CN104199900A - Audit and analysis method based on file trajectory tracking trees - Google Patents

Abstract

The invention belongs to the field of electronic file security control, and provides an audit and analysis method based on file trajectory tracking trees. Millions of pieces of file tag information are dynamically stored in a database of an electronic file security control system, and an efficient and reliable tag information audit and analysis technique needs to be developed to meet the requirement for audit and analysis of electronic files under the circumstances of large data volume, dynamic updating and multi-dimensional circulation. The file trajectory tracking trees are located between a database layer and an audit and analysis layer, a data storage structure body in the form of a file trajectory spreading tree graph is formed through certain association, partition and recombination of data after the tag information is extracted from an updating database table, the peak of each tree represents a file builder, child nodes of each tree represent the spreading range of the corresponding file, and branches of each tree represent the spreading trajectory of the corresponding file. Next, the audit and analysis layer directly operates the file trajectory tracking trees, so that the calculated quantity is reduced.

Description

Based on the audit analysis method of file trajectory track tree

Technical field

Audit analysis method based on file trajectory track tree belongs to safety of electronic file management and control field.

Background technology

For ease of the circulation process of observation and audit certain file and wave file thereof, the data structure body method for expressing of a kind of " file trajectory track tree " by name is proposed, simplify the workload of audit analysis.File trajectory track tree is after the database table from upgrade extracts information needed, through certain data correlation, division and restructuring, formation has the data store organisation body of file track propagation tree graph pattern, the summit representation file founder of each " tree ", its child node is the spread scope of representation file, and " branch " represents propagation trajectories.

One of Core Feature of safety of electronic file managing and control system is to carry out the circulation track of trace files by file is added to label information real-time update label information, operation each circulation node audit user to file, comprises that file is in local editing mode, circulation state between user, at interdepartmental range of scatter etc.

In the database of safety of electronic file managing and control system, dynamic memory the file label information of counting in necessarily, and due to the needs of Document Editing and circulation, every strip label information is the state in not stopping to upgrade all.Traditional data base querying and auditing method can solve retrieval and the analysis of " static state " data in a large number, but under the application model of native system, so " dynamically " label information of frequent updating will become a major challenge of accurate tracking and complete audit.Therefore the label information audit analysis technology that needs to work out a kind of high efficient and reliable meeting big data quantity, dynamically update, e-file audit needs in multidimensional circulation situation.

Propose the data structure body method for expressing of a kind of by name " file trajectory track tree " for the demand, simplify the workload of audit analysis with this.Tree is between database layer and audit analysis layer file trajectory track, after the database table from upgrade extracts label information, through certain data correlation, division and restructuring, formation has the data store organisation body of file track propagation tree graph pattern, the summit representation file founder of each " tree ", its child node is the spread scope of representation file, and " branch " represents propagation trajectories.Audit analysis layer directly operates file trajectory track tree subsequently, has reduced calculated amount.

Summary of the invention

A kind of tree construction (claiming file trajectory track tree) that represents file propagation track for observing, is characterized in that: tree interior nodes structure comprises the statistics of the operation behavior of the wave file of each file recipient to this file and generation thereof; Tree interior nodes structure comprises the correlation attribute information of the wave file being derived by this file; Can learn this file and the propagation trajectories of multiple wave files of being derived by it according to this tree construction.

Use file trajectory track tree for file operation and propagate the auditing method recording, it is characterized in that: utilize tree derivation to represent the propagation trajectories of file; Utilize file trajectory track tree interior nodes structure to represent other attributes such as operation of the wave file deriving to file and by it; Utilize tree interior nodes audit document circulation number of times.

Based on the audit analysis method of file trajectory track tree, it is characterized in that:

In the time that a file produces, system can be label of document creation, label substance comprises documentary unique ID, no matter it is carried out to what operation, unique ID of file is constant, can generate a new copy if exist when copying, preserve or save as operation, and the preservation of described preservation representative to the preservation after file modification instead of while receiving, the preservation occurring when reception or cover and can not generate latest copy; By duplicate of the document, ID distinguishes, duplicate of the document ID is created in the operation of preserving, save as and copy, a duplicate of the document only has a duplicate of the document ID, and it can not change in transmission, printing, retouching operation, and duplicate of the document can generate new duplicate of the document; If there is deletion action, the label record of this file can be not deleted; Each duplicate of the document also can generate the label of oneself;

By the inquiry to certain file name, learn the file ID of wanting inquiry, operation associated table, subscriber's meter, file table and data dictionary, build the propagation trajectories table of this file; Propagation trajectories table at least comprises file ID, filename, duplicate of the document ID, duplicate of the document name, operation ID, action name, running time, operation user ID, user name and level; Whether be the code name of " transmission " by decision operation ID, structure hierarchical information, in the time being operating as transmission, can write sender and recipient's information recording simultaneously, choose i.e. " the sender ID recipient ID " of operation user ID wherein, by the sequencing of transmitting time, " sender ID recipient ID " front interpolation label is to " m sender ID recipient ID ", m represents m sender or recipient, constructs hierarchical information with this;

The propagation trajectories tree that builds certain file according to the propagation trajectories table of file, takes a decision as to whether root node according to action name, if " establishment " is root node, all the other are child node; According to the hierarchical information structure file trajectory track tree of the file in file propagation trajectory table and copy thereof, carry out all-the-way tracking record to file and by the circulation process of the wave file of this file generated, with tree node representation file or wave file, in tree node structure, comprise General Properties and the operation note of this file or wave file, operation note is one the three capable form of row n, and three row record respectively operator, action type, running time; N represents number of operations; The child nodes of each tree node represents other users that this file sends to, and the line between tree node is that branch packets of information contains sent file and file ID thereof;

The concrete steps of structure propagation trajectories tree are as follows:

1) root node using document creation person as tree;

2) hierarchical information of selecting file itself, a subtree A of spanning tree, recipient ID corresponding to label in hierarchical information before each sender ID also adds sender's child nodes for this reason, now in the child nodes of each node, having one is repetition, deletes the child nodes that wherein there is no child node;

3) choose the shortest hierarchical information of file replica ID in All Files copy, the founder ID of locking copy, choose sender ID or the recipient ID node identical with the founder ID of copy in subtree A, judge the time of reception of each node in the creation-time of its copy and subtree A, if creation-time is later than time of reception, taking this node as subtree root node, another many subtrees of spanning tree, method and step 2) identical;

4) file replica ID time short hierarchical information, then concrete steps and 3 in selecting file copy) identical; Until traveled through all duplicates of the document, complete the generation of file trajectory track tree.

Brief description of the drawings

The file trajectory track tree instance graph that Fig. 1 produces.

Embodiment

Step 1

First, file trajectory track tree Core Generator diffuses information and operation information to file according to file in the network of collecting, it is built to table and arrange.Concrete operation step is as follows:

When the computing machine that this hypermedia system is installed produces new file or file is operated, can instant upload file information and operation information.When inquiring about track operation to certain file, keeper (also can carry out other operations), the file name that input will be inquired about, system is by the prompting initial release of this file and other copies (information comprises the information such as duplicate of the document title, operation, operator's information and running time to this file), keeper is the root node taking this file or this file copy as tree according to own Location of requirement, and then definite spanned file trajectory track tree.This computer-chronograph will carry out the foundation of file propagation trajectory table to this file or this file copy, and the object of setting up this table is for spanned file trajectory track tree.

Form file trajectory track tree data from the database table such as operation table, person chart in database.

In the time that a file produces, system can be label of document creation, label substance comprises documentary unique ID, no matter being carried out to what operation, it (comprises rename, amendment, preserve, print, send, copy, the operation such as save as), unique ID of file is constant, copy if exist, preserve (the preservation when preservation of this section represents the preservation after file modification instead of reception, the preservation occurring when reception or cover can not generate latest copy) or can generate a new copy when saving as operation, can distinguish by duplicate of the document ID, duplicate of the document ID is in amended preservation, in the operation that saves as and copy, be created, a duplicate of the document only has a duplicate of the document ID, it is sending, print, in other operations such as amendment, can not change, duplicate of the document can also generate new duplicate of the document.If there is deletion action, the label record of this file can be not deleted.Each duplicate of the document also can generate the label of oneself, can search for the propagation trajectories of this file and the All Files copy based on this file ID according to file ID.

By the inquiry to certain file name, learn the file ID of wanting inquiry, the information such as operation associated table, subscriber's meter, file table, build the propagation trajectories table of this file.(the overstriking attribute field in each table, by appearing in the new table generating in order to create file trajectory track tree, also can increase and delete not overstriking attribute field as required.)

The explanation of table 1 document entity

Attribute	Major key	External key	Father's entity title
				File ID	Be	No	?
Filename	No	No	?
				Duplicate of the document ID	No	No	?
Duplicate of the document name	No	No	?
				Owner ID	No	Be	Subscriber's meter
Size	No	No	?
				Creation-time	No	No	?
Modification time	No	No	?
				Access time	No	No	?
Position	No	No	?
				Operation ID	No	Be	Operation table
Level	No	No	?

The explanation of table 2 user subject

Attribute	Major key	External key	Father's entity title
				User ID	Be	No	?
Level of confidentiality	No	No	?
				Contact method	No	No	?
User name	No	No	?
				The ID of department	No	Be	Department table

The explanation of table 3 application entity

Attribute

Major key

External key

Father's entity title

Operation ID	Be	No	-
				File ID	No	Be	File table
Operation user ID	No	Be	Subscriber's meter
				Running time	No	No	?

Table 4 department entity declaration

Attribute	Major key	External key	Father's entity title
				The ID of department	Be	No	?
Department name	No	No	?

Table 5 data dictionary entity declaration

Attribute	Major key	External key	Father's entity title
				Create	No	No	?
Save as	No	No	?
				Print	No	No	?
Copy	No	No	-
				Rename	No	No	?
Delete	No	No	?
				Send	No	No	?
After amendment, preserve	No	No	?

With file ID locating file propagation trajectories, as follows according to the new table of some the field structure in above five tables:

Table 6 finds the propagation trajectories table of this file according to certain file ID

Attribute	Major key	External key	Father's entity title
				File ID	Be	No	?
Filename	No	No	?
				Duplicate of the document ID	No	No	?

Duplicate of the document name	No	No	?
				Operation ID	No	Be	Operation table
Action name	No	Be	Data dictionary
				Running time	No	No	?
Operation user ID	No	Be	Subscriber's meter
				User name	No	No	?
Level	No	No	?

In foundation, table builds the propagation trajectories tree of certain file, and the key that builds this tree is to know the child nodes of its root node and each node, takes a decision as to whether root node according to action name, if " establishment " is root node, all the other are child node.Obtain its root node, but also need to know its child nodes.First learn about the form of each attribute:

File ID: " identification number "+" creating document time numbering ", for example identification number is " 999 ", and creating document time is " 2014-01-0109:30:59 ", and its file ID number is " 99920140101093059 "; (this coded format also can design by additive method.)

Filename: file name;

Duplicate of the document ID: based on the duplicate of the document obtaining after file (or its copy) amendment, its ID form is: three random figure places of ID+ of this file (or its copy); (this coded format also can design by additive method.)

Duplicate of the document name: duplicate of the document title;

Operation ID: comprise establishments, preserve, save as, print, copy, the code name of rename, deletion, transmission or combine according to the code name of time sequencing, such as: < " code name of establishment "+" code name of printing "+" code name of transmission " >; (" code name of establishment " itself is a string shaping numeral, uses shaping numeral in order to accelerate the search speed of database his-and-hers watches, and the operation that its code name is corresponding can be inquired about in " operation dictionary ")

Action name: comprise establishment, preserve, save as, print, copy, rename, deletion, transmit operation;

Running time: the running time of operator to file, such as: < " time of establishment "+" time of printing "+" time of transmission " >;

Operation user ID: operator's ID, form is 5 bit digital, such as: < " founder's ID "+" printing person's ID "+" sender ID recipient ID recipient ID ... " >; (this coded format also can design by additive method.)

User name: operator's title;

Level: log file propagation trajectories, while only having operation ID to be the code name sending, hierarchical information is just upgraded.Its form is: < " operator P1 "+" operator P2 "+... + " operator PX " >, wherein, non-conterminous operator can be identical.

A file propagation trajectory table will have a file ID, a filename, a level record, and its remainder is all as duplicate of the document ID, duplicate of the document name, operation ID, action name, running time, operation user ID, user name can have many.

Whether be the code name of " transmission " by decision operation ID, can construct hierarchical information, in the time being operating as transmission, write operation user's (sender, recipient) information recording simultaneously, choose i.e. " the sender ID recipient ID " of operation user ID wherein, by the sequencing of transmitting time, " sender ID recipient ID " front interpolation label is to " m sender ID recipient ID ", 1,2,3,4, construct hierarchical information with this, such as: < " 1 sender ID "+" 2 sender ID "+... >.

1. choose data structure and the expression of tree form data structure as file propagation track, carry out all-the-way tracking record to file and by the circulation process of the wave file of this file generated, with tree node representation file or wave file, in tree node structure, comprise General Properties and the operation note of this file or wave file, operation note is one the three capable form of row n, records respectively operator, action type, running time.The child nodes of each tree node represents other users that this file sends to, and the line between tree node is that branch packets of information contains sent file and file ID thereof.

2. by fileinfo and file operation recording of information are gathered, arranged, form the propagation trajectories table of spanned file trajectory track tree.

3. directly certain paths of spanning tree of design of the record of the hierarchical information in tables of data, by constructing the logical design in the concrete implementation step of setting and then generating whole tree in step 2.

Step 2

Generating corresponding file trajectory track by file propagation trajectory table newly-generated in database sets.

According to the hierarchical information structure file trajectory track tree of the file in file propagation trajectory table and copy thereof, the nodal information structure of this tree comprises that sender's information (specifically comprising its department and contact method etc.), transmitting time, time of reception, file belong to the operation information which copy (judging by duplicate of the document ID length), sender carry out it.

The concrete implementation step of structure tree is as follows:

1) root node using document creation person as tree;

2) hierarchical information of selecting file itself (being non-duplicate of the document), a subtree A of spanning tree, recipient ID corresponding to label in hierarchical information before each sender ID also adds sender's child nodes for this reason, now in the child nodes of each node, having one is repetition, deletes the child nodes that wherein there is no child node;

3) choose the shortest hierarchical information of file replica ID in All Files copy, the founder ID of locking copy, choose sender ID or the recipient ID node identical with the founder ID of copy in subtree A, judge the time of reception of each node in the creation-time of its copy and subtree A, if creation-time is later than time of reception,, taking this node as subtree root node, another many stalks of spanning tree are set, and method is identical with step 2.

4) file replica ID time short hierarchical information in selecting file copy, then concrete steps and 3 identical.Until traveled through all duplicates of the document, complete the generation of file trajectory track tree.

Separately, there is following a kind of situation, for file X, if X is issued B and C by D, B receives and is also issued C (and C do not select to save as become another file) after X, after C modifies to X and send to other users, there is the subtree of redundancy for the generation of this tree, because the tree that the child C of the child C of D and B generates in step 3,4 is identical, identical tree should be explained accordingly or the change process of color, thereby be facilitated user to carry out checking and judging tree.

Step 3

Finally, user can audit to file according to self-defined screening conditions.

Specifically comprise following 3 points:

1. file propagation trajectory track

Can see intuitively the propagation trajectories of this file by the structure of tree, and which people carries out any operation to this file.

2. file circulation number of times audit

Can determine by the interstitial content that judges file trajectory track tree the number of times that file circulates, the subtree node of redundancy need to be deleted to rear statistics node sum.

3. file operation audit

Each node structure body of tree comprises operation information, comprise all operations information of this nodal operation people to this file, the nodal information of all nodes by statistics file or file copy, can learn the number of times of the various types of operations to this file or its certain copy.

File trajectory track tree is applied, except the propagation trajectories of the wave file of seeing intuitively certain file and produced by this file, can also audit to file according to user's request.Specifically in step 3.

The final file trajectory track producing is set example as shown in Figure 1:

Be called the file of safety in production guide by retrieving files, according to the information of the each file producing, select to be born in by Zhao the version that 2014-01-0109:30:59 creates, then generate the file track tree of this file.

Click the nodal information that node there will be figure the right, the line of clicking between node there will be sent file ID and filename.

File sends to Li Nan and Sun Wen by Zhao Sheng, and Li Nan then sends to trip and Wu Hui by file, and Sun Wen also sends to Wu Hui by file, and Wu Hui sends it back Li Nan after amendment.Wu Hui received Li Nan and Sun Wen issues his file before Transmit message is to Li Nan, so there is redundancy phenomenon herein, can carry out the relevant behaviors of informing user such as color filling or text description.

Claims (1)

1. the audit analysis method based on file trajectory track tree, is characterized in that:

In the time that a file produces, system can be label of document creation, label substance comprises documentary unique ID, no matter it is carried out to what operation, unique ID of file is constant, can generate a new copy if exist when copying, preserve or save as operation, and the preservation of described preservation representative to the preservation after file modification instead of while receiving, the preservation occurring when reception or cover and can not generate latest copy; By duplicate of the document, ID distinguishes, duplicate of the document ID is created in the operation of preserving, save as and copy, a duplicate of the document only has a duplicate of the document ID, and it can not change in transmission, printing, retouching operation, and duplicate of the document can generate new duplicate of the document; If there is deletion action, the label record of this file can be not deleted; Each duplicate of the document also can generate the label of oneself;

By the inquiry to certain file name, learn the file ID of wanting inquiry, operation associated table, subscriber's meter, file table and data dictionary, build the propagation trajectories table of this file; Propagation trajectories table at least comprises file ID, filename, duplicate of the document ID, duplicate of the document name, operation ID, action name, running time, operation user ID, user name and level; Whether be the code name of " transmission " by decision operation ID, structure hierarchical information, in the time being operating as transmission, can write sender and recipient's information recording simultaneously, choose i.e. " the sender ID recipient ID " of operation user ID wherein, by the sequencing of transmitting time, " sender ID recipient ID " front interpolation label is to " m sender ID recipient ID ", m represents m sender or recipient, constructs hierarchical information with this;

The propagation trajectories tree that builds certain file according to the propagation trajectories table of file, takes a decision as to whether root node according to action name, if " establishment " is root node, all the other are child node; According to the hierarchical information structure file trajectory track tree of the file in file propagation trajectory table and copy thereof, carry out all-the-way tracking record to file and by the circulation process of the wave file of this file generated, with tree node representation file or wave file, in tree node structure, comprise General Properties and the operation note of this file or wave file, operation note is one the three capable form of row n, and three row record respectively operator, action type, running time; N represents number of operations; The child nodes of each tree node represents other users that this file sends to, and the line between tree node is that branch packets of information contains sent file and file ID thereof;

The concrete steps of structure propagation trajectories tree are as follows:

1) root node using document creation person as tree;

2) hierarchical information of selecting file itself, a subtree A of spanning tree, recipient ID corresponding to label in hierarchical information before each sender ID also adds sender's child nodes for this reason, now in the child nodes of each node, having one is repetition, deletes the child nodes that wherein there is no child node;

3) choose the shortest hierarchical information of file replica ID in All Files copy, the founder ID of locking copy, choose sender ID or the recipient ID node identical with the founder ID of copy in subtree A, judge the time of reception of each node in the creation-time of its copy and subtree A, if creation-time is later than time of reception, taking this node as subtree root node, another many subtrees of spanning tree, method and step 2) identical;

4) file replica ID time short hierarchical information, then concrete steps and 3 in selecting file copy) identical; Until traveled through all duplicates of the document, complete the generation of file trajectory track tree.