WO2018166099A1 - 信息泄露检测方法及装置、服务器及计算机可读存储介质 - Google Patents
信息泄露检测方法及装置、服务器及计算机可读存储介质 Download PDFInfo
- Publication number
- WO2018166099A1 WO2018166099A1 PCT/CN2017/089807 CN2017089807W WO2018166099A1 WO 2018166099 A1 WO2018166099 A1 WO 2018166099A1 CN 2017089807 W CN2017089807 W CN 2017089807W WO 2018166099 A1 WO2018166099 A1 WO 2018166099A1
- Authority
- WO
- WIPO (PCT)
- Prior art keywords
- request message
- parameter
- information
- matching
- keyword
- Prior art date
Links
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F21/60—Protecting data
- G06F21/62—Protecting access to data via a platform, e.g. using keys or access control rules
- G06F21/6218—Protecting access to data via a platform, e.g. using keys or access control rules to a system of files or objects, e.g. local or distributed file system or database
- G06F21/6245—Protecting personal data, e.g. for financial or medical purposes
- G06F21/6263—Protecting personal data, e.g. for financial or medical purposes during internet communication, e.g. revealing personal data from cookies
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F16/00—Information retrieval; Database structures therefor; File system structures therefor
- G06F16/90—Details of database functions independent of the retrieved data types
- G06F16/903—Querying
- G06F16/90335—Query processing
- G06F16/90344—Query processing by using string matching techniques
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F16/00—Information retrieval; Database structures therefor; File system structures therefor
- G06F16/90—Details of database functions independent of the retrieved data types
- G06F16/95—Retrieval from the web
- G06F16/951—Indexing; Web crawling techniques
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
- G06F21/55—Detecting local intrusion or implementing counter-measures
- G06F21/556—Detecting local intrusion or implementing counter-measures involving covert channels, i.e. data leakage between processes
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F21/60—Protecting data
- G06F21/62—Protecting access to data via a platform, e.g. using keys or access control rules
- G06F21/6218—Protecting access to data via a platform, e.g. using keys or access control rules to a system of files or objects, e.g. local or distributed file system or database
- G06F21/6245—Protecting personal data, e.g. for financial or medical purposes
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F40/00—Handling natural language data
- G06F40/20—Natural language analysis
- G06F40/279—Recognition of textual entities
- G06F40/284—Lexical analysis, e.g. tokenisation or collocates
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06N—COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS
- G06N20/00—Machine learning
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/30—Network architectures or network communication protocols for network security for supporting lawful interception, monitoring or retaining of communications or communication related information
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06N—COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS
- G06N7/00—Computing arrangements based on specific mathematical models
- G06N7/01—Probabilistic graphical models, e.g. probabilistic networks
Definitions
- the present invention relates to the field of information security technologies, and in particular, to an information leakage detection method and apparatus, a server, and a computer readable storage medium.
- the server detects the information leakage through the web application vulnerability scanner, and only defines a specific keyword corresponding to the sensitive information, such as email, username, etc., and scans the recorded parameters with the key. The words are compared.
- the specific keyword includes username, excluding USERNAME
- the match is not recognized, or the parameter in the http request does not recognize the match, which may result in sensitive information in clear text. Transmission, the risk of information leakage.
- the method roughly judges whether there is a clear message transmission of sensitive information, and requires the safety tester to pay more labor for subsequent analysis and inspection, which not only reduces the efficiency of identifying sensitive information leakage, but also reduces the duplication of safety testers. .
- the main object of the present invention is to provide an information leakage detecting method and apparatus, a server and a computer readable storage medium, aiming at improving the efficiency of information leakage detection and reducing the risk of information leakage.
- the present invention provides an information leakage detecting method, including:
- the matching degree is greater than the preset threshold, determining that the information of the request message is leaked, and recording related information of the request message.
- the present invention also provides an information leakage detecting apparatus, including:
- a receiving module configured to receive a request message sent by the channel side
- a matching module configured to match a parameter included in the request message with a keyword obtained by pre-machine learning, and obtain a matching degree between the parameter and the keyword based on the matching result
- the first determining module is configured to: when the matching degree is greater than the preset threshold, determine that the information of the request message is leaked, and record related information of the request message.
- the present invention further provides a server, where the server includes a processor and a memory, and the processor is configured to execute an information leakage detection program stored in the memory to implement the following steps:
- the matching degree is greater than the preset threshold, determining that the information of the request message is leaked, and recording related information of the request message.
- the present invention also provides a computer readable storage medium storing one or more programs, the one or more programs being used by one or more processors Execute to implement the following steps:
- the matching degree is greater than the preset threshold, determining that the information of the request message is leaked, and recording related information of the request message.
- the request message sent by the channel is received, and the parameter included in the request message is matched with the keyword obtained by the pre-machine learning, and the parameter included in the request message is obtained between the parameter included in the request message and the keyword obtained by the pre-machine learning.
- the matching degree between the parameter and the keyword is greater than a preset threshold, it is determined that the information of the request message is leaked, and related information of the request message is recorded. Therefore, by machine learning to automatically identify more keywords, it is possible to identify sensitive information substantially and effectively, reduce the duplication of safety testers, improve the efficiency of information leakage detection and reduce the risk of information leakage.
- FIG. 1 is a schematic flowchart of a first embodiment of an information leakage detecting method according to the present invention
- FIG. 2 is a schematic flowchart of a second embodiment of an information leakage detecting method according to the present invention.
- FIG. 3 is a schematic flowchart of a third embodiment of an information leakage detecting method according to the present invention.
- FIG. 4 is a schematic flowchart diagram of a fourth embodiment of an information leakage detecting method according to the present invention.
- FIG. 5 is a schematic flowchart diagram of a fifth embodiment of an information leakage detecting method according to the present invention.
- FIG. 6 is a schematic diagram of functional modules of a first embodiment of an information leakage detecting apparatus according to the present invention.
- FIG. 7 is a schematic diagram of functional modules of a fourth embodiment of an information leakage detecting apparatus according to the present invention.
- FIG. 8 is a schematic diagram of functional modules of a fifth embodiment of an information leakage detecting apparatus according to the present invention.
- FIG. 9 is a schematic structural diagram of a server in a hardware operating environment according to an embodiment of the present invention.
- the information leakage detecting method of this embodiment includes:
- Step S10 Receive a request message sent by the channel side.
- the information leakage detection method is applied to a server, which mainly detects the leakage of interface sensitive information.
- the server is a back-end server corresponding to the front-end channel.
- the server receives the http request message sent by the channel or returns the response packet to the channel according to the request message, the server detects the request message or the response packet to prevent the information. Give way.
- the server may be pre-configured with a security application for intercepting the http request message sent by the channel to the server for information leakage detection, or intercepting the response packet returned by the server according to the request message to the channel for information leakage detection. . That is, when the channel direction server sends an http request message or the server feeds back the response data packet to the channel side, it can transit through the security application.
- the channel is the tested product, including online banking, bank background app, etc.
- the app can run on PC, mobile phone and other terminals.
- the channel can send a request message to the server according to its own usage requirement, and the server can receive the request message sent by the channel, and the request message includes inputting the account password, logging in, sending the information, opening the interface, and the like.
- Step S20 Matching parameters included in the request message with keywords obtained by machine learning in advance, and acquiring a matching degree between the parameter and the keyword based on the matching result.
- the server may perform machine learning in advance through a preset security application to identify multiple keywords, that is, automatically identify more keywords through machine learning in advance, for example, email, email, e-mail, and email. , EMAIL, etc., instead of simply identifying emails.
- keywords are first obtained by a large amount of learning recognition of a sample, such as username, Username, USNNANME, user, name, and the like.
- a sample such as username, Username, USNNANME, user, name, and the like.
- you can directly identify such as username, Username, UserName, etc.
- you can also directly identify such as username, uname, name, etc.
- the algorithm and the probabilistic algorithm select the most probable probability for identification matching. The following examples will be described in detail.
- the server receives the request message sent by the channel, it determines whether the request message is a plaintext transmission or a ciphertext transmission, that is, the parameters included in the request message are obtained by the pre-machine learning.
- the keyword is matched, and the degree of matching between the parameter included in the request message and the keyword obtained by the pre-machine learning is obtained, so as to determine the meaning of the parameter in the request message according to the matching degree.
- the parameters included in the request message may include email, username, passwd, flagname, and the like; when the request message is ciphertext transmission, the parameters included in the request message are some garbled characters.
- Step S30 When the matching degree is greater than a preset threshold, determine that the information of the request message is leaked, and record related information of the request message.
- the matching degree between the parameter included in the request message and the keyword obtained by the machine learning is obtained, it is determined whether the matching degree is greater than a preset threshold, and the preset threshold may be flexibly set according to a specific situation.
- the request message is transmitted in clear text and there is a risk of information leakage. At this time, it is determined that the information of the request message is leaked, and the related information of the request message is recorded, and the related information of the request message may be stored in a preset database.
- the record field may include the request url of the request message (the url is a uniform resource locator), the request sensitive parameter, the serial number, and the like.
- the request url is an interface address bound to the server by the channel party; the request sensitive parameter is plaintext data, and may include multiple parameters; the sequence number is a number, which serves to sort the request message.
- the security application detects that the data of the transmission process of the request message is a plaintext transmission, and the security application records the related information of the request message in the database redis of the security application. It should be noted that, regardless of whether the request message sent by the channel is a plaintext transmission or a ciphertext transmission, the security application needs to transfer the request message to the backend server.
- the matching degree between the keyword and the parameter is greater than the preset threshold, it indicates that the parameter cannot be determined in the meaning of the request message. At this time, it is determined that the request message is ciphertext transmission, and there is no risk of information leakage. When the request message is ciphertext transmission, it is determined that the information of the request message is not leaked, and it is not necessary to record related information of the request message.
- the data with security risks stored in the database may be exported, that is, the relevant information of the request message recorded in the database is exported, and the relevant security test personnel perform corresponding processing.
- the server when the channel direction server delivers the http request message, the server receives the request message, wherein the request message includes parameters including Username, passwd, IDCard, and the like.
- the server matches the parameters included in the request message with the keywords obtained by the pre-machine learning, and determines that the values of the parameters Username, passwd, IDCard, etc. are plaintext transmission, that is, the user name Username is aaaaaa, the password passwd is bbbbb, and the bank card number IDCard is 4205xxxxxxxxxx11, at this time, it is determined that the information of the request message is leaked, and the related information of the request message is recorded.
- the request message sent by the channel is received, and the parameter included in the request message is matched with the keyword obtained by the pre-machine learning, and the parameter included in the request message is obtained between the parameter included in the request message and the keyword obtained by the pre-machine learning.
- the matching degree between the parameter and the keyword is greater than a preset threshold, it is determined that the information of the request message is leaked, and related information of the request message is recorded. Therefore, by machine learning to automatically identify more keywords, it is possible to identify sensitive information substantially and effectively, reduce the duplication of safety testers, improve the efficiency of information leakage detection and reduce the risk of information leakage.
- step S20 may include:
- Step S21 Matching parameters included in the request message with keywords obtained by machine learning in advance, and determining a first matching degree between the parameter and the keyword.
- Step S22 Determine, according to the first matching degree and a context of the parameter in the request message, a degree of matching between the parameter and the keyword.
- the server in the process of matching the parameters included in the request message with the keywords obtained by the pre-machine learning, the server first compares the parameters with the keywords, and determines the first match between the parameters and the keywords. degree.
- multiple parameters may be compared with each keyword to determine the degree of matching between each parameter and the keyword. Then, performing weighting calculation according to the matching degree corresponding to each parameter, obtaining a first matching degree between the plurality of parameters and the keyword, and determining the parameter and the key according to the first matching degree and the context of the parameter in the request message. The degree of matching between words.
- the name message is included in the request message received by the server, the name is determined by the probability algorithm, and the name is the name of the name.
- the possible probability ie, the first matching degree
- the possible probability of the account meaning ie, the first matching degree
- a password parameter such as password
- the server In the process of matching the parameters included in the request message with the keywords obtained by the machine learning in advance, the server first determines the first matching degree between the parameter and the keyword through the probability algorithm, and then uses the decision tree algorithm according to the first A matching degree and a context of the parameter in the request message determine a matching degree between the parameter and the keyword, thereby improving the accuracy and reliability of the matching degree acquisition.
- step S20 may further include:
- Step S23 Split the parameters included in the request message into the first sub-parameter and the second sub-parameter according to the keyword obtained by the pre-machine learning.
- Step S24 matching the first sub-parameter and the second sub-parameter with a keyword obtained by pre-machine learning, determining a first probability that the first sub-parameter matches the first keyword, and the The second probability that the second sub-parameter matches the second keyword.
- Step S25 Determine, according to the first probability, the second probability, and a context of the parameter in the request message, a degree of matching between the parameter and the keyword.
- the server in the process of matching the parameters included in the request message with the keywords obtained by the machine learning in advance, the server first splits the plurality of sub-parameters according to the keywords included in the request message to the parameters included in the request message. For example, it can be split into a first sub-parameter and a second sub-parameter. Then, the first sub-parameter and the second sub-parameter are respectively matched with the keywords obtained by the pre-machine learning, and the first probability that the first sub-parameter matches the first keyword is determined according to the probabilistic algorithm, and the second sub-parameter and the second sub-parameter are determined. The second probability of the second keyword match. Then, the decision tree algorithm is used according to the first probability, the second probability, and the context of the parameter in the request message, the degree of matching between the parameter and the keyword, so as to determine the meaning of the parameter in the request message according to the matching degree.
- the request message may be according to the first probability and the parameter. a context, calculating a third probability that the first sub-parameter matches the first keyword, and determining a fourth probability that the second sub-parameter matches the second keyword according to the second probability and a context of the parameter in the request message . Finally, the magnitudes of the third probability and the fourth probability are compared, and the larger of the third probability and the fourth probability is set as the parameter and the keyword.
- determining the degree of matching between the parameters and the keywords may also be flexibly set according to specific circumstances, and does not limit the present invention.
- the flagname is first split to obtain the flag and the name, wherein the flag is selected due to multiple training encounters of the mark and the identifier, and the name is multiple times. Training to meet names, accounts, etc. will be selected. It is determined by various algorithms that the flagname is used to mark the possible probability of 40%, the flagname is used for the account name with a probability of 60%, and then the password parameter, such as password, appears in the following in the request message according to the parameter, and the flagname is determined as the account at this time.
- the possible probability is 90%, that is, the decision tree algorithm determines that the matching degree between the parameter flagname and the keyword account is 90%.
- the server may split the parameter, and then determine the matching degree between the parameter and the keyword according to the probabilistic algorithm and the decision tree algorithm according to the split sub-parameter and the context of the parameter in the request message.
- Step S40 Determine whether the identifier of the non-sensitive information set by the channel side exists in the request message.
- Step S50 When the identifier of the non-sensitive information set by the channel party exists in the request message, it is determined that the information of the request message is not leaked.
- the fourth embodiment of the information leakage detecting method of the present invention may also be based on the second or third embodiment of the above information leakage detecting method.
- the channel side may identify the request message that needs to be transmitted in plaintext, and set the request message that needs to be transmitted in plaintext as non-sensitive information.
- the server When the server receives the request message sent by the channel, it may first determine whether the identifier of the non-sensitive information set by the channel side exists in the request message. When the identifier of the non-sensitive information set by the channel is found in the request message, it is determined that the information of the request message is not leaked, even if the request message is a plaintext transmission, indicating that the request message does not have the risk of information leakage, and the record does not need to be recorded. Information about the request message.
- the server of the embodiment After receiving the request message sent by the channel side, the server of the embodiment determines that the information of the request message is not leaked when it is determined that the identifier of the non-sensitive information set by the channel side exists in the request message. It ensures that the requested message can be transmitted in plain text, which improves the reliability of information leakage detection.
- a fifth embodiment of the information leakage detecting method of the present invention is proposed, in which the information leakage detection is performed in this embodiment.
- the method also includes:
- Step S60 Acquire a response data packet returned to the channel side based on the request message.
- Step S70 Compare information included in the response data packet with a target parameter in a field corresponding to pre-recording the request message.
- Step S80 When the response data packet contains more information than the target parameter in the field, determine that the information of the response data packet is leaked, and record related information of the response data packet.
- step S60 in the fifth embodiment of the information leakage detecting method of the present invention may be performed after the above step S10, or may be performed after the above step S20 or step S30 or step S40 or step S50.
- the server when the server receives the request message sent by the channel and feeds back the response packet to the channel according to the request message, in order to further reduce the risk of information leakage, the response packet needs to be detected.
- the server when the server receives the request message sent by the channel, the server records the target parameter in the corresponding field of the request message according to the request message. The server then obtains a response data packet returned to the channel side based on the request message, compares the information contained in the response data packet with the target parameter in the corresponding field of the pre-recorded request message, and determines whether the information contained in the response data packet is more than Record the target parameter in the corresponding field of the request message. When the response packet contains more information than the target parameter in the field, it is determined that the information of the response packet is leaked, and the related information of the response packet is recorded, and the related information may include more data than the target parameter.
- the related information of the response data packet may be stored in a preset database, and the record field may include related information such as a request url, a sensitive parameter, a serial number, and the like of the response data packet.
- the request url is an interface address that the channel party binds to the server;
- the sensitive parameter is data that is more than the target parameter, and may include multiple parameters;
- the serial number is a number, which serves to sort the response data packet.
- the response packet may be detected by the security application by using the preset security application relay.
- the server when the channel direction server requests to query the page of the transaction record, the server will need to return to the channel side html page field record, where the request is the page, and the bank card number has not been entered yet for query.
- the transaction record includes the transaction amount and transaction time, and the html page field records the transaction amount and transaction time.
- the server When the subsequent channel sends a bank card number to the server to initiate an http query request, when the bank card number is entered for inquiry, when the bank card parameter is matched to the bank card number, the server records it, and then returns the response packet and the recorded web page according to the bank card number.
- the parameters in the field are compared. If the returned parameters are more than the parameters recorded in the field, the server returns more information than the channel party's business requirements.
- the request url, sensitive parameters, and serial number are recorded in the database redis.
- a page of the channel bank website is used to query the transaction record according to the bank card number input by the user, and the response packet returned by the server according to the request includes the transaction amount of 1000, the transaction time is 20160101, and the transaction user is test.
- the transaction user's bank card number is xxxxx, the merchant name is aaa; the transaction amount is 400, the transaction time is 20161201, the transaction user is bbb, the transaction user bank card number is aaaa, the merchant name is cccc, etc., which shows the channel business here. All that is required is transaction data, but the returned information also contains the user's identity information, etc., and there are too many returned information, and it is judged that sensitive information may be leaked.
- the data with security risks stored in the database may be exported, that is, the relevant information of the response data packets recorded in the database is exported, and the relevant security test personnel perform corresponding processing.
- the server determines, by comparing the response data packet based on the request message with the target parameter required by the request message, which parameters in the response data packet are more than the target parameter required by the request message, and the excess parameter relates to Sensitive information and record information about the response packet. Therefore, the information returned by the interface is not the data that the front-end channel page needs to display, and it is judged as sensitive information leakage, and automatic detection is realized, and manual detection is avoided, which not only improves the efficiency of information leakage detection, but also reduces The risk of information disclosure.
- a person skilled in the art may understand that all or part of the steps of implementing the above embodiments may be completed by hardware, or may be instructed by a program to execute related hardware, and the program may be stored in a computer readable storage medium.
- the storage medium mentioned may be a read only memory, a magnetic disk or an optical disk or the like.
- the information leakage detecting apparatus of this embodiment includes:
- the receiving module 100 is configured to receive a request message sent by a channel.
- the information leakage detecting device is applied to the server, and mainly detects the leakage of the interface sensitive information.
- the server is a back-end server corresponding to the front-end channel.
- the server receives the http request message sent by the channel or returns the response packet to the channel according to the request message, the server detects the request message or the response packet to prevent the information. Give way.
- the server may be pre-configured with a security application for intercepting the http request message sent by the channel to the server for information leakage detection, or intercepting the response packet returned by the server according to the request message to the channel for information leakage detection. . That is, when the channel direction server sends an http request message or the server feeds back the response data packet to the channel side, it can transit through the security application.
- the channel is the tested product, including online banking, bank background app, etc.
- the app can run on PC, mobile phone and other terminals.
- the channel party can send a request message to the server according to its own usage requirement, and the server can call the receiving module 100 to receive the request message sent by the channel party, and the request message includes inputting the account password, logging in, sending the information, opening the interface, and the like.
- the matching module 200 is configured to match the parameter included in the request message with a keyword obtained by machine learning in advance, and obtain a matching degree between the parameter and the keyword based on the matching result.
- the server may perform machine learning in advance through a preset security application to identify multiple keywords, that is, automatically identify more keywords through machine learning in advance, for example, email, email, e-mail, and email. , EMAIL, etc., instead of simply identifying emails.
- keywords are first obtained by a large amount of learning recognition of a sample, such as username, Username, USNNANME, user, name, and the like.
- a sample such as username, Username, USNNANME, user, name, and the like.
- you can directly identify such as username, Username, UserName, etc.
- you can also directly identify such as username, uname, name, etc.
- the algorithm and the probabilistic algorithm select the most probable probability for identification matching. The following examples will be described in detail.
- the server determines whether the request message is a plaintext transmission or a ciphertext transmission, that is, the matching module 200 sets the parameters included in the request message.
- the keywords obtained by the pre-machine learning are matched, and the degree of matching between the parameters included in the request message and the keywords obtained by the machine learning in advance is obtained, so as to determine the meaning of the parameter in the request message according to the matching degree.
- the parameters included in the request message may include email, username, passwd, flagname, and the like; when the request message is ciphertext transmission, the parameters included in the request message are some garbled characters.
- the first determining module 300 is configured to determine that the information of the request message is leaked when the matching degree is greater than a preset threshold, and record related information of the request message.
- the matching degree between the parameter included in the request message and the keyword obtained by the machine learning is obtained, it is determined whether the matching degree is greater than a preset threshold, and the preset threshold may be flexibly set according to a specific situation.
- the first determining module 300 determines that the meaning of the parameter in the request message is the meaning corresponding to the keyword, and after determining that the parameter is in the meaning of the request message, , it can be determined that the request message is a clear text transmission, there will be a risk of information leakage. At this time, it is determined that the information of the request message is leaked, and the related information of the request message is recorded, and the related information of the request message may be stored in a preset database.
- the record field may include the request url of the request message (the url is a uniform resource locator), the request sensitive parameter, the serial number, and the like.
- the request url is an interface address bound to the server by the channel party; the request sensitive parameter is plaintext data, and may include multiple parameters; the sequence number is a number, which serves to sort the request message.
- the security application detects that the data of the transmission process of the request message is a plaintext transmission, and the security application records the related information of the request message in the database redis of the security application. It should be noted that, regardless of whether the request message sent by the channel is a plaintext transmission or a ciphertext transmission, the security application needs to transfer the request message to the backend server.
- the matching degree between the keyword and the parameter is greater than the preset threshold, it indicates that the parameter cannot be determined in the meaning of the request message. At this time, it is determined that the request message is ciphertext transmission, and there is no risk of information leakage. When the request message is ciphertext transmission, it is determined that the information of the request message is not leaked, and it is not necessary to record related information of the request message.
- the data with security risks stored in the database may be exported, that is, the relevant information of the request message recorded in the database is exported, and the relevant security test personnel perform corresponding processing.
- the server when the channel direction server delivers the http request message, the server receives the request message, wherein the request message includes parameters including Username, passwd, IDCard, and the like.
- the server matches the parameters included in the request message with the keywords obtained by the pre-machine learning, and determines that the values of the parameters Username, passwd, IDCard, etc. are plaintext transmission, that is, the user name Username is aaaaaa, the password passwd is bbbbb, and the bank card number IDCard is 4205xxxxxxxxxx11, at this time, it is determined that the information of the request message is leaked, and the related information of the request message is recorded.
- the request message sent by the channel is received, and the parameter included in the request message is matched with the keyword obtained by the pre-machine learning, and the parameter included in the request message is obtained between the parameter included in the request message and the keyword obtained by the pre-machine learning.
- the matching degree between the parameter and the keyword is greater than a preset threshold, it is determined that the information of the request message is leaked, and related information of the request message is recorded. Therefore, by machine learning to automatically identify more keywords, it is possible to identify sensitive information substantially and effectively, reduce the duplication of safety testers, improve the efficiency of information leakage detection and reduce the risk of information leakage.
- the matching module 200 may include:
- the first determining unit is configured to match the parameter included in the request message with a keyword obtained by machine learning in advance, and determine a first matching degree between the parameter and the keyword.
- a second determining unit configured to determine, according to the first matching degree and a context of the parameter in the request message, a degree of matching between the parameter and the keyword.
- the first determining unit compares the parameters with the keywords, and determines the parameter and the keyword. The first match.
- multiple parameters may be compared with each keyword to determine the first matching degree between each parameter and the keyword.
- the second determining unit performs weighting calculation according to the matching degree corresponding to each parameter, and obtains a first matching degree between the plurality of parameters and the keyword, and then determines according to the first matching degree and the context of the parameter in the request message. The degree of matching between this parameter and the keyword.
- the name message is included in the request message received by the server, the name is determined by the probability algorithm, and the name is the name of the name.
- the possible probability ie, the first matching degree
- the possible probability of the account meaning ie, the first matching degree
- a password parameter such as password
- the server In the process of matching the parameters included in the request message with the keywords obtained by the machine learning in advance, the server first determines the first matching degree between the parameter and the keyword through the probability algorithm, and then uses the decision tree algorithm according to the first A matching degree and a context of the parameter in the request message determine a matching degree between the parameter and the keyword, thereby improving the accuracy and reliability of the matching degree acquisition.
- the matching module 200 may further include:
- the splitting unit is configured to split the parameters included in the request message into the first sub-parameter and the second sub-parameter according to the keyword obtained by the pre-machine learning.
- a matching unit configured to match the first sub-parameter and the second sub-parameter with a keyword obtained by pre-machine learning, and determine a first probability that the first sub-parameter matches the first keyword, and The second probability that the second sub-parameter matches the second keyword.
- a third determining unit configured to determine, according to the first probability, the second probability, and a context of the parameter in the request message, a degree of matching between the parameter and the keyword.
- the splitting unit first splits the parameters included in the request message according to the keywords obtained by the pre-machine learning.
- a plurality of sub-parameters for example, can be split into a first sub-parameter and a second sub-parameter.
- the first sub-parameter and the second sub-parameter are respectively matched by the matching unit to the keyword obtained by the pre-machine learning, and the first probability that the first sub-parameter matches the first keyword is determined according to the probabilistic algorithm, and the second sub-determination is determined.
- the second probability that the parameter matches the second keyword.
- determining, by the third determining unit, the first probability, the second probability, and the context of the parameter in the request message, the degree of matching between the parameter and the keyword so as to determine the parameter in the request message according to the matching degree.
- the request message may be according to the first probability and the parameter. a context, calculating a third probability that the first sub-parameter matches the first keyword, and determining a fourth probability that the second sub-parameter matches the second keyword according to the second probability and a context of the parameter in the request message . Finally, the magnitudes of the third probability and the fourth probability are compared, and the larger of the third probability and the fourth probability is set as the parameter and the keyword.
- determining the degree of matching between the parameters and the keywords may also be flexibly set according to specific circumstances, and does not limit the present invention.
- the flagname is first split to obtain the flag and the name, wherein the flag is selected due to multiple training encounters of the mark and the identifier, and the name is multiple times. Training to meet names, accounts, etc. will be selected. It is determined by various algorithms that the flagname is used to mark the possible probability of 40%, the flagname is used for the account name with a probability of 60%, and then the password parameter, such as password, appears in the following in the request message according to the parameter, and the flagname is determined as the account at this time.
- the possible probability is 90%, that is, the decision tree algorithm determines that the matching degree between the parameter flagname and the keyword account is 90%.
- the server may split the parameter, and then determine the matching degree between the parameter and the keyword according to the probabilistic algorithm and the decision tree algorithm according to the split sub-parameter and the context of the parameter in the request message.
- the information leakage detecting apparatus in the embodiment further includes:
- the determining module 400 is configured to determine whether the identifier of the non-sensitive information set by the channel side exists in the request message.
- the second determining module 500 is configured to determine that the information of the request message is not leaked when the identifier of the non-sensitive information set by the channel party exists in the request message.
- the fourth embodiment of the information leakage detecting apparatus of the present invention may also be proposed based on the second or third embodiment of the information leakage detecting apparatus.
- the channel side may identify the request message that needs to be transmitted in plaintext, and set the request message that needs to be transmitted in plaintext as non-sensitive information.
- the determining module 400 may first determine whether the identifier of the non-sensitive information set by the channel side exists in the request message. When the identifier of the non-sensitive information set by the channel side exists in the request message, the second determining module 500 determines that the information of the request message is not leaked, even if the request message is a plaintext transmission, indicating that the request message does not have the risk of information leakage. There is no need to record information about the request message.
- the server of the embodiment After receiving the request message sent by the channel side, the server of the embodiment determines that the information of the request message is not leaked when it is determined that the identifier of the non-sensitive information set by the channel side exists in the request message. It ensures that the requested message can be transmitted in plain text, which improves the reliability of information leakage detection.
- a fifth embodiment of the information leakage detecting device of the present invention is proposed.
- the information leakage detection is performed.
- the device also includes:
- the obtaining module 600 is configured to obtain a response data packet returned to the channel side based on the request message.
- the comparison module 700 is configured to compare information included in the response data packet with a target parameter in a field corresponding to pre-recording the request message.
- the third determining module 800 is configured to: when the response data packet includes more information than the target parameter in the field, determine that the information of the response data packet is leaked, and record related information of the response data packet. .
- the server when the server receives the request message sent by the channel and feeds back the response packet to the channel according to the request message, in order to further reduce the risk of information leakage, the response packet needs to be detected.
- the server when the server receives the request message sent by the channel, the server records the target parameter in the corresponding field of the request message according to the request message. Then, the server call obtaining module 600 obtains a response data packet returned to the channel side based on the request message, and the comparison module 700 compares the information included in the response data packet with the target parameter in the corresponding field of the pre-recorded request message, and determines the response data packet. Whether the included information is more than the target parameter in the field corresponding to the pre-recorded request message.
- the third determining module 800 determines that the information of the response data packet is leaked, and records related information of the response data packet, and the related information may include more than the target parameter.
- the related information of the response data packet may be stored in a preset database, and the record field may include related information such as a request url, a sensitive parameter, a serial number, and the like of the response data packet.
- the request url is an interface address that the channel party binds to the server;
- the sensitive parameter is data that is more than the target parameter, and may include multiple parameters;
- the serial number is a number, which serves to sort the response data packet.
- the response packet may be detected by the security application by using the preset security application relay.
- the server when the channel direction server requests to query the page of the transaction record, the server will need to return to the channel side html page field record, where the request is the page, and the bank card number has not been entered yet for query.
- the transaction record includes the transaction amount and transaction time, and the html page field records the transaction amount and transaction time.
- the server When the subsequent channel sends a bank card number to the server to initiate an http query request, when the bank card number is entered for inquiry, when the bank card parameter is matched to the bank card number, the server records it, and then returns the response packet and the recorded web page according to the bank card number.
- the parameters in the field are compared. If the returned parameters are more than the parameters recorded in the field, the server returns more information than the channel party's business requirements.
- the request url, sensitive parameters, and serial number are recorded in the database redis.
- a page of the channel bank website is used to query the transaction record according to the bank card number input by the user, and the response packet returned by the server according to the request includes the transaction amount of 1000, the transaction time is 20160101, and the transaction user is test.
- the transaction user's bank card number is xxxxx, the merchant name is aaa; the transaction amount is 400, the transaction time is 20161201, the transaction user is bbb, the transaction user bank card number is aaaa, the merchant name is cccc, etc., which shows the channel business here. All that is required is transaction data, but the returned information also contains the user's identity information, etc., and there are too many returned information, and it is judged that sensitive information may be leaked.
- the data with security risks stored in the database may be exported, that is, the relevant information of the response data packets recorded in the database is exported, and the relevant security test personnel perform corresponding processing.
- the server determines, by comparing the response data packet based on the request message with the target parameter required by the request message, which parameters in the response data packet are more than the target parameter required by the request message, and the excess parameter relates to Sensitive information and record information about the response packet. Therefore, the information returned by the interface is not the data that the front-end channel page needs to display, and it is judged as sensitive information leakage, and automatic detection is realized, and manual detection is avoided, which not only improves the efficiency of information leakage detection, but also reduces The risk of information disclosure.
- the foregoing receiving module 100, the matching module 200, the first determining module 300, and the like may be embedded in the hardware leakage detection device or may be stored in the memory of the information leakage detecting device in software.
- the processor can be a central processing unit (CPU), a microprocessor, a microcontroller, or the like.
- FIG. 9 is a schematic structural diagram of a server in a hardware operating environment according to an embodiment of the present invention.
- the server may include a processor 1001, a communication bus 1002, a memory 1003, and a communication interface 1004.
- the communication bus 1002 is used to implement connection communication between these components.
- the memory 1003 may be a high speed RAM memory or a stable memory (non-volatile) Memory), such as disk storage.
- the memory 1003 can also optionally be a storage device independent of the aforementioned processor 1001.
- the communication interface 1004 can include a user interface (not shown in FIG. 9) and/or a network interface (not shown in FIG. 9), wherein the user interface can be used to connect input/output devices such as a display screen and a keyboard, and the network interface can be used. Connect to the network, including wired networks and/or wireless networks.
- server structure illustrated in FIG. 9 does not constitute a limitation to the server, and may include more or less components than those illustrated, or some components may be combined, or different component arrangements.
- an operating system, a network communication module, and an information leakage detecting program may be included in the memory 1003 as a computer storage medium.
- the processor 1001 can be used to call the information leak detection program stored in the memory 1003 and perform the following operations:
- the matching degree is greater than the preset threshold, determining that the information of the request message is leaked, and recording related information of the request message.
- processor 1001 may execute an information leakage detection program stored in the memory 1003 to implement the following operations:
- processor 1001 may execute an information leakage detection program stored in the memory 1003 to implement the following operations:
- processor 1001 may execute an information leakage detection program stored in the memory 1003 to implement the following operations:
- processor 1001 may execute an information leakage detection program stored in the memory 1003 to implement the following operations:
- the response data packet contains more information than the target parameter in the field, it is determined that the information of the response data packet is leaked, and related information of the response data packet is recorded.
- the request message sent by the channel is received, and the parameter included in the request message is matched with the keyword obtained by the pre-machine learning, and the parameter included in the request message is obtained between the parameter included in the request message and the keyword obtained by the pre-machine learning.
- the matching degree between the parameter and the keyword is greater than a preset threshold, it is determined that the information of the request message is leaked, and related information of the request message is recorded. Therefore, by machine learning to automatically identify more keywords, it is possible to identify sensitive information substantially and effectively, reduce the duplication of safety testers, improve the efficiency of information leakage detection and reduce the risk of information leakage.
- the present invention provides a computer readable storage medium storing one or more programs, the one or more programs being executable by one or more processors to implement the following steps:
- the matching degree is greater than the preset threshold, determining that the information of the request message is leaked, and recording related information of the request message.
- the computer readable storage medium storage is further configured to: match a parameter included in the request message with a keyword obtained by pre-machine learning, and obtain between the parameter and the keyword based on a matching result. Steps to match the degree:
- the computer readable storage medium storage is further configured to: match a parameter included in the request message with a keyword obtained by pre-machine learning, and obtain between the parameter and the keyword based on a matching result. Steps to match the degree:
- the computer readable storage medium stores steps further for implementing a request message sent by the receiving channel side:
- the computer readable storage medium storage is further configured to implement the following steps:
- the response data packet contains more information than the target parameter in the field, it is determined that the information of the response data packet is leaked, and related information of the response data packet is recorded.
- a person skilled in the art may understand that all or part of the steps of implementing the above embodiments may be completed by hardware, or may be instructed by a program to execute related hardware, and the program may be stored in a computer readable storage medium.
- the storage medium mentioned may be a read only memory, a magnetic disk or an optical disk or the like.
Landscapes
- Engineering & Computer Science (AREA)
- Theoretical Computer Science (AREA)
- General Engineering & Computer Science (AREA)
- Physics & Mathematics (AREA)
- General Physics & Mathematics (AREA)
- Software Systems (AREA)
- Computer Security & Cryptography (AREA)
- Databases & Information Systems (AREA)
- Health & Medical Sciences (AREA)
- General Health & Medical Sciences (AREA)
- Computer Hardware Design (AREA)
- Bioethics (AREA)
- Data Mining & Analysis (AREA)
- Computational Linguistics (AREA)
- Artificial Intelligence (AREA)
- Medical Informatics (AREA)
- Audiology, Speech & Language Pathology (AREA)
- Computing Systems (AREA)
- Computer Vision & Pattern Recognition (AREA)
- Evolutionary Computation (AREA)
- Mathematical Physics (AREA)
- Signal Processing (AREA)
- Computer Networks & Wireless Communication (AREA)
- Technology Law (AREA)
- Data Exchanges In Wide-Area Networks (AREA)
- Storage Device Security (AREA)
- Information Transfer Between Computers (AREA)
Abstract
Description
Claims (22)
- 一种信息泄露检测方法,其特征在于,所述信息泄露检测方法包括以下步骤:接收渠道方发送的请求消息;将所述请求消息中包含的参数与预先机器学习得到的关键字进行匹配,并基于匹配结果获取所述参数与所述关键字之间的匹配度;当所述匹配度大于预设阈值时,确定所述请求消息的信息被泄露,并记录所述请求消息的相关信息。
- 如权利要求1所述的信息泄露检测方法,其特征在于,所述将所述请求消息中包含的参数与预先机器学习得到的关键字进行匹配,并基于匹配结果获取所述参数与所述关键字之间的匹配度包括:将所述请求消息中包含的参数与预先机器学习得到的关键字进行匹配,确定所述参数与所述关键字之间的第一匹配度;根据所述第一匹配度及所述参数在所述请求消息中的上下文,确定所述参数与所述关键字之间的匹配度。
- 如权利要求1所述的信息泄露检测方法,其特征在于,所述将所述请求消息中包含的参数与预先机器学习得到的关键字进行匹配,并基于匹配结果获取所述参数与所述关键字之间的匹配度包括:根据预先机器学习得到的关键字对所述请求消息中包含的参数拆分为第一子参数和第二子参数;将所述第一子参数和所述第二子参数分别与预先机器学习得到的关键字进行匹配,确定所述第一子参数与第一关键字匹配的第一概率,及所述第二子参数与第二关键字匹配的第二概率;根据所述第一概率、所述第二概率及所述参数在所述请求消息中的上下文,确定所述参数与所述关键字之间的匹配度。
- 如权利要求1所述的信息泄露检测方法,其特征在于,所述接收渠道方发送的请求消息之后包括:判断所述请求消息中是否存在所述渠道方设置的非敏感信息的标识;当所述请求消息中存在所述渠道方设置的非敏感信息的标识时,确定所述请求消息的信息未被泄露。
- 如权利要求1所述的信息泄露检测方法,其特征在于,所述信息泄露检测方法还包括:获取基于所述请求消息返回至所述渠道方的响应数据包;将所述响应数据包所包含的信息与预先记录所述请求消息对应字段中的目标参数进行对比;当所述响应数据包所包含的信息多于所述字段中的目标参数时,确定所述响应数据包的信息被泄露,并记录所述响应数据包的相关信息。
- 如权利要求2所述的信息泄露检测方法,其特征在于,所述信息泄露检测方法还包括:获取基于所述请求消息返回至所述渠道方的响应数据包;将所述响应数据包所包含的信息与预先记录所述请求消息对应字段中的目标参数进行对比;当所述响应数据包所包含的信息多于所述字段中的目标参数时,确定所述响应数据包的信息被泄露,并记录所述响应数据包的相关信息。
- 一种信息泄露检测装置,其特征在于,所述信息泄露检测装置包括:接收模块,用于接收渠道方发送的请求消息;匹配模块,用于将所述请求消息中包含的参数与预先机器学习得到的关键字进行匹配,并基于匹配结果获取所述参数与所述关键字之间的匹配度;第一确定模块,用于当所述匹配度大于预设阈值时,确定所述请求消息的信息被泄露,并记录所述请求消息的相关信息。
- 如权利要求7所述的信息泄露检测装置,其特征在于,所述匹配模块包括:第一确定单元,用于将所述请求消息中包含的参数与预先机器学习得到的关键字进行匹配,确定所述参数与所述关键字之间的第一匹配度;第二确定单元,用于根据所述第一匹配度及所述参数在所述请求消息中的上下文,确定所述参数与所述关键字之间的匹配度。
- 如权利要求7所述的信息泄露检测装置,其特征在于,所述匹配模块还包括:拆分单元,用于根据预先机器学习得到的关键字对所述请求消息中包含的参数拆分为第一子参数和第二子参数;匹配单元,用于将所述第一子参数和所述第二子参数分别与预先机器学习得到的关键字进行匹配,确定所述第一子参数与第一关键字匹配的第一概率,及所述第二子参数与第二关键字匹配的第二概率;第三确定单元,用于根据所述第一概率、所述第二概率及所述参数在所述请求消息中的上下文,确定所述参数与所述关键字之间的匹配度。
- 如权利要求7所述的信息泄露检测装置,其特征在于,所述信息泄露检测装置还包括:判断模块,用于判断所述请求消息中是否存在所述渠道方设置的非敏感信息的标识;第二确定模块,用于当所述请求消息中存在所述渠道方设置的非敏感信息的标识时,确定所述请求消息的信息未被泄露。
- 如权利要求7所述的信息泄露检测装置,其特征在于,所述信息泄露检测装置还包括:获取模块,用于获取基于所述请求消息返回至所述渠道方的响应数据包;对比模块,用于将所述响应数据包所包含的信息与预先记录所述请求消息对应字段中的目标参数进行对比;第三确定模块,用于当所述响应数据包所包含的信息多于所述字段中的目标参数时,确定所述响应数据包的信息被泄露,并记录所述响应数据包的相关信息。
- 如权利要求8所述的信息泄露检测装置,其特征在于,所述信息泄露检测装置还包括:获取模块,用于获取基于所述请求消息返回至所述渠道方的响应数据包;对比模块,用于将所述响应数据包所包含的信息与预先记录所述请求消息对应字段中的目标参数进行对比;第三确定模块,用于当所述响应数据包所包含的信息多于所述字段中的目标参数时,确定所述响应数据包的信息被泄露,并记录所述响应数据包的相关信息。
- 一种服务器,其特征在于,所述服务器包括处理器及存储器,所述处理器用于执行存储器中存储的信息泄露检测程序,以实现以下步骤:接收渠道方发送的请求消息;将所述请求消息中包含的参数与预先机器学习得到的关键字进行匹配,并基于匹配结果获取所述参数与所述关键字之间的匹配度;当所述匹配度大于预设阈值时,确定所述请求消息的信息被泄露,并记录所述请求消息的相关信息。
- 如权利要求13所述的服务器,其特征在于,所述处理器还用于执行存储器中存储的信息泄露检测程序,以实现将所述请求消息中包含的参数与预先机器学习得到的关键字进行匹配,并基于匹配结果获取所述参数与所述关键字之间的匹配度的步骤:将所述请求消息中包含的参数与预先机器学习得到的关键字进行匹配,确定所述参数与所述关键字之间的第一匹配度;根据所述第一匹配度及所述参数在所述请求消息中的上下文,确定所述参数与所述关键字之间的匹配度。
- 如权利要求13所述的服务器,其特征在于,所述处理器还用于执行存储器中存储的信息泄露检测程序,以实现将所述请求消息中包含的参数与预先机器学习得到的关键字进行匹配,并基于匹配结果获取所述参数与所述关键字之间的匹配度的步骤:根据预先机器学习得到的关键字对所述请求消息中包含的参数拆分为第一子参数和第二子参数;将所述第一子参数和所述第二子参数分别与预先机器学习得到的关键字进行匹配,确定所述第一子参数与第一关键字匹配的第一概率,及所述第二子参数与第二关键字匹配的第二概率;根据所述第一概率、所述第二概率及所述参数在所述请求消息中的上下文,确定所述参数与所述关键字之间的匹配度。
- 如权利要求13所述的服务器,其特征在于,所述处理器还用于执行存储器中存储的信息泄露检测程序,以实现接收渠道方发送的请求消息之后的步骤:判断所述请求消息中是否存在所述渠道方设置的非敏感信息的标识;当所述请求消息中存在所述渠道方设置的非敏感信息的标识时,确定所述请求消息的信息未被泄露。
- 如权利要求13所述的服务器,其特征在于,所述处理器还用于执行存储器中存储的信息泄露检测程序,以实现以下步骤:获取基于所述请求消息返回至所述渠道方的响应数据包;将所述响应数据包所包含的信息与预先记录所述请求消息对应字段中的目标参数进行对比;当所述响应数据包所包含的信息多于所述字段中的目标参数时,确定所述响应数据包的信息被泄露,并记录所述响应数据包的相关信息。
- 一种计算机可读存储介质,其特征在于,所述计算机可读存储介质存储有一个或者多个程序,所述一个或者多个程序可被一个或者多个处理器执行,以实现以下步骤:接收渠道方发送的请求消息;将所述请求消息中包含的参数与预先机器学习得到的关键字进行匹配,并基于匹配结果获取所述参数与所述关键字之间的匹配度;当所述匹配度大于预设阈值时,确定所述请求消息的信息被泄露,并记录所述请求消息的相关信息。
- 如权利要求18所述的计算机可读存储介质,其特征在于,所述计算机可读存储介质存储还用于实现将所述请求消息中包含的参数与预先机器学习得到的关键字进行匹配,并基于匹配结果获取所述参数与所述关键字之间的匹配度的步骤:将所述请求消息中包含的参数与预先机器学习得到的关键字进行匹配,确定所述参数与所述关键字之间的第一匹配度;根据所述第一匹配度及所述参数在所述请求消息中的上下文,确定所述参数与所述关键字之间的匹配度。
- 如权利要求18所述的计算机可读存储介质,其特征在于,所述计算机可读存储介质存储还用于实现将所述请求消息中包含的参数与预先机器学习得到的关键字进行匹配,并基于匹配结果获取所述参数与所述关键字之间的匹配度的步骤:根据预先机器学习得到的关键字对所述请求消息中包含的参数拆分为第一子参数和第二子参数;将所述第一子参数和所述第二子参数分别与预先机器学习得到的关键字进行匹配,确定所述第一子参数与第一关键字匹配的第一概率,及所述第二子参数与第二关键字匹配的第二概率;根据所述第一概率、所述第二概率及所述参数在所述请求消息中的上下文,确定所述参数与所述关键字之间的匹配度。
- 如权利要求18所述的计算机可读存储介质,其特征在于,所述计算机可读存储介质存储还用于实现接收渠道方发送的请求消息之后的步骤:判断所述请求消息中是否存在所述渠道方设置的非敏感信息的标识;当所述请求消息中存在所述渠道方设置的非敏感信息的标识时,确定所述请求消息的信息未被泄露。
- 如权利要求18所述的计算机可读存储介质,其特征在于,所述计算机可读存储介质存储还用于实现以下步骤:获取基于所述请求消息返回至所述渠道方的响应数据包;将所述响应数据包所包含的信息与预先记录所述请求消息对应字段中的目标参数进行对比;当所述响应数据包所包含的信息多于所述字段中的目标参数时,确定所述响应数据包的信息被泄露,并记录所述响应数据包的相关信息。
Priority Applications (6)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
SG11201901807YA SG11201901807YA (en) | 2017-03-17 | 2017-06-23 | Method and device for detecting information leakage, server, and computer-readable storage medium |
JP2018527065A JP6688389B2 (ja) | 2017-03-17 | 2017-06-23 | 情報漏えい検査の方法、装置、サーバー及びコンピュータ可読記憶媒体 |
AU2017403386A AU2017403386A1 (en) | 2017-03-17 | 2017-06-23 | Information leakage detection method and device, server, and computer-readable storage medium |
US16/071,140 US20210042443A1 (en) | 2017-03-17 | 2017-06-23 | Method and device for detecting information leakage, server, and computer-readable storage medium |
EP17900903.0A EP3447669B1 (en) | 2017-03-17 | 2017-06-23 | Information leakage detection method and device, server, and computer-readable storage medium |
KR1020187035322A KR102157712B1 (ko) | 2017-03-17 | 2017-06-23 | 정보 유출 검출 방법 및 장치 |
Applications Claiming Priority (2)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
CN201710164043.7 | 2017-03-17 | ||
CN201710164043.7A CN107066882B (zh) | 2017-03-17 | 2017-03-17 | 信息泄露检测方法及装置 |
Publications (1)
Publication Number | Publication Date |
---|---|
WO2018166099A1 true WO2018166099A1 (zh) | 2018-09-20 |
Family
ID=59620091
Family Applications (1)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
PCT/CN2017/089807 WO2018166099A1 (zh) | 2017-03-17 | 2017-06-23 | 信息泄露检测方法及装置、服务器及计算机可读存储介质 |
Country Status (8)
Country | Link |
---|---|
US (1) | US20210042443A1 (zh) |
EP (1) | EP3447669B1 (zh) |
JP (1) | JP6688389B2 (zh) |
KR (1) | KR102157712B1 (zh) |
CN (1) | CN107066882B (zh) |
AU (1) | AU2017403386A1 (zh) |
SG (1) | SG11201901807YA (zh) |
WO (1) | WO2018166099A1 (zh) |
Cited By (3)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
CN110502514A (zh) * | 2019-08-15 | 2019-11-26 | 中国平安财产保险股份有限公司 | 数据采集方法、装置、设备及计算机可读存储介质 |
CN111753149A (zh) * | 2020-06-28 | 2020-10-09 | 深圳前海微众银行股份有限公司 | 敏感信息的检测方法、装置、设备及存储介质 |
CN112118241A (zh) * | 2020-09-08 | 2020-12-22 | 上海谋乐网络科技有限公司 | 审计渗透测试方法、测试节点服务器、管理服务器及*** |
Families Citing this family (11)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
CN109522351A (zh) * | 2018-10-22 | 2019-03-26 | 中国银行股份有限公司 | 一种数据处理方法及*** |
CN111008401A (zh) * | 2019-12-10 | 2020-04-14 | 中国银行股份有限公司 | 一种文本保存方法及装置 |
CN111159703B (zh) * | 2019-12-31 | 2022-12-06 | 奇安信科技集团股份有限公司 | 虚拟机数据泄露检测方法及装置 |
CN111353174B (zh) * | 2020-03-16 | 2021-06-11 | 杭州康晟健康管理咨询有限公司 | 一种医疗机构的私密客户信息管理***及方法 |
CN112052364B (zh) * | 2020-09-27 | 2024-07-23 | 深圳前海微众银行股份有限公司 | 敏感信息检测方法、装置、设备与计算机可读存储介质 |
CN112364346B (zh) * | 2020-10-27 | 2024-03-22 | 杭州安恒信息技术股份有限公司 | 一种泄露数据探测方法、装置、设备及介质 |
CN113904828B (zh) * | 2021-09-29 | 2024-01-05 | 中国工商银行股份有限公司 | 接口的敏感信息检测方法、装置、设备、介质和程序产品 |
CN114077722A (zh) * | 2021-10-20 | 2022-02-22 | 深信服科技股份有限公司 | 数据泄密追踪方法、装置、电子设备和计算机存储介质 |
CN114629707B (zh) * | 2022-03-16 | 2024-05-24 | 深信服科技股份有限公司 | 一种乱码检测方法、装置及电子设备和存储介质 |
EP4261758A1 (en) * | 2022-04-13 | 2023-10-18 | Magnet Forensics Inc. | Computer method and system for intelligence gathering |
CN114877264A (zh) * | 2022-06-06 | 2022-08-09 | 国家石油天然气管网集团有限公司 | 一种基于声纹识别的天然气管体泄露识别方法和*** |
Citations (3)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
CN102012985A (zh) * | 2010-11-19 | 2011-04-13 | 国网电力科学研究院 | 一种基于数据挖掘的敏感数据动态识别方法 |
CN104123370A (zh) * | 2014-07-24 | 2014-10-29 | 杭州安恒信息技术有限公司 | 数据库敏感信息探测方法及*** |
CN106156017A (zh) * | 2015-03-23 | 2016-11-23 | 北大方正集团有限公司 | 信息识别方法和信息识别*** |
Family Cites Families (9)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
CA2342578A1 (en) * | 2001-03-29 | 2002-09-29 | Ibm Canada Limited-Ibm Canada Limitee | Method and apparatus for security of a network server |
US7467202B2 (en) * | 2003-09-10 | 2008-12-16 | Fidelis Security Systems | High-performance network content analysis platform |
JP5168620B2 (ja) * | 2007-11-07 | 2013-03-21 | 独立行政法人情報通信研究機構 | データ種類検出装置及びデータ種類検出方法 |
US8442926B2 (en) * | 2008-01-08 | 2013-05-14 | Mitsubishi Electric Corporation | Information filtering system, information filtering method and information filtering program |
CN102207973B (zh) * | 2011-06-22 | 2013-04-10 | 上海互联网软件有限公司 | 一种模糊检索***及其检索方法 |
GB2509709A (en) * | 2013-01-09 | 2014-07-16 | Ibm | Transparent encryption/decryption gateway for cloud storage services |
US9652597B2 (en) * | 2014-03-12 | 2017-05-16 | Symantec Corporation | Systems and methods for detecting information leakage by an organizational insider |
US9225734B1 (en) * | 2014-09-10 | 2015-12-29 | Fortinet, Inc. | Data leak protection in upper layer protocols |
CN105939359A (zh) * | 2016-06-20 | 2016-09-14 | 国家计算机网络与信息安全管理中心 | 检测移动终端隐私泄露的方法及装置 |
-
2017
- 2017-03-17 CN CN201710164043.7A patent/CN107066882B/zh active Active
- 2017-06-23 EP EP17900903.0A patent/EP3447669B1/en active Active
- 2017-06-23 AU AU2017403386A patent/AU2017403386A1/en not_active Abandoned
- 2017-06-23 SG SG11201901807YA patent/SG11201901807YA/en unknown
- 2017-06-23 US US16/071,140 patent/US20210042443A1/en not_active Abandoned
- 2017-06-23 WO PCT/CN2017/089807 patent/WO2018166099A1/zh unknown
- 2017-06-23 KR KR1020187035322A patent/KR102157712B1/ko active IP Right Grant
- 2017-06-23 JP JP2018527065A patent/JP6688389B2/ja active Active
Patent Citations (3)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
CN102012985A (zh) * | 2010-11-19 | 2011-04-13 | 国网电力科学研究院 | 一种基于数据挖掘的敏感数据动态识别方法 |
CN104123370A (zh) * | 2014-07-24 | 2014-10-29 | 杭州安恒信息技术有限公司 | 数据库敏感信息探测方法及*** |
CN106156017A (zh) * | 2015-03-23 | 2016-11-23 | 北大方正集团有限公司 | 信息识别方法和信息识别*** |
Non-Patent Citations (1)
Title |
---|
See also references of EP3447669A4 * |
Cited By (6)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
CN110502514A (zh) * | 2019-08-15 | 2019-11-26 | 中国平安财产保险股份有限公司 | 数据采集方法、装置、设备及计算机可读存储介质 |
CN110502514B (zh) * | 2019-08-15 | 2023-06-27 | 中国平安财产保险股份有限公司 | 数据采集方法、装置、设备及计算机可读存储介质 |
CN111753149A (zh) * | 2020-06-28 | 2020-10-09 | 深圳前海微众银行股份有限公司 | 敏感信息的检测方法、装置、设备及存储介质 |
CN111753149B (zh) * | 2020-06-28 | 2024-05-31 | 深圳前海微众银行股份有限公司 | 敏感信息的检测方法、装置、设备及存储介质 |
CN112118241A (zh) * | 2020-09-08 | 2020-12-22 | 上海谋乐网络科技有限公司 | 审计渗透测试方法、测试节点服务器、管理服务器及*** |
CN112118241B (zh) * | 2020-09-08 | 2022-11-01 | 上海谋乐网络科技有限公司 | 审计渗透测试方法、测试节点服务器、管理服务器及*** |
Also Published As
Publication number | Publication date |
---|---|
EP3447669A1 (en) | 2019-02-27 |
AU2017403386A1 (en) | 2018-10-11 |
US20210042443A1 (en) | 2021-02-11 |
KR20190019067A (ko) | 2019-02-26 |
SG11201901807YA (en) | 2019-04-29 |
CN107066882A (zh) | 2017-08-18 |
KR102157712B1 (ko) | 2020-09-21 |
EP3447669B1 (en) | 2020-11-11 |
JP2019519008A (ja) | 2019-07-04 |
EP3447669A4 (en) | 2019-12-04 |
CN107066882B (zh) | 2019-07-12 |
JP6688389B2 (ja) | 2020-04-28 |
Similar Documents
Publication | Publication Date | Title |
---|---|---|
WO2018166099A1 (zh) | 信息泄露检测方法及装置、服务器及计算机可读存储介质 | |
WO2020107756A1 (zh) | 信贷反欺诈方法、***、设备及计算机可读存储介质 | |
WO2021003930A1 (zh) | 客服录音的质检方法、装置、设备及计算机可读存储介质 | |
WO2018008800A1 (ko) | 블록체인을 기반으로 하는 공인인증서 인증시스템과 이를 이용한 블록체인을 기반으로 하는 공인인증서 인증방법 | |
WO2016108468A1 (en) | User terminal, service providing apparatus, driving method of user terminal, driving method of service providing apparatus, and encryption indexing-based search system | |
WO2014040501A1 (zh) | 一种动态口令的生成及认证方法与*** | |
WO2014084498A2 (ko) | 웹사이트와 어플에서의 회원 간 만남주선 시스템 | |
WO2014030889A1 (en) | Method and apparatus for sharing content | |
WO2018228050A1 (zh) | 防止敏感信息泄露的方法、装置及存储介质 | |
WO2020147385A1 (zh) | 数据录入方法、装置、终端及计算机可读存储介质 | |
WO2012108661A2 (ko) | 네트워크 통신망에서의 쌍방향 가입자 보안 인증 시스템과 방법 및 이 방법을 기록한 기록매체 | |
WO2020253125A1 (zh) | 日志管理方法、装置、设备及存储介质 | |
WO2019156506A1 (en) | System and method for providing conversational contents | |
WO2018201638A1 (zh) | 基于图像识别的信息采集方法、移动终端及存储介质 | |
WO2015126037A1 (ko) | 일회용 랜덤키를 이용한 본인 확인 및 도용 방지 시스템 및 방법 | |
WO2018084326A1 (ko) | 실시간 상담을 제공하기 위한 방법 및 서버 | |
WO2023106572A1 (ko) | 가상 자산 부정 거래 탐지를 위한 탐지 모델의 학습 방법, 탐지 모델을 이용한 가상 자산 부정 거래의 탐지 방법 및 이들을 수행하는 장치 및 컴퓨터 프로그램 | |
EP3472749A1 (en) | A primary device, an accessory device, and methods for processing operations on the primary device and the accessory device | |
WO2022055160A1 (ko) | 식별코드 및 보안일련번호 이원화를 통한 정품 인증 시스템 및 그 방법 | |
WO2021177639A1 (ko) | 거래에서 사용자 정보를 식별하는 방법 및 이러한 방법을 수행하는 장치 | |
WO2015026083A1 (ko) | 휴대폰 본인인증 도용방지와 스미싱 방지를 위한 문자메시지 보안시스템 및 방법 | |
WO2024043613A1 (ko) | 이력서 생성 및 관리 서비스를 제공하기 위한 서버 장치 및 그 동작 방법 | |
WO2022197026A1 (ko) | 서버, 서비스 제공 시스템 및 서버의 처리 방법 | |
WO2022035161A1 (ko) | 전산망 해킹방지 시스템 및 방법 | |
WO2019047022A1 (zh) | Wifi共享方法、移动终端及计算机可读存储介质 |
Legal Events
Date | Code | Title | Description |
---|---|---|---|
ENP | Entry into the national phase |
Ref document number: 2018527065 Country of ref document: JP Kind code of ref document: A |
|
ENP | Entry into the national phase |
Ref document number: 2017403386 Country of ref document: AU Date of ref document: 20170623 Kind code of ref document: A |
|
121 | Ep: the epo has been informed by wipo that ep was designated in this application |
Ref document number: 17900903 Country of ref document: EP Kind code of ref document: A1 |
|
ENP | Entry into the national phase |
Ref document number: 20187035322 Country of ref document: KR Kind code of ref document: A |
|
ENP | Entry into the national phase |
Ref document number: 2017900903 Country of ref document: EP Effective date: 20181123 |
|
NENP | Non-entry into the national phase |
Ref country code: DE |