WO2018166099A1 - 信息泄露检测方法及装置、服务器及计算机可读存储介质 - Google Patents

信息泄露检测方法及装置、服务器及计算机可读存储介质 Download PDF

Info

Publication number
WO2018166099A1
WO2018166099A1 PCT/CN2017/089807 CN2017089807W WO2018166099A1 WO 2018166099 A1 WO2018166099 A1 WO 2018166099A1 CN 2017089807 W CN2017089807 W CN 2017089807W WO 2018166099 A1 WO2018166099 A1 WO 2018166099A1
Authority
WO
WIPO (PCT)
Prior art keywords
request message
parameter
information
matching
keyword
Prior art date
Application number
PCT/CN2017/089807
Other languages
English (en)
French (fr)
Inventor
王胡园
Original Assignee
平安科技（深圳）有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 平安科技（深圳）有限公司 filed Critical 平安科技（深圳）有限公司
Priority to SG11201901807YA priority Critical patent/SG11201901807YA/en
Priority to JP2018527065A priority patent/JP6688389B2/ja
Priority to AU2017403386A priority patent/AU2017403386A1/en
Priority to US16/071,140 priority patent/US20210042443A1/en
Priority to EP17900903.0A priority patent/EP3447669B1/en
Priority to KR1020187035322A priority patent/KR102157712B1/ko
Publication of WO2018166099A1 publication Critical patent/WO2018166099A1/zh

Links

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60—Protecting data
    • G06F21/62—Protecting access to data via a platform, e.g. using keys or access control rules
    • G06F21/6218—Protecting access to data via a platform, e.g. using keys or access control rules to a system of files or objects, e.g. local or distributed file system or database
    • G06F21/6245—Protecting personal data, e.g. for financial or medical purposes
    • G06F21/6263—Protecting personal data, e.g. for financial or medical purposes during internet communication, e.g. revealing personal data from cookies
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F16/00—Information retrieval; Database structures therefor; File system structures therefor
    • G06F16/90—Details of database functions independent of the retrieved data types
    • G06F16/903—Querying
    • G06F16/90335—Query processing
    • G06F16/90344—Query processing by using string matching techniques
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F16/00—Information retrieval; Database structures therefor; File system structures therefor
    • G06F16/90—Details of database functions independent of the retrieved data types
    • G06F16/95—Retrieval from the web
    • G06F16/951—Indexing; Web crawling techniques
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/55—Detecting local intrusion or implementing counter-measures
    • G06F21/556—Detecting local intrusion or implementing counter-measures involving covert channels, i.e. data leakage between processes
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60—Protecting data
    • G06F21/62—Protecting access to data via a platform, e.g. using keys or access control rules
    • G06F21/6218—Protecting access to data via a platform, e.g. using keys or access control rules to a system of files or objects, e.g. local or distributed file system or database
    • G06F21/6245—Protecting personal data, e.g. for financial or medical purposes
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F40/00—Handling natural language data
    • G06F40/20—Natural language analysis
    • G06F40/279—Recognition of textual entities
    • G06F40/284—Lexical analysis, e.g. tokenisation or collocates
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06N—COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS
    • G06N20/00—Machine learning
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/30—Network architectures or network communication protocols for network security for supporting lawful interception, monitoring or retaining of communications or communication related information
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06N—COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS
    • G06N7/00—Computing arrangements based on specific mathematical models
    • G06N7/01—Probabilistic graphical models, e.g. probabilistic networks

Definitions

  • the present invention relates to the field of information security technologies, and in particular, to an information leakage detection method and apparatus, a server, and a computer readable storage medium.
  • the server detects the information leakage through the web application vulnerability scanner, and only defines a specific keyword corresponding to the sensitive information, such as email, username, etc., and scans the recorded parameters with the key. The words are compared.
  • the specific keyword includes username, excluding USERNAME
  • the match is not recognized, or the parameter in the http request does not recognize the match, which may result in sensitive information in clear text. Transmission, the risk of information leakage.
  • the method roughly judges whether there is a clear message transmission of sensitive information, and requires the safety tester to pay more labor for subsequent analysis and inspection, which not only reduces the efficiency of identifying sensitive information leakage, but also reduces the duplication of safety testers. .
  • the main object of the present invention is to provide an information leakage detecting method and apparatus, a server and a computer readable storage medium, aiming at improving the efficiency of information leakage detection and reducing the risk of information leakage.
  • the present invention provides an information leakage detecting method, including:
  • the matching degree is greater than the preset threshold, determining that the information of the request message is leaked, and recording related information of the request message.
  • the present invention also provides an information leakage detecting apparatus, including:
  • a receiving module configured to receive a request message sent by the channel side
  • a matching module configured to match a parameter included in the request message with a keyword obtained by pre-machine learning, and obtain a matching degree between the parameter and the keyword based on the matching result
  • the first determining module is configured to: when the matching degree is greater than the preset threshold, determine that the information of the request message is leaked, and record related information of the request message.
  • the present invention further provides a server, where the server includes a processor and a memory, and the processor is configured to execute an information leakage detection program stored in the memory to implement the following steps:
  • the matching degree is greater than the preset threshold, determining that the information of the request message is leaked, and recording related information of the request message.
  • the present invention also provides a computer readable storage medium storing one or more programs, the one or more programs being used by one or more processors Execute to implement the following steps:
  • the matching degree is greater than the preset threshold, determining that the information of the request message is leaked, and recording related information of the request message.
  • the request message sent by the channel is received, and the parameter included in the request message is matched with the keyword obtained by the pre-machine learning, and the parameter included in the request message is obtained between the parameter included in the request message and the keyword obtained by the pre-machine learning.
  • the matching degree between the parameter and the keyword is greater than a preset threshold, it is determined that the information of the request message is leaked, and related information of the request message is recorded. Therefore, by machine learning to automatically identify more keywords, it is possible to identify sensitive information substantially and effectively, reduce the duplication of safety testers, improve the efficiency of information leakage detection and reduce the risk of information leakage.
  • FIG. 1 is a schematic flowchart of a first embodiment of an information leakage detecting method according to the present invention
  • FIG. 2 is a schematic flowchart of a second embodiment of an information leakage detecting method according to the present invention.
  • FIG. 3 is a schematic flowchart of a third embodiment of an information leakage detecting method according to the present invention.
  • FIG. 4 is a schematic flowchart diagram of a fourth embodiment of an information leakage detecting method according to the present invention.
  • FIG. 5 is a schematic flowchart diagram of a fifth embodiment of an information leakage detecting method according to the present invention.
  • FIG. 6 is a schematic diagram of functional modules of a first embodiment of an information leakage detecting apparatus according to the present invention.
  • FIG. 7 is a schematic diagram of functional modules of a fourth embodiment of an information leakage detecting apparatus according to the present invention.
  • FIG. 8 is a schematic diagram of functional modules of a fifth embodiment of an information leakage detecting apparatus according to the present invention.
  • FIG. 9 is a schematic structural diagram of a server in a hardware operating environment according to an embodiment of the present invention.
  • the information leakage detecting method of this embodiment includes:
  • Step S10 Receive a request message sent by the channel side.
  • the information leakage detection method is applied to a server, which mainly detects the leakage of interface sensitive information.
  • the server is a back-end server corresponding to the front-end channel.
  • the server receives the http request message sent by the channel or returns the response packet to the channel according to the request message, the server detects the request message or the response packet to prevent the information. Give way.
  • the server may be pre-configured with a security application for intercepting the http request message sent by the channel to the server for information leakage detection, or intercepting the response packet returned by the server according to the request message to the channel for information leakage detection. . That is, when the channel direction server sends an http request message or the server feeds back the response data packet to the channel side, it can transit through the security application.
  • the channel is the tested product, including online banking, bank background app, etc.
  • the app can run on PC, mobile phone and other terminals.
  • the channel can send a request message to the server according to its own usage requirement, and the server can receive the request message sent by the channel, and the request message includes inputting the account password, logging in, sending the information, opening the interface, and the like.
  • Step S20 Matching parameters included in the request message with keywords obtained by machine learning in advance, and acquiring a matching degree between the parameter and the keyword based on the matching result.
  • the server may perform machine learning in advance through a preset security application to identify multiple keywords, that is, automatically identify more keywords through machine learning in advance, for example, email, email, e-mail, and email. , EMAIL, etc., instead of simply identifying emails.
  • keywords are first obtained by a large amount of learning recognition of a sample, such as username, Username, USNNANME, user, name, and the like.
  • a sample such as username, Username, USNNANME, user, name, and the like.
  • you can directly identify such as username, Username, UserName, etc.
  • you can also directly identify such as username, uname, name, etc.
  • the algorithm and the probabilistic algorithm select the most probable probability for identification matching. The following examples will be described in detail.
  • the server receives the request message sent by the channel, it determines whether the request message is a plaintext transmission or a ciphertext transmission, that is, the parameters included in the request message are obtained by the pre-machine learning.
  • the keyword is matched, and the degree of matching between the parameter included in the request message and the keyword obtained by the pre-machine learning is obtained, so as to determine the meaning of the parameter in the request message according to the matching degree.
  • the parameters included in the request message may include email, username, passwd, flagname, and the like; when the request message is ciphertext transmission, the parameters included in the request message are some garbled characters.
  • Step S30 When the matching degree is greater than a preset threshold, determine that the information of the request message is leaked, and record related information of the request message.
  • the matching degree between the parameter included in the request message and the keyword obtained by the machine learning is obtained, it is determined whether the matching degree is greater than a preset threshold, and the preset threshold may be flexibly set according to a specific situation.
  • the request message is transmitted in clear text and there is a risk of information leakage. At this time, it is determined that the information of the request message is leaked, and the related information of the request message is recorded, and the related information of the request message may be stored in a preset database.
  • the record field may include the request url of the request message (the url is a uniform resource locator), the request sensitive parameter, the serial number, and the like.
  • the request url is an interface address bound to the server by the channel party; the request sensitive parameter is plaintext data, and may include multiple parameters; the sequence number is a number, which serves to sort the request message.
  • the security application detects that the data of the transmission process of the request message is a plaintext transmission, and the security application records the related information of the request message in the database redis of the security application. It should be noted that, regardless of whether the request message sent by the channel is a plaintext transmission or a ciphertext transmission, the security application needs to transfer the request message to the backend server.
  • the matching degree between the keyword and the parameter is greater than the preset threshold, it indicates that the parameter cannot be determined in the meaning of the request message. At this time, it is determined that the request message is ciphertext transmission, and there is no risk of information leakage. When the request message is ciphertext transmission, it is determined that the information of the request message is not leaked, and it is not necessary to record related information of the request message.
  • the data with security risks stored in the database may be exported, that is, the relevant information of the request message recorded in the database is exported, and the relevant security test personnel perform corresponding processing.
  • the server when the channel direction server delivers the http request message, the server receives the request message, wherein the request message includes parameters including Username, passwd, IDCard, and the like.
  • the server matches the parameters included in the request message with the keywords obtained by the pre-machine learning, and determines that the values of the parameters Username, passwd, IDCard, etc. are plaintext transmission, that is, the user name Username is aaaaaa, the password passwd is bbbbb, and the bank card number IDCard is 4205xxxxxxxxxx11, at this time, it is determined that the information of the request message is leaked, and the related information of the request message is recorded.
  • the request message sent by the channel is received, and the parameter included in the request message is matched with the keyword obtained by the pre-machine learning, and the parameter included in the request message is obtained between the parameter included in the request message and the keyword obtained by the pre-machine learning.
  • the matching degree between the parameter and the keyword is greater than a preset threshold, it is determined that the information of the request message is leaked, and related information of the request message is recorded. Therefore, by machine learning to automatically identify more keywords, it is possible to identify sensitive information substantially and effectively, reduce the duplication of safety testers, improve the efficiency of information leakage detection and reduce the risk of information leakage.
  • step S20 may include:
  • Step S21 Matching parameters included in the request message with keywords obtained by machine learning in advance, and determining a first matching degree between the parameter and the keyword.
  • Step S22 Determine, according to the first matching degree and a context of the parameter in the request message, a degree of matching between the parameter and the keyword.
  • the server in the process of matching the parameters included in the request message with the keywords obtained by the pre-machine learning, the server first compares the parameters with the keywords, and determines the first match between the parameters and the keywords. degree.
  • multiple parameters may be compared with each keyword to determine the degree of matching between each parameter and the keyword. Then, performing weighting calculation according to the matching degree corresponding to each parameter, obtaining a first matching degree between the plurality of parameters and the keyword, and determining the parameter and the key according to the first matching degree and the context of the parameter in the request message. The degree of matching between words.
  • the name message is included in the request message received by the server, the name is determined by the probability algorithm, and the name is the name of the name.
  • the possible probability ie, the first matching degree
  • the possible probability of the account meaning ie, the first matching degree
  • a password parameter such as password
  • the server In the process of matching the parameters included in the request message with the keywords obtained by the machine learning in advance, the server first determines the first matching degree between the parameter and the keyword through the probability algorithm, and then uses the decision tree algorithm according to the first A matching degree and a context of the parameter in the request message determine a matching degree between the parameter and the keyword, thereby improving the accuracy and reliability of the matching degree acquisition.
  • step S20 may further include:
  • Step S23 Split the parameters included in the request message into the first sub-parameter and the second sub-parameter according to the keyword obtained by the pre-machine learning.
  • Step S24 matching the first sub-parameter and the second sub-parameter with a keyword obtained by pre-machine learning, determining a first probability that the first sub-parameter matches the first keyword, and the The second probability that the second sub-parameter matches the second keyword.
  • Step S25 Determine, according to the first probability, the second probability, and a context of the parameter in the request message, a degree of matching between the parameter and the keyword.
  • the server in the process of matching the parameters included in the request message with the keywords obtained by the machine learning in advance, the server first splits the plurality of sub-parameters according to the keywords included in the request message to the parameters included in the request message. For example, it can be split into a first sub-parameter and a second sub-parameter. Then, the first sub-parameter and the second sub-parameter are respectively matched with the keywords obtained by the pre-machine learning, and the first probability that the first sub-parameter matches the first keyword is determined according to the probabilistic algorithm, and the second sub-parameter and the second sub-parameter are determined. The second probability of the second keyword match. Then, the decision tree algorithm is used according to the first probability, the second probability, and the context of the parameter in the request message, the degree of matching between the parameter and the keyword, so as to determine the meaning of the parameter in the request message according to the matching degree.
  • the request message may be according to the first probability and the parameter. a context, calculating a third probability that the first sub-parameter matches the first keyword, and determining a fourth probability that the second sub-parameter matches the second keyword according to the second probability and a context of the parameter in the request message . Finally, the magnitudes of the third probability and the fourth probability are compared, and the larger of the third probability and the fourth probability is set as the parameter and the keyword.
  • determining the degree of matching between the parameters and the keywords may also be flexibly set according to specific circumstances, and does not limit the present invention.
  • the flagname is first split to obtain the flag and the name, wherein the flag is selected due to multiple training encounters of the mark and the identifier, and the name is multiple times. Training to meet names, accounts, etc. will be selected. It is determined by various algorithms that the flagname is used to mark the possible probability of 40%, the flagname is used for the account name with a probability of 60%, and then the password parameter, such as password, appears in the following in the request message according to the parameter, and the flagname is determined as the account at this time.
  • the possible probability is 90%, that is, the decision tree algorithm determines that the matching degree between the parameter flagname and the keyword account is 90%.
  • the server may split the parameter, and then determine the matching degree between the parameter and the keyword according to the probabilistic algorithm and the decision tree algorithm according to the split sub-parameter and the context of the parameter in the request message.
  • Step S40 Determine whether the identifier of the non-sensitive information set by the channel side exists in the request message.
  • Step S50 When the identifier of the non-sensitive information set by the channel party exists in the request message, it is determined that the information of the request message is not leaked.
  • the fourth embodiment of the information leakage detecting method of the present invention may also be based on the second or third embodiment of the above information leakage detecting method.
  • the channel side may identify the request message that needs to be transmitted in plaintext, and set the request message that needs to be transmitted in plaintext as non-sensitive information.
  • the server When the server receives the request message sent by the channel, it may first determine whether the identifier of the non-sensitive information set by the channel side exists in the request message. When the identifier of the non-sensitive information set by the channel is found in the request message, it is determined that the information of the request message is not leaked, even if the request message is a plaintext transmission, indicating that the request message does not have the risk of information leakage, and the record does not need to be recorded. Information about the request message.
  • the server of the embodiment After receiving the request message sent by the channel side, the server of the embodiment determines that the information of the request message is not leaked when it is determined that the identifier of the non-sensitive information set by the channel side exists in the request message. It ensures that the requested message can be transmitted in plain text, which improves the reliability of information leakage detection.
  • a fifth embodiment of the information leakage detecting method of the present invention is proposed, in which the information leakage detection is performed in this embodiment.
  • the method also includes:
  • Step S60 Acquire a response data packet returned to the channel side based on the request message.
  • Step S70 Compare information included in the response data packet with a target parameter in a field corresponding to pre-recording the request message.
  • Step S80 When the response data packet contains more information than the target parameter in the field, determine that the information of the response data packet is leaked, and record related information of the response data packet.
  • step S60 in the fifth embodiment of the information leakage detecting method of the present invention may be performed after the above step S10, or may be performed after the above step S20 or step S30 or step S40 or step S50.
  • the server when the server receives the request message sent by the channel and feeds back the response packet to the channel according to the request message, in order to further reduce the risk of information leakage, the response packet needs to be detected.
  • the server when the server receives the request message sent by the channel, the server records the target parameter in the corresponding field of the request message according to the request message. The server then obtains a response data packet returned to the channel side based on the request message, compares the information contained in the response data packet with the target parameter in the corresponding field of the pre-recorded request message, and determines whether the information contained in the response data packet is more than Record the target parameter in the corresponding field of the request message. When the response packet contains more information than the target parameter in the field, it is determined that the information of the response packet is leaked, and the related information of the response packet is recorded, and the related information may include more data than the target parameter.
  • the related information of the response data packet may be stored in a preset database, and the record field may include related information such as a request url, a sensitive parameter, a serial number, and the like of the response data packet.
  • the request url is an interface address that the channel party binds to the server;
  • the sensitive parameter is data that is more than the target parameter, and may include multiple parameters;
  • the serial number is a number, which serves to sort the response data packet.
  • the response packet may be detected by the security application by using the preset security application relay.
  • the server when the channel direction server requests to query the page of the transaction record, the server will need to return to the channel side html page field record, where the request is the page, and the bank card number has not been entered yet for query.
  • the transaction record includes the transaction amount and transaction time, and the html page field records the transaction amount and transaction time.
  • the server When the subsequent channel sends a bank card number to the server to initiate an http query request, when the bank card number is entered for inquiry, when the bank card parameter is matched to the bank card number, the server records it, and then returns the response packet and the recorded web page according to the bank card number.
  • the parameters in the field are compared. If the returned parameters are more than the parameters recorded in the field, the server returns more information than the channel party's business requirements.
  • the request url, sensitive parameters, and serial number are recorded in the database redis.
  • a page of the channel bank website is used to query the transaction record according to the bank card number input by the user, and the response packet returned by the server according to the request includes the transaction amount of 1000, the transaction time is 20160101, and the transaction user is test.
  • the transaction user's bank card number is xxxxx, the merchant name is aaa; the transaction amount is 400, the transaction time is 20161201, the transaction user is bbb, the transaction user bank card number is aaaa, the merchant name is cccc, etc., which shows the channel business here. All that is required is transaction data, but the returned information also contains the user's identity information, etc., and there are too many returned information, and it is judged that sensitive information may be leaked.
  • the data with security risks stored in the database may be exported, that is, the relevant information of the response data packets recorded in the database is exported, and the relevant security test personnel perform corresponding processing.
  • the server determines, by comparing the response data packet based on the request message with the target parameter required by the request message, which parameters in the response data packet are more than the target parameter required by the request message, and the excess parameter relates to Sensitive information and record information about the response packet. Therefore, the information returned by the interface is not the data that the front-end channel page needs to display, and it is judged as sensitive information leakage, and automatic detection is realized, and manual detection is avoided, which not only improves the efficiency of information leakage detection, but also reduces The risk of information disclosure.
  • a person skilled in the art may understand that all or part of the steps of implementing the above embodiments may be completed by hardware, or may be instructed by a program to execute related hardware, and the program may be stored in a computer readable storage medium.
  • the storage medium mentioned may be a read only memory, a magnetic disk or an optical disk or the like.
  • the information leakage detecting apparatus of this embodiment includes:
  • the receiving module 100 is configured to receive a request message sent by a channel.
  • the information leakage detecting device is applied to the server, and mainly detects the leakage of the interface sensitive information.
  • the server is a back-end server corresponding to the front-end channel.
  • the server receives the http request message sent by the channel or returns the response packet to the channel according to the request message, the server detects the request message or the response packet to prevent the information. Give way.
  • the server may be pre-configured with a security application for intercepting the http request message sent by the channel to the server for information leakage detection, or intercepting the response packet returned by the server according to the request message to the channel for information leakage detection. . That is, when the channel direction server sends an http request message or the server feeds back the response data packet to the channel side, it can transit through the security application.
  • the channel is the tested product, including online banking, bank background app, etc.
  • the app can run on PC, mobile phone and other terminals.
  • the channel party can send a request message to the server according to its own usage requirement, and the server can call the receiving module 100 to receive the request message sent by the channel party, and the request message includes inputting the account password, logging in, sending the information, opening the interface, and the like.
  • the matching module 200 is configured to match the parameter included in the request message with a keyword obtained by machine learning in advance, and obtain a matching degree between the parameter and the keyword based on the matching result.
  • the server may perform machine learning in advance through a preset security application to identify multiple keywords, that is, automatically identify more keywords through machine learning in advance, for example, email, email, e-mail, and email. , EMAIL, etc., instead of simply identifying emails.
  • keywords are first obtained by a large amount of learning recognition of a sample, such as username, Username, USNNANME, user, name, and the like.
  • a sample such as username, Username, USNNANME, user, name, and the like.
  • you can directly identify such as username, Username, UserName, etc.
  • you can also directly identify such as username, uname, name, etc.
  • the algorithm and the probabilistic algorithm select the most probable probability for identification matching. The following examples will be described in detail.
  • the server determines whether the request message is a plaintext transmission or a ciphertext transmission, that is, the matching module 200 sets the parameters included in the request message.
  • the keywords obtained by the pre-machine learning are matched, and the degree of matching between the parameters included in the request message and the keywords obtained by the machine learning in advance is obtained, so as to determine the meaning of the parameter in the request message according to the matching degree.
  • the parameters included in the request message may include email, username, passwd, flagname, and the like; when the request message is ciphertext transmission, the parameters included in the request message are some garbled characters.
  • the first determining module 300 is configured to determine that the information of the request message is leaked when the matching degree is greater than a preset threshold, and record related information of the request message.
  • the matching degree between the parameter included in the request message and the keyword obtained by the machine learning is obtained, it is determined whether the matching degree is greater than a preset threshold, and the preset threshold may be flexibly set according to a specific situation.
  • the first determining module 300 determines that the meaning of the parameter in the request message is the meaning corresponding to the keyword, and after determining that the parameter is in the meaning of the request message, , it can be determined that the request message is a clear text transmission, there will be a risk of information leakage. At this time, it is determined that the information of the request message is leaked, and the related information of the request message is recorded, and the related information of the request message may be stored in a preset database.
  • the record field may include the request url of the request message (the url is a uniform resource locator), the request sensitive parameter, the serial number, and the like.
  • the request url is an interface address bound to the server by the channel party; the request sensitive parameter is plaintext data, and may include multiple parameters; the sequence number is a number, which serves to sort the request message.
  • the security application detects that the data of the transmission process of the request message is a plaintext transmission, and the security application records the related information of the request message in the database redis of the security application. It should be noted that, regardless of whether the request message sent by the channel is a plaintext transmission or a ciphertext transmission, the security application needs to transfer the request message to the backend server.
  • the matching degree between the keyword and the parameter is greater than the preset threshold, it indicates that the parameter cannot be determined in the meaning of the request message. At this time, it is determined that the request message is ciphertext transmission, and there is no risk of information leakage. When the request message is ciphertext transmission, it is determined that the information of the request message is not leaked, and it is not necessary to record related information of the request message.
  • the data with security risks stored in the database may be exported, that is, the relevant information of the request message recorded in the database is exported, and the relevant security test personnel perform corresponding processing.
  • the server when the channel direction server delivers the http request message, the server receives the request message, wherein the request message includes parameters including Username, passwd, IDCard, and the like.
  • the server matches the parameters included in the request message with the keywords obtained by the pre-machine learning, and determines that the values of the parameters Username, passwd, IDCard, etc. are plaintext transmission, that is, the user name Username is aaaaaa, the password passwd is bbbbb, and the bank card number IDCard is 4205xxxxxxxxxx11, at this time, it is determined that the information of the request message is leaked, and the related information of the request message is recorded.
  • the request message sent by the channel is received, and the parameter included in the request message is matched with the keyword obtained by the pre-machine learning, and the parameter included in the request message is obtained between the parameter included in the request message and the keyword obtained by the pre-machine learning.
  • the matching degree between the parameter and the keyword is greater than a preset threshold, it is determined that the information of the request message is leaked, and related information of the request message is recorded. Therefore, by machine learning to automatically identify more keywords, it is possible to identify sensitive information substantially and effectively, reduce the duplication of safety testers, improve the efficiency of information leakage detection and reduce the risk of information leakage.
  • the matching module 200 may include:
  • the first determining unit is configured to match the parameter included in the request message with a keyword obtained by machine learning in advance, and determine a first matching degree between the parameter and the keyword.
  • a second determining unit configured to determine, according to the first matching degree and a context of the parameter in the request message, a degree of matching between the parameter and the keyword.
  • the first determining unit compares the parameters with the keywords, and determines the parameter and the keyword. The first match.
  • multiple parameters may be compared with each keyword to determine the first matching degree between each parameter and the keyword.
  • the second determining unit performs weighting calculation according to the matching degree corresponding to each parameter, and obtains a first matching degree between the plurality of parameters and the keyword, and then determines according to the first matching degree and the context of the parameter in the request message. The degree of matching between this parameter and the keyword.
  • the name message is included in the request message received by the server, the name is determined by the probability algorithm, and the name is the name of the name.
  • the possible probability ie, the first matching degree
  • the possible probability of the account meaning ie, the first matching degree
  • a password parameter such as password
  • the server In the process of matching the parameters included in the request message with the keywords obtained by the machine learning in advance, the server first determines the first matching degree between the parameter and the keyword through the probability algorithm, and then uses the decision tree algorithm according to the first A matching degree and a context of the parameter in the request message determine a matching degree between the parameter and the keyword, thereby improving the accuracy and reliability of the matching degree acquisition.
  • the matching module 200 may further include:
  • the splitting unit is configured to split the parameters included in the request message into the first sub-parameter and the second sub-parameter according to the keyword obtained by the pre-machine learning.
  • a matching unit configured to match the first sub-parameter and the second sub-parameter with a keyword obtained by pre-machine learning, and determine a first probability that the first sub-parameter matches the first keyword, and The second probability that the second sub-parameter matches the second keyword.
  • a third determining unit configured to determine, according to the first probability, the second probability, and a context of the parameter in the request message, a degree of matching between the parameter and the keyword.
  • the splitting unit first splits the parameters included in the request message according to the keywords obtained by the pre-machine learning.
  • a plurality of sub-parameters for example, can be split into a first sub-parameter and a second sub-parameter.
  • the first sub-parameter and the second sub-parameter are respectively matched by the matching unit to the keyword obtained by the pre-machine learning, and the first probability that the first sub-parameter matches the first keyword is determined according to the probabilistic algorithm, and the second sub-determination is determined.
  • the second probability that the parameter matches the second keyword.
  • determining, by the third determining unit, the first probability, the second probability, and the context of the parameter in the request message, the degree of matching between the parameter and the keyword so as to determine the parameter in the request message according to the matching degree.
  • the request message may be according to the first probability and the parameter. a context, calculating a third probability that the first sub-parameter matches the first keyword, and determining a fourth probability that the second sub-parameter matches the second keyword according to the second probability and a context of the parameter in the request message . Finally, the magnitudes of the third probability and the fourth probability are compared, and the larger of the third probability and the fourth probability is set as the parameter and the keyword.
  • determining the degree of matching between the parameters and the keywords may also be flexibly set according to specific circumstances, and does not limit the present invention.
  • the flagname is first split to obtain the flag and the name, wherein the flag is selected due to multiple training encounters of the mark and the identifier, and the name is multiple times. Training to meet names, accounts, etc. will be selected. It is determined by various algorithms that the flagname is used to mark the possible probability of 40%, the flagname is used for the account name with a probability of 60%, and then the password parameter, such as password, appears in the following in the request message according to the parameter, and the flagname is determined as the account at this time.
  • the possible probability is 90%, that is, the decision tree algorithm determines that the matching degree between the parameter flagname and the keyword account is 90%.
  • the server may split the parameter, and then determine the matching degree between the parameter and the keyword according to the probabilistic algorithm and the decision tree algorithm according to the split sub-parameter and the context of the parameter in the request message.
  • the information leakage detecting apparatus in the embodiment further includes:
  • the determining module 400 is configured to determine whether the identifier of the non-sensitive information set by the channel side exists in the request message.
  • the second determining module 500 is configured to determine that the information of the request message is not leaked when the identifier of the non-sensitive information set by the channel party exists in the request message.
  • the fourth embodiment of the information leakage detecting apparatus of the present invention may also be proposed based on the second or third embodiment of the information leakage detecting apparatus.
  • the channel side may identify the request message that needs to be transmitted in plaintext, and set the request message that needs to be transmitted in plaintext as non-sensitive information.
  • the determining module 400 may first determine whether the identifier of the non-sensitive information set by the channel side exists in the request message. When the identifier of the non-sensitive information set by the channel side exists in the request message, the second determining module 500 determines that the information of the request message is not leaked, even if the request message is a plaintext transmission, indicating that the request message does not have the risk of information leakage. There is no need to record information about the request message.
  • the server of the embodiment After receiving the request message sent by the channel side, the server of the embodiment determines that the information of the request message is not leaked when it is determined that the identifier of the non-sensitive information set by the channel side exists in the request message. It ensures that the requested message can be transmitted in plain text, which improves the reliability of information leakage detection.
  • a fifth embodiment of the information leakage detecting device of the present invention is proposed.
  • the information leakage detection is performed.
  • the device also includes:
  • the obtaining module 600 is configured to obtain a response data packet returned to the channel side based on the request message.
  • the comparison module 700 is configured to compare information included in the response data packet with a target parameter in a field corresponding to pre-recording the request message.
  • the third determining module 800 is configured to: when the response data packet includes more information than the target parameter in the field, determine that the information of the response data packet is leaked, and record related information of the response data packet. .
  • the server when the server receives the request message sent by the channel and feeds back the response packet to the channel according to the request message, in order to further reduce the risk of information leakage, the response packet needs to be detected.
  • the server when the server receives the request message sent by the channel, the server records the target parameter in the corresponding field of the request message according to the request message. Then, the server call obtaining module 600 obtains a response data packet returned to the channel side based on the request message, and the comparison module 700 compares the information included in the response data packet with the target parameter in the corresponding field of the pre-recorded request message, and determines the response data packet. Whether the included information is more than the target parameter in the field corresponding to the pre-recorded request message.
  • the third determining module 800 determines that the information of the response data packet is leaked, and records related information of the response data packet, and the related information may include more than the target parameter.
  • the related information of the response data packet may be stored in a preset database, and the record field may include related information such as a request url, a sensitive parameter, a serial number, and the like of the response data packet.
  • the request url is an interface address that the channel party binds to the server;
  • the sensitive parameter is data that is more than the target parameter, and may include multiple parameters;
  • the serial number is a number, which serves to sort the response data packet.
  • the response packet may be detected by the security application by using the preset security application relay.
  • the server when the channel direction server requests to query the page of the transaction record, the server will need to return to the channel side html page field record, where the request is the page, and the bank card number has not been entered yet for query.
  • the transaction record includes the transaction amount and transaction time, and the html page field records the transaction amount and transaction time.
  • the server When the subsequent channel sends a bank card number to the server to initiate an http query request, when the bank card number is entered for inquiry, when the bank card parameter is matched to the bank card number, the server records it, and then returns the response packet and the recorded web page according to the bank card number.
  • the parameters in the field are compared. If the returned parameters are more than the parameters recorded in the field, the server returns more information than the channel party's business requirements.
  • the request url, sensitive parameters, and serial number are recorded in the database redis.
  • a page of the channel bank website is used to query the transaction record according to the bank card number input by the user, and the response packet returned by the server according to the request includes the transaction amount of 1000, the transaction time is 20160101, and the transaction user is test.
  • the transaction user's bank card number is xxxxx, the merchant name is aaa; the transaction amount is 400, the transaction time is 20161201, the transaction user is bbb, the transaction user bank card number is aaaa, the merchant name is cccc, etc., which shows the channel business here. All that is required is transaction data, but the returned information also contains the user's identity information, etc., and there are too many returned information, and it is judged that sensitive information may be leaked.
  • the data with security risks stored in the database may be exported, that is, the relevant information of the response data packets recorded in the database is exported, and the relevant security test personnel perform corresponding processing.
  • the server determines, by comparing the response data packet based on the request message with the target parameter required by the request message, which parameters in the response data packet are more than the target parameter required by the request message, and the excess parameter relates to Sensitive information and record information about the response packet. Therefore, the information returned by the interface is not the data that the front-end channel page needs to display, and it is judged as sensitive information leakage, and automatic detection is realized, and manual detection is avoided, which not only improves the efficiency of information leakage detection, but also reduces The risk of information disclosure.
  • the foregoing receiving module 100, the matching module 200, the first determining module 300, and the like may be embedded in the hardware leakage detection device or may be stored in the memory of the information leakage detecting device in software.
  • the processor can be a central processing unit (CPU), a microprocessor, a microcontroller, or the like.
  • FIG. 9 is a schematic structural diagram of a server in a hardware operating environment according to an embodiment of the present invention.
  • the server may include a processor 1001, a communication bus 1002, a memory 1003, and a communication interface 1004.
  • the communication bus 1002 is used to implement connection communication between these components.
  • the memory 1003 may be a high speed RAM memory or a stable memory (non-volatile) Memory), such as disk storage.
  • the memory 1003 can also optionally be a storage device independent of the aforementioned processor 1001.
  • the communication interface 1004 can include a user interface (not shown in FIG. 9) and/or a network interface (not shown in FIG. 9), wherein the user interface can be used to connect input/output devices such as a display screen and a keyboard, and the network interface can be used. Connect to the network, including wired networks and/or wireless networks.
  • server structure illustrated in FIG. 9 does not constitute a limitation to the server, and may include more or less components than those illustrated, or some components may be combined, or different component arrangements.
  • an operating system, a network communication module, and an information leakage detecting program may be included in the memory 1003 as a computer storage medium.
  • the processor 1001 can be used to call the information leak detection program stored in the memory 1003 and perform the following operations:
  • the matching degree is greater than the preset threshold, determining that the information of the request message is leaked, and recording related information of the request message.
  • processor 1001 may execute an information leakage detection program stored in the memory 1003 to implement the following operations:
  • processor 1001 may execute an information leakage detection program stored in the memory 1003 to implement the following operations:
  • processor 1001 may execute an information leakage detection program stored in the memory 1003 to implement the following operations:
  • processor 1001 may execute an information leakage detection program stored in the memory 1003 to implement the following operations:
  • the response data packet contains more information than the target parameter in the field, it is determined that the information of the response data packet is leaked, and related information of the response data packet is recorded.
  • the request message sent by the channel is received, and the parameter included in the request message is matched with the keyword obtained by the pre-machine learning, and the parameter included in the request message is obtained between the parameter included in the request message and the keyword obtained by the pre-machine learning.
  • the matching degree between the parameter and the keyword is greater than a preset threshold, it is determined that the information of the request message is leaked, and related information of the request message is recorded. Therefore, by machine learning to automatically identify more keywords, it is possible to identify sensitive information substantially and effectively, reduce the duplication of safety testers, improve the efficiency of information leakage detection and reduce the risk of information leakage.
  • the present invention provides a computer readable storage medium storing one or more programs, the one or more programs being executable by one or more processors to implement the following steps:
  • the matching degree is greater than the preset threshold, determining that the information of the request message is leaked, and recording related information of the request message.
  • the computer readable storage medium storage is further configured to: match a parameter included in the request message with a keyword obtained by pre-machine learning, and obtain between the parameter and the keyword based on a matching result. Steps to match the degree:
  • the computer readable storage medium storage is further configured to: match a parameter included in the request message with a keyword obtained by pre-machine learning, and obtain between the parameter and the keyword based on a matching result. Steps to match the degree:
  • the computer readable storage medium stores steps further for implementing a request message sent by the receiving channel side:
  • the computer readable storage medium storage is further configured to implement the following steps:
  • the response data packet contains more information than the target parameter in the field, it is determined that the information of the response data packet is leaked, and related information of the response data packet is recorded.
  • a person skilled in the art may understand that all or part of the steps of implementing the above embodiments may be completed by hardware, or may be instructed by a program to execute related hardware, and the program may be stored in a computer readable storage medium.
  • the storage medium mentioned may be a read only memory, a magnetic disk or an optical disk or the like.

Landscapes

  • Engineering & Computer Science (AREA)
  • Theoretical Computer Science (AREA)
  • General Engineering & Computer Science (AREA)
  • Physics & Mathematics (AREA)
  • General Physics & Mathematics (AREA)
  • Software Systems (AREA)
  • Computer Security & Cryptography (AREA)
  • Databases & Information Systems (AREA)
  • Health & Medical Sciences (AREA)
  • General Health & Medical Sciences (AREA)
  • Computer Hardware Design (AREA)
  • Bioethics (AREA)
  • Data Mining & Analysis (AREA)
  • Computational Linguistics (AREA)
  • Artificial Intelligence (AREA)
  • Medical Informatics (AREA)
  • Audiology, Speech & Language Pathology (AREA)
  • Computing Systems (AREA)
  • Computer Vision & Pattern Recognition (AREA)
  • Evolutionary Computation (AREA)
  • Mathematical Physics (AREA)
  • Signal Processing (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Technology Law (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)
  • Storage Device Security (AREA)
  • Information Transfer Between Computers (AREA)

Abstract

本发明公开了一种信息泄露检测方法，包括：接收渠道方发送的请求消息；将所述请求消息中包含的参数与预先机器学习得到的关键字进行匹配，并基于匹配结果获取所述参数与所述关键字之间的匹配度；当所述匹配度大于预设阈值时，确定所述请求消息的信息被泄露，并记录所述请求消息的相关信息。本发明还公开了一种信息泄露检测装置、服务器及计算机可读存储介质。本发明通过机器学习自动识别更多的关键字，能够大幅有效地识别出敏感信息，减少安全测试人员重复劳动，提高了对信息泄露检测的效率及降低信息泄露的风险。

Description

信息泄露检测方法及装置、服务器及计算机可读存储介质
本申请要求于2017年03月17日提交中国专利局、申请号为201710164043.7、发明名称为“信息泄露检测方法及装置”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本发明涉及信息安全技术领域，尤其涉及一种信息泄露检测方法及装置、服务器及计算机可读存储介质。
背景技术
目前，为了保障用户的信息安全，服务器通过web应用漏洞扫描器对信息泄露进行检测的过程中，仅仅预先定义敏感信息对应的特定关键字，例如email，username等，将扫描记录的参数与该关键字进行对比，当扫描记录的参数中存在与该关键字一致的参数时，说明存在敏感信息明文传输，即存在信息泄露的风险。但是若新开发的***http请求中的参数出现USERNAME，而特定关键字包括username，不包括USERNAME，则无法识别匹配，或者http请求中的参数出现uname也无法识别匹配，这就可能导致敏感信息明文传输，信息泄露的风险。
因此，该方法比较粗暴地判断是否存在敏感信息明文传输，需要安全测试人员付出较多的劳动力进行后续的分析检查工作，不仅降低了识别出敏感信息泄露的效率，而且减少了安全测试人员重复劳动。
发明内容
本发明的主要目的在于提供一种信息泄露检测方法及装置、服务器及计算机可读存储介质，旨在提高对信息泄露检测的效率及降低信息泄露的风险。
为实现上述目的，本发明提供了一种信息泄露检测方法，包括：
接收渠道方发送的请求消息；
将所述请求消息中包含的参数与预先机器学习得到的关键字进行匹配，并基于匹配结果获取所述参数与所述关键字之间的匹配度；
当所述匹配度大于预设阈值时，确定所述请求消息的信息被泄露，并记录所述请求消息的相关信息。
此外，为实现上述目的，本发明还提供了一种信息泄露检测装置，包括：
接收模块，用于接收渠道方发送的请求消息；
匹配模块，用于将所述请求消息中包含的参数与预先机器学习得到的关键字进行匹配，并基于匹配结果获取所述参数与所述关键字之间的匹配度；
第一确定模块，用于当所述匹配度大于预设阈值时，确定所述请求消息的信息被泄露，并记录所述请求消息的相关信息。
此外，为实现上述目的，本发明还提供了一种服务器，所述服务器包括处理器及存储器，所述处理器用于执行存储器中存储的信息泄露检测程序，以实现以下步骤：
接收渠道方发送的请求消息；
将所述请求消息中包含的参数与预先机器学习得到的关键字进行匹配，并基于匹配结果获取所述参数与所述关键字之间的匹配度；
当所述匹配度大于预设阈值时，确定所述请求消息的信息被泄露，并记录所述请求消息的相关信息。
此外，为实现上述目的，本发明还提供了一种计算机可读存储介质，所述计算机可读存储介质存储有一个或者多个程序，所述一个或者多个程序被一个或者多个处理器用来执行，以实现以下步骤：
接收渠道方发送的请求消息；
将所述请求消息中包含的参数与预先机器学习得到的关键字进行匹配，并基于匹配结果获取所述参数与所述关键字之间的匹配度；
当所述匹配度大于预设阈值时，确定所述请求消息的信息被泄露，并记录所述请求消息的相关信息。
本发明实施例通过接收渠道方发送的请求消息，将该请求消息中包含的参数与预先机器学习得到的关键字进行匹配，获取请求消息中包含的参数与预先机器学习得到的关键字之间的匹配度。当该参数与该关键字之间的匹配度大于预设阈值时，确定该请求消息的信息被泄露，并记录该请求消息的相关信息。从而通过机器学习自动识别更多的关键字，能够大幅有效地识别出敏感信息，减少安全测试人员重复劳动，提高了对信息泄露检测的效率及降低信息泄露的风险。
附图说明
图1为本发明信息泄露检测方法第一实施例的流程示意图；
图2为本发明信息泄露检测方法第二实施例的流程示意图；
图3为本发明信息泄露检测方法第三实施例的流程示意图；
图4为本发明信息泄露检测方法第四实施例的流程示意图；
图5为本发明信息泄露检测方法第五实施例的流程示意图；
图6为本发明信息泄露检测装置第一实施例的功能模块示意图；
图7为本发明信息泄露检测装置第四实施例的功能模块示意图；
图8为本发明信息泄露检测装置第五实施例的功能模块示意图；
图9为本发明实施例方案涉及的硬件运行环境的服务器结构示意图。
本发明目的的实现、功能特点及优点将结合实施例，参照附图做进一步说明。
具体实施方式
应当理解，此处所描述的具体实施例仅仅用以解释本发明，并不用于限定本发明。
如图1所示，示出了本发明一种信息泄露检测方法第一实施例。该实施例的信息泄露检测方法包括：
步骤S10、接收渠道方发送的请求消息。
本实施例中，信息泄露检测方法应用于服务器，主要是对接口敏感信息泄露进行检测。服务器为前端渠道方对应的后端服务器，当服务器接收到渠道方发送的http请求消息或根据请求消息返回响应数据包至渠道方时，均会对请求消息或响应数据包进行检测，以防止信息泄露。
优选地，该服务器可预先设置有安全应用，该安全应用用于拦截渠道方发送至服务器的http请求消息进行信息泄露检测，或者截取服务器根据请求消息返回至渠道方的响应数据包进行信息泄露检测。即渠道方向服务器发送http请求消息或服务器向渠道方反馈响应数据包时，可经过安全应用中转。
渠道方为被测试的产品，包括网银、银行后台app等，该app可运行于PC、手机等终端。渠道方可根据自己的使用需求向服务器发送请求消息，服务器可接收渠道方发送的请求消息，该请求消息包括输入账号密码、登录、发送信息、打开界面等。
步骤S20、将所述请求消息中包含的参数与预先机器学习得到的关键字进行匹配，并基于匹配结果获取所述参数与所述关键字之间的匹配度。
本实施例中，服务器可通过预置的安全应用预先进行机器学习，以识别多个关键字，即预先通过机器学习自动识别更多的关键词，例如，电子邮件、email、e-mail、Email、EMAIL等，而不是仅仅简单的识别email而已。
具体地，基于机器学习的方式中，首先通过对样本的大量学习识别得到关键字，例如username、Username、USERNANME、user、name等。对于简单的字母大小写变换，可以直接识别出，例如username、Username、UserName等；对于常用词汇也可以直接识别出，例如username、uname、name等，对于其他情况还可以通过机器学习中的决策树算法和概率算法等选择最可能的概率进行识别匹配。以下实施例将进行详细说明。
在进行机器学习后可记录下大量的关键字，当服务器接收到渠道方发送的请求消息时，判断该请求消息是明文传输还是密文传输，即将请求消息中包含的参数与预先机器学习得到的关键字进行匹配，获取请求消息中包含的参数与预先机器学习得到的关键字之间的匹配度，以便根据匹配度确定该参数在请求消息中的含义。当该请求消息是明文传输时，该请求消息中包含的参数可包括Email、username、passwd、flagname等一些词语；当该请求消息是密文传输时，该请求消息中包含的参数为一些乱码。
步骤S30、当所述匹配度大于预设阈值时，确定所述请求消息的信息被泄露，并记录所述请求消息的相关信息。
在得到请求消息中包含的参数与预先机器学习得到的关键字之间的匹配度后，判断该匹配度是否大于预设阈值，该预设阈值可根据具体情况而灵活设置。
当存在关键字与该参数之间的匹配度大于预设阈值时，确定该参数在请求消息的含义为该关键字对应的含义，在确定出该参数在请求消息的含义后，即可判定该请求消息为明文传输，将会存在信息泄露的风险。此时确定请求消息的信息被泄露，同时记录该请求消息的相关信息，可将该请求消息的相关信息存储至预置的数据库中。记录字段中可包括该请求消息的请求url（url为统一资源***）、请求敏感参数、序号等相关信息。该请求url为渠道方绑定到服务器的接口地址；该请求敏感参数为明文数据，可包括多个参数；该序号即为编号，起到对请求消息的排序作用。
优选地，当服务器通过安全应用中转时，安全应用检测到请求消息的传输过程的数据是明文传输时，安全应用将该请求消息的相关信息记录在安全应用的数据库redis中。需要说明的是，不管渠道方发送的请求消息是明文传输还是密文传输，安全应用都需要将请求消息中转至后端服务器。
当不存在关键字与该参数之间的匹配度大于预设阈值时，说明无法确定该参数在请求消息的含义，此时判定该请求消息为密文传输，不存在信息泄露的风险。当该请求消息为密文传输时，确定请求消息的信息未被泄露，不需要记录该请求消息的相关信息。
在检测完成后，可将数据库中存储的存在安全风险的数据导出，即将数据库中所记录的请求消息的相关信息导出，由相关安全测试人员进行相应的处理。
以下将进行举例说明，当渠道方向服务器传递http请求消息时，服务器接收该请求消息，其中该请求消息包含的参数包括Username、passwd、IDCard等。服务器将该请求消息包含的参数与预先机器学习得到的关键字进行匹配，确定参数Username、passwd、IDCard等的值是明文传输，即确定用户名Username为aaaaaa、密码passwd为bbbbb、银行***IDCard为4205xxxxxxxxxxxx11，此时确定该请求消息的信息被泄露，并记录请求消息的相关信息。
本发明实施例通过接收渠道方发送的请求消息，将该请求消息中包含的参数与预先机器学习得到的关键字进行匹配，获取请求消息中包含的参数与预先机器学习得到的关键字之间的匹配度。当该参数与该关键字之间的匹配度大于预设阈值时，确定该请求消息的信息被泄露，并记录该请求消息的相关信息。从而通过机器学习自动识别更多的关键字，能够大幅有效地识别出敏感信息，减少安全测试人员重复劳动，提高了对信息泄露检测的效率及降低信息泄露的风险。
进一步地，如图2所示，基于上述信息泄露检测方法第一实施例，提出了本发明信息泄露检测方法第二实施例，该实施例中上述步骤S20可包括：
步骤S21、将所述请求消息中包含的参数与预先机器学习得到的关键字进行匹配，确定所述参数与所述关键字之间的第一匹配度。
步骤S22、根据所述第一匹配度及所述参数在所述请求消息中的上下文，确定所述参数与所述关键字之间的匹配度。
本实施例中，服务器在将请求消息中包含的参数与预先机器学习得到的关键字进行匹配的过程中，首先将参数与关键字进行比对，确定该参数与关键字之间的第一匹配度。当存在多个参数时，可将多个参数分别与各个关键字进行比对，确定各个参数与关键字之间的匹配度。然后，根据各个参数所对应的匹配度进行加权计算，得到多个参数与关键字之间的第一匹配度，再根据第一匹配度及该参数在请求消息中的上下文，确定该参数与关键字之间的匹配度。
以下将进行举例说明，当服务器接收到的请求消息中包括name时，name由于在机器学习的过程中多次训练遇见取名、账户等会被确定出来，通过概率算法判断name为取名含义的可能概率（即第一匹配度）为30%，为账户含义可能概率（即第一匹配度）为70%，然后根据该参数在请求消息中的下文中出现密码参数，例如password，此时通过决策树算法确定name为账户含义的匹配度为95%。
本实施例服务器在将请求消息中包含的参数与预先机器学习得到的关键字进行匹配的过程中，首先通过概率算法确定参数与关键字之间的第一匹配度，再通过决策树算法根据第一匹配度及该参数在所述请求消息中的上下文，确定该参数与关键字之间的匹配度，提高了匹配度获取的准确性及可靠性。
进一步地，如图3所示，基于上述信息泄露检测方法第一实施例，提出了本发明信息泄露检测方法第三实施例，该实施例中上述步骤S20还可包括：
步骤S23、根据预先机器学习得到的关键字对所述请求消息中包含的参数拆分为第一子参数和第二子参数。
步骤S24、将所述第一子参数和所述第二子参数分别与预先机器学习得到的关键字进行匹配，确定所述第一子参数与第一关键字匹配的第一概率，及所述第二子参数与第二关键字匹配的第二概率。
步骤S25、根据所述第一概率、所述第二概率及所述参数在所述请求消息中的上下文，确定所述参数与所述关键字之间的匹配度。
本实施例中，服务器在将请求消息中包含的参数与预先机器学习得到的关键字进行匹配的过程中，首先根据预先机器学习得到的关键字对请求消息中包含的参数拆分多个子参数，例如可拆分为第一子参数和第二子参数。然后将第一子参数和第二子参数分别与预先机器学习得到的关键字进行匹配，根据概率算法确定第一子参数与第一关键字匹配的第一概率，及确定第二子参数与第二关键字匹配的第二概率。再通过决策树算法根据第一概率、第二概率及该参数在请求消息中的上下文，该参数与关键字之间的匹配度，以便根据该匹配度确定参数在请求消息中的含义。
可选地，在确定第一子参数与第一关键字匹配的第一概率，及确定第二子参数与第二关键字匹配的第二概率后，可根据第一概率及该参数在请求消息中的上下文，计算第一子参数与第一关键字匹配的第三概率，以及根据第二概率及该参数在请求消息中的上下文，确定第二子参数与第二关键字匹配的第四概率。最后比较第三概率和第四概率的大小，将第三概率与第四概率中较大者设定为该参数与关键字。当然，确定参数与关键字之间的匹配度还可根据具体情况而灵活设置，并不限定本发明。
以下将进行举例说明，当服务器接收到的请求消息中包括flagname时，首先将flagname进行拆分得到flag和name，其中flag由于多次训练遇见标记、标识的情况会被选择出来，name由于多次训练遇见姓名、账户等会被选择出来。通过多种算法判定flagname用于标记可能概率为40%，flagname用于账户姓名可能概率为60%，然后根据该参数在请求消息中的下文中出现密码参数，例如password，此时flagname确定作为账户的可能概率为90%，即通过决策树算法确定参数flagname与关键字账户之间的匹配度为90%。
本实施例服务器可对参数进行拆分，然后根据拆分得到的子参数通过概率算法及决策树算法、及该参数在请求消息中的上下文，确定该参数与关键字之间的匹配度。从而可以有效地识别出敏感信息，提高对信息泄露检测的效率。
进一步地，如图4所示，基于上述信息泄露检测方法第一实施例，提出了本发明信息泄露检测方法第四实施例，该实施例中上述步骤S10之后包括：
步骤S40、判断所述请求消息中是否存在所述渠道方设置的非敏感信息的标识。
步骤S50、当所述请求消息中存在所述渠道方设置的非敏感信息的标识时，确定所述请求消息的信息未被泄露。
需要说明的是，本发明信息泄露检测方法第四实施例，也可以是基于上述信息泄露检测方法第二或第三实施例提出。
本实施例中，由于存在某些请求消息规定进行明文传输，因此渠道方可以对需要进行明文传输的请求消息进行标识，将该类需要进行明文传输的请求消息设定为非敏感信息。
在服务器接收到渠道方发送的请求消息时，可首先判断该请求消息中是否存在渠道方设置的非敏感信息的标识。当请求消息中存在渠道方设置的非敏感信息的标识时，确定该请求消息的信息未被泄露，即使该请求消息为明文传输，也说明该请求消息不存在信息泄露的风险，不需要记录该请求消息的相关信息。
本实施例服务器在接收到渠道方发送的请求消息后，当判定请求消息中存在渠道方设置的非敏感信息的标识时，确定请求消息的信息未被泄露。保证了有需求的请求消息可进行明文传输，提高了对信息泄露检测的可靠性。
进一步地，如图5所示，基于上述信息泄露检测方法第一、第二、第三或第四实施例，提出了本发明信息泄露检测方法第五实施例，该实施例中上述信息泄露检测方法还包括：
步骤S60、获取基于所述请求消息返回至所述渠道方的响应数据包。
步骤S70、将所述响应数据包所包含的信息与预先记录所述请求消息对应字段中的目标参数进行对比。
步骤S80、当所述响应数据包所包含的信息多于所述字段中的目标参数时，确定所述响应数据包的信息被泄露，并记录所述响应数据包的相关信息。
需要说明的是，本发明信息泄露检测方法第五实施例中的步骤S60，可以在上述步骤S10之后执行，也可以是在上述步骤S20或步骤S30或步骤S40或步骤S50之后执行。
本实施例中，当服务器接收到渠道方发送的请求消息，根据请求消息反馈响应数据包至渠道方时，为了进一步降低信息泄露的风险，还需要对响应数据包进行检测。
具体地，首先服务器在接收到渠道方发送的请求消息时，根据该请求消息将请求消息对应字段中的目标参数进行记录。然后服务器获取基于请求消息返回至渠道方的响应数据包，将响应数据包所包含的信息与预先记录请求消息对应字段中的目标参数进行对比，判断响应数据包所包含的信息是否多于与预先记录请求消息对应字段中的目标参数。当响应数据包所包含的信息多于字段中的目标参数时，确定该响应数据包的信息被泄露，同时记录响应数据包的相关信息，该相关信息可以包括多于目标参数的数据。可将该响应数据包的相关信息存储至预置的数据库中，记录字段中可包括该响应数据包的请求url、敏感参数、序号等相关信息。该请求url为渠道方绑定到服务器的接口地址；该敏感参数为多于目标参数的数据，可包括多个参数；该序号即为编号，起到对响应数据包的排序作用。
优选地，当服务器返回响应数据包给渠道方时，可通过预置的安全应用中转，由安全应用对响应数据包进行检测。
以下将进行举例说明，当渠道方向服务器请求查询交易记录的页面时，服务器将需要返回至渠道方的html网页字段记录下来，这里请求的是页面，此时还没有输入银行***进行查询。该交易记录包括交易金额和交易时间，html网页字段记录交易金额和交易时间。后续渠道方发送银行***向服务器发起http查询请求时，即输入银行***进行查询时，当匹配到银行***bankcard参数时，服务器将其记录，然后将根据银行***返回的响应数据包与记录的网页字段中的参数进行对比，若检测到返回的参数多于字段中记录的参数，则说明服务器返回信息多于渠道方业务要求的信息，此时记录该请求url、敏感参数、序号到数据库redis中。例如，渠道方银行网站某一个页面，该面用来根据用户输入的银行***查询交易记录，而服务器根据请求返回的响应数据包中包括交易金额为1000，交易时间为20160101，交易用户为test，交易用户银行***为xxxxx，商户名为aaa；交易金额为400，交易时间为20161201，交易用户为bbb，交易用户银行***为aaaa，商户名为cccc等等的数据，由此可见这里渠道方业务要求的只是交易数据，但是返回的却还包含了用户的身份信息等，就出现返回信息过多的情况，判定可能出现敏感信息泄露。
最后检测完成后，可将数据库中存储的存在安全风险的数据导出，即将数据库中所记录的响应数据包的相关信息导出，由相关安全测试人员进行相应的处理。
本实施例服务器通过对比基于请求消息的返回的响应数据包和该请求消息所需要的目标参数，判断响应数据包中哪些参数多于该请求消息所需要的目标参数，该多出的参数涉及到敏感信息，并记录响应数据包的相关信息。从而实现了对于有的接口返回的信息并非前端渠道方页面需要显示的数据，将其判断为敏感信息泄露，且实现了自动检测，避免人工检测，不仅提高了对信息泄露检测的效率，而且降低信息泄露的风险。
本领域普通技术人员可以理解实现上述实施例的全部或部分步骤可以通过硬件来完成，也可以通过程序来指令相关的硬件完成，所述的程序可以存储于一种计算机可读存储介质中，上述提到的存储介质可以是只读存储器，磁盘或光盘等。
对应地，如图6所示，提出本发明一种信息泄露检测装置第一实施例。该实施例的信息泄露检测装置包括：
接收模块100，用于接收渠道方发送的请求消息。
本实施例中，信息泄露检测装置应用于服务器，主要是对接口敏感信息泄露进行检测。服务器为前端渠道方对应的后端服务器，当服务器接收到渠道方发送的http请求消息或根据请求消息返回响应数据包至渠道方时，均会对请求消息或响应数据包进行检测，以防止信息泄露。
优选地，该服务器可预先设置有安全应用，该安全应用用于拦截渠道方发送至服务器的http请求消息进行信息泄露检测，或者截取服务器根据请求消息返回至渠道方的响应数据包进行信息泄露检测。即渠道方向服务器发送http请求消息或服务器向渠道方反馈响应数据包时，可经过安全应用中转。
渠道方为被测试的产品，包括网银、银行后台app等，该app可运行于PC、手机等终端。渠道方可根据自己的使用需求向服务器发送请求消息，服务器可调用接收模块100接收渠道方发送的请求消息，该请求消息包括输入账号密码、登录、发送信息、打开界面等。
匹配模块200，用于将所述请求消息中包含的参数与预先机器学习得到的关键字进行匹配，并基于匹配结果获取所述参数与所述关键字之间的匹配度。
本实施例中，服务器可通过预置的安全应用预先进行机器学习，以识别多个关键字，即预先通过机器学习自动识别更多的关键词，例如，电子邮件、email、e-mail、Email、EMAIL等，而不是仅仅简单的识别email而已。
具体地，基于机器学习的方式中，首先通过对样本的大量学习识别得到关键字，例如username、Username、USERNANME、user、name等。对于简单的字母大小写变换，可以直接识别出，例如username、Username、UserName等；对于常用词汇也可以直接识别出，例如username、uname、name等，对于其他情况还可以通过机器学习中的决策树算法和概率算法等选择最可能的概率进行识别匹配。以下实施例将进行详细说明。
在进行机器学习后可记录下大量的关键字，当服务器接收到渠道方发送的请求消息时，判断该请求消息是明文传输还是密文传输，即由匹配模块200将请求消息中包含的参数与预先机器学习得到的关键字进行匹配，获取请求消息中包含的参数与预先机器学习得到的关键字之间的匹配度，以便根据匹配度确定该参数在请求消息中的含义。当该请求消息是明文传输时，该请求消息中包含的参数可包括Email、username、passwd、flagname等一些词语；当该请求消息是密文传输时，该请求消息中包含的参数为一些乱码。
第一确定模块300，用于当所述匹配度大于预设阈值时，确定所述请求消息的信息被泄露，并记录所述请求消息的相关信息。
在得到请求消息中包含的参数与预先机器学习得到的关键字之间的匹配度后，判断该匹配度是否大于预设阈值，该预设阈值可根据具体情况而灵活设置。
当存在关键字与该参数之间的匹配度大于预设阈值时，第一确定模块300确定该参数在请求消息的含义为该关键字对应的含义，在确定出该参数在请求消息的含义后，即可判定该请求消息为明文传输，将会存在信息泄露的风险。此时确定请求消息的信息被泄露，同时记录该请求消息的相关信息，可将该请求消息的相关信息存储至预置的数据库中。记录字段中可包括该请求消息的请求url（url为统一资源***）、请求敏感参数、序号等相关信息。该请求url为渠道方绑定到服务器的接口地址；该请求敏感参数为明文数据，可包括多个参数；该序号即为编号，起到对请求消息的排序作用。
优选地，当服务器通过安全应用中转时，安全应用检测到请求消息的传输过程的数据是明文传输时，安全应用将该请求消息的相关信息记录在安全应用的数据库redis中。需要说明的是，不管渠道方发送的请求消息是明文传输还是密文传输，安全应用都需要将请求消息中转至后端服务器。
当不存在关键字与该参数之间的匹配度大于预设阈值时，说明无法确定该参数在请求消息的含义，此时判定该请求消息为密文传输，不存在信息泄露的风险。当该请求消息为密文传输时，确定请求消息的信息未被泄露，不需要记录该请求消息的相关信息。
在检测完成后，可将数据库中存储的存在安全风险的数据导出，即将数据库中所记录的请求消息的相关信息导出，由相关安全测试人员进行相应的处理。
以下将进行举例说明，当渠道方向服务器传递http请求消息时，服务器接收该请求消息，其中该请求消息包含的参数包括Username、passwd、IDCard等。服务器将该请求消息包含的参数与预先机器学习得到的关键字进行匹配，确定参数Username、passwd、IDCard等的值是明文传输，即确定用户名Username为aaaaaa、密码passwd为bbbbb、银行***IDCard为4205xxxxxxxxxxxx11，此时确定该请求消息的信息被泄露，并记录请求消息的相关信息。
本发明实施例通过接收渠道方发送的请求消息，将该请求消息中包含的参数与预先机器学习得到的关键字进行匹配，获取请求消息中包含的参数与预先机器学习得到的关键字之间的匹配度。当该参数与该关键字之间的匹配度大于预设阈值时，确定该请求消息的信息被泄露，并记录该请求消息的相关信息。从而通过机器学习自动识别更多的关键字，能够大幅有效地识别出敏感信息，减少安全测试人员重复劳动，提高了对信息泄露检测的效率及降低信息泄露的风险。
进一步地，基于上述信息泄露检测装置第一实施例，提出了本发明信息泄露检测装置第二实施例，该实施例中上述匹配模块200可包括：
第一确定单元，用于将所述请求消息中包含的参数与预先机器学习得到的关键字进行匹配，确定所述参数与所述关键字之间的第一匹配度。
第二确定单元，用于根据所述第一匹配度及所述参数在所述请求消息中的上下文，确定所述参数与所述关键字之间的匹配度。
本实施例中，服务器在将请求消息中包含的参数与预先机器学习得到的关键字进行匹配的过程中，首先第一确定单元将参数与关键字进行比对，确定该参数与关键字之间的第一匹配度。当存在多个参数时，可将多个参数分别与各个关键字进行比对，确定各个参数与关键字之间的第一匹配度。然后，第二确定单元根据各个参数所对应的匹配度进行加权计算，得到多个参数与关键字之间的第一匹配度，再根据第一匹配度及该参数在请求消息中的上下文，确定该参数与关键字之间的匹配度。
以下将进行举例说明，当服务器接收到的请求消息中包括name时，name由于在机器学习的过程中多次训练遇见取名、账户等会被确定出来，通过概率算法判断name为取名含义的可能概率（即第一匹配度）为30%，为账户含义可能概率（即第一匹配度）为70%，然后根据该参数在请求消息中的下文中出现密码参数，例如password，此时通过决策树算法确定name为账户含义的匹配度为95%。
本实施例服务器在将请求消息中包含的参数与预先机器学习得到的关键字进行匹配的过程中，首先通过概率算法确定参数与关键字之间的第一匹配度，再通过决策树算法根据第一匹配度及该参数在所述请求消息中的上下文，确定该参数与关键字之间的匹配度，提高了匹配度获取的准确性及可靠性。
进一步地，基于上述信息泄露检测装置第一实施例，提出了本发明信息泄露检测装置第三实施例，该实施例中上述匹配模块200还可包括：
拆分单元，用于根据预先机器学习得到的关键字对所述请求消息中包含的参数拆分为第一子参数和第二子参数。
匹配单元，用于将所述第一子参数和所述第二子参数分别与预先机器学习得到的关键字进行匹配，确定所述第一子参数与第一关键字匹配的第一概率，及所述第二子参数与第二关键字匹配的第二概率。
第三确定单元，用于根据所述第一概率、所述第二概率及所述参数在所述请求消息中的上下文，确定所述参数与所述关键字之间的匹配度。
本实施例中，服务器在将请求消息中包含的参数与预先机器学习得到的关键字进行匹配的过程中，首先由拆分单元根据预先机器学习得到的关键字对请求消息中包含的参数拆分多个子参数，例如可拆分为第一子参数和第二子参数。然后由匹配单元将第一子参数和第二子参数分别与预先机器学习得到的关键字进行匹配，根据概率算法确定第一子参数与第一关键字匹配的第一概率，及确定第二子参数与第二关键字匹配的第二概率。再由第三确定单元通过决策树算法根据第一概率、第二概率及该参数在请求消息中的上下文，该参数与关键字之间的匹配度，以便根据该匹配度确定参数在请求消息中的含义。
可选地，在确定第一子参数与第一关键字匹配的第一概率，及确定第二子参数与第二关键字匹配的第二概率后，可根据第一概率及该参数在请求消息中的上下文，计算第一子参数与第一关键字匹配的第三概率，以及根据第二概率及该参数在请求消息中的上下文，确定第二子参数与第二关键字匹配的第四概率。最后比较第三概率和第四概率的大小，将第三概率与第四概率中较大者设定为该参数与关键字。当然，确定参数与关键字之间的匹配度还可根据具体情况而灵活设置，并不限定本发明。
以下将进行举例说明，当服务器接收到的请求消息中包括flagname时，首先将flagname进行拆分得到flag和name，其中flag由于多次训练遇见标记、标识的情况会被选择出来，name由于多次训练遇见姓名、账户等会被选择出来。通过多种算法判定flagname用于标记可能概率为40%，flagname用于账户姓名可能概率为60%，然后根据该参数在请求消息中的下文中出现密码参数，例如password，此时flagname确定作为账户的可能概率为90%，即通过决策树算法确定参数flagname与关键字账户之间的匹配度为90%。
本实施例服务器可对参数进行拆分，然后根据拆分得到的子参数通过概率算法及决策树算法、及该参数在请求消息中的上下文，确定该参数与关键字之间的匹配度。从而可以有效地识别出敏感信息，提高对信息泄露检测的效率。
进一步地，如图7所示，基于上述信息泄露检测装置第一实施例，提出了本发明信息泄露检测装置第四实施例，该实施例中上述信息泄露检测装置还包括：
判断模块400，用于判断所述请求消息中是否存在所述渠道方设置的非敏感信息的标识。
第二确定模块500，用于当所述请求消息中存在所述渠道方设置的非敏感信息的标识时，确定所述请求消息的信息未被泄露。
需要说明的是，本发明信息泄露检测装置第四实施例，也可以是基于上述信息泄露检测装置第二或第三实施例提出。
本实施例中，由于存在某些请求消息规定进行明文传输，因此渠道方可以对需要进行明文传输的请求消息进行标识，将该类需要进行明文传输的请求消息设定为非敏感信息。
在服务器接收到渠道方发送的请求消息时，可首先由判断模块400判断该请求消息中是否存在渠道方设置的非敏感信息的标识。当请求消息中存在渠道方设置的非敏感信息的标识时，第二确定模块500确定该请求消息的信息未被泄露，即使该请求消息为明文传输，也说明该请求消息不存在信息泄露的风险，不需要记录该请求消息的相关信息。
本实施例服务器在接收到渠道方发送的请求消息后，当判定请求消息中存在渠道方设置的非敏感信息的标识时，确定请求消息的信息未被泄露。保证了有需求的请求消息可进行明文传输，提高了对信息泄露检测的可靠性。
进一步地，如图8所示，基于上述信息泄露检测装置第一、第二、第三或第四实施例，提出了本发明信息泄露检测装置第五实施例，该实施例中上述信息泄露检测装置还包括：
获取模块600，用于获取基于所述请求消息返回至所述渠道方的响应数据包。
对比模块700，用于将所述响应数据包所包含的信息与预先记录所述请求消息对应字段中的目标参数进行对比。
第三确定模块800，用于当所述响应数据包所包含的信息多于所述字段中的目标参数时，确定所述响应数据包的信息被泄露，并记录所述响应数据包的相关信息。
本实施例中，当服务器接收到渠道方发送的请求消息，根据请求消息反馈响应数据包至渠道方时，为了进一步降低信息泄露的风险，还需要对响应数据包进行检测。
具体地，首先服务器在接收到渠道方发送的请求消息时，根据该请求消息将请求消息对应字段中的目标参数进行记录。然后服务器调用获取模块600获取基于请求消息返回至渠道方的响应数据包，由对比模块700将响应数据包所包含的信息与预先记录请求消息对应字段中的目标参数进行对比，判断响应数据包所包含的信息是否多于与预先记录请求消息对应字段中的目标参数。当响应数据包所包含的信息多于字段中的目标参数时，第三确定模块800确定该响应数据包的信息被泄露，同时记录响应数据包的相关信息，该相关信息可以包括多于目标参数的数据。可将该响应数据包的相关信息存储至预置的数据库中，记录字段中可包括该响应数据包的请求url、敏感参数、序号等相关信息。该请求url为渠道方绑定到服务器的接口地址；该敏感参数为多于目标参数的数据，可包括多个参数；该序号即为编号，起到对响应数据包的排序作用。
优选地，当服务器返回响应数据包给渠道方时，可通过预置的安全应用中转，由安全应用对响应数据包进行检测。
以下将进行举例说明，当渠道方向服务器请求查询交易记录的页面时，服务器将需要返回至渠道方的html网页字段记录下来，这里请求的是页面，此时还没有输入银行***进行查询。该交易记录包括交易金额和交易时间，html网页字段记录交易金额和交易时间。后续渠道方发送银行***向服务器发起http查询请求时，即输入银行***进行查询时，当匹配到银行***bankcard参数时，服务器将其记录，然后将根据银行***返回的响应数据包与记录的网页字段中的参数进行对比，若检测到返回的参数多于字段中记录的参数，则说明服务器返回信息多于渠道方业务要求的信息，此时记录该请求url、敏感参数、序号到数据库redis中。例如，渠道方银行网站某一个页面，该面用来根据用户输入的银行***查询交易记录，而服务器根据请求返回的响应数据包中包括交易金额为1000，交易时间为20160101，交易用户为test，交易用户银行***为xxxxx，商户名为aaa；交易金额为400，交易时间为20161201，交易用户为bbb，交易用户银行***为aaaa，商户名为cccc等等的数据，由此可见这里渠道方业务要求的只是交易数据，但是返回的却还包含了用户的身份信息等，就出现返回信息过多的情况，判定可能出现敏感信息泄露。
最后检测完成后，可将数据库中存储的存在安全风险的数据导出，即将数据库中所记录的响应数据包的相关信息导出，由相关安全测试人员进行相应的处理。
本实施例服务器通过对比基于请求消息的返回的响应数据包和该请求消息所需要的目标参数，判断响应数据包中哪些参数多于该请求消息所需要的目标参数，该多出的参数涉及到敏感信息，并记录响应数据包的相关信息。从而实现了对于有的接口返回的信息并非前端渠道方页面需要显示的数据，将其判断为敏感信息泄露，且实现了自动检测，避免人工检测，不仅提高了对信息泄露检测的效率，而且降低信息泄露的风险。
在硬件实现上，以上接收模块100、匹配模块200以及第一确定模块300等可以以硬件形式内嵌于或独立于信息泄露检测装置中，也可以以软件形式存储于信息泄露检测装置的存储器中，以便于处理器执行以上各个模块对应的操作。该处理器可以为中央处理单元（CPU)、微处理器、单片机等。
如图9所示，图9是本发明实施例方案涉及的硬件运行环境的服务器结构示意图。
如图9所示，该服务器可以包括：处理器1001，通信总线1002，存储器1003，通信接口1004。其中，通信总线1002用于实现这些组件之间的连接通信。存储器1003可以是高速RAM存储器，也可以是稳定的存储器（non-volatile memory），例如磁盘存储器。存储器1003可选的还可以是独立于前述处理器1001的存储装置。通信接口1004可以包括用户接口（图9未示出）和/或网络接口（图9未示出），其中，用户接口可以用于连接例如显示屏和键盘等输入/输出设备，网络接口可以用于连接网络，包括有线网络和/或无线网络。
本领域技术人员可以理解，图9中示出的服务器结构并不构成对服务器的限定，可以包括比图示更多或更少的部件，或者组合某些部件，或者不同的部件布置。
如图9所示，作为一种计算机存储介质的存储器1003中可以包括操作***、网络通信模块以及信息泄露检测程序。
在图9所示的服务器中，处理器1001可以用于调用存储器1003中存储的信息泄露检测程序，并执行以下操作：
接收渠道方发送的请求消息；
将所述请求消息中包含的参数与预先机器学习得到的关键字进行匹配，并基于匹配结果获取所述参数与所述关键字之间的匹配度；
当所述匹配度大于预设阈值时，确定所述请求消息的信息被泄露，并记录所述请求消息的相关信息。
进一步地，处理器1001可以执行存储器1003中存储的信息泄露检测程序，以实现以下操作：
将所述请求消息中包含的参数与预先机器学习得到的关键字进行匹配，确定所述参数与所述关键字之间的第一匹配度；
根据所述第一匹配度及所述参数在所述请求消息中的上下文，确定所述参数与所述关键字之间的匹配度。
进一步地，处理器1001可以执行存储器1003中存储的信息泄露检测程序，以实现以下操作：
根据预先机器学习得到的关键字对所述请求消息中包含的参数拆分为第一子参数和第二子参数；
将所述第一子参数和所述第二子参数分别与预先机器学习得到的关键字进行匹配，确定所述第一子参数与第一关键字匹配的第一概率，及所述第二子参数与第二关键字匹配的第二概率；
根据所述第一概率、所述第二概率及所述参数在所述请求消息中的上下文，确定所述参数与所述关键字之间的匹配度。
进一步地，处理器1001可以执行存储器1003中存储的信息泄露检测程序，以实现以下操作：
判断所述请求消息中是否存在所述渠道方设置的非敏感信息的标识；
当所述请求消息中存在所述渠道方设置的非敏感信息的标识时，确定所述请求消息的信息未被泄露。
进一步地，处理器1001可以执行存储器1003中存储的信息泄露检测程序，以实现以下操作：
获取基于所述请求消息返回至所述渠道方的响应数据包；
将所述响应数据包所包含的信息与预先记录所述请求消息对应字段中的目标参数进行对比；
当所述响应数据包所包含的信息多于所述字段中的目标参数时，确定所述响应数据包的信息被泄露，并记录所述响应数据包的相关信息。
本发明实施例通过接收渠道方发送的请求消息，将该请求消息中包含的参数与预先机器学习得到的关键字进行匹配，获取请求消息中包含的参数与预先机器学习得到的关键字之间的匹配度。当该参数与该关键字之间的匹配度大于预设阈值时，确定该请求消息的信息被泄露，并记录该请求消息的相关信息。从而通过机器学习自动识别更多的关键字，能够大幅有效地识别出敏感信息，减少安全测试人员重复劳动，提高了对信息泄露检测的效率及降低信息泄露的风险。
本发明提供了一种计算机可读存储介质，所述计算机可读存储介质存储有一个或者多个程序，所述一个或者多个程序可被一个或者多个处理器执行，以实现以下步骤：
接收渠道方发送的请求消息；
将所述请求消息中包含的参数与预先机器学习得到的关键字进行匹配，并基于匹配结果获取所述参数与所述关键字之间的匹配度；
当所述匹配度大于预设阈值时，确定所述请求消息的信息被泄露，并记录所述请求消息的相关信息。
优选地，所述计算机可读存储介质存储还用于实现将所述请求消息中包含的参数与预先机器学习得到的关键字进行匹配，并基于匹配结果获取所述参数与所述关键字之间的匹配度的步骤：
将所述请求消息中包含的参数与预先机器学习得到的关键字进行匹配，确定所述参数与所述关键字之间的第一匹配度；
根据所述第一匹配度及所述参数在所述请求消息中的上下文，确定所述参数与所述关键字之间的匹配度。
优选地，所述计算机可读存储介质存储还用于实现将所述请求消息中包含的参数与预先机器学习得到的关键字进行匹配，并基于匹配结果获取所述参数与所述关键字之间的匹配度的步骤：
根据预先机器学习得到的关键字对所述请求消息中包含的参数拆分为第一子参数和第二子参数；
将所述第一子参数和所述第二子参数分别与预先机器学习得到的关键字进行匹配，确定所述第一子参数与第一关键字匹配的第一概率，及所述第二子参数与第二关键字匹配的第二概率；
根据所述第一概率、所述第二概率及所述参数在所述请求消息中的上下文，确定所述参数与所述关键字之间的匹配度。
优选地，所述计算机可读存储介质存储还用于实现接收渠道方发送的请求消息之后的步骤：
判断所述请求消息中是否存在所述渠道方设置的非敏感信息的标识；
当所述请求消息中存在所述渠道方设置的非敏感信息的标识时，确定所述请求消息的信息未被泄露。
优选地，所述计算机可读存储介质存储还用于实现以下步骤：
获取基于所述请求消息返回至所述渠道方的响应数据包；
将所述响应数据包所包含的信息与预先记录所述请求消息对应字段中的目标参数进行对比；
当所述响应数据包所包含的信息多于所述字段中的目标参数时，确定所述响应数据包的信息被泄露，并记录所述响应数据包的相关信息。
本领域普通技术人员可以理解实现上述实施例的全部或部分步骤可以通过硬件来完成，也可以通过程序来指令相关的硬件完成，所述的程序可以存储于一种计算机可读存储介质中，上述提到的存储介质可以是只读存储器，磁盘或光盘等。
还需要说明的是，在本文中，术语“包括”、“包含”或者其任何其他变体意在涵盖非排他性的包含，从而使得包括一系列要素的过程、方法、物品或者装置不仅包括那些要素，而且还包括没有明确列出的其他要素，或者是还包括为这种过程、方法、物品或者装置所固有的要素。在没有更多限制的情况下，由语句“包括一个……”限定的要素，并不排除在包括该要素的过程、方法、物品或者装置中还存在另外的相同要素。
上述本发明实施例序号仅仅为了描述，不代表实施例的优劣。
通过以上的实施方式的描述，本领域的技术人员可以清楚地了解到上述实施例方法可借助软件加必需的通用硬件平台的方式来实现，当然也可以通过硬件，但很多情况下前者是更佳的实施方式。基于这样的理解，本发明的技术方案本质上或者说对现有技术做出贡献的部分可以以软件产品的形式体现出来，该计算机软件产品存储在一个存储介质（如ROM/RAM、磁碟、光盘）中，包括若干指令用以使得一台服务器执行本发明各个实施例所述的方法。
以上仅为本发明的优选实施例，并非因此限制本发明的专利范围，凡是利用本发明说明书及附图内容所作的等效结构或等效流程变换，或直接或间接运用在其他相关的技术领域，均同理包括在本发明的专利保护范围内。

Claims (22)

  1. 一种信息泄露检测方法，其特征在于，所述信息泄露检测方法包括以下步骤：
    接收渠道方发送的请求消息；
    将所述请求消息中包含的参数与预先机器学习得到的关键字进行匹配，并基于匹配结果获取所述参数与所述关键字之间的匹配度；
    当所述匹配度大于预设阈值时，确定所述请求消息的信息被泄露，并记录所述请求消息的相关信息。
  2. 如权利要求1所述的信息泄露检测方法，其特征在于，所述将所述请求消息中包含的参数与预先机器学习得到的关键字进行匹配，并基于匹配结果获取所述参数与所述关键字之间的匹配度包括：
    将所述请求消息中包含的参数与预先机器学习得到的关键字进行匹配，确定所述参数与所述关键字之间的第一匹配度；
    根据所述第一匹配度及所述参数在所述请求消息中的上下文，确定所述参数与所述关键字之间的匹配度。
  3. 如权利要求1所述的信息泄露检测方法，其特征在于，所述将所述请求消息中包含的参数与预先机器学习得到的关键字进行匹配，并基于匹配结果获取所述参数与所述关键字之间的匹配度包括：
    根据预先机器学习得到的关键字对所述请求消息中包含的参数拆分为第一子参数和第二子参数；
    将所述第一子参数和所述第二子参数分别与预先机器学习得到的关键字进行匹配，确定所述第一子参数与第一关键字匹配的第一概率，及所述第二子参数与第二关键字匹配的第二概率；
    根据所述第一概率、所述第二概率及所述参数在所述请求消息中的上下文，确定所述参数与所述关键字之间的匹配度。
  4. 如权利要求1所述的信息泄露检测方法，其特征在于，所述接收渠道方发送的请求消息之后包括：
    判断所述请求消息中是否存在所述渠道方设置的非敏感信息的标识；
    当所述请求消息中存在所述渠道方设置的非敏感信息的标识时，确定所述请求消息的信息未被泄露。
  5. 如权利要求1所述的信息泄露检测方法，其特征在于，所述信息泄露检测方法还包括：
    获取基于所述请求消息返回至所述渠道方的响应数据包；
    将所述响应数据包所包含的信息与预先记录所述请求消息对应字段中的目标参数进行对比；
    当所述响应数据包所包含的信息多于所述字段中的目标参数时，确定所述响应数据包的信息被泄露，并记录所述响应数据包的相关信息。
  6. 如权利要求2所述的信息泄露检测方法，其特征在于，所述信息泄露检测方法还包括：
    获取基于所述请求消息返回至所述渠道方的响应数据包；
    将所述响应数据包所包含的信息与预先记录所述请求消息对应字段中的目标参数进行对比；
    当所述响应数据包所包含的信息多于所述字段中的目标参数时，确定所述响应数据包的信息被泄露，并记录所述响应数据包的相关信息。
  7. 一种信息泄露检测装置，其特征在于，所述信息泄露检测装置包括：
    接收模块，用于接收渠道方发送的请求消息；
    匹配模块，用于将所述请求消息中包含的参数与预先机器学习得到的关键字进行匹配，并基于匹配结果获取所述参数与所述关键字之间的匹配度；
    第一确定模块，用于当所述匹配度大于预设阈值时，确定所述请求消息的信息被泄露，并记录所述请求消息的相关信息。
  8. 如权利要求7所述的信息泄露检测装置，其特征在于，所述匹配模块包括：
    第一确定单元，用于将所述请求消息中包含的参数与预先机器学习得到的关键字进行匹配，确定所述参数与所述关键字之间的第一匹配度；
    第二确定单元，用于根据所述第一匹配度及所述参数在所述请求消息中的上下文，确定所述参数与所述关键字之间的匹配度。
  9. 如权利要求7所述的信息泄露检测装置，其特征在于，所述匹配模块还包括：
    拆分单元，用于根据预先机器学习得到的关键字对所述请求消息中包含的参数拆分为第一子参数和第二子参数；
    匹配单元，用于将所述第一子参数和所述第二子参数分别与预先机器学习得到的关键字进行匹配，确定所述第一子参数与第一关键字匹配的第一概率，及所述第二子参数与第二关键字匹配的第二概率；
    第三确定单元，用于根据所述第一概率、所述第二概率及所述参数在所述请求消息中的上下文，确定所述参数与所述关键字之间的匹配度。
  10. 如权利要求7所述的信息泄露检测装置，其特征在于，所述信息泄露检测装置还包括：
    判断模块，用于判断所述请求消息中是否存在所述渠道方设置的非敏感信息的标识；
    第二确定模块，用于当所述请求消息中存在所述渠道方设置的非敏感信息的标识时，确定所述请求消息的信息未被泄露。
  11. 如权利要求7所述的信息泄露检测装置，其特征在于，所述信息泄露检测装置还包括：
    获取模块，用于获取基于所述请求消息返回至所述渠道方的响应数据包；
    对比模块，用于将所述响应数据包所包含的信息与预先记录所述请求消息对应字段中的目标参数进行对比；
    第三确定模块，用于当所述响应数据包所包含的信息多于所述字段中的目标参数时，确定所述响应数据包的信息被泄露，并记录所述响应数据包的相关信息。
  12. 如权利要求8所述的信息泄露检测装置，其特征在于，所述信息泄露检测装置还包括：
    获取模块，用于获取基于所述请求消息返回至所述渠道方的响应数据包；
    对比模块，用于将所述响应数据包所包含的信息与预先记录所述请求消息对应字段中的目标参数进行对比；
    第三确定模块，用于当所述响应数据包所包含的信息多于所述字段中的目标参数时，确定所述响应数据包的信息被泄露，并记录所述响应数据包的相关信息。
  13. 一种服务器，其特征在于，所述服务器包括处理器及存储器，所述处理器用于执行存储器中存储的信息泄露检测程序，以实现以下步骤：
    接收渠道方发送的请求消息；
    将所述请求消息中包含的参数与预先机器学习得到的关键字进行匹配，并基于匹配结果获取所述参数与所述关键字之间的匹配度；
    当所述匹配度大于预设阈值时，确定所述请求消息的信息被泄露，并记录所述请求消息的相关信息。
  14. 如权利要求13所述的服务器，其特征在于，所述处理器还用于执行存储器中存储的信息泄露检测程序，以实现将所述请求消息中包含的参数与预先机器学习得到的关键字进行匹配，并基于匹配结果获取所述参数与所述关键字之间的匹配度的步骤：
    将所述请求消息中包含的参数与预先机器学习得到的关键字进行匹配，确定所述参数与所述关键字之间的第一匹配度；
    根据所述第一匹配度及所述参数在所述请求消息中的上下文，确定所述参数与所述关键字之间的匹配度。
  15. 如权利要求13所述的服务器，其特征在于，所述处理器还用于执行存储器中存储的信息泄露检测程序，以实现将所述请求消息中包含的参数与预先机器学习得到的关键字进行匹配，并基于匹配结果获取所述参数与所述关键字之间的匹配度的步骤：
    根据预先机器学习得到的关键字对所述请求消息中包含的参数拆分为第一子参数和第二子参数；
    将所述第一子参数和所述第二子参数分别与预先机器学习得到的关键字进行匹配，确定所述第一子参数与第一关键字匹配的第一概率，及所述第二子参数与第二关键字匹配的第二概率；
    根据所述第一概率、所述第二概率及所述参数在所述请求消息中的上下文，确定所述参数与所述关键字之间的匹配度。
  16. 如权利要求13所述的服务器，其特征在于，所述处理器还用于执行存储器中存储的信息泄露检测程序，以实现接收渠道方发送的请求消息之后的步骤：
    判断所述请求消息中是否存在所述渠道方设置的非敏感信息的标识；
    当所述请求消息中存在所述渠道方设置的非敏感信息的标识时，确定所述请求消息的信息未被泄露。
  17. 如权利要求13所述的服务器，其特征在于，所述处理器还用于执行存储器中存储的信息泄露检测程序，以实现以下步骤：
    获取基于所述请求消息返回至所述渠道方的响应数据包；
    将所述响应数据包所包含的信息与预先记录所述请求消息对应字段中的目标参数进行对比；
    当所述响应数据包所包含的信息多于所述字段中的目标参数时，确定所述响应数据包的信息被泄露，并记录所述响应数据包的相关信息。
  18. 一种计算机可读存储介质，其特征在于，所述计算机可读存储介质存储有一个或者多个程序，所述一个或者多个程序可被一个或者多个处理器执行，以实现以下步骤：
    接收渠道方发送的请求消息；
    将所述请求消息中包含的参数与预先机器学习得到的关键字进行匹配，并基于匹配结果获取所述参数与所述关键字之间的匹配度；
    当所述匹配度大于预设阈值时，确定所述请求消息的信息被泄露，并记录所述请求消息的相关信息。
  19. 如权利要求18所述的计算机可读存储介质，其特征在于，所述计算机可读存储介质存储还用于实现将所述请求消息中包含的参数与预先机器学习得到的关键字进行匹配，并基于匹配结果获取所述参数与所述关键字之间的匹配度的步骤：
    将所述请求消息中包含的参数与预先机器学习得到的关键字进行匹配，确定所述参数与所述关键字之间的第一匹配度；
    根据所述第一匹配度及所述参数在所述请求消息中的上下文，确定所述参数与所述关键字之间的匹配度。
  20. 如权利要求18所述的计算机可读存储介质，其特征在于，所述计算机可读存储介质存储还用于实现将所述请求消息中包含的参数与预先机器学习得到的关键字进行匹配，并基于匹配结果获取所述参数与所述关键字之间的匹配度的步骤：
    根据预先机器学习得到的关键字对所述请求消息中包含的参数拆分为第一子参数和第二子参数；
    将所述第一子参数和所述第二子参数分别与预先机器学习得到的关键字进行匹配，确定所述第一子参数与第一关键字匹配的第一概率，及所述第二子参数与第二关键字匹配的第二概率；
    根据所述第一概率、所述第二概率及所述参数在所述请求消息中的上下文，确定所述参数与所述关键字之间的匹配度。
  21. 如权利要求18所述的计算机可读存储介质，其特征在于，所述计算机可读存储介质存储还用于实现接收渠道方发送的请求消息之后的步骤：
    判断所述请求消息中是否存在所述渠道方设置的非敏感信息的标识；
    当所述请求消息中存在所述渠道方设置的非敏感信息的标识时，确定所述请求消息的信息未被泄露。
  22. 如权利要求18所述的计算机可读存储介质，其特征在于，所述计算机可读存储介质存储还用于实现以下步骤：
    获取基于所述请求消息返回至所述渠道方的响应数据包；
    将所述响应数据包所包含的信息与预先记录所述请求消息对应字段中的目标参数进行对比；
    当所述响应数据包所包含的信息多于所述字段中的目标参数时，确定所述响应数据包的信息被泄露，并记录所述响应数据包的相关信息。
PCT/CN2017/089807 2017-03-17 2017-06-23 信息泄露检测方法及装置、服务器及计算机可读存储介质 WO2018166099A1 (zh)

Priority Applications (6)

Application Number Priority Date Filing Date Title
SG11201901807YA SG11201901807YA (en) 2017-03-17 2017-06-23 Method and device for detecting information leakage, server, and computer-readable storage medium
JP2018527065A JP6688389B2 (ja) 2017-03-17 2017-06-23 情報漏えい検査の方法、装置、サーバー及びコンピュータ可読記憶媒体
AU2017403386A AU2017403386A1 (en) 2017-03-17 2017-06-23 Information leakage detection method and device, server, and computer-readable storage medium
US16/071,140 US20210042443A1 (en) 2017-03-17 2017-06-23 Method and device for detecting information leakage, server, and computer-readable storage medium
EP17900903.0A EP3447669B1 (en) 2017-03-17 2017-06-23 Information leakage detection method and device, server, and computer-readable storage medium
KR1020187035322A KR102157712B1 (ko) 2017-03-17 2017-06-23 정보 유출 검출 방법 및 장치

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201710164043.7 2017-03-17
CN201710164043.7A CN107066882B (zh) 2017-03-17 2017-03-17 信息泄露检测方法及装置

Publications (1)

Publication Number Publication Date
WO2018166099A1 true WO2018166099A1 (zh) 2018-09-20

Family

ID=59620091

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2017/089807 WO2018166099A1 (zh) 2017-03-17 2017-06-23 信息泄露检测方法及装置、服务器及计算机可读存储介质

Country Status (8)

Country Link
US (1) US20210042443A1 (zh)
EP (1) EP3447669B1 (zh)
JP (1) JP6688389B2 (zh)
KR (1) KR102157712B1 (zh)
CN (1) CN107066882B (zh)
AU (1) AU2017403386A1 (zh)
SG (1) SG11201901807YA (zh)
WO (1) WO2018166099A1 (zh)

Cited By (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN110502514A (zh) * 2019-08-15 2019-11-26 中国平安财产保险股份有限公司 数据采集方法、装置、设备及计算机可读存储介质
CN111753149A (zh) * 2020-06-28 2020-10-09 深圳前海微众银行股份有限公司 敏感信息的检测方法、装置、设备及存储介质
CN112118241A (zh) * 2020-09-08 2020-12-22 上海谋乐网络科技有限公司 审计渗透测试方法、测试节点服务器、管理服务器及***

Families Citing this family (11)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN109522351A (zh) * 2018-10-22 2019-03-26 中国银行股份有限公司 一种数据处理方法及***
CN111008401A (zh) * 2019-12-10 2020-04-14 中国银行股份有限公司 一种文本保存方法及装置
CN111159703B (zh) * 2019-12-31 2022-12-06 奇安信科技集团股份有限公司 虚拟机数据泄露检测方法及装置
CN111353174B (zh) * 2020-03-16 2021-06-11 杭州康晟健康管理咨询有限公司 一种医疗机构的私密客户信息管理***及方法
CN112052364B (zh) * 2020-09-27 2024-07-23 深圳前海微众银行股份有限公司 敏感信息检测方法、装置、设备与计算机可读存储介质
CN112364346B (zh) * 2020-10-27 2024-03-22 杭州安恒信息技术股份有限公司 一种泄露数据探测方法、装置、设备及介质
CN113904828B (zh) * 2021-09-29 2024-01-05 中国工商银行股份有限公司 接口的敏感信息检测方法、装置、设备、介质和程序产品
CN114077722A (zh) * 2021-10-20 2022-02-22 深信服科技股份有限公司 数据泄密追踪方法、装置、电子设备和计算机存储介质
CN114629707B (zh) * 2022-03-16 2024-05-24 深信服科技股份有限公司 一种乱码检测方法、装置及电子设备和存储介质
EP4261758A1 (en) * 2022-04-13 2023-10-18 Magnet Forensics Inc. Computer method and system for intelligence gathering
CN114877264A (zh) * 2022-06-06 2022-08-09 国家石油天然气管网集团有限公司 一种基于声纹识别的天然气管体泄露识别方法和***

Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102012985A (zh) * 2010-11-19 2011-04-13 国网电力科学研究院 一种基于数据挖掘的敏感数据动态识别方法
CN104123370A (zh) * 2014-07-24 2014-10-29 杭州安恒信息技术有限公司 数据库敏感信息探测方法及***
CN106156017A (zh) * 2015-03-23 2016-11-23 北大方正集团有限公司 信息识别方法和信息识别***

Family Cites Families (9)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CA2342578A1 (en) * 2001-03-29 2002-09-29 Ibm Canada Limited-Ibm Canada Limitee Method and apparatus for security of a network server
US7467202B2 (en) * 2003-09-10 2008-12-16 Fidelis Security Systems High-performance network content analysis platform
JP5168620B2 (ja) * 2007-11-07 2013-03-21 独立行政法人情報通信研究機構 データ種類検出装置及びデータ種類検出方法
US8442926B2 (en) * 2008-01-08 2013-05-14 Mitsubishi Electric Corporation Information filtering system, information filtering method and information filtering program
CN102207973B (zh) * 2011-06-22 2013-04-10 上海互联网软件有限公司 一种模糊检索***及其检索方法
GB2509709A (en) * 2013-01-09 2014-07-16 Ibm Transparent encryption/decryption gateway for cloud storage services
US9652597B2 (en) * 2014-03-12 2017-05-16 Symantec Corporation Systems and methods for detecting information leakage by an organizational insider
US9225734B1 (en) * 2014-09-10 2015-12-29 Fortinet, Inc. Data leak protection in upper layer protocols
CN105939359A (zh) * 2016-06-20 2016-09-14 国家计算机网络与信息安全管理中心 检测移动终端隐私泄露的方法及装置

Patent Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102012985A (zh) * 2010-11-19 2011-04-13 国网电力科学研究院 一种基于数据挖掘的敏感数据动态识别方法
CN104123370A (zh) * 2014-07-24 2014-10-29 杭州安恒信息技术有限公司 数据库敏感信息探测方法及***
CN106156017A (zh) * 2015-03-23 2016-11-23 北大方正集团有限公司 信息识别方法和信息识别***

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
See also references of EP3447669A4 *

Cited By (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN110502514A (zh) * 2019-08-15 2019-11-26 中国平安财产保险股份有限公司 数据采集方法、装置、设备及计算机可读存储介质
CN110502514B (zh) * 2019-08-15 2023-06-27 中国平安财产保险股份有限公司 数据采集方法、装置、设备及计算机可读存储介质
CN111753149A (zh) * 2020-06-28 2020-10-09 深圳前海微众银行股份有限公司 敏感信息的检测方法、装置、设备及存储介质
CN111753149B (zh) * 2020-06-28 2024-05-31 深圳前海微众银行股份有限公司 敏感信息的检测方法、装置、设备及存储介质
CN112118241A (zh) * 2020-09-08 2020-12-22 上海谋乐网络科技有限公司 审计渗透测试方法、测试节点服务器、管理服务器及***
CN112118241B (zh) * 2020-09-08 2022-11-01 上海谋乐网络科技有限公司 审计渗透测试方法、测试节点服务器、管理服务器及***

Also Published As

Publication number Publication date
EP3447669A1 (en) 2019-02-27
AU2017403386A1 (en) 2018-10-11
US20210042443A1 (en) 2021-02-11
KR20190019067A (ko) 2019-02-26
SG11201901807YA (en) 2019-04-29
CN107066882A (zh) 2017-08-18
KR102157712B1 (ko) 2020-09-21
EP3447669B1 (en) 2020-11-11
JP2019519008A (ja) 2019-07-04
EP3447669A4 (en) 2019-12-04
CN107066882B (zh) 2019-07-12
JP6688389B2 (ja) 2020-04-28

Similar Documents

Publication Publication Date Title
WO2018166099A1 (zh) 信息泄露检测方法及装置、服务器及计算机可读存储介质
WO2020107756A1 (zh) 信贷反欺诈方法、***、设备及计算机可读存储介质
WO2021003930A1 (zh) 客服录音的质检方法、装置、设备及计算机可读存储介质
WO2018008800A1 (ko) 블록체인을 기반으로 하는 공인인증서 인증시스템과 이를 이용한 블록체인을 기반으로 하는 공인인증서 인증방법
WO2016108468A1 (en) User terminal, service providing apparatus, driving method of user terminal, driving method of service providing apparatus, and encryption indexing-based search system
WO2014040501A1 (zh) 一种动态口令的生成及认证方法与***
WO2014084498A2 (ko) 웹사이트와 어플에서의 회원 간 만남주선 시스템
WO2014030889A1 (en) Method and apparatus for sharing content
WO2018228050A1 (zh) 防止敏感信息泄露的方法、装置及存储介质
WO2020147385A1 (zh) 数据录入方法、装置、终端及计算机可读存储介质
WO2012108661A2 (ko) 네트워크 통신망에서의 쌍방향 가입자 보안 인증 시스템과 방법 및 이 방법을 기록한 기록매체
WO2020253125A1 (zh) 日志管理方法、装置、设备及存储介质
WO2019156506A1 (en) System and method for providing conversational contents
WO2018201638A1 (zh) 基于图像识别的信息采集方法、移动终端及存储介质
WO2015126037A1 (ko) 일회용 랜덤키를 이용한 본인 확인 및 도용 방지 시스템 및 방법
WO2018084326A1 (ko) 실시간 상담을 제공하기 위한 방법 및 서버
WO2023106572A1 (ko) 가상 자산 부정 거래 탐지를 위한 탐지 모델의 학습 방법, 탐지 모델을 이용한 가상 자산 부정 거래의 탐지 방법 및 이들을 수행하는 장치 및 컴퓨터 프로그램
EP3472749A1 (en) A primary device, an accessory device, and methods for processing operations on the primary device and the accessory device
WO2022055160A1 (ko) 식별코드 및 보안일련번호 이원화를 통한 정품 인증 시스템 및 그 방법
WO2021177639A1 (ko) 거래에서 사용자 정보를 식별하는 방법 및 이러한 방법을 수행하는 장치
WO2015026083A1 (ko) 휴대폰 본인인증 도용방지와 스미싱 방지를 위한 문자메시지 보안시스템 및 방법
WO2024043613A1 (ko) 이력서 생성 및 관리 서비스를 제공하기 위한 서버 장치 및 그 동작 방법
WO2022197026A1 (ko) 서버, 서비스 제공 시스템 및 서버의 처리 방법
WO2022035161A1 (ko) 전산망 해킹방지 시스템 및 방법
WO2019047022A1 (zh) Wifi共享方法、移动终端及计算机可读存储介质

Legal Events

Date Code Title Description
ENP Entry into the national phase

Ref document number: 2018527065

Country of ref document: JP

Kind code of ref document: A

ENP Entry into the national phase

Ref document number: 2017403386

Country of ref document: AU

Date of ref document: 20170623

Kind code of ref document: A

121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 17900903

Country of ref document: EP

Kind code of ref document: A1

ENP Entry into the national phase

Ref document number: 20187035322

Country of ref document: KR

Kind code of ref document: A

ENP Entry into the national phase

Ref document number: 2017900903

Country of ref document: EP

Effective date: 20181123

NENP Non-entry into the national phase

Ref country code: DE