Server access risk monitoring method and device

Abstract

The embodiment of the invention provides a server access risk monitoring method and device which can be used in the technical field of information security, and the method comprises the steps: obtaining a target login data record with a fortress machine bypassing behavior from a current newly-added log combination of a server system provided with a fortress machine according to preset access risk data features, determining application nodes having an association relationship, and extracting newly added access data between every two associated application nodes; clustering newly-added access data between every two associated application nodes in the target login data records to remove misinformation data in the target login data records, and if data records still exist in the target login data records after the misinformation data are removed, determining the data records as server access risk data. According to the invention, the fortress machine bypassing event can be automatically monitored, the detection efficiency and detection comprehensiveness of the fortress machine bypassing event can be improved, and the false alarm rate of fortress machine bypassing event alarm is reduced.

Description

technical field [0001] The present application relates to the technical field of data processing, in particular to the technical field of information security, and in particular to a server access risk monitoring method and device. Background technique [0002] Data centers often have a large number of servers, and how to manage these servers safely and efficiently has become a necessary work for operation and maintenance personnel. The more common solution is to set up one or more bastion host environments as the entrance to the online server. All servers can only be accessed through the bastion host first. At the same time, the bastion host can manage user access rights, which poses a high risk to users. Commands are intercepted and all operation and maintenance operations are recorded. [0003] Due to emergency needs, the network firewall policy of non-bastion host login cannot be banned under normal circumstances, so there may be unauthorized access behaviors bypassing ...

AI Technical Summary

Problems solved by technology

[0003] Due to emergency needs, the network firewall policy of non-bastion host login cannot be banned under normal circumstances, so there may be unauthorized access behaviors bypassing the bastion host, making the security control of the bastion host invalid, and it is difficult to trace and audit user operations. However, there is currently no way to monitor the bypass behavior of the bastion machine for the server system with a bastion machine environment, so the risk of server access is greatly increased, and the security and stability of the server system cannot be guaranteed.

Images