Information interception method and device

Abstract

The embodiment of the invention provides an information interception method and device, and relates to the technical field of network security, the method comprises the following steps: responding to received service information, the service information comprising a first risk assessment feature; the first risk assessment feature is compared with each second risk assessment feature recorded in a risk feature library, the risk level of the business information is determined according to a comparison result, and each second risk assessment feature is obtained according to sending end reputation data fed back by a cloud information security service; and when the risk level represents that the service information is risk information, intercepting the service information. By applying the scheme provided by the embodiment of the invention, communication resources consumed by the electronic equipment in an information interception scene can be reduced.

Description

Technical Field

[0001] This invention relates to the field of network security technology, and in particular to an information interception method and apparatus. Background Technology

[0002] In communication scenarios, malicious information often interferes with users' normal communication. For example, spam emails, phishing emails, and other malicious emails not only occupy mailbox storage space and interfere with normal communication, but may also carry malicious code, thereby affecting system security.

[0003] In related technologies, subscribing to information security websites is a common method to intercept malicious information. Specifically, after receiving information, the electronic device extracts the sender's address and queries the sender blacklist maintained by the subscribed information security website to verify whether the sender's address is on the blacklist. If so, an interception operation is performed.

[0004] However, the above method requires the electronic device to initiate a blacklist query with the information security site every time it receives information, which consumes a lot of communication resources. Summary of the Invention

[0005] The purpose of this invention is to provide an information interception method and apparatus to reduce the communication resources consumed in information interception scenarios. The specific technical solution is as follows:

[0006] In a first aspect, embodiments of the present invention provide an information interception method, the method comprising:

[0007] Receive business information, the business information including a first risk assessment feature;

[0008] By comparing the first risk assessment feature with each of the second risk assessment features recorded in the risk feature database, the risk level of the business information is determined based on the comparison results. The second risk assessment features are obtained based on the sender reputation data fed back by the cloud information security service.

[0009] If the risk level indicates that the business information is risky, the business information will be intercepted.

[0010] Secondly, embodiments of the present invention provide an information interception device, the device comprising:

[0011] A first feature extraction module is used to receive business information, the business information including a first risk assessment feature;

[0012] The risk level determination module is used to compare the first risk assessment feature with each of the second risk assessment features recorded in the risk feature library, and determine the risk level of the business information based on the comparison results. The second risk assessment features are obtained based on the sender reputation data fed back by the cloud data security service.

[0013] The information interception module is used to intercept the business information when the risk level indicates that the business information is risky information.

[0014] Thirdly, embodiments of the present invention provide an electronic device, including:

[0015] Memory, used to store computer programs;

[0016] A processor, when executing a program stored in memory, implements the method described in the first aspect.

[0017] Fourthly, embodiments of the present invention provide a computer-readable storage medium, comprising:

[0018] Memory, used to store computer programs;

[0019] A processor, when executing a program stored in memory, implements the method described in the first aspect.

[0020] Fifthly, embodiments of the present invention also provide a computer program product containing instructions that, when run on a computer, cause the computer to perform the method described in the first aspect.

[0021] As can be seen from the above, in the information interception scheme provided by the embodiments of the present invention, when the electronic device receives business information, it extracts the risk assessment features of the business information and compares the extracted features with the features in the risk feature library. The comparison result reflects the degree of similarity between the risk assessment features of the business information and the features in the risk feature library. Therefore, the risk level of the business information can be determined based on the above similarity, and the information can be intercepted when the risk level indicates that the business information is risky. It can be seen that since the electronic device has pre-built a risk feature library based on the features of the sender reputation data fed back by the cloud information security service, whenever business information is received, the risk level of the business information can be determined only by feature extraction and feature comparison. Compared with related technologies, it is not necessary to initiate a blacklist query to the information security site every time business information is received, which reduces the communication resources consumed in the scenario of intercepting information.

[0022] Of course, implementing any product or method of the present invention does not necessarily require achieving all of the advantages described above at the same time. Attached Figure Description

[0023] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other embodiments can be obtained based on these drawings.

[0024] Figure 1 A flowchart illustrating an information interception method provided in an embodiment of the present invention;

[0025] Figure 2 A flowchart illustrating a method for constructing a risk feature database according to an embodiment of the present invention;

[0026] Figure 3 This is a schematic diagram of the structure of an information interception device provided in an embodiment of the present invention;

[0027] Figure 4 This is a schematic diagram of the structure of an electronic device provided in an embodiment of the present invention. Detailed Implementation

[0028] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art based on the present invention are within the scope of protection of the present invention.

[0029] The application scenarios of this invention are various information communication scenarios, such as email communication, SMS communication, and instant messaging software communication. In the above scenarios, the solution provided by this invention can be used to intercept risky information, thereby reducing the probability of risky information interfering with the user's normal communication.

[0030] The executing entity of this invention can be any electronic device with data processing and communication functions. Specifically, it can be a server or a personal computer.

[0031] The following section, in conjunction with the flowchart, provides a detailed description of the information interception scheme provided in the embodiments of the present invention.

[0032] See Figure 1 The above is a flowchart illustrating an information interception method provided by an embodiment of the present invention. The method includes the following steps S101 to S103.

[0033] Step S101: Receive business information, which includes a first risk assessment feature; Step S102: Compare the first risk assessment feature with each second risk assessment feature recorded in the risk feature database, and determine the risk level of the business information based on the comparison results; Step S103: If the risk level indicates that the business information is risky, intercept the business information.

[0034] The aforementioned business information varies depending on the specific communication scenario. This embodiment of the invention does not limit the type of the aforementioned business information, which may specifically be email, SMS, instant messaging software information, etc.

[0035] The aforementioned risk feature library is a feature library pre-built before the electronic device executes this embodiment. The second risk assessment feature included is obtained based on the sender reputation data fed back by the cloud data security service. Specifically, the cloud data security service obtains the sender reputation data by comprehensively analyzing the sender's multi-dimensional contextual information and threat data sources. This reputation data reflects the probability that the sender will send malicious information.

[0036] When the aforementioned business information is in the form of email, the cloud-based data security service can specifically be a cloud-based Realtime Blackhole List (RBL) service. The following is a brief introduction to the principles of the cloud-based RBL service.

[0037] The cloud-based RBL service collects comprehensive email sender information, also known as multi-dimensional contextual information, through the Hypertext Transfer Protocol Secure Application Programming Interface (HTTPS API). This includes, but is not limited to, basic sender information, email content characteristics, and historical sender behavior data. Basic sender information may include, but is not limited to, the sender's IP address, email sending time, and email sending frequency. Email content characteristics may include, but are not limited to, textual features of the email body and subject, which indicate whether the email content contains risky words, malicious links, etc. Historical sender behavior data may include, but is not limited to, the sender's email sending rhythm within a set historical time period and server rejection records of emails from the sender.

[0038] In addition, cloud-based RBL services can obtain threat data from multiple channels around the world, including but not limited to blacklists of senders maintained by well-known RBL sites, botnet databases of security vendors, and report data from enterprise users.

[0039] After collecting the aforementioned email sender information and threat data, the cloud-based RBL service can use its deployed AI analysis engine to organize and analyze the data, calculating reputation scores and threat classifications for each sender in real time, and returning structured sender reputation data to the electronic device. The reputation score reflects the probability of an attack risk posed by the sender; a higher reputation score indicates a lower attack risk, and vice versa.

[0040] After electronic devices obtain the reputation data of the sender from the cloud information security service, they can extract the characteristics of the reputation data for each sender to obtain the second risk assessment characteristics. Based on the second risk assessment characteristics, a risk feature library, also known as an email security feature library, can be constructed.

[0041] The embodiments of the present invention do not limit the specific content of the second risk assessment feature described above. For example, the second risk assessment feature may include, but is not limited to, the sending end IP address, information content features, etc.

[0042] Correspondingly, the first risk assessment characteristics may also include, but are not limited to, the sender's IP address, information content characteristics, etc.

[0043] When the aforementioned business information is email, the first risk assessment feature and the second risk assessment feature may also include the sender's email address, the sender's mail server address, etc.

[0044] In this way, the risk level of the business information can be determined by comparing the first risk assessment feature of the currently received business information with each of the second risk assessment features recorded in the risk feature database.

[0045] As can be seen from the above, in the information interception scheme provided by the embodiments of the present invention, when the electronic device receives business information, it extracts the risk assessment features of the business information and compares the extracted features with the features in the risk feature library. The comparison result reflects the degree of similarity between the risk assessment features of the business information and the features in the risk feature library. Therefore, the risk level of the business information can be determined based on the above similarity, and the information can be intercepted when the risk level indicates that the business information is risky. It can be seen that since the electronic device has pre-built a risk feature library based on the features of the sender reputation data fed back by the cloud information security service, whenever business information is received, the risk level of the business information can be determined only by feature extraction and feature comparison. Compared with related technologies, it is not necessary to initiate a blacklist query to the information security site every time business information is received, which reduces the communication resources consumed in the scenario of intercepting information.

[0046] Especially in email communication scenarios, related technologies often employ multi-round Domain Name System (DNS) queries to retrieve blacklists from the Reference Blacklist (RBL) site. However, DNS queries rely heavily on User Datagram Protocol (UDP) for data transmission, resulting in low reliability. Furthermore, multiple DNS queries suffer from latency accumulation, leading to low query efficiency and consequently, low email interception efficiency. The solution provided in this invention, however, eliminates the need for communication with the RBL site during email interception, overcoming the reliability issues and improving interception efficiency. Additionally, related technologies require users to manually configure multiple RBL lists and interception policies, demanding a high level of security expertise. The solution provided in this invention eliminates this configuration process, offering greater ease of use and reducing the need for highly skilled personnel.

[0047] In addition, the sender blacklist returned by the RBL site only includes the sender address, which is limited in information and not updated in a timely manner. Interception based on the above blacklist is prone to misjudgment. However, the solution provided by this invention constructs a feature library based on comprehensive sender reputation data fed back by the cloud RBL service. It assesses email risk through feature comparison, without relying on a single sender blacklist for email interception. This improves the accuracy of email interception, reduces business interruption losses caused by misjudgment, and achieves more accurate, intelligent and efficient spam and threat defense.

[0048] In one possible implementation, the aforementioned second risk assessment feature may also include the attack time, sending frequency, and attack type of the sender. The following example, using email, will provide a clear illustration of this second risk assessment feature.

[0049] Feature ID: 1

[0050] IP address: XXX

[0051] Attack time: XXX

[0052] Sender: employee@example.com

[0053] HELO / EHLO: mail.example.com

[0054] Transmission frequency: 10 / s

[0055] Attack type: Trojan virus

[0056] Email content characteristics: XX

[0057] Among them, the feature ID is used to uniquely identify the second risk assessment feature in the risk feature database, and HELO / EHLO represents the mail server address of the sender.

[0058] Correspondingly, the first risk assessment feature can also include the sending time of the sender. This way, during subsequent feature comparisons, the risk level of the email can be determined based on whether the attack time and the sending time are close.

[0059] The following example illustrates how to determine risk levels.

[0060] In one implementation, for each second risk assessment feature, each item in the first risk assessment feature is compared with it. Based on the comparison results, the number of items with consistent content is determined. Then, according to the established correspondence between the number of items and the risk level, the risk level of the business information is determined. For example, if the number of items with consistent content is less than or equal to a first number, the risk level of the business information is determined to be no risk; if the number of items with consistent content is greater than the first number, the risk level of the business information is determined to be risky.

[0061] In another implementation, the similarity between the first risk assessment feature and each second risk assessment feature can be directly calculated, and the risk level of the business information can be determined based on the direct correspondence between the obtained maximum similarity and the risk level.

[0062] In another implementation, the second risk assessment feature with the highest similarity to the first risk assessment feature can be determined first. Then, the risk level of the business information can be determined based on the correspondence between the credit score and the risk level carried in the second risk assessment feature.

[0063] The aforementioned reputation score, which is the score obtained by the cloud information security service through comprehensive analysis of multi-dimensional contextual information and threat data sources, reflects the probability of an attack risk at the sending end. The higher the reputation score, the lower the attack risk at the sending end, and vice versa.

[0064] In one possible implementation, Figure 1 Based on the illustrated embodiment, when constructing the risk feature database, the sender blacklist maintained by the RBL sites subscribed to by electronic devices can be combined. The following section will discuss this further. Figure 2 Let me introduce it.

[0065] See Figure 2 The above is a flowchart illustrating a risk feature database construction method provided by an embodiment of the present invention. The method includes the following steps S201 to S204.

[0066] Step S201: Obtain the sender blacklist; Step S202: Send the sender blacklist to the cloud information security service; Step S203: Receive the reputation data of each sender in the sender blacklist fed back by the cloud information security service, and use the characteristics of the reputation data as the second risk assessment characteristics; Step S204: Construct a risk feature library based on the second risk assessment characteristics.

[0067] Specifically, the aforementioned blacklist of senders can be obtained in the following way: send a blacklist retrieval request to the subscribed information security site and obtain the blacklist of senders returned by the information security site.

[0068] In one scenario, the aforementioned information security site could be an RBL site.

[0069] In other words, it first quickly filters out senders that may be engaging in attack behavior based on the sender blacklist, and then obtains detailed and accurate reputation data of the senders in the blacklist from the cloud information security service. It combines the advantages of sender blacklists and cloud information security services, which not only improves the accuracy of information interception and achieves more precise, intelligent and efficient information interception and threat defense, but also does not require communication with information security sites or cloud information security services during information interception, that is, it does not rely on network connectivity, reduces the communication load of electronic devices and extends the device life cycle.

[0070] In one possible implementation, when obtaining the second risk assessment feature in step S203, the attack risk characterization value of each sender can be determined first based on the reputation score included in the reputation data of each sender; then, from the attack risk characterization value of each sender, the feature of the reputation data of the sender whose corresponding attack risk characterization value is greater than a set threshold is obtained, and used as the second risk assessment feature.

[0071] The aforementioned attack risk characterization value can also be called a comprehensive risk score, which represents the probability that the sending end will send malicious information.

[0072] The aforementioned reputation score is negatively correlated with the attack risk indicator value; that is, the higher the reputation score, the lower the determined attack risk indicator value, and vice versa. Specifically, the attack risk indicator value corresponding to the reputation score of each sender can be determined according to a pre-set correspondence between reputation scores and attack risk indicator values.

[0073] In this way, the senders with higher attack risk characteristics are first screened out, and then features are extracted from the reputation data of these senders, rather than processing the reputation data of all senders. This reduces the number of features in the risk feature database while minimizing the impact on interception accuracy, thereby reducing the computational resources required for subsequent feature comparison and improving information interception efficiency.

[0074] To improve the accuracy of determining the attack risk characterization value, one possible implementation is to first determine the data confidence of each sender's reputation data based on the confidence reference information included in the reputation data of each sender; then, calculate the product of the data confidence of each sender's reputation data and the reputation score included in the reputation data of each sender as the attack risk characterization value of each sender.

[0075] The aforementioned confidence level reference information may include, but is not limited to, one or more of the following: attack risk characterization value, data freshness, and content risk characterization value in reputation data. All of the above information may be expressed as a percentage.

[0076] The attack risk characterization value is determined by the cloud-based information security service based on historical attack information. This historical attack information can include the attack frequency and the most recent attack time within a historical period. For example, the higher the attack frequency and the earlier the most recent attack time, the higher the attack risk characterization value, and vice versa. The data freshness is determined by the most recent update time of the reputation data maintained by the cloud-based information security service. For example, the more recent the update time, the higher the data freshness, and vice versa. The content risk characterization value is obtained by the cloud-based information security service based on the characteristics of the information content. For example, the more risky words the information content features include, the higher the data confidence level, and vice versa.

[0077] The following section describes the methods for determining the data confidence level of each sender's reputation data.

[0078] If the reputation data includes any one of the three types of information—attack risk representation value, data freshness, and content risk representation value—the above information can be directly used as the confidence level of the sender's reputation data.

[0079] When the reputation data includes multiple of the above three types of information, the various types of information can be weighted according to preset weights, and the calculation result can be used as the data confidence level of the reputation data of the sending end.

[0080] Preferably, the reputation data can simultaneously include the above three types of information. In this case, the attack risk characterization value, data freshness, and content risk characterization value can be weighted according to the set first weight, second weight, and third weight to obtain the data confidence level of the reputation data of each sending end. The first weight, second weight, and third weight can be set according to actual needs and / or experience, and the embodiments of the present invention do not limit them.

[0081] In this way, the confidence level of reputation data can be comprehensively evaluated from multiple dimensions, thus improving the accuracy of the obtained confidence level.

[0082] The reputation score included in the reputation data reflects the attack risk of the sender as assessed by the cloud. The data confidence level of the reputation data represents the credibility of the reputation data. Therefore, calculating the product of the data confidence level and the reputation score is equivalent to correcting the reputation score included in the reputation data based on the data confidence level, and using the corrected result as the actual attack risk representation value of the sender.

[0083] In essence, this corrects the reputation score included in the reputation data based on the data confidence level, so that the final determined attack risk characterization value is more accurate.

[0084] exist Figure 1 Based on the illustrated embodiment, the execution is complete. Figure 1 Following the process shown, the risk feature library can be updated based on the matching of the first risk assessment features of the business information with the features in the risk feature library, as explained below.

[0085] In one possible implementation, if the target similarity between the first risk assessment feature and the associated feature is greater than or equal to the first similarity, then the first risk assessment feature and the associated feature are merged, and the associated feature in the risk feature library is updated with the merged feature.

[0086] Among them, the associated feature refers to the feature in the risk feature library that matches the first risk assessment feature of the currently received business information. It can also be called the matching feature. It is determined based on the similarity between the first risk assessment feature and each second risk assessment feature. Specifically, it can be the second risk assessment feature that has the highest similarity to the first risk assessment feature.

[0087] The first similarity is greater than the second similarity. The first and second similarities can be set by staff based on experience and / or actual needs. This embodiment of the invention does not limit this.

[0088] In one possible implementation, if the target similarity is less than the second similarity, then a first risk assessment feature is added to the risk feature library.

[0089] When the similarity between the risk assessment features of the currently received business information and the associated features in the risk feature library is high, the two types of features are merged to improve the quality of the features in the risk feature library, which is beneficial to improving the accuracy of subsequent information interception. When the similarity is low, new information features are added to the risk feature library, increasing the number of features in the risk feature library. In this way, the risk feature library is updated according to the real-time business information received, and dynamic updates of the feature library are achieved through traffic self-learning.

[0090] In one possible implementation, the second risk assessment feature in the risk feature library may further include the sender's reputation score and record the feature confidence level of the second risk assessment feature. In this case, when determining the risk level of business information, the product of the reputation score carried in the associated feature and the feature confidence level of the associated feature can be calculated. Then, based on the correspondence between the calculation result and the risk level, the risk level of the first risk assessment feature can be obtained. After the information interception process is completed, if the target similarity is less than the first similarity but greater than the second similarity, the confidence increment corresponding to the target similarity can be obtained according to the set correspondence between similarity and confidence increment. The feature confidence level of the associated feature in the risk feature library and the determined confidence increment are then calculated as the feature confidence level of the associated feature after the feature is updated.

[0091] The actual score of the sender can be determined by calculating the product of the reputation score and the feature confidence of the associated features. Then, the risk level of the business information can be determined based on the correspondence between the actual score and the risk level.

[0092] The aforementioned feature confidence reflects the credibility or accuracy of the reputation score in the feature. The higher the feature confidence, the higher the accuracy of the reputation score carried by the feature.

[0093] In this way, when the similarity between the features of business information and related features is moderate, the feature confidence of related features in the risk feature library is increased. That is, the credibility or accuracy of the reputation score in related features is increased, so that the risk level determined when similar business information is received in the future is more reasonable, thus improving the rationality of the solution.

[0094] In one possible implementation, the electronic device can respond to receiving a risk setting operation for a target risk assessment feature in the risk feature library, determine the risk level indicated by the risk setting operation as the risk level of the target risk assessment feature, and record the target risk assessment feature and the determined risk level accordingly. In this case, when determining the risk level of business information, if the risk level corresponding to the associated feature of the currently received business information has been recorded, the risk level corresponding to the associated feature can be directly used as the risk level of the business information.

[0095] Among them, the risk setting operation mentioned above can be an operation in which the user directly inputs the risk level, and the risk level input by the user is the risk level of the target risk assessment feature.

[0096] In some cases, the risk assessment features recorded in the risk feature database may not be entirely accurate or meet actual prevention needs. This can lead to inaccurate or unmet risk levels when determining risk levels through feature comparison in the database. For example, if a second risk assessment feature carries a credit score that is too low, the risk level of the business information sent by its sender may be mistakenly judged as low risk.

[0097] In this case, users can manually set the expected risk level for features in the feature library. In the subsequent feature comparison stage, as long as there is a manually set risk level for a feature in the risk feature library that matches the information feature, the risk level of the business information will be directly determined as the risk level corresponding to that feature.

[0098] For example, if a user discovers that a certain email traffic does not match the feature database on the intranet and cannot block the traffic, they can first store the email feature in the feature database and then manually set its risk level. Or, if a user finds that the risk assessment feature of a certain sender in the risk feature database is low risk, but needs to block emails from that sender based on actual needs, they can manually set the risk level of the sender's risk assessment feature.

[0099] In this way, staff can set the risk level of specific sender risk assessment characteristics according to actual needs, achieving more flexible and granular information interception and control.

[0100] Corresponding to the aforementioned information interception method, this embodiment of the invention also provides an information interception device.

[0101] See Figure 3 The above is a schematic diagram of the structure of an information interception device provided in an embodiment of the present invention. The device includes the following modules:

[0102] The first feature acquisition module 301 is used to receive business information, the business information including a first risk assessment feature;

[0103] The risk level determination module 302 is used to compare the first risk assessment feature with each of the second risk assessment features recorded in the risk feature library, and determine the risk level of the business information based on the comparison results. The second risk assessment features are obtained based on the sender reputation data fed back by the cloud data security service.

[0104] The information interception module 303 is used to intercept the business information when the risk level indicates that the business information is risky information.

[0105] As can be seen from the above, in the information interception scheme provided by the embodiments of the present invention, when the electronic device receives business information, it extracts the risk assessment features of the business information and compares the extracted features with the features in the risk feature library. The comparison result reflects the degree of similarity between the risk assessment features of the business information and the features in the risk feature library. Therefore, the risk level of the business information can be determined based on the above similarity, and the information can be intercepted when the risk level indicates that the business information is risky. It can be seen that since the electronic device has pre-built a risk feature library based on the features of the sender reputation data fed back by the cloud information security service, whenever business information is received, the risk level of the business information can be determined only by feature extraction and feature comparison. Compared with related technologies, it is not necessary to initiate a blacklist query to the information security site every time business information is received, which reduces the communication resources consumed in the scenario of intercepting information.

[0106] Especially in email communication scenarios, related technologies often employ multi-round DNS queries to retrieve blacklists from RBL sites. However, DNS queries rely heavily on UDP for data transmission, resulting in low reliability. Furthermore, multiple rounds of DNS queries lead to latency accumulation, further reducing query efficiency and consequently, email interception efficiency. The solution provided in this invention, however, eliminates the need for communication with RBL sites during email interception, overcoming the reliability issues and improving interception efficiency. Additionally, related technologies require users to manually configure multiple RBL lists and interception policies, demanding a high level of security expertise. The solution provided in this invention eliminates this configuration process, offering greater ease of use and reducing the need for highly skilled personnel.

[0107] In addition, the sender blacklist returned by the RBL site only includes the sender address, which is limited in information and not updated in a timely manner. Interception based on the above blacklist is prone to misjudgment. However, the solution provided by this invention constructs a feature library based on comprehensive sender reputation data fed back by the cloud RBL service. It assesses email risk through feature comparison, without relying on a single sender blacklist for email interception. This improves the accuracy of email interception, reduces business interruption losses caused by misjudgment, and achieves more accurate, intelligent and efficient spam and threat defense.

[0108] In one possible implementation, the device further includes:

[0109] The query module is used to obtain the sender's blacklist before the first feature extraction module is triggered;

[0110] The list sending module is used to send the blacklist from the sending end to the cloud information security service;

[0111] The second feature acquisition module is used to receive the reputation data of each sender in the sender blacklist fed back by the cloud information security service, and use the features of the reputation data as the second risk assessment features;

[0112] The feature library construction module is used to construct the risk feature library based on the second risk assessment feature.

[0113] In other words, it first quickly filters out senders that may be engaging in attack behavior based on the sender blacklist, and then obtains detailed and accurate reputation data of the senders in the blacklist from the cloud information security service. It combines the advantages of sender blacklists and cloud information security services, which not only improves the accuracy of information interception and achieves more precise, intelligent and efficient information interception and threat defense, but also does not require communication with information security sites or cloud information security services during information interception, that is, it does not rely on network connectivity, reduces the communication load of electronic devices and extends the device life cycle.

[0114] In one possible implementation, the second feature acquisition module includes:

[0115] The attack risk determination submodule is used to receive the reputation data of each sender in the sender blacklist fed back by the cloud information security service, and determine the attack risk characterization value of each sender based on the reputation score included in the reputation data of each sender.

[0116] The feature extraction submodule is used to obtain the features of the reputation data of the sending end indicated by the attack risk characterization value that is greater than a set threshold from the attack risk characterization values ​​of each sending end, and use them as the second risk assessment features.

[0117] In this way, the senders with higher attack risk characteristics are first screened out, and then features are extracted from the reputation data of these senders, rather than processing the reputation data of all senders. This reduces the number of features in the risk feature database while minimizing the impact on interception accuracy, thereby reducing the computational resources required for subsequent feature comparison and improving information interception efficiency.

[0118] In one possible implementation,

[0119] The attack risk determination submodule is specifically used to determine the data confidence level of the reputation data of each sender based on the confidence level reference information included in the reputation data of each sender; and to calculate the product of the data confidence level of the reputation data of each sender and the reputation score included in the reputation data of each sender as the attack risk characterization value of each sender.

[0120] In essence, this corrects the reputation score included in the reputation data based on the data confidence level, so that the final determined attack risk characterization value is more accurate.

[0121] In one possible implementation, the confidence reference information includes: attack risk characterization value, data freshness, and content risk characterization value; the attack risk determination submodule is specifically used to perform weighted calculations on the attack risk characterization value, data freshness, and content risk characterization value according to a set first weight, second weight, and third weight, to obtain the data confidence of the reputation data of each sending end.

[0122] In this way, the confidence level of reputation data can be comprehensively evaluated from multiple dimensions, thus improving the accuracy of the obtained confidence level.

[0123] In one possible implementation, the device further includes:

[0124] The feature merging module is used to merge the first risk assessment feature and the associated feature if the target similarity between the first risk assessment feature and the associated feature is greater than or equal to the first similarity, and update the associated feature in the risk feature library with the merged feature, wherein the associated feature is determined based on the similarity between the first risk assessment feature and each of the second risk assessment features.

[0125] In one possible implementation, the device further includes:

[0126] The feature addition module is used to add the first risk assessment feature to the risk feature library if the target similarity is less than the second similarity.

[0127] When the similarity between the risk assessment features of the currently received business information and the associated features in the risk feature library is high, the two types of features are merged to improve the quality of the features in the risk feature library, which is beneficial to improving the accuracy of subsequent information interception. When the similarity is low, new information features are added to the risk feature library, increasing the number of features in the risk feature library. In this way, the risk feature library is updated according to the real-time business information received, and dynamic updates of the feature library are achieved through traffic self-learning.

[0128] In one possible implementation,

[0129] The risk level determination module is specifically used to calculate the product of the reputation score carried in the associated feature and the feature confidence level of the associated feature, and obtain the risk level of the first risk assessment feature based on the correspondence between the calculation result and the risk level.

[0130] The device further includes: a confidence enhancement module, configured to determine the confidence increment corresponding to the target similarity according to the set correspondence between similarity and confidence increment if the target similarity is less than the first similarity and greater than the second similarity; and calculate the sum of the feature confidence of the associated feature in the risk feature library and the determined confidence increment as the updated feature confidence of the associated feature.

[0131] In this way, when the similarity between the features of business information and related features is moderate, the feature confidence of related features in the risk feature library is increased. That is, the credibility or accuracy of the reputation score in related features is increased, so that the risk level determined when similar business information is received in the future is more reasonable, thus improving the rationality of the solution.

[0132] In one possible implementation,

[0133] The device further includes: a risk level setting module, configured to, in response to receiving a risk setting operation for a target risk assessment feature in the risk feature library, determine the risk level indicated by the risk setting operation as the risk level of the target risk assessment feature; and record the target risk assessment feature and the determined risk level accordingly;

[0134] The risk level determination module is specifically used to, when the risk level corresponding to the associated feature has been recorded, use the risk level corresponding to the associated feature as the risk level of the business information, wherein the associated feature is determined based on the similarity between the first risk assessment feature and each of the second risk assessment features.

[0135] In this way, staff can set the risk level of specific sender risk assessment characteristics according to actual needs, achieving more flexible and granular information risk management.

[0136] Corresponding to the above-mentioned information interception method, embodiments of the present invention also provide an electronic device, a computer-readable storage medium, and a computer program.

[0137] This invention also provides an electronic device, such as... Figure 4 As shown, it includes a processor 401, a communication interface 402, a memory 403, and a communication bus 404, wherein the processor 401, the communication interface 402, and the memory 403 communicate with each other through the communication bus 404.

[0138] Memory 403 is used to store computer programs;

[0139] The processor 401, when executing the program stored in the memory 403, implements the aforementioned redundancy configuration detection method.

[0140] The communication bus mentioned in the above electronic devices can be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus, etc. This communication bus can be divided into address bus, data bus, control bus, etc. For ease of illustration, only one thick line is used to represent it in the diagram, but this does not mean that there is only one bus or one type of bus.

[0141] The communication interface is used for communication between the aforementioned electronic devices and other devices.

[0142] The memory may include random access memory (RAM) or non-volatile memory (NVM), such as at least one disk storage device. Optionally, the memory may also be at least one storage device located remotely from the aforementioned processor.

[0143] The processors mentioned above can be general-purpose processors, including central processing units (CPUs), network processors (NPs), etc.; they can also be digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components.

[0144] In another embodiment of the present invention, a computer-readable storage medium is also provided, which stores a computer program that, when executed by a processor, implements the steps of any of the above-described redundant configuration detection methods.

[0145] In another embodiment of the present invention, a computer program product containing instructions is also provided, which, when run on a computer, causes the computer to execute any of the redundancy configuration detection methods described above.

[0146] In the above embodiments, implementation can be achieved, in whole or in part, through software, hardware, firmware, or any combination thereof. When implemented in software, it can be implemented, in whole or in part, as a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, all or part of the processes or functions described in the embodiments of the present invention are generated. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another. For example, the computer instructions can be transmitted from one website, computer, server, or data center to another website, computer, server, or data center via wired (e.g., coaxial cable, fiber optic, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) means. The computer-readable storage medium can be any available medium accessible to a computer or a data storage device such as a server or data center that integrates one or more available media. The available medium can be a magnetic medium (e.g., floppy disk, hard disk, magnetic tape), an optical medium (e.g., DVD), or a solid-state drive (SSD), etc.

[0147] It should be noted that, in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0148] The various embodiments in this specification are described in a related manner. Similar or identical parts between embodiments can be referred to mutually. Each embodiment focuses on describing the differences from other embodiments. In particular, the embodiments of apparatus, electronic devices, and storage media are basically similar to the method embodiments, so the descriptions are relatively simple; relevant parts can be referred to the descriptions of the method embodiments.

[0149] The above description is merely a preferred embodiment of the present invention and is not intended to limit the scope of protection of the present invention. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention are included within the scope of protection of the present invention.

Claims

1. An information interception method, characterized in that, The method includes: Receive business information, the business information including a first risk assessment feature; By comparing the first risk assessment feature with each of the second risk assessment features recorded in the risk feature database, the risk level of the business information is determined based on the comparison results. The second risk assessment features are obtained based on the sender reputation data fed back by the cloud information security service. If the risk level indicates that the business information is risky, the business information will be intercepted.

2. The method according to claim 1, characterized in that, Before receiving the service information, the method further includes: Get the sender's blacklist; Send the sender blacklist to the cloud information security service; Receive the reputation data of each sender in the sender blacklist fed back by the cloud information security service, and use the characteristics of the reputation data as the second risk assessment characteristics; Based on the second risk assessment feature, the risk feature library is constructed.

3. The method according to claim 2, characterized in that, The step of receiving reputation data of each sender in the sender blacklist fed back by the cloud information security service, and using the characteristics of the reputation data as the second risk assessment characteristics, includes: The system receives reputation data of each sender in the sender blacklist from the cloud information security service, and determines the attack risk characterization value of each sender based on the reputation score included in the reputation data of each sender. From the attack risk characterization values ​​of each sending end, obtain the characteristics of the reputation data of the sending end indicated by the attack risk characterization value that is greater than a set threshold, and use it as the second risk assessment feature.

4. The method according to claim 3, characterized in that, The determination of the attack risk characterization value of each sender based on the reputation score included in the reputation data of each sender includes: Based on the confidence reference information included in the reputation data of each sending end, the data confidence of the reputation data of each sending end is determined; The product of the data confidence level of the reputation data of each sender and the reputation score included in the reputation data of each sender is calculated as the attack risk characterization value of each sender.

5. The method according to claim 4, characterized in that, The confidence reference information includes: attack risk characterization value, data freshness, and content risk characterization value; The determination of the data confidence level of the reputation data of each sender based on the confidence reference information included in the reputation data of each sender includes: The attack risk characterization value, data freshness, and content risk characterization value are weighted and calculated according to the first, second, and third weights to obtain the data confidence level of the reputation data of each sending end.

6. The method according to claim 1, characterized in that, The method further includes: If the target similarity between the first risk assessment feature and the associated feature is greater than or equal to the first similarity, then the first risk assessment feature and the associated feature are merged, and the associated feature in the risk feature library is updated to the merged feature, wherein the associated feature is determined based on the similarity between the first risk assessment feature and each of the second risk assessment features.

7. The method according to claim 6, characterized in that, The method further includes: If the target similarity is less than the second similarity, then the first risk assessment feature is added to the risk feature library.

8. The method according to claim 7, characterized in that, The step of determining the risk level of the business information based on the comparison results includes: Calculate the product of the reputation score carried in the associated feature and the feature confidence of the associated feature, and obtain the risk level of the first risk assessment feature based on the correspondence between the calculation result and the risk level; The method further includes: If the target similarity is less than the first similarity but greater than the second similarity, then according to the set correspondence between similarity and confidence increment, the confidence increment corresponding to the target similarity is obtained; the sum of the feature confidence of the associated feature in the risk feature library and the determined confidence increment is calculated as the updated feature confidence of the associated feature.

9. The method according to any one of claims 1-8, characterized in that, The method further includes: In response to receiving a risk setting operation for a target risk assessment feature in the risk feature library, the risk level indicated by the risk setting operation is determined as the risk level of the target risk assessment feature; the target risk assessment feature and the determined risk level are recorded accordingly. The step of determining the risk level of the business information based on the comparison results includes: If the risk level corresponding to the associated feature has been recorded, the risk level corresponding to the associated feature is used as the risk level of the business information, wherein the associated feature is determined based on the similarity between the first risk assessment feature and each of the second risk assessment features.

10. An information interception device, characterized in that, The device includes: The first feature acquisition module is used to receive business information, the business information including a first risk assessment feature; The risk level determination module is used to compare the first risk assessment feature with each of the second risk assessment features recorded in the risk feature library, and determine the risk level of the business information based on the comparison results. The second risk assessment features are obtained based on the sender reputation data fed back by the cloud data security service. The information interception module is used to intercept the business information when the risk level indicates that the business information is risky information.

Images