CN106650432B - Method and device for analyzing classified information - Google Patents

Abstract

The invention discloses a method and a device for analyzing secret-related information, which relate to the field of information technology and can improve the efficiency of querying the cause of secret leakage. The method includes: acquiring secret-related period information corresponding to secret-related information; analyzing the secret-related information according to the secret-related period information; and when an unauthorized access event occurs on the secret-related information within the secret-related period , determine the occurrence of a leaking event; output an analysis result of the leaking cause of the leaking event according to the access information corresponding to the unauthorized access event. The present invention is suitable for the analysis of classified information.

Description

Method and device for analyzing classified information

technical field

The invention relates to the field of information technology, in particular to a method and device for analyzing classified information.

Background technique

With the continuous development of information technology, the security of classified information has been paid more and more attention by people. The so-called confidential information refers to confidential information, such as corporate investment and restructuring plans, key financial index information, specific plans, specifications, technical solutions, R&D personnel composition and other information of corporate products, financial securities investment and other resolutions or news, etc. . Usually, confidential information will have a confidential period. When the confidential information is within its corresponding confidential period, it belongs to the confidential stage, and when the confidential information is outside its corresponding confidential period, it belongs to the public stage.

At present, after the user learns that the confidential information has been leaked, the user can trace the historical situation of accessing the confidential information in the original data by means of query, so as to determine the cause of the leakage. However, this method requires the user to take the initiative to inquire, The original data is usually embodied in the ledger mode. Therefore, the massive data needs to be screened by users, which will lead to low efficiency in querying the reasons for leaks.

SUMMARY OF THE INVENTION

In view of this, the present invention provides a method and device for analyzing secret-related information, the main purpose of which is to solve the current need to actively query secret-related information through manual means to leak the cause of secret information, and massive data needs to be screened by users. This will lead to a problem of low efficiency in querying the cause of leaks.

In order to achieve the above object, according to one aspect of the present invention, a method for analyzing classified information is provided, the method comprising:

Obtain the secret-related period information corresponding to the secret-related information;

analyzing the secret-related information according to the secret-related period information;

When an unauthorized access event occurs to the classified information within the classified information period, it is determined that a leakage event occurs;

According to the access information corresponding to the unauthorized access event, an analysis result of the leakage cause of the leakage event is output.

According to another aspect of the present invention, a device for analyzing classified information is provided, the device comprising:

an obtaining unit, used to obtain the secret-related period information corresponding to the secret-related information;

an analysis unit, configured to analyze the secret-related information according to the secret-related period information obtained by the obtaining unit;

a determining unit, configured to determine that a leakage event occurs when an unauthorized access event occurs to the classified information within the classified information period;

An output unit, configured to output an analysis result of the leakage cause of the leakage event according to the access information corresponding to the unauthorized access event.

With the above technical solutions, the technical solutions provided by the embodiments of the present invention have at least the following advantages:

A method and device for analyzing secret-related information provided by the present invention firstly obtains the secret-related period information corresponding to the secret-related information; then analyzes the secret-related information according to the secret-related period information; When an unauthorized access event occurs in the information during the confidential period, it is determined that a leakage event occurs; according to the access information corresponding to the unauthorized access event, an analysis result of the leakage cause of the leakage event is output. Compared with the current manual method to actively inquire about the leakage cause of the leakage incident of the secret-related information, the present invention analyzes the secret-related information according to the period of the secret-related information in which the secret-related information is located, and obtains the leakage incident from the results obtained from the analysis. The reason of the leak can be automatically displayed to the user, which can realize the automatic analysis of the leak cause, without the need for the user to screen the massive data one by one, which can improve the efficiency of querying the leak cause, and when the confidential information is unauthorized access during the confidential period In the event of an incident, it is determined that a leaking incident has occurred, so that the user can be notified in time that a leaking incident has occurred in the confidential information, and then effective interception can be carried out in a timely manner.

The above description is only an overview of the technical solutions of the present invention, in order to be able to understand the technical means of the present invention more clearly, it can be implemented according to the content of the description, and in order to make the above and other purposes, features and advantages of the present invention more obvious and easy to understand , the following specific embodiments of the present invention are given.

Description of drawings

Various other advantages and benefits will become apparent to those of ordinary skill in the art upon reading the following detailed description of the preferred embodiments. The drawings are for the purpose of illustrating preferred embodiments only and are not to be considered limiting of the invention. Also, the same components are denoted by the same reference numerals throughout the drawings. In the attached image:

1 shows a schematic flowchart of a method for analyzing classified information provided by an embodiment of the present invention;

FIG. 2 shows a schematic flowchart of another method for analyzing classified information provided by an embodiment of the present invention;

FIG. 3 shows a schematic diagram of analysis of the access time of leaked information provided by an embodiment of the present invention;

FIG. 4 shows a schematic diagram of periodic access analysis of leaked content according to an embodiment of the present invention;

FIG. 5 shows a schematic diagram of access analysis of confidential information of an access source provided by an embodiment of the present invention;

FIG. 6 shows a schematic diagram of an analysis of access volume of confidential information provided by an embodiment of the present invention;

FIG. 7 shows a schematic structural diagram of an apparatus for analyzing classified information provided by an embodiment of the present invention;

FIG. 8 shows a schematic structural diagram of another apparatus for analyzing classified information provided by an embodiment of the present invention.

Detailed ways

Exemplary embodiments of the present disclosure will be described in more detail below with reference to the accompanying drawings. While exemplary embodiments of the present disclosure are shown in the drawings, it should be understood that the present disclosure may be embodied in various forms and should not be limited by the embodiments set forth herein. Rather, these embodiments are provided so that the present disclosure will be more thoroughly understood, and will fully convey the scope of the present disclosure to those skilled in the art.

An embodiment of the present invention provides a method for analyzing classified information, as shown in FIG. 1 , the method includes:

101. Obtain secret-related period information corresponding to the secret-related information.

Wherein, the secret-related period information may include the time range of the secret-related information from the secret-related state to the public state. Specifically, according to different secret levels, the secret-related period information may specifically include top secret period information, and/or secret period information, and/or general secret period information, and the like. For example, the confidential period corresponding to confidential information A is from October 1, 2015 to March 1, 2016, specifically, from October 1, 2015 to February 1, 2016 It is a top secret period, and the period from February 2, 2016 to March 1, 2016 is a confidential period.

It should be noted that, for this embodiment of the present invention, the classified information is first generated in the organization, used, and needs to be authorized to access during the classified period according to the classification level. It needs to be protected within the secret-related period, and new secret-related information can be formed through association between secret-related information. The secret level corresponding to the secret-related information can be formed according to the limitation of the access authority of the secret-related information and the limitation of the secret-related period.

102. Analyze the secret-related information according to the secret-related period information.

Specifically, according to the secret-related period information, the secret-related information can be analyzed in combination with the behavior log information corresponding to the secret-related information. Authorized access status, delivery status, reference frequency, access frequency, delivery frequency, etc.

For example, for the specific plans, specifications, technical solutions, R&D personnel composition and other information of the product, there are confidentiality requirements before the release. After the release, the data security level is lowered or enters the declassification period. Whether there is a leakage event in the information can be analyzed based on the secret-related period in which the information is located. Specifically, it can be judged based on whether the information is authorized to be accessed during the secret-related period.

It should be noted that, for the embodiment of the present invention, the process of analyzing the secret-related information according to the secret-related period information may specifically be analyzed after the secret-related information is disclosed, that is, outside the secret-related period, or it can be analyzed in the secret-related period. When confidential information is not disclosed, it is analyzed during the confidential period, so as to achieve the purpose of real-time monitoring of whether there is a leakage incident, so that the confidential information can be supervised during the confidential period, and can be monitored outside the confidential period. analyze.

103. When an unauthorized access event occurs to the confidential information within the confidential period, it is determined that a leakage event occurs.

In this embodiment of the present invention, authorized users may be preset, that is, it is legal for these authorized users to access the leaked information during the secret-related period, while it is illegal for other users to access the leaked information during the secret-related period.

For example, when the confidential information is accessed during the confidential period and is accessed by an unauthorized user, it means that the system may have been attacked by hackers, and the hacker has stolen the confidential information, and then it can be determined that a leakage incident has occurred.

104. According to the access information corresponding to the unauthorized access event, output an analysis result of the leakage cause of the leakage event.

The access information may include information such as visitor identity, access path, access time, and access source.

In this embodiment of the present invention, the presentation form of the analysis result may be a presentation form of text and graphs, so that the user can understand the leaking event more intuitively.

For example, when confidential information is accessed during the confidential period and is accessed by an unauthorized user, it is determined that a leakage event has occurred, and the user's identity information can be obtained through analysis, and what methods are used to access confidential information and access confidential information. Information time, access path, access source of confidential information, etc., and output the corresponding analysis results, so as to automatically display the leakage incident and its analysis results to the user.

A method for analyzing secret-related information provided by an embodiment of the present invention first obtains secret-related period information corresponding to secret-related information; then analyzes the secret-related information according to the secret-related period information; When an unauthorized access event occurs in the information during the confidential period, it is determined that a leakage event occurs; according to the access information corresponding to the unauthorized access event, an analysis result of the leakage cause of the leakage event is output. Compared with the current manual method to actively inquire about the leakage cause of the leakage incident of the secret-related information, the present invention analyzes the secret-related information according to the period of the secret-related information in which the secret-related information is located, and obtains the leakage incident from the results obtained from the analysis. The reason of the leak can be automatically displayed to the user, which can realize the automatic analysis of the leak cause, without the need for the user to screen the massive data one by one, which can improve the efficiency of querying the leak cause, and when the confidential information is unauthorized access during the confidential period In the event of an incident, it is determined that a leaking incident has occurred, so that the user can be notified in time that a leaking incident has occurred in the confidential information, and then effective interception can be carried out in a timely manner.

Specifically, an embodiment of the present invention provides another method for analyzing classified information, as shown in FIG. 2 , the method includes:

201. Match industry data according to feature rules in a preset industry rule base.

Wherein, the preset industry rule base stores characteristic rules corresponding to secret-related information of different industries respectively. The industry data may be data of the medical industry, data of the construction industry, data of the banking industry, data of the e-commerce industry, etc., which are not specifically limited in the embodiment of the present invention. For the embodiment of the present invention, the feature rules in the preset industry rule base are obtained by induction according to the features of confidential information involved in various industries, and the preset industry rule base stores the features corresponding to the industry confidential information Rules, not classified information of various industries. The more complete the feature rules in the preset industry rule base, the more accurate the classified information determined by matching industry data according to the feature rules. In the embodiment of the present invention, by establishing a preset industry rule base, it is possible to intelligently monitor industry data in the audit strategy, and accurately determine whether the industry data matching the preset industry rule base is classified information.

202. Determine the industry data that is successfully matched with the characteristic rule as confidential information.

In the embodiment of the present invention, when the industry data is successfully matched with the feature rules in the preset industry rule base, it means that the industry data contains confidential information, so the industry data can be determined as confidential information.

It should be noted that, according to the feature rules in the preset industry rule base, the industry data is matched, and the industry data that successfully matches the feature rules is determined as confidential information, which can realize automatic analysis of these confidential information, and then It is possible to query which classified information has been leaked, so as to realize the integration of the big data analysis platform, the analysis results are more effective, the data acquisition is complete, and the analysis results are more accurate.

203. Acquire secret-related period information corresponding to the determined secret-related information.

Wherein, the secret-related period information includes one or more types of secret-level period information. For example, the secret-related period information may specifically include top secret period information, and/or secret period information, and/or common secret period information, and the like.

For example, when a user purchases a bid to the end of the bid, the commercial and technical terms of the bid are in a confidential period before the bid is opened, and the secret level is downgraded to the public after the bid is opened. Before the opening of the bid, users are more concerned about whether the terms are leaked in addition to adopting a bidding strategy.

204. Analyze the secret-related information according to the secret-related period information.

Specifically, according to the secret-related period information, the secret-related information can be analyzed in combination with the behavior log information corresponding to the secret-related information.

For example, after the product design, design, materials, etc. of the smartphone are kept secret until the product is delivered, any specification leakage is a real business loss. The information is analyzed during the secret period, and specifically, it can be judged in combination with whether the information is authorized to be accessed during the secret period.

Further, after step 204, it may also include: when an abnormal storage event occurs in the confidential information within the confidential period, it is determined that a leakage event occurs; according to the storage location information and storage time information corresponding to the abnormal storage event , and output the analysis result of the leaking cause of the leaking event.

For example, confidential information is stored in the central server of the enterprise or in a fixed computer. When it is detected that the storage location of confidential information has migrated during the confidential period, the confidential information is copied or cut to the mobile When using external storage devices such as hard disks, optical discs, and U-disks, it can be determined that a leakage event has occurred, and an analysis result of the leakage cause of the leakage event can be output in combination with the identification of the external storage device.

Further, after step 204, it may also include: when an abnormal transmission event occurs in the confidential information within the confidential period, it is determined that a leakage event occurs; according to the transmission path information and transmission method information corresponding to the abnormal transmission event and transmission time information, and output the analysis result of the leaking cause of the leaking event.

For example, the confidential information is stored in computer A, the user logs in to computer A through the local area network, and transmits the confidential information to his computer B, and then the confidential information is transmitted from computer B to computer C through the local area network. , among them, computers A, B, and C are the internal computers of the company. Finally, the confidential information is sent out by e-mail through the Internet in computer C. Since the confidential information cannot be leaked, it can be determined that the occurrence of In case of leaks, you can combine the transmission path of "computer A->computer B->computer C", as well as the transmission methods of local area network transmission and e-mail transmission, to output the analysis result of the leaking cause of the leaking incident.

205. When an unauthorized access event occurs to the confidential information within the confidential period, it is determined that a leakage event occurs.

Further, after it is determined that the leakage event occurs, alarm information of the occurrence of the leakage event may also be output, so as to prompt the user that the leakage event has occurred in time. The alarm information may be text alarm information, picture alarm information, audio alarm information, video alarm information, and the like.

For example, when the confidential information is accessed during the confidential period and is accessed by an unauthorized user, it means that the system may be attacked, and the intruder steals the confidential information, and then it can be determined that a leakage incident has occurred.

206. According to the access information corresponding to the unauthorized access event, output an analysis result of the leaking cause of the leaking event.

Wherein, the access information includes visitor information, access time information, access path information and access source information. For the embodiment of the present invention, an analysis graph of the access time of the leaked information, an analysis graph of the periodic access to the secret-related content, and an access analysis graph of the secret-related information of the access source can be output.

For example, as shown in Figure 3, it is a schematic diagram of the analysis of the access time of leaked information. In this figure, the abscissa represents each day of the confidential period, such as March 1, March 2, etc., and the ordinate represents one day The specific time, such as 1:00, 2:00, etc., in the figure can record the time period when the confidential information of the access source is accessed in a day, which can be represented by vertical lines. The length of the vertical line corresponds to the length of the access. The start position and end position of the line correspond to the start time and end time of the access, respectively. When an unauthorized access event occurs, abnormal vertical lines can be represented by linear differences or color differences, and further, access time characteristics that are prone to leakage events can be counted.

As shown in Figure 4, it is a schematic diagram for the analysis of the periodical access of the leaked content. In this figure, the abscissa can represent the time of the confidential period, and the ordinate represents the amount of access to the confidential information in each day. The length of the vertical line corresponds to the amount of access, and the positive half-axis of the ordinate can represent the amount of authorized access, and the negative half-axis can represent the amount of unauthorized access, and can also be divided into different intervals according to different security levels. For example, the top secret period interval, the confidential period interval, the general secret period interval, etc., among which, each vertical line can also specifically display the visit statistics of the day, such as the number of visits, visitor IP (Internet Protocol, the protocol for interconnection between networks) address, etc. information. The vertical line of the amount of access that appears on the negative half-axis of the ordinate can be marked with a special mark, indicating that an unauthorized access event occurs, so as to prompt an exception.

As shown in Figure 5, it is a schematic diagram of access analysis of access source secret-related information. In this figure, the abscissa can represent the time of the secret-related cycle, and the ordinate can represent the corresponding secret-related information stored locally in the access source. The number of visits can be represented by vertical lines. The length of the vertical lines corresponds to the number of visits, and the positive half-axis of the ordinate can represent the amount of authorized visits, and the negative half-axis can indicate the amount of unauthorized visits, and can also be marked The period of the secret level corresponding to the classified information, such as top secret period, secret period, general secret period, etc. The vertical line of the amount of access that appears on the negative half-axis of the ordinate can be marked with a special mark, indicating that an unauthorized access event occurs, so as to prompt an exception.

Specifically, the step 206 may specifically include: determining the security level period information corresponding to the leaking event according to the access time information; determining the impact level corresponding to the leaking event according to the security level period information corresponding to the leaking event Information, for example, when it is determined that it is in the top-secret period according to the access time corresponding to the unauthorized access event, and a leaking event occurs during this time, the consequences are very serious and the impact level is high. When it is determined that it is in the general secret period at this time, and a leak occurs during this time, the consequences are not serious and the impact level is low.

Then, according to the impact level information, the visitor information, the access time information, the access path information, and the access source information, an analysis result of the leakage cause of the leakage event is output. For example, the identity information of the accessing user, the means used to access the confidential information, the time of accessing the confidential information, the path of the access, the access source of the confidential information and other information are obtained through analysis, and the corresponding analysis results are output, so as to Leak events and their analysis results are automatically presented to users.

Further, the method may further include: acquiring the respective access volumes of the secret-related information in different security-level periods; and outputting the value analysis result of the secret-related information according to the access volume, so as to realize the value of the secret-related information. Sexual analysis needs.

In this embodiment of the present invention, the number of visits for unauthorized access and the number of visits for authorized access can be obtained, and the number of visits after the disclosure of confidential information can also be obtained. The amount of access to confidential information during the confidential period is greater than a certain threshold. The confidential information belongs to the stage of paid access during the confidential period, indicating that a large number of users pay to access the confidential information, and then the value of the confidential information can be determined. High performance and output relevant value analysis results.

Further, in this embodiment of the present invention, it is also possible to count the access volumes corresponding to different secret-related information, and output an analysis graph of access volume of secret-related information, which is specifically displayed in the form of a bubble graph, and each bubble corresponds to one secret-related information. It can also display information such as the proportion of authorized access and unauthorized access, so as to analyze and obtain the corresponding value of different confidential information according to the monitoring graph of the access volume of confidential information.

For example, as shown in Figure 6, it is a schematic diagram of the analysis of the amount of access to confidential information. In this figure, the amount of access to the confidential information related to "T main building design plan" is 2,675,398, of which unauthorized access accounts for 13.15%. %.

Further, the method may further include: counting the file format information corresponding to different secret-related information in which a leak event occurs, wherein the file format information may include word file format, excel file format, and pdf file format; according to the The amount of confidential information corresponding to the file format information, and output the analysis results of the leakage ease corresponding to different file format information, so that users can strengthen corresponding preventive measures according to the analysis results. For example, according to the statistical results, the proportion of leakage incidents in files in dwg format is relatively large, indicating that confidential information files in this format are easily leaked.

Another method for analyzing secret-related information provided by the embodiment of the present invention first obtains secret-related period information corresponding to secret-related information; then analyzes the secret-related information according to the secret-related period information; When an unauthorized access event occurs in the confidential information during the confidential period, it is determined that a leakage event occurs; according to the access information corresponding to the unauthorized access event, an analysis result of the leakage cause of the confidential information leakage event is output. Compared with the current manual method to actively inquire about the leakage cause of the leakage incident of the secret-related information, the present invention analyzes the secret-related information according to the period of the secret-related information in which the secret-related information is located, and obtains the leakage incident from the results obtained from the analysis. The reason of the leak can be automatically displayed to the user, which can realize the automatic analysis of the leak cause, without the need for the user to screen the massive data one by one, which can improve the efficiency of querying the leak cause, and when the confidential information is unauthorized access during the confidential period In the event of an incident, it is determined that a leaking incident has occurred, so that the user can be notified in time that a leaking incident has occurred in the confidential information, and then effective interception can be carried out in a timely manner.

Further, as a specific implementation of the method described in FIG. 1 , an embodiment of the present invention provides an apparatus for analyzing classified information. As shown in FIG. 7 , the apparatus includes: an acquisition unit 71 , an analysis unit 72 , and a determination unit 73 , the output unit 74 .

The obtaining unit 71 may be configured to obtain the secret-related period information corresponding to the secret-related information.

The analyzing unit 72 may be configured to analyze the secret-related information according to the secret-related period information obtained by the obtaining unit 71 .

The determining unit 73 may be configured to determine that a secret leakage event occurs when an unauthorized access event occurs to the secret-related information within the secret-related period.

The output unit 74 may be configured to output the analysis result of the leakage cause of the leakage event according to the access information corresponding to the unauthorized access event.

It should be noted that, for other corresponding descriptions of the functional units involved in the apparatus for analyzing classified information provided by the embodiment of the present invention, reference may be made to the corresponding descriptions in FIG. 1 , and details are not repeated here.

An apparatus for analyzing secret-related information provided by an embodiment of the present invention first obtains secret-related period information corresponding to secret-related information; then analyzes the secret-related information according to the secret-related period information; When an unauthorized access event occurs in the information during the confidential period, it is determined that a leakage event occurs; according to the access information corresponding to the unauthorized access event, an analysis result of the leakage cause of the leakage event is output. Compared with the current manual method to actively inquire about the leakage cause of the leakage incident of the secret-related information, the present invention analyzes the secret-related information according to the period of the secret-related information in which the secret-related information is located, and obtains the leakage incident from the results obtained from the analysis. The reason of the leak can be automatically displayed to the user, which can realize the automatic analysis of the leak cause, without the need for the user to screen the massive data one by one, which can improve the efficiency of querying the leak cause, and when the confidential information is unauthorized access during the confidential period In the event of an incident, it is determined that a leaking incident has occurred, so that the user can be notified in time that a leaking incident has occurred in the confidential information, and then effective interception can be carried out in a timely manner.

Further, as a specific implementation of the method described in FIG. 2 , an embodiment of the present invention provides another apparatus for analyzing classified information. As shown in FIG. 8 , the apparatus includes: an acquisition unit 81 , an analysis unit 82 , and a determination unit 83. Output unit 84.

The obtaining unit 81 may be configured to obtain the secret-related period information corresponding to the secret-related information.

The analyzing unit 82 may be configured to analyze the secret-related information according to the secret-related period information obtained by the obtaining unit 81 .

The determining unit 83 may be configured to determine that a secret leakage event occurs when an unauthorized access event occurs to the secret-related information within the secret-related period.

The output unit 84 may be configured to output an analysis result of the leakage cause of the leakage event according to the access information corresponding to the unauthorized access event.

Optionally, the access information includes visitor information, access time information, access path information and access source information.

Optionally, the secret-related period information includes one or more types of secret-level period information.

Specifically, the output unit 84 includes: a determination module 841 and an output module 842 .

The determining module 841 may be configured to determine, according to the access time information, the security level period information corresponding to the leaking event.

The determining module 841 may also be configured to determine the impact level information corresponding to the leaking event according to the security level period information corresponding to the leaking event.

The output module 842 can be configured to output the analysis result of the leakage cause of the leakage event according to the impact level information, the visitor information, the access time information, the access path information and the access source information .

The obtaining unit 81 may also be configured to obtain the respective access amounts of the secret-related information in different secret-level periods.

The output unit 84 may also be configured to output the value analysis result of the secret-related information according to the amount of visits obtained by the obtaining unit 81 .

Further, the apparatus further includes: a matching unit 85 .

The matching unit 85 may be configured to match the industry data according to the feature rules in the preset industry rule base, which stores the feature rules corresponding to the confidential information of different industries respectively.

The determining unit 83 may also be configured to determine the industry data that is successfully matched with the feature rule as confidential information.

The obtaining unit 81 may be specifically configured to obtain the secret-related period information corresponding to the determined secret-related information.

Further, the apparatus further includes: a statistical unit 86 .

The statistics unit 86 may be configured to count the file format information corresponding to different secret-related information in which a leak event occurs.

The output unit 84 may also be configured to output the analysis results of the ease of leaking corresponding to different file format information according to the number of secret-related information corresponding to the file format information counted by the statistics unit 86 .

The determining unit 83 may also be configured to determine that a secret leakage event occurs when an abnormal storage event occurs in the secret-related information within the secret-related period.

The output unit 84 may also be configured to output an analysis result of the leakage cause of the leakage event according to the storage location information and storage time information corresponding to the abnormal storage event.

The determining unit 83 may also be configured to determine that a secret leakage event occurs when an abnormal transmission event occurs in the secret-related information within the secret-related period.

The output unit 84 may also be configured to output an analysis result of the leakage cause of the leakage event according to the delivery path information, delivery method information and delivery time information corresponding to the abnormal delivery event.

The output unit 84 may also be used to output alarm information of a leaking event.

It should be noted that, for other corresponding descriptions of the functional units involved in another apparatus for analyzing classified information provided by the embodiment of the present invention, reference may be made to the corresponding descriptions in FIG. 2 , which will not be repeated here.

Another apparatus for analyzing secret-related information provided by an embodiment of the present invention first obtains secret-related period information corresponding to secret-related information; then analyzes the secret-related information according to the secret-related period information; When an unauthorized access event occurs in the confidential information during the confidential period, it is determined that a leakage event occurs; according to the access information corresponding to the unauthorized access event, an analysis result of the leakage cause of the confidential information leakage event is output. Compared with the current manual method to actively inquire about the leakage cause of the leakage incident of the confidential information, the present invention analyzes the confidential information according to the confidential period in which the confidential information is located, and obtains the leakage incident from the results obtained from the analysis. The reason of the leak can be automatically displayed to the user, which can realize the automatic analysis of the leak cause, without the need for the user to screen the massive data one by one, which can improve the efficiency of querying the leak cause, and when the confidential information is unauthorized access during the confidential period In the event of an incident, it is determined that a leaking incident has occurred, so that the user can be notified in time that a leaking incident has occurred in the confidential information, and then effective interception can be carried out in a timely manner.

In the above-mentioned embodiments, the description of each embodiment has its own emphasis. For parts that are not described in detail in a certain embodiment, reference may be made to the relevant descriptions of other embodiments.

It can be understood that the relevant features in the above-mentioned methods and apparatuses may refer to each other. In addition, "first", "second", etc. in the above-mentioned embodiments are used to distinguish each embodiment, and do not represent the advantages and disadvantages of each embodiment.

Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working process of the system, device and unit described above may refer to the corresponding process in the foregoing method embodiments, which will not be repeated here.

The algorithms and displays provided herein are not inherently related to any particular computer, virtual system, or other device. Various general-purpose systems can also be used with teaching based on this. The structure required to construct such a system is apparent from the above description. Furthermore, the present invention is not directed to any particular programming language. It is to be understood that various programming languages may be used to implement the inventions described herein, and that the descriptions of specific languages above are intended to disclose the best mode for carrying out the invention.

In the description provided herein, numerous specific details are set forth. It will be understood, however, that embodiments of the invention may be practiced without these specific details. In some instances, well-known methods, structures and techniques have not been shown in detail in order not to obscure an understanding of this description.

Similarly, it is to be understood that in the above description of exemplary embodiments of the invention, various features of the invention are sometimes grouped together into a single embodiment, figure, or its description. This disclosure, however, should not be construed as reflecting an intention that the invention as claimed requires more features than are expressly recited in each claim. Rather, as the following claims reflect, inventive aspects lie in less than all features of a single foregoing disclosed embodiment. Thus, the claims following the Detailed Description are hereby expressly incorporated into this Detailed Description, with each claim standing on its own as a separate embodiment of this invention.

Those skilled in the art will understand that the modules in the device in the embodiment can be adaptively changed and arranged in one or more devices different from the embodiment. The modules or units or components in the embodiments may be combined into one module or unit or component, and further they may be divided into multiple sub-modules or sub-units or sub-assemblies. All features disclosed in this specification (including accompanying claims, abstract and drawings) and any method so disclosed may be employed in any combination, unless at least some of such features and/or procedures or elements are mutually exclusive. All processes or units of equipment are combined. Each feature disclosed in this specification (including accompanying claims, abstract and drawings) may be replaced by alternative features serving the same, equivalent or similar purpose, unless expressly stated otherwise.

Furthermore, those skilled in the art will appreciate that although some of the embodiments described herein include certain features, but not others, included in other embodiments, that combinations of features of different embodiments are intended to be within the scope of the invention within and form different embodiments. For example, in the following claims, any of the claimed embodiments may be used in any combination.

Various component embodiments of the present invention may be implemented in hardware, or in software modules running on one or more processors, or in a combination thereof. Those skilled in the art should understand that a microprocessor or a digital signal processor (DSP) may be used in practice to implement some or all of the components in a method and apparatus for analyzing classified information according to the embodiments of the present invention or full functionality. The present invention can also be implemented as apparatus or apparatus programs (eg, computer programs and computer program products) for performing part or all of the methods described herein. Such a program implementing the present invention may be stored on a computer-readable medium, or may be in the form of one or more signals. Such signals may be downloaded from Internet sites, or provided on carrier signals, or in any other form.

It should be noted that the above-described embodiments illustrate rather than limit the invention, and that alternative embodiments may be devised by those skilled in the art without departing from the scope of the appended claims. In the claims, any reference signs placed between parentheses shall not be construed as limiting the claim. The word "comprising" does not exclude the presence of elements or steps not listed in a claim. The word "a" or "an" preceding an element does not exclude the presence of a plurality of such elements. The invention can be implemented by means of hardware comprising several different elements and by means of a suitably programmed computer. In a unit claim enumerating several means, several of these means may be embodied by one and the same item of hardware. The use of the words first, second, and third, etc. do not denote any order. These words can be interpreted as names.

Claims (14)

1. an analysis method of confidential information, is characterized in that, comprises: Matching industry data according to the feature rules in the preset industry rule base, where the preset industry rule base stores the feature rules corresponding to the confidential information of different industries respectively; Determine the industry data that successfully matches the feature rule as confidential information; Obtaining the secret-related period information corresponding to the secret-related information includes: obtaining the secret-related period information corresponding to the determined secret-related information; analyzing the secret-related information according to the secret-related period information; When an abnormal storage event occurs in the confidential information within the confidential period, it is determined that a leakage event occurs; According to the storage location information and storage time information corresponding to the abnormal storage event, output the analysis result of the leakage cause of the leakage event; When an unauthorized access event occurs to the classified information within the classified information period, it is determined that a leakage event occurs; According to the access information corresponding to the unauthorized access event, output the analysis result of the leakage cause of the leakage event, specifically including: The abscissa represents each day of the confidential period and the ordinate represents the specific moment of the day; Record the time period when the confidential information of the access source is accessed in one day, specifically including: the length of the vertical line corresponds to the length of the access, and the starting position and ending position of the vertical line correspond to the starting time and ending time of the access respectively; When an unauthorized access event occurs, an unusual vertical line is represented by a linear difference or a color difference, and the unusual vertical line is used to count access time characteristics that are prone to leaking events. 2 . The method for analyzing confidential information according to claim 1 , wherein the access information includes visitor information, access time information, access path information and access source information. 3 . 3. The method for analyzing secret-related information according to claim 2, wherein the secret-related period information includes one or more types of secret-level period information. information, and output the analysis result of the leaking cause of the leaking event including: According to the access time information, determine the security level period information corresponding to the leaking event; determining the impact level information corresponding to the leaking event according to the secret level period information corresponding to the leaking event; According to the impact level information, the visitor information, the access time information, the access path information, and the access source information, an analysis result of the leakage cause of the leakage event is output. 4. The method for analyzing classified information according to claim 3, wherein the method further comprises: Acquiring the respective access volumes of the secret-related information in different secret-level periods; According to the amount of visits, the value analysis result of the confidential information is output. 5. The method for analyzing classified information according to claim 1, wherein the method further comprises: Statistical file format information corresponding to different secret-related information in the event of a leak; According to the quantity of secret-related information corresponding to the file format information, the analysis results of the degree of leakage of secrets corresponding to different file format information respectively are output. 6 . The method for analyzing classified information according to claim 1 , wherein after analyzing the classified information according to the classified periodic information, the method further comprises: 6 . When an abnormal transmission event occurs in the confidential information within the confidential period, it is determined that a leakage event occurs; According to the delivery path information, delivery method information and delivery time information corresponding to the abnormal delivery event, an analysis result of the leakage cause of the leakage event is output. 7. The method for analyzing classified information according to claim 1, characterized in that, after said determining that a leakage event occurs, the method further comprises: Output the alarm information of the leakage event. 8. A device for analyzing classified information, comprising: a matching unit, configured to match industry data according to feature rules in a preset industry rule base, where the preset industry rule base stores feature rules corresponding to secret-related information of different industries; The determining unit is further configured to determine the industry data that is successfully matched with the feature rule as confidential information; an obtaining unit, configured to obtain the secret-related period information corresponding to the secret-related information, and is specifically configured to obtain the secret-related period information corresponding to the determined secret-related information; an analysis unit, configured to analyze the secret-related information according to the secret-related period information obtained by the obtaining unit; The determining unit is further configured to determine that a leaking event occurs when an abnormal storage event occurs in the secret-related information within the secret-related period; an output unit, further configured to output an analysis result of the leakage cause of the leakage event according to the storage location information and storage time information corresponding to the abnormal storage event; The determining unit is further configured to determine that a leaking event occurs when an unauthorized access event occurs to the secret-related information within the secret-related period; The output unit is configured to output the analysis result of the leakage cause of the leakage event according to the access information corresponding to the unauthorized access event, specifically including: The abscissa represents each day of the confidential period and the ordinate represents the specific moment of the day; Record the time period when the confidential information of the access source is accessed in one day, specifically including: the length of the vertical line corresponds to the length of the access, and the starting position and ending position of the vertical line correspond to the starting time and ending time of the access respectively; When an unauthorized access event occurs, an unusual vertical line is represented by a linear difference or a color difference, and the unusual vertical line is used to count access time characteristics that are prone to leaking events. 9 . The apparatus for analyzing confidential information according to claim 8 , wherein the access information includes visitor information, access time information, access path information and access source information. 10 . 10 . The apparatus for analyzing classified information according to claim 9 , wherein the classified period information includes one or more types of classified period information, and the output unit comprises: 10 . a determining module, configured to determine the security level period information corresponding to the leaking event according to the access time information; The determining module is further configured to determine the impact level information corresponding to the leaking event according to the secret level period information corresponding to the leaking event; An output module, configured to output an analysis result of the leakage cause of the leakage event according to the impact level information, the visitor information, the access time information, the access path information and the access source information. 11. The apparatus for analyzing classified information according to claim 10, characterized in that: The obtaining unit is further configured to obtain the respective access amounts of the secret-related information in different secret-level periods; The output unit is further configured to output the value analysis result of the secret-related information according to the amount of visits obtained by the obtaining unit. 12. The apparatus for analyzing classified information according to claim 8, wherein the apparatus further comprises: a statistical unit; The statistical unit is used to count the file format information corresponding to different secret-related information in which the leaking event occurs; The output unit is further configured to output an analysis result of the ease of leakage corresponding to different file format information according to the amount of secret-related information corresponding to the file format information counted by the statistics unit. 13. The apparatus for analyzing classified information according to claim 8, characterized in that: The determining unit is further configured to determine that a leaking event occurs when an abnormal transmission event occurs in the secret-related information within the secret-related period; The output unit is further configured to output an analysis result of the leakage cause of the leakage event according to the delivery path information, delivery method information and delivery time information corresponding to the abnormal delivery event. 14. The apparatus for analyzing classified information according to claim 8, characterized in that: The output unit is further configured to output the alarm information of the leakage event.

Images