CN116186764B - Data security inspection method and system - Google Patents

Abstract

The invention relates to the technical field of data security inspection, and discloses a data security inspection method, which comprises the steps of creating task items in a task database through a processing module, writing various information of a new task, including a file storage path to be scanned, then scanning data through a scanning module, generating a scanning result to an inspection report file to store a designated path after scanning is completed, inquiring the task items in the database through an inquiring module by a user, reading the scanning result from a file system according to the designated path if the task state is completed, realizing scanning of the data, quickly obtaining the scanning result, and facilitating the user to quickly take corresponding measures.

Description

A data security inspection method and system

Technical field

The invention relates to the technical field of data security inspection, and in particular to a data security inspection method and system.

Background technique

With the popularization and application of Internet technology, data security issues cannot be ignored. Computer system security is the security protection of technology and management established and adopted for data processing systems, protecting computer hardware, software and data from accidental and malicious reasons. Be destroyed, altered and leaked; that is, by using various technical and management measures to ensure the normal operation of the network system, thereby ensuring the availability, integrity and confidentiality of network data; ensuring that the data transmitted and exchanged through the network will not increase, Modification, loss and disclosure.

In today's information age, more and more companies are saving technological achievements, production records, market statistics and other information in the form of data. More and more data information is saved in the form of electronic documents. The Chinese patent "CN108133148B" has been made public. A data security inspection method and system are provided, which performs trusted authentication on the collection terminal, securely collects, transmits, and stores data to ensure the safety and reliability of the data to be inspected, and the data security inspection results are true and effective. In addition, the present invention supports multiple application modes. , including local inspection mode, cloud inspection mode, cloud-to-ground synchronous inspection mode and cloud-to-ground intelligent switching inspection mode. The application modes are diverse and can meet the application needs of data security inspection in complex business scenarios.

Although the above-mentioned patent can call the security inspection sub-module that matches the preset inspection mode through the data security inspection module, perform security inspection on the data to be inspected based on the called security inspection sub-module, and obtain the security inspection results, however, there is no specific By examining various types of data files, criminals may be able to bring out sensitive data by mixing it with normal files.

Contents of the invention

The purpose of the present invention is to provide a data security inspection method and system to solve the above technical problems.

The object of the present invention can be achieved through the following technical solutions:

A data security inspection method, the method includes the following steps:

Step 1. The user uploads the data that needs to be security scanned through the communication module and submits the task through the processing module;

Step 2. The system receives the task request and the attached data to be scanned. It saves the data to be scanned to the file system, creates a task entry in the task database through the processing module, and writes various information about the new task, including saving the file to be scanned. path, and then perform data inspection through the scanning module;

Step 3. The scanning module periodically polls the database through the scanning program. If a new task is found, the task attributes are read, the path of the data to be scanned is obtained, the data is scanned according to the path, and after the scanning is completed, the scan result is generated and the inspection report file is saved to Specify the path and update the status of the current task entry to completed in the task database;

Step 4. When the user requests the task status next time, the system queries the task entries in the database through the query module. If the task status has been completed, the scan results are read from the file system according to the specified path.

Through the above technical solution, when the present invention needs to check data security, it can create a task entry in the task database through the processing module, write various information of the new task, including the storage path of the file to be scanned, and then scan the data through the scanning module , after the scan is completed, the scan results will be generated and the inspection report file will be saved in the specified path. The user can query the task entries in the database through the query module. If the task status is completed, the scan results will be read from the file system according to the specified path.

As a further description of the solution of the present invention, the specific working method of step 3 includes the following steps:

Step 31. First, the scanning program obtains the scan path and begins to traverse all files under the path and all sub-paths;

Step 32: Perform file type filtering, file type verification, and file encryption checks on the file. If the check fails, it is directly reported as a suspicious file. If the check is normal, proceed to the next step of the check;

Step 33. Perform Office document structure inspection and text keyword inspection on the Office document in sequence. If the inspection fails, it is reported as a suspicious file. If the inspection is normal, proceed to the next step of inspection;

Step 34: Perform image noise and transformation on the image file;

Step 35. For the compressed package file, decompress the files, return to step 1, and scan all files in the compressed package;

Step 36. When the file enumeration has enumerated all the files in the scan path, the scan ends and the report generator collects all the inspection results. It organizes the results into a report file and saves it to the specified path. At this point, Task execution ends.

Through the above technical solution, the scanner performs file type filtering, file type verification, and file encryption checks on files. If the check fails, it is directly reported as a suspicious file, performs image noise and transformation on the image file, and decompresses the compressed package file. The files in it are then checked. If the check fails, it is directly reported as a suspicious file. If the check is normal, the next step of the check is entered.

As a further description of the solution of the present invention, the scanning program will continuously poll the task database, retrieve the tasks to be executed and execute them in sequence. If all tasks are executed, polling will continue to wait for new tasks to appear. .

As a further description of the solution of the present invention, the specific method of step 32 includes:

The file type filtering method is:

First, scan the file extension;

Secondly, compare the scanned suffix name with the whitelist set in advance;

Finally, only file types in the whitelist can pass, and other types are reported as suspicious files;

The method of file type verification is:

First, scan the file extension;

Secondly, check the file structure according to the format declared by the file extension name;

Finally, if it does not conform to the format identified by the suffix, it is reported as suspicious;

The file encryption check method is: the system reports all password-protected files as suspicious files, scans file types that support encryption, checks whether they are encrypted, and reports encrypted files as suspicious.

Through the above technical solution, file type filtering, file type verification, and file encryption check are performed on files to prevent hidden means of changing file suffix names. By scanning the suffix name, files that do not conform to the format identified by the suffix are scanned out. At the same time, , reports all password-protected files as suspicious, scans them out and reports them as suspicious.

As a further description of the solution of the present invention, the specific method of step 33 includes:

The Office document structure checking method is: checking the file structure of the Office document according to Microsoft's definition of various Office documents, checking some commonly used data hiding methods, and reporting files with hidden data;

The text keyword checking method is:

First, scan every byte of the file;

Then, compare the scanned bytes with the comparison keywords defined in advance;

Finally, if a comparison keyword appears, it is reported as suspicious text.

As a further description of the solution of the present invention, the definition method of the comparison keyword is:

First, multiple sensitive documents are randomly selected as the experimental data set, algorithm tools are used to process the experimental data set, candidate keywords are selected, and the obtained keywords are formed into a keyword vocabulary;

Then, the weight is calculated for each candidate keyword in the keyword vocabulary, and the top five candidate keywords with the largest weight are selected according to the ranking;

Finally, other candidate keywords are deleted, and the five filtered candidate keywords are the comparison keywords.

Through the above technical solution, Office documents are sequentially checked for Office document structure and text keywords, and Office texts are checked through keywords defined in advance to prevent suspicious texts from being released.

As a further description of the solution of the present invention, the specific method package of step 34 is: using an active attack method on the image file to destroy the hidden data that may exist in it: adding noise to the image file to destroy the LSB steganographic data that may exist, Then perform subtle rotation and scaling transformations to destroy possible DCT steganographic data.

Through the above technical solution, the present invention destroys the hidden data that may exist in the image file through active attacks without affecting the original image file.

As a further description of the solution of the present invention, in step 35: the system uses the Zlib development package to compress and decompress the Zip file, and uses rar. exe to compress RAR files and unrar.dll to decompress RAR files.

Through the above technical solution, the compressed file is decompressed and then scanned to avoid mixing suspicious files into the compressed file.

A data security inspection system, including: a communication module, a processing module and a scanning module;

Communication module: used to upload files that need to be security scanned and send task requirements to the system;

Processing module: used to create scanning task entries and write various information about the new task;

Scanning module: Responsible for scanning detection data, it is the core module of this system.

Beneficial effects of the present invention:

1. The present invention creates task entries in the task database through the processing module, writes various information of the new task, including the storage path of the file to be scanned, and then scans the data through the scanning module. After the scanning is completed, the scanning results are generated and the inspection report file is saved. By specifying the path, the user can query the task entries in the database through the query module. If the task status has been completed, the scan results are read from the file system according to the specified path, which realizes the scanning of data and can quickly obtain the scan results, which is convenient for users. Take appropriate measures quickly.

2. The present invention uses a scanning program to perform file type filtering, file type verification, and file encryption inspection on files. If the inspection fails, it is directly reported as a suspicious file, image files are added to the image noise and transformed, and the compressed package file is decompressed. The files in it are then checked to prevent additional files from being embedded by checking the file name and file format.

3. The present invention sequentially checks the Office document structure and text keywords on the Office document, and checks the Office text through keywords defined in advance to prevent additional messages from being embedded in the text.

4. The present invention destroys the hidden data that may exist in the image file through active attacks without affecting the original image file, and embeds additional information into the image file.

5. The present invention decompresses the compressed file and then scans and checks the compressed file to prevent suspicious files from being mixed into the compressed file.

Description of the drawings

The present invention will be further described below in conjunction with the accompanying drawings.

Figure 1 is a partial flow diagram of the data security inspection method provided by the present invention.

Detailed ways

The technical solutions in the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings in the embodiments of the present invention. Obviously, the described embodiments are only some of the embodiments of the present invention, rather than all the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those of ordinary skill in the art without creative efforts fall within the scope of protection of the present invention.

A data security inspection method, the method includes the following steps:

Step 1. The user uploads the data that needs to be security scanned through the communication module and submits the task through the processing module;

Step 2. The system receives the task request and the attached data to be scanned. It saves the data to be scanned to the file system, creates a task entry in the task database through the processing module, and writes various information about the new task, including saving the file to be scanned. path, and then perform data inspection through the scanning module;

Step 3. The scanning module periodically polls the database through the scanning program. If a new task is found, the task attributes are read, the path of the data to be scanned is obtained, the data is scanned according to the path, and after the scanning is completed, the scan result is generated and the inspection report file is saved to Specify the path and update the status of the current task entry to completed in the task database;

The specific working method of step 3 includes the following steps:

Step 31. First, the scanning program obtains the scan path and begins to traverse all files under the path and all sub-paths;

Step 32: Perform file type filtering, file type verification, and file encryption checks on the file. If the check fails, it is directly reported as a suspicious file. If the check is normal, proceed to the next step of the check;

The specific method of step 32 includes:

The file type filtering method is:

First, scan the file extension;

Secondly, compare the scanned suffix name with the whitelist set in advance;

Finally, only file types in the whitelist can pass, and other types are reported as suspicious files.

The method of file type verification is:

First, scan the file extension;

Secondly, check the file structure according to the format declared by the file extension name;

Finally, if it does not conform to the format identified by the suffix it is reported as suspicious.

The file encryption check method is: the system reports all password-protected files as suspicious files, scans file types that support encryption, checks whether they are encrypted, and reports encrypted files as suspicious.

Through the above technical solution, the scanner performs file type filtering, file type verification, and file encryption checks on files. If the check fails, it is directly reported as a suspicious file, performs image noise and transformation on the image file, and decompresses the compressed package file. The files in it are then checked. If the check fails, it is directly reported as a suspicious file. If the check is normal, the next step of the check is entered.

Step 33. Perform Office document structure inspection and text keyword inspection on the Office document in sequence. If the inspection fails, it is reported as a suspicious file. If the inspection is normal, proceed to the next step of inspection;

The specific method of step 33 includes:

The Office document structure checking method is: checking the file structure of the Office document according to Microsoft's definition of various Office documents, checking some commonly used data hiding methods, and reporting files with hidden data;

The text keyword checking method is:

First, scan every byte of the file;

Then, compare the scanned bytes with the comparison keywords defined in advance;

The definition method of the comparison keyword is:

First, multiple sensitive documents are randomly selected as the experimental data set, algorithm tools are used to process the experimental data set, candidate keywords are selected, and the obtained keywords are formed into a keyword vocabulary;

Then, the weight is calculated for each candidate keyword in the keyword vocabulary, and the top five candidate keywords with the largest weight are selected according to the ranking;

Finally, other candidate keywords are deleted, and the five filtered candidate keywords are the comparison keywords.

Finally, if a comparison keyword appears, it is reported as suspicious text.

Through the above technical solution, Office documents are sequentially checked for Office document structure and text keywords, and Office texts are checked through keywords defined in advance to prevent suspicious texts from being released.

Step 34: Perform image noise and transformation on the image file;

Use an active attack method on the image file to destroy the hidden data that may exist in it: add noise to the image file to destroy the possible LSB steganographic data, and then perform subtle rotation and scaling transformations to destroy the possible DCT steganographic data. , this step is a "cleaning" operation, which will not produce "suspicious" inspection results, nor will it affect the original image file.

Through the above technical solution, the present invention destroys the hidden data that may exist in the image file through active attacks without affecting the original image file.

Step 35. For the compressed package file, decompress the files, return to step 1, and scan all files in the compressed package;

This system uses the Zlib development package to compress and decompress Zip files, and uses rar. exe to compress RAR files and unrar.dll to decompress RAR files.

Through the above technical solution, the compressed file is decompressed and then scanned to avoid mixing suspicious files into the compressed file.

Step 36. When the file enumeration has enumerated all the files in the scan path, the scan ends and the report generator collects all the inspection results. It organizes the results into a report file and saves it to the specified path. At this point, Task execution ends.

Step 4. When the user requests the task status next time, the system queries the task entries in the database through the query module. If the task status has been completed, the scan results are read from the file system according to the specified path.

The scanner will continuously poll the task database, retrieve the tasks to be executed and execute them in sequence. If all tasks are executed, polling will continue to wait for new tasks to appear.

Through the above technical solution, when the data security needs to be checked, the present invention can create a task entry in the task database through the processing module, write various information of the new task, including the storage path of the file to be scanned, and then scan the data through the scanning module. After the scan is completed, the scan results are generated and the inspection report file is saved in the specified path. The user can query the task entries in the database through the query module. If the task status is completed, the scan results are read from the file system according to the specified path.

A data collection security inspection system, characterized by including: a communication module, a processing module and a scanning module;

Communication module: used to upload files that need to be security scanned and send task requirements to the system;

Processing module: used to create scanning task entries and write various information about the new task;

Scanning module: Responsible for scanning and detecting files, it is the core module of this system.

An embodiment of the present invention has been described in detail above, but the content is only a preferred embodiment of the present invention and cannot be considered to limit the implementation scope of the present invention. All equivalent changes and improvements made within the scope of the present invention shall still fall within the scope of the patent of the present invention.

Claims (8)

1. A data security inspection method, characterized in that the method includes the following steps: Step 1. The user uploads the data that needs to be security scanned through the communication module and submits the task through the processing module; Step 2. The system receives the task request and the attached data to be scanned. It saves the data to be scanned to the file system, creates a task entry in the task database through the processing module, and writes various information about the new task, including saving the file to be scanned. path, and then perform data inspection through the scanning module; Step 3. The scanning module periodically polls the database through the scanning program. If a new task is found, the task attributes are read, the path of the data to be scanned is obtained, the data is scanned according to the path, and after the scanning is completed, the scan result is generated and the inspection report file is saved to Specify the path and update the status of the current task entry to completed in the task database; Step 4. When the user requests the task status next time, the system queries the task entries in the database through the query module. If the task status has been completed, the scan results are read from the file system according to the specified path; The specific working method of step 3 includes the following steps: Step 31. First, the scanning program obtains the scan path and begins to traverse all files under the path and all sub-paths; Step 32: Perform file type filtering, file type verification, and file encryption checks on the file. If the check fails, it is directly reported as a suspicious file. If the check is normal, proceed to the next step of the check; Step 33. Perform Office document structure inspection and text keyword inspection on the Office document in sequence. If the inspection fails, it is reported as a suspicious file. If the inspection is normal, proceed to the next step of inspection; Step 34. Perform image noise and transformation on the image file; Step 35. For the compressed package file, decompress the files, return to step 1, and scan all files in the compressed package; Step 36. When the file enumeration has enumerated all the files in the scan path, the scan ends and the report generator collects all the inspection results. It organizes the results into a report file and saves it to the specified path. At this point, Task execution ends. 2. The data security inspection method according to claim 1, characterized in that the scanning program will continuously poll the task database, retrieve the tasks to be executed and execute them in sequence. If all tasks are completed, the polling Will continue to wait for new tasks to appear. 3. The data security inspection method according to claim 1, characterized in that the specific method of step 32 includes: The file type filtering method is: First, scan the file extension; Secondly, compare the scanned suffix name with the whitelist set in advance; Finally, only the file types in the whitelist can pass, and other types are reported as suspicious files; The method of file type verification is: First, scan the file extension; Secondly, check the file structure according to the format declared by the file extension name; Finally, if it does not conform to the format identified by the suffix, it is reported as suspicious; The file encryption check method is: the system reports all password-protected files as suspicious files, scans file types that support encryption, checks whether they are encrypted, and reports encrypted files as suspicious. 4. The data security inspection method according to claim 1, characterized in that, The specific method of step 33 includes: The method for checking the Office document structure is: check the file structure of the Office document according to Microsoft's definition of various Office documents, check some commonly used data hiding methods, and report files with hidden data; The method of checking text keywords is: First, scan every byte of the file; Then, compare the scanned bytes with the comparison keywords defined in advance; Finally, if a comparison keyword appears, it is reported as suspicious text. 5. The data security inspection method according to claim 4, characterized in that, The definition method of the comparison keyword is: First, multiple sensitive documents are randomly selected as the experimental data set, algorithm tools are used to process the experimental data set, candidate keywords are selected, and the obtained keywords are formed into a keyword vocabulary; Then, the weight is calculated for each candidate keyword in the keyword vocabulary, and the top five candidate keywords with the largest weight are selected according to the ranking; Finally, other candidate keywords are deleted, and the five filtered candidate keywords are the comparison keywords. 6. The data security inspection method according to claim 1, characterized in that the specific method package of step 34 is: using an active attack method on the image file to destroy hidden data that may exist therein: adding noise to the image file To destroy the possible LSB steganographic data, and then perform subtle rotation and scaling transformations to destroy the possible DCT steganographic data. 7. The data security inspection method according to claim 1, characterized in that in step 35: the system uses the Zlib development package to compress and decompress Zip files, using rar. exe to compress RAR files and unrar.dll to decompress RAR files. 8. A data security inspection system using the method according to any one of claims 1 to 7, characterized in that it includes: a communication module, a processing module and a scanning module; Communication module: used to upload files that need to be security scanned and send task requirements to the system; Processing module: used to create scanning task entries and write various information about the new task; Scanning module: Responsible for scanning detection data, it is the core module of this system.