RU2546583C2 - System of automated analysis of down-loading from data bases - Google Patents

Abstract

FIELD: physics, computer engineering.

SUBSTANCE: invention relates to computer engineering. Proposed method converts all info-important cells of standard down-loads from data bases from data base with indication of their position in every down-load. Definite conditions are set to indicate interrelations between cells in one line of down-load. Converted standard down-loads and named conditions are memorised in definite memory. Revealed are cell of standard down-loads in electronic file of analysed document. Found cells matrix is compiled to apply preset named conditions to matrix of found cells. Compiled the list of conditions whereto corresponds the matrix of found cells. Decision is made on if the portion of standard down-load exists in analysed document which satisfied the preset named conditions.

EFFECT: protection of data stored in protected data base from leaks.

2 cl, 2 dwg

Description

FIELD OF THE INVENTION

The present invention relates to the field of information technology, in particular to a method for automated analysis of database uploads.

State of the art

Currently, the problem of the so-called data interception is very acute. Such a problem may occur in the case of tracking documents passing through the company network for the presence of confidential information in them.

Currently, several systems or methods are known to solve this problem.

For example, in US patent application No. 201166585 (publ. March 17, 2011), a method is disclosed in which structured data files are extracted from unstructured data and thus, based on statistics on this file, give the data some structure, for example, in the form of a table. This method has limited application, since it is implemented only to extract structured data.

Japanese Patent Application No. 2008257444 (published October 23, 2008) discloses a method that can be considered the closest analogue of the present invention, in which features are distinguished in a file by using the prescribed conditions and the similarity between files is calculated by comparing these features. This method has limited application and low efficiency in the analysis of intercepted documents and, accordingly, requires a long processing time and has limited use.

Disclosure of invention

Thus, there is a need to expand the arsenal of technical means by creating a relatively quick and universal way of automated analysis of database uploads, with the ability to flexibly configure the parameters at which the current text to be analyzed can be attributed to uploading from the database, which would allow to identify which or document information from a given database and which would not have flaws with respect to known solutions.

To solve this problem and obtain the specified technical result, the present invention proposes a method for automated analysis of unloading from databases, which consists in the fact that:

- convert to a predetermined format all the information-significant cells of the standard unloading from the database with an indication of their positions in each unloading;

- set nominal conditions indicating the relationship between cells in the same line of unloading;

- save the converted lines of the reference unloading on the storage device;

- identify the cells of the standard downloads in the electronic file of the analyzed document;

- make a matrix of the found cells;

- apply the specified conditions to the matrix of found cells;

- make up a list of conditions to which the matrix of found cells corresponds;

- render a verdict on the basis of the above list of conditions.

A feature of the method of the present invention is that “stop words” are excluded in the analyzed document and in the reference unloading.

Brief Description of the Drawings

Figure 1 presents the block diagram of the implementation of the method of automated analysis of unloading from databases.

Figure 2 presents an example of a reference upload from a database that is used in this method of the present invention.

DETAILED DESCRIPTION OF THE INVENTION

The present invention can be implemented in any computing system, for example in a personal computer, etc.

The method of automated analysis of database uploads is designed to protect against leakage of information stored in the protected database, as well as to identify information not only in cells, but also on its relative position. For example, simply numbers that coincide with the salaries of company employees, but without a text description, carry little information. However, if the analyzed text also contains first names and surnames from the same database, then this is likely to be a leak of information from the database.

A method for automated analysis of database uploads includes several basic steps. In one of the initial stages, before performing an automated analysis of unloadings from databases, it is necessary to prepare reference data for unloadings, an example of which is shown in Figure 2.

Unloading from the database is most often a table consisting of one or more columns and one or more rows. It is also worth noting the fact that databases usually store a certain amount of service information that is not accessible to the average user. For example, it can be a unique key, with the help of which a given row of a given table is referenced from other database tables. Also, some uploads are not a direct mapping of the database, since these uploads are formed according to certain rules. For example, employee salaries can be calculated from rates and odds at the time of building the upload. Therefore, it is very important to prepare reference unloadings correctly.

In the method of the present invention, all the information-significant cells of the reference unloads from the database are converted into a predetermined format with an indication of their positions in each unloading and the nominal conditions indicating the relationship between the cells in the same unloading line are set.

Each upload consists of a set of cells arranged in rows. First of all, you need to identify the relationship between cells in one row. This is due to the fact that there is no need to protect data from only one cell, most often data becomes secret information only in conjunction with data from other cells of this upload. Namely conditions are introduced in the present invention to describe such relationships. Since the connections between cells can be multivariate, and also with the aim of saving resources, there can be several named conditions.

Directly the reference data related to the reference unloading from the database is prepared as follows:

1. Each cell is divided into words or numbers (the separator is all characters except letters and numbers) (Figure 1-2);

2. Stop words are deleted from the resulting list (Figs. 1-3);

3. For each highlighted word, HASH is removed (Figs. 1-4);

4. For the received HASH values, the location of the cells in which they occur is recorded (name of the reference upload, column number, row number) (Figure 1-5).

The converted reference unload lines as well as named conditions are stored on the storage device. Together, these data form a digital fingerprint of the reference upload from the database.

In named conditions, relationships between columns on the same row must be specified. In the simplest case, this may be a condition for the presence of all cells in a row. The condition also indicates the minimum number of lines, upon finding which it is considered that the condition is met. In addition, the condition rating is set, the higher the rating, the more critical the condition is considered. The triggered condition with the highest rating stops the analysis for the current standard. A rating is also an identifier for a condition.

Examples of conditions for unloading containing 5 columns and 1000 rows: 1 & 2 & 3 & 4 & 5: 1000> 100 - according to this condition, the entire reference table should be present in the analyzed document. 1 & (2 | 3): 50> 90 - this condition will work if there are 50 or more lines from the standard in the analyzed text, the first cell of which is present in the analyzed document and the second or third cell from this line is also present in this document. Next, before starting an automated analysis of unloadings from databases, digital fingerprints of reference unloadings are loaded into memory (Figs. 1-8). According to security requirements, the texts of the standard downloads are not saved, which helps prevent their unauthorized reading. The next step of the present invention is that the reference unloading cells are detected in the electronic file of the analyzed document, thus, an analysis is made whether the electronic document contains a part of the standard unloading or not. Next, they compose a matrix of found cells. The main goal of this stage is to create an n-dimensional matrix in which each cell is a projection of the cell of the standard discharge into the binary field. If the cell of this matrix corresponds to the value "true", then this means that this cell is present in the analyzed document. The step of creating an n-dimensional matrix of the found cells consists of several steps:

1. The input text (Figure 1-9) is divided into words and numbers (all characters except letters and numbers are considered as a separator), a vector is formed (Figure 1-10);

2. Stop words and duplicates are removed from the obtained vector, thus, a vector is obtained consisting of unique words and numbers belonging to the analyzed document (Figure 1-11);

3. From each element in the vector, the HASH amount is considered (Figure 1-12);

4. Each HASH from the resulting vector is searched in the internal storage of the reference unloadings (Fig.1-13);

5. Each cell where the current HASH is found is marked (Figs. 1-14);

6. As soon as it becomes clear that all HASH values in any cell are present in the analyzed text, the corresponding cell of the resulting matrix takes the value “true” (Figs. 1-15 and Figs. 1-16);

7. The result is an n-dimensional matrix with marked cells (Fig.1-17 and Fig.1-18).

The number of measurements of the resulting matrix depends on the number of reference downloads.

The result of a further implementation of the present invention is a list of conditions that the analyzed document satisfies, in which the specified conditions are applied to the matrix of found cells. This list is obtained as follows, the n-dimensional matrix is decomposed into two-dimensional matrices (Figs. 1-19), each two-dimensional matrix is a representation of one reference upload, each named condition is applied to each row of each two-dimensional matrix (Figs. 1-20). A list is made of all the conditions that worked (Figure 1-21), and a verdict is issued based on the list of conditions (Figure 1-22). In the particular case of the invention, before starting work, a list of "stop words" is loaded from the file. After breaking the text into words, each received word is searched in this list and if it is present there, then it is excluded.

An example implementation of the present invention. The company has a database, in this database, among other information, a list of customers with all their details is stored. For the enterprise, this data is a trade secret. There are several ways to protect an enterprise from leakage of this data, including by analyzing network traffic that goes beyond the local network of the enterprise, in which, for example, a list of customers with details can be transmitted in full or in parts. At the same time, the mention of customers may also be outside the context of this list, for example, in business correspondence, the name of the organization and its details can be found in the signatures of letters of employees. Therefore, in addition to preventing leakage, it is also necessary to ensure a minimum number of false positives.

To provide such functionality, a method of automated analysis of database uploads is used. The method is implemented as follows: customer data is uploaded to the table, thus unloading from the database is created, logical conditions are created for it that describe the relationships between the columns, a standard unloading is compiled from the received data, which is transferred to the analysis technology. Further, all intercepted outgoing traffic of the corporate network is transmitted for analysis. If the verdict of the technology is positive, that is, the intercepted traffic contains a part of the standard upload that meets the specified conditions, then this traffic is not transmitted outside and the enterprise security officer is notified of the incident.

Thus, the method of automated analysis of unloadings from the databases of the present invention provides an expansion of the arsenal of technical means and allows you to relatively quickly identify the presence of data from reference unloadings in any document, thereby overcoming the disadvantages of known solutions in the form of the limitations of their application.

In conclusion, it should be noted that the information provided in the description are examples that do not limit the scope of the present invention defined by the claims. One skilled in the art will recognize that there may be other embodiments of the present invention consistent with the spirit and scope of the present invention.

Claims (2)

1. The method of automated analysis of database uploads, which consists in the fact that:
- convert to a predetermined format all the information-significant cells of the standard unloading from the database with an indication of their positions in each unloading, and each unloading consists of a set of cells arranged in rows;
- specify named conditions indicating the relationship between cells in the same line of unloading;
- save the converted lines of the reference uploads and named conditions on the storage device, and in the aggregate, these data form a digital fingerprint of the reference upload from the database;
- identify the cells of the standard downloads in the electronic file of the analyzed document;
- make a matrix of the found cells;
- apply the specified named conditions to the matrix of found cells;
- make up a list of conditions to which the matrix of found cells corresponds;
- a verdict is passed on whether the analyzed document contains a part of the standard unloading that satisfies the specified named conditions on the basis of the mentioned list of conditions. 2. The method according to claim 1, in which “stop words” are excluded in the analyzed document and in the reference unloading.

Images