# A Sensitive File Abnormal Access Detection Method Based on Application Classification

Authors: Hui Liu; Hanxing Xue; Hui Lu
Journal: Security and Communication Networks
 (2021)

---

## Abstract

As the access control mode of notepad files cannot meet the requirements of risk control for sensitive file hierarchical access, this paper proposes an application classification-based detection method for abnormal access to sensitive files. The application classification and file classification, access control policy mapping, and basic and preset policy detection are designed. Combining the operating system’s identification control of different applications at runtime, we monitor the abnormal access of sensitive files by hierarchical applications. The cross-access experiment of different levels of application to different sensitive files verified the effectiveness and security of hierarchical access control strategy and sensitive file abnormal access detection and reduced the risk of disclosure of sensitive files.


---

## Body

## 1. Introduction

In recent years, with the development of big data, mobile Internet, cloud computing, and other technologies, network security incidents have occurred frequently, and issues such as system and data security, consistency, integrity, and user access rights have attracted attentions [1–3]. Based on this, the directions of system risk identification, vulnerability scanning, and anomaly detection have become hot topics for researchers [4–8]. Access authority and anomaly detection for mobile terminals are also a branch of research. There are two types of access risks to sensitive files in the notebook of mobile terminals: one is that an unauthorized user (such as malware or been rooted) accesses a file that should not be accessed, and the other is that a user accesses a file with a higher security level than the user. There are several sources of this access risk. Firstly, a high-privileged user or service such as root and MTP has unauthorized access to a file of an application. Secondly, a file that is higher than the user’s security level is entered in the notebook. Thirdly, the access directories of application programs are crossed and shared. Fourthly, files are not classified according to the same security level.Lin et al. proposed a hierarchical access control scheme for shared files based on attribute encryption [9]. Huang et al. proposed a Ciphertext-Policy Attribute-Based Encryption (CP-ABE) access control scheme based on multiple authorization centers in cloud storage [10]. Li et al. proposed a hierarchical access control scheme for encrypted storage of shared files [11]. These methods mainly use encryption to control file access. Wang et al. proposed a cloud computing access control model based on task roles to achieve fine-grained file access control [12]. The abovementioned methods are mainly static protection strategies. The encryption method has a great impact on usability, and the implementation of the system is also very complicated. Fine-grained access control methods must be embedded in the application program to be effective, and external access control strategies cannot be implemented. Song et al. proposed a security level evaluation model under the cloud computing network and determined the storage file security level through evaluation [13]. Hu designed the method and device for document security level identification to identify the security level of files [14]. Zhu proposed a security analysis method for sensitive data of mobile smart terminals [15]. Detection and evaluation methods are used to determine the legal access of sensitive files or data. It can be seen from the above that researchers have explored different solutions to improve information security capabilities [16, 17].In order to control the hierarchical access of sensitive files on mobile terminals further and improve the usability of mobile terminals, a method for detecting abnormal access to sensitive files based on application classification is constructed. Sensitive files are statically detected, and dynamic monitoring is integrated to prevent low-level users from accessing high-security files and prevent unauthorized users from abnormally accessing high-security files.


## 2. The Proposed Abnormal Access Detection Method

### 2.1. Framework of the Detection Method

There is the principle of least privilege for Android applications and data. In Linux, UID is the user’s ID, indicating which user has run the program and is mainly used for permission management, but things are different in the Android system since it is a single-user system that allocates a different UID to almost every application. Unlike traditional Linux, each user is assigned the same UID if they are the same [18].As for file access, Android also follows the basic Linux mechanism. For sensitive files in sensitive industries, we can design a model that only a certain application can access certain sensitive files. Accessing the file through other means, whether root, MTP, or other applications, is considered a risk. Logs and marks can be made in the system, and the risk can be graded.A sensitive file abnormal access detection method based on application classification includes eight modules, such as file access behavior abnormal detection, user security level identification and identification, sensitive file security level identification and identification, file sensitive classification and access control property mapping, and file and directory access control mechanism. The sensitive file abnormal access detection method based on application classification is shown in Figure1.Figure 1
Composition of an abnormal access detection method for sensitive files based on application classification.Sensitive file classification is to mark sensitive files and design the mark of document security level in the document name and document body. The classification process can be identified by the software. Application program classification is to mark and identify the security level of the application program according to the User Identification (UID) of the application program; for example, an application program with a high UID is designed to have a high-security level, and a software can be used to identify the application program identification.In the file access behavior abnormal detection module, static detection of the file security level in the disk can be adopted, and the sensitive file access by the application can be dynamically monitored. By measuring the credibility of the behavior, the malicious level of the application program and the user’s behavior can be judged. The following is the security level mapping, consistency check, and application behavior monitoring in the method.


### 2.2. Hierarchical Control of Sensitive Documents

In the laptop or terminal system, there is a “one-to-one” correspondence between an application and a user, that is, an application corresponds to a user, and the authority of the application is the authority of the user. In the Android system, the UID is used to identify the application. The application inherits the user's authority, thereby giving the application corresponding access authority.


### 2.3. User and File Security Level Matching Relationship Mapping

Three strategies can be used to map the matching relationship between the user and file security levels: benchmark strategy, preset strategy, and monitoring strategy.The benchmark strategy is to set the UID size benchmark for the files corresponding to the security level. Assuming that the security level of the file F isti, the UID of the application program is u, and the benchmark for accessing the file F by the application program is zti (graded according to the file security level), which represents a UID benchmark for accessing the file F. The hierarchical protection strategy adopted for sensitive files can be described as follows:(1)p=1,u≥zti,0,u<zti,where 1 means that it can be accessed and 0 means that it cannot be accessed. Table 1 shows the sensitive file protection strategy scenarios which adopt benchmarks. It can be seen that the u = 68501 can access the file security level t3 (the benchmark is 40000), but it cannot access the file security level t5 (the benchmark is 70,000). Only the application program corresponding to the UID higher than the benchmark can access the corresponding security level file.Table 1
Sensitive file protection strategy scenarios based on benchmark strategy.
Serial numberFiletiApplication UIDuFile access benchmarkztiAccess permissionp1F1 t5685017000002F2 t3685014000013F3 t5139929700001The preset strategy is to preset the access authority and file access of the application. Assuming that the application can access the directorydx,jwhich is a set, where x represents the file security level that the application can access and j represents the directory number that can be accessed. Then, the preset strategy for using sensitive file f (security level ti) is described as follows:(2)d=1,f∈dx,j,x≥i,0,f∈dx,j,x<i.Then,ti, the security level of file F, should be included in this directory. The preset strategy is shown in Table 2.Table 2
Sensitive file protection strategy scenarios based on preset strategy.
Serial numberFiletiApplication UIDuAccessible directoriesdx,jAccess permissiond and containment1F1 t5385820d(3, 7)0, do not include2F2 t3385820d(3, 4)1, include3F3 t5678643d(6, 7)1, includeMonitoring strategy is the method of controlling application access to files based on security strategy in an environment without protection strategy, as shown in Table3. Assuming that the application program uhas a security level of j, and the file F has a security level ti. If u wants to access file F, it must satisfy the condition j≥i, or it is regarded as abnormal access.Table 3
Sensitive file protection strategy scenarios based on monitoring strategy.
Serial numberFiletiApplication UIDuApplication security leveljAccess permission1F1 t5645830402F2 t3645830413F3 t578384981Ifs≥t, user U can open file F. Such a setting requires the user ID to be changed to meet the access requirements.


### 2.4. Consistency Detection and Monitoring of Access Control Behavior

Sensitive file access control consistency detection means to monitor the consistency of application access sensitive files and check whether the application has access to sensitive files corresponding to the security level according to the benchmark strategy, preset strategy, and monitoring strategy.


#### 2.4.1. Static Monitoring Based on Benchmarks and Preset Strategy

Assuming that all filesFx=f1,f2,…,fn,n∈N, on the terminal are the security levelTx=t1,t2,…,tn,n∈N, and the security level benchmark is UBx=ub1,ub2,…,ubn,n∈N. At the same time, suppose that the accessed application identification UID is u, the security level is ut, and the accessible directory is Dx=d1,d2,…,dm,m∈N.(1)
Benchmark strategy consistency static detection method. Based on the principle that the identity of the application is greater than the benchmark identity strategy, i.e.,u≥ubx,ubx∈UBx. We detect the access permission of the application u. If it satisfied the condition u<ubx and the application has the access permission, it is determined that there is a risk of access to the application, and an alarm or warning is raised.(2)
Preset strategy consistency static detection method. According to the principleut≥tx,tx∈Tx and the access strategy that application security level should be higher than that of sensitive files, we detect the access permission of the application u. If it satisfied the condition ut<tx and the file fx is in theDx directory, it is determined that there is an application access risk, and an alarm or warning is raised.


#### 2.4.2. Access Control Dynamic Monitoring

Dynamic monitoring method: at the beginning of the application program accessing the file, according to the access policy that the application program security level is higher than the sensitive file security level, the application programu’s access permission is detected. If ut<tx, it is judged as abnormal access.Analysis of user behavior is the process of credible evaluation of applications by the system. Abnormal user access behavior refers to violations of benchmark strategy, preset strategy, and dynamic strategy. Assuming that, in the interval of timet, the dynamic monitoring method is used to detect or monitor that the number c of abnormal times that the application u accesses the sensitive file is c, and then, the credibility metric is tr=c/t. The larger the value, the less credible it is. When the threshold TR is reached, which means tr>TR, it is determined that the application u is untrustworthy.


#### 2.4.3. Exception Emergency Response

Abnormal emergency response is a measure taken to detect and monitor abnormal behavior. For statically detected abnormalities, the alarm prompts are generally used and delete abnormally sensitive files according to settings. In response to the abnormal access behavior of the application program that is dynamically monitored, measures to close the application program are taken to respond. For untrusted applications or usage behavior, a permanent shutdown strategy can be adopted.


## 2.1. Framework of the Detection Method

There is the principle of least privilege for Android applications and data. In Linux, UID is the user’s ID, indicating which user has run the program and is mainly used for permission management, but things are different in the Android system since it is a single-user system that allocates a different UID to almost every application. Unlike traditional Linux, each user is assigned the same UID if they are the same [18].As for file access, Android also follows the basic Linux mechanism. For sensitive files in sensitive industries, we can design a model that only a certain application can access certain sensitive files. Accessing the file through other means, whether root, MTP, or other applications, is considered a risk. Logs and marks can be made in the system, and the risk can be graded.A sensitive file abnormal access detection method based on application classification includes eight modules, such as file access behavior abnormal detection, user security level identification and identification, sensitive file security level identification and identification, file sensitive classification and access control property mapping, and file and directory access control mechanism. The sensitive file abnormal access detection method based on application classification is shown in Figure1.Figure 1
Composition of an abnormal access detection method for sensitive files based on application classification.Sensitive file classification is to mark sensitive files and design the mark of document security level in the document name and document body. The classification process can be identified by the software. Application program classification is to mark and identify the security level of the application program according to the User Identification (UID) of the application program; for example, an application program with a high UID is designed to have a high-security level, and a software can be used to identify the application program identification.In the file access behavior abnormal detection module, static detection of the file security level in the disk can be adopted, and the sensitive file access by the application can be dynamically monitored. By measuring the credibility of the behavior, the malicious level of the application program and the user’s behavior can be judged. The following is the security level mapping, consistency check, and application behavior monitoring in the method.


## 2.2. Hierarchical Control of Sensitive Documents

In the laptop or terminal system, there is a “one-to-one” correspondence between an application and a user, that is, an application corresponds to a user, and the authority of the application is the authority of the user. In the Android system, the UID is used to identify the application. The application inherits the user's authority, thereby giving the application corresponding access authority.


## 2.3. User and File Security Level Matching Relationship Mapping

Three strategies can be used to map the matching relationship between the user and file security levels: benchmark strategy, preset strategy, and monitoring strategy.The benchmark strategy is to set the UID size benchmark for the files corresponding to the security level. Assuming that the security level of the file F isti, the UID of the application program is u, and the benchmark for accessing the file F by the application program is zti (graded according to the file security level), which represents a UID benchmark for accessing the file F. The hierarchical protection strategy adopted for sensitive files can be described as follows:(1)p=1,u≥zti,0,u<zti,where 1 means that it can be accessed and 0 means that it cannot be accessed. Table 1 shows the sensitive file protection strategy scenarios which adopt benchmarks. It can be seen that the u = 68501 can access the file security level t3 (the benchmark is 40000), but it cannot access the file security level t5 (the benchmark is 70,000). Only the application program corresponding to the UID higher than the benchmark can access the corresponding security level file.Table 1
Sensitive file protection strategy scenarios based on benchmark strategy.
Serial numberFiletiApplication UIDuFile access benchmarkztiAccess permissionp1F1 t5685017000002F2 t3685014000013F3 t5139929700001The preset strategy is to preset the access authority and file access of the application. Assuming that the application can access the directorydx,jwhich is a set, where x represents the file security level that the application can access and j represents the directory number that can be accessed. Then, the preset strategy for using sensitive file f (security level ti) is described as follows:(2)d=1,f∈dx,j,x≥i,0,f∈dx,j,x<i.Then,ti, the security level of file F, should be included in this directory. The preset strategy is shown in Table 2.Table 2
Sensitive file protection strategy scenarios based on preset strategy.
Serial numberFiletiApplication UIDuAccessible directoriesdx,jAccess permissiond and containment1F1 t5385820d(3, 7)0, do not include2F2 t3385820d(3, 4)1, include3F3 t5678643d(6, 7)1, includeMonitoring strategy is the method of controlling application access to files based on security strategy in an environment without protection strategy, as shown in Table3. Assuming that the application program uhas a security level of j, and the file F has a security level ti. If u wants to access file F, it must satisfy the condition j≥i, or it is regarded as abnormal access.Table 3
Sensitive file protection strategy scenarios based on monitoring strategy.
Serial numberFiletiApplication UIDuApplication security leveljAccess permission1F1 t5645830402F2 t3645830413F3 t578384981Ifs≥t, user U can open file F. Such a setting requires the user ID to be changed to meet the access requirements.


## 2.4. Consistency Detection and Monitoring of Access Control Behavior

Sensitive file access control consistency detection means to monitor the consistency of application access sensitive files and check whether the application has access to sensitive files corresponding to the security level according to the benchmark strategy, preset strategy, and monitoring strategy.


### 2.4.1. Static Monitoring Based on Benchmarks and Preset Strategy

Assuming that all filesFx=f1,f2,…,fn,n∈N, on the terminal are the security levelTx=t1,t2,…,tn,n∈N, and the security level benchmark is UBx=ub1,ub2,…,ubn,n∈N. At the same time, suppose that the accessed application identification UID is u, the security level is ut, and the accessible directory is Dx=d1,d2,…,dm,m∈N.(1)
Benchmark strategy consistency static detection method. Based on the principle that the identity of the application is greater than the benchmark identity strategy, i.e.,u≥ubx,ubx∈UBx. We detect the access permission of the application u. If it satisfied the condition u<ubx and the application has the access permission, it is determined that there is a risk of access to the application, and an alarm or warning is raised.(2)
Preset strategy consistency static detection method. According to the principleut≥tx,tx∈Tx and the access strategy that application security level should be higher than that of sensitive files, we detect the access permission of the application u. If it satisfied the condition ut<tx and the file fx is in theDx directory, it is determined that there is an application access risk, and an alarm or warning is raised.


### 2.4.2. Access Control Dynamic Monitoring

Dynamic monitoring method: at the beginning of the application program accessing the file, according to the access policy that the application program security level is higher than the sensitive file security level, the application programu’s access permission is detected. If ut<tx, it is judged as abnormal access.Analysis of user behavior is the process of credible evaluation of applications by the system. Abnormal user access behavior refers to violations of benchmark strategy, preset strategy, and dynamic strategy. Assuming that, in the interval of timet, the dynamic monitoring method is used to detect or monitor that the number c of abnormal times that the application u accesses the sensitive file is c, and then, the credibility metric is tr=c/t. The larger the value, the less credible it is. When the threshold TR is reached, which means tr>TR, it is determined that the application u is untrustworthy.


### 2.4.3. Exception Emergency Response

Abnormal emergency response is a measure taken to detect and monitor abnormal behavior. For statically detected abnormalities, the alarm prompts are generally used and delete abnormally sensitive files according to settings. In response to the abnormal access behavior of the application program that is dynamically monitored, measures to close the application program are taken to respond. For untrusted applications or usage behavior, a permanent shutdown strategy can be adopted.


## 2.4.1. Static Monitoring Based on Benchmarks and Preset Strategy

Assuming that all filesFx=f1,f2,…,fn,n∈N, on the terminal are the security levelTx=t1,t2,…,tn,n∈N, and the security level benchmark is UBx=ub1,ub2,…,ubn,n∈N. At the same time, suppose that the accessed application identification UID is u, the security level is ut, and the accessible directory is Dx=d1,d2,…,dm,m∈N.(1)
Benchmark strategy consistency static detection method. Based on the principle that the identity of the application is greater than the benchmark identity strategy, i.e.,u≥ubx,ubx∈UBx. We detect the access permission of the application u. If it satisfied the condition u<ubx and the application has the access permission, it is determined that there is a risk of access to the application, and an alarm or warning is raised.(2)
Preset strategy consistency static detection method. According to the principleut≥tx,tx∈Tx and the access strategy that application security level should be higher than that of sensitive files, we detect the access permission of the application u. If it satisfied the condition ut<tx and the file fx is in theDx directory, it is determined that there is an application access risk, and an alarm or warning is raised.


## 2.4.2. Access Control Dynamic Monitoring

Dynamic monitoring method: at the beginning of the application program accessing the file, according to the access policy that the application program security level is higher than the sensitive file security level, the application programu’s access permission is detected. If ut<tx, it is judged as abnormal access.Analysis of user behavior is the process of credible evaluation of applications by the system. Abnormal user access behavior refers to violations of benchmark strategy, preset strategy, and dynamic strategy. Assuming that, in the interval of timet, the dynamic monitoring method is used to detect or monitor that the number c of abnormal times that the application u accesses the sensitive file is c, and then, the credibility metric is tr=c/t. The larger the value, the less credible it is. When the threshold TR is reached, which means tr>TR, it is determined that the application u is untrustworthy.


## 2.4.3. Exception Emergency Response

Abnormal emergency response is a measure taken to detect and monitor abnormal behavior. For statically detected abnormalities, the alarm prompts are generally used and delete abnormally sensitive files according to settings. In response to the abnormal access behavior of the application program that is dynamically monitored, measures to close the application program are taken to respond. For untrusted applications or usage behavior, a permanent shutdown strategy can be adopted.


## 3. Effectiveness Analysis of Abnormal Access Detection of Sensitive Files

Take Android as an example to design a sensitive file access tree. Traverse all paths, evaluate the possibility of unauthorized access, and obtain a total score through the evaluation mechanism to verify the effectiveness of hierarchical access control for sensitive files. The test environment is shown in Figure2.Figure 2
The test environment of Android.


### 3.1. Safety Risk Analysis of Lagging Detection

Establish the effectiveness of detection methods for abnormal access to sensitive files. Static detection is to detect all files according to frequency. The feature of detecting and using at the same time will cause the detection of sensitive files to be missed. In a dynamic using environment, it is inevitable to produce file detection omissions. Assuming that the total number of files isw, because detection is a process, changed files or newly entered files may be lagging detection files. Assuming that the lagging detection time is Dc=dc1,dc2,…,dcw,w∈N. The lagging detection time is Dci=dci1,dci2,…,dcv,v∈N, and then, the overall lagging detection safety risk is(3)risk=∑i=1vdcii∑i=1wdci.The experiments are conducted by putting 100 sensitive files to the folds in a notepad randomly. The detection software begins to check these files one by one with no interval in order to reduce the delay. The check goes with a roundtrip time, which is called lag. The lag will grow with more files to be checked. It may cost about 20 ms or more to process a file and depends on the performance of the notepad. The experiment checks 1, 2, …, 17 files every roundtrip time, runs software to put these files in the folds, and finds abnormal access in Table4.Table 4
Experimental data.
Serial numberLagAbnormalAbnormal lag12100235003540046700571006810079500892192910800101110011123001299199131381138141540015164116416143001717200Summary17284493According to Table4, the maximum file number is 17. ∑i=1vdcii=493, and ∑i=1wdci=1728. The overall lagging detection security risk is risk=493/1728=28.5%, which is still a high proportion. So, the hysteresis detection effect caused by static detection cannot be ignored. Therefore, a dynamic monitoring mechanism needs to be introduced.According to the experiments, the lag time grows as the file number grows. Figure3 shows that checking 17 files will cost almost 170 ms. If a sensitive file is an abnormal read in that interval, it will be a big risk.Figure 3
The lag grows with the growth in file number.The abnormal files in a roundtrip time will not grow as the reader open a file may cause more time than the check, but it may cause more risks. The experiments also verify the lag risk, which is shown in Figure4. It shows that the lag risk slightly grows with more files to check. When the experiment has 15 files to check and also finds abnormal access, it causes more risk.Figure 4
The lag risk slightly grows with more files to check.


### 3.2. Analysis of Availability of Dynamic Monitoring and Safety Risk

The dynamic monitoring mechanism is to monitor the consistency of access control when users access files, so the monitoring performance must be higher than the user program's access performance to files; otherwise, the availability of software and privacy of files will be affected. Assuming that the monitoring time istd and the file access creation time istcr, the available reference condition of the monitoring mechanism is expressed as td≤tcr. The risk of privacy leakage is Risk=td/tcr. Table 5 is a case study of monitoring mechanism availability and security risk. It could be seen that the second case has the highest risk because the monitoring speed is faster than the access creation speed. Therefore, the rapid monitoring mechanism can improve the availability of applications and monitor software while reducing the security risks of sensitive data leakage.Table 5
Cases of monitoring mechanism availability and security risk analysis.
Serial numberMonitoring timeAccess creation timeAvailabilityRisk1235810.3965522221801.2222223236310.36507942112810.1640635204610.434783


## 3.1. Safety Risk Analysis of Lagging Detection

Establish the effectiveness of detection methods for abnormal access to sensitive files. Static detection is to detect all files according to frequency. The feature of detecting and using at the same time will cause the detection of sensitive files to be missed. In a dynamic using environment, it is inevitable to produce file detection omissions. Assuming that the total number of files isw, because detection is a process, changed files or newly entered files may be lagging detection files. Assuming that the lagging detection time is Dc=dc1,dc2,…,dcw,w∈N. The lagging detection time is Dci=dci1,dci2,…,dcv,v∈N, and then, the overall lagging detection safety risk is(3)risk=∑i=1vdcii∑i=1wdci.The experiments are conducted by putting 100 sensitive files to the folds in a notepad randomly. The detection software begins to check these files one by one with no interval in order to reduce the delay. The check goes with a roundtrip time, which is called lag. The lag will grow with more files to be checked. It may cost about 20 ms or more to process a file and depends on the performance of the notepad. The experiment checks 1, 2, …, 17 files every roundtrip time, runs software to put these files in the folds, and finds abnormal access in Table4.Table 4
Experimental data.
Serial numberLagAbnormalAbnormal lag12100235003540046700571006810079500892192910800101110011123001299199131381138141540015164116416143001717200Summary17284493According to Table4, the maximum file number is 17. ∑i=1vdcii=493, and ∑i=1wdci=1728. The overall lagging detection security risk is risk=493/1728=28.5%, which is still a high proportion. So, the hysteresis detection effect caused by static detection cannot be ignored. Therefore, a dynamic monitoring mechanism needs to be introduced.According to the experiments, the lag time grows as the file number grows. Figure3 shows that checking 17 files will cost almost 170 ms. If a sensitive file is an abnormal read in that interval, it will be a big risk.Figure 3
The lag grows with the growth in file number.The abnormal files in a roundtrip time will not grow as the reader open a file may cause more time than the check, but it may cause more risks. The experiments also verify the lag risk, which is shown in Figure4. It shows that the lag risk slightly grows with more files to check. When the experiment has 15 files to check and also finds abnormal access, it causes more risk.Figure 4
The lag risk slightly grows with more files to check.


## 3.2. Analysis of Availability of Dynamic Monitoring and Safety Risk

The dynamic monitoring mechanism is to monitor the consistency of access control when users access files, so the monitoring performance must be higher than the user program's access performance to files; otherwise, the availability of software and privacy of files will be affected. Assuming that the monitoring time istd and the file access creation time istcr, the available reference condition of the monitoring mechanism is expressed as td≤tcr. The risk of privacy leakage is Risk=td/tcr. Table 5 is a case study of monitoring mechanism availability and security risk. It could be seen that the second case has the highest risk because the monitoring speed is faster than the access creation speed. Therefore, the rapid monitoring mechanism can improve the availability of applications and monitor software while reducing the security risks of sensitive data leakage.Table 5
Cases of monitoring mechanism availability and security risk analysis.
Serial numberMonitoring timeAccess creation timeAvailabilityRisk1235810.3965522221801.2222223236310.36507942112810.1640635204610.434783


## 4. Conclusion

A sensitive file abnormal access detection method based on application classification includes application classification and sensitive file classification, application permission control, security control strategy of sensitive file classification, abnormal access detection of sensitive file classification, consistency evaluation, and validity evaluation of sensitive file classification detection. The abnormal access detection of sensitive files is realized through the cross and combination access test between the permission control of notepad and its operating system, hierarchical application, differentiated sensitive files, and the matching control between hierarchical control and application. Through the dynamic monitoring of sensitive documents, the security control availability and safety evaluation of sensitive documents are realized, and the effectiveness of the method is verified through the test and evaluation of important indicators.



---

*Source: 6684456-2021-03-15.xml*