Real-time data leakage intelligent blocking dynamic masking method for API call

Abstract

The application discloses a real-time data leakage intelligent blocking dynamic masking method for API calling, relates to the technical field of data leakage intelligent blocking, and comprises the following steps: when a caller calls data, the response data returned by an API is intercepted, the identity permission of the caller is acquired, and the historical calling data of the caller is called; whether the current calling behavior is normal is judged according to the identity permission and the data category of the response data; whether the current calling behavior is normal is judged according to the historical calling data and the data category of the response data; if the calling behavior is normal, the response data is returned to the user, if the calling behavior is abnormal, sensitive field identification is performed on the response data, the sensitive fields are subjected to masking processing, controlled data is obtained, and the controlled data is returned to the caller; and the application is used to solve the problem that the existing data leakage intelligent blocking technology is not comprehensive enough in analyzing risk factors and user behaviors, and the misjudgment rate of data leakage is relatively high.

Description

Technical Field

[0001] This invention relates to the field of intelligent data leakage prevention technology, specifically a real-time intelligent data leakage prevention dynamic masking method for API calls. Background Technology

[0002] Intelligent data breach blocking technology refers to a technical system that assesses the risk of a user's data access based on the data generated during the access process, and promptly blocks high-risk data access behaviors to prevent large-scale data breaches.

[0003] Existing intelligent data leakage prevention technologies typically control data access through permission-based access control. However, permission-based access only ensures that users have the necessary permissions, not the legitimacy of their access behavior. Furthermore, existing technologies often fail to comprehensively consider factors when analyzing the risk of access behavior, usually focusing on a single factor. They frequently rely on preset thresholds to determine abnormal behavior, lacking individualized analysis for each user. This results in insufficient applicability and an inability to monitor each user specifically. For example, patent CN118445840A discloses a "method and device for protecting sensitive database data from leakage." This solution uses a preset first ratio to determine if the peak value of sensitive data queries is normal, further assessing the risk of the operation. However, it lacks personalized analysis for different users, failing to ensure the judgment rules apply to every user. Existing intelligent data leakage prevention technologies also suffer from insufficient analysis of risk factors and user behavior, leading to a high false positive rate for data leakage. Summary of the Invention

[0004] This invention aims to at least partially solve one of the technical problems in the prior art. By intercepting the API response data when a caller invokes data, the system obtains the caller's identity and permissions, retrieves the caller's historical call data, and then determines whether the current call is normal based on the caller's identity, permissions, and the data category of the response data. Furthermore, it analyzes the caller's time-based usage patterns based on historical call times and IP addresses, and further analyzes the caller's data call patterns based on historical call categories and frequencies, determining whether the current call is normal. If the call is normal, response data is returned to the user; if the call is abnormal, sensitive fields in the response data are identified and masked to obtain control data, which is then returned to the caller. This addresses the problem that existing intelligent data leakage blocking technologies suffer from insufficient analysis of risk factors and user behavior, leading to a high false positive rate for data leakage.

[0005] To achieve the above objectives, in a first aspect, this application provides a real-time data leakage intelligent blocking dynamic masking method for API calls, comprising the following steps: When a caller requests data, intercept the response data returned by the API to obtain the caller's identity and permissions, and retrieve the caller's historical call data. Determine whether the call is normal based on the user's permissions and the data category of the response data; Determine whether the current call behavior is normal based on the data categories of historical call data and response data; If the call is successful, response data is returned to the user. If the call is unsuccessful, sensitive fields are identified in the response data and masked to obtain control data, which is then returned to the caller.

[0006] Furthermore, the step of intercepting the API response data when the caller invokes data, obtaining the caller's identity and permissions, and retrieving the caller's historical call data also includes the following sub-steps: When the caller requests data, intercept the response data returned by the API, obtain the database name from which the response data originates, and name it the data category; Obtain the caller's identity and permissions, including username, user permissions, user position, and user IP; Obtain the caller's historical call data, which includes historical call time, historical call category, historical call IP, and historical call frequency.

[0007] Furthermore, the step of determining whether the current call is normal based on identity permissions and the data category of the response data also includes the following sub-steps: Check if the user has the necessary permissions to access the data category. If yes, output a permission normal signal; otherwise, output a permission abnormal signal. Query whether the user's job title can access the data category. If yes, output a normal job title signal; otherwise, output an abnormal job title signal. If an abnormal permission signal or an abnormal job position signal is output, then this call behavior is marked as abnormal.

[0008] Furthermore, the step of determining whether the current call behavior is normal based on the data categories of historical call data and response data also includes the following sub-steps: Analyze the caller's time-based usage patterns based on historical call times and IP addresses, and determine whether the current call behavior is normal based on these time-based usage patterns. Analyze the caller's data call patterns based on historical call categories and frequencies, and determine whether the current call behavior is normal based on these patterns.

[0009] Furthermore, the step of analyzing the caller's time-based usage patterns based on historical call times and historical call IPs, and determining whether the current call behavior is normal based on these time-based usage patterns, also includes the following sub-steps: The historical call time in each historical call data corresponds to the historical call IP, and the historical call time is divided into different IP groups according to the different historical call IPs; Each IP packet is analyzed independently, and the historical call times are sorted in ascending order, using the symbol T. m It means that the T m In this context, m is the index of T, and m is a positive integer. Starting with m=1, the calculation of T... m With T m+1 The time difference between the values ​​is calculated for all possible values ​​of m, excluding the maximum value of m. The time differences are then sorted in ascending order, using the symbol TC. m express; Using sequence number m as the X-axis and time difference TC as the Y-axis... m Construct a time-segmented coordinate system for the Y-axis, and divide the time difference TC m Enter the time period division coordinate system according to the serial number m, draw the time period division auxiliary line. The time period division auxiliary line is perpendicular to the X-axis and is initially located on the Y-axis. Move the time period division auxiliary line in the positive direction of the X-axis. Name the coordinate point on the left side of the time period division auxiliary line as the same time period difference point, and name the remaining coordinate points as different time period difference points. Linear regression was performed on the time difference points within the same time period and the time difference points in different time periods to obtain the slope of the regression line. These slopes were named the time difference parameter within the same time period and the time difference parameter in different time periods, respectively, and represented by the symbols QA and QB. QB-QA was calculated to obtain the time period division parameter. Continuously move the time period division auxiliary line and update the time period division parameters. Take the time difference point of different time periods when the time period division parameters are at their maximum as the time period division point. Obtain the minimum value of the time difference corresponding to the time period division point and name it the time period division threshold. The caller's time-based usage patterns are analyzed based on time-period thresholds, and the call behavior is judged to be normal based on these time-based usage patterns.

[0010] Furthermore, the step of analyzing the caller's time-based usage patterns based on time-period thresholds and determining whether the current call behavior is normal based on these time-based usage patterns also includes the following sub-steps: Time differences greater than or equal to the time period segmentation threshold are named time period segmentation points. These time period segmentation points are then sorted in order from morning to evening and designated by the symbol TF. h This indicates that the TF h In this context, h is the index of TF and h is a positive integer; TF h The corresponding T m The index m is labeled as G(h), and T of m≤G(1) is... m Merge them into a single call time period group, and include T with ≤G(h)m≤G(h+1). m Merge them into a single call time period group, and analyze the call time period group for each value of h, excluding the maximum value of h; The range of historical call times in each call time period group is statistically analyzed and named as the historical call time period. Each IP group has a different historical call time period. The IP group and the historical call time period are the time-based usage pattern. The security manager configures trusted IPs for each user. When a caller requests data, the system checks whether the caller's IP is a trusted IP. If it is, the system outputs a normal IP signal; otherwise, it outputs an abnormal IP signal. If the IP is normal, the time when the caller requests the data is named the real-time time. It is then determined whether the real-time time is within the historical call period of the IP group corresponding to the trusted IP. If so, the time is normal; otherwise, the time is abnormal. If an IP error signal or a time error signal is output, then the call behavior is marked as abnormal.

[0011] Furthermore, the step of analyzing the caller's data call patterns based on historical call categories and frequencies, and determining whether the current call behavior is normal based on these patterns, also includes the following sub-steps: The historical call frequency records the historical similar call frequency and the historical call action frequency. The historical similar call frequency is the frequency at which a user calls the same historical call category within one second. The historical call action frequency is the frequency at which a user calls all historical call categories within one second. Based on the different historical call categories, the frequency of similar historical calls is grouped to obtain category groups. The maximum frequency of similar historical calls in the category group is taken as the category call threshold. The data category called by the caller in real time is named the real-time category. The frequency of the user's call to the implementation category is taken and named the real-time category frequency. If the real-time category frequency is greater than or equal to the category call threshold, the category call abnormal signal is output; otherwise, the category call normal signal is output. Set a sliding window period, starting with the first data call of the day. Obtain the historical call frequency within the sliding window period, naming it the "Periodic Call Frequency." Sort the periodic call frequency in ascending order, using the symbol ZT. i The ZT shown represents... i In this context, i is the index of ZT and i is a positive integer; Using sequence number i as the horizontal axis, and the periodic call frequency ZT as the vertical axis... i Construct a call frequency analysis coordinate system for the vertical axis, and set ZT i Enter the frequency analysis coordinate system according to the serial number i, perform linear regression on the frequency analysis coordinate system, obtain the slope of the regression line, and name it the frequency stability parameter; The sliding window period moves along the time growth direction, and the frequency stability parameter is updated synchronously. The maximum value of the frequency stability parameter is taken as the frequency stability threshold. The frequency stability parameter of the caller is analyzed in real time and named the real-time frequency parameter. If the real-time frequency parameter is less than or equal to the frequency stability threshold, a normal frequency call signal is output; otherwise, an abnormal frequency call signal is output. If the category call exception signal or the frequency call exception signal is output, then the call behavior is marked as abnormal.

[0012] Furthermore, the step of returning response data to the user if the call behavior is normal, and identifying and masking sensitive fields in the response data if the call behavior is abnormal to obtain control data and return the control data to the caller, also includes the following sub-steps: If the call proceeds normally, return response data to the user; If the call behavior is abnormal, the sensitive fields in the response data are identified by multi-modal regular expressions, and the sensitive fields are encrypted using an asymmetric encryption algorithm to obtain the control data, which is then returned to the caller. Each time encryption is performed, a public key and a private key are randomly generated. The public key is sent to the security manager, along with risk call information. If the security manager confirms that the call is risk-free, the public key is sent to the caller to view the content that is blocked in the control data.

[0013] A second aspect of the present invention provides an electronic device comprising: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores a computer program executable by the at least one processor, the computer program being executed by the at least one processor to enable the at least one processor to perform the method described in the first aspect above.

[0014] A third aspect of the present invention provides a computer-readable storage medium storing a computer program that, when executed by a processor, implements the method described in the first aspect above.

[0015] The beneficial effects of this invention are as follows: 1. This invention intercepts the response data returned by the API when the caller calls data, obtains the caller's identity and permissions, and retrieves the caller's historical call data. Then, it judges whether the current call behavior is normal based on the identity and permissions and the data category of the response data. Furthermore, it analyzes the caller's time-based usage patterns based on historical call time and historical call IP, and judges whether the current call behavior is normal based on the time-based usage patterns. It also analyzes the caller's data call patterns based on historical call categories and historical call frequencies, and judges whether the current call behavior is normal based on the data call patterns. The advantage is that it analyzes whether there are security risks when the caller calls data based on comprehensive factors such as permissions, time, space, and frequency. Moreover, it analyzes each user independently. The time-based usage patterns and data call patterns of different users are analyzed independently. That is, each user has an independent security standard, which prevents misjudgment caused by the global application of security standards. This greatly reduces the misjudgment rate of data leakage and improves the accuracy and effectiveness of intelligent blocking of data leakage. 2. This invention returns response data to the user when the call behavior is normal, and identifies and masks sensitive fields in the response data when the call behavior is abnormal, thereby obtaining control data and returning the control data to the caller. The advantage is that it can determine in real time whether the user's call behavior is risky and mask the response data in a timely manner to prevent information leakage, thus improving the timeliness of intelligent blocking of data leakage. Attached Figure Description

[0016] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this application and, together with the description, serve to explain the principles of this application.

[0017] Figure 1 This is a flowchart of the steps of the method of the present invention; Figure 2 This is a schematic diagram of the time period division coordinate system of the present invention; Figure 3 This is a schematic diagram of the time period division auxiliary lines of the present invention; Figure 4 This is a schematic diagram of the coordinate system for call frequency analysis in this invention. Detailed Implementation

[0018] To enable those skilled in the art to better understand the present invention, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present invention.

[0019] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this invention are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be used interchangeably where appropriate so that the embodiments of the invention described herein can cover implementations in sequences other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0020] In enterprise information security protection, preventing data leakage is of paramount importance. Besides network security protection, it is also necessary to prevent internal human-caused leaks due to business competition. Within an enterprise, people with different permissions and positions require access to different data, and different individuals have different data access habits. Therefore, when analyzing the risks of access behavior, it is necessary to differentiate between individuals and not use a single standard to evaluate everyone's access behavior. Furthermore, it is essential to comprehensively consider factors related to the risk of access behavior to prevent missed detections. To address the above issues, Embodiment 1 of this application provides a real-time intelligent blocking dynamic masking method for API calls. Please refer to... Figure 1 As shown, it includes the following steps: Step S1: When the caller requests data, intercept the response data returned by the API, obtain the caller's identity and permissions, and retrieve the caller's historical call data. Step S1 also includes the following sub-steps: Step S101: When the caller requests data, intercept the response data returned by the API, obtain the database name of the source of the response data, and name it as the data category; Step S102: Obtain the caller's identity and permissions, including username, user permissions, user position, and user IP. Step S103: Obtain the caller's historical call data, which includes historical call time, historical call type, historical call IP, and historical call frequency. In practice, step S1 involves acquiring and defining various data items. The username is merely a record of the caller's account name and has no substantive function. For example, when a caller accesses financial data, the system obtains the employee's username as Zhang San, user privileges as level two, user position as CFO, and user IP as 192.168.0.0. Simultaneously, in this employee's historical data access records, a particular record includes "Historical access time: 2026-02-08". 15:30:16, Historical call category: Financial data, Historical call IP: 192.168.0.0, Historical similar call frequency: 186s, Historical call action frequency: 28s. Here, the historical similar call frequency and historical call action frequency are collectively referred to as historical call frequency. User permissions and data categories are defined and corresponded by the enterprise itself, and this embodiment will not provide a detailed explanation. The example listed above is a schematic diagram of the format of each data item. Here, the historical similar call frequency means that the time frequency between the employee's current retrieval of financial data and the previous retrieval of financial data is 186s, while the historical call action frequency means that the employee had sequential call behavior in the 28s before this call behavior.

[0021] Step S2: Determine whether the call is normal based on the user's identity permissions and the data category of the response data; Step S2 also includes the following sub-steps: Step S201: Check whether the user's permissions allow access to the data category. If yes, output a permission normal signal; otherwise, output a permission abnormal signal. Step S202: Query whether the user's job can access the data category. If yes, output a normal job signal; otherwise, output an abnormal job signal. Step S203: If an abnormal permission signal or an abnormal position signal is output, then mark this call behavior as abnormal; In specific implementation, for example, in this embodiment, financial data requires level one or level two permissions to access. The employee listed in step S1 has level two permissions, so the employee can access the financial data and outputs a normal permission signal. The employee's position is CFO, so the employee can access the financial data and outputs a normal position signal, indicating that the employee's calling behavior is normal in terms of permissions and position.

[0022] Step S3: Determine whether the current call behavior is normal based on the data categories of historical call data and response data; Step S3 also includes the following sub-steps: Step S301: Analyze the caller's time-based usage patterns based on historical call times and historical call IPs, and determine whether the current call behavior is normal based on the time-based usage patterns. Step S301 also includes the following sub-steps: Step S3011: The historical call time in each historical call data corresponds to the historical call IP, and the historical call time is divided into different IP groups according to the different historical call IPs; Step S3012: Analyze each IP packet independently, and sort the historical call times in ascending order, using the symbol T. m It means that T m In this context, m is the index of T, and m is a positive integer. Starting with m=1, the calculation of T... m With T m+1 The time difference between the values ​​is calculated for all possible values ​​of m, excluding the maximum value of m. The time differences are then sorted in ascending order, using the symbol TC. m express; In specific implementation, for example, in this embodiment, the historical call IPs of a certain employee include 192.168.0.0 and 192.168.0.1. The historical call times are divided into two IP groups according to 192.168.0.0 and 192.168.0.1. For easy distinction, in this embodiment, the IP group corresponding to 192.168.0.0 is named group A, and the IP group corresponding to 192.168.0.1 is named group B. Taking group A as an example, the historical call times are sorted in order from earliest to latest to obtain the historical call time T. m 1≤m≤26428. It should be noted that the historical data recall time here only considers hours, minutes, and seconds, not the date. Weekdays and holidays can also be analyzed separately; that is, there exists a set T for weekdays. m There is a set of T during holidays. m This embodiment is only used to illustrate the analysis process, therefore it does not distinguish between holidays and workdays. During the sorting process, historical call times with the same hour, minute, and second are merged into the same T. m Then, calculate T. m With T m+1 The time difference between them gives us TC1 to TC 26427 Due to the large amount of data, it will not be listed in detail in this embodiment.

[0023] Please see Figures 2 to 3 As shown, in step S3013, with the sequence number m as the X-axis and the time difference TC as the X-axis... m Construct a time-segmented coordinate system for the Y-axis, and divide the time difference TC m Enter the time period division coordinate system according to the serial number m, draw the time period division auxiliary line. The time period division auxiliary line is perpendicular to the X-axis and is initially located on the Y-axis. Move the time period division auxiliary line in the positive direction of the X-axis. Name the coordinate point on the left side of the time period division auxiliary line as the same time period difference point, and name the remaining coordinate points as different time period difference points. Step S3014: Perform linear regression on the time difference points of the same time period and the time difference points of different time periods respectively, obtain the slope of the regression line, and name them as the time difference parameter of the same time period and the time difference parameter of different time periods respectively, and represent them by the symbols QA and QB respectively. Calculate QB-QA to obtain the time period division parameter. Step S3015: Continuously move the time period division auxiliary line and update the time period division parameters. Take the time difference point of different time periods when the time period division parameters are at their maximum as the time period division point. Obtain the minimum value of the time difference corresponding to the time period division point and name it the time period division threshold. In specific implementation, the time period division coordinate system is constructed as follows: Figure 2 As shown, auxiliary lines for dividing time periods are drawn simultaneously. Figure 3 As shown, at this time Figure 3 The vertical line segments in the diagram are auxiliary lines for dividing time periods. White coordinate points represent time differences within the same time period, while black coordinate points represent time differences between different time periods. This is obtained through regression. Figure 3 The corresponding time difference parameter QA for the same time period is 0.0157, and the time difference parameter QB for different time periods is 0.5857. The calculated time period division parameter is 0.57, which is the maximum value. Therefore, [the parameter is...]. Figure 3 The time difference corresponding to the leftmost black coordinate point is used as the time period segmentation threshold, specifically 596 seconds. This is because employees have different working periods throughout the day, and it is necessary to analyze the normal working periods of employees. If the earliest and latest time range is directly taken, it will include multiple idle periods where employees are not working. In this case, retrieving company data is very likely to cause a data leakage event. The time period segmentation threshold is used to divide working periods, and the periods when data is not accessed for a long time are regarded as idle periods. In the time period segmentation coordinate system, the time difference points of the same period represent close time nodes, which can be regarded as being in the same time period. The time difference points of different periods are time nodes that are far apart. These time nodes are usually not regarded as being in the same time period, but need to be split into different time periods. By moving the time period segmentation auxiliary line, the time difference points of the same period and the time difference points of different periods are found. Generally, the difference between the time difference points of the same period is small, and the QA is small. The difference between the time difference points of different periods is large, and the QB is large. When QB-QA reaches the maximum, it means that the division standard between long and short time periods has reached the optimal level.

[0024] Step S3017: Analyze the caller's time-based usage patterns based on the time period segmentation threshold, and determine whether the current call behavior is normal based on the time-based usage patterns. Step S3017 also includes the following sub-steps: Step S3017.1: Name the time difference greater than or equal to the time period division threshold as the time period division point, and sort the time period division points in order from morning to evening, using the symbol TF. h TF indicates h In this context, h is the index of TF and h is a positive integer; Step S3017.2, TF h The corresponding T m The index m is labeled as G(h), and T of m≤G(1) is... m Merge them into a single call time period group, and include T with ≤G(h)m≤G(h+1). m Merge them into a single call time period group, and analyze the call time period group for each value of h, excluding the maximum value of h; Step S3017.3: Calculate the range of historical call times in each call time period group and name it as the historical call time period. Each IP group has a different historical call time period. The IP group and the historical call time period are the time-based usage pattern. In specific implementation, this embodiment only lists a small amount of data as an example. For instance, the historical call times of an employee, without considering the date, include 9:28:43, 9:31:18, 9:38:36, 11:18:27, 11:24:38, 13:14:58, and 13:25:38, corresponding to T1 to T7 respectively. Calculating the time differences in chronological order, we obtain the following: the time difference TC1 between 9:28:43 and 9:31:18 is 155s; the time difference TC2 between 9:31:18 and 9:38:36 is 438s; the time difference TC3 between 9:38:36 and 11:18:27 is 5991s; the time difference TC4 between 11:18:27 and 11:24:38 is 371s; and the time difference TC5 between 11:24:38 and 13:14:58 is 13:25:38. The time difference TC5 between 4:58 and 13:16:58 is 6620s, and the time difference TC6 between 13:25:38 and 13:16:58 is 520s. It can be seen that TC3 and TC5 are the time period division points. Sorting, we get TF1 as TC3 and TF2 as TC5. We get G(1) as 3 and G(2) as 5. Thus, we divide T1 to T3 into one group of call time periods, T4 and T5 into one group of call time periods, and T6 and T7 into one group of call time periods. Further statistics show that the historical call time periods include [9:28:43, 9:38:36], [11:18:27, 11:24:38] and [13:14:58, 13:25:38]. The historical call time periods analyzed here only belong to the AIP group. Similarly, we analyze the historical call time periods of the BIP group.

[0025] Step S3017.4: The security manager configures a trusted IP for each user. When a caller requests data, the system checks whether the caller's user IP is a trusted IP. If it is, the system outputs a normal IP signal; otherwise, the system outputs an abnormal IP signal. Step S3017.5: If the IP normal signal is output, the time when the caller requests the data is named the real-time time. Determine whether the real-time time is within the historical call period in the IP group corresponding to the trusted IP. If yes, output the time normal signal; otherwise, output the time abnormal signal. Step S3017.6: If an IP error signal or a time error signal is output, then mark this call behavior as abnormal; In practice, the trusted IP is usually an IP address within the company. Additional user IPs can also be added as trusted IPs as needed. Steps S3017.4 to S3017.6 are actually to determine whether the caller is on a trusted device and retrieves data within the caller's usual historical call period. If so, it means that the time and location of the user's call are normal, that is, there are no abnormalities in the time and space dimensions of this call. Since the judgment process is relatively simple and has been clearly explained in the steps, no further examples will be given here.

[0026] Step S302: Analyze the data calling patterns of the caller based on the historical call categories and historical call frequencies, and at the same time determine whether the current call behavior is normal based on the data calling patterns; Step S302 also includes the following sub-steps: Step S3021: The historical call frequency records the historical similar call frequency and the historical call action frequency. The historical similar call frequency is the frequency at which the user calls the same historical call category within one second, and the historical call action frequency is the frequency at which the user calls all historical call categories within one second. Step S3022: Group the frequency of historical calls of the same type according to different historical call categories to obtain category groups. Obtain the maximum value of the frequency of historical calls of the same type in the category group as the category call threshold. Name the data category called by the caller in real time as the real-time category. Obtain the frequency of the user calling the real-time category and name it the real-time category frequency. If the real-time category frequency is greater than or equal to the category call threshold, output the category call abnormal signal; otherwise, output the category call normal signal. In specific implementation, the detailed definitions of historical similar call frequency and historical call action frequency have been explained in step S1, and will not be explained again here. Regarding the historical similar call frequency, taking financial data as an example, within the company, except for the CFO, the historical similar call frequency of some employees is only 10 times / s. If such employees exceed 10 times / s in a certain call to financial data, it is considered a risky behavior. For example, if an employee's historical similar call frequency in the financial data category group is 10 times / s, that is, the category call threshold is 10 times / s, and the employee's call frequency for this time is 15 times / s, that is, the real-time category frequency is 15 times / s, which is greater than 10 times / s, so a category call abnormal signal is output, indicating that the employee's call behavior violates the employee's calling habits for financial data, and this call is risky. It should be noted that before step S4, the called data has not been transmitted to the caller.

[0027] Step S3023: Set the sliding window period, starting with the first data call of the day. Obtain the historical call frequency within the sliding window period, name it the periodic call frequency, and sort the periodic call frequency in ascending order, denoted by the symbol ZT. i The ZT shown represents... i In this context, i is the index of ZT and i is a positive integer; Please see Figure 4 As shown, in step S3024, with the sequence number i as the horizontal axis, and simultaneously using the periodic call action frequency ZT... i Construct a call frequency analysis coordinate system for the vertical axis, and set ZT i Enter the frequency analysis coordinate system according to the serial number i, perform linear regression on the frequency analysis coordinate system, obtain the slope of the regression line, and name it the frequency stability parameter; Step S3025: Move the sliding window period along the time growth direction, update the frequency stability parameter synchronously, take the maximum value of the frequency stability parameter as the frequency stability threshold, analyze the caller's frequency stability parameter in real time, name it the real-time frequency parameter, if the real-time frequency parameter is less than or equal to the frequency stability threshold, output the frequency call normal signal, otherwise output the frequency call abnormal signal. Step S3026: If the output category call exception signal or frequency call exception signal is output, then mark the current call behavior as abnormal; In practice, the sliding window period is set by the administrator. In this embodiment, the sliding window period is set to 10 seconds. For example, if an employee first calls data at 9:25:46 on a certain day in history, the historical call frequency between 9:25:46 and 9:25:56 is obtained, starting from 9:25:46, to obtain the periodic call frequency. During this period, the employee's periodic call frequency is ZT1 to ZT. 10The frequencies were 8 times / s, 10 times / s, 12 times / s, 12 times / s, 13 times / s, 15 times / s, 19 times / s, 20 times / s, 20 times / s, and 24 times / s, respectively. A coordinate system for analyzing the call frequency was constructed as follows: Figure 4 As shown, the frequency stability parameter obtained through linear regression is 1.6788. The frequency stability parameter represents the fluctuation of the employee's call frequency in a short period of time. If the employee's call frequency suddenly increases, it will cause the frequency stability parameter to rise rapidly. This call scenario also has risks. However, each employee's call needs are different. Therefore, it is necessary to analyze the independent frequency stability threshold for each employee. The sliding window period is moved along the time growth direction, that is, the frequency stability parameter is analyzed every 10 seconds after 9:25:46. After analyzing all historical call times, the maximum value is taken as the frequency stability threshold, which represents the employee's highest API call demand. If the demand is exceeded, it is considered a risky behavior.

[0028] Step S4: If the call behavior is normal, return the response data to the user; if the call behavior is abnormal, identify the sensitive fields in the response data and mask the sensitive fields to obtain the control data and return the control data to the caller. Step S4 also includes the following sub-steps: Step S401: If the call is successful, return response data to the user. Step S402: If the calling behavior is abnormal, the sensitive fields in the response data are identified by multi-modal regular expressions, and the sensitive fields are encrypted by an asymmetric encryption algorithm to obtain the control data, and the control data is returned to the caller. Step S403: Randomly generate a public key and a private key each time encryption is performed, and send the public key to the security manager. Send risk call information to the security manager. If the security manager confirms that the call is risk-free, send the public key to the caller to view the content that is blocked in the control data. In specific implementation, if the following signals are output simultaneously: normal permission signal, normal position signal, normal IP signal, normal time signal, normal category call signal, and normal frequency call signal, it indicates that the caller's call behavior is normal, and response data is returned to the user. Otherwise, it is considered that the call behavior is abnormal. The extraction of sensitive fields and the encryption of asymmetric encryption algorithms are existing data processing methods, which will not be listed in detail in this embodiment. When each risky behavior occurs, a public key and a private key are randomly generated and the sensitive fields are encrypted using an asymmetric encryption algorithm. Then, the public key is sent to the security manager, who assesses whether the risky behavior is a misjudgment. If a misjudgment is made, the control data is decrypted using the public key.

[0029] This application also provides an electronic device. The electronic device may include a processor and a memory communicatively connected to the processor. The memory stores computer-executable instructions; the processor executes the computer-executable instructions stored in the memory to implement the method embodiment as described in Embodiment 1 above. The specific implementation and technical effects are similar and will not be repeated here.

[0030] In this embodiment, the memory and processor are connected via a bus. The bus can be an Industry Standard Architecture (ISA) bus, a Peripheral Component Interconnect (PCI) bus, or an Extended Industry Standard Architecture (EISA) bus, etc. The bus can be categorized into address bus, data bus, control bus, etc.

[0031] In the above embodiments, it should be understood that the processor can be a Central Processing Unit (CPU), or other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), etc. The general-purpose processor can be a microprocessor or any conventional processor. The steps of the method disclosed in this invention can be directly implemented by a hardware processor, or implemented by a combination of hardware and software modules within the processor.

[0032] The memory may include random access memory (RAM) and may also include non-volatile memory (NVM), such as at least one disk storage device.

[0033] The bus can be an Industry Standard Architecture (ISA) bus, a Peripheral Component Interconnect (PCI) bus, or an Extended Industry Standard Architecture (EISA) bus, etc. Buses can be categorized as address buses, data buses, control buses, etc. For ease of illustration, the buses shown in the accompanying drawings are not limited to a single bus or a single type of bus.

[0034] This application also provides a computer program product, including a computer program that, when executed by a processor, implements the above-described method.

[0035] This application also provides a computer-readable storage medium storing computer-executable instructions, which, when executed by a processor, implement the above-described method.

[0036] The aforementioned readable storage medium can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic storage, flash memory, magnetic disk, or optical disk. The readable storage medium can be any available medium accessible to a general-purpose or special-purpose computer.

[0037] An exemplary readable storage medium is coupled to a processor, enabling the processor to read information from and write information to the readable storage medium. Of course, the readable storage medium can also be a component of the processor. The processor and the readable storage medium can reside in an Application Specific Integrated Circuit (ASIC). Alternatively, the processor and the readable storage medium can exist as discrete components in the device.

[0038] Those skilled in the art will understand that all or part of the steps of the above-described method embodiments can be implemented by hardware related to program instructions. The aforementioned program can be stored in a computer-readable storage medium. When executed, the program performs the steps of the above-described method embodiments; and the aforementioned storage medium includes various media capable of storing program code, such as ROM, RAM, magnetic disks, or optical disks.

[0039] Finally, it should be noted that other embodiments of the invention will readily occur to those skilled in the art upon consideration of the specification and practice of the invention disclosed herein. This invention is intended to cover any variations, uses, or adaptations of the invention that follow the general principles of the invention and include common knowledge or customary techniques in the art not disclosed herein, and is not limited to the precise structures described above and shown in the accompanying drawings, and various modifications and changes can be made without departing from its scope. The scope of the invention is limited only by the appended claims.

Claims

1. A real-time data leakage intelligent blocking dynamic masking method for API calls, characterized in that, include: When a caller requests data, intercept the response data returned by the API to obtain the caller's identity and permissions, and retrieve the caller's historical call data. Determine whether the call is normal based on the user's permissions and the data category of the response data; The process involves determining whether the current call is normal based on the data categories of historical call data and response data; analyzing the caller's time-based usage patterns based on historical call time and historical call IP, and then determining whether the current call is normal based on these patterns; this includes the following sub-steps: Each historical call data entry corresponds to a historical call IP, and the historical call time is divided into different IP groups according to the different historical call IPs; each IP group is analyzed independently, and the historical call times are sorted in ascending order, using the symbol T. m It means that the T m In this context, m is the index of T, and m is a positive integer. Starting with m=1, the calculation of T... m With T m+1 The time difference between the values ​​is calculated for all possible values ​​of m, excluding the maximum value of m. The time differences are then sorted in ascending order, using the symbol TC. m express; Using sequence number m as the X-axis and time difference TC as the Y-axis... m Construct a time-segmented coordinate system for the Y-axis, and divide the time difference TC m Enter the time period division coordinate system according to the sequence number m, and draw the time period division auxiliary line. The time period division auxiliary line is perpendicular to the X-axis and is initially located on the Y-axis. Move the time period division auxiliary line in the positive direction of the X-axis. Name the coordinate points on the left side of the time period division auxiliary line as the same time period difference points, and name the remaining coordinate points as different time period difference points. Perform linear regression on the same time period difference points and different time period difference points respectively, obtain the slope of the regression line, and name them as the same time period difference parameter and different time period difference parameter, respectively, and represent them by the symbols QA and QB. Calculate QB-QA to obtain the time period division parameter. Continuously move the time period division auxiliary line and update the time period division parameter. Take the different time period difference point when the time period division parameter is the largest as the time period division point, obtain the minimum value of the time difference corresponding to the time period division point, and name it the time period division threshold. The caller's time-based usage patterns are analyzed based on time-period thresholds, and the normality of the current call behavior is determined based on these time-based usage patterns. If the call is successful, response data is returned to the user. If the call is unsuccessful, sensitive fields are identified in the response data and masked to obtain control data, which is then returned to the caller.

2. The method according to claim 1, characterized in that, The step of intercepting the API response data when the caller requests data, obtaining the caller's identity and permissions, and retrieving the caller's historical call data further includes the following sub-steps: When the caller requests data, intercept the response data returned by the API, obtain the database name from which the response data originates, and name it the data category; Obtain the caller's identity and permissions, including username, user permissions, user position, and user IP; Obtain the caller's historical call data, which includes historical call time, historical call category, historical call IP, and historical call frequency.

3. The method according to claim 2, characterized in that, The step of determining whether the current call behavior is normal based on identity permissions and the data category of the response data also includes the following sub-steps: Check if the user has the necessary permissions to access the data category. If yes, output a permission normal signal; otherwise, output a permission abnormal signal. Query whether the user's job title can access the data category. If yes, output a normal job title signal; otherwise, output an abnormal job title signal. If an abnormal permission signal or an abnormal job position signal is output, then this call behavior is marked as abnormal.

4. The method according to claim 3, characterized in that, The step of determining whether the current call behavior is normal based on the data categories of historical call data and response data also includes the following sub-steps: Analyze the caller's data call patterns based on historical call categories and frequencies, and determine whether the current call behavior is normal based on these patterns.

5. The method according to claim 4, characterized in that, The step of analyzing the caller's time-based usage patterns based on time-period thresholds and determining whether the current call behavior is normal based on these time-based usage patterns also includes the following sub-steps: The time difference greater than or equal to the time period segmentation threshold is named the time period segmentation difference. These time period segmentation differences are sorted from morning to night and denoted by the symbol TF. h This indicates that the TF h In this context, h is the index of TF and h is a positive integer; TF h The corresponding T m The index m is labeled as G(h), and T of m≤G(1) is... m Merge them into a single call time period group, and include T for G(h) < m ≤ G(h+1). m Merge them into a single call time period group, and analyze the call time period group for each value of h, excluding the maximum value of h; The range of historical call times in each call time period group is statistically analyzed and named as the historical call time period. Each IP group has a different historical call time period. The IP group and the historical call time period are the time-based usage pattern. The security manager configures trusted IPs for each user. When a caller requests data, the system checks whether the caller's IP is a trusted IP. If it is, the system outputs a normal IP signal; otherwise, it outputs an abnormal IP signal. If the IP is normal, the time when the caller requests the data is named the real-time time. It is then determined whether the real-time time is within the historical call period of the IP group corresponding to the trusted IP. If so, the time is normal; otherwise, the time is abnormal. If an IP error signal or a time error signal is output, then the call behavior is marked as abnormal.

6. The method according to claim 5, characterized in that, The step of analyzing the caller's data call patterns based on historical call categories and frequencies, and determining whether the current call behavior is normal based on these patterns, also includes the following sub-steps: The historical call frequency records the historical call frequency of the same type and the historical call action frequency. The historical call frequency of the same type is the frequency at which a user calls the same historical call category within one second. The historical call action frequency is the frequency at which a user calls all historical call categories within one second. Based on the different historical call categories, the frequency of historical calls of the same type is grouped to obtain category groups. The maximum value of the historical call frequency of the same type in the category group is taken as the category call threshold. The data category called by the caller in real time is named the real-time category. The frequency of the user calling the real-time category is obtained and named the real-time category frequency. If the real-time category frequency is greater than or equal to the category call threshold, the category call abnormal signal is output; otherwise, the category call normal signal is output. Set a sliding window period, starting with the first data call of the day. Obtain the historical call frequency within the sliding window period, naming it the "Periodic Call Frequency." Sort the periodic call frequency in ascending order, using the symbol ZT. i It indicates that the ZT i In this context, i is the index of ZT and i is a positive integer; Using sequence number i as the horizontal axis, and the periodic call frequency ZT as the vertical axis... i Construct a call frequency analysis coordinate system for the vertical axis, and set ZT i Enter the frequency analysis coordinate system according to the serial number i, perform linear regression on the frequency analysis coordinate system, obtain the slope of the regression line, and name it the frequency stability parameter; The sliding window period moves along the time growth direction, and the frequency stability parameter is updated synchronously. The maximum value of the frequency stability parameter is taken as the frequency stability threshold. The frequency stability parameter of the caller is analyzed in real time and named the real-time frequency parameter. If the real-time frequency parameter is less than or equal to the frequency stability threshold, a normal frequency call signal is output; otherwise, an abnormal frequency call signal is output. If the category call exception signal or the frequency call exception signal is output, then the call behavior is marked as abnormal.

7. The method according to claim 6, characterized in that, The step of returning response data to the user if the call behavior is normal, and identifying and masking sensitive fields in the response data if the call behavior is abnormal to obtain control data and return the control data to the caller, further includes the following sub-steps: If the call proceeds normally, return response data to the user; If the call behavior is abnormal, the sensitive fields in the response data are identified by multi-modal regular expressions, and the sensitive fields are encrypted using an asymmetric encryption algorithm to obtain the control data, which is then returned to the caller. Each time encryption is performed, a public key and a private key are randomly generated. The public key is sent to the security manager, along with risk call information. If the security manager confirms that the call is risk-free, the public key is sent to the caller to view the content that is blocked in the control data.

8. An electronic device, characterized in that, The electronic device includes: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores a computer program executable by the at least one processor, the computer program being executed by the at least one processor to enable the at least one processor to perform the method as described in any one of claims 1-7.

9. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program that, when executed by a processor, implements the method as described in any one of claims 1-7.

Images