Information security processing method and device, electronic equipment, medium and program product

Abstract

The application provides an information security processing method and device, electronic equipment, medium and program product, and relates to the fields of artificial intelligence and financial technology. The method comprises the following steps: acquiring real-time operation behavior data and environment data of a user, wherein the environment data comprises operation time and operation location corresponding to the operation behavior data; generating a behavior intervention rule based on a preset rule, the operation behavior data and the environment data; processing and storing abnormal operation behavior of the user based on the behavior intervention rule; the processing comprises blocking and / or issuing a warning. By acquiring the operation behavior data and the environment data of the user in real time, generating the behavior intervention rule based on the preset rule, and automatically processing and recording the abnormal operation behavior, real-time monitoring and accurate intervention of the operation of the user are realized, risk behavior can be discovered and processed in time, the occurrence of security events is reduced, the risk of leakage is reduced, and the information security protection capability and compliance are significantly improved.

Description

Technical Field

[0001] This application relates to the fields of artificial intelligence and financial technology, and in particular to an information security processing method, apparatus, electronic device, medium, and program product. Background Technology

[0002] In some enterprise environments, when users access business systems through terminal devices, they often need to view, edit, and transmit sensitive data. These operations involve the enterprise's core business information and confidential data, so ensuring data security and compliance is crucial.

[0003] However, existing technologies have significant limitations in monitoring and managing user operations. They often analyze user behavior through log reviews, but this analysis is only reactive and cannot detect risky user actions in real time. For example, multiple failed login attempts may indicate a malicious attack, while unusual file downloads may suggest a data breach risk. If these risky behaviors are not detected and addressed promptly, they can lead to serious security incidents and incalculable losses for businesses.

[0004] Therefore, a method is needed to detect and intervene in risky user behavior in real time to enhance the security and reliability of the system. Summary of the Invention

[0005] This application provides an information security processing method, apparatus, electronic device, medium, and program product to solve the technical problem of being unable to detect and process risky user operations in a timely manner.

[0006] Firstly, this application provides an information security processing method, which includes:

[0007] Acquire real-time user action data and environmental data, including the action time and location corresponding to the action data;

[0008] Based on preset rules, as well as operational behavior data and environmental data, behavioral intervention rules are generated;

[0009] Based on behavioral intervention rules, abnormal user behavior is processed and stored; the processing includes blocking and / or issuing warnings.

[0010] In one embodiment, behavioral intervention rules are generated based on preset rules, operational behavior data, and environmental data, specifically including:

[0011] Based on operational behavior data and environmental data, determine the user's operational behavior;

[0012] Based on preset rules, determine whether the operation is an unauthorized access;

[0013] If the operation is an unauthorized access, then access permissions are set; access permissions are used to block unauthorized access by users; the preset rules include the role corresponding to the user's identifier.

[0014] In one embodiment, the method further includes:

[0015] Watermark characters are generated based on user identifier, operation behavior, and operation time;

[0016] Generate a watermark view based on the resolution of the terminal device and the watermark characters;

[0017] The watermark view is overlaid onto the display interface of the terminal device so that the display interface carries the watermark view.

[0018] In one embodiment, behavioral intervention rules are generated based on preset rules, operational behavior data, and environmental data, specifically including:

[0019] Based on operational behavior data and environmental data, determine the user's operational behavior;

[0020] Based on preset rules, determine whether the operation is an abnormal operation; abnormal operations include at least one of the following: deleting a database, modifying a critical configuration file, and accessing sensitive information.

[0021] If the user's operation is abnormal, an interrupt instruction is generated to interrupt the operation.

[0022] In one embodiment, the user's operational behavior is determined based on operational behavior data and environmental data, specifically including:

[0023] The operational behavior data and environmental data are matched using regular expression algorithms to determine whether there is sensitive information in the operational behavior data and environmental data. Sensitive information includes identification codes, mobile phone numbers or sensitive words.

[0024] In one embodiment, storing abnormal user actions specifically includes:

[0025] The system records the user's interface in real time and generates the recording content, which includes the user's actions on the interface.

[0026] The screen recording content is converted into text records, and operation information is extracted from the text records. The operation information includes the operation behavior, the operation time corresponding to the operation behavior, the operation object, and the operation result.

[0027] The operation information is structured to generate operation record data; the structured processing is then used to store the operation information in a database.

[0028] In one embodiment, behavioral intervention rules are generated based on preset rules, operational behavior data, and environmental data, specifically including:

[0029] Based on operational behavior data and environmental data, monitor user operational behavior; operational behavior data includes operation type, operation object, and operation time.

[0030] Determine whether the operation is illegal software installation or uninstallation of security software based on preset rules;

[0031] If a user's action involves illegally installing or uninstalling security software, a warning instruction is generated; the warning instruction is used to report the user's action.

[0032] In one embodiment, the method further includes:

[0033] Obtain users' historical operation behavior data, which includes operation type, operation frequency, operation time, and operation object;

[0034] Based on historical operational behavior data and scoring rules, obtain the user's risk score;

[0035] If a user's risk score exceeds a preset threshold, the user will be listed as a person requiring close monitoring.

[0036] Secondly, embodiments of this application provide an information security processing apparatus, comprising:

[0037] The acquisition module is used to acquire real-time user operation behavior data and environmental data. The environmental data includes the operation time and operation location corresponding to the operation behavior data.

[0038] The generation module is used to generate behavioral intervention rules based on preset rules, as well as operational behavior data and environmental data;

[0039] The processing module is used to process and store abnormal user behavior based on behavior intervention rules; the processing includes blocking and / or issuing warnings.

[0040] Thirdly, embodiments of this application provide an electronic device, including: a processor, and a memory communicatively connected to the processor;

[0041] The memory stores instructions that the computer executes;

[0042] The processor executes computer-executable instructions stored in memory to implement any of the methods described above.

[0043] Fourthly, embodiments of this application provide a computer-readable storage medium storing computer-executable instructions, which, when executed by a processor, are used to implement any of the methods described above.

[0044] Fifthly, embodiments of this application provide a computer program product, including a computer program that, when executed by a processor, implements any of the methods described above.

[0045] This application provides an information security processing method, apparatus, electronic device, medium, and program product. The method includes: acquiring real-time user operation behavior data and environmental data, whereby the environmental data includes the operation time and location corresponding to the operation behavior data; generating behavior intervention rules based on preset rules, the operation behavior data, and the environmental data; processing and storing the user's abnormal operation behavior based on the behavior intervention rules; the processing includes blocking and / or issuing warnings. By acquiring user operation behavior data and environmental data in real time, generating behavior intervention rules based on preset rules, and automatically processing and recording abnormal operation behavior, real-time monitoring and precise intervention of user operations are achieved. This not only enables timely detection and handling of risky behaviors, reducing the occurrence of security incidents and preventing the leakage or damage of secure data, but also provides detailed data support for subsequent analysis, significantly improving information security protection capabilities and compliance. Attached Figure Description

[0046] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this application and, together with the description, serve to explain the principles of this application.

[0047] Figure 1 A flowchart illustrating an information security processing method provided in an embodiment of this application;

[0048] Figure 2 A flowchart illustrating an information security processing method provided in another embodiment of this application;

[0049] Figure 3 This is a schematic diagram of the structure of an information security processing device provided in an embodiment of this application;

[0050] Figure 4 A schematic diagram of the structure of the electronic device provided in this application.

[0051] The accompanying drawings illustrate specific embodiments of this application, which will be described in more detail below. These drawings and descriptions are not intended to limit the scope of the concept in any way, but rather to illustrate the concept of this application to those skilled in the art through reference to particular embodiments. Detailed Implementation

[0052] Exemplary embodiments will now be described in detail, examples of which are illustrated in the accompanying drawings. When the following description relates to the drawings, unless otherwise indicated, the same numbers in different drawings denote the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with this application. Rather, they are merely examples of apparatuses and methods consistent with some aspects of this application as detailed in the appended claims.

[0053] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, data stored, data displayed, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties. Furthermore, the collection, storage, use, processing, transmission, provision, disclosure, and application of the relevant data all comply with the relevant laws, regulations, and standards of the relevant countries and regions, have taken necessary confidentiality measures, do not violate public order and good morals, and provide corresponding operation access points for users to choose to authorize or refuse.

[0054] Furthermore, the technical solution involved in this application, which involves big data analysis of user information (including but not limited to personal biometrics, identity data, consumption data, asset data, electronic terminal operation data, etc.) and the use of artificial intelligence technology for automated decision-making, and makes decisions that have a significant impact on personal rights based on the results of automated decision-making, provides users with corresponding operation entry points for users to choose to agree to or reject the results of automated decision-making; if the user chooses to reject, the process will proceed to the expert decision-making process.

[0055] It should be noted that the information security processing methods, devices, electronic devices, media, and program products provided in this application can be used in the fields of artificial intelligence and fintech, as well as in any other field. The application fields of the information security processing methods, devices, electronic devices, media, and program products in this application are not limited.

[0056] When users access business systems through terminal devices, they often need to view, edit, and transmit sensitive data. Existing technologies have significant limitations in monitoring and managing user operations. They typically analyze user behavior through log reviews, but this analysis is only reactive and cannot detect risky user actions in real time. For example, multiple failed login attempts may indicate a malicious attack, while unusual file downloads may suggest a data breach risk. If these risky behaviors are not detected and addressed promptly, they can lead to serious security incidents and incalculable losses for the enterprise.

[0057] The specific application scenarios of this application are industry scenarios that require strict protection of sensitive information or data, such as: finance, healthcare, government agencies, and business systems of large enterprises.

[0058] This application provides an information security processing method that acquires user operation behavior data and environmental data in real time, generates behavior intervention rules based on preset rules, and automatically processes and records abnormal operation behaviors. This achieves real-time monitoring and precise intervention of user operations, which can not only promptly detect and handle risky behaviors, reduce the occurrence of security incidents, and prevent the leakage or damage of security data, but also provide detailed data support for subsequent analysis, significantly improving information security protection capabilities and compliance. It aims to solve the above-mentioned technical problems of existing technologies.

[0059] The technical solution of this application and how the technical solution of this application solves the above-mentioned technical problems are described in detail below with specific embodiments. These specific embodiments can be combined with each other, and the same or similar concepts or processes may not be described again in some embodiments. The embodiments of this application will now be described with reference to the accompanying drawings.

[0060] like Figure 1 As shown, Figure 1 This is a flowchart illustrating an embodiment of an information security processing method provided in this application. The information security processing method includes the following steps:

[0061] Step S101: Obtain real-time user operation behavior data and environmental data. The environmental data includes the operation time and operation location corresponding to the operation behavior data.

[0062] Specifically, this example will illustrate the acquisition of real-time user action and environmental data using two examples. For instance, when a user logs into a business system, the system captures the user's login attempt through the terminal device's login interface, records the username and password input, and simultaneously records the timestamp of the operation and the user's IP address to determine the time and location of the operation. When a user accesses a file, the system records the user's file access request through the file server, including the file path and access time, and also records the user's device information and network location to determine the location of the operation. Other real-time user action and environmental data can also be used for various operational scenarios, which will not be listed here.

[0063] Step S102: Generate behavioral intervention rules based on preset rules, operational behavior data, and environmental data.

[0064] Specifically, preset rules can include whitelists, sensitive information rules, and behavioral rule bases. The whitelist includes URLs and applications essential for daily work. Based on the company's security policy, it identifies which URLs and applications may pose security risks; for example, websites containing malware and unverified third-party applications should be excluded from the whitelist. User roles are categorized, such as ordinary employees, management, and technical teams. Different roles may require access to different resources. For example, management may need access to advanced management modules in the business system, while ordinary employees may only need access to basic business operation modules. Based on these considerations, a whitelist database is established, restricting users outside the whitelist to access only authorized business systems or software. Sensitive information refers to information of significant value and confidentiality to individuals, organizations, or companies, such as personal identification information, financial information, health information, confidential company information, and system configuration information. The behavioral rule base refers to a preset set of rules used to define and identify whether user actions comply with security requirements, such as triggering a warning after three consecutive failed login attempts or triggering a warning for logging in from an external network outside of working hours.

[0065] Based on the example, if the system detects that a user has failed to log in three times in a row, and considering that the operation time is 2:00 AM and the operation location is outside the company network, it determines that the behavior may pose a risk, generates a behavior intervention rule, temporarily locks the user's account, and issues a warning notification to the administrator; or if it detects that a user attempts to access sensitive files outside of working hours, and considering that the operation location is outside the company network, it determines that the behavior may pose a risk, generates a behavior intervention rule, blocks the access operation, and issues a warning notification to the administrator.

[0066] Step S103: Based on the behavior intervention rules, process and store the user's abnormal operation behavior; the processing includes blocking and / or issuing warnings.

[0067] Specifically, abnormal operational behaviors are blocked or prohibited according to behavioral intervention rules, and the processing results are stored in the security log for subsequent auditing and analysis.

[0068] This application embodiment acquires user operation behavior data and environmental data in real time, generates behavior intervention rules based on preset rules, and automatically processes and records abnormal operation behaviors, realizing real-time monitoring and precise intervention of user operations. This not only enables timely detection and handling of risky behaviors, reducing the occurrence of security incidents and preventing the leakage or damage of security data, but also provides detailed data support for subsequent analysis, significantly improving information security protection capabilities and compliance.

[0069] In one embodiment, step S102 specifically includes the following steps:

[0070] Based on operational behavior data and environmental data, user operational behavior is determined.

[0071] Specifically, the system collects and analyzes user behavior data and environmental data, and combines the collected data to analyze specific user behavior patterns. For example, if a user accesses sensitive internal files from outside the company network outside of working hours, this behavior pattern will be recorded.

[0072] Based on preset rules, determine whether the operation is an illegal access.

[0073] Specifically, after collecting user behavior data and environmental data, the system determines whether an action constitutes unauthorized access based on preset rules. These preset rules are predefined and used to identify behaviors that do not comply with security policies or compliance requirements. For example, preset rules may include prohibiting access to sensitive files outside of working hours and prohibiting access to the system from unknown devices. Secondly, the preset rules also consider the user's assigned role, such as administrator or regular employee; different roles have different access permissions. The collected user behavior data and environmental data are matched against the preset rules. If a user's behavior violates a preset rule, that behavior is marked as unauthorized access.

[0074] If the operation is an unauthorized access, then access permissions are set; access permissions are used to block unauthorized access by users; the preset rules include the role corresponding to the user's identifier.

[0075] Specifically, if a user's actions are determined to be unauthorized access, the system automatically adjusts the user's access permissions according to preset rules. Once the access permissions are adjusted, the unauthorized access will be blocked to prevent unauthorized operations. For example, a user attempts to access a sensitive file at 10 PM outside the company network; the preset rule prohibits accessing sensitive files from external networks outside of working hours. If the system detects that the user's actions violate the preset rule, it automatically revokes the user's access permissions to block the access operation, issues a warning to the system administrator, and records detailed information about the event for subsequent auditing and analysis. This embodiment can monitor user actions in real time, identify and block unauthorized access, thereby protecting the company's information security and compliance.

[0076] In one embodiment, the method further includes the following steps:

[0077] Watermark characters are generated based on user identifiers, user actions, and the time of the action.

[0078] Specifically, the system needs to generate a unique watermark character that identifies a user's specific action and the time of the action. Watermark characters are typically used to track and record user actions for auditing and traceability when needed. The user identifier can be a username, user ID, or other unique identifier. The system records the user's specific actions, such as the filename accessed, the command executed, and the type of operation. It also records the specific timestamp of the operation. The user identifier, action, and time are combined into a string, and then a unique watermark character is generated using a hash algorithm. The content of the watermark character can dynamically change with the operation time and action.

[0079] A watermark view is generated based on the resolution of the terminal device and the watermark characters.

[0080] Specifically, a transparent watermark view is designed according to the resolution of the terminal device to ensure that the watermark characters are clearly visible on the screen and do not affect the user's normal use.

[0081] The watermark view is overlaid onto the display interface of the terminal device so that the display interface carries the watermark view.

[0082] Specifically, the system can generate and display watermarked views to track and record user actions. Watermarking reduces the risk of sensitive information leakage and allows users to be traced, improving system security and traceability.

[0083] In one embodiment, camera detection technology is used to identify whether a user is using a mobile phone or camera to take pictures of the screen. If the taking action is detected, the screen will be blurred or go black.

[0084] In one embodiment, step S102 specifically includes the following steps, such as... Figure 2 As shown, Figure 2 A flowchart of an information security processing method provided in another embodiment of this application is shown below:

[0085] Step S201: Determine the user's operational behavior based on operational behavior data and environmental data.

[0086] Step S202: Based on preset rules, determine whether the operation is an abnormal operation; abnormal operation includes at least one of the following: deleting the database, modifying the key configuration file, and accessing sensitive information.

[0087] Specifically, the preset rules include prohibiting users from deleting critical databases or tables; prohibiting users from modifying critical configuration files, such as system configuration files and security configuration files; and prohibiting users from accessing sensitive information, such as customer data and financial information. The system matches collected user actions against the preset rules. If an action violates a preset rule, it will be marked as an abnormal action. For example, if a user attempts to delete a critical database table, the system will detect that this action violates the rule prohibiting the deletion of critical database tables, and thus mark the action as an abnormal action.

[0088] Step S203: If the user's operation behavior is abnormal, an interrupt instruction is generated; the interrupt instruction is used to interrupt the user's operation behavior.

[0089] Specifically, if a user's action is determined to be abnormal, the system will generate an interrupt command to prevent the operation from continuing. The specific form of the interrupt command depends on the type of operation and the system's implementation. For example, for a database deletion operation, the system can generate an SQL command to undo the deletion. This embodiment can monitor user actions in real time, identify and prevent abnormal actions, thereby protecting the enterprise's information security and compliance.

[0090] In one embodiment, step S201 specifically includes the following steps:

[0091] The operational behavior data and environmental data are matched using regular expression algorithms to determine whether there is sensitive information in the operational behavior data and environmental data. Sensitive information includes identification codes, mobile phone numbers or sensitive words.

[0092] Specifically, common sensitive information includes: personal identification information, financial information, health information, and corporate confidential information. User action data includes the content of files accessed by the user, text entered by the user, commands executed by the user, and their parameters; environmental data includes: the user's IP address, user's device information, and timestamps of operations. User action data and environmental data are matched against predefined regular expression patterns to determine the presence of sensitive information. The specific steps are: Selecting data fields: Determine the fields to be checked, such as file content, user input, IP address, etc.; Applying regular expressions: Apply the corresponding regular expression to each field and check for a match; Recording matching results: If the data matches the regular expression, record that the data field contains sensitive information. The matched sensitive information is recorded for subsequent auditing and processing. If sensitive information is detected, appropriate measures can be taken, such as issuing warnings, blocking operations, or recording detailed information, to identify the risk of sensitive information leakage due to system vulnerabilities or internal / external collusion.

[0093] In one embodiment, storing abnormal user actions specifically includes the following steps:

[0094] The system records the user's interface in real time and generates the recording content, which includes the user's actions on the interface.

[0095] Specifically, the system needs to capture the user's interface in real time and generate screen recordings. These recordings include all user actions on the interface, such as clicking, typing, and dragging. The recordings are saved as video files or image sequences; this application does not impose any restrictions on the format of the recordings.

[0096] The screen recording content is converted into text records, and operation information is extracted from the text records. The operation information includes the operation behavior, the operation time corresponding to the operation behavior, the operation object, and the operation result.

[0097] The operation information is structured to generate operation record data; the structured processing is then used to store the operation information in a database.

[0098] Specifically, the system needs to structure the extracted operation information and store it in a database. The database table structure includes fields such as operation behavior, operation time, operation object, and operation result. Storing the extracted operation information in the database allows for detailed recording and analysis of user operations, ensuring traceability and security. The structured processing ensures that the operation information can be easily queried and analyzed.

[0099] In one embodiment, step S102 specifically includes the following steps:

[0100] Based on operational behavior data and environmental data, monitor user operational behavior; operational behavior data includes operation type, operation object, and operation time.

[0101] The system determines whether an operation constitutes illegal software installation or uninstallation of security software based on preset rules.

[0102] Specifically, the system needs to determine whether a user's actions constitute unauthorized software installation or uninstallation of security software based on preset rules, ensuring that the terminal device environment complies with security regulations. Preset rules include prohibiting users from installing unauthorized software or uninstalling security software already deployed on the system. The system matches the user's actions against these preset rules; if the user's actions violate the rules, the system will mark the action as an unauthorized operation. For example, if a user attempts to install software not on the authorized list, the system will mark this as unauthorized software installation.

[0103] If a user's action involves illegally installing or uninstalling security software, a warning instruction is generated; the warning instruction is used to report the user's action.

[0104] Specifically, if a user's action involves illegally installing or uninstalling security software, the system will generate a warning command to prevent the operation from continuing and will notify the system administrator. This embodiment detects illegal software installation or security software uninstallation in real time. If non-whitelisted software is detected or security software is uninstalled, an alarm is triggered and the user's identity information is recorded, ensuring that the terminal device's environment complies with security policies.

[0105] In one embodiment, the method further includes the following steps:

[0106] Obtain users' historical operation behavior data, which includes operation type, operation frequency, operation time, and operation object.

[0107] Based on historical operational behavior data and scoring rules, a user's risk score is obtained.

[0108] If a user's risk score exceeds a preset threshold, the user will be listed as a person requiring close monitoring.

[0109] This embodiment establishes a risk scoring model to calculate risk values ​​by comprehensively considering dimensions such as user identity, operation type, time window, and operation frequency. When the risk value exceeds the threshold, dynamic intervention is triggered to improve the accuracy of risk identification, reduce false alarms and false negatives, and achieve graded response to high-risk operations.

[0110] like Figure 3 As shown, Figure 3 This is a schematic diagram of the structure of an information security processing device provided in an embodiment of this application. An information security processing device 300 includes: an acquisition module 301, used to acquire real-time user operation behavior data and environmental data, the environmental data including the operation time and location corresponding to the operation behavior data; a generation module 302, used to generate behavior intervention rules based on preset rules, the operation behavior data, and the environmental data; and a processing module 303, used to process and store abnormal user operation behaviors based on the behavior intervention rules; the processing includes blocking and / or issuing warnings.

[0111] In one embodiment, the generation module 302 is further configured to determine the user's operation behavior based on operation behavior data and environmental data; determine whether the operation behavior is illegal access based on preset rules; if the operation behavior is illegal access, set access permissions; the access permissions are used to block the user's illegal access; wherein, the preset rules include the role corresponding to the user identifier.

[0112] In one embodiment, the generation module 302 is further configured to generate watermark characters based on user identifier, operation behavior, and operation time; generate a watermark view according to the resolution of the terminal device and the watermark characters; overlay the watermark view onto the display interface of the terminal device, and display the watermark view on the display interface.

[0113] In one embodiment, the generation module 302 is further configured to determine the user's operation behavior based on operation behavior data and environmental data; determine whether the operation behavior is abnormal based on preset rules; abnormal operation behavior includes at least one of: deleting a database, modifying a key configuration file, and accessing sensitive information; if the user's operation behavior is abnormal, an interruption instruction is generated to interrupt the operation behavior.

[0114] In one embodiment, the generation module 302 is further configured to match the operation behavior data and environmental data using a regular expression algorithm to determine whether there is sensitive information in the operation behavior data and environmental data, including identity verification codes, mobile phone numbers or sensitive words.

[0115] In one embodiment, the processing module 303 is further configured to record the user's operation interface in real time and generate screen recording content, the screen recording content including recording the user's operation behavior on the operation interface; convert the screen recording content into text records and extract operation information from the text records, the operation information including operation behavior, operation time corresponding to the operation behavior, operation object, and operation result; perform structured processing on the operation information to generate operation record data; the structured processing is to store the operation information in a database.

[0116] In one embodiment, the generation module 302 is further configured to monitor the user's operation behavior based on operation behavior data and environmental data; the operation behavior data includes operation type, operation object and operation time; determine whether the operation behavior is illegal software installation or uninstallation of security software based on preset rules; if the user's operation behavior is illegal software installation or uninstallation of security software, generate a warning instruction; the warning instruction is used to report the user's operation behavior.

[0117] In one embodiment, the processing module 303 is further configured to acquire the user's historical operation behavior data, which includes operation type, operation frequency, operation time and operation object; based on the historical operation behavior data and scoring rules, acquire the user's risk score; if the user's risk score exceeds a preset threshold, list the user as a key person to pay attention to.

[0118] The information security processing device 300 provided in this embodiment can execute the method provided in the above method embodiment. Its implementation principle and technical effect are similar, and will not be described in detail here.

[0119] This application provides an electronic device, including: a processor, and a memory communicatively connected to the processor;

[0120] The memory stores instructions that the computer executes;

[0121] The processor executes computer-executable instructions stored in memory to implement any of the methods described above.

[0122] Figure 4 A schematic diagram of the structure of the electronic device provided in this application. Figure 4 As shown, the electronic device 400 provided in this embodiment includes at least one processor 401 and a memory 402. Optionally, the electronic device 400 further includes a communication component 403. The processor 401, memory 402, and communication component 403 are connected via a bus 404.

[0123] In a specific implementation, at least one processor 401 executes computer execution instructions stored in memory 402, causing at least one processor 401 to perform the above-described method.

[0124] The specific implementation process of processor 401 can be found in the above method embodiments, and its implementation principle and technical effect are similar. It will not be repeated here.

[0125] This application also provides a computer program product, including a computer program that, when executed by a processor, implements the above-described method.

[0126] This application also provides a computer-readable storage medium storing computer-executable instructions, which, when executed by a processor, implement the above-described method.

[0127] It should be noted that, for the sake of simplicity, the foregoing method embodiments are all described as a series of actions. However, those skilled in the art should understand that this application is not limited to the described order of actions, as some steps may be performed in other orders or simultaneously according to this application. Furthermore, those skilled in the art should also understand that the embodiments described in the specification are all optional embodiments, and the actions and modules involved are not necessarily essential to this application.

[0128] It should be further noted that although the steps in the flowchart are shown sequentially according to the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless explicitly stated herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least some steps in the flowchart may include multiple sub-steps or multiple stages. These sub-steps or stages are not necessarily completed at the same time, but can be executed at different times. The execution order of these sub-steps or stages is not necessarily sequential, but can be performed alternately or in turn with other steps or at least some of the sub-steps or stages of other steps.

[0129] It should be understood that the above-described device embodiments are merely illustrative, and the device of this application can also be implemented in other ways. For example, the division of units / modules in the above embodiments is only a logical functional division, and there may be other division methods in actual implementation. For example, multiple units, modules, or components may be combined, or integrated into another system, or some features may be ignored or not executed.

[0130] Furthermore, unless otherwise specified, the functional units / modules in the various embodiments of this application can be integrated into one unit / module, or each unit / module can exist physically separately, or two or more units / modules can be integrated together. The integrated units / modules described above can be implemented in hardware or as software program modules.

[0131] When integrated units / modules are implemented in hardware, the hardware can be digital circuits, analog circuits, etc. The physical implementation of the hardware structure includes, but is not limited to, transistors, memristors, etc. Unless otherwise specified, the processor can be any suitable hardware processor, such as a CPU, GPU, FPGA, DSP, and ASIC, etc. Unless otherwise specified, the storage unit can be any suitable magnetic or magneto-optical storage medium, such as Resistive Random Access Memory (RRAM), Dynamic Random Access Memory (DRAM), Static Random Access Memory (SRAM), Enhanced Dynamic Random Access Memory (EDRAM), High-Bandwidth Memory (HBM), Hybrid Memory Cube (HMC), etc.

[0132] If the integrated unit / module is implemented as a software program module and sold or used as an independent product, it can be stored in a computer-readable storage device (CMD). Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a memory and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods of the various embodiments of this application. The aforementioned memory includes various media capable of storing program code, such as a USB flash drive, read-only memory (ROM), random access memory (RAM), portable hard drive, magnetic disk, or optical disk.

[0133] In the above embodiments, the descriptions of each embodiment have their own emphasis. For parts not described in detail in a certain embodiment, please refer to the relevant descriptions of other embodiments. The technical features of the above embodiments can be combined arbitrarily. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as the combination of these technical features does not contradict each other, it should be considered within the scope of this specification.

[0134] Other embodiments of this application will readily occur to those skilled in the art upon consideration of the specification and practice of the invention disclosed herein. This application is intended to cover any variations, uses, or adaptations of this application that follow the general principles of this application and include common knowledge or customary techniques in the art not disclosed herein. The specification and examples are to be considered exemplary only, and the true scope and spirit of this application are indicated by the following claims.

[0135] It should be understood that this application is not limited to the precise structure described above and shown in the accompanying drawings, and various modifications and changes can be made without departing from its scope. The scope of this application is limited only by the appended claims.

Claims

1. An information security processing method, characterized in that, The method includes: Acquire real-time user action data and environmental data, wherein the environmental data includes the action time and location corresponding to the action data; Based on preset rules, as well as the operational behavior data and environmental data, behavioral intervention rules are generated; Based on the aforementioned behavior intervention rules, abnormal user behavior is processed and stored; the processing includes blocking and / or issuing warnings.

2. The method according to claim 1, characterized in that, The generation of behavioral intervention rules based on preset rules, operational behavior data, and environmental data specifically includes: Based on the aforementioned operational behavior data and environmental data, the user's operational behavior is determined; Based on preset rules, determine whether the operation is an illegal access; If the operation is an illegal access, then an access permission is set; the access permission is used to block the user's illegal access; wherein, the preset rules include the role corresponding to the user identifier.

3. The method according to claim 2, characterized in that, The method further includes: A watermark character is generated based on the user identifier, the operation behavior, and the operation time; A watermark view is generated based on the resolution of the terminal device and the watermark characters; The watermark view is overlaid onto the display interface of the terminal device so that the display interface carries the watermark view.

4. The method according to claim 1, characterized in that, The generation of behavioral intervention rules based on preset rules, operational behavior data, and environmental data specifically includes: Based on the operational behavior data and the environmental data, the user's operational behavior is determined; Based on preset rules, it is determined whether the operation is an abnormal operation; the abnormal operation includes at least one of: deleting a database, modifying a key configuration file, and accessing sensitive information; If the user's operation is abnormal, an interrupt command is generated to interrupt the operation.

5. The method according to claim 4, characterized in that, The process of determining the user's operational behavior based on the operational behavior data and the environmental data specifically includes: The operation behavior data and the environment data are matched using a regular expression algorithm to determine whether there is sensitive information in the operation behavior data and the environment data. The sensitive information includes identification codes, mobile phone numbers or sensitive words.

6. The method according to claim 1, characterized in that, The storage of abnormal user actions specifically includes: The user's interface is recorded in real time and the recording content is generated. The recording content includes the user's operation behavior on the interface. The screen recording content is converted into text records, and operation information is extracted from the text records. The operation information includes the operation behavior, the operation time corresponding to the operation behavior, the operation object, and the operation result. The operation information is structured to generate operation record data; the structured processing involves storing the operation information in a database.

7. The method according to claim 1, characterized in that, The generation of behavioral intervention rules based on preset rules, operational behavior data, and environmental data specifically includes: Based on the operational behavior data and the environmental data, the user's operational behavior is monitored; the operational behavior data includes the operation type, the operation object, and the operation time. Based on preset rules, determine whether the operation is illegal software installation or uninstallation of security software; If a user's action involves illegally installing or uninstalling security software, a warning instruction is generated; the warning instruction is used to report the user's action.

8. The method according to claim 1, characterized in that, The method further includes: Obtain the user's historical operation behavior data, which includes operation type, operation frequency, operation time, and operation object; Based on the historical operational behavior data and the scoring rules, a risk score for the user is obtained; If a user's risk score exceeds a preset threshold, the user will be listed as a person requiring close monitoring.

9. An information security processing device, characterized in that, include: The acquisition module is used to acquire real-time user operation behavior data and environmental data, wherein the environmental data includes the operation time and operation location corresponding to the operation behavior data; The generation module is used to generate behavioral intervention rules based on preset rules, as well as the operational behavior data and environmental data; The processing module is used to process and store abnormal user behavior based on the behavior intervention rules; the processing includes blocking and / or issuing warnings.

10. An electronic device, characterized in that, include: A processor, and a memory communicatively connected to the processor; The memory stores computer-executed instructions; The processor executes computer execution instructions stored in the memory to implement the method as described in any one of claims 1 to 8.

11. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer-executable instructions, which, when executed by a processor, are used to implement the method as described in any one of claims 1 to 8.

12. A computer program product, characterized in that, Includes a computer program that, when executed by a processor, implements the method of any one of claims 1 to 8.

Images