WO2020113401A1

WO2020113401A1 - Data detection method, apparatus and device

Info

Publication number: WO2020113401A1
Application number: PCT/CN2018/119060
Authority: WO
Inventors: 刘奎龙
Original assignee: 北京比特大陆科技有限公司
Priority date: 2018-12-04
Filing date: 2018-12-04
Publication date: 2020-06-11
Also published as: CN113316921A

Abstract

A data detection method, apparatus and device. The method comprises: detecting the security of data to be detected according to attribute information of the data to be detected and a preset model (S202), the preset model being obtained by learning sample data by means of a neural network. The data detection efficiency and accuracy are improved.

Description

Data detection method, device and equipment

Technical field

This application relates to the field of computer technology, for example, to a data detection method, device, and equipment.

Background technique

With the continuous development of network technology, the application of the network is more and more extensive, and many important information is usually transmitted over the network.

In the related art, in the process of data transmission on the network, in order to prevent the leakage of important information or attack the network by illegal data, in the important interfaces of the network (for example, the network gateway from the internal network to the external network), usually The staff will manually detect the data passing through important nodes, and then allow the data to pass when it is determined that the data is safe. However, the staff cannot accurately identify many processed data, which not only leads to inefficient data detection, but also leads to The reliability of data detection is low.

Summary of the invention

The embodiments of the present disclosure provide a data detection method, device and equipment, which improve the efficiency and accuracy of data detection.

In a first aspect, an embodiment of the present disclosure provides a data detection method, including:

According to the attribute information of the data to be detected and a preset model, the security of the data to be detected is detected, and the preset model is obtained by learning the sample data through a neural network.

In a possible implementation manner, the method further includes:

Obtain the attribute information of the data to be detected.

In a possible implementation manner, the attribute information of the data to be detected includes at least one of the following attributes: a format of the data to be detected, resources used by the data to be detected, and a frequency of data transmission.

In a possible implementation manner, the data transmission frequency is a frequency at which the device that sends the data to be detected sends data within a preset time period.

In a possible implementation manner, the detecting the security of the data to be detected according to the attribute information of the data to be detected and the preset model includes:

Detecting the security of the data to be detected according to the attribute information;

When detecting that the data to be detected is safety data according to the attribute information, perform security verification on the attribute information and/or the data to be detected through the preset model.

In a possible implementation manner, the method further includes:

When detecting that the data to be detected is risk data according to the attribute information, it is determined that the data to be detected is risk data.

In a possible implementation manner, the detecting the security of the data to be detected according to the attribute information includes:

Obtain the security range corresponding to each attribute in the attribute information;

When there is at least one attribute in the attribute information outside the safety range corresponding to the at least one attribute, it is determined that the data to be detected is risk data;

When the attributes in the attribute information are all within the security range corresponding to the attributes, it is determined that the data to be detected is security data.

In a possible implementation manner, the security range corresponding to the format of the data to be detected includes at least one preset security format.

In a possible implementation manner, the security range corresponding to the resource used by the data to be detected includes a preset resource range.

In a possible implementation manner, the safety range corresponding to the data transmission frequency includes a preset frequency range.

In a possible implementation manner, the performing security verification on the attribute information and/or the data to be detected through the preset model includes:

Acquiring the type of the data to be detected, the type of the data to be detected includes at least one of a text type, an image type, a voice type, or a video type;

Acquiring the preset model according to the type of the data to be detected;

Perform security verification on the attribute information and/or the data to be detected through the preset model.

In a possible implementation manner, the sample data includes marked safety sample data and marked risk sample data.

In a second aspect, an embodiment of the present disclosure provides a data detection device, including a detection module;

The detection module is configured to detect the security of the data to be detected according to the attribute information of the data to be detected and a preset model, and the preset model is obtained by learning the sample data through a neural network.

In a possible implementation manner, the device further includes a first acquisition module;

The first acquiring module is configured to acquire attribute information of the data to be detected.

In a possible implementation manner, the attribute information of the data to be detected includes at least one of the following attributes: a format of the data to be detected, a resource used by the data to be detected, and a frequency of data transmission.

In a possible implementation manner, the detection module is configured to:

In a possible implementation manner, the device further includes a determination module, and the determination module is configured to:

When the detection module detects that the data to be detected is risk data according to the attribute information, it is determined that the data to be detected is risk data.

In a possible implementation manner, the detection module is configured to:

In a possible implementation manner, the device further includes a second acquisition module and a third acquisition module,

The second acquiring module is configured to acquire the type of the data to be detected, and the type of the data to be detected includes at least one of a text type, an image type, a voice type, or a video type;

The third obtaining module is configured to obtain the preset model according to the type of the data to be detected;

The detection module is configured to perform security verification on the attribute information and/or the data to be detected through the preset model.

In a third aspect, an embodiment of the present disclosure provides a computer including the device according to any one of the second aspect.

According to a fourth aspect, an embodiment of the present disclosure provides an electronic device, including:

At least one processor; and

A memory communicatively connected to the at least one processor; wherein,

The memory stores instructions executable by the at least one processor, and when the instructions are executed by the at least one processor, causes the at least one processor to perform the method of any one of the first aspects.

According to a fifth aspect, an embodiment of the present disclosure provides a computer-readable storage medium that stores computer-executable instructions, and the computer-executable instructions are configured to perform the method according to any one of the first aspects.

According to a sixth aspect, an embodiment of the present disclosure provides a computer program product, characterized in that the computer program product includes a computer program stored on a computer-readable storage medium, and the computer program includes program instructions, when the program instructions When executed by a computer, the computer is caused to perform the method of any one of the first aspects.

The data detection method, device and equipment provided by the embodiments of the present disclosure can detect the security of the data to be detected according to the attribute information of the data to be detected and the preset model, because the preset model is obtained by learning the sample data through the neural network The sample data includes marked safety sample data and marked risk sample data. Therefore, according to the preset model, you can accurately verify whether the data to be tested is safe. In the above process, not only save labor costs, but also improve detection efficiency and improve The accuracy of detection.

BRIEF DESCRIPTION

One or more embodiments are exemplified by the corresponding drawings. These exemplary descriptions and the drawings do not constitute a limitation on the embodiments. Elements with the same reference numerals in the drawings are shown as similar elements. The drawings do not constitute a proportional limitation, and among them:

FIG. 1 is an architectural diagram of a data monitoring method provided by an embodiment of the present disclosure;

2 is a schematic flowchart of a data detection method according to an embodiment of the present disclosure;

3 is a schematic flowchart of a method for detecting data to be detected based on attribute information according to an embodiment of the present disclosure;

4 is a schematic flowchart of another data detection method provided by an embodiment of the present disclosure;

5 is a schematic structural diagram of a data detection device according to an embodiment of the present disclosure;

6 is a schematic structural diagram of another data detection device according to an embodiment of the present disclosure;

7 is a schematic structural diagram of an electronic device provided by an embodiment of the present disclosure.

detailed description

In order to understand the features and technical contents of the embodiments of the present disclosure in more detail, the following describes the implementation of the embodiments of the present disclosure in detail with reference to the drawings. The accompanying drawings are for reference only and are not intended to limit the embodiments of the present disclosure. In the following technical description, for convenience of explanation, various details are provided to provide a sufficient understanding of the disclosed embodiments. However, without these details, one or more embodiments can still be implemented. In other cases, to simplify the drawings, well-known structures and devices can be simplified.

In order to facilitate the understanding of this application, first, the scenarios used by the data detection method shown in this application will be exemplified. In the first possible application scenario, when data is sent over the network, the important interface in the network (for example, the network gateway from the internal network to the external network) detects the data passing through the important interface to determine the data Whether it is confidential data. If the data is confidential data, the data is prohibited from being sent through the important interface. In this way, leakage of important data can be avoided. In the second possible application scenario, after receiving the data, before processing the data, you can first verify whether the data is attack data, and when the data is determined to be attack data, discard the data, so that you can avoid being affected. Network attacks. The above describes the application scenarios that can be used in the present application in the form of examples, and is not a limitation of the application scenarios. In the actual application process, the application scenarios can be determined according to actual needs, which is not limited in this application.

FIG. 1 is an architectural diagram of a data monitoring method provided by an embodiment of the present disclosure. Referring to FIG. 1, when the data to be detected is detected, the attribute information of the data to be detected can be obtained first, and whether the data to be detected is safe is verified according to the attribute information of the data to be detected first. When verifying that the data to be tested is risk data (unsafe data) according to the attribute information of the data to be tested, it is determined that the data to be tested is risk data. When verifying that the data to be tested is safe data based on the attribute information of the data to be tested, then the security information of the attribute information of the data to be tested and/or the data to be tested is verified through the preset model, and the data to be tested is verified through the preset model verification If it is risk data, it is determined that the data to be tested is risk data, and after the preset model is verified to detect that the data to be tested is safe data, then the data to be tested is determined to be safe data.

In the embodiment of the present disclosure, the attribute information of the data to be detected is firstly subjected to a rough security verification of the data to be detected. The verification process is simple and convenient. When the data to be detected is determined to be safe data according to the attribute information, the Set the model to verify the security of the data to be tested. Since the preset model is obtained by learning the sample data through the neural network, the sample data includes the marked safety sample data and the marked risk sample data. Therefore, according to the preset model, it can accurately verify whether the data to be tested is safe. In the above process In addition to saving labor costs, it can also improve detection efficiency and accuracy.

The technical solutions shown in the present application will be described in detail below through examples. The following disclosed embodiments may be separate embodiments or may be combined with each other. The same or similar content will not be repeated in different embodiments.

FIG. 2 is a schematic flowchart of a data detection method according to an embodiment of the present disclosure. Please refer to FIG. 2, the method may include:

S201. Acquire attribute information of data to be detected.

The execution subject of the embodiments of the present disclosure may be an electronic device or a data detection device provided in the electronic device. Optionally, the data detection device may be implemented by software or a combination of software and hardware.

Optionally, the electronic device may be user equipment, for example, mobile phones, computers, and other devices. The electronic device may also be a device such as a gateway or a server.

Optionally, the data to be detected may be any data transmitted in the network.

Optionally, the attribute information of the data to be detected includes at least one of the following attributes: the format of the data to be detected, the resources used by the data to be detected, and the frequency of data transmission.

Optionally, the format of the data to be detected may include doc format, PPT format, HTML format, JPG format, and so on.

The format of the data to be detected may also include other, which is not limited in the embodiments of the present disclosure.

Optionally, the resources used by the data to be detected may include network resources, CPU resources, memory resources, and so on. For example, the network resource may be network traffic, network bandwidth, and so on.

Optionally, the data sending frequency may be the frequency of sending data by the device sending the data to be detected.

Optionally, the data sending frequency is the frequency at which the device sending the data to be detected sends data within a preset time period.

Optionally, the frequency of data transmission may be the number of data transmissions per unit time. For example, the unit time may be 1 hour, 1 minute, and so on.

Optionally, the preset time period may be a time period of a preset duration before the current time. For example, the preset duration may be 1 hour, 3 hours, one day, etc. The preset duration can be set according to actual needs.

S202: Detect the security of the data to be detected according to the attribute information of the data to be detected and the preset model.

In the embodiment of the present disclosure, the preset model is obtained by learning the sample data through a neural network.

Alternatively, the neural network may be a deep neural network.

Optionally, the sample data may include marked safety sample data and marked risk sample data.

The marked sample data refers to the sample data determined as safety data. The marked risk sample data refers to the sample data determined as risk data.

Optionally, the security of the data to be detected may be detected according to the attribute information of the data to be detected first. When detecting that the data to be detected is risk data according to the attribute information of the data to be detected, it may be determined that the data to be detected is risk data. When detecting that the data to be detected is safe data according to the attribute information of the data to be detected, security verification may be performed on the attribute information of the data to be detected and/or the data to be detected through a preset model. When detecting that the data to be detected is safe data based on the attribute information of the data to be detected and/or the data to be detected through the preset model, it can be determined that the data to be detected is safe data; /Or when the data to be detected detects that the data to be detected is risk data, it may be determined that the data to be detected is risk data.

Optionally, the security of the data to be detected can be detected based on the attribute information in the following feasible implementation manners:

Obtain the security range corresponding to each attribute in the attribute information; when there is at least one attribute in the attribute information that is outside the security range corresponding to at least one attribute, determine that the data to be detected is risk data; in the attribute information, the attributes are all When it is within the safe range, the data to be tested is determined to be safe data.

Optionally, the security range corresponding to the format of the data to be detected includes at least one preset security format.

For example, the preset security format included in the security range may be preset.

Optionally, the security range corresponding to the resource used by the data to be detected includes a preset resource range.

For example, the preset resource range may include a CPU occupancy range, a memory occupancy range, and a traffic occupancy range.

Optionally, the safety range corresponding to the data transmission frequency includes a preset frequency range.

For example, the preset frequency range includes the maximum frequency and the minimum frequency.

In the embodiment shown in FIG. 3, the process of detecting the security of the data to be detected according to the attribute information is described in detail, and details are not repeated here.

Optionally, the type of the data to be detected may be obtained, and a preset model may be obtained according to the type of the data to be detected; the preset model may be used to perform security verification on the attribute information and/or the data to be detected.

Optionally, the type of data to be detected includes at least one of a text type, an image type, a voice type, or a video type.

Optionally, different data types correspond to different preset models. A preset model corresponding to a data type can perform security verification on the data of the data type.

Optionally, the preset models corresponding to different data types are learned according to the sample data corresponding to the data types.

For example, the preset model corresponding to the text type is obtained by learning based on the sample data of the text type. The text-type sample data includes text-type sample data marked as safety data, and text-type sample data marked as risk data.

For example, the preset model corresponding to the image type is learned based on the sample data of the image type. The sample data of the image type includes sample data marked as safety data of the text type and sample data marked as risk data of the image type.

The data detection method provided by the embodiment of the present disclosure can detect the security of the data to be detected according to the attribute information of the data to be detected and the preset model. Since the preset model is obtained by learning the sample data through the neural network, the sample data includes Marked safety sample data and marked risk sample data, therefore, it can accurately verify whether the data to be tested is safe according to the preset model. In the above process, not only save labor costs, but also improve the detection efficiency and improve the accuracy of detection .

On the basis of any of the above embodiments, the data detection method will be described in detail below through the embodiment shown in FIG. 3.

FIG. 3 is a schematic flowchart of a method for detecting data to be detected according to attribute information according to an embodiment of the present disclosure. Please refer to FIG. 3, the method may include:

S301. Acquire a security range corresponding to each attribute in the attribute information.

When the format of the data to be detected is included in the attribute information, the security range corresponding to the format of the data to be detected is acquired, and the security range corresponding to the format of the data to be detected includes at least one preset security format.

For example, the preset security format may include doc format, HTML format, and so on.

When the attribute information includes the resource used by the data to be detected, the security range corresponding to the resource used by the data to be detected is acquired, and the security range corresponding to the resource used by the data to be detected includes the preset resource range.

For example, when the resources include CPU resources, the preset resource range may include 1%-30% of CPU occupancy.

For example, when the resources include memory resources, the preset resource range may include 1%-50% of memory resource occupancy.

For example, when the resource includes traffic resources, the preset resource range may include traffic resource occupancy: 1M/s-300M/s.

When the attribute information includes the data transmission frequency corresponding to the data to be detected, the safety range corresponding to the data transmission frequency is acquired, and the safety range corresponding to the data transmission frequency includes the preset frequency range.

For example, the preset frequency range can be 1 time/hour-50 times/decimal.

S302. Determine whether each attribute in the attribute information is within a corresponding security range.

If yes, execute S303.

If not, S304 is executed.

S303. Determine that the data to be detected is risk data.

Optionally, in the first possible application scenario shown in the embodiment of the present disclosure, the risk data may be confidential data.

Optionally, in the second possible application scenario shown in the embodiment of the present disclosure, the risk data may be attack data.

S304. Determine that the data to be detected is safety data.

Optionally, in the first possible application scenario shown in the embodiment of the present disclosure, the security data may be non-confidential data.

Optionally, in the second possible application scenario shown in the embodiment of the present disclosure, the security data may be non-attack data.

Optionally, in the embodiment shown in FIG. 3, the risk range corresponding to each attribute may also be set in advance, and it is determined whether each attribute in the attribute information is within the corresponding risk range. When there is an attribute in the attribute information of the data to be detected in the corresponding risk range, it can be determined that the data to be detected is risk data. When all the data information in the attribute information of the data to be detected is not within the corresponding risk range, it can be determined that the data to be detected is safe data.

In the embodiment shown in FIG. 3, the attribute information corresponding to the data to be detected and the security range corresponding to each attribute in the attribute information can quickly determine whether the data to be detected is safe data or risk data.

Based on any one of the above embodiments, the data detection method will be described in detail through the embodiment shown in FIG. 4 below.

4 is a schematic flowchart of another data detection method provided by an embodiment of the present disclosure. Please refer to FIG. 4, the method may include:

S401. Acquire attribute information of data to be detected.

Optionally, the execution process of S401 can refer to the execution process of S201, and no more details are provided here.

S402. Determine whether the data to be detected is safe data according to the attribute information of the data to be detected.

If yes, execute S403.

If not, S407 is executed.

Optionally, for the execution process of S402, refer to the embodiment shown in FIG. 3, and details are not described herein again.

S403. Acquire the type of data to be detected.

The type of data to be detected includes at least one of text type, image type, voice type, or video type.

The type of data to be detected may also include other types, which is not limited in the embodiments of the present disclosure.

S404. Acquire a preset model according to the type of data to be detected.

Optionally, the preset models corresponding to multiple data types can be learned in advance, and the preset models corresponding to multiple data types can be stored. When the preset model is used, the preset model is obtained according to the type of data to be detected.

S405. Perform security verification on the attribute information and/or the data to be detected through a preset model, and determine whether the data to be detected is safe data.

If yes, execute S406.

If not, S407 is executed.

Optionally, when the preset model is learned based on the first sample (attribute information of the detected data), the preset model is used to perform security verification on the attribute information of the detected data to determine whether the data to be tested is Safety data. The attribute sample data includes known security data attributes and known risk data attributes.

Optionally, when the preset model is learned based on the second sample (the detected data), the preset model is used to perform security verification on the detected data to determine whether the data to be detected is safe data. Attribute sample data includes known safety data and known risk data.

Optionally, when the preset model is learned based on the first sample (attribute information of the detected data) and the second sample (detected data), the preset model The attribute information is used for security verification to determine whether the data to be detected is safe data. The attribute sample data includes known safety data, known safety data attribute information, known risk data, and known risk data attribute information.

S406. Determine that the data to be detected is safety data.

S407. Determine that the data to be detected is risk data.

In the embodiment shown in FIG. 4, the attribute information of the data to be detected is firstly subjected to a rough security verification of the data to be detected. The verification process is simple and convenient. Then, the security of the data to be tested is verified through a preset model. Since the preset model is obtained by learning the sample data through the neural network, the sample data includes the marked safety sample data and the marked risk sample data, therefore, according to the preset model, it can accurately verify whether the data to be tested is safe. In the above process In addition to saving labor costs, it can also improve detection efficiency and accuracy.

5 is a schematic structural diagram of a data detection device according to an embodiment of the present disclosure. Referring to FIG. 5, the data detection device 10 may include a detection module 11;

The detection module 11 is configured to detect the security of the data to be detected according to the attribute information of the data to be detected and a preset model, and the preset model is obtained by learning the sample data through a neural network.

The data detection apparatus provided by the embodiments of the present disclosure may execute the technical solutions shown in the foregoing method embodiments. The implementation principles and beneficial effects are similar, and details are not described herein again.

6 is a schematic structural diagram of another data detection device according to an embodiment of the present disclosure. On the basis of the embodiment shown in FIG. 5, the data detection device 10 further includes a first acquisition module 12;

The first acquiring module 12 is configured to acquire attribute information of the data to be detected.

In a possible implementation manner, the detection module 11 is configured to:

In a possible implementation manner, according to claim 1, characterized in that the device further comprises a determination module 13, and the determination module configuration 13 is:

When the detection module 11 detects that the data to be detected is risk data according to the attribute information, it is determined that the data to be detected is risk data.

In a possible implementation manner, the detection module 11 is configured to:

In a possible implementation manner, the data detection device 10 further includes a second acquisition module 14 and a third acquisition module 15,

The second acquiring module 14 is configured to acquire the type of the data to be detected, and the type of the data to be detected includes at least one of a text type, an image type, a voice type, or a video type;

The third obtaining module 15 is configured to obtain the preset model according to the type of the data to be detected;

The detection module configuration 11 is to perform security verification on the attribute information and/or the data to be detected through the preset model.

The data detection apparatus provided by the embodiments of the present disclosure can execute the technical solutions shown in the foregoing method embodiments, and the implementation principles and beneficial effects are similar, and details are not described herein again.

An embodiment of the present disclosure also provides a computer including the above-mentioned data detection device.

An embodiment of the present disclosure also provides a computer-readable storage medium that stores computer-executable instructions that are configured to perform the above-described data detection method.

An embodiment of the present disclosure also provides a computer program product. The computer program product includes a computer program stored on a computer-readable storage medium. The computer program includes program instructions. When the program instructions are executed by a computer, the The computer executes the above data detection method.

The aforementioned computer-readable storage medium may be a transient computer-readable storage medium or a non-transitory computer-readable storage medium.

7 is a schematic structural diagram of an electronic device provided by an embodiment of the present disclosure. Referring to FIG. 7, the electronic device 20 includes:

At least one processor 21, one processor 21 is taken as an example in FIG. 7; and the memory 22 may further include a communication interface 23 and a bus 24. Among them, the processor 21, the communication interface 23, and the memory 22 can communicate with each other through the bus 24. The communication interface 24 can be used for information transmission. The processor 21 may call logic instructions in the memory 22 to execute the data detection method of the above embodiment.

In addition, the logic instructions in the above-mentioned memory 22 may be implemented in the form of software functional units and sold or used as an independent product, and may be stored in a computer-readable storage medium.

The memory 22 is a computer-readable storage medium and can be used to store software programs and computer-executable programs, such as program instructions/modules corresponding to the methods in the embodiments of the present disclosure. The processor 21 executes functional applications and data processing by running software programs, instructions, and modules stored in the memory 22, that is, implementing the data detection method in the foregoing method embodiments.

The memory 22 may include a storage program area and a storage data area, where the storage program area may store an operating system and application programs required for at least one function; the storage data area may store data created according to the use of a terminal device and the like. In addition, the memory 22 may include a high-speed random access memory, and may also include a non-volatile memory.

The technical solutions of the embodiments of the present disclosure may be embodied in the form of software products, which are stored in a storage medium and include one or more instructions to make a computer device (which may be a personal computer, server, or network) Equipment, etc.) to perform all or part of the steps of the method described in the embodiments of the present disclosure. The aforementioned storage medium may be a non-transitory storage medium, including: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), magnetic disk or optical disk, etc. A medium that can store program codes may also be a transient storage medium.

When used in this application, although the terms "first", "second", etc. may be used in this application to describe various elements, these elements should not be limited by these terms. These terms are only used to distinguish one element from another. For example, without changing the meaning of the description, the first element can be called the second element, and likewise, the second element can be called the first element, as long as all occurrences of the "first element" are consistently renamed and all occurrences of The "second component" can be renamed consistently. The first element and the second element are both elements, but they may not be the same element.

The terms used in this application are only used to describe the embodiments and are not used to limit the claims. As used in the description of the embodiments and claims, unless the context clearly indicates otherwise, the singular forms "a", "an" and "said" are intended to include plural forms as well . Similarly, the term "and/or" as used in this application is meant to include any and all possible combinations of one or more associated lists. In addition, when used in this application, the term "comprise" and its variations "comprises" and/or includes etc. refer to the stated features, wholes, steps, operations, elements, and/or The presence of components does not exclude the presence or addition of one or more other features, wholes, steps, operations, elements, components, and/or groups of these.

The various aspects, implementations, implementations or features in the described embodiments can be used alone or in any combination. Various aspects in the described embodiments may be implemented by software, hardware, or a combination of software and hardware. The described embodiments may also be embodied by a computer-readable medium that stores computer-readable code including instructions executable by at least one computing device. The computer-readable medium can be associated with any data storage device capable of storing data, which can be read by a computer system. Computer-readable media used for examples may include read-only memory, random access memory, CD-ROM, HDD, DVD, magnetic tape, optical data storage devices, and the like. The computer-readable medium may also be distributed in computer systems connected through a network, so that computer-readable codes can be stored and executed in a distributed manner.

The above technical description may refer to the accompanying drawings, which form a part of the present application, and the description shows an implementation according to the described embodiments in the drawings. Although these embodiments are described in sufficient detail to enable those skilled in the art to implement these embodiments, these embodiments are non-limiting; so that other embodiments can be used without departing from the scope of the described embodiments Changes can also be made under circumstances. For example, the sequence of operations described in the flowchart is non-limiting, so the sequence of two or more operations explained in the flowchart and described according to the flowchart may be changed according to several embodiments. As another example, in several embodiments, one or more operations illustrated in the flowchart and described in accordance with the flowchart are optional or may be deleted. In addition, certain steps or functions may be added to the disclosed embodiments, or two or more steps may be replaced in sequence. All these changes are considered to be included in the disclosed embodiments and claims.

In addition, terminology is used in the above technical description to provide a thorough understanding of the described embodiments. However, no excessively detailed details are required to implement the described embodiments. Therefore, the above description of the embodiments is presented for explanation and description. The embodiments presented in the above description and the examples disclosed according to these embodiments are provided separately to add context and help to understand the described embodiments. The above description is not intended to be without omission or to limit the described embodiments to the precise form of this disclosure. Based on the above teachings, several modifications, choices and changes are possible. In some cases, well-known processing steps are not described in detail to avoid unnecessarily affecting the described embodiments.

Claims

A data detection method, which includes:

According to the attribute information of the data to be detected and a preset model, the security of the data to be detected is detected, and the preset model is obtained by learning the sample data through a neural network.
The method according to claim 1, wherein the method further comprises:

Obtain the attribute information of the data to be detected.
The method according to claim 1 or 2, wherein

The attribute information of the data to be detected includes at least one of the following attributes: the format of the data to be detected, the resources used by the data to be detected, and the frequency of data transmission.
The method according to claim 3, wherein the data transmission frequency is a frequency at which the device that sends the data to be detected sends data within a preset time period.
The method according to any one of claims 1 to 4, wherein the detecting the security of the data to be detected according to the attribute information of the data to be detected and a preset model includes:

Detecting the security of the data to be detected according to the attribute information;

When detecting that the data to be detected is safety data according to the attribute information, perform security verification on the attribute information and/or the data to be detected through the preset model.
The method according to claim 5, wherein the method further comprises:

When detecting that the data to be detected is risk data according to the attribute information, it is determined that the data to be detected is risk data.
The method according to claim 5, wherein the detecting the security of the data to be detected according to the attribute information comprises:

Obtain the security range corresponding to each attribute in the attribute information;

When there is at least one attribute in the attribute information outside the safety range corresponding to the at least one attribute, it is determined that the data to be detected is risk data;

When the attributes in the attribute information are all within the security range corresponding to the attributes, it is determined that the data to be detected is security data.
The method according to claim 7, wherein the security range corresponding to the format of the data to be detected includes at least one preset security format.
The method according to claim 7, wherein the security range corresponding to the resource used by the data to be detected includes a preset resource range.
The method according to claim 7, wherein the safety range corresponding to the data transmission frequency includes a preset frequency range.
The method according to claim 5, wherein the performing security verification on the attribute information and/or the data to be detected through the preset model includes:

Acquiring the type of the data to be detected, the type of the data to be detected includes at least one of a text type, an image type, a voice type, or a video type;

Acquiring the preset model according to the type of the data to be detected;

Perform security verification on the attribute information and/or the data to be detected through the preset model.
The method according to any one of claims 1-11, wherein the sample data includes marked safety sample data and marked risk sample data.
A data detection device, characterized in that it includes a detection module;

The detection module is configured to detect the security of the data to be detected according to the attribute information of the data to be detected and a preset model, and the preset model is obtained by learning the sample data through a neural network.
The apparatus according to claim 13, wherein the apparatus further comprises a first acquisition module;

The first acquiring module is configured to acquire attribute information of the data to be detected.
The device according to claim 13 or 14, wherein

The attribute information of the data to be detected includes at least one of the following attributes: the format of the data to be detected, the resources used by the data to be detected, and the frequency of data transmission.
The apparatus according to claim 15, wherein the data transmission frequency is a frequency at which a device that transmits the data to be detected transmits data within a preset time period.
The device according to any one of claims 13-16, wherein the detection module is configured to:

Detecting the security of the data to be detected according to the attribute information;

When detecting that the data to be detected is safety data according to the attribute information, perform security verification on the attribute information and/or the data to be detected through the preset model.
The apparatus according to claim 17, wherein the apparatus further comprises a determination module, and the determination module is configured to:

When the detection module detects that the data to be detected is risk data according to the attribute information, it is determined that the data to be detected is risk data.
The apparatus according to claim 17, wherein the detection module is configured to:

Obtain the security range corresponding to each attribute in the attribute information;

When there is at least one attribute in the attribute information outside the safety range corresponding to the at least one attribute, it is determined that the data to be detected is risk data;

When the attributes in the attribute information are all within the security range corresponding to the attributes, it is determined that the data to be detected is security data.
The apparatus according to claim 19, wherein the security range corresponding to the format of the data to be detected includes at least one preset security format.
The apparatus according to claim 19, wherein the security range corresponding to the resource used by the data to be detected includes a preset resource range.
The apparatus according to claim 19, wherein the safety range corresponding to the data transmission frequency includes a preset frequency range.
The apparatus according to claim 17, wherein the apparatus further comprises a second acquisition module and a third acquisition module,

The second acquiring module is configured to acquire the type of the data to be detected, and the type of the data to be detected includes at least one of a text type, an image type, a voice type, or a video type;

The third obtaining module is configured to obtain the preset model according to the type of the data to be detected;

The detection module is configured to perform security verification on the attribute information and/or the data to be detected through the preset model.
The device according to any one of claims 13 to 23, wherein the sample data includes marked safety sample data and marked risk sample data.
A computer, characterized by comprising the device according to any one of claims 13-24.
An electronic device, characterized in that it includes:

At least one processor; and

A memory communicatively connected to the at least one processor; wherein,

The memory stores instructions executable by the at least one processor, and when the instructions are executed by the at least one processor, causes the at least one processor to perform the method of any one of claims 1-12 .
A computer-readable storage medium, characterized in that computer-executable instructions are stored, and the computer-executable instructions are configured to perform the method of any one of claims 1-12.
A computer program product, characterized in that the computer program product includes a computer program stored on a computer-readable storage medium, the computer program includes program instructions, and when the program instructions are executed by a computer, the computer Performing the method of any one of claims 1-12.