CN111953558A - Sensitive information monitoring method and device, electronic equipment and storage medium - Google Patents
Sensitive information monitoring method and device, electronic equipment and storage medium Download PDFInfo
- Publication number
- CN111953558A CN111953558A CN202010665229.2A CN202010665229A CN111953558A CN 111953558 A CN111953558 A CN 111953558A CN 202010665229 A CN202010665229 A CN 202010665229A CN 111953558 A CN111953558 A CN 111953558A
- Authority
- CN
- China
- Prior art keywords
- monitoring
- sensitive information
- application
- information
- calling
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Pending
Links
Images
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L43/00—Arrangements for monitoring or testing data switching networks
- H04L43/12—Network monitoring probes
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
- H04L41/22—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks comprising specially adapted graphical user interfaces [GUI]
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L43/00—Arrangements for monitoring or testing data switching networks
- H04L43/04—Processing captured monitoring data, e.g. for logfile generation
- H04L43/045—Processing captured monitoring data, e.g. for logfile generation for graphical visualisation of monitoring data
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L67/00—Network arrangements or protocols for supporting network services or applications
- H04L67/01—Protocols
- H04L67/133—Protocols for remote procedure calls [RPC]
Landscapes
- Engineering & Computer Science (AREA)
- Computer Networks & Wireless Communication (AREA)
- Signal Processing (AREA)
- Data Mining & Analysis (AREA)
- Human Computer Interaction (AREA)
- Debugging And Monitoring (AREA)
Abstract
The application provides a monitoring method and device for sensitive information, an electronic device and a storage medium, which are applied to the technical field of data monitoring, wherein the method comprises the following steps: acquiring tracking information of sensitive information through a monitoring probe, wherein the monitoring probe is preset in an application server in a byte code instrumentation mode, and the tracking information at least comprises: the hierarchical relationship between the service identification and the monitoring probe, wherein the service identification at least comprises: an application identifier of the application server; classifying the tracking information containing the same application identification to obtain N tracking information sets corresponding to the N application identifications; generating N sensitive information calling monitoring graphs corresponding to N application identifications according to the hierarchical relation contained in the N tracking information sets, wherein N is a positive integer; and displaying the calling monitoring graph of the sensitive information. According to the scheme, the user can conveniently and intuitively monitor the sensitive information by watching and calling the monitoring graph.
Description
Technical Field
The present application belongs to the technical field of data monitoring, and in particular, to a method and an apparatus for monitoring sensitive information, an electronic device, and a storage medium.
Background
With the popularization of the internet and the rapid development of information technology, when an internet enterprise provides various servers for users, sensitive information of the users is generally collected, for example, an insurance business collects identity numbers, telephone numbers, addresses, bank accounts, work units and the like of the users. However, with the continuous expansion of enterprise services and the continuous construction of service systems, these sensitive information will be distributed in each corner of a large number of servers, so that the management of the sensitive information becomes very inconvenient.
In the prior art, if a manager wants to monitor sensitive information, the manager needs to manually search and locate the sensitive information in a large number of components and servers, and the method is time-consuming and labor-consuming and easily causes sensitive information omission. Or a manager can also monitor sensitive information through some monitoring tools, but the monitoring tools have a great influence on the normal operation of the server and cannot be applied to a service system consisting of a large number of servers.
Disclosure of Invention
In view of this, a first aspect of the present application provides a method for monitoring sensitive information, which is applied to a monitoring server, and the method includes:
acquiring tracking information of sensitive information through a monitoring probe, wherein the monitoring probe is preset in an application server in a byte code instrumentation mode, and the tracking information at least comprises: the hierarchical relationship between the service identification and the monitoring probe, wherein the service identification at least comprises: an application identifier of the application server;
classifying the tracking information containing the same application identification to obtain N tracking information sets corresponding to the N application identifications;
generating N sensitive information calling monitoring graphs corresponding to N application identifications according to the hierarchical relation contained in the N tracking information sets, wherein N is a positive integer;
and displaying the calling monitoring graph of the sensitive information.
Optionally, the service identifier further includes: the starting time of the monitoring probe and the calling parameter of the sensitive information, wherein the calling monitoring graph of the sensitive information comprises: and the service nodes corresponding to the monitoring probes are sequentially connected according to the hierarchical relationship, and the service nodes are marked with the starting time of the monitoring probes and the calling parameters of the sensitive information.
Optionally, the displaying the call monitoring graph of the sensitive information includes:
receiving a first input of a user, the first input comprising: a target application identification;
displaying, in response to the first input, an invocation monitoring graph of at least one sensitive information corresponding to the target application identification.
Optionally, after the calling monitoring graph displaying the sensitive information is displayed, the method further includes:
alarming in a target mode under the condition that the tracking information of the sensitive information meets the preset alarm condition;
wherein the target mode comprises at least one of the following modes:
sending alarm prompt information to a target communication program;
and outputting alarm prompt information in an audio and video form.
According to a second aspect of the present application, there is provided another method for monitoring sensitive information, applied to an application server, the method including:
under the condition that sensitive information in an application server is called, controlling a monitoring probe to acquire a service identifier of the sensitive information, wherein the monitoring probe is preset in the application server in a byte code instrumentation manner;
and controlling the monitoring probe to send tracking information of the sensitive information to a monitoring server according to the service identification and the hierarchical relation of the monitoring probe, wherein the service identification at least comprises an application identification of the application server.
Optionally, in the case that the sensitive information in the application server is called, before controlling the monitoring probe to acquire the service identifier of the sensitive information, the method further includes:
acquiring a program package of a monitoring probe;
decompressing a program package of the monitoring probe;
configuring the monitoring probe according to a preset installation path and the address of the monitoring server;
restarting the application server to start the monitoring probe.
Optionally, the controlling, in the case that the sensitive information in the application server is called, the monitoring probe to acquire the service identifier of the sensitive information includes:
under the condition that sensitive information in an application server is called, controlling a monitoring probe to update calling parameters of the sensitive information;
and generating the service identifier of the sensitive information according to the updated calling parameter, the starting time of the monitoring probe and the application identifier.
Optionally, the controlling and monitoring the probe to obtain the service identifier of the sensitive information includes:
controlling a monitoring probe to send an acquisition request aiming at the sensitive data to a central server;
and receiving the service identifier of the sensitive data sent by the central server according to the acquisition request.
According to a third aspect of the present application, there is provided a monitoring apparatus for sensitive information, which is applied to a monitoring server, the apparatus including:
the first acquisition module is used for acquiring tracking information of sensitive information through a monitoring probe, wherein the monitoring probe is preset in an application server in a byte code instrumentation mode, and the tracking information at least comprises: the hierarchical relationship between the service identification and the monitoring probe, wherein the service identification at least comprises: an application identifier of the application server;
the generating module is used for classifying the tracking information containing the same application identifier to obtain N tracking information sets corresponding to the N application identifiers;
generating N sensitive information calling monitoring graphs corresponding to N application identifications according to the hierarchical relation contained in the N tracking information sets, wherein N is a positive integer;
and the display module is used for displaying the calling monitoring graph of the sensitive information.
Optionally, the service identifier further includes: the starting time of the monitoring probe and the calling parameter of the sensitive information, wherein the calling monitoring graph of the sensitive information comprises: and the service nodes corresponding to the monitoring probes are sequentially connected according to the hierarchical relationship, and the service nodes are marked with the starting time of the monitoring probes and the calling parameters of the sensitive information.
Optionally, the display module is further configured to:
receiving a first input of a user, the first input comprising: a target application identification;
displaying, in response to the first input, an invocation monitoring graph of at least one sensitive information corresponding to the target application identification.
Optionally, the apparatus further includes:
the alarm module is used for alarming in a target mode under the condition that the tracking information of the sensitive information meets the preset alarm condition;
wherein the target mode comprises at least one of the following modes:
sending alarm prompt information to a target communication program;
and outputting alarm prompt information in an audio and video form.
According to a fourth aspect of the present application, there is provided another apparatus for monitoring sensitive information, which is applied to an application server, the apparatus comprising:
the second acquisition module is used for controlling the monitoring probe to acquire the service identifier of the sensitive information under the condition that the sensitive information in the application server is called, and the monitoring probe is preset in the application server in a byte code instrumentation mode;
and the sending module is used for controlling the monitoring probe to send the tracking information of the sensitive information to the monitoring server according to the service identifier and the hierarchical relation of the monitoring probe, wherein the service identifier at least comprises the application identifier of the application server.
Optionally, the apparatus further includes:
an installation module for:
acquiring a program package of a monitoring probe;
decompressing a program package of the monitoring probe;
configuring the monitoring probe according to a preset installation path and the address of the monitoring server;
restarting the application server to start the monitoring probe.
Optionally, the second obtaining module is further configured to:
under the condition that sensitive information in an application server is called, controlling a monitoring probe to update calling parameters of the sensitive information;
and generating the service identifier of the sensitive information according to the updated calling parameter, the starting time of the monitoring probe and the application identifier.
Optionally, the second obtaining module is further configured to:
controlling a monitoring probe to send an acquisition request aiming at the sensitive data to a central server;
and receiving the service identifier of the sensitive data sent by the central server according to the acquisition request.
According to a fifth aspect of the present application, there is provided an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the method for monitoring the sensitive information according to any one of the above aspects when executing the computer program.
According to a sixth aspect of the present application, there is provided a computer-readable storage medium, on which a computer program is stored, which, when executed by a processor, implements the method for monitoring sensitive information according to any one of the above aspects.
To prior art, this application possesses following advantage:
according to the monitoring method, the monitoring device, the electronic equipment and the storage medium for the sensitive information, the tracking information of the sensitive information is acquired by setting the monitoring probe in the application server in a byte code pile inserting mode, the code of the application server does not need to be changed, the influence on the normal operation of the server is small, and the calling monitoring graph of the sensitive information of each application program is generated according to the hierarchical relation of the monitoring probe in the tracking information and displayed for a user to watch, so that the user can monitor the sensitive information conveniently and visually.
The foregoing description is only an overview of the technical solutions of the present application, and the present application can be implemented according to the content of the description in order to make the technical means of the present application more clearly understood, and the following detailed description of the present application is given in order to make the above and other objects, features, and advantages of the present application more clearly understandable.
Drawings
Various other advantages and benefits will become apparent to those of ordinary skill in the art upon reading the following detailed description of the preferred embodiments. The drawings are only for purposes of illustrating the preferred embodiments and are not to be construed as limiting the application. Also, like reference numerals are used to refer to like parts throughout the drawings. In the drawings:
fig. 1 is a flowchart illustrating steps of a first method for monitoring sensitive information according to an embodiment of the present application;
FIG. 2 is a flowchart illustrating steps of a second method for monitoring sensitive information according to an embodiment of the present disclosure;
fig. 3 is a schematic effect diagram of a monitoring method for sensitive information according to an embodiment of the present application;
FIG. 4 is a flowchart illustrating steps of a third method for monitoring sensitive information according to an embodiment of the present disclosure;
FIG. 5 is a flowchart illustrating steps of a fourth method for monitoring sensitive information according to an embodiment of the present disclosure;
fig. 6 is a flowchart illustrating steps of a service identifier obtaining method according to an embodiment of the present application;
fig. 7 is a flowchart illustrating steps of a fifth method for monitoring sensitive information according to an embodiment of the present application;
fig. 8 is a data transmission diagram of a monitoring method for sensitive information according to an embodiment of the present disclosure;
fig. 9 is a block diagram of a monitoring apparatus for sensitive information according to an embodiment of the present disclosure;
FIG. 10 is a block diagram of another monitoring apparatus for sensitive information according to an embodiment of the present disclosure;
fig. 11 is a block diagram of an electronic device according to an embodiment of the present application.
Detailed Description
Exemplary embodiments of the present application will be described in more detail below with reference to the accompanying drawings. While exemplary embodiments of the present application are shown in the drawings, it should be understood that the present application may be embodied in various forms and should not be limited to the embodiments set forth herein. Rather, these embodiments are provided so that this disclosure will be thorough and complete, and will fully convey the scope of the disclosure to those skilled in the art.
Fig. 1 is a flowchart of steps of a first method for monitoring sensitive information, which is applied to a monitoring server and provided by an embodiment of the present application, and the method includes:
step 101, obtaining tracking information of sensitive information through a monitoring probe, wherein the monitoring probe is preset in an application server in a byte code instrumentation manner, and the tracking information at least comprises: the hierarchical relationship between the service identification and the monitoring probe, wherein the service identification at least comprises: an application identification of the application server.
In this embodiment of the application, the monitoring probe (Agent) is a JVM (Java virtual machine) that is previously installed in the application server using a bytecode instrumentation technology, and collects a tracked application program and periodically sends tracking information of sensitive information to the monitoring server.
The byte code instrumentation technology is to insert one code segment into another code segment or replace another code segment.
An application server refers to a backend server of an application. Sensitive information refers to information in the application server that is related to user privacy or business confidentiality, such as: the user's identification number, address, telephone, business plan of the enterprise, etc. The monitoring server is used for storing and processing the tracking information of the sensitive information sent by the monitoring probe.
The tracking information refers to various index parameters which can reflect the calling condition of the sensitive information, such as: the method specifically includes the steps of calling a source address, calling a destination address, calling time consumption and the like, and the monitoring probe can be set to be adjusted according to actual requirements, and the method is not limited here. The service identifier refers to an identifier corresponding to a service node where the monitoring probe is located, and it can be understood that a complete service may be composed of one or more service nodes, and each service node may be distributed in one or more application servers, so that the monitoring probes set on the application servers correspond to the service identifier of the service, and there is an association relationship between the service nodes of the same service. The hierarchical relationship of the monitoring probes refers to the hierarchical relationship among the monitoring probes, and for the same service, service nodes in charge of the application server where the monitoring probes are located are arranged in a tree structure, so that the monitoring probes have corresponding hierarchical relationship according to the level of the set application server in the tree structure. The application identifier of the application server refers to an application identifier of a service related to the application server, and the application identifier is the same in each application server related to the same service and is usually generated when the monitoring probe is started.
In practical application, the online service of the insurance industry inevitably collects personal information of users, and the personal information relates to user privacy, which is sensitive information, and if the privacy is not effectively monitored, problems such as illegal disclosure easily occur, and threats are brought to the personal privacy of the users and the reputation of insurance companies. Therefore, it is urgently needed to effectively monitor the sensitive information scattered in each application server, but as online services are continuously expanded and a service framework is continuously updated, monitoring the sensitive information through manually inquiring or modifying the service framework obviously consumes a lot of manpower and financial resources, so that the monitoring probes are arranged on each application server in the byte code instrumentation mode without modifying codes in the application servers, the manpower and financial resources required for modifying the service framework can be obviously reduced, and as byte code instrumentation technology does not need to modify the service codes, the influence on the normal operation of the application servers is small.
And 102, classifying the tracking information containing the same application identifier to obtain N tracking information sets corresponding to the N application identifiers.
In the embodiment of the application, because the application identifiers in the trace information belonging to the same application program are the same, the trace information can be classified according to the application identifiers, so that the trace information sets of the application programs indicated by different application identifiers are obtained.
In the embodiment of the present application, since the hierarchical relationship of the monitoring probe is determined according to the hierarchical relationship of the service node where the application server is located in the whole service, the trace information belonging to the same service can be summarized according to the service identifier, that is, after the trace information containing the same service identifier is summarized, the calling monitoring graph of the sensitive information is drawn according to the hierarchical relationship, where the calling monitoring graph may be a tree graph reflecting the calling path of the sensitive information or a hierarchical directory graph, and the specific form of the calling monitoring graph may be determined according to actual requirements as long as the calling condition of the sensitive information can be reflected, and this is not limited herein.
And 104, displaying the calling monitoring graph of the sensitive information.
In the embodiment of the application, the calling monitoring graphs of different sensitive information may be pre-stored in the database, the calling monitoring graph related to the user may be viewed according to different service identifiers or information identifiers of the sensitive information when the user needs the calling monitoring graph, and certainly, the calling monitoring graph of the updated sensitive information may also be displayed in real time for the user to monitor the calling condition of the sensitive information in real time, and may be specifically determined according to actual needs, which is not limited herein.
According to the first monitoring method for the sensitive information, the tracking information of the sensitive information is acquired by setting the monitoring probe in the application server in a byte code pile inserting mode, the code of the application server does not need to be changed, the influence on the normal operation of the server is small, and the calling monitoring graph of the sensitive information of each application program is generated according to the hierarchical relation of the monitoring probe in the tracking information and displayed for a user to watch, so that the user can monitor the sensitive information conveniently and intuitively.
Fig. 2 is a flowchart of steps of a second method for monitoring sensitive information, which is applied to a speed measurement management terminal and provided by the embodiment of the present application, where the method includes:
This step can refer to the detailed description of step 101, which is not repeated herein.
Optionally, the service identifier includes: the application server comprises an application identifier of the application server, the starting time of the monitoring probe and the calling parameter of the sensitive information.
In this embodiment of the present application, the application identifier of the application server may be a hostname (an attribute name used to display or set a host name of the system), so the hostname is generally not duplicated, and if a plurality of monitor probes need to be run in a server cluster of the same application program, a prefix may be added in front of the hostname to avoid duplication. For example, if there are three monitoring probes in the server cluster of the application program a, the application identifiers may be set to 1-application identifier a, 2-application identifier a, and 3-application identifier a, respectively, so as to be distinguished from each other.
This step can refer to the detailed description of step 102, which is not repeated here.
This step can refer to the detailed description of step 103, which is not repeated herein.
In this embodiment, the first input may be an input in the form of a click, a long press, a swipe, a gesture, a voice, and the like of the target application identifier in the application identifier list by the user. The target application identification is an application identification determined from a first input by the user. The application identifiers of the application programs can be displayed as an application identifier list for the user to select according to the requirements of the user.
In the embodiment of the application, according to the target application identifier selected by the user, the calling monitoring graph of the application program corresponding to the target application identifier can be inquired from the calling monitoring graph of the sensitive information prestored in the database and displayed, so that the user can quickly check the calling condition of the required sensitive information.
Optionally, the service identifier further includes: the starting time of the monitoring probe and the calling parameter of the sensitive information, wherein the calling monitoring graph of the sensitive information comprises: and the service nodes corresponding to the monitoring probes are sequentially connected according to the hierarchical relationship, and the service nodes are marked with the starting time of the monitoring probes and the calling parameters of the sensitive information.
In the embodiment of the application, the starting time of the monitoring probe is recorded when the monitoring probe is started, so that repeated application identifications are prevented from being created by mistake. It will be appreciated that if the application of different monitoring probes identifies repetitions, the repetitions may also be distinguished by the initiation time.
The calling parameter of the sensitive information refers to parameters of the called times, the calling source address, the calling destination address, the calling time consumption and the like of the sensitive information, and can be specifically determined according to actual requirements, and is not limited here. Specifically, the number of calls is obtained by continuously increasing from 0 when the sensitive information is called.
In the calling monitoring graph of the sensitive information, service nodes corresponding to application servers where the monitoring probes are located are sequentially connected according to a hierarchical relationship so that a user can know calling paths of the sensitive information, starting time of the monitoring probes is marked on the service nodes so that the user can know time points when the sensitive information is called, and calling parameters such as calling time consumption and calling times are included so that the user can know index parameters when the sensitive information is called.
Illustratively, referring to fig. 3, a schematic diagram illustrating an effect of the monitoring method for sensitive information according to an embodiment of the present application is shown, where Node1, Node2, and Node3 indicate application identifiers, RPC (Remote Procedure Call) identifies basic units of tracking, and when an RPC Call arrives, it indicates that work has been processed and contains tracking information. The TxId represents that the service identifier comprises an application identifier Node, a starting Time (Time) of a monitoring probe and a calling number, and SpaniD and pSpanId jointly represent a hierarchical relationship, wherein SpaniD represents a child field, and pSpanId represents a parent field. It can be seen that RPC1, RPC2, RPC3 are related to each other, each service Node displays a corresponding application identification Node, and the corresponding TxId and hierarchical relationship are labeled below, for Node1 at the root Node, its parent field may be-1 and its child field may be 1, and for Node2 at the second level, its parent field may be 2 and its child field may be 1, Node3 and Node4 may refer to the descriptions of Node2 and Node 2. Through the calling monitoring graph of the sensitive information, a user can conveniently and intuitively know the calling condition of the sensitive information.
wherein the target mode comprises at least one of the following modes:
sending alarm prompt information to a target communication program;
and outputting alarm prompt information in an audio and video form.
In this embodiment of the present application, the preset alarm condition means that a specific index parameter in the tracking information of the sensitive information meets a preset condition, for example: the calling destination address of the sensitive information is an illegal address, the calling times of the sensitive information are greater than a time threshold, the calling time consumption of the sensitive information exceeds a time-consuming threshold, and the like, and the calling destination address of the sensitive information can be specifically set according to actual requirements, and is not specifically limited here.
In order to facilitate the user to find the abnormal calling condition of the sensitive information in time, the user can be informed in time by sending alarm prompt information to the user under the condition that the tracking information of the sensitive information meets the preset alarm condition. Specifically, the alarm prompt information can be sent to the user in a timely communication program, a mail, a short message and other modes, and the alarm prompt information in an audio and video mode can also be output through the monitoring server. The alarm prompt information can include description information of the name of the sensitive information meeting the preset alarm condition, the alarm reason and other types, so that a user can quickly know the abnormal calling condition.
According to the second monitoring method for the sensitive information, the tracking information of the sensitive information is acquired by setting the monitoring probe in the application server in a byte code pile inserting mode, the code of the application server does not need to be changed, the influence on the normal operation of the server is small, and the calling monitoring graph of the sensitive information of each application program is generated according to the hierarchical relation of the monitoring probe in the tracking information and displayed for a user to watch, so that the user can monitor the sensitive information conveniently and intuitively. And the calling parameters of the sensitive information and the starting time of the monitoring probe are displayed in the monitoring graph of the sensitive information, so that a user can visually check the calling condition of the sensitive information and can automatically alarm the abnormal condition of the sensitive information, and the user can timely find the abnormal condition of the sensitive information.
Fig. 4 is a flowchart of steps of a third method for monitoring sensitive information, which is applied to an application server and provided by an embodiment of the present application, where the method includes:
In the embodiment of the application, when the sensitive information in the application server is called, the monitoring probe acquires the service identifier according to each index parameter called by the sensitive information, the related service and the like, so as to be used in the subsequent steps.
In the embodiment of the application, the monitoring probe packs the service identifier and the hierarchical relationship of the monitoring probe into the tracking information at regular time and feeds the tracking information back to the monitoring server, so that the monitoring server processes the tracking information and generates a corresponding calling monitoring graph of sensitive information for a user to check.
According to the third monitoring method for the sensitive information, the monitoring probes are arranged in the application server in a byte code pile inserting mode to acquire the tracking information of the sensitive information, the codes of the application server do not need to be changed, the influence on the normal operation of the server is small, and the calling monitoring graph of the sensitive information of each application program is generated according to the hierarchical relation of the monitoring probes in the tracking information and displayed for a user to watch, so that the user can monitor the sensitive information conveniently and visually.
Fig. 5 is a flowchart of steps of a fourth method for monitoring sensitive information, which is applied to an application server and provided by the embodiment of the present application, and the method includes:
In this embodiment of the application, the program package of the monitoring probe may be stored in the application server by the user in advance, or may be downloaded by the application server from the online, and a specific manner for the application server to obtain the program package of the monitoring probe may be determined according to actual requirements, which is not limited herein.
In the embodiment of the present application, the program package of the monitoring probe is first decompressed, and then the decompressed program file is placed into a container.
And 403, configuring the monitoring probe according to a preset installation path and the address of the monitoring server.
In this embodiment of the present application, the preset installation path refers to a designated path for installing the monitoring probe, and the address of the monitoring server refers to an internet address of the monitoring server. The preset installation path and the address of the monitoring server may be configured in advance, respectively, or may be configured by the user in real time before the installation of the program package of the monitoring probe, and may be determined specifically according to actual requirements, which is not limited herein.
In the embodiment of the present application, since the server configuration of the application server is changed, the application server needs to be restarted to start the monitoring probe.
In the embodiment of the application, each time sensitive information is called, the monitoring probe updates the calling parameters according to each calling index parameter, for example, the calling times are increased, the calling destination address is updated, and the like.
And 406, generating a service identifier of the sensitive information according to the updated calling parameter, the starting time of the monitoring probe and the application identifier.
In the embodiment of the application, the service identifier including the updated calling parameter, the starting time of the monitoring probe and the application identifier can ensure uniqueness, so that abnormal data caused by repeated service identifiers is avoided.
In the embodiment of the application, the tracking information of the sensitive information sent to the monitoring server by the monitoring probe includes the service identifier and the hierarchical relationship of the monitoring probe, so that not only can the uniqueness of the tracking information be ensured, but also the hierarchical relationship of the monitoring probe where the tracking information is located can be reflected, and the monitoring server can generate the calling monitoring graph of the sensitive information capable of reflecting the calling condition of the sensitive information according to the tracking information, so that a user can conveniently know the calling condition of the sensitive information.
Optionally, referring to fig. 6, the step 405 may include:
sub-step 4051, controlling the monitoring probe to send an acquisition request for said sensitive data to the central server.
In the embodiment of the present application, the central server refers to an electronic device that generates a unique data identifier of sensitive data by using index parameters of dimensions such as a source address, a target address, time, a belonging application program, and the like, which are called according to the sensitive data. The central server may be independently configured, may also be compatible in a monitoring server or other servers, and may be determined specifically according to actual requirements, which is not limited herein.
In the embodiment of the application, the central server can generate the only service identification for the sensitive data according to the identification generation method of the central server, and all the service identifications of the sensitive data are in the central server, so that the central server can ensure that the service identifications of the sensitive data are not repeated according to the service identifications generated by history, the situation that the service identifications are repeated possibly due to the fact that the service identifications are generated at different monitoring nodes is avoided, and the hidden danger that the monitoring of the sensitive data is wrong due to the fact that the service identifications are repeated is avoided.
According to the fourth monitoring method for the sensitive information, the tracking information of the sensitive information is acquired by arranging the monitoring probe in the application server in a byte code pile inserting mode, the code of the application server does not need to be changed, the influence on the normal operation of the server is small, and the calling monitoring graph of the sensitive information of each application program is generated according to the hierarchical relation of the monitoring probe in the tracking information and displayed for a user to watch, so that the user can monitor the sensitive information conveniently and visually.
Fig. 7 is a flowchart of steps of a fifth method for monitoring sensitive information, which is applied to a monitoring system for sensitive information, where the system includes a monitoring server, and the method includes:
step 501, the application server controls a monitoring probe to acquire a service identifier of sensitive information when the sensitive information in the application server is called, and the monitoring probe is preset in the application server in a byte code instrumentation manner.
This step can refer to the detailed description of step 301, and is not described herein again.
Step 502, the application server controls the monitoring probe to send the tracking information of the sensitive information to the monitoring server according to the service identifier and the hierarchical relationship of the monitoring probe, wherein the service identifier at least comprises the application identifier of the application server.
This step can refer to the detailed description of step 302, and is not repeated here.
Step 503, the monitoring server obtains tracking information of the sensitive information through a monitoring probe, wherein the monitoring probe is preset in the application server in a bytecode instrumentation manner, and the tracking information at least includes: the hierarchical relationship between the service identification and the monitoring probe, wherein the service identification at least comprises: an application identification of the application server.
This step can refer to the detailed description of step 101, which is not repeated herein.
Step 504, the monitoring server classifies the tracking information containing the same application identifier to obtain N tracking information sets corresponding to the N application identifiers.
This step can refer to the detailed description of step 102, which is not repeated here.
And 505, the monitoring server generates N calling monitoring graphs of the sensitive information corresponding to the N application identifiers according to the hierarchical relationship included in the N tracking information sets, where N is a positive integer.
This step can refer to the detailed description of step 103, which is not repeated herein.
Step 506, the monitoring server displays the calling monitoring graph of the sensitive information.
This step can refer to the detailed description of step 104, which is not repeated here.
Exemplarily, referring to fig. 8, a data transmission schematic diagram of a monitoring method for sensitive information provided by the present application is shown, where monitoring probes 1 to 3 in application servers 1 to 3 upload tracking information to a monitoring server, the monitoring server processes the tracking information to obtain a calling monitoring graph of the sensitive information and writes the calling monitoring graph into a database, and when a user needs to check the calling monitoring graph of the sensitive information, the user can read a required calling monitoring graph of the sensitive information from the database through a display device for checking.
According to the fifth monitoring method for the sensitive information, the tracking information of the sensitive information is acquired by setting the monitoring probe in the application server in a byte code pile inserting mode, the code of the application server does not need to be changed, the influence on the normal operation of the server is small, and the calling monitoring graph of the sensitive information of each application program is generated according to the hierarchical relation of the monitoring probe in the tracking information and displayed for a user to watch, so that the user can monitor the sensitive information conveniently and intuitively.
Fig. 9 is a monitoring apparatus 60 for sensitive information, which is applied to a monitoring server and provided by an embodiment of the present application, and the apparatus includes:
a first obtaining module 601, configured to obtain tracking information of sensitive information through a monitoring probe, where the monitoring probe is preset in an application server in a bytecode instrumentation manner, and the tracking information at least includes: the hierarchical relationship between the service identification and the monitoring probe, wherein the service identification at least comprises: an application identifier of the application server;
a generating module 602, configured to classify the tracking information containing the same application identifier to obtain N tracking information sets corresponding to the N application identifiers;
generating N sensitive information calling monitoring graphs corresponding to N application identifications according to the hierarchical relation contained in the N tracking information sets, wherein N is a positive integer;
and the display module 603 is configured to display the call monitoring graph of the sensitive information.
Optionally, the service identifier further includes: the starting time of the monitoring probe and the calling parameter of the sensitive information, wherein the calling monitoring graph of the sensitive information comprises: and the service nodes corresponding to the monitoring probes are sequentially connected according to the hierarchical relationship, and the service nodes are marked with the starting time of the monitoring probes and the calling parameters of the sensitive information.
Optionally, the display module 603 is further configured to:
receiving a first input of a user, the first input comprising: a target application identification;
displaying, in response to the first input, an invocation monitoring graph of at least one sensitive information corresponding to the target application identification.
Optionally, the apparatus further includes:
the alarm module 604 is configured to alarm in a target manner when the tracking information of the sensitive information meets a preset alarm condition;
wherein the target mode comprises at least one of the following modes:
sending alarm prompt information to a target communication program;
and outputting alarm prompt information in an audio and video form.
According to the monitoring device for the sensitive information, the tracking information of the sensitive information is collected by setting the monitoring probe in the application server in a byte code pile inserting mode, the code of the application server does not need to be changed, the influence on the normal operation of the server is small, and the calling monitoring graph of the sensitive information of each application program is generated according to the hierarchical relation of the monitoring probe in the tracking information and displayed for a user to watch, so that the user can monitor the sensitive information conveniently and intuitively.
Fig. 10 is a monitoring apparatus 70 for another sensitive information provided in this embodiment of the present application, applied to an application server, where the apparatus includes:
a second obtaining module 701, configured to control a monitoring probe to obtain a service identifier of sensitive information when the sensitive information in an application server is called, where the monitoring probe is preset in the application server in a bytecode-instrumentation manner;
a sending module 702, configured to control the monitoring probe to send, according to the service identifier and the hierarchical relationship of the monitoring probe, the tracking information of the sensitive information to the monitoring server.
Optionally, the apparatus further includes:
a mounting module 703 for:
acquiring a program package of a monitoring probe;
decompressing a program package of the monitoring probe;
configuring the monitoring probe according to a preset installation path and the address of the monitoring server;
restarting the application server to start the monitoring probe.
Optionally, the second obtaining module 701 is further configured to:
under the condition that sensitive information in an application server is called, controlling a monitoring probe to update calling parameters of the sensitive information;
and generating the service identifier of the sensitive information according to the updated calling parameter, the starting time of the monitoring probe and the application identifier.
Optionally, the second obtaining module 701 is further configured to:
controlling a monitoring probe to send an acquisition request aiming at the sensitive data to a central server;
and receiving the service identifier of the sensitive data sent by the central server according to the acquisition request.
According to the monitoring device for the other sensitive information, the tracking information of the sensitive information is collected by setting the monitoring probe in the application server in a byte code pile inserting mode, the code of the application server does not need to be changed, the influence on the normal operation of the server is small, and the calling monitoring graph of the sensitive information of each application program is generated according to the hierarchical relation of the monitoring probe in the tracking information and displayed for a user to watch, so that the user can monitor the sensitive information conveniently and intuitively.
For the embodiment of the server, since it is basically similar to the method embodiment, the description is relatively simple, and for relevant points, reference may be made to part of the description of the method embodiment.
The embodiment of the present application further provides an electronic device, as shown in fig. 11, which includes a processor 801, a communication interface 802, a memory 803, and a communication bus 804, where the processor 801, the communication interface 802, and the memory 803 complete mutual communication through the communication bus 804,
a memory 803 for storing a computer program;
the processor 801 is configured to implement the following steps when executing the program stored in the memory 803:
acquiring tracking information of sensitive information through a monitoring probe, wherein the monitoring probe is preset in an application server in a byte code instrumentation mode, and the tracking information at least comprises: the hierarchical relationship between the service identification and the monitoring probe; generating a calling monitoring graph of the sensitive information corresponding to the service identification according to the hierarchical relationship; and displaying the calling monitoring graph of the sensitive information.
The processor 801 is further configured to perform the following steps:
acquiring tracking information of sensitive information through a monitoring probe, wherein the monitoring probe is preset in an application server in a byte code instrumentation mode, and the tracking information at least comprises: the hierarchical relationship between the service identification and the monitoring probe, wherein the service identification at least comprises: an application identifier of the application server; classifying the tracking information containing the same application identification to obtain N tracking information sets corresponding to the N application identifications; generating N sensitive information calling monitoring graphs corresponding to N application identifications according to the hierarchical relation contained in the N tracking information sets, wherein N is a positive integer; and displaying the calling monitoring graph of the sensitive information.
The communication bus mentioned in the above terminal may be a Peripheral Component Interconnect (PCI) bus, an Extended Industry Standard Architecture (EISA) bus, or the like. The communication bus may be divided into an address bus, a data bus, a control bus, etc. For ease of illustration, only one thick line is shown, but this does not mean that there is only one bus or one type of bus.
The communication interface is used for communication between the terminal and other equipment.
The Memory may include a Random Access Memory (RAM), or may also include a non-volatile Memory (non-volatile Memory), such as at least one disk Memory. Optionally, the memory may also be at least one memory device located remotely from the processor.
The Processor may be a general-purpose Processor, and includes a Central Processing Unit (CPU), a Network Processor (NP), and the like; the Integrated Circuit may also be a Digital Signal Processor (DSP), an Application Specific Integrated Circuit (ASIC), a Field Programmable Gate Array (FPGA) or other Programmable logic device, discrete gate or transistor logic device, or discrete hardware components.
In another embodiment provided by the present application, a computer-readable storage medium is further provided, in which instructions are stored, and when the instructions are executed on a computer, the computer is caused to execute the monitoring method for the sensitive information described in any one of the above embodiments.
In yet another embodiment provided by the present application, there is also provided a computer program product containing instructions which, when run on a computer, cause the computer to perform the method for monitoring sensitive information as described in any of the above embodiments.
In the above embodiments, the implementation may be wholly or partially realized by software, hardware, firmware, or any combination thereof. When implemented in software, may be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions. When loaded and executed on a computer, cause the processes or functions described in accordance with the embodiments of the application to occur, in whole or in part. The computer may be a general purpose computer, a special purpose computer, a network of computers, or other programmable device. The computer instructions may be stored in a computer readable storage medium or transmitted from one computer readable storage medium to another, for example, from one website site, computer, server, or data center to another website site, computer, server, or data center via wired (e.g., coaxial cable, fiber optic, Digital Subscriber Line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.). The computer-readable storage medium can be any available medium that can be accessed by a computer or a data storage device, such as a server, a data center, etc., that incorporates one or more of the available media. The usable medium may be a magnetic medium (e.g., floppy Disk, hard Disk, magnetic tape), an optical medium (e.g., DVD), or a semiconductor medium (e.g., Solid State Disk (SSD)), among others.
It is noted that, herein, relational terms such as first and second, and the like may be used solely to distinguish one entity or action from another entity or action without necessarily requiring or implying any actual such relationship or order between such entities or actions. Also, the terms "comprises," "comprising," or any other variation thereof, are intended to cover a non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements does not include only those elements but may include other elements not expressly listed or inherent to such process, method, article, or apparatus. Without further limitation, an element defined by the phrase "comprising an … …" does not exclude the presence of other identical elements in a process, method, article, or apparatus that comprises the element.
All the embodiments in the present specification are described in a related manner, and the same and similar parts among the embodiments may be referred to each other, and each embodiment focuses on the differences from the other embodiments. In particular, for the system embodiment, since it is substantially similar to the method embodiment, the description is simple, and for the relevant points, reference may be made to the partial description of the method embodiment.
The above description is only for the preferred embodiment of the present application, and is not intended to limit the scope of the present application. Any modification, equivalent replacement, improvement and the like made within the spirit and principle of the present application are included in the protection scope of the present application.
Claims (10)
1. A monitoring method of sensitive information is applied to a monitoring server, and the method comprises the following steps:
acquiring tracking information of sensitive information through a monitoring probe, wherein the monitoring probe is preset in an application server in a byte code instrumentation mode, and the tracking information at least comprises: the hierarchical relationship between the service identification and the monitoring probe, wherein the service identification at least comprises: an application identifier of the application server;
classifying the tracking information containing the same application identification to obtain N tracking information sets corresponding to the N application identifications;
generating N sensitive information calling monitoring graphs corresponding to N application identifications according to the hierarchical relation contained in the N tracking information sets, wherein N is a positive integer;
and displaying the calling monitoring graph of the sensitive information.
2. The method of claim 1, wherein the service identifier further comprises: the starting time of the monitoring probe and the calling parameter of the sensitive information, wherein the calling monitoring graph of the sensitive information comprises: and the service nodes corresponding to the monitoring probes are sequentially connected according to the hierarchical relationship, and the service nodes are marked with the starting time of the monitoring probes and the calling parameters of the sensitive information.
3. The method of claim 1, wherein displaying the call monitoring graph of the sensitive information comprises:
receiving a first input of a user, the first input comprising: a target application identification;
displaying, in response to the first input, an invocation monitoring graph of at least one sensitive information corresponding to the target application identification.
4. The method of claim 1, further comprising, after the displaying the call monitoring graph for the sensitive information:
alarming in a target mode under the condition that the tracking information of the sensitive information meets the preset alarm condition;
wherein the target mode comprises at least one of the following modes:
sending alarm prompt information to a target communication program;
and outputting alarm prompt information in an audio and video form.
5. A method for monitoring sensitive information is applied to an application server, and the method comprises the following steps:
under the condition that sensitive information in an application server is called, controlling a monitoring probe to acquire a service identifier of the sensitive information, wherein the monitoring probe is preset in the application server in a byte code instrumentation manner;
and controlling the monitoring probe to send tracking information of the sensitive information to a monitoring server according to the service identification and the hierarchical relation of the monitoring probe, wherein the service identification at least comprises an application identification of the application server.
6. An apparatus for monitoring sensitive information, which is applied to a monitoring server, the apparatus comprising:
the first acquisition module is used for acquiring tracking information of sensitive information through a monitoring probe, wherein the monitoring probe is preset in an application server in a byte code instrumentation mode, and the tracking information at least comprises: the hierarchical relationship between the service identification and the monitoring probe, wherein the service identification at least comprises: an application identifier of the application server;
the generating module is used for classifying the tracking information containing the same application identifier to obtain N tracking information sets corresponding to the N application identifiers;
generating N sensitive information calling monitoring graphs corresponding to N application identifications according to the hierarchical relation contained in the N tracking information sets, wherein N is a positive integer;
and the display module is used for displaying the calling monitoring graph of the sensitive information.
7. The apparatus of claim 6, wherein the service identifier further comprises: the starting time of the monitoring probe and the calling parameter of the sensitive information, wherein the calling monitoring graph of the sensitive information comprises: and the service nodes corresponding to the monitoring probes are sequentially connected according to the hierarchical relationship, and the service nodes are marked with the starting time of the monitoring probes and the calling parameters of the sensitive information.
8. An apparatus for monitoring sensitive information, applied to an application server, the apparatus comprising:
the second acquisition module is used for controlling the monitoring probe to acquire the service identifier of the sensitive information under the condition that the sensitive information in the application server is called, and the monitoring probe is preset in the application server in a byte code instrumentation mode;
and the sending module is used for controlling the monitoring probe to send the tracking information of the sensitive information to the monitoring server according to the service identifier and the hierarchical relation of the monitoring probe, wherein the service identifier at least comprises the application identifier of the application server.
9. An electronic device comprising a memory, a processor and a computer program stored on the memory and executable on the processor, wherein the processor implements the method for monitoring sensitive information according to any one of claims 1 to 5 when executing the computer program.
10. A computer-readable storage medium, on which a computer program is stored which, when being executed by a processor, carries out a method for monitoring sensitive information according to any one of claims 1 to 5.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202010665229.2A CN111953558A (en) | 2020-07-10 | 2020-07-10 | Sensitive information monitoring method and device, electronic equipment and storage medium |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202010665229.2A CN111953558A (en) | 2020-07-10 | 2020-07-10 | Sensitive information monitoring method and device, electronic equipment and storage medium |
Publications (1)
| Publication Number | Publication Date |
|---|---|
| CN111953558A true CN111953558A (en) | 2020-11-17 |
Family
ID=73341235
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN202010665229.2A Pending CN111953558A (en) | 2020-07-10 | 2020-07-10 | Sensitive information monitoring method and device, electronic equipment and storage medium |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN111953558A (en) |
Cited By (4)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN112433915A (en) * | 2020-11-30 | 2021-03-02 | 泰康保险集团股份有限公司 | Data monitoring method based on distributed performance monitoring tool and related device |
| CN112528331A (en) * | 2020-12-15 | 2021-03-19 | 杭州默安科技有限公司 | Privacy disclosure risk detection method, device and system |
| CN113891118A (en) * | 2021-10-11 | 2022-01-04 | 北京仁光科技有限公司 | Method and system for calling copy by signal source, readable storage medium and electronic equipment |
| CN114647854A (en) * | 2022-03-01 | 2022-06-21 | 深圳开源互联网安全技术有限公司 | Component security detection method and device, firewall and component downloading system |
Citations (4)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US20140095868A1 (en) * | 2012-10-02 | 2014-04-03 | Ca, Inc. | System and method for multi-layered sensitive data protection in a virtual computing environment |
| CN110007957A (en) * | 2018-12-17 | 2019-07-12 | 阿里巴巴集团控股有限公司 | Call link construction method, device and equipment |
| CN110888780A (en) * | 2019-11-19 | 2020-03-17 | 泰康保险集团股份有限公司 | Application monitoring method, device, equipment and storage medium |
| CN111008105A (en) * | 2019-11-07 | 2020-04-14 | 泰康保险集团股份有限公司 | Distributed system call relation visualization method and device |
-
2020
- 2020-07-10 CN CN202010665229.2A patent/CN111953558A/en active Pending
Patent Citations (4)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US20140095868A1 (en) * | 2012-10-02 | 2014-04-03 | Ca, Inc. | System and method for multi-layered sensitive data protection in a virtual computing environment |
| CN110007957A (en) * | 2018-12-17 | 2019-07-12 | 阿里巴巴集团控股有限公司 | Call link construction method, device and equipment |
| CN111008105A (en) * | 2019-11-07 | 2020-04-14 | 泰康保险集团股份有限公司 | Distributed system call relation visualization method and device |
| CN110888780A (en) * | 2019-11-19 | 2020-03-17 | 泰康保险集团股份有限公司 | Application monitoring method, device, equipment and storage medium |
Cited By (5)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN112433915A (en) * | 2020-11-30 | 2021-03-02 | 泰康保险集团股份有限公司 | Data monitoring method based on distributed performance monitoring tool and related device |
| CN112433915B (en) * | 2020-11-30 | 2023-06-16 | 泰康保险集团股份有限公司 | Data monitoring method and related device based on distributed performance monitoring tool |
| CN112528331A (en) * | 2020-12-15 | 2021-03-19 | 杭州默安科技有限公司 | Privacy disclosure risk detection method, device and system |
| CN113891118A (en) * | 2021-10-11 | 2022-01-04 | 北京仁光科技有限公司 | Method and system for calling copy by signal source, readable storage medium and electronic equipment |
| CN114647854A (en) * | 2022-03-01 | 2022-06-21 | 深圳开源互联网安全技术有限公司 | Component security detection method and device, firewall and component downloading system |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN111953558A (en) | Sensitive information monitoring method and device, electronic equipment and storage medium | |
| CN112506755B (en) | Log acquisition method, device, computer equipment and storage medium | |
| CN109831358B (en) | Client flow statistical method and device, server and readable storage medium | |
| CN110430070B (en) | Service state analysis method, device, server, data analysis equipment and medium | |
| CN112953791A (en) | Network detection method and device, electronic equipment and computer readable storage medium | |
| CN109491733B (en) | Interface display method based on visualization and related equipment | |
| CN114218410A (en) | Information recommendation method and device, electronic equipment and storage medium | |
| CN111159269A (en) | Data processing method, device and system | |
| CN108650123B (en) | Fault information recording method, device, equipment and storage medium | |
| CN112115103A (en) | File address display method and device, electronic equipment and readable storage medium | |
| CN108390770B (en) | Information generation method and device and server | |
| CN107679198B (en) | Information query method and device | |
| CN114090268B (en) | Container management method and container management system | |
| CN114050990A (en) | Test method and device for network isolation equipment, storage medium and electronic equipment | |
| CN113590180A (en) | Detection strategy generation method and device | |
| CN113778780A (en) | Application stability determination method and device, electronic equipment and storage medium | |
| CN111767178A (en) | Physical machine performance testing method and device | |
| CN111368039A (en) | Data management system | |
| CN112506740B (en) | Cloud alarm method, electronic equipment, storage medium and cloud alarm device | |
| CN110837454A (en) | Interface monitoring processing method and server | |
| CN114374534B (en) | Test sample set updating method and device and electronic equipment | |
| CN117097599B (en) | Network service detection method, device, computer equipment and storage medium | |
| CN115309612B (en) | Method and device for monitoring data | |
| CN108256320B (en) | Dynamic detection method, device, equipment and storage medium for differential domain | |
| CN115793968A (en) | Data migration method and device and electronic equipment |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| RJ01 | Rejection of invention patent application after publication | ||
| RJ01 | Rejection of invention patent application after publication |
Application publication date: 20201117 |