Data theft detection method and apparatus

Abstract

The present application belongs to the technical field of information security. Disclosed are a data theft detection method and apparatus. The method comprises: acquiring IO operation information of a plurality of IO requests, wherein the plurality of IO requests are IO requests for accessing a file system, and the IO operation information comprises operation information of an IO operation that is requested by each of the plurality of IO requests for execution; and on the basis of the IO operation information of the plurality of IO requests, detecting whether a target IO request is present among the plurality of IO requests, wherein the target IO request is an IO request for stealing data from the file system. In the method, a plurality of IO requests for accessing a file system are detected at one time, such that the purpose of using the relationship (or the degree of association) between the plurality of IO requests as reference information for detecting / identifying a data theft behavior can be achieved, thereby enhancing the capability of detecting data theft behaviors, improving the accuracy and reliability of detecting data theft behaviors, and reducing the false detection rate and the missed detection rate for when data theft behaviors are detected.

Description

Method and device for detecting data theft

[0001] The present application claims priority to the Chinese patent application No. 202411136673.X, filed on August 16, 2024, and entitled "Method and device for detecting data theft", the whole content of which is incorporated herein by reference. TECHNICAL FIELD

[0002] The present application relates to the field of information security technology, in particular to a method and device for detecting data theft. BACKGROUND

[0003] With the rapid development of the information age, data has become an important asset for enterprises and individuals. However, network security threats have also increased, especially the proliferation of malicious software and ransomware, which pose a significant threat to data security. For example, in recent years, in addition to being able to encrypt user data to extort users, ransomware can also steal user data through viruses and extort users by threatening to publish the data, which has caused huge economic and reputation losses to users. Therefore, in order to protect the safety of data assets, how to quickly detect data theft behavior has become a problem to be solved. SUMMARY

[0004] The present application provides a method and device for detecting data theft, which can quickly and accurately detect data theft behavior.

[0005] The technical solutions provided by the present application are as follows.

[0006] In a first aspect, the present application provides a method for detecting data theft, comprising: obtaining IO operation information of a plurality of input / output (IO) requests, and detecting whether there is a target IO request in the plurality of IO requests according to the IO operation information of the plurality of IO requests, the target IO request being an IO request for stealing data in a file system. Wherein, the plurality of IO requests are IO requests for accessing the file system, and the IO operation information includes operation information of an IO operation requested to be performed by each IO request in the plurality of IO requests.

[0007] The method provided in the application detects the IO operation information of a plurality of IO requests (denoted as a to-be-inspected unit) accessing a file system at a time, achieves the purpose of taking the relationship (or correlation) between the plurality of IO requests in the to-be-inspected unit as reference information for detecting data stealing behavior, thereby being capable of enhancing the capability of detecting data stealing behavior, improving the accuracy and reliability of detecting data stealing behavior, and reducing the false detection rate and the missed detection rate when detecting data stealing behavior. Moreover, when the clients initiating the IO requests in the to-be-inspected unit are all the same client, the IO requests indicated by the IO requests of the same client accessing the file system in a period of time have a correlation in time sequence, so the correlation between the plurality of IO requests in the to-be-inspected unit is closer, and when detecting whether there is an IO request for stealing data in the to-be-inspected unit according to the IO operation information of the IO requests included in the to-be-inspected unit, the accuracy and reliability are higher.

[0008] In a possible design, the detecting, according to the IO operation information of the plurality of IO requests, whether there is the target IO request in the plurality of IO requests includes: detecting, according to the IO operation information of the plurality of IO requests, whether there is the target IO request in the plurality of IO requests by using a detection model. The detection model includes a first network and a fourth network, the first network is configured to extract behavior features based on the IO operation information, and the fourth network is configured to infer whether there is the target IO request in the plurality of IO requests according to the behavior features. Through the possible design, the purpose of detecting the IO operation information of the IO requests included in the to-be-inspected unit by using a pre-trained detection model is achieved.

[0009] In another possible design, the IO operation information includes one or more of the following: an IO operation type of an IO operation requested to be performed by each IO request, an IO operation time, metadata of a file requested to be operated by each IO request, or performance information of a storage node storing data in a file system. Through the possible design, the IO operation information is more flexible when implementing the scheme of the application.

[0010] In yet another possible design, when there is at least one IO write request in the plurality of IO requests, the method further includes: obtaining file content requested to be written into the file system by each IO write request in the at least one IO write request. In this case, the detecting, according to the IO operation information of the plurality of IO requests, whether there is the target IO request in the plurality of IO requests includes: detecting, according to the IO operation information of the plurality of IO requests and the file content, whether there is the target IO request in the plurality of IO requests.

[0011] Through the possible design, the multiple IO requests of the client accessing the file system are taken as the detection unit, and whether the IO request for stealing data exists in the detection unit is detected according to the IO operation information of the IO request contained in the detection unit and the file content indicated by the IO request in the detection unit to write the file system. The possible design increases the reference analysis of the file content indicated by the IO request in the detection unit to write the file system when detecting the data stealing behavior, and therefore has stronger detection capability.

[0012] In another possible design, the detection of whether the target IO request exists in the multiple IO requests according to the IO operation information of the multiple IO requests and the file content includes: determining the behavior feature of the multiple IO requests according to the IO operation information, the behavior feature being used to represent the feature of the IO operation indicated by the multiple IO requests; determining the semantic feature according to the file content, the semantic feature being used to represent the semantics of the file content; fusing the behavior feature and the semantic feature to obtain the fused feature; and detecting whether the target IO request exists in the multiple IO requests according to the fused feature. In this way, the purpose of detecting whether the IO request for stealing data exists in the detection unit according to the IO operation information of the IO request contained in the detection unit and the file content indicated by the IO request in the detection unit to write the file system is achieved.

[0013] In another possible design, the detection of whether the target IO request exists in the multiple IO requests according to the IO operation information of the multiple IO requests and the file content includes: detecting whether the target IO request exists in the multiple IO requests through a detection model according to the IO operation information of the multiple IO requests and the file content. In this design, the detection model includes a first network, a second network, a third network, and a fourth network. The first network is used to extract the behavior feature based on the IO operation information, the second network is used to extract the semantic feature according to the file content, the third network is used to fuse the behavior feature and the semantic feature, and the fourth network is used to infer whether the target IO request exists in the multiple IO requests according to the fused feature. Through the possible design, the purpose of detecting the IO operation information of the IO request contained in the detection unit and the file content according to the pre-trained detection model is achieved.

[0014] In another possible design, the first network is an encoder network in a transformer model (a kind of deep learning model).

[0015] In another possible design, the second network is a language model.

[0016] In another possible design, the third network is a gating network.

[0017] In yet another possible design, the fourth network is a multi-layer perceptron (MLP) network.

[0018] With the above possible designs, the network structure of the detection model in the solution is a mature network structure and is easy to implement.

[0019] In yet another possible design, the determining the semantic feature according to the file content includes: determining suspicious file content in the file content, the suspicious file content having characteristics of a ransom note; performing word segmentation on the suspicious file content to obtain a word segmentation result of the suspicious file content; and learning the word segmentation result by using the second network to obtain the semantic feature.

[0020] With this possible design, compared with using the semantic feature of the entire file content for subsequent theft behavior detection, using the semantic feature of the suspicious file content determined in the file content for subsequent theft behavior detection can reduce the calculation amount of the second network in the detection model, thereby saving the computing power of the detection device.

[0021] In yet another possible design, the determining the suspicious file content in the file content includes: determining the suspicious file content in the file content according to metadata of a file to which the file content belongs; or determining the suspicious file content in the file content according to the file content and a knowledge base, the knowledge base being a knowledge base constructed based on keywords of a ransom note collected historically; or determining initial suspicious file content in the file content according to metadata of a file to which the file content belongs; and determining the suspicious file content in the initial suspicious file content according to the initial suspicious file content and the knowledge base. With this possible design, the purpose of determining the suspicious file content in the file content can be achieved in multiple ways, and flexibility is achieved.

[0022] In yet another possible design, in a case where the detection model is used to detect whether the target IO request exists in the plurality of IO requests, the method further includes: comparing the confidence threshold and the confidence output by the detection model to obtain a comparison result, the comparison result indicating whether the target IO request exists in the plurality of IO requests.

[0023] In yet another possible design, when the detection result indicates that the target IO request exists in the plurality of IO requests, the method further includes: determining the influence degree of the plurality of IO requests on the detection result, and determining the target IO request in the plurality of IO requests; and determining a file requested to be operated by the target IO request as the stolen file. With this possible design, the stolen data is determined at a file granularity.

[0024] In a further possible design, the determining the influence degree of the plurality of IO requests on the detection result includes determining the influence degree of each IO request on the detection result by using a gradient feature attribution method.

[0025] In a further possible design, the method further includes generating an attack report, the attack report including description information of the target IO request and metadata of the stolen file. The description information of the target IO request includes but is not limited to a client network address that initiates the target IO request, a receiving time of the target IO request, and an operation type of an IO operation requested by the target IO request, and the like. The metadata of the file (i.e., the stolen file) on which the target IO request requests to perform the IO operation includes but is not limited to a file name, a file suffix, a file size, and a file quantity, and the like.

[0026] Since the target IO request is the detected IO request for stealing data, the description information of the target IO request can be regarded as an attack pattern portrait of an attacker who steals data. The stolen file is an object of attack, and thus the metadata of the stolen file can be regarded as a portrait of the object of attack. Therefore, by the possible design, a detailed attack report including the portrait of the attacker and the portrait of the object of attack can be obtained. Based on the attack report, a user can take corresponding handling to protect data assets.

[0027] In a further possible design, the attack report further includes an alarm of a high-risk file, the high-risk file being a file in the file system whose semantic fingerprint has a fingerprint distance less than or equal to a threshold value from the semantic fingerprint of the stolen file, and the semantic fingerprint being used to identify the file.

[0028] In a further possible design, the attack report further includes an access control policy, the access control policy being used to indicate access control on the high-risk file.

[0029] By the above two possible designs, the high-risk file that has a risk of being stolen can be predicted, and thus by access control on the high-risk file, the safety of data of the file can be ensured.

[0030] In a further possible design, the plurality of IO requests access the file system based on a network attached storage (NAS) protocol.

[0031] In a second aspect, the present application provides a data theft detection apparatus. The detection apparatus is configured to perform any of the methods provided in the first aspect. The detection apparatus can be divided into functional modules according to any of the methods provided in the first aspect. For example, each functional module can be divided according to each function, or two or more functions can be integrated into one processing module. For example, the detection apparatus can be divided into an acquisition unit and a detection unit according to functions. The possible technical solutions and beneficial effects of each functional module are described above in the first aspect and any of the possible design manners in the first aspect, which will not be described here again.

[0032] In a third aspect, the present application provides a data theft detection apparatus. The detection apparatus includes a memory, a communication interface, and one or more processors. The one or more processors receive or send data through the communication interface, and the one or more processors are configured to read program instructions stored in the memory to perform the method provided in the first aspect and any of the possible design manners in the first aspect.

[0033] The detection apparatus in the second aspect or the third aspect may, for example, be a computing device that communicates with a file system layer of a file system and has computing processing capability, or a functional module in the computing device, or a chip that is configured to perform part or all of the operations in the method provided in any of the aspects and any of the possible designs. In one possible design, the detection apparatus is implemented as a management server / management device / management node / management module that is configured to manage a file system.

[0034] In a fourth aspect, the present application provides a computer-readable storage medium, which is a non-volatile computer-readable storage medium, and includes computer program instructions. When the computer program instructions are executed by a processor, the processor or a device including the processor performs the method provided in the first aspect and any of the possible design manners in the first aspect.

[0035] In a fifth aspect, the present application provides a computer program product including instructions, which, when executed by a processor, cause the processor or a device including the processor to perform the method provided in the first aspect and any of the possible design manners in the first aspect.

[0036] In a sixth aspect, the present application provides a chip, which comprises a processor for running program instructions or codes, and the chip or a device comprising the chip can be used to execute the method provided by the first aspect and any possible implementation manner of the first aspect. For example, the chip further comprises an input interface, an output interface, and a memory. The input interface, the output interface, the processor, and the memory of the chip are connected through an internal connection path of the chip. The memory in the chip is used to store program instructions or codes run by the processor. The input interface and the output interface of the chip are used for connection and communication between the chip and other chips or devices.

[0037] It can be understood that any of the above-provided data theft detection apparatuses, computer readable storage media, computer program products, or chips can be applied to the corresponding method provided above, and thus the beneficial effects that can be achieved can refer to the beneficial effects in the corresponding method, which will not be described here again.

[0038] In the present application, the names of the above data theft detection apparatuses do not constitute a limitation on the devices or functional modules themselves, and in actual implementation, these devices or functional modules can appear with other names. As long as the functions of each device or functional module are similar to those in the present application, they all belong to the protection scope of the present application. BRIEF DESCRIPTION OF DRAWINGS

[0039] FIG. 1a is a schematic diagram of an implementation environment of the method provided by the embodiments of the present application;

[0040] FIG. 1b is a schematic diagram of the deployment relationship between the file system layer of the file system and the storage system for storing data in the file system provided by the embodiments of the present application;

[0041] FIG. 2 is a schematic diagram of a process of training a detection model provided by the embodiments of the present application;

[0042] FIG. 3 is a schematic diagram of a data theft detection method provided by the embodiments of the present application;

[0043] FIG. 4 is a schematic diagram of a process in which a detection apparatus provided by the embodiments of the present application learns and infers the received embedding vector through a detection model and outputs a confidence score;

[0044] FIG. 5 is a schematic diagram of another data theft detection method provided by the embodiments of the present application;

[0045] FIG. 6 is a schematic diagram of a process of determining suspicious file content by using mode 3 and determining semantic features representing the semantic of the suspicious file content according to the suspicious file content provided by the embodiments of the present application;

[0046] FIG. 7 is a schematic diagram of a process of obtaining fused features and a confidence score provided by the embodiments of the present application;

[0047] FIG. 8 is a schematic diagram of a process for determining a target IO request and locating a stolen file in a unit under inspection according to an embodiment of the present application;

[0048] FIG. 9 is another schematic diagram of a process for detecting data theft according to an embodiment of the present application;

[0049] FIG. 10 is a schematic diagram of a data theft detection apparatus according to an embodiment of the present application;

[0050] FIG. 11 is a schematic diagram of a computing device according to an embodiment of the present application. DETAILED DESCRIPTION

[0051] To make the objectives, technical solutions, and advantages of the present application clearer, the following will further describe the embodiments of the present application in conjunction with the accompanying drawings.

[0052] To facilitate understanding, the following first explains the technologies and background involved in the embodiments of the present application.

[0053] 1) Stealing virus, ransom note

[0054] Traditional ransom viruses generally perform ransom by encrypting the files of victims, for example, requiring the victims to pay ransom to unlock the encrypted files. However, with the progress of anti-virus software and data backup technology, the ransom method of simply relying on encrypting files gradually loses threat. Thus, attackers begin to use another more covert and efficient ransom method, data theft, to threaten victims. The ransom method of data theft refers to that an attacker steals the confidential data of a victim and sends the confidential data to the server of the attacker, and then the attacker threatens to publish the data as a means to ransom the victim.

[0055] Among them, the attacker generally acquires the confidential data of the victim by propagating a stealing virus to the host of the victim. For example, after the attacker propagates a stealing virus to the host of the victim, the stealing virus runs on the host of the victim, and thus the running virus program performs a data stealing operation to steal the confidential data of the victim. Here, the data stealing operation generally includes the following steps: data screening and collection, file aggregation, and data sending. Among them, data screening and collection refers to screening files according to preset rules (for example, screening files according to file directories or screening files according to file types, etc.), thereby locating and reading confidential data. File aggregation refers to storing the stolen data / files in a preset directory after encoding, compressing, etc. Data sending refers to sending all the file data stored in the preset directory to the host or server of the attacker after reading.

[0056] It should be understood that in the scenario where an attacker uses a "data theft" ransom method to extort a victim for ransom, the attacker will usually generate a ransom note containing ransom information and payment requirements in the system where the victim stores the stolen data / files, so as to realize the threat of the victim. Among them, the ransom information is the threat information proposed by the attacker to the victim. For example, the ransom information is that the attacker claims to have obtained the victim's confidential information, such as account password, photo, video, etc., and threatens to disclose this information to demand the victim to pay ransom, and gives a specific amount of ransom, and gives a promise to not take threatening actions in exchange for the ransom. The payment requirement is the requirement of the attacker to the victim to pay the ransom. For example, the payment requirement includes the payment method (such as digital currency (or virtual currency) payment method) and the account (such as digital currency account) provided by the attacker to collect the ransom, and the like.

[0057] 2), Time-series model

[0058] The time-series model refers to a model used to analyze and predict time series data. Time series data is data collected at different times to describe the situation of a phenomenon changing over time. Such data reflects the changing state or degree of a thing or phenomenon over time.

[0059] Optionally, the time-series model is a deep learning model. For example, the time-series model is a machine learning model based on attention mechanism: transformer model.

[0060] 3), Self-attention mechanism, self-attention block

[0061] The self-attention mechanism is a special attention mechanism that allows the model to consider the relationship between each element in a sequence and all other elements when processing the sequence. This mechanism calculates the correlation (or weight) between each element in the sequence and other elements, which helps the model using the self-attention mechanism to better understand the context information in the sequence and more accurately process the sequence data.

[0062] That is, in the model using the self-attention mechanism, the model calculates the correlation between each element in the sequence and all other elements, which reflects the mutual relationship between the elements. For example, in a language model using the self-attention mechanism, the self-attention mechanism can reflect the semantic correlation between words.

[0063] Generally, the self-attention mechanism needs to be trained on a large amount of data to effectively establish accurate global relationships.

[0064] The self-attention block is a module or neural network structure used to implement the self-attention mechanism in a model using the self-attention mechanism. Thus, the self-attention block can capture the correlation between elements in the input sequence.

[0065] 4) Sparse self-attention mechanism

[0066] The sparse self-attention mechanism is a method for reducing computational complexity by sparse processing in the self-attention mechanism.

[0067] Among them, the sparse processing method is a technology that makes data more sparse by reducing the number of non-zero elements in the data set. The sparse processing method uses the sparse nature of data to remove irrelevant information and only keep the most meaningful part of the problem, which significantly reduces the dimensionality of the data and thus reduces the noise of the data. Therefore, by reducing the dimensionality of the data, the sparse processing method can improve the computational efficiency, speed up the data processing speed, and reduce the storage space occupation.

[0068] 5) Embedding vector

[0069] The embedding vector refers to a representation of high-dimensional data mapped to a low-dimensional vector space by embedding encoding. Among them, embedding encoding can also be understood as vectorization of data.

[0070] 6) MLP

[0071] MLP is a neural network model, usually composed of multiple fully connected layers, and used to map multiple input data sets to a single output data set.

[0072] 7) Gradient shapley additive explanations (gradient SHAP), self-attention map, and integrated gradients

[0073] Gradient SHAP, self-attention map, and integrated gradients are methods for explaining the prediction results of deep learning models, which generally explain the prediction results of the model by calculating the contribution of input features to the prediction results.

[0074] 8) Semantic fingerprint

[0075] The semantic fingerprint refers to a unique identifier generated by analyzing the content of a text to uniquely identify the text content, and is usually used for similarity detection of text.

[0076] 9), NAS

[0077] NAS is a storage system specially used for storing and sharing files. The NAS system is usually connected to a local area network (LAN) and provides efficient storage and data sharing services to users through network protocols. Therefore, the NAS system can play the role of a file server, so that multiple users can access the shared files stored on the NAS system through the network.

[0078] The NAS system supports various file protocols, such as the network file system (NFS) protocol, the server message block (SMB) protocol / common internet file system (CIFS) protocol, the file transfer protocol (FTP), etc., which can enable file sharing and access between different operating systems and devices.

[0079] Currently, on the one hand, due to the fact that stealing viruses usually use various code obfuscation methods and junk code to achieve the purpose, it increases the difficulty of killing stealing viruses for antivirus tools. Among them, code obfuscation is a technique that changes the form and structure of the code to make it more difficult to understand and reverse engineering. Junk code, also known as garbage code or dirty bytes, is a kind of garbage code inserted into the real code without affecting the program running, so as to affect the normal operation of the disassembler, and then interfere with the static analysis of the reverse analysis personnel, so as to increase the analysis difficulty and analysis time. On the other hand, the data stealing operation (or data stealing behavior) caused by the stealing virus is usually hidden in the IO operation of the victim host to process file data normally, and the data stealing behavior does not change the file, so the victim cannot discover the data stealing event in time after the data stealing event occurs, so it is difficult to evaluate the data loss situation, and it is difficult to respond quickly to deal with the data stealing event. Therefore, the data stealing behavior has the characteristics of strong concealment. On the other hand, the propagation mode of the stealing virus includes but is not limited to email, program Trojan, webpage horse, etc., and with the continuous change and development of the stealing virus, the number of variants of the stealing virus is constantly emerging, so the stealing virus has strong resistance, which brings great threat to the data assets of users.

[0080] Therefore, compared with encryption-based ransomware, data-stealing viruses that can steal data have stronger detectability, concealment and resistance. In order to effectively detect and defend against data-stealing behaviors caused by data-stealing viruses and ensure the safety of user data assets, the following related technologies can be used to protect against data-stealing viruses.

[0081] In a related technology, a protection software, a threat intelligence service and / or an automated alarm system are deployed on a host (denoted as a user host) of a user end to realize detection and alarm of data-stealing viruses. The protection software can be a protection software based on active learning artificial intelligence (AI) technology. The user host can detect a non-running virus program in the user host in real time through the protection software. The threat intelligence service is used to detect the features of a running program in the user host through a threat intelligence library, so as to determine whether there is a running virus program in the user host. The threat intelligence library includes information such as features and attack means of known threats. The automated alarm system is used to detect terminal logs (such as logs recorded by the terminal, including registry, file operation, etc.) through a model (such as a behavior tree model) to find traces left by data-stealing behaviors in the terminal logs, and to find data-stealing behaviors and alarm based on the detected traces. Compared with manually detecting and analyzing terminal logs to find threats and alarm, the automated alarm system can reduce the threat false alarm rate by 90%.

[0082] In another related technology, a detection model based on deep learning is deployed on a storage system for storing user data, which is trained based on IO access logs recorded by the storage system. Through the detection model, each IO access log recorded by the storage system can be detected to find abnormal IO access behaviors and alarm abnormal IO access behaviors.

[0083] In another related technology, a user and entity behavior analytics (UEBA) model is deployed on a storage system for storing user data or a network side connecting a user host to a network, and abnormal access behaviors for important data of a user are detected through the UEBA model, and an alarm is given and transmission of the important data of the user is blocked when the abnormal access behaviors for the important data of the user are detected. The UEBA model is trained based on access behaviors for pre-labeled important data of a user.

[0084] In another related technology, simulated confrontation drills are constantly initiated for a storage system for storing user data, so as to find and repair security vulnerabilities in the storage system, thereby improving the overall security of the storage system.

[0085] The above-mentioned related technologies can improve the protection ability against data stealing behavior to some extent, but the precision of detecting stealing virus is not high due to the strong concealment of the stealing virus, that is, the false detection rate and / or the missed detection rate of the above-mentioned related technologies is still high.

[0086] Therefore, the embodiments of the present application provide a method for detecting data stealing, which takes a plurality of IO requests for accessing a file system as a detection unit, and detects whether there is an IO request for stealing data in the plurality of IO requests according to IO data of the IO request contained in the detection unit. Optionally, the plurality of IO requests can be IO requests for accessing the file system initiated by a same client. In this way, by detecting a plurality of IO requests for accessing the file system at one time, the relationship (or the correlation degree) between the plurality of IO requests can be taken as reference information for detecting / recognizing data stealing behavior, so that the ability of detecting data stealing behavior can be enhanced, the accuracy and reliability of detecting data stealing behavior can be improved, and the false detection rate and the missed detection rate when detecting data stealing behavior can be reduced. The storage system for storing data of the file system is not limited in the embodiments of the present application. The storage system can be a block storage system based on a storage area network (SAN) or a NAS system.

[0087] Optionally, the plurality of IO requests for accessing the file system are IO requests for accessing the file system based on a NAS protocol.

[0088] Referring to FIG. 1a, FIG. 1a shows a schematic diagram of an implementation environment of the method provided by the embodiments of the present application. As shown in FIG. 1a, the implementation environment includes a file system and a plurality of clients for accessing the file system, such as client 1, …, client n, where n is an integer greater than 1. The storage system for storing data of the file system is not limited in the embodiments of the present application. The storage system can be a block storage system based on a SAN or a NAS system. Moreover, the storage architecture of the storage system is not limited in the embodiments of the present application. For example, the storage architecture can be a centralized storage architecture or a distributed storage architecture.

[0089] In the embodiments of the present application, the deployment position of the storage system for storing data of the file system is not limited.

[0090] In one example, the storage system for storing data of the file system is deployed in an enterprise intranet. In this case, by applying the method provided by the embodiments of the present application to the file system, real-time monitoring, detection and response to potential data stealing behavior of data in the file system in the enterprise intranet can be realized, so that the protection of key data assets of the enterprise can be realized.

[0091] In another example, the storage system for storing the file system data is a storage system of a storage service provider providing storage service to the outside. In this case, by applying the method provided by the embodiments of the present application to the file system, malicious attacks on tenant data of the storage service provider and data leakage events can be prevented, thereby improving the protection capability of the storage service provider for tenant data. The tenant refers to a user using the storage service provided by the storage service provider. In this example, when the method provided by the embodiments of the present application is applied to the file system of the storage service provider providing storage service to the outside, the data theft detection function implemented by the method provided by the embodiments of the present application can be attached to the storage product as a security detection function, thereby increasing the diversity and competitiveness of the storage product of the storage service provider.

[0092] In yet another example, the storage system for storing the file system data is a storage system deployed in a data center (DC) or a storage system of a service provider providing data hosting service. When the method provided by the embodiments of the present application is applied to the file system of the DC or the file system of the service provider providing data hosting service, the data theft protection can be efficiently and accurately implemented.

[0093] It should be understood that when the method provided by the embodiments of the present application is applied to the file system shown in FIG. 1a, the data theft behavior against the file system can be discovered in time and accurately based on the IO request of the client accessing the file system, so that the user can respond and handle the data theft behavior in time, thereby realizing the protection of the file system data.

[0094] It should be understood that the file system includes a file system layer, and the file system layer relates to the specific implementation of the file system. The file system layer includes operations such as organization, storage, and access control of files. The file system layer usually includes specific details such as naming rules of files, directory structure, and how to find a file through a path. The embodiments of the present application do not make specific limitations on the file system layer and the deployment relationship of the storage system for storing the data in the file system. Referring to FIG. 1b, FIG. 1b shows a schematic diagram of the deployment relationship of the file system layer of the file system and the storage system for storing the data in the file system.

[0095] As shown in (a) of FIG. 1b, the file system layer of the file system is located at the client, and the data in the file system is stored in the disk of the block storage system. At this time, the block storage system is, for example, a SAN-based storage system. In this implementation, the application program of the client communicates with the file system layer through the file system interface, and the communication belongs to the internal communication of the client. Moreover, the IO request sent by the application program in the client to the file system layer through the file system interface is the IO request of the client accessing the file system in the embodiments of the present application. In addition, the communication between the file system layer and the storage system can be realized through a network, which includes but is not limited to the user internal network, the Internet or the SAN network, etc.

[0096] As shown in (b) of FIG. 1b, the file system layer of the file system is located at the storage system, and the data in the file system is stored in the disk of the storage system. At this time, the storage system is, for example, a NAS system. In this implementation, the application program of the client communicates with the file system layer in the storage system through the file system interface, and the communication belongs to the network communication, which includes but is not limited to the user internal network communication or the Internet communication, etc. Moreover, the IO request sent by the application program in the client to the file system layer in the storage system through the file system interface is the IO request of the client accessing the file system in the embodiments of the present application.

[0097] It should be understood that the above is an exemplary description of the implementation environment of the method provided by the embodiments of the present application, and does not constitute a limitation on the implementation environment of the method. Those skilled in the art can know that the implementation environment can be adjusted according to the application requirements as the business requirements change, and the embodiments of the present application do not enumerate them one by one.

[0098] The embodiments of the present application also provide a detection device for data stealing, which is deployed at the file system layer of the file system and used to execute the detection method for stealing data provided by the embodiments of the present application.

[0099] Optionally, the detection device can be any computing device with data computing processing capability, or a functional module in the computing device, which is not limited. Exemplarily, the computing device can be a general-purpose computer, a notebook computer, a tablet computer, etc. Exemplarily, the computing device can be implemented as a management server / management device / management node / management module for managing the file system, which is not limited.

[0100] Optionally, in the embodiments of the present application, the detection model is pre-stored in the detection device, and the detection model is used to detect a plurality of IO requests accessing the file system at one time to determine whether the target IO request for stealing data exists in the plurality of IO requests.

[0101] The detection model includes a first network and a fourth network. In this case, for a plurality of IO requests to be detected, the first network is configured to extract behavior features of the plurality of IO requests according to IO operation information of the plurality of IO requests. The IO operation information of the plurality of IO requests includes operation information of an IO operation requested to be performed by each IO request in the plurality of IO requests, and the operation information includes one or more of an IO operation type of the IO operation, an IO operation time, metadata of an operation object of the IO operation, or performance information of a storage node of data in a storage file system, and the like. Here, for a file system, the operation object is generally a file, and therefore the metadata of the operation object includes but is not limited to a file name, a file suffix, a file size, a directory where the file is located, and the like. The performance information of the storage node of data in the storage file system is, for example, performance information such as a central processing unit (CPU) occupancy rate. The fourth network is configured to perform inference detection on the behavior features determined by the first network to determine whether there is a target IO request for stealing data in the plurality of IO requests to be detected.

[0102] Optionally, the detection model can further include a second network and a third network. In this way, when there is at least one IO write request in the plurality of IO requests to be detected, the second network can be configured to extract semantic features of file content requested to be written into a file system by the at least one IO write request according to the file content. The third network is configured to fuse the behavior features determined by the first network and the semantic features determined by the second network to obtain fused features. Further, the fourth network is configured to perform inference detection on the fused features to determine whether there is a target IO request for stealing data in the plurality of IO requests to be detected.

[0103] For example, the first network in the detection model is an encoder network in a transformer model, the second network is a language model, the third network is a gating network, and the fourth network is an MLP network.

[0104] The training process of the detection model preconfigured in the detection device according to the embodiments of the present application will be described below.

[0105] Taking the architecture of the detection model provided by the embodiments of the present application as an example, which includes a first network, a second network, a third network, and a fourth network, and referring to FIG. 2, FIG. 2 shows a process diagram for training the detection model according to the embodiments of the present application. Optionally, the process can be performed by the detection device provided by the embodiments of the present application, or by any other computing device with data computing and processing capability, which is not limited. For ease of description, the training of the detection model by the computing device will be described below. As shown in FIG. 2, the process includes the following steps 101-102.

[0106] Step 101, the computing device acquires training samples.

[0107] The training samples include IO data parsed from IO requests of the client accessing the file system when the stealing virus runs on the client, and include IO data parsed from IO requests of the client accessing the file system when the stealing virus does not run on the client. The IO data includes IO operation information of the IO requests, and the IO operation information of the IO requests includes operation information of an IO operation requested to be performed by the IO requests. The operation information includes one or more of the following: an IO operation type of the IO operation, an IO operation time, metadata of an operation object of the IO operation, performance information of a storage node storing data in the file system, and the like. Optionally, when there is an IO write request for indicating writing data to the file system in the IO requests used for parsing the IO data, the IO data further includes file content carried by the IO write request and indicating writing to the file system.

[0108] In one example, the embodiments of the present application record samples included in the training samples and obtained when the stealing virus runs on the client as positive samples, and record samples included in the training samples and obtained when the stealing virus does not run on the client as negative samples. In this case, the training samples include the positive samples and the negative samples, wherein the positive samples include IO data parsed from IO requests of the client accessing the file system when the stealing virus runs on the client, and the negative samples include IO data parsed from IO requests of the client accessing the file system when the stealing virus does not run on the client.

[0109] In the embodiments of the present application, each training sample includes IO data parsed from a plurality of IO requests of the client accessing the file system. For example, taking any one of the training samples, for example, a first sample, as an example, the first sample includes IO data parsed from a plurality of IO requests of the client accessing the file system. In the embodiments of the present application, the specific value of "plurality" is not limited, but in the following of the embodiments of the present application, "plurality" represents the same number each time it appears.

[0110] In addition, each training sample further includes a sample label. Taking the first sample as an example, in addition to the IO data parsed from the plurality of IO requests of the client accessing the file system, the first sample further includes a sample label. When the first sample is a positive sample, the sample label of the first sample is that the target IO request exists in the plurality of IO requests of the IO data in the first sample. When the first sample is a negative sample, the sample label of the first sample is that the target IO request does not exist in the plurality of IO requests of the IO data in the first sample. In other words, when the plurality of IO requests of the IO data in the first sample are IO requests of the client accessing the file system when the stealing virus is running, the sample label of the first sample is that the target IO request exists in the plurality of IO requests. When the plurality of IO requests of the IO data in the first sample are IO requests of the client accessing the file system when the stealing virus is not running, the sample label of the first sample is that the target IO request does not exist in the plurality of IO requests.

[0111] It should be noted that the client running or not running the stealing virus and using the IO request to access the file system can be the same client or different clients. Since there is no correlation between the IO operations indicated by the IO requests of different clients accessing the file system, there is a timing correlation between the IO operations indicated by the IO requests of the same client accessing the file system in a period of time. Therefore, the IO data in one training sample is optionally IO data parsed from the plurality of IO requests of the same client accessing the file system.

[0112] Specifically, the computing device obtains the training sample, including: the computing device obtains the training sample by recording the IO log when accessing the file system. Wherein, the IO log includes a plurality of IO requests of the client accessing the file system when the stealing virus is running, simulating the IO behavior of the user. In this case, by parsing the plurality of IO requests, the IO log can be recorded based on the parsing result, denoted as a first IO log. The IO log further includes a plurality of IO requests of the client accessing the file system when the stealing virus is not running, simulating the IO behavior of the user. In this case, by parsing the plurality of IO requests, the IO log recorded based on the parsing result is denoted as a second IO log. Here, the execution subject of recording the IO log is not limited by the embodiments of the present application. For example, in combination with FIG. 1b, if the file system layer of the file system is located at the client, the execution subject of recording the IO log is the client. If the file system layer of the file system is located at the storage system, the execution subject of recording the IO log is the storage system.

[0113] In one possible implementation, the computing device obtains the training sample by accessing the IO log recorded when accessing the file system, including: the computing device obtains a first IO log and a second IO log recorded when accessing the file system; the computing device extracts a first IO data set from the first IO log and a second IO data set from the second IO log, wherein the first IO data set includes IO data of a plurality of IO requests recorded in the first IO log, and the second IO data set includes IO data of a plurality of IO requests recorded in the second IO log; the computing device slices the first IO data set into a plurality of groups of IO data according to the operation time of each IO request in the first IO data set, thereby obtaining a plurality of positive samples, and the computing device slices the second IO data set into a plurality of groups of IO data according to the operation time of each IO request in the second IO data set, thereby obtaining a plurality of negative samples. One group of IO data contains IO data of a plurality of IO requests recorded in the IO log, and thus one group of IO data is one training sample.

[0114] In step 102, the computing device iteratively trains the detection model to be trained using the training sample to obtain a target detection model.

[0115] The target detection model is a detection model preloaded in the detection device described in the embodiments of the present application.

[0116] The detection model to be trained has a preset network structure, which includes a first network, a second network, a third network, and a fourth network. Taking any training sample in the training sample as an example, such as a first sample, the first network is configured to extract a behavior feature according to IO operation information contained in the IO data in the first sample, and the behavior feature is a feature of an IO operation indicated by a plurality of IO requests of the IO data in the first sample. The second network is configured to determine a semantic feature according to file content contained in the IO data in the first sample, and the file content is file content written into the file system indicated by an IO write request in the plurality of IO requests of the IO data in the first sample, and the semantic feature is a semantic feature of the file content. The third network is configured to fuse the behavior feature determined by the first network and the semantic feature determined by the second network, thereby obtaining a fused feature. The fourth network is configured to perform inference detection on the fused feature, thereby obtaining a detection result of the first sample. In this case, the network structure of the target detection model obtained by the computing device after iteratively training the detection model to be trained using the training sample also includes the first network, the second network, the third network, and the fourth network. For example, the first network is an encoder network in a transformer model, the second network is a language model, the third network is a gating network, and the fourth network is an MLP network.

[0117] It should be noted that when the preset network structure includes the first network and the fourth network, but does not include the second network and the third network. Still taking the first sample as an example, the first network is used to extract the behavior feature according to the IO operation information contained in the IO data in the first sample, and the behavior feature is the feature of the IO operation indicated by the plurality of IO requests of the IO data in the first sample. The fourth network is used to perform inference detection on the behavior feature determined by the first network, so as to obtain the detection result of the first sample. In this case, when the computing device obtains the training sample in step 101, the file content contained in the IO data in the training sample does not need to be obtained. Further, the network structure of the target detection model obtained by the computing device after iteratively training the detection model to be trained using the training sample in this case includes the first network and the fourth network, but does not include the second network and the third network.

[0118] Specifically, the computing device iteratively trains the detection model to be trained using the training sample to obtain the target detection model, including: the computing device inputs any training sample (such as the first sample) in the training sample into the initial detection model to be trained (denoted as the first detection model) to obtain the first detection result. The computing device calculates the loss according to the first detection result and the sample label of the first sample, and adjusts the network parameters of the first detection model according to the calculation result to obtain the second detection model to be trained. Then, the computing device inputs the second sample in the training sample into the second detection model to obtain the second detection result. Wherein, the second sample and the first sample can be the same training sample, or can be different training samples, which are not limited. Subsequently, the computing device calculates the loss according to the second calculation result and the sample label of the second sample, and adjusts the network parameters of the second detection model according to the calculation result to obtain the third detection model to be trained. In this way, the computing device iteratively trains the detection model to be trained for multiple times, and finally obtains the target detection model. In one example, the computing device determines the detection model obtained after adjusting the network parameters this time as the target detection model when it is determined that the number of iterations of iteratively training the detection model to be trained exceeds a threshold. In another example, the computing device determines the current detection model to be trained as the target detection model when it is determined that the loss calculated based on the detection result of the training sample detected by the current detection model to be trained and the sample label of the training sample is less than a threshold.

[0119] Wherein, in the process of iteratively training the detection model, the processing flow of the detection model to be trained for each training sample can refer to the description of step 202 or step 302 below, which will not be repeated here.

[0120] Optionally, in the process of iteratively training the detection model by the computing device, the computing device can acquire training samples while training the detection model. Of course, the computing device can also acquire all the training samples and then train the detection model using the training samples, which is not limited in the embodiments of the present application.

[0121] In this way, by steps 101-102, the computing device can train the detection model preset in the detection apparatus in the embodiments of the present application.

[0122] The implementation process of the data theft detection method provided in the embodiments of the present application is described below.

[0123] Referring to FIG. 3, FIG. 3 shows a flowchart of a data theft detection method according to an embodiment of the present application. Optionally, the method can be applied to the implementation environment shown in FIG. 1a and executed by the detection apparatus deployed in the file system layer of the file system. As shown in FIG. 3, the method includes steps 201-202 described below.

[0124] Step 201: The detection apparatus acquires IO operation information of a plurality of IO requests.

[0125] The plurality of IO requests are IO requests for accessing the file system. Optionally, the plurality of IO requests are IO requests for accessing the file system by a client with the same network address.

[0126] The IO operation information of the plurality of IO requests includes operation information of an IO operation requested to be performed by each IO request in the plurality of IO requests, and the operation information includes one or more of the following: an IO operation type of the IO operation, an IO operation time, metadata of an operation object of the IO operation, or performance information of a storage node storing the file system, etc. In the embodiments of the present application, the plurality of IO requests are regarded as a detection unit.

[0127] Specifically, the detection apparatus acquires the IO operation information of the plurality of IO requests, including: the detection apparatus acquires a plurality of log records from the IO log recorded when the client accesses the file system, and extracts the IO operation information from each log record in the plurality of log records, thereby obtaining the IO operation information of the plurality of IO requests; or the detection apparatus acquires a plurality of log records containing the same network address from the IO log recorded when the client accesses the file system, and extracts the IO operation information from each log record in the plurality of log records, thereby obtaining the IO operation information of the plurality of IO requests.

[0128] It can be understood that for each IO request of the client accessing the file system, there is a log record in the corresponding IO log. Therefore, the detection apparatus obtains a plurality of log records from the IO log, and extracts IO operation information from each log record in the plurality of log records. The extracted IO operation information is the IO operation information of each IO request in the plurality of IO requests for which the plurality of log records are obtained.

[0129] In addition, the plurality of log records obtained by the detection apparatus from the IO log and containing the same network address are obtained based on a plurality of IO requests of the same client accessing the file system represented by the same network address. Furthermore, the IO operation information extracted by the detection apparatus from each log record in the plurality of log records is the IO operation information of each IO request in the plurality of IO requests for which the plurality of log records are obtained.

[0130] In one example, when the storage system for storing data of the file system is deployed in an enterprise intranet, or the storage system is a storage system deployed in a DC, or a storage system deployed in a service provider providing data hosting services, the same client represented by the same network address can be any terminal host accessing the file system. This is because, in order to protect user data assets (such as enterprise data assets), it is necessary to detect each IO request of each client accessing the file system to determine whether the IO request is a target IO request for stealing enterprise data. Therefore, in this example, each record in the IO log records a plurality of log records, the detection apparatus obtains the plurality of log records, and extracts IO operation information from the plurality of log records, thereby obtaining the IO operation information of a unit to be detected. Alternatively, each record in the IO log records a plurality of log records containing the same network address, the detection apparatus obtains the plurality of log records containing the same network address, and extracts IO operation information from the plurality of log records containing the same network address, thereby obtaining the IO operation information of a unit to be detected.

[0131] In another example, when the storage system for storing data of the file system is a storage system provided by a storage service provider to provide storage services, the same client represented by the same network address refers to a client of a tenant of the storage service provider who chooses to use the scheme provided by the embodiments of the present application to protect data assets. Therefore, in this example, each record in the IO log records a plurality of log records containing the same specific network address, the detection apparatus obtains the plurality of log records containing the same specific network address, and extracts IO operation information from the plurality of log records containing the same specific network address, thereby obtaining the IO operation information of a unit to be detected. The same specific network address refers to the network address of a client of a specific tenant, and the specific tenant refers to a tenant of the storage service provider who chooses to use the scheme provided by the embodiments of the present application to protect data assets.

[0132] In step 202, the detection device detects, according to IO operation information of a plurality of IO requests, whether a target IO request for stealing data exists in the plurality of IO requests.

[0133] In step 202, the detection device detects, according to IO operation information of a plurality of IO requests, whether a target IO request for stealing data exists in the plurality of IO requests, which can also be understood as that the detection device detects, according to IO operation information of a to-be-detected unit, whether a target IO request exists in the to-be-detected unit.

[0134] Specifically, the detection device detects, according to IO operation information of a plurality of IO requests, whether a target IO request for stealing data exists in the plurality of IO requests, including: the detection device determines, according to the IO operation information of the plurality of IO requests, a behavior feature of the plurality of IO requests, the behavior feature being used to represent a feature of an IO operation indicated by the plurality of IO requests; and the detection device detects, according to the behavior feature, whether the target IO request exists in the plurality of IO requests.

[0135] For example, the detection device first performs embedding coding on the IO operation information of the plurality of IO requests, so as to obtain a plurality of embedding vectors used to represent IO operations indicated by the plurality of IO requests. Since the detection device can obtain an embedding vector with a preset length (or a preset dimension) after performing embedding coding on the IO operation information of an IO request, the plurality of embedding vectors are equivalent to a plurality of matrices with a number of rows and the preset length. For example, when the number of rows is 500 and the preset length (or the preset dimension) is 64, the detection device can obtain 500 embedding vectors with a length of 64 (or 64 dimensions) after performing embedding coding on the IO operation information of 500 IO requests, which is equivalent to a 500*64 matrix. Each embedding vector (i.e., a row of elements in the 500*64 matrix) in the 500 embedding vectors with a length of 64 is used to represent an IO operation indicated by an IO request.

[0136] In the process of embedding coding on the IO operation information, the IO operation information is actually vectorized. In one example, the process of embedding coding on the IO operation information of an IO request by the detection device includes: for any information in the IO operation information, such as an IO operation type, the detection device first maps the IO operation type to a preset value (or assigns the preset value) according to a preset strategy, and then maps the preset value to a multi-dimensional vector; and then, the detection device superimposes or splices the multi-dimensional vectors obtained by mapping each information in the IO operation information, so as to obtain an embedding vector representing an IO operation indicated by an IO request.

[0137] Then, the detection device inputs the obtained plurality of embedding vectors into a detection model pre-stored in the detection device, the detection model performs learning inference on the received embedding vectors, and outputs a confidence score for determining whether the target IO request exists in the plurality of IO requests.

[0138] In this embodiment, the detection model includes a first network and a fourth network. Therefore, after the detection device inputs the embedding vectors into the detection model, the detection model inputs the embedding vectors into the first network, learns the relationship between the elements in the embedding vectors through the first network, and outputs the behavior features through the first network, where the behavior features are the features of the IO operations indicated by the plurality of IO requests used to obtain the embedding vectors. Then, the detection model inputs the behavior features output by the first network into the fourth network, performs detection inference on the behavior features through the fourth network, and outputs a confidence score for determining whether the target IO request exists in the plurality of IO requests through the fourth network.

[0139] It should be understood that when the first network is an encoder network in a transformer model, the first network includes a plurality of sparse self-attention layers using a sparse self-attention mechanism. Thus, when the received embedding vectors are processed through the first network and the behavior features are obtained, each element in the embedding vectors can be quantitatively processed through the sparse self-attention layers in the first network, so that the sparse processing of the embedding vectors can be realized, thereby realizing the noise filtering and further enhancing the behavior features obtained after the first network learns the embedding vectors.

[0140] It should also be understood that for one unit to be detected, the detection model receives a plurality of embedding vectors, i.e., the number of embedding vectors input into the first network of the detection model is a plurality. In this way, the plurality of embedding vectors received by the first network in the detection model can be regarded as a plurality of matrices of a preset length. Therefore, after the first network learns the relationship between the elements in the matrix, the behavior features output by the first network are represented by a plurality of matrices of a preset length.

[0141] Alternatively, before the detection device inputs the embedding vectors into the detection model, the detection device can perform layer normalization processing on the embedding vectors, so as to improve the computational complexity of the detection model when learning and inferring the embedding vectors. In this embodiment, the process of the detection device performing layer normalization processing on the embedding vectors is not described in detail, and the normalization range when the detection device performs layer normalization processing on the embedding vectors is not limited. For example, the normalization range can be [0, 1] or [0, 100].

[0142] The following describes the process of the detection device learning and reasoning the received embedding vector through the detection model, and outputting the confidence for determining whether the target IO request exists in the plurality of IO requests, taking the first network as an encoder network in the transformer model and the fourth network as an MLP network as an example. Referring to FIG. 4, FIG. 4 shows a process diagram of the detection device learning and reasoning the received embedding vector through the detection model and outputting the confidence according to an embodiment of the present application.

[0143] As shown in (a) of FIG. 4, the detection device encodes the IO operation information of the to-be-detected unit to obtain an embedding vector for representing the IO operations indicated by the plurality of IO requests in the to-be-detected unit. The detection device performs layer normalization processing on the obtained embedding vector, and inputs the embedding vector after the layer normalization processing into the first network, learns the relationship between the elements in the received embedding vector through the first network, and outputs the behavior feature of the to-be-detected unit. It should be understood that the behavior feature of the to-be-detected unit is the feature of the IO operations indicated by the plurality of IO requests contained in the to-be-detected unit. The to-be-detected unit contains a plurality of IO requests, and the IO operation information of each IO request includes: the IO operation time, the IO operation type, the metadata of the operation file of the IO operation, and the performance information of the storage node storing the data in the storage file system requested by the IO request to perform the IO operation, and the metadata of the operation file includes the file name, the file suffix, the file size, and other metadata of the operation file. The first network includes M self-attention blocks, including self-attention block 1 to self-attention block M, and M is an integer greater than 1. Each self-attention block includes a sparse self-attention layer, an ADD&Norm layer, a position feedforward layer, and an ADD&Norm layer in sequence. Wherein, ADD represents residual connection, and Norm represents layer normalization.

[0144] As shown in (b) of FIG. 4, the detection model inputs the behavior feature of the to-be-detected unit output by the first network into the fourth network, such as an MLP network, detects the behavior feature through the fourth network, and outputs the confidence for indicating whether the target IO request exists in the to-be-detected unit.

[0145] Further, the detection device determines whether the target IO request exists in the to-be-detected unit according to the confidence output by the detection model.

[0146] Specifically, the detection apparatus determines whether the target IO request exists in the to-be-detected unit according to the confidence level output by the detection model, including: the detection apparatus compares the confidence level output by the detection model with the confidence threshold to obtain a comparison result, and the comparison result indicates whether the target IO request exists in the to-be-detected unit. For example, when the comparison result indicates that the confidence level output by the detection model is greater than the confidence threshold, it is determined that the target IO request exists in the to-be-detected unit. When the comparison result indicates that the confidence level output by the detection model is less than the confidence threshold, it is determined that the target IO request does not exist in the to-be-detected unit. The embodiments of the present application do not specifically limit the case where the comparison result indicates that the confidence level output by the detection model is equal to the confidence threshold, for example, in this case, the detection apparatus can determine that the target IO request exists in the to-be-detected unit, or determine that the target IO request does not exist in the to-be-detected unit.

[0147] It should be understood that the confidence threshold is preset in the detection apparatus. Alternatively, the confidence threshold preset in the detection apparatus is determined according to historical experience and remains unchanged. Alternatively, the detection apparatus can also dynamically adjust the confidence threshold during operation according to the confidence level of historical reasoning and the safety requirements of the user, and the comparison is not limited. For example, the detection apparatus can adjust the confidence threshold based on the confidence level of historical reasoning using the sigma rule or the empirical Bayesian method.

[0148] Through the method described in steps 201-202, the plurality of IO requests of the client accessing the file system as the to-be-detected unit is realized, and whether the IO request for stealing data exists in the to-be-detected unit is detected according to the behavior characteristics of the IO request contained in the to-be-detected unit. In this way, by detecting the plurality of IO requests accessing the file system once, the relationship between the plurality of IO requests can be used as reference information for detecting / recognizing data stealing behavior, thereby enhancing the ability to detect data stealing behavior, improving the accuracy and reliability of detecting data stealing behavior, and reducing the false detection rate and the missed detection rate when detecting data stealing behavior.

[0149] In addition, when the IO requests included in the to-be-detected unit are IO requests of the same client accessing the file system, the correlation between the plurality of IO requests in the to-be-detected unit is closer, and therefore, when detecting whether the IO request for stealing data exists in the to-be-detected unit according to the behavior characteristics of the IO request contained in the to-be-detected unit, the accuracy and reliability are higher.

[0150] In other embodiments, when the plurality of IO requests contained in the above to-be-detected unit includes at least one IO write request, in order to further improve the ability to detect data stealing behavior, the semantic analysis and detection of the ransomware can be considered to be increased when detecting data stealing behavior based on the behavior characteristics of the plurality of IO requests. In this way, by covering more stealing characteristics, the detection capability of the detection apparatus for data stealing behavior can be enhanced.

[0151] Referring to FIG. 5, FIG. 5 shows a flowchart of another method for detecting data stealing provided by the embodiments of the present application. Optionally, the method can be applied to the implementation environment shown in FIG. la, and is executed by the detection apparatus deployed at the file system layer of the file system. As shown in FIG. 5, the method comprises the following steps 301-302.

[0152] In step 301, the detection apparatus acquires IO operation information of a plurality of IO requests, and acquires file content indicated by each IO write request in the plurality of IO requests to be written into the file system.

[0153] Optionally, the plurality of IO requests are IO requests of a client with the same network address accessing the file system.

[0154] The detailed description of the detection apparatus acquiring the IO operation information of the plurality of IO requests can refer to the description of step 201, which is not repeated here.

[0155] In the embodiment, the plurality of IO requests of the unit to be detected include at least one IO write request, the IO write request is used to indicate writing file content into the file system, and the file content is generally carried by the IO write request. Therefore, the detection apparatus further acquires the file content indicated by each IO write request in the at least one IO write request to be written into the file system.

[0156] Optionally, when the IO log records the file content carried by the IO write request and indicated to be written into the file system. In this case, the detection apparatus can acquire the file content carried by each IO write request in the at least one IO write request and indicated to be written into the file system from the IO log.

[0157] Optionally, when the IO log records the storage address and / or file path of the file content carried by the IO write request and indicated to be written into the file system in the file system. In this case, the detection apparatus can acquire the storage address and / or file path of the file content carried by each IO write request in the at least one IO write request and indicated to be written into the file system in the file system from the IO log, and read the file content requested by each IO write request to be written into the file system from the acquired storage address and / or file path.

[0158] In step 302, the detection apparatus detects whether there is a target IO request for stealing data in the plurality of IO requests according to the IO operation information of the plurality of IO requests and the file content indicated by each IO write request in the plurality of IO requests to be written into the file system.

[0159] For convenience of description, the "file content requested by an IO request to be written into the file system" is denoted as "file content of the IO request" hereinafter.

[0160] Specifically, the detection apparatus detects whether there is a target IO request for stealing data in the plurality of IO requests according to the IO operation information of the plurality of IO requests and the file content indicated by each IO write request in the plurality of IO requests, including: the detection apparatus determines the behavior feature of the plurality of IO requests according to the IO operation information of the plurality of IO requests, the behavior feature being used to represent the characteristics of the IO operations indicated by the plurality of IO requests; the detection apparatus determines the semantic feature according to the file content indicated by each IO write request in the plurality of IO requests, the semantic feature being used to represent the semantics of the file content; the detection apparatus fuses the behavior feature and the semantic feature to obtain a fused feature; and the detection apparatus detects whether there is a target IO request in the plurality of IO requests according to the fused feature.

[0161] For example, the detection apparatus can perform embedding coding on the IO operation information of the plurality of IO requests contained in the unit to be detected, so as to obtain a plurality of embedding vectors used to represent the IO operations indicated by the plurality of IO requests. The detailed description of this process can be referred to the related description of step 202, which will not be repeated here.

[0162] Optionally, the detection apparatus performs text segmentation on the file content of each IO write request to obtain a first segmentation result. Wherein, when the detection apparatus performs text segmentation on the file content of each IO write request, the text segmentation algorithm used by the detection apparatus is not limited in the embodiments of the present application.

[0163] Further, the detection apparatus inputs the obtained embedding vectors and the first segmentation result into the detection model, and the detection model performs learning inference on the received embedding vectors and the first segmentation result, and outputs a confidence degree used to determine whether there is a target IO request in the unit to be detected. In the embodiment described in FIG. 5, the detection model includes a first network, a second network, a third network and a fourth network. Specifically, the detection apparatus inputs the embedding vectors obtained based on the unit to be detected into the first network in the detection model, processes through the first network and outputs a behavior feature, which is used to represent the characteristics of the IO operations indicated by the plurality of IO requests contained in the unit to be detected. The detailed description of this process can be referred to the related description of step 202. The detection apparatus inputs the first segmentation result into the second network of the detection model, learns the semantic feature of the first segmentation result through the second network, and outputs the semantic feature through the second network, which is used to represent the semantics of the file content of each IO write request in the unit to be detected.

[0164] In the embodiments of the present application, the semantic feature output by the second network can be represented as a sequence, and the length of the sequence is also the preset length described above. Moreover, the number of the semantic features output by the second network is at least one, and one semantic feature is used to represent the file content of one IO write request in the unit to be detected.

[0165] Optionally, the detection device can determine suspicious file content in the file content of each IO write request obtained, and then perform text segmentation on the suspicious file content to obtain a second segmentation result (or referred to as a segmentation result of the suspicious file content). The suspicious file content refers to file content with ransomware characteristics. The ransomware characteristics include keywords in common ransomware file names, common ransomware file suffixes, and keywords with high frequency in ransomware, etc. In addition, when the detection device performs text segmentation on the suspicious file content, the text segmentation algorithm used by the detection device is not limited in the embodiments of the present application.

[0166] Further, the detection device inputs the embedding vector obtained based on the unit under test and the second segmentation result into the detection model. The detection model performs learning inference on the received embedding vector and the second segmentation result, and outputs a confidence degree for determining whether the target IO request exists in the unit under test. Specifically, the detection device inputs the obtained embedding vector into the first network of the detection model, processes it through the first network, and outputs a behavior feature. The behavior feature is used to represent the characteristics of the IO operations indicated by the plurality of IO requests contained in the unit under test. The detailed description of this process can be referred to the related description of step 202, and will not be repeated. The detection device inputs the second segmentation result into the second network of the detection model, learns the semantics of the second segmentation result through the second network, and outputs a semantic feature representing the semantics of the second segmentation result through the second network. That is, the semantic feature is used to represent the semantics of the suspicious file content.

[0167] It should be noted that when the detection device first determines the suspicious file content in the file content of each IO write request in the unit under test, and then learns the semantic feature of the suspicious file content through the second network, so as to obtain the semantic feature representing the semantics of the suspicious file content, and uses the semantic feature for subsequent theft detection inference, this way reduces the calculation amount of the second network in the detection model compared with using the semantic feature representing the semantics of the file content of each IO write request in the unit under test for subsequent theft detection inference, thereby saving the computing power of the detection device.

[0168] The process of determining the suspicious file content in the file content of each IO write request obtained by the detection device can be implemented in the following three ways.

[0169] Method 1: The detection device determines the suspicious file content in the file content of each IO write request according to the metadata of the file to which the file content belongs.

[0170] The metadata of the file includes but is not limited to the file name, the file suffix, the file size, the directory where the file is located, and the like.

[0171] In this mode, the detection device is preset with a first knowledge base, which includes metadata of historically collected ransom notes, such as keywords in file names of historically collected ransom notes, file suffixes, and the like. Exemplarily, the keywords in file names of historically collected ransom notes are, for example, “Attention!”, “attention!”, and the like, and the file suffixes are, for example, “.txt”, “.html”, “.lha”, “.lzh”, and the like.

[0172] In this case, the detection device acquires metadata of a file to which the file content of each IO write request belongs, and queries the first knowledge base according to the acquired metadata, so as to determine the file content including the knowledge in the first knowledge base in the metadata as suspicious file content.

[0173] Mode 2, the detection device determines suspicious file content in the file content of each IO write request according to the file content of each IO write request and a knowledge base (referred to as a second knowledge base).

[0174] In this mode, the detection device is preset with a second knowledge base, which is a knowledge base constructed based on keywords of historically collected ransom notes. The keywords of the ransom notes include words with high occurrence frequency in historically collected ransom notes, or words with characteristics of ransom notes. The words with characteristics of ransom notes refer to words that generally only appear in ransom notes and do not appear in ordinary files. For example, ransom notes generally require payment of digital currency, so words such as digital currency payment appear in ransom notes.

[0175] In this case, the detection device performs word segmentation on the file content of each IO write request to obtain a word segmentation result of the file content of each IO write request. The detection device queries the second knowledge base according to the word segmentation result of the file content of each IO write request to determine suspicious file content. Here, the word segmentation result of the suspicious file content includes the keywords of the ransom notes recorded in the second knowledge base. At this time, the word segmentation result of the suspicious file content is the second word segmentation result.

[0176] Mode 3, the detection device determines initial suspicious file content in the file content of each IO write request according to metadata of a file to which the file content of each IO write request belongs, and determines suspicious file content in the initial suspicious file content according to the initial suspicious file content and a knowledge base (i.e., the second knowledge base).

[0177] In this mode, the detection device is pre-stored with the first knowledge base and the second knowledge base. The first knowledge base is described in the first mode, and the second knowledge base is described in the second mode, which will not be repeated. Alternatively, the first knowledge base and the second knowledge base can be implemented as one knowledge base. Alternatively, the first knowledge base and the second knowledge base can be implemented as two independent knowledge bases, which are not limited.

[0178] In this case, the detection device can first determine the initial suspicious file content in each IO write request file content through the process described in the first mode, and then determine the suspicious file content in the initial suspicious file content through the process described in the second mode, which will not be repeated.

[0179] As can be seen, in the third mode, the detection device needs to query the first knowledge base and then query the second knowledge base. When the first knowledge base and the second knowledge base are implemented as one knowledge base, the size of the knowledge base is greater than the size of the first knowledge base and greater than the size of the second knowledge base. Therefore, compared with the implementation mode that the first knowledge base and the second knowledge base are implemented as one knowledge base, when the first knowledge base and the second knowledge base are implemented as two independent knowledge bases, the efficiency of the detection device querying the first knowledge base and the second knowledge base can be improved, and the efficiency of the detection device detecting data stealing behavior can be improved.

[0180] Referring to FIG. 6, FIG. 6 shows a process diagram for determining suspicious file content by the third mode and determining semantic features representing the semantics of the suspicious file content according to the embodiments of the present application. As shown in FIG. 6, file content 1 to file content 4 are four IO write request file contents contained in the to-be-detected unit and indicated to be written to the file system. After the detection device obtains the file content 1 to file content 4, the detection device determines the initial suspicious file content in the file content 1 to file content 4 through the first mode, and then determines the suspicious file content in the initial suspicious file content through the second mode. Then, the detection device inputs the word segmentation result of the suspicious file content into the second network, so as to obtain the semantic features representing the semantics of the suspicious file content. When the detection device determines the initial suspicious file content in the file content 1 to file content 4 through the first mode, the first knowledge base constructed based on the historical ransom notes needs to be used. When the detection device determines the suspicious file content in the initial suspicious file content through the second mode, the second knowledge base constructed based on the historical ransom notes needs to be used.

[0181] Subsequently, the detection model inputs the behavior features output by the first network and the semantic features output by the second network into the third network, and fuses the behavior features and the semantic features through the third network, so as to obtain the fusion features, and outputs the fusion features through the third network.

[0182] It should be noted that the behavior features output by the first network are represented by a plurality of matrices of a preset length, and the semantic features output by the second network have a preset length, but the number is necessarily less than the number of IO requests included in the to-be-detected unit (i.e., "a plurality of"), and one semantic feature is used to represent the file content of one IO write request in the to-be-detected unit. Therefore, the detection model sets the semantic features of the IO requests in the to-be-detected unit for which the semantic features have not been extracted to semantic features with a value of 0, so that the semantic features input into the third network are also represented by a plurality of matrices of a preset length.

[0183] Optionally, the detection model performs weighted fusion on the behavior features output by the first network and the semantic features output by the second network through the third network to obtain fused features, and outputs the fused features through the third network. For example, the third network is a gating network, in which case the detection model performs adaptive weighted fusion on the behavior features output by the first network and the semantic features output by the second network through the gating network to obtain the fused features, and outputs the fused features through the gating network.

[0184] Then, the detection model inputs the fused features output by the third network into the fourth network, performs inference detection on the fused features through the fourth network, and outputs a confidence for determining whether the target IO request exists in the to-be-detected unit through the fourth network.

[0185] Taking the third network as a gating network and the fourth network as an MLP network as an example, reference is made to FIG. 7, which shows a process diagram for obtaining fused features and a confidence according to an embodiment of the present application.

[0186] As shown in FIG. 7, in the feature sequence fusion layer based on the gating network in the detection model, the detection model inputs the behavior features output by the first network and the semantic features output by the second network into the gating network, and adaptively determines the weight of the behavior features through a sigmoid function (a kind of activation function) in the gating network, denoted as weight 1, and adaptively determines the weight of the semantic features, denoted as weight 2. Then, the gating network performs weighted summation on the behavior features and the semantic features based on the weight 1 of the behavior features and the weight 2 of the semantic features, thereby obtaining the fused features.

[0187] Continuing to refer to FIG. 7, in the data stealing behavior detection layer based on the MLP network in the detection model, the detection model inputs the fused features into the MLP network, performs inference detection on the fused features through the MLP network, and outputs a confidence for determining whether the target IO request exists in the to-be-detected unit.

[0188] Further, the detection device determines whether the target IO request exists in the plurality of IO requests included in the to-be-detected unit according to the confidence output by the detection model. The detailed description of this process can be referred to the related description of step 202, which will not be repeated here.

[0189] Thus, by the method described in FIG. 5, the plurality of IO requests of the client accessing the file system are taken as the detection unit, and according to the behavior characteristics of the IO requests contained in the detection unit and the semantic characteristics of the IO requests in the detection unit indicating the content of the file written in the file system, it is detected whether there is an IO request for stealing data in the detection unit. Compared with the method shown in FIG. 3 of the embodiment of the present application, the method shown in FIG. 5 of the embodiment of the present application increases the reference analysis of the file content semantic characteristics when detecting the data stealing behavior, so the detection capability is stronger.

[0190] In still some embodiments, after the detection device detects that there is a target IO request for stealing data in the detection unit, the detection device further determines the target IO request and locates the stolen file in the detection unit, so that the user can deal with the data stealing behavior.

[0191] Referring to FIG. 8, FIG. 8 shows a process diagram for determining the target IO request and locating the stolen file in the detection unit provided by the embodiment of the present application. Optionally, the method can be applied to the implementation environment shown in FIG. 1a, and is executed by the detection device deployed in the file system layer of the file system. As shown in FIG. 8, after the detection device executes steps 201-202, or after executing steps 301-302, it further executes steps 401-404 as follows.

[0192] Step 401, the detection device determines the influence degree of each IO request contained in the detection unit on the detection result, and determines the target IO request in the detection unit according to the influence degree.

[0193] For example, the detection device determines the influence degree of each IO request contained in the detection unit on the confidence output by the detection model, and determines the target IO request in the detection unit according to the influence degree.

[0194] Optionally, the detection device can use gradient-based feature attribution technology to determine the influence degree of each IO request contained in the detection unit on the confidence output by the detection model, and determine the target IO request in the detection unit according to the influence degree. As an example, the gradient-based feature attribution technology includes but is not limited to self-attention map, integrated gradients or gradient SHAP.

[0195] In one example, the detection device is pre-stored with an explanation model implemented by using the gradient-based feature attribution technology, which is trained along with the detection model described above. Based on this, after the detection device detects that there is a target IO request in the unit under test through the detection model, the detection device inputs the IO data of multiple IO requests contained in the unit under test into the explanation model, so as to obtain the influence degree (or contribution degree) of each IO request in the unit under test on the confidence output by the detection model. Further, the detection device sorts the influence degrees from large to small, and determines the IO requests in the top k of the sorted influence degrees as the target IO requests, or the detection device determines the IO requests with the influence degrees greater than a threshold as the target IO requests. Here, k is a positive integer.

[0196] It can be seen that the number of target IO requests in the unit under test is at least one.

[0197] Step 402, the detection device determines the file requested to be operated by the target IO request as the stolen file.

[0198] It can be seen that the granularity of the stolen data determined in the embodiment of the present application is file granularity.

[0199] Step 403, the detection device collects the description information of the target IO request and the metadata of the stolen file.

[0200] For example, the description information of the target IO request includes but is not limited to the client network address initiating the target IO request, the receiving time of the target IO request, the operation type of the IO operation requested by the target IO request, etc. These information can be extracted from the log records recorded after analyzing the target IO request.

[0201] For another example, the metadata of the file requested to be operated by the target IO request (i.e. the stolen file) includes but is not limited to the file name, the file suffix, the file size, the file quantity, etc.

[0202] Step 404, the detection device generates an attack report according to the description information of the target IO request and the metadata of the stolen file.

[0203] It should be understood that since the target IO request is the IO request for stealing data detected by the detection device, the description information of the target IO request can be regarded as the attack pattern portrait of the attacker stealing data. And the stolen file is the object of attack, so the metadata of the stolen file can be regarded as the portrait of the object of attack.

[0204] Therefore, based on the collected description information of the target IO request and the metadata of the stolen file, the detection device can generate an attack report including the attack pattern portrait and the portrait of the object of attack.

[0205] Optionally, the detection device outputs an attack report and issues an alarm to the user. In response, the user receives the alarm and handles the discovered data theft behavior according to the attack report, for example, blocking the outgoing of the stolen file.

[0206] Optionally, the attack report generated by the detection device can also include an alarm of high-risk files to remind the user to increase security protection for the high-risk files. The high-risk files are files that are likely to be stolen later, which are discovered by the detection device based on the discovered data theft behavior. In this case, as shown in FIG. 8, the detection device further performs step 404a before performing step 404.

[0207] Step 404a, the detection device determines the fingerprint distance between the semantic fingerprint of the stolen file and the semantic fingerprints of other files in the file system, and determines the high-risk files based on the fingerprint distance.

[0208] The semantic fingerprint is used to identify a file. In this embodiment, the semantic fingerprint of each file is calculated in advance based on the metadata of each file in the file system.

[0209] In this way, after the detection device determines the stolen file, the fingerprint distance between the semantic fingerprint of the stolen file and the semantic fingerprints of other files in the file system is compared, and the files in the file system whose semantic fingerprint distance with the semantic fingerprint of the stolen file is less than or equal to the threshold value are determined as high-risk files. That is, the high-risk files are the files in the file system whose semantic fingerprint distance with the semantic fingerprint of the stolen file is less than or equal to the threshold value. In this way, the high-risk files are the files with high similarity to the stolen file. Since the high-risk files have high similarity to the stolen file, they are likely to be targeted for theft by attackers later.

[0210] Of course, if the stolen file is a new file indicated by the IO request in the unit to be detected, after the detection device determines the stolen file, the semantic fingerprint of the stolen file is calculated based on the file metadata of the stolen file, and then the detection device compares the semantic fingerprint of the stolen file with the semantic fingerprints of other files in the file system, and determines the files in the file system whose semantic fingerprint distance with the semantic fingerprint of the stolen file is less than or equal to the threshold value as high-risk files.

[0211] Optionally, the attack report generated by the detection device further includes an access control policy, and the access control policy is used to indicate access control of the high-risk file. The detection device can formulate the access control policy for the high-risk file according to the description information of the target IO request. For example, the time when the file system receives the target IO request is non-working time, that is, the time when the target IO request accesses the file system is non-working time, and the detection device formulates the access control policy for the high-risk file as: the client initiating the target IO request is prohibited from accessing the high-risk file in non-working time. It can be seen that, compared with the related art which limits the access to the file system in the granularity of network address or client, the embodiment of the present application realizes more fine-grained (that is, file-grained) access control of the high-risk file in the file system.

[0212] At this point, through steps 401-404, after the detection device accurately detects that there is an IO request for stealing data in the to-be-detected unit through the detection model, the detection device can also accurately identify the IO request for stealing data from the to-be-detected unit, identify the stolen file, and discover the high-risk file based on the stolen file. Thus, the detection device can output an attack report including an attack pattern portrait, an attacked object portrait, a high-risk file alarm, and an access control policy of the high-risk file. In this way, the detailed attack report can help users to take measures to deal with data stealing behavior in a timely manner, thereby reducing the risk of data assets. In addition, the embodiment of the present application can improve the efficiency and effect of the overall security protection of the file system by automatically detecting data stealing behavior and generating a detailed attack report.

[0213] To further understand the method provided by the embodiment of the present application, the method described in the embodiment of the present application will be further described by the flow shown in FIG. 9. Referring to FIG. 9, FIG. 9 shows another flowchart of the data stealing detection method provided by the embodiment of the present application. As shown in FIG. 9, in the process of the client accessing the file system, for the to-be-detected unit of a plurality of IO requests for accessing the file system, the detection device first extracts the behavior features of the to-be-detected unit and extracts the semantic features of the to-be-detected unit. Then, the detection device fuses the extracted behavior features and semantic features to obtain fused features, and detects the fused features to determine whether there is a target IO request for stealing data in the to-be-detected unit. This process is described in steps 301-302 above and will not be described again. Subsequently, when the detection device determines that there is a target IO request in the to-be-detected unit, it performs attack tracing and generates an attack report (for a description of steps 401-404), and outputs the attack report and a data stealing alarm to the user. The attack tracing refers to the process of obtaining an attack pattern portrait and an attacked object portrait. The attack pattern portrait and the attacked object portrait are described in detail in step 404 and will not be described again.

[0214] It can be understood that the method described above can also be applied to the field of communication to ensure the security of communication data. For example, in a mobile communication network or a wireless fidelity (Wi-Fi) network, the method described in the embodiments of the present application is used to extract the transmission characteristics (corresponding to the behavior characteristics of the IO request) of a plurality of communication messages (corresponding to the to-be-inspected unit) and identify the content characteristics (corresponding to the semantic characteristics of the file content of the IO request) of the communication data transmitted by the communication messages in the to-be-inspected unit, so as to detect potential malicious behaviors in the to-be-inspected unit according to the transmission characteristics and the content characteristics of the to-be-inspected unit. The mobile communication network is, for example, a 5th generation mobile communication technology (5G) network. The communication message can be a communication message between a base station and a user terminal in a mobile communication network, or a communication message between an access point device and a terminal device in a Wi-Fi network, and the like, which is not limited. The malicious behavior is, for example, a ransom behavior or a data stealing behavior, and the like, which is not limited.

[0215] The above mainly introduces the scheme provided by the embodiments of the present application from the perspective of the method.

[0216] In order to realize the above functions, as shown in FIG. 10, FIG. 10 shows a structural schematic diagram of a data stealing detection device provided by the embodiments of the present application. The data stealing detection device 1000 is used to execute the data stealing detection method described above, for example, to execute the method shown in FIG. 3, FIG. 5 or FIG. 8. The data stealing detection device 1000 can include an acquisition unit 1001 and a detection unit 1002.

[0217] The acquisition unit 1001 is configured to acquire a plurality of requested IO operation information. The plurality of IO requests are IO requests for accessing a file system, and the IO operation information includes operation information of an IO operation requested to be executed by each IO request in the plurality of IO requests. The detection unit 1002 is configured to detect whether a target IO request exists in the plurality of IO requests according to the IO operation information of the plurality of IO requests, and the target IO request is an IO request for stealing data in the file system.

[0218] As an example, in combination with FIG. 3, the acquisition unit 1001 can be configured to execute step 201, and the detection unit 1002 can be configured to execute step 202.

[0219] Optionally, the detection unit 1002 is specifically configured to detect, according to the IO operation information of the plurality of IO requests, whether the target IO request exists in the plurality of IO requests by using a detection model. The detection model includes a first network and a fourth network. The first network is configured to extract behavior features based on the IO operation information. The fourth network is configured to infer, according to the behavior features, whether the target IO request exists in the plurality of IO requests.

[0220] Optionally, the IO operation information includes one or more of the following: an IO operation type of an IO operation requested to be performed by each IO request, an IO operation time, metadata of a file requested to be operated by each IO request, or performance information of a storage node storing data in a file system.

[0221] Optionally, when at least one IO write request exists in the plurality of IO requests, the obtaining unit 1001 is further configured to obtain file content requested to be written into the file system by each IO write request in the at least one IO write request. The detection unit 1002 is further specifically configured to detect, according to the IO operation information of the plurality of IO requests and the file content, whether the target IO request exists in the plurality of IO requests.

[0222] As an example, in combination with FIG. 5, the obtaining unit 1001 can be configured to perform step 301, and the detection unit 1002 can be configured to perform step 302.

[0223] Optionally, the data stealing detection apparatus 1000 further includes a determination unit 1003. The determination unit 1003 is configured to determine, according to the IO operation information, behavior features of the plurality of IO requests, the behavior features being used to represent characteristics of IO operations indicated by the plurality of IO requests; determine, according to the file content, semantic features, the semantic features being used to represent semantics of the file content; and fuse the behavior features and the semantic features to obtain fused features. The detection unit 1002 is specifically configured to detect, according to the fused features, whether the target IO request exists in the plurality of IO requests.

[0224] Optionally, the detection unit 1002 is specifically configured to detect, according to the IO operation information of the plurality of IO requests and the file content, whether the target IO request exists in the plurality of IO requests by using a detection model. In this implementation, the detection model includes a first network, a second network, a third network, and a fourth network. The first network is configured to extract behavior features based on the IO operation information. The second network is configured to extract semantic features according to the file content. The third network is configured to fuse the behavior features and the semantic features. The fourth network is configured to infer, according to the fused features, whether the target IO request exists in the plurality of IO requests.

[0225] Optionally, the first network is an encoder network in a transformer model.

[0226] Optionally, the second network is a language model.

[0227] Optionally, the third network is a gating network.

[0228] Optionally, the fourth network is an MLP network.

[0229] Optionally, the determining unit 1003 is specifically configured to: determine suspicious file content in the file content, the suspicious file content having characteristics of a ransom note; perform word segmentation on the suspicious file content to obtain a word segmentation result of the suspicious file content; and learn the word segmentation result through the second network to obtain semantic features.

[0230] Optionally, the determining unit 1003 is specifically configured to: determine suspicious file content in the file content according to metadata of a file to which the file content belongs; or determine suspicious file content in the file content according to the file content and a knowledge base, the knowledge base being a knowledge base constructed based on keywords of historical ransom notes; or determine initial suspicious file content in the file content according to metadata of a file to which the file content belongs; and determine suspicious file content in the initial suspicious file content according to the initial suspicious file content and the knowledge base.

[0231] Optionally, in a case where the target IO request is detected through the detection model, the determining unit 1003 is further configured to compare the confidence threshold and the confidence output by the detection model to obtain a comparison result, the comparison result indicating whether the target IO request exists in the plurality of IO requests.

[0232] Optionally, when the detection result indicates that the target IO request exists in the plurality of IO requests, the determining unit 1003 is further configured to: determine a degree of influence of the plurality of IO requests on the detection result, and determine the target IO request in the plurality of IO requests; and determine a file requested by the target IO request as the stolen file.

[0233] As an example, in combination with FIG. 8, the determining unit 1003 can be configured to perform steps 401 and 402.

[0234] Optionally, the determining unit 1003 is specifically configured to determine the degree of influence of each IO request on the detection result in a gradient class attribution manner.

[0235] Optionally, the determining unit 1003 is further configured to generate an attack report, the attack report including description information of the target IO request and metadata of the stolen file.

[0236] As an example, in combination with FIG. 8, the determining unit 1003 can be configured to perform step 404.

[0237] Optionally, the attack report further includes an alarm of a high-risk file, the high-risk file being a file in a file system, a semantic fingerprint of which has a fingerprint distance less than or equal to a threshold value from a semantic fingerprint of the stolen file, the semantic fingerprint being used to identify the file.

[0238] Optionally, the attack report further comprises an access control policy, the access control policy being used to indicate access control of the high-risk file.

[0239] Optionally, the plurality of IO requests access the file system based on a NAS protocol.

[0240] For a specific description of the optional mode, refer to the foregoing method embodiments, which will not be described here again. In addition, the foregoing explanation and beneficial effect description of any one of the data theft detection apparatuses 1000 provided above can refer to the corresponding method embodiments described above, which will not be described here again.

[0241] As an example, in combination with FIG. 11 described below, the function implemented by the acquisition unit 1001 in the data theft detection apparatus 1000 can be implemented by the communication interface 1103 shown in FIG. 11. The functions implemented by the detection unit 1002 and the determination unit 1003 in the data theft detection apparatus 1000 can be implemented by the processor 1101 in FIG. 11 executing the program code in the memory 1102 in FIG. 11.

[0242] Those skilled in the art should easily understand that, in combination with the units and algorithm steps of the examples described in combination with the embodiments disclosed herein, the functions implemented by the embodiments of the present application can be implemented in the form of hardware or a combination of hardware and computer software. Whether a certain function is implemented in the form of hardware or computer software driving hardware depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of the present application.

[0243] It should be noted that the division of the modules / units in FIG. 10 is schematic, and is merely a logical function division. In actual implementation, another division manner can be used. For example, two or more functions can be integrated in one processing module. The integrated module can be implemented in the form of hardware or in the form of a software function module.

[0244] The embodiments of the present application provide a computing device, and the computing device or a function module in the computing device is used to implement part or all of the functions in the data theft detection method provided by the embodiments of the present application.

[0245] FIG. 11 is a structural schematic diagram of a computing device provided by an embodiment of the present application. As shown in FIG. 11, the computing device 1100 includes a processor 1101, a memory 1102, a communication interface 1103 and a bus 1104. The processor 1101, the memory 1102 and the communication interface 1103 are in communication connection with each other through the bus 1104.

[0246] The processor 1101 can include a general-purpose processor and / or a special-purpose hardware chip. The general-purpose processor can include a CPU, a microprocessor, or a graphics processing unit (GPU). The CPU is, for example, a single-CPU, and is, for example, a multi-CPU. The special-purpose hardware chip is a hardware module with high processing performance. The special-purpose hardware chip includes at least one of a digital signal processor (DSP), a data processing unit (DPU), an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA), other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, a neural processing unit (NPU), a tensor processing unit (TPU), an artificial intelligent chip, or a network processor (NP). The processor 1101 can also be an integrated circuit chip with processing capability of signals. In the implementation process, part or all of the functions of the method provided by the embodiments of the present application can be completed by integrated logic circuits or software forms of instructions in the processor 1101.

[0247] The memory 1102 is configured to store computer programs, including an operating system 1102a and executable code (i.e., program instructions) 1102b. The memory 1102 is, for example, a read-only memory (ROM), a programmable ROM (PROM), an erasable PROM (EPROM), an electrically EPROM (EEPROM), a flash memory, or another type of static storage device that can store static information and instructions, or is, for example, a static RAM (SRAM), a dynamic random access memory (DRAM), a synchronous DRAM (SDRAM), a double data rate SDRAM (DDR SDRAM), an enhanced SDRAM (ESDRAM), a synchlink DRAM (SLDRAM), or another type of dynamic storage device that can store information and instructions, or is, for example, a read-only optical disc or another optical disc storage, an optical disc storage (including a compact disc, a laser disc, an optical disc, a digital versatile disc, a Blu-ray disc, etc.), a magnetic disk storage medium or another magnetic storage device, or is any other medium that can be used to carry or store desired executable codes in the form of instructions or data structures and can be accessed by a computer, but is not limited to this. For example, the memory 1102 is configured to store an IO log and the like. The memory 1102 is, for example, independent and connected to the processor 1101 through the bus 1104. Alternatively, the memory 1102 and the processor 1101 are integrated together. The memory 1102 can store executable codes, and when the executable codes stored in the memory 1102 are executed by the processor 1101, the processor 1101 is configured to perform part or all of the functions of the data theft detection method provided in the embodiments of the present application. For implementation of the processor 1101 to execute the process, please refer to the related description in the foregoing embodiments. The memory 1102 can also include software modules and data required by other running processes such as an operating system.

[0248] The communication interface 1103 uses a transceiving module such as, but not limited to, a transceiver to implement communication with other devices or communication networks. For example, the communication interface 1103 can be any one or any combination of the following devices: a communication interface (such as an Ethernet interface), a wireless network card, and the like, which has a network access function. Among them, the communication interface 1103 includes a receiving unit for receiving data / packets, and a sending unit for sending data / packets.

[0249] The bus 1104 is any type of communication bus for interconnecting internal devices (e.g., the memory 1102, the processor 1101, the communication interface 1103) of the computing device 1100. For example, a system bus. The embodiments of the present application take the above-mentioned devices inside the computing device 1100 as an example to illustrate that the above-mentioned devices inside the computing device 1100 are interconnected by the bus 1104. Alternatively, the above-mentioned devices inside the computing device 1100 can also be connected in communication with each other in other ways in addition to the bus 1104, for example, the above-mentioned devices inside the computing device 1100 are interconnected by internal logical interfaces.

[0250] It should be noted that the above-mentioned devices can be respectively arranged on chips independent of each other, or at least partially or entirely arranged on the same chip. Whether to arrange each device independently on different chips or to integrate on one or more chips often depends on the needs of product design. The embodiments of the present application do not limit the specific implementation form of the above-mentioned devices. And the description of the corresponding flow of each of the above-mentioned figures has its own emphasis, and the part not described in detail in a certain flow can be referred to the related description of other flows.

[0251] In the above embodiments, all or part can be realized by software, hardware, firmware or any combination thereof. When realized by software, all or part can be realized in the form of a computer program product. The computer program product providing a program development platform includes one or more computer instructions, which, when loaded and executed on the computing device 1100, realize all or part of the functions of the data theft detection method provided by the embodiments of the present application.

[0252] Moreover, the computer instructions can be stored in a computer readable storage medium or transmitted from one computer readable storage medium to another, for example, the computer instructions can be transmitted from one website, computer, server or data center to another website, computer, server or data center through wired (such as coaxial cable, optical fiber, digital subscriber line) or wireless (such as infrared, wireless, microwave, etc.) mode. The computer readable storage medium stores computer program instructions providing a program development platform.

[0253] The embodiment of the present application further provides a computer readable storage medium, which is a nonvolatile computer readable storage medium, and the computer readable storage medium comprises computer program instructions. When the computer program instructions are executed by a processor or a computing device comprising the processor, a computer system, or the processor, the computing device, the computer system, or the processor executes the data theft detection method provided by the embodiment of the present application.

[0254] The embodiment of the present application further provides a computer program product comprising instructions, which, when executed by a processor or a computing device comprising the processor, a computer system, cause the computing device, the computer system, or the processor to implement the data theft detection method provided by the embodiment of the present application.

[0255] The computer system is a system with computing processing capability. The computer system generally comprises a processor and a memory. The processor is configured to call and execute instructions stored in the memory, so that the computer system implements the data theft detection method described above. Optionally, the computer system can further comprise at least one of an input interface or an output interface. The processor, the memory, the input interface, and the output interface of the computer system are connected through internal connection paths.

[0256] Those skilled in the art can understand that all or part of the steps of the above-mentioned embodiments can be completed by hardware, or by a program instructing related hardware to complete. The program can be stored in a computer readable storage medium. The storage medium mentioned above can be a read-only memory, a magnetic disk or an optical disk.

[0257] It should be noted that the information (including but not limited to user device information, user personal information, etc.), data (including but not limited to data for analysis, stored data, displayed data, etc.), and signals involved in the present application are all authorized by the user or fully authorized by all parties, and the collection, use, and processing of related data need to comply with relevant laws, regulations, and standards of relevant countries and regions.

[0258] The embodiment of the present application further provides a chip comprising a processor for executing program instructions or codes. The chip or a device comprising the chip can be used to execute the data theft detection method provided by the embodiment of the present application. Illustratively, the chip further comprises an input interface, an output interface, and a memory. The input interface, the output interface, the processor, and the memory of the chip are connected through internal connection paths of the chip. The memory in the chip is configured to store program instructions or codes executed by the processor. The input interface and the output interface of the chip are configured to connect and communicate with other chips or devices.

[0259] In the embodiments of the present application, the terms "first", "second" and "third" are only used for descriptive purpose and cannot be understood as indicating or implying relative importance. The term "at least one" refers to one or more, and the term "multiple" refers to at least two, unless otherwise explicitly limited.

[0260] In the present application, the term "and / or", merely describes the association relationship of the associated objects, which means that there can be three relationships, for example, A and / or B, which can represent the three cases of A existing alone, A and B existing together, and B existing alone. In addition, the character " / " in this paper generally represents that the front and rear associated objects are a "or" relationship.

[0261] It should be understood that the terms used in the description of various described examples herein are only for the purpose of describing specific examples and are not intended to be limiting. As used in the description of various described examples and the appended claims, the singular forms "a", "an", and "the" are intended to include the plural forms as well, unless the context clearly indicates otherwise.

[0262] It should be understood that determining B according to A does not mean that B is determined only according to A, but B can also be determined according to A and / or other information.

[0263] It should be understood that the term "comprise" (also referred to as "includes", "including", "comprises" and / or "comprising") when used in the specification specifies the presence of the stated features, integers, steps, operations, elements, and / or components, but does not exclude the presence or addition of one or more other features, integers, steps, operations, elements, components, and / or groups thereof.

[0264] It should also be understood that in various embodiments of the present application, the magnitude of the sequence number of each process does not mean the order of execution, and the execution order of each process should be determined according to its function and inherent logic, and should not constitute any limitation on the implementation process of the embodiments of the present application.

[0265] The above is only an optional embodiment of the present application and does not limit the present application. Any modification, equivalent replacement, improvement, etc. made within the concept and principles of the present application shall be included in the protection scope of the present application.

[0266] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present application, and not to limit them; although the present application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that they can still modify the technical solutions recorded in the foregoing embodiments, or make equivalent replacements for some technical features; and these modifications or replacements do not make the essence of the corresponding technical solutions deviate from the protection scope of the technical solutions of the embodiments of the present application.

Claims

1. A method of detecting data theft, the method comprising: The method comprises: obtaining IO operation information of a plurality of input / output (IO) requests, the plurality of IO requests being IO requests for accessing a file system, the IO operation information comprising operation information of an IO operation requested to be performed by each of the plurality of IO requests; detecting, according to the IO operation information of the plurality of IO requests, whether a target IO request exists in the plurality of IO requests, the target IO request being an IO request for stealing data in the file system.

2. The method of claim 1, wherein, When at least one IO write request exists in the plurality of IO requests, the method further comprises: obtaining file content requested to be written by each of the at least one IO write request in the file system; the detecting, according to the IO operation information of the plurality of IO requests, whether the target IO request exists in the plurality of IO requests comprises: detecting, according to the IO operation information of the plurality of IO requests and the file content, whether the target IO request exists in the plurality of IO requests.

3. The method of claim 2, wherein, The detecting, according to the IO operation information of the plurality of IO requests and the file content, whether the target IO request exists in the plurality of IO requests comprises: determining a behavior feature of the plurality of IO requests according to the IO operation information, the behavior feature being used to represent a feature of an IO operation indicated by the plurality of IO requests; determining a semantic feature according to the file content, the semantic feature being used to represent a semantic of the file content; fusing the behavior feature and the semantic feature to obtain a fused feature; detecting, according to the fused feature, whether the target IO request exists in the plurality of IO requests.

4. The method of claim 3, wherein, The detecting, according to the IO operation information of the plurality of IO requests and the file content, whether the target IO request exists in the plurality of IO requests comprises: detecting, according to the IO operation information of the plurality of IO requests and the file content, whether the target IO request exists in the plurality of IO requests by a detection model; wherein the detection model comprises a first network, a second network, a third network and a fourth network, the first network is used to extract the behavior feature based on the IO operation information, the second network is used to extract the semantic feature according to the file content, the third network is used to fuse the behavior feature and the semantic feature, and the fourth network is used to infer, according to the fused feature, whether the target IO request exists in the plurality of IO requests.

5. The method of claim 3 or 4, wherein, The determining a semantic feature according to the file content comprises: determining suspicious file content in the file content, the suspicious file content having a feature of a ransom note; performing word segmentation on the suspicious file content to obtain a word segmentation result of the suspicious file content; learning the word segmentation result by a second network to obtain the semantic feature.

6. The method of claim 5, wherein, The determining suspicious file content in the file content comprises: determining the suspicious file content in the file content according to metadata of a file to which the file content belongs; or, determine the suspicious file content in the file content according to the file content and a knowledge base, the knowledge base being a knowledge base constructed based on keywords of ransom notes collected historically; or determine initial suspicious file content in the file content according to metadata of a file to which the file content belongs; and determine the suspicious file content in the initial suspicious file content according to the initial suspicious file content and the knowledge base.

7. The method of any one of claims 1 to 6, wherein, When the detection result indicates that the target IO request exists in the plurality of IO requests, the method further comprises: determining the target IO request in the plurality of IO requests according to an influence degree of the plurality of IO requests on the detection result; determining a file requested to be operated by the target IO request as a stolen file.

8. The method of any one of claims 1 to 7, wherein, The IO operation information comprises one or more of the following: an IO operation type of an IO operation requested to be performed by each IO request, an IO operation time, metadata of a file requested to be operated by each IO request, or performance information of a storage node storing data in the file system.

9. The method of any one of claims 1 to 8, wherein, The plurality of IO requests access the file system based on a network attached storage (NAS) protocol.

10. A data theft detection apparatus, characterized by, The apparatus comprises: an obtaining unit configured to obtain IO operation information of a plurality of input / output (IO) requests, the plurality of IO requests being IO requests for accessing a file system, the IO operation information comprising operation information of an IO operation requested to be performed by each IO request in the plurality of IO requests; a detecting unit configured to detect, according to the IO operation information of the plurality of IO requests, whether a target IO request exists in the plurality of IO requests, the target IO request being an IO request for stealing data in the file system.

11. The apparatus of claim 10, wherein, When at least one IO write request exists in the plurality of IO requests, the obtaining unit is further configured to obtain file content requested to be written by each IO write request in the at least one IO write request into the file system; the detecting unit is specifically configured to detect, according to the IO operation information of the plurality of IO requests and the file content, whether the target IO request exists in the plurality of IO requests.

12. The apparatus of claim 11, wherein, The apparatus comprises: a determining unit configured to determine a behavior feature of the plurality of IO requests according to the IO operation information, the behavior feature being used to represent a feature of an IO operation indicated by the plurality of IO requests; determine a semantic feature according to the file content, the semantic feature being used to represent a semantic of the file content; and fuse the behavior feature and the semantic feature to obtain a fused feature; the detecting unit is specifically configured to detect, according to the fused feature, whether the target IO request exists in the plurality of IO requests.

13. The apparatus of claim 12, wherein the detecting unit is specifically configured to detect, according to the IO operation information of the plurality of IO requests and the file content, whether the target IO request exists in the plurality of IO requests by using a detection model. The detection model comprises a first network, a second network, a third network, and a fourth network. The first network is configured to extract the behavior feature based on the IO operation information. The second network is configured to extract the semantic feature based on the file content. The third network is configured to fuse the behavior feature and the semantic feature. The fourth network is configured to infer whether the target IO request exists in the plurality of IO requests based on the fused feature.

14. The apparatus of claim 12 or 13, wherein, The determination unit is specifically configured to: determine suspicious file content in the file content, the suspicious file content having characteristics of a ransom note; perform word segmentation on the suspicious file content to obtain a word segmentation result of the suspicious file content; learn the word segmentation result by the second network to obtain the semantic feature.

15. The apparatus of claim 14, wherein, The determination unit is specifically configured to: determine the suspicious file content in the file content according to metadata of a file to which the file content belongs; or determine the suspicious file content in the file content according to the file content and a knowledge base, the knowledge base being a knowledge base constructed based on keywords of a ransom note collected historically; or determine initial suspicious file content in the file content according to metadata of a file to which the file content belongs; and determine the suspicious file content in the initial suspicious file content according to the initial suspicious file content and the knowledge base. The apparatus further comprises a determination unit, 16. The apparatus of any one of claims 10 to 15, wherein, when the detection result indicates that the target IO request exists in the plurality of IO requests, the determination unit is configured to determine the target IO request in the plurality of IO requests according to an influence degree of the plurality of IO requests on the detection result; and determine a file requested to be operated by the target IO request as a stolen file. The IO operation information comprises one or more of the following: an IO operation type of an IO operation requested to be performed by each IO request, an IO operation time, metadata of a file requested to be operated by each IO request, or performance information of a storage node storing data in the file system. The plurality of IO requests access the file system based on a network-attached storage (NAS) protocol.

17. The apparatus of any one of claims 10 to 16, wherein, The apparatus comprises a memory, a communication interface, and one or more processors. The one or more processors receive or send data through the communication interface. The one or more processors are configured to read program instructions stored in the memory to perform the method of any one of claims 1 to 9.

18. The apparatus of any one of claims 10 to 17, wherein, When the instructions are executed by a processor, the processor or a device comprising the processor performs the method of any one of claims 1 to 9.

19. A data theft detection apparatus, comprising: The computer program instructions, when executed by a processor, cause the processor or a device comprising the processor to perform the method of any one of claims 1 to 9.

20. A computer program product comprising instructions, characterized in that, ​ 21. A computer-readable storage medium, characterized in that, ​

Images