Session-level application auditing method and system

Abstract

The invention provides a session-level application auditing method and system. The system comprises an auditing strategy definition module, a session monitoring module, a capturing module, an acquiring module, a performing module and a mapping relation allocation table, wherein the auditing strategy definition module and the session monitoring module are used to a session layer for monitoring the progress of each application running in an operation maintenance server; the capturing module is used for capturing operation behavior data on real time; the performing module is used for acquiring various auditing data; the mapping relation allocation table is used for storing a mapping relation between the storage operation behavior data and the auditing information. The system is arranged at a target server suffering from auditing and used for monitoring the application progress at the session layer of the operation system; the specific session production protocol is irrelevant, no change is performed for the existing network structure, and the maintenance is easily carried out; the operation behavior data, screen video frames, account names, timestamps, and corresponding relation of the application program names can be quickly and conveniently found out without connecting with any third-party account system; in addition, the video frames produced as the operation behavior appears can be displayed, and thus the operation scene of the time can be recovered truly.

Description

technical field [0001] The invention belongs to the technical field of server operation behavior auditing, and in particular relates to a session-level application auditing method and system. Background technique [0002] At present, the IT system of an enterprise is complex, often including a large number of operation and maintenance hosts and a large number of operation and maintenance terminals. Each operation and maintenance terminal sends operation instructions to the operation and maintenance host, and then remotely operates and controls each operation and maintenance host. Therefore, effectively monitoring the operation behavior of each operation and maintenance terminal on the operation and maintenance host is an important means for enterprises to control internal risks. [0003] In the prior art, mainstream fine-grained to operational behavior, non-log event audit products generally adopt a proxy login mode. That is: deploy a proxy host on a certain communication n...

AI Technical Summary

Problems solved by technology

[0010] (1) It is necessary to change the user's existing network structure and deploy additional physical network nodes. However, because the user's network structure varies greatly and the complexity is high, it is difficult to deploy additional physical network nodes and the construction cost is high , in special cases, it is not even possible to deploy physical network nodes; therefore, it has great limitations in use;

[0011] (2) Since the communication messages between the operation and maintenance terminal and the operation and maintenance host need to go through the proxy host, the reliability of the proxy host is extremely high; once the proxy host itself fails, it will directly affect the operation and maintenance

Images