File Leak Detection via Path and Fingerprint Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing file leak detection methods rely on specified keywords, which can lead to missed detections if the keyword range is too narrow or false alarms if it's too wide, affecting the accuracy of identifying protected files.
Innovation Solution
A method that acquires file operation events, extracts file paths, searches for file content to obtain fingerprints, and determines if files belong to specified libraries using both path and fingerprint, reducing miss detection and false detection by using a two-dimensional approach.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Device complexity
If keyword-based detection is used, then the detection process is simple, but the accuracy of file leak detection deteriorates due to missed detections or false alarms
Solution Approach 1:
The patent transitions from one-dimensional keyword matching to two-dimensional verification by introducing file path as an additional dimension. The detection mechanism now checks both the file path (to identify protected files) and the file content fingerprint (to verify actual file identity), thereby improving detection accuracy while maintaining reasonable complexity through structured verification
2Reliability
If the keyword range is expanded to reduce missed detections, then more files are covered, but false alarms increase
Solution Approach 1:
The patent introduces file path as an intermediary verification layer between the detection system and file content. By first checking if the file path matches protected file patterns and then verifying the file fingerprint, the system achieves comprehensive coverage without false alarms from unrelated files containing similar keywords
3Measurement precision
If the keyword range is narrowed to reduce false alarms, then detection precision improves, but missed detections increase
Solution Approach 1:
By adding the file path dimension to the detection process, the system can maintain narrow, precise keyword matching for file content while using the path dimension to ensure comprehensive coverage of protected files, thereby eliminating the trade-off between precision and coverage
4Productivity
If only file path is used for identification, then the detection process is fast, but accuracy deteriorates when files are copied or moved
Solution Approach 1:
The patent merges file path-based identification with file content fingerprint verification into a unified detection mechanism. The system first uses file path for quick identification of protected files, then combines this with fingerprint matching to verify the actual file identity, ensuring both speed and accuracy even when files are copied or moved to different locations
Data Source
AI summary
Provided are a file leak detection method. The method includes: acquiring a file operation event on a terminal device, wherein the file operation event is an event in which a specified operation is executed on a target file; extracting, from the file operation event, a file path of the target file involved in the file operation event; searching for file content of the target file according to the file path, and performing mapping processing on the file content of the target file, so as to obtain a file fingerprint of the target file; determining, according to the file path and the file fingerprint, whether the target file belongs to a specified file library which is used for dynamically maintaining a service file that needs to be protected; and if the target file belongs to the specified file library, determining that a file in the specified file library is leaking.