2Vec generates vectors by considering the context and semantic relationships of words within the text. These vectors capture the meaning and structure of the text, enabling machine learning and deep learning models to process and analyze text data. It is one of the commonly used algorithms in the encoding layer of deep learning models.

[0044] Classification and Regression Trees (CART) is a commonly used decision tree algorithm that can be used for both classification and regression problems. This algorithm generates a tree-structured model by recursively dividing the dataset into subsets based on feature values.

[0045] The method for generating the above-mentioned data detection strategy provided in this application embodiment can be applied to, for example... Figure 1 The application scenarios shown are not limited to these. Figure 1 This is a schematic diagram illustrating an application scenario of a data detection strategy generation method according to an embodiment of this application. Figure 1 In the application scenario shown, the server 10 can be in the cloud. The server 10 can connect to one or more client devices 20 via a local area network (LAN), wide area network (WAN), internet connection, or other types of data network. These client devices 20 can include, but are not limited to, smartphones, tablets, laptops, PDAs, personal computers, smart home devices, and in-vehicle devices. These client devices collectively constitute the client relative to the server. An operation interface for uploading files to be processed can be deployed on the graphical user interface of the client device. The client device 20 can interact with the user through the graphical user interface to implement the data detection strategy generation method provided in this application embodiment.

[0046] In this embodiment of the application, the system consisting of client device 20 and server 10 can perform the following steps: if a user needs to generate a detection strategy for the client, they can perform the corresponding operation in the operation interface on client device 20 to upload the file to be processed. The client device can send the file to be processed to the server via the network. The server can perform the following steps: Step S102, obtain the file to be processed, wherein the file to be processed includes the log data to be detected generated by the client during operation; Step S104, call the data processing model to determine the general category, sensitivity index and keywords of the file to be processed, wherein the data processing model is trained based on at least a large model, the general category is used to represent the category with general meaning, the sensitivity index is used to represent the sensitivity of the text in the file to be processed, and the keywords are used to describe the text structure; Step S106, based on the general category and sensitivity index, determine the recommendation level of the detection rule to be generated, generate the rule name of the detection rule based on the keywords, and generate the detection logic information of the detection rule based on at least the general category, sensitivity index and keywords, wherein the detection rule is used to represent the rule for security detection of the client, the recommendation level is used to represent the priority of the recommended detection rule, and the detection logic information is used to represent the logic adopted by the detection rule during execution; Step S108, generate the client's detection strategy with the recommendation level, rule name and detection logic information, wherein the detection strategy is used to represent the generated detection rule.

[0047] Under the aforementioned operating environment, this application provides the following: Figure 2 The method for generating detection strategies for the data shown is illustrated. The detection strategy can be an algorithm for detecting specific types of data or behaviors; for example, it could be an algorithm for detecting a certain type of sensitive asset data. This strategy can be used to detect and analyze data to promptly identify potential security risks. For instance, in the field of cybersecurity, when a certain type of sensitive asset data is discovered, a detection strategy can be used to classify this sensitive asset data, determine its category, and further classify it to determine its security level.

[0048] Optionally, users can apply detection policies to security devices or software to achieve real-time detection of certain sensitive asset data. When a file or data matches the rules defined by the detection policy, an alarm or blocking action will be triggered, thereby protecting the system from security threats. For example, in a corporate intranet, when an employee attempts to send a file containing confidential company information to an external email address, this action may trigger the detection policy, thus promptly detecting and preventing the risk of data leakage. By applying detection policies, enterprises can help promptly detect various security threats, improve data security, and protect privacy information.

[0049] Figure 2 This is a flowchart of a data detection strategy generation method according to an embodiment of this application, such as... Figure 2 As shown, the method may include the following steps:

[0050] Step S202: Obtain the file to be processed, which includes the log data to be detected generated by the client during operation.

[0051] In the technical solution provided in step S202 of this application, a file to be processed can be obtained. This file may include log data to be detected generated by the client during operation, and may also be referred to as a file scan log.

[0052] In this embodiment, based on asset mapping capabilities, users can select a specified range of clients (deployed on terminal devices) and scan files in a specified directory to obtain files to be processed, or obtain files to be processed by manually submitting a batch of files.

[0053] Optionally, after obtaining the file to be processed, i.e., the file scan log, the obtained file scan log can be reported to the server. After the server obtains the file scan log, it can provide the file content parsing text to the LLM main model and other deep learning sub-models to perform the following steps to generate the client's detection strategy. The file content parsing text can be one of the fields contained in the file scan log, such as a timestamp field.

[0054] Step S204: Invoke the data processing model to determine the general category, sensitivity index and keywords of the file to be processed. The data processing model is trained based on at least a large model. The general category is used to represent the category with general meaning. The sensitivity index is used to represent the sensitivity of the text in the file to be processed. The keywords are used to describe the text structure of the text.

[0055] In the technical solution provided in step S204 of this application, after obtaining the file to be processed, the data processing model is invoked to determine the general category, sensitivity index, and keywords of the file to be processed. The data processing model is at least trained based on a large model; that is, this embodiment uses a large model base to train the data processing model. The general category can be used to represent a category with a general meaning, i.e., a category with a universally applicable definition. The sensitivity index can be used to represent the sensitivity level of the text in the file to be processed. For example, a score of 0–100 can be used to represent the sensitivity index. This sensitivity index can also be a sensitivity score or a sensitivity rating; the higher the score, the more sensitive the text content. The text in the file to be processed can be the parsed text of the file content, which can be one of the fields contained in the file to be processed. Keywords can be used to describe the text structure and can also be called topic words.

[0056] In this embodiment, after obtaining the file to be processed, the general category classification model in the data processing model is called to determine the general category of the file to be processed. That is, after the server obtains the file scan log reported by the client, the server can provide the file content parsing text in the file scan log to the general category classification model to classify the file content parsing text into a general category with universal definition. There can be twenty types of general categories, but this is only an example and no specific limitation is made on the types of general categories.

[0057] Optionally, after obtaining the file to be processed, the sensitivity scoring model in the data processing model can be called to determine the sensitivity index of the file to be processed. That is, the server can provide the file content parsing text in the file scanning log to the sensitivity scoring model to score the sensitivity of the file content parsing text from 0 to 100. The higher the score, the more sensitive the text content.

[0058] Optionally, after obtaining the file to be processed, the LLM large model in the data processing model can be called to determine the keywords of the file to be processed. That is, the server can provide the file content parsing text in the file scanning log to the LLM large model in order to identify keywords from the file content parsing text.

[0059] Step S206: Based on the general category and sensitivity index, determine the recommendation level of the detection rule to be generated, generate the rule name of the detection rule based on keywords, and generate the detection logic information of the detection rule based on at least the general category, sensitivity index and keywords. The detection rule is used to represent the rule for security detection of the client, the recommendation level is used to represent the priority of the recommended detection rule, and the detection logic information is used to represent the logic used by the detection rule in the execution process.

[0060] In the technical solution provided in step S206 of this application, after calling the data processing model and determining the general category, sensitivity index, and keywords of the file to be processed, the recommendation level of the detection rule to be generated can be determined based on the determined general category and sensitivity index. Based on the determined keywords, the rule name of the detection rule can be generated, and at least based on the determined general category, sensitivity index, and keywords, the detection logic information of the detection rule can be generated. The detection rule can be used to represent a rule for security detection of the client, and can also be called a classification and grading rule, classification and grading detection rule, classification and grading detection logic rule, executable logic detection rule, or detection logic rule. The recommendation level can be used to represent the priority of the recommended detection rule, and can also be called a rule level, which can be a grading in the above classification and grading rules. The rule name can be the category name of the classification of the detection rule to be generated, that is, the name of the category in the above classification and grading rules. The detection logic information can be used to represent the logic used by the detection rule during execution, and can be the executable detection logic of the detection rule, or a rule detection logic expression.

[0061] In this embodiment, after calling the data processing model to determine the general category and sensitivity index of the file to be processed, the default sensitivity index corresponding to the general category can be determined first. Furthermore, based on the default sensitivity index and the sensitivity index, the recommendation level of the detection rule to be generated can be determined.

[0062] Optionally, after calling the data processing model and determining the keywords, the text content categories of the text in the file to be processed can be determined based on the keywords. Further clustering of the determined text content categories can generate rule names for the detection rules.

[0063] Optionally, after calling the data processing model and determining the general category, sensitivity index, and keywords of the file to be processed, the general category, sensitivity index, and keywords of the file to be processed can be combined to generate the detection logic information of the detection rules.

[0064] Step S208 involves generating a client-side detection strategy from the recommendation level, rule name, and detection logic information. This detection strategy represents the generated detection rules and can also be called a classification and grading detection strategy. Optionally, in practical applications, this classification and grading detection strategy can be a classification and grading detection algorithm. By publishing this algorithm, an automated solution can be provided to users.

[0065] In the technical solution provided in step S208 of this application, after determining the recommendation level, rule name, and detection logic information of the detection rule to be generated, the determined recommendation level, rule name, and detection logic information can be used to generate a detection strategy for the client. The detection strategy can be used to represent the generated detection rule.

[0066] In this embodiment, the generated detection strategy may include the recommendation level of the detection rule (i.e., rule level, classification level), rule name (i.e., classification name in classification level) and detection logic information (i.e. rule detection logic expression).

[0067] This embodiment generates detection strategies through customized batch automatic training, which can save the manpower cost of manually configuring detection rules and shorten the cycle of updating and iterating detection rules.

[0068] In related technologies, methods such as keywords, regular expressions, and traditional machine learning are commonly used to generate detection strategies. However, keyword-based and regular expression-based methods require significant human resources to configure rules and are computationally slow. Models generated by traditional machine learning methods are fixed and rigid, difficult to iterate, and cannot adapt to various industry data usage scenarios, resulting in low efficiency in generating data detection strategies.

[0069] However, in this embodiment of the application, in response to the problem of low generation efficiency of data detection strategies in the aforementioned related technologies, an open-source LLM large model base is used to automatically generate data security classification and grading detection rules with high accuracy, thereby providing an automated digital solution. This greatly shortens the generation cycle of data security classification and grading detection rules, reduces manpower and time costs, and realizes the implementation of automated classification and grading of sensitive assets based on a large model, thus achieving the technical effect of improving the generation efficiency of data detection strategies.

[0070] Through steps S202 to S208 of this application, the files to be processed are classified into general categories with universally defined characteristics; a sensitivity assessment is performed on the files to be processed to obtain sensitivity indicators; and keywords are extracted from the files to be processed. Further, based on the general categories, sensitivity indicators, and keywords, the recommendation level, rule name, and detection logic information of the detection rules to be generated are determined. Finally, the recommendation level, rule name, and detection logic information are used to generate a detection strategy, which can be used to represent the generated detection rules. Since the generated detection rules include recommendation level, rule name, and detection logic information, the detection rules can realize functions such as data classification, grading, and detection logic, thereby achieving the purpose of customized batch automatic generation of detection strategies. Customization is reflected in the aforementioned classification, grading, and detection logic; batch processing is reflected in the ability to process a batch of files to be processed, and processing each file to be processed can produce hundreds of detection rules. This application embodiment uses a large model base to train a data processing model, which can determine the general category, sensitivity index and keywords of the file to be processed. Without relying on manual annotation of samples, it can automatically generate detection strategies with high accuracy, greatly shorten the generation cycle and manpower cost of detection strategies, and thus achieve the technical effect of improving the generation efficiency of data detection strategies, solving the technical problem of low generation efficiency of data detection strategies.

[0071] The method described in this embodiment will be further described below.

[0072] As an optional implementation, a data processing model is invoked to determine the general category, sensitivity indicators, and keywords of the file to be processed. This includes: invoking a classification model within the data processing model to classify the file to be processed and obtain a general category, wherein the classification model is trained on the corresponding deep learning model using samples of the general category; invoking a sensitivity assessment model within the data processing model to assess the sensitivity of the file to be processed and obtain sensitivity indicators, wherein the sensitivity assessment model is trained on the corresponding deep learning model using samples of the sensitivity indicators; and invoking a data recognition model within the data processing model to identify keywords from the file to be processed, wherein the data recognition model is trained based on a large language model.

[0073] In this embodiment, after obtaining the file to be processed, a classification model in the data processing model can be invoked to classify the file and obtain a general category. The classification model can be invoked to classify the file according to a deep learning algorithm, and the obtained general category is the result of a deep learning algorithm. The classification model can be trained using general category samples on a corresponding deep learning model, and can also be called a general category classification model. Optionally, after obtaining the file scan log, this embodiment can utilize an algorithm service deployed on the server to calculate the file scan log, and can classify the file scan log based on an MLP algorithm to obtain a general category.

[0074] Optionally, this embodiment calls a sensitivity assessment model in the data processing model to perform a sensitivity assessment on the file to be processed, obtaining sensitivity indicators. The sensitivity assessment model can be called to perform a sensitivity assessment on the file to be processed using a deep learning algorithm, and the obtained sensitivity indicators are the results of a deep learning algorithm. The sensitivity assessment model can be trained using sensitivity indicator samples on a corresponding deep learning model, and can also be called a sensitivity scoring model. Optionally, after obtaining the file scan logs, this embodiment can use an algorithm service deployed on the server to calculate the sensitivity of the file scan logs, and can perform a sensitivity assessment on the file scan logs based on a self-developed deep learning algorithm to obtain sensitivity indicators.

[0075] Optionally, this embodiment calls the data recognition model in the data processing model to identify keywords from the file to be processed. The data recognition model can be trained based on a large language model, such as an LLM model. LLM models have zero-shot classification capabilities, eliminating the need to pre-specify the number of categories and enabling automatic batch generation of classification and grading detection logic rules.

[0076] As an optional implementation, the data recognition model in the data processing model is invoked to identify keywords from the file to be processed, including: determining the prompt information corresponding to the file to be processed, wherein the prompt information is used to indicate multiple steps for extracting keywords from the file to be processed, and the multiple steps have a logical relationship; and using the prompt information to guide the data recognition model to identify keywords from the file to be processed.

[0077] In this embodiment, after acquiring the file to be processed, the corresponding prompt information can be determined. After determining the prompt information, the determined prompt information can be used to guide the data recognition model to identify keywords from the file. The prompt information can represent multiple steps in extracting keywords from the file, and these steps have a logical relationship, which can be implemented using COT (Content-Oriented Technology).

[0078] Optionally, after obtaining the file to be processed, a corresponding Prompt can be determined. For example, COT (Content-Oriented Learning) technology can be used to write a Prompt for the file. The problem, its decomposed parts, and the thought process can be integrated into a complete Prompt, which includes a problem description, the thought process for each part, and the logical relationships connecting the parts. Furthermore, the Prompt can be used to guide the LLM (Local Management Model) to extract keywords representing the text structure from the text of the file to be processed. The number of keywords can be up to ten, but this is only an example and no specific limit is placed on the number of keywords.

[0079] As an optional implementation, the classification model in the data processing model is invoked to classify the files to be processed and obtain general categories, including: invoking the multilayer perceptron in the classification model to classify different texts in the files to be processed into different general categories.

[0080] In this embodiment, after obtaining the file to be processed, a multilayer perceptron (MLP) in the classification model can be invoked to classify different texts in the file into different general categories. Optionally, after obtaining the file to be processed, the text in the file can be classified into twenty general categories with universal definitions based on the MLP algorithm. This is only for illustrative purposes, and no specific limit is made on the number of general categories.

[0081] It should be noted that when classifying the text in the file to be processed into twenty universally defined categories, the classification is also based on a self-developed deep learning algorithm, which is a modified version of the MLP algorithm. Building upon the MLP algorithm, more hidden layers, neurons, and more types of input features can be introduced, such as word embeddings and character-level features, to obtain this deep learning algorithm. Furthermore, based on this deep learning algorithm, the text in the file to be processed is classified into twenty universally defined categories, thereby improving the classification accuracy.

[0082] As an optional implementation, a sensitivity assessment model within the data processing model is invoked to perform a sensitivity assessment on the file to be processed, obtaining sensitivity indices. This includes: invoking the sensitivity assessment model to determine the text content of the text in the file to be processed, and performing a sensitivity assessment on the text content to obtain sensitivity indices. The sensitivity indices are positively correlated with the sensitivity of the text content. The text content can be the specific content of the text contained in the file to be processed, i.e., the specific content of the parsed text of the file content.

[0083] In this embodiment, after obtaining the file to be processed, a sensitivity assessment model can be invoked to determine the text content of the text in the file. After determining the text content, a sensitivity assessment can be performed on the determined text content to obtain a sensitivity index.

[0084] Optionally, after calling the sensitivity assessment model to determine the text content of the file to be processed, a sensitivity assessment can be performed on the determined text content. That is, the sensitivity of the text content can be scored from 0 to 100 based on a self-developed deep learning algorithm to obtain a sensitivity index. This deep learning algorithm improves the accuracy and precision of the scoring by considering text features and contextual information through more complex model training.

[0085] As an optional implementation method, generating rule names for detection rules based on keywords includes: calling a data recognition model to analyze the keywords and different texts in the file to be processed to obtain the text content categories of different texts; and performing clustering processing on the text content categories of different texts to obtain rule names.

[0086] In this embodiment, after identifying keywords from the file to be processed, a data recognition model can be invoked to analyze the keywords and different texts in the file to obtain the text content categories of different texts. After obtaining the text content categories of different texts, clustering processing can be performed on the text content categories to obtain rule names. The text content category can be used to represent the category of the text content contained in the file to be processed.

[0087] Optionally, after identifying keywords from the files to be processed, the LLM (Large-Scale Model) can be invoked to analyze the keywords and different texts in the files to be processed, obtaining the text content categories of different texts. That is, the LLM model is invoked to summarize the text content category of each log entry to be detected. Further, the summarized text content categories of each log entry to be detected can be clustered to obtain rule names.

[0088] As an optional implementation, clustering is performed on the text content categories of different texts to obtain rule names, including: performing a clustering process on the text content categories of different texts to obtain clustering results; and identifying the text content categories of different texts whose similarity to the clustering results is higher than a similarity threshold as rule names.

[0089] In this embodiment, after calling the data recognition model to analyze keywords and different texts in the file to be processed, and obtaining the text content categories of different texts, a one-pass clustering process can be performed on the text content categories of different texts to obtain clustering results. After obtaining the clustering results, the text content categories among the different text content categories whose similarity to the clustering results is higher than a similarity threshold can be identified as rule names. The clustering results can be used to represent the clusters obtained after performing a one-pass clustering process on the text content categories of different texts. The similarity threshold can be a pre-set threshold based on actual conditions, or it can be a critical threshold for measuring the highest similarity, for example, 0.25. This is only an example and no specific limitation is made on the value of the similarity threshold.

[0090] Optionally, after calling the LLM large model to analyze the keywords and different texts in the file to be processed, and summarizing the text content category of each text in the log to be detected, the OnePassCluster algorithm can be used to cluster the above text content categories output by the LLM large model to obtain the clustering results. Among them, the OnePassCluster algorithm has the advantages of fast speed, small memory consumption, and no need to specify the number of clustering categories in advance.

[0091] Optionally, for the similarity calculation part of the clustering algorithm, the text embedding can be vectorized beforehand using the Text2vec algorithm (a text-to-vector conversion algorithm), and then the cosine distance can be calculated to measure the similarity. That is, Text2vec converts the text into vectors, and then the cosine distance between the vectors is calculated; the smaller the cosine distance, the higher the similarity. The Text2vec algorithm is trained based on the CoSENT algorithm.

[0092] Optionally, after obtaining the clustering results, i.e., obtaining the clusters, the text content categories with a similarity higher than the clustering result can be identified as rule names based on the clustered clusters. That is, the text content category closest to the cluster center (i.e., the text content category with the smallest cosine distance to the cluster center) is selected as the representative of that cluster, and this text content category is used as the rule name for the detection rule, i.e., the category name in the final classification and grading. It should be noted that there can be only one text content category with a similarity higher than the clustering result. When there are multiple text content categories with a similarity higher than the clustering result, one text content category can be selected from the multiple categories according to actual needs, or any text content category can be selected arbitrarily from the multiple categories. This is only an example and does not impose specific restrictions on the selection method of text content categories with a similarity higher than the clustering result.

[0093] In related technologies, the academic community's AutoCOT automatically generates prompts based on text to complete classification tasks, but it can only generate basic category names and cannot generate specific executable detection logic rules. In addition, the clustering algorithm uses the K-means clustering algorithm, which requires the number of cluster centers to be specified in advance, resulting in poor universality.

[0094] However, in this embodiment, addressing the issue that the kmeans algorithm in the aforementioned related technologies requires pre-specifying the number of cluster centers and has poor universality, the OnePassCluster algorithm is adopted. This algorithm does not require pre-specifying the number of cluster centers and has better universality. Therefore, compared to AutoCOT, this application can directly generate executable detection logic rules instead of non-executable explanatory text, thereby achieving the technical effect of improving the generation efficiency of data detection strategies.

[0095] As an optional implementation, the method further includes: performing heuristic filtering on text content categories in an abnormal state from different text content categories; and performing a clustering process on different text content categories to obtain clustering results, including: performing a clustering process on the filtered text content categories of different texts to obtain clustering results.

[0096] In this embodiment, after calling the data recognition model to analyze the keywords and different texts in the file to be processed, and obtaining the text content categories of different texts, heuristic filtering can be performed on the text content categories that are in an abnormal state. After filtering out the text content categories that are in an abnormal state, a clustering process can be further performed on the filtered text content categories to obtain the clustering results. The text content categories that are in an abnormal state can be used to represent text content categories that are falsely reported, for example, text content categories with excessively long categories. This is only an example and no specific restrictions are placed on the text content categories that are in an abnormal state.

[0097] Optionally, after calling the LLM large model to analyze the keywords and different texts in the files to be processed, and summarizing the text content categories of the text in the files to be processed, a heuristic filtering method can be used to filter out text content categories in an abnormal state, that is, to filter out false positives that are obviously caused by the illusion of the large model, such as filtering out text content categories with excessively long category lengths. In addition to filtering out text content categories in an abnormal state, a heuristic filtering method can also be used to select the classification result with the highest relevance to the summarized text content categories from the different classification results of the large model corresponding to files to be processed with similar text content categories, and update and cover the other classification results.

[0098] Optionally, after filtering out text content categories that are in an abnormal state, the OnePassCluster algorithm can be used to cluster the filtered text content categories to obtain clustering results.

[0099] As an optional implementation, the recommendation level of the detection rule to be generated is determined based on the general category and the sensitivity index, including: determining the default sensitivity index corresponding to the general category, wherein the default sensitivity index is used to represent the default sensitivity of the text in the file to be processed in the general category; linearly combining the default sensitivity index and the sensitivity index to obtain the combination result; and determining the recommendation level that matches the combination result.

[0100] In this embodiment, after calling the data processing model to determine the general category and sensitivity index of the file to be processed, the default sensitivity index corresponding to the general category can be determined. After determining the default sensitivity index corresponding to the general category, the determined default sensitivity index and sensitivity index can be linearly combined to obtain the combined result. Further, a recommendation level matching the combined result can be determined. The default sensitivity index can be used to represent the default sensitivity level of the text in the file to be processed within the general category, and can also be called the default sensitivity level.

[0101] Optionally, after calling the data processing model to classify the text in the file to be processed into twenty universally defined categories, a default sensitivity index corresponding to each category can be determined. For example, a default sensitivity level can be assigned to each of the twenty categories, resulting in twenty default sensitivity levels. Further, the twenty default sensitivity levels and sensitivity indices can be linearly combined to obtain a combination result, and a recommendation level matching the combination result can be determined. That is, the twenty default sensitivity levels and sensitivity scores are linearly combined to obtain a new recommendation level as the recommendation level for the detection rule. A weight can be assigned to each default sensitivity level, each default sensitivity level is multiplied by its corresponding weight, and the results of multiplying the twenty default sensitivity levels by their weights are summed to obtain the total default sensitivity level. Further, the total default sensitivity level and sensitivity score can be linearly combined. A weight can be assigned to both the sensitivity score and the total default sensitivity level, the sensitivity score is multiplied by its corresponding weight, and the total default sensitivity level is multiplied by its corresponding weight. The results of multiplying the two are summed to obtain a new recommendation level.

[0102] As an optional implementation, the detection logic information of the detection rules is generated based at least on general categories, sensitivity indicators, and keywords, including: converting at least the general categories, sensitivity indicators, and keywords into feature vectors; inputting the feature vectors as positive samples into a decision tree structure model, and using the decision tree structure model to perform machine learning on the positive samples to obtain a trained decision tree classifier; obtaining the recognition logic information of the decision tree classifier, wherein the recognition logic information is used to represent the logic of the trained decision tree classifier in recognizing the input data; and determining the recognition logic information as the detection logic information.

[0103] In this embodiment, after calling the data processing model to determine the general category, sensitivity index, and keywords of the file to be processed, the determined general category, sensitivity index, and keywords can be converted into feature vectors. After converting the general category, sensitivity index, and keywords into feature vectors, the feature vectors can be used as positive samples input into the decision tree structure model, and the decision tree structure model is used to perform machine learning on the positive samples to obtain a decision tree classifier. After obtaining the decision tree classifier, the recognition logic information of the decision tree classifier can be obtained. Further, the obtained recognition logic information can be determined as detection logic information. Here, the feature vector can be a feature matrix. The decision tree classifier can be a classifier constructed through a decision tree. The recognition logic information can be used to represent the logic by which the trained decision tree classifier recognizes the input data, and can also be called a logical expression.

[0104] Optionally, after calling the data processing model to determine the general category, sensitivity index, and keywords of the files to be processed, the general category, sensitivity index, and keywords can be converted into feature vectors. That is, the general category, sensitivity index, and keywords can be combined to obtain feature vectors. These feature vectors can then be input into the Cart decision tree algorithm to train a decision tree classifier for each detection rule (i.e., the clusters obtained by performing a clustering process on the text content categories of different texts). In the training set corresponding to each decision tree classifier, positive samples can be set as the feature vectors of files contained in the cluster corresponding to that detection rule, while files from other clusters can be set as negative samples.

[0105] Optionally, after obtaining the decision tree classifier, the recognition logic information of the decision tree classifier can be acquired, that is, the trained tree structure classifier can be expanded into a logical expression. Finally, the acquired recognition logic information can be determined as the detection logic information, that is, a complete set of classification and hierarchical detection rules can be obtained. The obtained classification and hierarchical detection rules are usually several hundred, and the accuracy is generally greater than 99% on the training set.

[0106] As an optional implementation, the method further includes: invoking a data recognition model to identify entity objects in the text of the file to be processed, wherein the data recognition model is trained based on a large language model; and converting at least the general category, sensitivity index, and keywords into feature vectors, including: combining the number of entity objects, recommendation level, file identifier of the file to be processed, general category, sensitivity index, and keywords to obtain feature vectors.

[0107] In this embodiment, a data recognition model can be invoked to identify entity objects in the text of the file to be processed. After identifying the entity objects in the text of the file to be processed, the number of entity objects, recommendation level, file identifier of the file to be processed, general category, sensitivity index, and keywords can be combined to obtain a feature vector. The data recognition model can be trained based on a large language model. Entity objects can at least include ID card numbers, mobile phone numbers, email addresses, addresses, bank card numbers, account passwords, etc., but this is only for illustrative purposes and no specific restrictions are placed on the type of entity objects. The file identifier of the file to be processed can be the file extension and file name of the file to be processed.

[0108] Optionally, based on CNN algorithms, regular expressions, and by calling LLM large models, entity objects in the text of the file to be processed can be identified. For example, more than 20 common entity objects, including ID card numbers, mobile phone numbers, email addresses, addresses, bank card numbers, account passwords, etc., can be identified and counted from the text contained in each log to be detected.

[0109] Furthermore, the number of entity objects, recommendation level, file identifier of the file to be processed, general category, sensitivity index and keywords can be combined. That is, the twenty general categories, sensitivity scores, the number of each entity object obtained above, the ten keywords summarized from the LLM model, and the file names reported in the file log are combined to obtain the feature vector.

[0110] As an optional implementation, the method further includes: in response to a selection operation, selecting a target detection strategy from multiple detection strategies; determining the target detection strategy as a subcategory; and classifying the subcategory under the parent category to which the general category belongs.

[0111] In this embodiment, after generating multiple detection strategies for the client, in response to a selection operation, a target detection strategy that meets the actual needs can be selected from the multiple detection strategies. The selected target detection strategy can be determined as a subcategory. Further, the subcategory can be categorized under the parent category of the general category. The selection operation can be a user's touch operation on multiple detection strategies; for example, the touch operation can be a click operation. This is only an example and does not impose specific limitations on the form of the selection operation.

[0112] Optionally, after generating multiple detection strategies, these strategies can be displayed. In response to a user clicking on a target detection strategy from the displayed strategies (i.e., a selection operation), the user can choose the rule that meets their needs from hundreds of detection rules (strategies), thus selecting the target detection strategy. This target detection rule is then designated as a subcategory and placed under the parent category of a general category. If a suitable parent category does not exist, it can be created.

[0113] In this embodiment, users can review and edit the generated detection rules based on the hit rate of online data. Users can continuously modify the detection logic and publish rules for false positives and false negatives.

[0114] As an optional implementation, the method further includes: if the detection strategy is in an abnormal state, adjusting the detection strategy in response to the adjustment operation of the detection strategy, and training a data processing model using the adjusted detection strategy; obtaining the target file that triggered the online detection strategy, and training the data processing model using the target file.

[0115] In this embodiment, after generating the detection strategy, if the detection strategy is in an abnormal state, in response to the adjustment operation of the detection strategy, the detection strategy can be adjusted, and the data processing model can be trained using the adjusted detection strategy. It is also possible to obtain the target file that triggered the deployed detection strategy and use the target file to train the data processing model. The abnormal state can be used to indicate the false positive and false negative status of the detection strategy. The target file can be a file that triggered the deployed detection strategy, for example, a file that has been matched by deployed rules.

[0116] Optionally, if the detection strategy is in an abnormal state, in response to the adjustment operation of the detection strategy, the detection strategy can be adjusted, and the data processing model can be trained using the adjusted detection strategy. That is, this embodiment automatically feeds back files with false positives and false negatives as new samples to automatically and continuously optimize the deep learning sub-model and the LLM large model.

[0117] Optionally, this embodiment also utilizes the target files that triggered the detection strategy after going live to train the data processing model. That is, this embodiment also automatically feeds back the files that have been matched by the rules that have been launched as new samples to automatically and continuously optimize the deep learning sub-model and the LLM large model.

[0118] In this embodiment, as new file categories continue to emerge, users no longer need professional algorithm knowledge, nor do they need to expend a lot of manpower to configure new detection rules, and can quickly generate new rules with high accuracy.

[0119] In this embodiment, the files to be processed are classified into general categories with universally defined characteristics; a sensitivity assessment is performed on the files to be processed to obtain sensitivity indicators; and keywords are extracted from the files to be processed. Furthermore, based on the general categories, sensitivity indicators, and keywords, the recommendation level, rule name, and detection logic information of the detection rules to be generated are determined. Finally, the recommendation level, rule name, and detection logic information are used to generate a detection strategy, which can be used to represent the generated detection rules. Since the generated detection rules include recommendation level, rule name, and detection logic information, the detection rules can realize functions such as data classification, grading, and detection logic, thereby achieving the purpose of customized batch automatic generation of detection strategies. Customization is reflected in the aforementioned classification, grading, and detection logic; batch processing is reflected in the ability to process a batch of files to be processed, and processing each file to be processed can produce hundreds of detection rules. This application embodiment uses a large model base to train a data processing model, which can determine the general category, sensitivity index and keywords of the file to be processed. Without relying on manual annotation of samples, it can automatically generate detection strategies with high accuracy, greatly shorten the generation cycle and manpower cost of detection strategies, and thus achieve the technical effect of improving the generation efficiency of data detection strategies, solving the technical problem of low generation efficiency of data detection strategies.

[0120] This application also provides another method for generating a data detection strategy. Figure 3 This is a flowchart of a method for generating another data detection strategy according to an embodiment of this application, such as... Figure 3 As shown, the method may include the following steps:

[0121] Step S302: Obtain the file to be processed from the client's data assets.

[0122] In the technical solution provided in step S302 of this application, files to be processed can be obtained from the client's data assets. The categories of data assets correspond to the client's data usage scenarios. Files to be processed may include log data to be detected generated during the client's operation in the data usage scenario, which can be referred to as file scan logs.

[0123] In this embodiment, based on asset mapping capabilities, users can select a specified range of clients (deployed on terminal devices) and scan files in a specified directory to obtain files to be processed, or obtain files to be processed by manually submitting a batch of files.

[0124] Optionally, after obtaining the file to be processed, i.e., the file scan log, the obtained file scan log can be reported to the server. After the server obtains the file scan log, it can provide the file content parsing text to the LLM large model and other deep learning sub-models to perform the following steps to generate the client's detection strategy. The file content parsing text can be one of the fields contained in the file scan log.

[0125] Step S304: Call the classification model to classify the files to be processed and obtain general categories; call the sensitivity assessment model to perform sensitivity assessment on the files to be processed and obtain sensitivity indicators; call the data recognition model to extract keywords from the files to be processed.

[0126] In the technical solution provided in step S304 of this application, after obtaining the file to be processed from the client's data assets, a classification model can be invoked to classify the file to be processed and obtain a general category. A sensitivity assessment model can be invoked to assess the sensitivity of the file to be processed and obtain a sensitivity index. A data recognition model can be invoked to extract keywords from the file to be processed. The classification model can be obtained by training a corresponding deep learning model using general category samples; it can also be called a general category classification model. The general category can be used to represent categories with general meaning, that is, categories with universal definitions.

[0127] Optionally, the sensitivity assessment model can be obtained by training a corresponding deep learning model using sensitivity index samples, and can also be called a sensitivity scoring model. The text in the file to be processed can be the parsed text of the file content, which can be one of the fields contained in the file to be processed. The sensitivity index can be used to represent the sensitivity of the text in the file to be processed. For example, the sensitivity index can be represented by a score of 0 to 100. In this case, the sensitivity index can also be called a sensitivity score or sensitivity rating. The higher the score, the more sensitive the text content.

[0128] Optionally, the data recognition model can be trained based on a large language model, such as an LLM model. Keywords can be used to describe the text structure and can also be called topic words.

[0129] In this embodiment, after obtaining the file to be processed, a classification model can be invoked to classify the file and obtain a general category. Alternatively, the classification model can be invoked to classify the file according to a deep learning algorithm, and the resulting general category is the result of a deep learning algorithm. Optionally, after obtaining the file scanning log, this embodiment can utilize an algorithm service deployed on the server to calculate the file scanning log, and can classify the file scanning log based on an MLP algorithm to obtain a general category.

[0130] Optionally, this embodiment invokes a sensitivity assessment model to perform a sensitivity assessment on the file to be processed, obtaining sensitivity indicators. The sensitivity assessment model can be invoked to perform a sensitivity assessment on the file to be processed using a deep learning algorithm, and the obtained sensitivity indicators are the results of a deep learning algorithm. Optionally, after obtaining the file scan logs, this embodiment can utilize an algorithm service deployed on the server to calculate the file scan logs, and can perform a sensitivity assessment on the file scan logs based on a self-developed deep learning algorithm to obtain sensitivity indicators.

[0131] Optionally, this embodiment invokes a data recognition model to identify keywords from the file to be processed. The data recognition model can be an LLM (Limited Least Metric) model, which has zero-shot classification capabilities, eliminating the need to pre-specify the number of categories and enabling automatic batch generation of classification and grading detection logic rules. A Prompt corresponding to the file to be processed can be determined; for example, COT (Copyright Occurrence Technology) can be used to write a Prompt corresponding to the file. Furthermore, the Prompt can be used to guide the LLM model to extract keywords that characterize the text structure from the text of the file to be processed.

[0132] Step S306: Based on the general category and sensitivity index, determine the recommendation level of the detection rule to be generated, generate the rule name of the detection rule based on keywords, and generate the detection logic information of the detection rule based at least on the general category, sensitivity index and keywords.

[0133] In the technical solution provided in step S306 of this application, after determining the general category, sensitivity indicators, and keywords, the recommendation level of the detection rule to be generated can be determined based on the general category and sensitivity indicators. Based on the keywords, the rule name of the detection rule can be generated. And at least based on the general category, sensitivity indicators, and keywords, the detection logic information of the detection rule can be generated. Here, the detection rule can be used to represent a rule for security detection of the client, and can also be called a classification and grading detection logic rule. The recommendation level can be used to represent the priority of the recommended detection rule, and can also be called a rule level. The rule name can be the category name of the detection rule to be generated. The detection logic information can be used to represent the logic used by the detection rule during execution; the detection logic information can be the executable detection logic of the detection rule, and can also be called a rule detection logic expression.

[0134] In this embodiment, after calling the data processing model to determine the general category and sensitivity index of the file to be processed, the default sensitivity index corresponding to the general category can be determined first. Based on the default sensitivity index and the sensitivity index, the recommendation level of the detection rule to be generated can be determined.

[0135] Optionally, after calling the data processing model and determining the keywords, the text content categories of the text in the file to be processed can be determined based on the keywords. Further clustering of the determined text content categories can generate rule names for the detection rules.

[0136] Optionally, after calling the data processing model and determining the general category, sensitivity index, and keywords of the file to be processed, the general category, sensitivity index, and keywords of the file to be processed can be combined to generate detection logic information for the detection rules.

[0137] Step S308: Generate the client's detection strategy by combining the recommendation level, rule name, and detection logic information.

[0138] In the technical solution provided in step S308 of this application, after determining the recommendation level, rule name, and detection logic information of the detection rule to be generated, the determined recommendation level, rule name, and detection logic information can be used to generate a detection strategy for the client. The detection strategy can be used to represent the generated detection rule.

[0139] In this embodiment, the generated detection strategy may include the recommendation level of the detection rule (i.e., rule level, classification level), rule name (i.e., classification name in classification level) and detection logic information (i.e. rule detection logic expression).

[0140] This embodiment generates detection strategies through customized batch automatic training, which can save the manpower cost of manually configuring detection rules and shorten the cycle of updating and iterating detection rules.

[0141] Through steps S302 to S308 of this application, the files to be processed are classified into general categories with universally defined characteristics; a sensitivity assessment is performed on the files to be processed to obtain sensitivity indicators; and keywords are extracted from the files to be processed. Further, based on the general categories, sensitivity indicators, and keywords, the recommendation level, rule name, and detection logic information of the detection rules to be generated are determined. Finally, the recommendation level, rule name, and detection logic information are used to generate a detection strategy, which can be used to represent the generated detection rules. Since the generated detection rules include recommendation level, rule name, and detection logic information, the detection rules can realize functions such as data classification, grading, and detection logic, thereby achieving the purpose of customized batch automatic generation of detection strategies. Customization is reflected in the aforementioned classification, grading, and detection logic; batch processing is reflected in the ability to process a batch of files to be processed, and processing each file to be processed can produce hundreds of detection rules. This application embodiment uses a large model base to train a data processing model, which can determine the general category, sensitivity index and keywords of the file to be processed. Without relying on manual annotation of samples, it can automatically generate detection strategies with high accuracy, greatly shorten the generation cycle and manpower cost of detection strategies, and thus achieve the technical effect of improving the generation efficiency of data detection strategies, solving the technical problem of low generation efficiency of data detection strategies.

[0142] This application also provides a method for generating another data detection strategy. Figure 4 This is a flowchart of a method for generating a data detection strategy according to an embodiment of this application, such as... Figure 4 As shown, the method may include the following steps:

[0143] Step S402: Obtain the file to be processed by calling the first interface.

[0144] In the technical solution provided by step S402 of this application, the file to be processed can be obtained by calling a first interface. The first interface may include a first parameter. The value of the first parameter can be the file to be processed. The file to be processed may include log data to be detected generated by the client during operation, and may also be referred to as a file scan log.

[0145] In this embodiment, based on asset mapping capabilities, users can select a specified range of clients (deployed on terminal devices) and scan files in a specified directory, or manually report a batch of files and obtain the files to be processed by calling the first interface.

[0146] Optionally, after obtaining the file to be processed, i.e., the file scan log, the obtained file scan log can be reported to the server. After the server obtains the file scan log, it can provide the file content parsing text to the LLM large model and other deep learning sub-models to perform the following steps to generate the client's detection strategy. The file content parsing text can be one of the fields contained in the file scan log.

[0147] Step S404: Call the data processing model to determine the general category, sensitivity index and keywords of the file to be processed.

[0148] In the technical solution provided in step S404 of this application, after obtaining the file to be processed by calling the first interface, a data processing model can be called to determine the general category, sensitivity index, and keywords of the file to be processed. The data processing model is at least trained based on a large model, i.e., the data processing model is trained using a large model base. The general category can be used to represent a category with a general meaning, i.e., a category with a universally applicable definition. The sensitivity index can be used to represent the sensitivity level of the text in the file to be processed. For example, a score of 0–100 can be used to represent the sensitivity index; this sensitivity index can also be called a sensitivity score or sensitivity rating. The higher the score, the more sensitive the text content. The text in the file to be processed can be the parsed text of the file content, which can be one of the fields contained in the file to be processed. Keywords can be used to describe the text structure and can also be called topic terms.

[0149] In this embodiment, after obtaining the file to be processed, the general category classification model in the data processing model is called to determine the general category of the file to be processed. That is, the file to be processed can be classified into a general category with universal definition.

[0150] Optionally, after obtaining the file to be processed, the sensitivity scoring model in the data processing model can be called to determine the sensitivity index of the file to be processed. That is, the sensitivity of the text itself in the file to be processed can be scored from 0 to 100. The higher the score, the more sensitive the text content is.

[0151] Optionally, after obtaining the file to be processed, the LLM model in the data processing model can be called to determine the keywords of the file to be processed, that is, to identify the keywords from the file to be processed.

[0152] Step S406: Based on the general category and sensitivity index, determine the recommendation level of the detection rule to be generated, generate the rule name of the detection rule based on keywords, and generate the detection logic information of the detection rule based at least on the general category, sensitivity index and keywords.

[0153] In the technical solution provided in step S406 of this application, after calling the data processing model and determining the general category, sensitivity indicators, and keywords of the file to be processed, the recommendation level of the detection rule to be generated can be determined based on the determined general category and sensitivity indicators. Based on the determined keywords, the rule name of the detection rule can be generated, and at least based on the determined general category, sensitivity indicators, and keywords, the detection logic information of the detection rule can be generated. The detection rule can be used to represent a rule for security detection of the client, and can also be called a classification and grading detection logic rule. The recommendation level can be used to represent the priority of the recommended detection rule, and can also be called a rule level. The rule name can be the category name of the detection rule to be generated. The detection logic information can be used to represent the logic used by the detection rule during execution; the detection logic information can be the executable detection logic of the detection rule, and can also be called a rule detection logic expression.

[0154] In this embodiment, after calling the data processing model to determine the general category and sensitivity index of the file to be processed, the default sensitivity index corresponding to the general category can be determined first. Based on the default sensitivity index and the sensitivity index, the recommendation level of the detection rule to be generated can be determined.

[0155] Optionally, after calling the data processing model and determining the keywords, the text content categories of the text in the file to be processed can be determined based on the keywords. Further clustering of the determined text content categories can generate rule names for the detection rules.

[0156] Optionally, after calling the data processing model and determining the general category, sensitivity index, and keywords of the file to be processed, the general category, sensitivity index, and keywords of the file to be processed can be combined to generate detection logic information for the detection rules.

[0157] Step S408: Generate the client's detection strategy by combining the recommendation level, rule name, and detection logic information.

[0158] In the technical solution provided in step S408 of this application, after determining the recommendation level, rule name, and detection logic information of the detection rule to be generated, the determined recommendation level, rule name, and detection logic information can be used to generate a detection strategy for the client. The detection strategy can be used to represent the generated detection rule.

[0159] In this embodiment, the generated detection strategy may include the recommendation level of the detection rule (i.e., rule level, classification level), rule name (i.e., classification name in classification level) and detection logic information (i.e. rule detection logic expression).

[0160] This embodiment generates detection strategies through customized batch automatic training, which can save the manpower cost of manually configuring detection rules and shorten the cycle of updating and iterating detection rules.

[0161] Step S410: Output the detection strategy by calling the second interface.

[0162] In the technical solution provided in step S410 of this application, after generating the client's detection strategy from the recommendation level, rule name, and detection logic information, the detection strategy can be output by calling the second interface. The second interface may include a second parameter, the value of which can be the detection strategy.

[0163] This embodiment generates detection strategies through customized batch automatic training, which can save the manpower cost of manually configuring detection rules and shorten the cycle of updating and iterating detection rules.

[0164] Through steps S402 to S410 of this application, the files to be processed are classified into general categories with universal definitions, a sensitivity assessment is performed on the files to be processed to obtain sensitivity indicators, and keywords are extracted from the files to be processed. Further, based on the general categories, sensitivity indicators, and keywords, the recommendation level, rule name, and detection logic information of the detection rules to be generated are determined. Finally, the recommendation level, rule name, and detection logic information are used to generate a detection strategy, which can be used to represent the generated detection rules. Since the generated detection rules include recommendation level, rule name, and detection logic information, the detection rules can realize functions such as data classification, grading, and detection logic, thereby achieving the purpose of customized batch automatic generation of detection strategies. Customization is reflected in the aforementioned classification, grading, and detection logic; batch processing is reflected in the ability to process a batch of files to be processed, and processing each file to be processed can produce hundreds of detection rules. This application embodiment uses a large model base to train a data processing model, which can determine the general category, sensitivity index and keywords of the file to be processed. Without relying on manual annotation of samples, it can automatically generate detection strategies with high accuracy, greatly shorten the generation cycle and manpower cost of detection strategies, and thus achieve the technical effect of improving the generation efficiency of data detection strategies, solving the technical problem of low generation efficiency of data detection strategies.

[0165] This application also provides a data detection strategy generation system. Figure 5 This is a schematic diagram of a data detection strategy generation system according to an embodiment of this application, such as... Figure 5 As shown, the data detection strategy generation system 500 may include at least: client 502 and server 504.

[0166] Client 502 is used to upload files to be processed, which include log data to be detected generated during the operation of the client.

[0167] Optionally, based on asset surveying capabilities, users can select a specified range of clients (deployed on terminal devices) and scan files in a specified directory to obtain files to be processed, or manually submit a batch of files to obtain files to be processed.

[0168] Optionally, after obtaining the file to be processed, i.e., the file scan log, the client 502 can report the obtained file scan log to the server 504. After the server obtains the file scan log, it can provide file content parsing text to the LLM large model and other deep learning sub-models to generate the client's detection strategy. The file content parsing text can be one of the fields contained in the file scan log.

[0169] The server-side 504 statement is used to invoke the data processing model to determine the general category, sensitivity index, and keywords of the file to be processed. The data processing model is trained on at least a large model. The general category represents a category with general meaning, the sensitivity index represents the sensitivity of the text in the file to be processed, and the keywords describe the text structure. Based on the general category and sensitivity index, the recommendation level of the generated detection rules is determined. Based on the keywords, the rule name of the detection rule is generated. At least based on the general category, sensitivity index, and keywords, the detection logic information of the detection rule is generated. The detection rule represents the rule for security detection on the client, the recommendation level represents the priority of the recommended detection rule, and the detection logic information represents the logic used by the detection rule during execution. The recommendation level, rule name, and detection logic information are used to generate the client-side detection strategy, where the detection strategy represents the generated detection rule.

[0170] Optionally, after the server receives the file to be processed reported by the client (502) via a 504 error, it can call the general category classification model in the data processing model to determine the general category of the file to be processed. That is, the file can be classified into twenty universally defined categories. It can also call the sensitivity scoring model in the data processing model to determine the sensitivity index of the file to be processed. That is, the sensitivity of the text in the file can be scored from 0 to 100, with higher scores indicating more sensitive text content. Finally, it can call the LLM model in the data processing model to determine the keywords in the file to be processed.

[0171] Optionally, after calling the data processing model to determine the general category and sensitivity indicators of the file to be processed, the default sensitivity indicators corresponding to the general category can be determined first. Based on the default sensitivity indicators and the sensitivity indicators, the recommendation level of the detection rules to be generated can be determined. After calling the data processing model to determine the keywords, the text content category of the text in the file to be processed can be determined based on the keywords. Further clustering of the determined text content categories can generate the rule names of the detection rules. After calling the data processing model to determine the general category, sensitivity indicators, and keywords of the file to be processed, the general category, sensitivity indicators, and keywords can be combined to generate the detection logic information of the detection rules.

[0172] Optionally, after determining the recommendation level, rule name, and detection logic information of the detection rule to be generated, the determined recommendation level, rule name, and detection logic information can be used to generate a detection strategy for the client. The generated detection strategy may include the recommendation level of the detection rule (i.e., rule level, or level in classification and grading), rule name (i.e., category name in classification and grading), and detection logic information (i.e., rule detection logic expression).

[0173] This embodiment generates detection strategies through customized batch automatic training, which can save the manpower cost of manually configuring detection rules and shorten the cycle of updating and iterating detection rules.

[0174] In the system for generating the detection strategy for this data, a file to be processed is uploaded via client 502, which includes log data to be detected generated by the client during operation. The data processing model is invoked via server 504 to determine the general category, sensitivity index, and keywords of the file to be processed. The data processing model is trained on at least a large model. The general category represents a category with general meaning, the sensitivity index represents the sensitivity of the text in the file, and the keywords describe the text structure. Based on the general category and sensitivity index, the recommendation level of the detection rule to be generated is determined. Based on the keywords, the rule name of the detection rule is generated. At least based on the general category, sensitivity index, and keywords, the detection logic information of the detection rule is generated. The detection rule represents the rule for security detection of the client, the recommendation level represents the priority of the recommended detection rule, and the detection logic information represents the logic used by the detection rule during execution. The recommendation level, rule name, and detection logic information are used to generate the client's detection strategy. The detection strategy represents the generated detection rule, thus improving the technical efficiency of data detection strategy generation and solving the technical problem of low generation efficiency.

[0175] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application, such as the data to be verified, are all information and data authorized by the user or fully authorized by all parties. Furthermore, the collection, use and processing of the relevant data must comply with the relevant laws, regulations and standards of the relevant countries and regions, and corresponding operation entry points are provided for users to choose to authorize or refuse.

[0176] Currently, regarding the classification and grading issues in the field of data security, the traditional security operation chain in the data security industry, from the discovery of a certain type of sensitive asset to the final release of a detection algorithm for that type of sensitive asset, usually takes more than three months, and the accuracy is low, with high human maintenance costs.

[0177] In related technologies, the traditional classification and grading methods in the data security industry rely on highly specialized security operations personnel to manually collect keywords and define regular expressions to develop detection strategies. From the discovery of a type of sensitive asset to the development of detection standards and solutions, and finally the release of a classification and grading detection algorithm for that type of sensitive asset, it typically takes more than six months. Furthermore, the types of sensitive assets are constantly evolving, with new categories emerging over time. Therefore, this model requires highly specialized security personnel to continuously invest manpower in maintenance, resulting in extremely high costs and slow response times.

[0178] Various classification and grading schemes are offered in related technologies. For example, schemes based on simple word frequency, regularization, and keywords require significant manpower to configure rules, resulting in low precision and recall, and poor performance. Schemes based on simple traditional machine learning algorithms have fixed detection rule templates, cannot provide detection rules trained on user data, and also suffer from low precision and recall, resulting in poor performance. Some schemes only support selection from existing fixed templates based on simple keywords and regularization, leading to poor results. Schemes based on unsupervised clustering classification algorithms in traditional machine learning have limited categories and poor precision and recall. Schemes based on lexicons and regularization rules only support selection from existing fixed templates, resulting in poor performance. The academic community's AutoCOT uses a large LLM model to automatically generate prompt words based on text to complete classification tasks, but it can only generate basic category names and cannot generate specific executable detection logic rules, and it has not been practically applied.

[0179] To address the aforementioned issues, this application proposes a streamlined method for automatically generating detection rules for data security classification and grading. Based on self-developed automated generation of detection rules for data security classification and grading, and using an open-source LLM large model base, it automatically generates data security classification and grading detection rules with high accuracy, providing an automated digital solution. This significantly shortens the generation cycle of detection rules for data security classification and grading, reduces manpower and time costs, and realizes the implementation of automated classification and grading of sensitive assets based on a large model.

[0180] The aforementioned solutions in related technologies lack a similar streamlined approach for automatically generating classification and grading detection rules. Furthermore, most of these solutions are based on keywords and regular expressions, typically achieving an accuracy of less than 70% and a recall of less than 10%. A few solutions incorporate traditional machine learning algorithms, but these generally achieve an accuracy of less than 80% and a recall of less than 50%. In addition, keyword- and regular expression-based solutions require significant manpower for rule configuration and are computationally slow; models generated using traditional machine learning methods are rigid, difficult to iterate, and unsuitable for diverse industry data usage scenarios. However, this application enables the practical implementation of automatically generating classification and grading detection rules from large models, achieving a precision and recall greater than 90%. Therefore, this application outperforms the aforementioned algorithms in terms of accuracy, recall, generalization ability, computational efficiency, and cost.

[0181] Furthermore, the academic AutoCOT algorithm in related technologies automatically generates prompts from text to complete classification tasks, but it can only generate basic category names and cannot generate specific executable detection logic rules. Moreover, its clustering algorithm uses the k-means algorithm. However, the OnePassCluster algorithm used in this application, compared to the k-means algorithm, does not require pre-specifying the number of cluster centers and has better universality. Compared to AutoCOT, this application can directly generate executable detection logic rules instead of non-executable explanatory text.

[0182] This application aims to integrate artificial intelligence (AI) into the traditional data security industry to address pain points in the traditional process. By combining the open-source LLM large model base, it has independently developed the ability to automatically generate detection rules for data security classification and grading, and implemented an automated classification and grading process for sensitive assets. This provides enterprises or organizations with classification and grading guidelines that are customized based on their own sensitive assets, greatly reducing the user threshold and improving asset governance efficiency.

[0183] The method described in this embodiment will be further described below.

[0184] This embodiment leverages the zero-shot classification capability of large models to build a process that automates the training of text classifiers from asset mapping, text classification, text keyword extraction to text category clustering, and finally generates classification and grading detection logic rules. It provides enterprises or organizations with classification and grading definition guidelines based on their own sensitive assets and runnable logic detection rules.

[0185] The framework first provides parsed text for the LLM main model and other deep learning sub-models based on file logs reported by the client's local scanning. There are three deep learning sub-models, all based on the parsed text, and their functions are: classifying files into universally defined categories, scoring the sensitivity of the text itself, and identifying entities in the text (e.g., addresses, account passwords, emails, phone numbers, ID numbers, etc.) using regular expressions, and combining the results of these two methods to give a default sensitivity level for the file. The main model, based on the parsed text, first extracts keywords from the text, then identifies entities in the text (e.g., account passwords, personal names, company names, product names, etc.), and finally classifies the text. The text categories generated by the main model are heuristically filtered to remove obvious false positives, and then clustered to obtain rule names for batch detection rules. The average sensitivity level of the clusters is taken as the classification level of the detection rule. Furthermore, the general category classification, sensitivity score, and keywords are transformed into a feature matrix for training a decision tree classifier. Secondly, the recognition logic of the decision tree is derived as the executable detection logic of the detection rules, resulting in customized batch automatic training and generation of detection rules. This greatly saves the manpower cost of manually configuring detection rules and shortens the cycle of updating and iterating detection rules.

[0186] Figure 6 This is a schematic diagram of a detection rule according to an embodiment of this application, such as... Figure 6 As shown, Figure 6 The left side of the middle section represents the parent-child category tree structure. Personal data, management data, training materials, recruitment information, salary and benefits, onboarding and offboarding, corporate culture, and financial data are the parent categories. The subcategory under the parent category of salary and benefits is L4, "Employee Salaries." The corresponding detection rules for this subcategory are as follows: Figure 6 As shown on the right, the generated detection rules include the rule name (i.e., the category name in classification and grading), the rule level (i.e., the grading in classification and grading), and the rule detection logic expression.

[0187] The rule information section includes L4 and employee salary, where L4 represents the rule level and employee salary represents the rule name (category). The configuration information section represents logical expressions, including conditional logical combinations and conditional combination displays. The conditional logical combinations are A and B and C and D and E. In the conditional combination display, A represents the file content (satisfying all conditions), B represents the format type (satisfying any condition), C represents the file size (greater than), D represents the algorithm category (satisfying any condition), and E represents the file name (excluding any condition).

[0188] Figure 7 This is a schematic diagram of a generation detection rule according to an embodiment of this application, such as... Figure 7 As shown, firstly, users utilize the provided asset mapping capabilities to select a range of terminal devices to scan files in a specified directory, or manually report a batch of files, uploading file scan logs to the server to provide parsed text of the file content for the LLM large model and other deep learning sub-models. One field in the file scan log is the parsed text of the file content.

[0189] Secondly, the algorithm service deployed on the server side performs calculations on these logs. First, it calculates the results of two deep learning algorithms for each log entry to be tested. These algorithms classify the text into twenty universally defined categories based on the MLP algorithm, and score the sensitivity of the text itself on a scale of 0 to 100 based on a self-developed deep learning algorithm. A higher score indicates a more sensitive text content. Specifically, the deep learning sub-model can be invoked to perform the above steps. That is, the general category classification model is used to classify the text into the twenty universally defined categories, and the sensitivity scoring model is used to score the sensitivity of the text itself, resulting in a sensitivity score. It should be noted that the classification of text into the twenty universally defined categories is also based on a self-developed deep learning algorithm, which is a modified version of the MLP algorithm.

[0190] Furthermore, based on CNN algorithms, regular expressions, and the use of LLM large models to identify entities in text (i.e. entity recognition), it can identify and count the number of more than 20 common entities, including ID card numbers, mobile phone numbers, email addresses, addresses, bank card numbers, account passwords, etc., from the text contained in each log to be detected.

[0191] The following section further introduces the method for generating the rule name (i.e., the classification in classification and grading) of the detection rules.

[0192] Optionally, a Prompt is written using COT technology, which calls the LLM large-scale model to extract ten keywords that can characterize the text structure (i.e., summarize the full-text keywords). Based on the keywords and the original text contained in the file scanning logs, the LLM large-scale model summarizes the category of the text content contained in each log to be detected (i.e., summarize the file category). Next, the summarized categories are post-processed. Heuristic filtering methods are used to filter out false positives that are clearly caused by model illusions (such as excessively long category lengths). Furthermore, the OnePassCluster algorithm is used to cluster the categories output by the large-scale model. This algorithm has advantages such as high speed, low memory consumption, and no need to pre-specify the number of clusters. For the similarity calculation part of the clustering algorithm, the text embedding can be vectorized beforehand using the Text2vec algorithm (the Text2vec algorithm is trained based on the CoSENT algorithm), and then the cosine distance is calculated to measure similarity. Finally, based on the clusters obtained, the category closest to the cluster center is selected as the representative of that category, and this category is used as the rule name of the detection rule (i.e., the category name in the final classification and grading).

[0193] The following section further introduces the method for generating recommendation levels (i.e., levels in classification and grading) for detection rules.

[0194] After calling the general category classification model to classify the text into twenty universally defined categories, a default sensitivity level can be assigned to each of the twenty categories. These twenty default sensitivity levels are then linearly combined with the two features of sensitivity score to obtain a new level as the recommended level for the detection rule.

[0195] The following section provides a further introduction to the method for generating executable detection logic expressions for detection rules.

[0196] The twenty general categories, sensitivity scores, the number of entities counted, the ten keywords summarized from the LLM model, and the filenames reported in the file logs are combined to obtain a feature vector. This feature vector is then input into the Cart decision tree algorithm to train a decision tree classifier for each detection rule (i.e., each cluster). In the training set corresponding to each classifier, positive samples are set as the feature vectors of files contained in the cluster corresponding to that rule, and files from other clusters are set as negative samples. Finally, the trained tree-structured classifier is expanded into a logical expression (i.e., derived logical expression) to obtain a complete set of classification and hierarchical detection rules. These rules typically number in the hundreds, and the accuracy is generally greater than 99% on the training set. A Domain Specific Language (DSL) policy engine can be used to manage these classification and hierarchical detection rules.

[0197] Furthermore, users first select rules that meet their needs from hundreds of detection rules and categorize them as subcategories under the parent category of the general category. If no suitable parent category exists, users can create one. Based on the hit rate of online data, users review and edit the generated detection rules, and can continuously modify the detection logic and publish rules for false positives and false negatives.

[0198] For files that have been correctly identified by the deployed rules, or those that have been falsely reported or missed, they will be automatically fed back as new samples to help continuously optimize the deep learning sub-models and the LLM main model. As new files continue to emerge, there is no longer a need for specialized algorithmic knowledge, nor is there a significant manpower cost for configuring new detection rules. New rules with high accuracy can be generated quickly. End users can export these rule sets at any time to generate their own classification and grading guidelines.

[0199] In terms of detection performance, this application employs the latest COT and LLM large-model technologies. These new technologies integrate multiple self-developed deep learning models and traditional machine learning algorithms, achieving significantly higher accuracy and recall than commonly used keyword and regular expression methods (which typically have an accuracy of less than 70% and a recall of less than 10%). Models based on traditional machine learning schemes (which typically have an accuracy of less than 80% and a recall of less than 50%) are rigid and difficult to iterate. In contrast, this embodiment performs customized training based on user application scenarios, resulting in higher accuracy and recall (accuracy greater than 99%, recall greater than 90%), flexible configuration, and faster model iteration. Compared to the academic AutoCOT technology, this embodiment does not require pre-specifying the number of categories to be classified and can directly generate executable logical detection rules.

[0200] Regarding computational costs, methods based on keywords and regular expressions in related technologies experience exponential increases in computational overhead with the number of configured rules, typically exceeding seconds, causing system lag and impacting normal office work. However, this embodiment only requires calculating deep learning operators and then linearly combining them into logical rules, without needing to compute a large model. Deep learning operators can be basic computational units in deep learning models, such as convolution, pooling, and fully connected layers. This embodiment achieves keyword matching and recognition by calculating deep learning operators and linearly combining them into logical rules. Compared to traditional regular expression-based methods, this deep learning operator-based method is faster and has lower training costs. Users only need to perform customized training of the large model once when new category files appear or during initialization, instead of recalculating the entire model each time, thus improving efficiency and reducing costs. In other words, this embodiment deeply optimizes the running speed of deep learning algorithms from the underlying framework, with a total overhead of approximately 60 to 140 milliseconds, more than ten times faster. Users only need to perform customized training on a large model once when a new category file appears or when initialization occurs, with a training cost of less than 100 yuan per session.

[0201] In terms of maintenance costs and flexibility, the conventional process for configuring detection strategies, from the discovery of a certain type of sensitive asset to the development of detection standards and schemes, and finally the release of classification and grading detection algorithms for that type of sensitive asset, typically takes more than six months. This application can automatically generate thousands of detection rules in batches within a day, and it is compatible with most large model services. Users can flexibly select large model bases for customized training as needed, and can also flexibly select the data range to be detected as needed, thereby reducing the user's usage costs, maintenance costs, and labor costs.

[0202] This application independently developed and combined various deep learning-specific small models and traditional machine learning models, and adopted the latest COT and LLM large model technologies to improve classification and grading accuracy. Thanks to the zero-shot classification capability of the LLM large model, it eliminates the need to pre-specify the number of categories, automatically generating classification and grading detection logic rules with superior performance compared to other related technologies. By manually writing efficient prompts, entity recognition and keyword extraction results are added to the COT, and post-processing clustering is performed on the output results, effectively improving the accuracy of the large model.

[0203] This embodiment describes a process that automates the training of a text classifier, from asset mapping, text classification, sensitivity scoring, entity recognition, text keyword extraction to text category clustering, and finally generates classification and grading detection logic rules. This framework automatically produces highly accurate and practically executable data security classification and grading detection rules, providing an automated digital solution that greatly shortens the generation cycle of data security classification and grading detection rules and reduces computation, maintenance, manpower, and time costs.

[0204] In this embodiment, the files to be processed are classified into general categories with universal definitions, a sensitivity assessment is performed on the files to be processed to obtain sensitivity indices, and keywords are extracted from the files to be processed. Furthermore, based on the general categories, sensitivity indices, and keywords, the recommendation level, rule name, and detection logic information of the detection rules to be generated are determined. Finally, the recommendation level, rule name, and detection logic information are used to generate a detection strategy, thereby achieving the goal of customized batch automatic generation of detection strategies. Because a large model base is used to train the data processing model, the general categories, sensitivity indices, and keywords of the files to be processed can be determined. There is no need to rely on manually labeled samples, and detection strategies with high accuracy can be automatically generated, greatly shortening the generation cycle and reducing labor costs. This achieves the technical effect of improving the generation efficiency of data detection strategies and solves the technical problem of low generation efficiency of data detection strategies.

[0205] Figure 8 This is a structural block diagram of the computing environment for a data detection strategy generation method according to an embodiment of this application, such as... Figure 8 As shown, computing environment 801 includes multiple computing nodes (such as servers) running on a distributed network (represented as 810-1, 810-2, ..., in the diagram). Each computing node contains local processing and memory resources, and end user 802 can remotely run applications or store data within computing environment 801. Applications can be provided as multiple services 820-1, 820-2, 820-3, and 820-4 within computing environment 801, representing services "A", "D", "E", and "H", respectively.

[0206] End user 802 can provide and access services through a web browser or other software applications on a client. In some embodiments, the provisioning and / or requests of end user 802 can be provided to ingress gateway 830. Ingress gateway 830 may include a corresponding agent to handle the provisioning and / or requests for services (one or more services provided in computing environment 801).

[0207] Services are provided or deployed based on various virtualization technologies supported by the computing environment 801. In some embodiments, services may be provided based on virtual machine (VM)-based virtualization, container-based virtualization, and / or similar methods. VM-based virtualization can simulate a real computer by initializing a virtual machine, executing programs and applications without directly accessing any actual hardware resources. While the machine is virtualized by a virtual machine, container-based virtualization can launch containers to virtualize an entire operating system (OS), allowing multiple workloads to run on a single OS instance.

[0208] In one embodiment based on container virtualization, several containers of a service can be assembled into a Pod (e.g., a Kubernetes Pod). For example, such as Figure 8 As shown, service 820-2 can be equipped with one or more Pods 840-1, 840-2, ..., 840-N (collectively referred to as Pods). A Pod can include a proxy 845 and one or more containers 842-1, 842-2, ..., 842-M (collectively referred to as containers). One or more containers within a Pod handle requests related to one or more corresponding functions of the service. The proxy 845 typically controls service-related network functions such as routing and load balancing. Other services can also be equipped with Pods similar to Pods.

[0209] During operation, executing a user request from end user 802 may require calling one or more services in computing environment 801, and executing one or more functions of one service may require calling one or more functions of another service. For example... Figure 8 As shown, service "A" 820-1 receives user requests from terminal user 802 from ingress gateway 830. Service "A" 820-1 can call service "D" 820-2, and service "D" 820-2 can request service "E" 820-3 to perform one or more functions.

[0210] The aforementioned computing environment can be a cloud computing environment, where resource allocation is managed by cloud services, allowing functionality development without needing to consider implementation, adjustment, or server scaling. This computing environment allows developers to execute event-responsive code without building or maintaining complex infrastructure. Services can be partitioned into a set of functions that can automatically and independently scale, rather than scaling a single hardware device to handle potential loads.

[0211] According to embodiments of this application, a method for implementing the above is also provided. Figure 2 The method for generating the data detection strategy shown is a data detection strategy generation device.

[0212] Figure 9 This is a schematic diagram of a data detection strategy generation device according to an embodiment of this application, such as... Figure 9 As shown, the data detection strategy generation device 900 may include: a first acquisition unit 902, a first determination unit 904, a second determination unit 906, and a first generation unit 908.

[0213] The first acquisition unit 902 is used to acquire the file to be processed, wherein the file to be processed includes the log data to be detected generated by the client during operation.

[0214] The first determining unit 904 is used to call the data processing model to determine the general category, sensitivity index and keywords of the file to be processed. The data processing model is trained based on at least a large model. The general category is used to represent the category with general meaning. The sensitivity index is used to represent the sensitivity of the text in the file to be processed. The keywords are used to describe the text structure of the text.

[0215] The second determining unit 906 is used to determine the recommendation level of the detection rule to be generated based on the general category and sensitivity index, generate the rule name of the detection rule based on keywords, and generate the detection logic information of the detection rule based on at least the general category, sensitivity index and keywords. The detection rule is used to represent the rule for security detection of the client, the recommendation level is used to represent the priority of the recommended detection rule, and the detection logic information is used to represent the logic adopted by the detection rule in the execution process.

[0216] The first generation unit 908 is used to generate a detection strategy for the client from the recommendation level, rule name and detection logic information, wherein the detection strategy is used to represent the generated detection rules.

[0217] It should be noted that the first acquisition unit 902, the first determination unit 904, the second determination unit 906, and the first generation unit 908 correspond to steps S202 to S208. The four units and their corresponding steps implement the same instances and application scenarios, but are not limited to the content disclosed above. It should also be noted that the aforementioned units can be hardware or software components stored in a memory (e.g., memory 1204) and processed by one or more processors (e.g., processors 1202a, 1202b, ..., 1202n). These units can also be part of a device and run in computer terminal A.

[0218] In the device for generating the detection strategy for this data, a file to be processed is acquired by a first acquisition unit 902, which includes log data to be detected generated by the client during operation. A first determination unit 904 invokes a data processing model to determine the general category, sensitivity index, and keywords of the file to be processed. The data processing model is trained on at least a large model; the general category represents a category with general meaning; the sensitivity index represents the sensitivity of the text in the file to be processed; and the keywords describe the text structure. A second determination unit 906 determines the recommendation level of the detection rule to be generated based on the general category and sensitivity index, generates the rule name of the detection rule based on the keywords, and generates detection logic information for the detection rule based on at least the general category, sensitivity index, and keywords. The detection rule represents the rule for security detection of the client; the recommendation level represents the priority of recommending the detection rule; and the detection logic information represents the logic of the detection rule. The first generation unit 908 generates a client-side detection strategy by combining the recommendation level, rule name, and detection logic information. The detection strategy represents the generated detection rules, thereby improving the efficiency of data detection strategy generation and solving the technical problem of low generation efficiency of data detection strategy.

[0219] According to embodiments of this application, a method for implementing the above is also provided. Figure 3 The method for generating the data detection strategy shown is a data detection strategy generation device.

[0220] Figure 10 This is a schematic diagram of a data detection strategy generation apparatus according to an embodiment of this application, such as... Figure 10 As shown, the data detection strategy generation device 1000 may include: a second acquisition unit 1002, a processing unit 1004, a third determination unit 1006, and a second generation unit 1008.

[0221] The second acquisition unit 1002 is used to acquire files to be processed from the client's data assets. The categories of data assets correspond to the client's data usage scenarios, and the files to be processed include log data to be detected generated by the client during operation in the data usage scenarios.

[0222] The processing unit 1004 is used to call a classification model to classify the file to be processed and obtain a general category, call a sensitivity assessment model to assess the sensitivity of the file to be processed and obtain a sensitivity index, and call a data recognition model to extract keywords from the file to be processed. The classification model is trained on the corresponding deep learning model using general category samples. The general category is used to represent a category with a general meaning. The sensitivity assessment model is trained on the corresponding deep learning model using sensitivity index samples. The sensitivity index is used to represent the sensitivity of the text in the file to be processed. The data recognition model is trained based on a large language model. Keywords are used to describe the text structure of the text.

[0223] The third determining unit 1006 is used to determine the recommendation level of the detection rule to be generated based on the general category and sensitivity index, generate the rule name of the detection rule based on keywords, and generate the detection logic information of the detection rule based on at least the general category, sensitivity index and keywords. The detection rule is used to represent the rule for security detection of the client, the recommendation level is used to represent the priority of the recommended detection rule, and the detection logic information is used to represent the logic adopted by the detection rule in the execution process.

[0224] The second generation unit 1008 is used to generate a client-side detection strategy from the recommendation level, rule name, and detection logic information, wherein the detection strategy is used to represent the generated detection rules.

[0225] Here, the second acquisition unit 1002, processing unit 1004, third determination unit 1006, and second generation unit 1008 correspond to steps S302 to S308. The four units and the corresponding steps implement the same instances and application scenarios, but are not limited to the content disclosed above. It should be noted that the above units can be hardware or software components stored in memory (e.g., memory 1204) and processed by one or more processors (e.g., processors 1202a, 1202b, ..., 1202n). The above units can also be part of a device and run in computer terminal A.

[0226] In the device for generating the detection strategy for this data, the second acquisition unit 1002 obtains the files to be processed from the client's data assets. The categories of the data assets correspond to the client's data usage scenarios, and the files to be processed include log data to be detected generated by the client during operation within the data usage scenarios. The processing unit 1004 calls a classification model to classify the files to be processed, obtaining a general category; calls a sensitivity assessment model to assess the sensitivity of the files to be processed, obtaining a sensitivity index; and calls a data recognition model to extract keywords from the files to be processed. The classification model is trained using general category samples on a corresponding deep learning model, where the general category represents categories with general meaning. The sensitivity assessment model is trained using sensitivity index samples on a corresponding deep learning model, where the sensitivity index represents the sensitivity level of the text in the files to be processed. The data recognition model is trained based on a large language model, and the keywords describe the text structure. The third determining unit 1006 determines the recommendation level of the detection rule to be generated based on general categories and sensitivity indicators, generates the rule name of the detection rule based on keywords, and generates the detection logic information of the detection rule based on at least general categories, sensitivity indicators, and keywords. Here, the detection rule represents the rule for performing security detection on the client, the recommendation level represents the priority of the recommended detection rule, and the detection logic information represents the logic of the detection rule. The second generating unit 1008 uses the recommendation level, rule name, and detection logic information to generate a detection strategy for the client. The detection strategy represents the generated detection rule, thereby improving the technical efficiency of generating the data detection strategy and solving the technical problem of low generation efficiency of the data detection strategy.

[0227] According to embodiments of this application, a method for implementing the above is also provided. Figure 4 The method for generating the data detection strategy shown is a data detection strategy generation device.

[0228] Figure 11 This is a schematic diagram of a data detection strategy generation apparatus according to another embodiment of this application, such as... Figure 11 As shown, the data detection strategy generation device 1100 may include: a third acquisition unit 1102, a fourth determination unit 1104, a fifth determination unit 1106, a third generation unit 1108, and an output unit 1110.

[0229] The third acquisition unit 1102 is used to acquire a file to be processed by calling a first interface, wherein the first interface includes a first parameter, the value of which is the file to be processed, and the file to be processed includes log data to be detected generated by the client during operation.

[0230] The fourth determining unit 1104 is used to call the data processing model to determine the general category, sensitivity index and keywords of the file to be processed. The data processing model is trained based on at least a large model. The general category is used to represent the category with general meaning. The sensitivity index is used to represent the sensitivity of the text in the file to be processed. The keywords are used to describe the text structure of the text.

[0231] The fifth determining unit 1106 is used to determine the recommendation level of the detection rule to be generated based on the general category and sensitivity index, generate the rule name of the detection rule based on keywords, and generate the detection logic information of the detection rule based on at least the general category, sensitivity index and keywords. The detection rule is used to represent the rule for security detection of the client, the recommendation level is used to represent the priority of the recommended detection rule, and the detection logic information is used to represent the logic adopted by the detection rule in the execution process.

[0232] The third generation unit 1108 is used to generate a client-side detection strategy from the recommendation level, rule name, and detection logic information, wherein the detection strategy is used to represent the generated detection rules.

[0233] The output unit 1110 is used to output the detection strategy by calling the second interface, wherein the second interface includes a second parameter, and the parameter value of the second parameter is the detection strategy.

[0234] It should be noted that the third acquisition unit 1102, the fourth determination unit 1104, the fifth determination unit 1106, the third generation unit 1108, and the output unit 1110 correspond to steps S402 to S410. The five units and their corresponding steps implement the same examples and application scenarios, but are not limited to the content disclosed above. It should also be noted that the aforementioned units can be hardware or software components stored in a memory (e.g., memory 1204) and processed by one or more processors (e.g., processors 1202a, 1202b, ..., 1202n). These units can also be part of a device and run in computer terminal A.

[0235] In the device for generating the detection strategy for this data, the third acquisition unit 1102 acquires the file to be processed by calling the first interface. The first interface includes a first parameter, the value of which is the file to be processed. The file to be processed includes log data to be detected generated by the client during operation. The fourth determination unit 1104 calls the data processing model to determine the general category, sensitivity index, and keywords of the file to be processed. The data processing model is trained based on at least a large model. The general category represents a category with general meaning, the sensitivity index represents the sensitivity of the text in the file to be processed, and the keywords describe the text structure. The fifth determination unit 1106 determines the recommendation level of the detection rule to be generated based on the general category and sensitivity index, generates the rule name of the detection rule based on the keywords, and generates the detection logic information of the detection rule based on at least the general category, sensitivity index, and keywords. The detection rule represents the rule for security detection of the client, the recommendation level represents the priority of recommending the detection rule, and the detection logic information represents the logic of the detection rule. The third generation unit 1108 generates a detection strategy for the client by combining the recommendation level, rule name, and detection logic information. The detection strategy represents the generated detection rules. The output unit 1110 outputs the detection strategy by calling a second interface, which includes a second parameter whose value is the detection strategy. This improves the efficiency of generating the detection strategy and solves the problem of low generation efficiency.

[0236] Embodiments of this application may provide a computer terminal, which may be any computer terminal device in a group of computer terminals. Optionally, in this embodiment, the aforementioned computer terminal may also be replaced by a mobile terminal or other terminal device.

[0237] Optionally, in this embodiment, the computer terminal may be located in at least one of a plurality of network devices in a computer network.

[0238] In this embodiment, the computer terminal described above can execute the following steps of the data detection strategy generation method: obtaining a file to be processed, wherein the file to be processed includes log data to be detected generated by the client during operation; calling a data processing model to determine the general category, sensitivity index, and keywords of the file to be processed, wherein the data processing model is trained based on at least a large model, the general category is used to represent a category with general meaning, the sensitivity index is used to represent the sensitivity of the text in the file to be processed, and the keywords are used to describe the text structure of the text; based on the general category and sensitivity index, determining the recommendation level of the detection rule to be generated, generating the rule name of the detection rule based on the keywords, and generating the detection logic information of the detection rule based at least on the general category, sensitivity index, and keywords, wherein the detection rule is used to represent the rule for security detection of the client, the recommendation level is used to represent the priority of the recommended detection rule, and the detection logic information is used to represent the logic of the detection rule; generating a detection strategy for the client by combining the recommendation level, rule name, and detection logic information, wherein the detection strategy is used to represent the generated detection rule.

[0239] Optionally, Figure 12 This is a structural block diagram of a computer terminal according to an embodiment of this application, such as... Figure 12 As shown, the computer terminal A may include one or more (only one is shown in the figure) processors 1202, memory 1204, and transmission devices 1206.

[0240] The memory can be used to store software programs and modules, such as the program instructions / modules corresponding to the data detection strategy generation method and apparatus in this application embodiment. The processor executes various functional applications and data processing by running the software programs and modules stored in the memory, thereby realizing the aforementioned data detection strategy generation method. The memory may include high-speed random access memory, and may also include non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory may further include memory remotely located relative to the processor, and these remote memories can be connected to terminal A via a network. Examples of such networks include, but are not limited to, the Internet, corporate intranets, local area networks, mobile communication networks, and combinations thereof.

[0241] Optionally, the processor may also execute program code that performs the following steps: calling the classification model in the data processing model to classify the file to be processed and obtain a general category, wherein the classification model is trained on the corresponding deep learning model using samples of the general category; calling the sensitivity assessment model in the data processing model to perform sensitivity assessment on the file to be processed and obtain a sensitivity index, wherein the sensitivity assessment model is trained on the corresponding deep learning model using samples of the sensitivity index; and calling the data recognition model in the data processing model to identify keywords from the file to be processed, wherein the data recognition model is trained based on a large language model.

[0242] Optionally, the processor may also execute program code that performs the following steps: determining prompt information corresponding to the file to be processed, wherein the prompt information is used to represent multiple steps for extracting keywords from the file to be processed, and the multiple steps have a logical relationship; and using the prompt information to guide the data recognition model to identify keywords from the file to be processed.

[0243] Optionally, the processor may also execute program code that calls a multilayer perceptron in the classification model to classify different texts in the file to be processed into different general categories.

[0244] Optionally, the processor may also execute program code that performs the following steps: calling a sensitivity assessment model to determine the text content of the text in the file to be processed, and performing a sensitivity assessment on the text content to obtain a sensitivity index, wherein the sensitivity index is positively correlated with the sensitivity of the text content.

[0245] Optionally, the processor may also execute program code that performs the following steps: calling a data recognition model to analyze keywords and different texts in the file to be processed to obtain the text content categories of different texts; and performing clustering processing on the text content categories of different texts to obtain rule names.

[0246] Optionally, the processor may also execute program code that performs the following steps: performing a clustering process on the text content categories of different texts to obtain clustering results; and identifying the text content types of different texts whose similarity to the clustering results is higher than a similarity threshold as rule names.

[0247] Optionally, the processor may also execute program code that performs the following steps: heuristically filtering text content categories in an abnormal state from different text content categories; performing a clustering process on different text content categories to obtain clustering results, including: performing a clustering process on the filtered text content categories of different texts to obtain clustering results.

[0248] Optionally, the processor may also execute program code that performs the following steps: determining the default sensitivity index corresponding to the general category, wherein the default sensitivity index is used to represent the default sensitivity of the text in the file to be processed in the general category; performing a linear combination of the default sensitivity index and the sensitivity index to obtain a combination result; and determining a recommendation level that matches the combination result.

[0249] Optionally, the processor may also execute program code that performs the following steps: converting at least the general category, sensitivity index, and keywords into feature vectors; training a decision tree classifier using the feature vectors, wherein the decision tree classifier is a classifier constructed through a decision tree; obtaining the recognition logic information of the trained decision tree classifier, wherein the recognition logic information is used to represent the logic by which the trained decision tree classifier recognizes the input data; and determining the recognition logic information as detection logic information.

[0250] Optionally, the processor may also execute program code that performs the following steps: calling a data recognition model to identify entity objects in the text of the file to be processed, wherein the data recognition model is trained based on a large language model; and converting at least the general category, sensitivity index, and keywords into feature vectors, including: combining the number of entity objects, recommendation level, file identifier of the file to be processed, general category, sensitivity index, and keywords to obtain feature vectors.

[0251] Optionally, the processor may also execute program code that performs the following steps: determining the detection strategy as a subcategory; and classifying the subcategory under the parent category.

[0252] Optionally, the processor may also execute program code that performs the following steps: if the detection strategy is in an abnormal state, adjust the detection strategy in response to the adjustment operation of the detection strategy, and train the data processing model using the adjusted detection strategy; obtain the target file that triggered the online detection strategy, and train the data processing model using the target file.

[0253] The processor can access information and applications stored in memory via a transmission device to perform the following steps: retrieving files to be processed from the client's data assets, wherein the categories of the data assets correspond to the client's data usage scenarios, and the files to be processed include log data to be detected generated by the client during operation within the data usage scenarios; invoking a classification model to classify the files to be processed to obtain general categories; invoking a sensitivity assessment model to perform sensitivity assessment on the files to be processed to obtain sensitivity indicators; and invoking a data recognition model to extract keywords from the files to be processed. Here, the classification model is trained using general category samples on the corresponding deep learning model, where the general categories represent categories with general meanings, and the sensitivity assessment model uses sensitivity indicator samples on the corresponding... The deep learning model is trained, and the sensitivity index is used to represent the sensitivity of the text in the file to be processed. The data recognition model is trained based on a large language model, and keywords are used to describe the text structure. Based on the general category and the sensitivity index, the recommendation level of the detection rule to be generated is determined. Based on the keywords, the rule name of the detection rule is generated, and at least based on the general category, sensitivity index, and keywords, the detection logic information of the detection rule is generated. Here, the detection rule is used to represent the rule for security detection of the client, the recommendation level is used to represent the priority of the recommended detection rule, and the detection logic information is used to represent the logic of the detection rule. The recommendation level, rule name, and detection logic information are used to generate the client's detection strategy, where the detection strategy is used to represent the generated detection rule.

[0254] The processor can access information and applications stored in memory via a transmission device to perform the following steps: obtaining a file to be processed by calling a first interface, wherein the first interface includes a first parameter, the value of which is the file to be processed, and the file to be processed includes log data to be detected generated by the client during operation; calling a data processing model to determine the general category, sensitivity index, and keywords of the file to be processed, wherein the data processing model is trained based on at least a large model, the general category represents a category with general meaning, the sensitivity index represents the sensitivity of the text in the file to be processed, and the keywords describe the text structure; based on the general category and sensitivity... The system uses sensitivity indicators to determine the recommendation level of the detection rules to be generated. Based on keywords, it generates the rule name of the detection rules and, at least based on general categories, sensitivity indicators, and keywords, generates the detection logic information of the detection rules. Here, the detection rules represent the rules for security detection of the client, the recommendation level represents the priority of recommending the detection rules, and the detection logic information represents the logic of the detection rules. The system then uses the recommendation level, rule name, and detection logic information to generate the client's detection strategy, where the detection strategy represents the generated detection rules. Finally, the system outputs the detection strategy by calling a second interface, where the second interface includes a second parameter whose value is the detection strategy.

[0255] Those skilled in the art will understand that Figure 12 The structure shown is for illustrative purposes only. Computer terminal A can also be a smartphone (such as an Android phone, iOS phone, etc.), tablet computer, handheld computer, mobile Internet device (MID), personal access display (PAD), and other terminal devices. Figure 12 This does not limit the structure of the aforementioned computer terminal A. For example, computer terminal A may also include components that are more complex than those described above. Figure 12 The more or fewer components shown (such as network interfaces, display devices, etc.), or having the same Figure 12 The different configurations shown.

[0256] Those skilled in the art will understand that all or part of the steps in the various methods of the above embodiments can be implemented by a program instructing the hardware related to the terminal device. The program can be stored in a computer-readable storage medium, which may include: flash drive, read-only memory (ROM), random access memory (RAM), disk or optical disk, etc.

[0257] Embodiments of this application also provide a computer-readable storage medium. Optionally, in this embodiment, the aforementioned computer-readable storage medium can be used to store the program code executed by the method for generating the data detection strategy provided in Embodiment 1 above.

[0258] Optionally, in this embodiment, the computer-readable storage medium may be located in any computer terminal in a group of computer terminals in a computer network, or in any mobile terminal in a group of mobile terminals.

[0259] Optionally, in this embodiment, the computer-readable storage medium is configured to store program code for performing the following steps: obtaining a file to be processed, wherein the file to be processed includes log data to be detected generated by the client during operation; invoking a data processing model to determine the general category, sensitivity index, and keywords of the file to be processed, wherein the data processing model is trained based on at least a large model, the general category is used to represent a category with general meaning, the sensitivity index is used to represent the sensitivity of the text in the file to be processed, and the keywords are used to describe the text structure of the text; based on the general category and sensitivity index, determining the recommendation level of the detection rule to be generated, generating the rule name of the detection rule based on the keywords, and generating the detection logic information of the detection rule based at least on the general category, sensitivity index, and keywords, wherein the detection rule is used to represent the rule for security detection of the client, the recommendation level is used to represent the priority of recommending the detection rule, and the detection logic information is used to represent the logic of the detection rule; and generating a detection strategy for the client by combining the recommendation level, rule name, and detection logic information, wherein the detection strategy is used to represent the generated detection rule.

[0260] Optionally, the aforementioned computer-readable storage medium may also execute program code that performs the following steps: calling a classification model in the data processing model to classify the file to be processed and obtain a general category, wherein the classification model is trained on the corresponding deep learning model using samples of the general category; calling a sensitivity assessment model in the data processing model to perform a sensitivity assessment on the file to be processed and obtain a sensitivity index, wherein the sensitivity assessment model is trained on the corresponding deep learning model using samples of the sensitivity index; and calling a data recognition model in the data processing model to identify keywords from the file to be processed, wherein the data recognition model is trained based on a large language model.

[0261] Optionally, the aforementioned computer-readable storage medium may also execute program code that performs the following steps: determining prompt information corresponding to the file to be processed, wherein the prompt information is used to indicate multiple steps for extracting keywords from the file to be processed, and the multiple steps have a logical relationship; using the prompt information to guide a data recognition model to identify keywords from the file to be processed.

[0262] Optionally, the aforementioned computer-readable storage medium may also execute program code that calls a multilayer perceptron in a classification model to classify different texts in the file to be processed into different general categories.

[0263] Optionally, the aforementioned computer-readable storage medium may also execute program code that performs the following steps: calling a sensitivity assessment model to determine the text content of the text in the file to be processed, and performing a sensitivity assessment on the text content to obtain a sensitivity index, wherein the sensitivity index is positively correlated with the sensitivity of the text content.

[0264] Optionally, the aforementioned computer-readable storage medium may also execute program code that performs the following steps: calling a data recognition model to analyze keywords and different texts in the file to be processed to obtain text content categories of different texts; and performing clustering processing on the text content categories of different texts to obtain rule names.

[0265] Optionally, the aforementioned computer-readable storage medium may also execute program code that performs the following steps: performing a clustering process on the text content categories of different texts to obtain clustering results; and identifying the text content types among the different text content types whose similarity to the clustering results is higher than a similarity threshold as rule names.

[0266] Optionally, the aforementioned computer-readable storage medium may also execute program code that performs the following steps: heuristically filtering text content categories in an abnormal state from text content categories of different texts; performing a clustering process on text content categories of different texts to obtain clustering results, including: performing a clustering process on the filtered text content categories of different texts to obtain clustering results.

[0267] Optionally, the aforementioned computer-readable storage medium may also execute program code that performs the following steps: determining a default sensitivity index corresponding to a general category, wherein the default sensitivity index is used to represent the default sensitivity of text in the file to be processed in the general category; performing a linear combination of the default sensitivity index and the sensitivity index to obtain a combination result; and determining a recommendation level that matches the combination result.

[0268] Optionally, the aforementioned computer-readable storage medium may also execute program code that performs the following steps: converting at least the general category, sensitivity index, and keywords into feature vectors; training a decision tree classifier using the feature vectors, wherein the decision tree classifier is a classifier constructed through a decision tree; obtaining the recognition logic information of the trained decision tree classifier, wherein the recognition logic information is used to represent the logic by which the trained decision tree classifier recognizes the input data; and determining the recognition logic information as detection logic information.

[0269] Optionally, the aforementioned computer-readable storage medium may also execute program code that performs the following steps: calling a data recognition model to identify entity objects in the text of the file to be processed, wherein the data recognition model is trained based on a large language model; at least converting the general category, sensitivity index, and keywords into feature vectors, including: combining the number of entity objects, recommendation level, file identifier of the file to be processed, general category, sensitivity index, and keywords to obtain feature vectors.

[0270] Optionally, the computer-readable storage medium may also execute program code that performs the following steps: the processor may also execute program code that performs the following steps: determining the detection strategy as a subcategory; classifying the subcategory under the parent category.

[0271] Optionally, the aforementioned computer-readable storage medium may also execute program code that performs the following steps: if the detection strategy is in an abnormal state, in response to the adjustment operation of the detection strategy, adjust the detection strategy and train a data processing model using the adjusted detection strategy; obtain the target file that triggered the online detection strategy and train the data processing model using the target file.

[0272] As an optional example, a computer-readable storage medium is configured to store program code for performing the following steps: retrieving files to be processed from the client's data assets, wherein the categories of the data assets correspond to the client's data usage scenarios, and the files to be processed include log data to be detected generated by the client during operation in the data usage scenarios; invoking a classification model to classify the files to be processed to obtain general categories; invoking a sensitivity assessment model to perform sensitivity assessment on the files to be processed to obtain sensitivity indicators; and invoking a data recognition model to extract keywords from the files to be processed, wherein the classification model is trained on the corresponding deep learning model using samples of the general categories, the general categories being used to represent categories with general meanings, and the sensitivity assessment model is trained on the data recognition model using samples of sensitivity indicators. The corresponding deep learning model is trained, and the sensitivity index is used to represent the sensitivity of the text in the file to be processed. The data recognition model is trained based on a large language model, and keywords are used to describe the text structure. Based on the general category and the sensitivity index, the recommendation level of the detection rule to be generated is determined. Based on the keywords, the rule name of the detection rule is generated, and at least based on the general category, sensitivity index, and keywords, the detection logic information of the detection rule is generated. Here, the detection rule is used to represent the rule for security detection of the client, the recommendation level is used to represent the priority of the recommended detection rule, and the detection logic information is used to represent the logic of the detection rule. The recommendation level, rule name, and detection logic information are used to generate the client's detection strategy, where the detection strategy is used to represent the generated detection rule.

[0273] As an optional example, a computer-readable storage medium is configured to store program code for performing the following steps: obtaining a file to be processed by calling a first interface, wherein the first interface includes a first parameter, the value of which is the file to be processed, the file to be processed including log data to be detected generated by the client during operation; calling a data processing model to determine the general category, sensitivity index, and keywords of the file to be processed, wherein the data processing model is trained at least on a large model, the general category is used to represent a category with general meaning, the sensitivity index is used to represent the sensitivity of the text in the file to be processed, and the keywords are used to describe the text structure of the text; based on the general category and Sensitivity indicators are used to determine the recommendation level of the detection rules to be generated. Based on keywords, the rule name of the detection rule is generated. At least based on the general category, sensitivity indicators, and keywords, the detection logic information of the detection rule is generated. Here, the detection rule is used to represent the rule for security detection of the client, the recommendation level is used to represent the priority of the recommended detection rule, and the detection logic information is used to represent the logic of the detection rule. The recommendation level, rule name, and detection logic information are used to generate the client's detection strategy. Here, the detection strategy is used to represent the generated detection rule. The detection strategy is output by calling a second interface. Here, the second interface includes a second parameter, and the parameter value of the second parameter is the detection strategy.

[0274] Embodiments of this application also provide a computer program product. Optionally, in this embodiment, the computer program product may include a computer program that, when executed by a processor, implements the methods provided in the embodiments described above.

[0275] Optionally, the computer program product described above may include a non-volatile computer-readable storage medium, which can be used to store a computer program that, when executed by a processor, implements the method provided in the above embodiments.

[0276] Embodiments of this application may provide an electronic device that may include a memory and a processor.

[0277] Figure 13 This is a block diagram of an electronic device for generating a data detection strategy according to an embodiment of this application. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device may also represent various forms of mobile devices, such as personal digital processors, cellular phones, smartphones, wearable devices, and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely illustrative and are not intended to limit the implementation of the present application described and / or claimed herein.

[0278] like Figure 13 As shown, device 1300 includes a computing unit 1301, which can perform various appropriate actions and processes according to a computer program stored in read-only memory (ROM) 1302 or a computer program loaded from storage unit 1308 into random access memory (RAM) 1303. RAM 1303 may also store various programs and data required for the operation of device 1300. The computing unit 1301, ROM 1302, and RAM 1303 are interconnected via bus 1304. Input / output (I / O) interface 1305 is also connected to bus 1304.

[0279] Multiple components in device 1300 are connected to I / O interface 1305, including: input unit 1306, such as keyboard, mouse, etc.; output unit 1307, such as various types of monitors, speakers, etc.; storage unit 1308, such as disk, optical disk, etc.; and communication unit 1309, such as network card, modem, wireless transceiver, etc. Communication unit 1309 allows device 1300 to exchange information / data with other devices through computer networks such as the Internet and / or various telecommunications networks.

[0280] The computing unit 1301 can be various general-purpose and / or special-purpose processing components with processing and computing capabilities. Some examples of the computing unit 1301 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various special-purpose artificial intelligence (AI) computing chips, various computing units running machine learning model algorithms, digital signal processors (DSPs), and any suitable processor, controller, microcontroller, etc. The computing unit 1301 performs the various methods and processes described above, such as methods for generating data detection strategies. For example, in some embodiments, the methods for generating data detection strategies may be implemented as computer software programs tangibly contained in a machine-readable medium, such as storage unit 1308. In some embodiments, part or all of the computer program may be loaded and / or installed on device 1300 via ROM 1302 and / or communication unit 1309. When the computer program is loaded into RAM 1303 and executed by computing unit 1301, one or more steps of the data detection strategy generation method described above can be performed. Alternatively, in other embodiments, computing unit 1301 can be configured to perform the data detection strategy generation method by any other suitable means (e.g., by means of firmware).

[0281] Various implementations of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field-programmable gate arrays (FPGAs), application-specific integrated circuits (ASICs), application-specific standard parts (ASSPs), system-on-a-chip (SOCs), complex programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various implementations may include implementations in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which may be a dedicated or general-purpose programmable processor, capable of receiving data and instructions from a storage system, at least one input device, and at least one output device, and transmitting data and instructions to the storage system, the at least one input device, and the at least one output device.

[0282] The program code used to implement the methods of this application may be written in any combination of one or more programming languages. This program code may be provided to a processor or controller of a general-purpose computer, special-purpose computer, or other programmable data processing device, such that when executed by the processor or controller, the functions / operations specified in the flowcharts and / or block diagrams are implemented. The program code may be executed entirely on a machine, partially on a machine, as a standalone software package partially on a machine and partially on a remote machine, or entirely on a remote machine or server.

[0283] The method embodiment provided in Embodiment 1 of this application can be executed in a mobile terminal, computer terminal or similar computing device. Figure 14 This is a hardware structure block diagram of a computer terminal (or mobile device) for implementing a data detection strategy generation method according to an embodiment of this application, such as... Figure 14As shown, the computer terminal 140 (or mobile device) may include one or more processors 1402 (shown as 1402a, 1402b, ..., 1402n in the figure) (processor 1402 may include, but is not limited to, a microprocessor (MCU) or a programmable gate array (FPGA), etc.), a memory 1404 for storing data, and a transmission device 1406 for communication functions. In addition, it may also include: a display, an input / output interface (I / O interface), a Universal Serial Bus (USB) port (which may be included as one of the ports of a BUS bus), a network interface, a power supply, and / or a camera. Those skilled in the art will understand that... Figure 14 The structure shown is for illustrative purposes only and does not limit the structure of the aforementioned electronic device. For example, the computer terminal 140 may also include... Figure 14 The more or fewer components shown, or having the same Figure 14 The different configurations shown.

[0284] Figure 14 The hardware structure block diagram shown can serve not only as an exemplary block diagram of the aforementioned computer terminal 140 (or mobile device), but also as an exemplary block diagram of the aforementioned server. In one optional embodiment, Figure 14 The use of the above is illustrated in a block diagram. Figure 14 The computer terminal 140 (or mobile device) shown is an embodiment of a computing node in computing environment 701.

[0285] In the context of this application, a machine-readable medium can be a tangible medium that may contain or store a program for use by an instruction execution system, apparatus, or device, or in combination with such an instruction execution system, apparatus, or device. A machine-readable medium can be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium can be, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatus, or devices, or any suitable combination of the foregoing. More specific examples of machine-readable storage media include electrical connections based on one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fibers, compact disc read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination of the foregoing.

[0286] To provide interaction with a user, the systems and techniques described herein can be implemented on a computer having: a display device (e.g., a cathode ray tube (CRT) or liquid crystal display (LCD)) for displaying information to the user; a monitor; and a keyboard and pointing device (e.g., a mouse or pathball) through which the user provides input to the computer. Other types of devices can also be used to provide interaction with the user; for example, feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including sound input, voice input, or tactile input).

[0287] The systems and technologies described herein can be implemented in computing systems that include backend components (e.g., as a data server), or computing systems that include middleware components (e.g., an application server), or computing systems that include frontend components (e.g., a user computer with a graphical user interface or web browser through which a user can interact with implementations of the systems and technologies described herein), or any combination of such backend, middleware, or frontend components. The components of the system can be interconnected via digital data communication (e.g., a communication network) of any form or medium. Examples of communication networks include Local Area Networks (LANs), Wide Area Networks (WANs), and the Internet.

[0288] Computer systems can include clients and servers. Clients and servers are generally located far apart and typically interact via communication networks. Client-server relationships are created by computer programs running on the respective computers and having a client-server relationship with each other. Servers can be cloud servers, servers in distributed systems, or servers incorporating blockchain technology.

[0289] It should be noted that the sequence numbers of the embodiments in this application are for descriptive purposes only and do not represent the superiority or inferiority of the embodiments.

[0290] In the above embodiments of this application, the descriptions of each embodiment have different focuses. For parts not described in detail in a certain embodiment, please refer to the relevant descriptions of other embodiments.

[0291] In the several embodiments provided in this application, it should be understood that the disclosed technical content can be implemented in other ways. The device embodiments described above are merely illustrative; for example, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some interfaces; the indirect coupling or communication connection of units or modules may be electrical or other forms.

[0292] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0293] Furthermore, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0294] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods of the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as a USB flash drive, read-only memory, random access memory, portable hard drive, magnetic disk, or optical disk.

[0295] The above are merely preferred embodiments of this application. It should be noted that those skilled in the art can make various improvements and modifications without departing from the principles of this application, and these improvements and modifications should also be considered within the scope of protection of this application.

Claims

1. A method for generating a data detection strategy, characterized in that, include: Obtain the file to be processed, wherein the file to be processed includes log data to be detected generated by the client during operation; The data processing model is invoked to determine the general category, sensitivity index, and keywords of the file to be processed. The data processing model is trained based on at least a large model. The general category is used to represent a category with general meaning. The sensitivity index is used to represent the sensitivity of the text in the file to be processed. The keywords are used to describe the text structure of the text. Based on the general category and the sensitivity index, the recommendation level of the detection rule to be generated is determined. Based on the keyword, the rule name of the detection rule is generated. At least based on the general category, the sensitivity index and the keyword, the detection logic information of the detection rule is generated. The detection rule is used to represent the rule for security detection of the client. The recommendation level is used to represent the priority of recommending the detection rule. The detection logic information is used to represent the logic adopted by the detection rule during execution. The client's detection strategy is generated using the recommendation level, the rule name, and the detection logic information, wherein the detection strategy is used to represent the generated detection rule.

2. The method according to claim 1, characterized in that, The data processing model is invoked to determine the general category, sensitivity indicators, and keywords of the file to be processed, including: The classification model in the data processing model is invoked to classify the file to be processed and obtain the general category. The classification model is obtained by training the corresponding deep learning model using samples of the general category. The sensitivity assessment model in the data processing model is invoked to perform a sensitivity assessment on the file to be processed, and the sensitivity index is obtained. The sensitivity assessment model is obtained by training the corresponding deep learning model using sensitivity index samples. The data recognition model in the data processing model is invoked to identify the keywords from the file to be processed, wherein the data recognition model is trained based on a large language model.

3. The method according to claim 2, characterized in that, The data recognition model in the data processing model is invoked to identify the keywords from the file to be processed, including: Determine the prompt information corresponding to the file to be processed, wherein the prompt information is used to represent multiple steps for extracting the keyword from the file to be processed, and the multiple steps have a logical relationship; The prompt information guides the data recognition model to identify the keywords from the file to be processed.

4. The method according to claim 2, characterized in that, The classification model in the data processing model is invoked to classify the files to be processed, obtaining the general categories, including: The multilayer perceptron in the classification model is invoked to classify different texts in the file to be processed into different general categories.

5. The method according to claim 2, characterized in that, The sensitivity assessment model in the data processing model is invoked to perform a sensitivity assessment on the file to be processed, thereby obtaining the sensitivity index, including: The sensitivity assessment model is invoked to determine the text content of the text in the file to be processed, and the sensitivity of the text content is assessed to obtain the sensitivity index, wherein the sensitivity index is positively correlated with the sensitivity of the text content.

6. The method according to claim 2, characterized in that, Based on the keywords, the rule name for the detection rule is generated, including: The data recognition model is invoked to analyze the keywords and different texts in the file to be processed, thereby obtaining the text content categories of the different texts; Clustering is performed on the text content categories of the different texts to obtain the rule names.

7. The method according to claim 6, characterized in that, Clustering is performed on the text content categories of the different texts to obtain the rule names, including: Perform a clustering process on the different text content categories to obtain the clustering results; The text content categories of different texts that have a similarity higher than the similarity threshold with the clustering results are identified as the rule names.

8. The method according to claim 7, characterized in that, The method further includes: Heuristically filter the text content categories that are in an abnormal state from the different text content categories described; A clustering process is performed on the different text content categories to obtain the clustering results, including: A clustering process is performed on the different text content categories of the filtered texts to obtain the clustering results.

9. The method according to claim 1, characterized in that, Based on the general category and the sensitivity index, the recommendation level of the detection rule to be generated is determined, including: Determine the default sensitivity index corresponding to the general category, wherein the default sensitivity index is used to represent the default sensitivity level of the text in the file to be processed in the general category; The default sensitivity index and the sensitivity index are linearly combined to obtain the combined result; Determine the recommendation level that matches the combined result.

10. The method according to claim 1, characterized in that, Based at least on the general category, the sensitivity index, and the keywords, the detection logic information for the detection rules is generated, including: At least the general category, the sensitivity index, and the keywords should be converted into feature vectors; The feature vector is input as a positive sample into the decision tree structure model, and the decision tree structure model is used to perform machine learning on the positive sample to obtain a decision tree classifier; Obtain the recognition logic information of the decision tree classifier, wherein the recognition logic information is used to represent the logic by which the trained decision tree classifier recognizes input data; The identification logic information is determined as the detection logic information.

11. The method according to claim 10, characterized in that, The method further includes: The data recognition model is invoked to identify the entity objects of the text in the file to be processed, wherein the data recognition model is trained based on a large language model; At least the general category, the sensitivity index, and the keywords are converted into feature vectors, including: combining the number of entity objects, the recommendation level, the file identifier of the file to be processed, the general category, the sensitivity index, and the keywords to obtain the feature vector.

12. The method according to any one of claims 1 to 11, characterized in that, The method further includes: In response to the selection operation, a target detection strategy is selected from a plurality of the detection strategies; The target detection strategy is defined as a subcategory; The subcategories are classified under the parent category of the general category.

13. The method according to any one of claims 1 to 11, characterized in that, The method further includes: If the detection strategy is in an abnormal state, in response to the adjustment operation of the detection strategy, the detection strategy is adjusted, and the data processing model is trained using the adjusted detection strategy. Obtain the target file that triggered the detection strategy after going live, and use the target file to train the data processing model.

14. A method for generating a data detection strategy, characterized in that, include: Obtain files to be processed from the client's data assets, wherein the category of the data assets corresponds to the data usage scenario of the client, and the files to be processed include log data to be detected generated by the client during operation under the data usage scenario; The process involves: calling a classification model to classify the file to be processed and obtaining a general category; calling a sensitivity assessment model to assess the sensitivity of the file to be processed and obtaining a sensitivity index; and calling a data recognition model to extract keywords from the file to be processed. The classification model is trained on a corresponding deep learning model using general category samples, where the general category represents a category with general meaning. The sensitivity assessment model is trained on a corresponding deep learning model using sensitivity index samples, where the sensitivity index represents the sensitivity level of the text in the file to be processed. The data recognition model is trained based on a large language model, and the keywords describe the text structure of the text. Based on the general category and the sensitivity index, the recommendation level of the detection rule to be generated is determined. Based on the keyword, the rule name of the detection rule is generated. At least based on the general category, the sensitivity index and the keyword, the detection logic information of the detection rule is generated. The detection rule is used to represent the rule for security detection of the client. The recommendation level is used to represent the priority of recommending the detection rule. The detection logic information is used to represent the logic adopted by the detection rule during execution. The client's detection strategy is generated using the recommendation level, the rule name, and the detection logic information, wherein the detection strategy is used to represent the generated detection rule.

15. A method for generating a data detection strategy, characterized in that, include: The file to be processed is obtained by calling the first interface, wherein the first interface includes a first parameter, the value of the first parameter is the file to be processed, and the file to be processed includes log data to be detected generated by the client during operation; The data processing model is invoked to determine the general category, sensitivity index, and keywords of the file to be processed. The data processing model is trained based on at least a large model. The general category is used to represent a category with general meaning. The sensitivity index is used to represent the sensitivity of the text in the file to be processed. The keywords are used to describe the text structure of the text. Based on the general category and the sensitivity index, the recommendation level of the detection rule to be generated is determined. Based on the keyword, the rule name of the detection rule is generated. At least based on the general category, the sensitivity index and the keyword, the detection logic information of the detection rule is generated. The detection rule is used to represent the rule for security detection of the client. The recommendation level is used to represent the priority of recommending the detection rule. The detection logic information is used to represent the logic adopted by the detection rule during execution. The client's detection strategy is generated using the recommendation level, the rule name, and the detection logic information, wherein the detection strategy is used to represent the generated detection rule; The detection strategy is output by calling the second interface, wherein the second interface includes a second parameter, and the parameter value of the second parameter is the detection strategy.

16. A system for generating a data detection strategy, characterized in that, include: A client is used to upload files to be processed, wherein the files to be processed include log data to be detected generated by the client during operation; On the server side, a data processing model is invoked to determine the general category, sensitivity index, and keywords of the file to be processed. The data processing model is trained on at least a large model. The general category represents a category with general meaning, the sensitivity index represents the sensitivity of the text in the file to be processed, and the keywords describe the text structure. Based on the general category and the sensitivity index, a recommendation level for the generated detection rule is determined. Based on the keywords, a rule name for the detection rule is generated. At least based on the general category, the sensitivity index, and the keywords, detection logic information for the detection rule is generated. The detection rule represents a rule for security detection of the client, the recommendation level represents the priority of recommending the detection rule, and the detection logic information represents the logic used by the detection rule during execution. The recommendation level, the rule name, and the detection logic information are used to generate a detection strategy for the client, whereby the detection strategy represents the generated detection rule.

17. An electronic device, characterized in that, include: Memory, which stores executable programs; A processor for running the program, wherein the program, when running, performs the method according to any one of claims 1 to 15.

18. A computer-readable storage medium, characterized in that, The computer-readable storage medium includes a stored executable program, wherein, when the executable program is executed, it controls the device on which the storage medium is located to perform the method according to any one of claims 1 to 15.

19. A computer program product, characterized in that, Includes a computer program that, when executed by a processor, implements the method according to any one of claims 1 to 15.

Images