Terminal infection virus processing method and system

Abstract

The invention relates to a terminal infection virus processing method and system, and the method comprises the steps: obtaining an alarm information data set which comprises a plurality of pieces of terminal alarm information from different network security devices, and the alarm information comprises a source IP, a target IP, a source port, a target port, a transmission protocol, a target domain name, a file name and a file hash value; matching the target terminal alarm information with a threat intelligence library, and if the threat intelligence library is matched, linking an asset management system and an identity authentication system to determine a terminal affiliation unit and a terminal user; generating a virus analysis report and disposal opinions based on a source IP, a destination IP, a source port, a destination port, a transmission protocol, a file name, a file hash value and matched virus information in the threat intelligence library in the target terminal alarm information; and sending the generated virus infection event work order, the virus analysis report and the disposal opinion to security operation and maintenance personnel of a unit to which the target terminal belongs and terminal users so as to carry out virus disposal on the target terminal.

Description

Technical Field

[0001] The present disclosure relates to the field of computer technology, and more particularly to a method and system for processing terminal virus infection. Background Art

[0002] With the rapid global transformation of digital technology, the application of innovative technologies such as cloud computing, big data, the Internet of Things, and mobile internet is accelerating. The traditional network perimeters of an organization, such as an enterprise, are being broken down, and various types of terminal devices have become the new security perimeter. Furthermore, the emergence of numerous cybersecurity threats such as ransomware, backdoor Trojans, botnets, and mining viruses is posing an increasingly severe challenge to terminal security.

[0003] Among the many network security threats, endpoint security is particularly vulnerable to virus infection. Terminals can be infected through various means, including infected external devices, visiting malicious or unknown websites, downloading and installing unauthorized software, and exploiting system vulnerabilities. Terminal security not only protects individual users' privacy and sensitive data but is also a crucial component of ensuring network and information security for businesses and organizations. Therefore, it is crucial to conduct prompt analysis and rapid response upon the discovery of a terminal infection. Unfortunately, however, traditional network security protection systems currently lack the ability to quickly and accurately analyze and address terminal infection, resulting in inefficient response and disposal. Summary of the Invention

[0004] In order to solve the above technical problems or at least partially solve the above technical problems, the embodiments of the present disclosure provide a method and system for processing terminal virus infection.

[0005] In a first aspect, an embodiment of the present disclosure provides a method for processing a terminal infected with a virus, comprising:

[0006] Obtain an alarm information data set, the alarm information data set including multiple terminal alarm information from different network security devices, each terminal alarm information including at least a source IP address, a destination IP address, a source port, a destination port, a transmission protocol, a destination domain name, a file name, and a file hash value;

[0007] Matching the target terminal alarm information with the threat intelligence library; if at least one of the source IP, destination IP, source port, destination port, transport protocol, destination domain name, file name, and file hash value in the target terminal alarm information matches the threat intelligence library, linking the asset management system and identity authentication system to determine the terminal's affiliated unit and terminal user information; the target terminal alarm information is any one of the multiple terminal alarm information;

[0008] Generate a virus analysis report and disposal opinions based on the source IP, destination IP, source port, destination port, transmission protocol, file name, file hash value in the target terminal alarm information and the matching virus information in the threat intelligence library;

[0009] A virus infection event work order for the target terminal is generated based on the terminal's unit and terminal user information, and the virus infection event work order, the virus analysis report, and disposal opinions are sent to the security operation and maintenance personnel of the unit to which the target terminal belongs and the terminal user for virus disposal of the target terminal.

[0010] In one embodiment, before obtaining the alarm information data set, the original terminal alarm data information of different network security devices is collected in real time through system logs, and the original terminal alarm data information is preprocessed to obtain the alarm information data set; wherein the preprocessing includes removing repeated alarm data within a preset time length, alarm data noise reduction processing, and converting the alarm data into a unified format.

[0011] In one embodiment, the method further comprises:

[0012] Call a unified interface and pass in preset parameters to enable different network security devices to automatically block the IP address of the target terminal based on the preset parameters. The unified interface is pre-customized based on the response interfaces and operation commands of different network security devices.

[0013] In one embodiment, the method further comprises:

[0014] Receive feedback from security operations personnel after they handle virus attacks on target terminals;

[0015] In response to receiving the feedback information, the unified interface is called and another preset parameter is passed in, so as to enable different network security devices to automatically perform an unblocking operation on the IP of the target terminal based on the another preset parameter.

[0016] In one embodiment, the method further comprises:

[0017] After receiving the feedback information, obtaining the network information and file information of the target terminal within a specified time period;

[0018] Based on the analysis of the network information and file information, it is determined whether the target terminal is infected with the virus again. If so, a notification message is sent to instruct the security operation and maintenance personnel to further deal with the infected virus; otherwise, the virus infection event work order is closed.

[0019] In one embodiment, the specified duration comprises at least two hours.

[0020] In one embodiment, the different network security devices include at least two of an IP protocol cipher, a security router, a line cipher, a firewall, an anti-virus software system, a network / system scanning system, an intrusion detection system, and a network security early warning and auditing system.

[0021] In a second aspect, an embodiment of the present disclosure provides a terminal virus infection processing system, comprising:

[0022] An information acquisition module is used to obtain an alarm information data set, wherein the alarm information data set includes multiple terminal alarm information from different network security devices, and each terminal alarm information includes at least the source IP address, destination IP address, source port, destination port, transmission protocol, destination domain name, file name, and file hash value;

[0023] A matching linkage module is used to match the target terminal alarm information with the threat intelligence library. If at least one of the source IP, destination IP, source port, destination port, transmission protocol, destination domain name, file name, and file hash value in the target terminal alarm information matches the threat intelligence library, the asset management system and the identity authentication system are linked to determine the terminal's affiliated unit and terminal user information; the target terminal alarm information is any one of the multiple terminal alarm information;

[0024] An information generation module is used to generate a virus analysis report and disposal opinions based on the source IP, destination IP, source port, destination port, transmission protocol, file name, file hash value in the target terminal alarm information and the matching virus information in the threat intelligence library;

[0025] The virus handling module is used to generate a virus infection event work order for the target terminal based on the terminal's affiliated unit and terminal user information, and send the virus infection event work order, the virus analysis report and disposal opinions to the security operation and maintenance personnel of the target terminal's affiliated unit and the terminal user to handle the virus of the target terminal.

[0026] In a third aspect, an embodiment of the present disclosure provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the terminal virus infection processing method described in any of the above embodiments.

[0027] In a fourth aspect, an embodiment of the present disclosure provides an electronic device, including:

[0028] processor; and

[0029] memory for storing computer programs;

[0030] The processor is configured to execute the terminal virus infection processing method described in any of the above embodiments by executing the computer program.

[0031] The technical solution provided by the embodiments of the present disclosure has the following advantages over the prior art:

[0032] The terminal virus infection processing method and system provided by the embodiment of the present disclosure obtains an alarm information data set, wherein the alarm information data set includes multiple terminal alarm information from different network security devices, and each terminal alarm information includes at least source IP, destination IP, source port, destination port, transmission protocol, destination domain name, file name and file hash value; matches the target terminal alarm information with the threat intelligence library, and if at least one of the source IP, destination IP, source port, destination port, transmission protocol, destination domain name, file name and file hash value in the target terminal alarm information matches the threat intelligence library, then the asset management system and the identity authentication system are linked to confirm The target terminal's affiliated unit and terminal user information are determined; the target terminal alarm information is any one of the multiple terminal alarm information; a virus analysis report and disposal opinions are generated based on the source IP, destination IP, source port, destination port, transmission protocol, file name, file hash value in the target terminal alarm information and the matched virus information in the threat intelligence library; a virus infection event work order for the target terminal is generated based on the terminal's affiliated unit and terminal user information, and the virus infection event work order, the virus analysis report and disposal opinions are sent to the security operation and maintenance personnel of the unit to which the target terminal belongs and the terminal user for target terminal virus disposal. In this embodiment, the alarm information after the terminal is infected with the virus is automatically matched and collided with the threat intelligence library to obtain a virus analysis report, and the asset management system and user authentication system of the enterprise or organization are linked to complete the asset location of the virus-infected terminal, generate an event work order, and accurately push the work order to the security operation and maintenance personnel and terminal user personnel of the relevant specific unit for timely completion of disposal. Therefore, after the terminal is infected with the virus, the asset location of the terminal, the specific virus information infected, and the disposal opinions can be quickly and accurately analyzed and judged, thereby improving the response and disposal efficiency of the terminal virus. BRIEF DESCRIPTION OF THE DRAWINGS

[0033] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present disclosure and, together with the description, serve to explain the principles of the present disclosure.

[0034] In order to more clearly illustrate the embodiments of the present disclosure or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, for ordinary technicians in this field, other drawings can be obtained based on these drawings without any creative work.

[0035] Figure 1 This is a flow chart of a method for handling terminal virus infection according to an embodiment of the present disclosure;

[0036] Figure 2 A flowchart of matching a terminal infected with a virus with a threat intelligence library according to an embodiment of the present disclosure;

[0037] Figure 3 This is a schematic diagram of a terminal virus infection processing system according to an embodiment of the present disclosure;

[0038] Figure 4 Schematic diagram of an electronic device according to an embodiment of the present disclosure. DETAILED DESCRIPTION

[0039] In order to more clearly understand the above-mentioned objectives, features and advantages of the present disclosure, the scheme of the present disclosure will be further described below. It should be noted that the embodiments of the present disclosure and the features therein can be combined with each other in the absence of conflict.

[0040] In the following description, many specific details are set forth to facilitate a full understanding of the present disclosure, but the present disclosure may also be implemented in other ways different from those described herein; it is obvious that the embodiments in the specification are only part of the embodiments of the present disclosure, rather than all of the embodiments.

[0041] It should be understood that, in the following text, "at least one (item)" refers to one or more, and "plurality" refers to two or more. "And / or" is used to describe the association relationship of associated objects, indicating that three relationships may exist. For example, "A and / or B" can mean: only A exists, only B exists, and A and B exist at the same time, where A and B can be singular or plural. The character " / " generally indicates that the previous and next associated objects are in an "or" relationship. "At least one of the following items" or similar expressions refers to any combination of these items, including any combination of single items or plural items. For example, at least one of a, b or c can mean: a, b, c, "a and b", "a and c", "b and c", or "a and b and c", where a, b, c can be single or multiple.

[0042] In the related technologies, the existing methods for handling terminal virus infection are mostly to manually analyze and judge the scattered alarm information of network security equipment, query the source IP of the alarm information in the asset management and user authentication systems, complete asset positioning and investigation and evidence collection, and then manually ban the source IP in the network security equipment, and notify the security operation and maintenance personnel at each level to handle the terminal. The alarm information only provides simple information such as the source IP and virus behavior. This leads to problems such as security monitoring personnel having to spend a lot of time on the analysis and judgment of the alarm information, which is inefficient and the accuracy of the analysis results is low. In short, after the terminal is infected with the virus, it is impossible to quickly and accurately analyze and judge it, and the response and disposal efficiency is low.

[0043] Figure 1The following is a flowchart of a terminal virus infection processing method according to an embodiment of the present disclosure, which can be applied to computing devices such as computers. The terminal virus infection processing method may include the following steps:

[0044] Step S101: Acquire an alarm information data set, which includes multiple terminal alarm information from different network security devices, each terminal alarm information includes at least source IP, destination IP, source port, destination port, transmission protocol, destination domain name, file name and file hash value.

[0045] For example, in one embodiment, the various network security devices may include, but are not limited to, at least two of an IP protocol cipher, a security router, a line cipher, a firewall, an antivirus software system, a network / system scanning system, an intrusion detection system, and a network security early warning and auditing system. These network security devices may be deployed at different locations within an enterprise network system. Terminals may be various computing devices connected to the enterprise network system, primarily including but not limited to laptops, desktops, tablets, smartphones, and new IoT terminal devices. A computer virus is a set of computer instructions or program codes inserted by the programmer into a computer program to disrupt computer functions or data, affecting the normal use of the computer and capable of replication. These viruses can be categorized as network viruses, file viruses, and boot viruses. When a terminal is infected by a virus, the corresponding network security device may generate terminal alert information, such as the terminal's source IP address, destination IP address, source port, destination port, transmission protocol (e.g., protocol number), destination domain name, file name (e.g., alert file name), and file hash value (e.g., alert file name), where the file name identifies the file infected by the virus.

[0046] Step S102: Match the target terminal alarm information with the threat intelligence database. If at least one of the source IP address, destination IP address, source port number, destination port number, transport protocol, destination domain name, file name, and file hash value in the target terminal alarm information matches the threat intelligence database, the asset management system and identity authentication system are linked to determine the terminal's affiliated unit and terminal user information. The target terminal alarm information is any one of the multiple terminal alarm information.

[0047] For example, a threat intelligence library can be one provided by major security vendors. It collects data from multiple sources, such as open-source intelligence, malware analysis, and network traffic analysis, and intelligently analyzes and integrates it to provide real-time, accurate, and comprehensive threat intelligence information. The source IP address, destination IP address, source port number, destination port number, and transport protocol, such as the protocol number, constitute the network communication quintuple. A hash value is a set of binary values ​​obtained by performing cryptographic operations on file contents. It is primarily used for file verification or signing.

[0048] For each terminal alarm information in the acquired alarm information dataset, match any target terminal alarm information with the threat intelligence library, refer to Figure 2 As shown in , if at least one of the source IP, destination IP, source port, destination port, transmission protocol, destination domain name, file name, and file hash value in the target terminal alarm information matches the threat intelligence library, the asset management system and identity authentication system are linked to determine the terminal's affiliated unit and the terminal user information.

[0049] For example, the asset management system and identity authentication system are pre-established information systems within an enterprise or organization. The asset management system is used to manage various assets, such as terminals, servers, and network security devices, while the identity authentication system is used to manage the identities of the enterprise or organization's personnel, such as access control. In this embodiment, when a match is found in the threat intelligence database, the asset management system and identity authentication system can be used to query the target terminal's source and destination IP addresses for the corresponding asset, i.e., the name of the unit to which the target terminal belongs, and user information, such as name and employee ID, to obtain an asset location result.

[0050] Step S103: Generate a virus analysis report and disposal opinions based on the source IP, destination IP, source port, destination port, transmission protocol, file name, file hash value in the target terminal alarm information and the matching virus information in the threat intelligence library.

[0051] Exemplarily, a virus analysis report and disposal opinions are generated based on the communication quintuple related to the target terminal, the file name and file hash value of the virus-infected file, and the matching virus information in the threat intelligence library, such as the virus name and feature information.

[0052] Step S104: Generate a virus infection event worksheet for the target terminal based on the terminal's affiliated unit and terminal user information, and send the virus infection event worksheet, the virus analysis report, and disposal opinions to the security operation and maintenance personnel of the target terminal's affiliated unit and the terminal user for target terminal virus disposal.

[0053] For example, after a virus infection incident work order is generated, the virus infection incident work order, along with the virus analysis report and disposal suggestions, is sent to the security operations and maintenance personnel of the unit to which the target terminal belongs and the terminal user for virus disposal on the target terminal. For example, after sending the work order to the operations and maintenance terminal used by the security operations and maintenance personnel and the target terminal, a prompt message is displayed to prompt the security operations and maintenance personnel and the terminal user to dispose of the virus on the target terminal, such as performing virus detection and removal operations. In some embodiments, after a virus infection incident work order is generated, monitoring personnel can further determine whether to dispose of the target terminal based on the virus analysis report.

[0054] In this embodiment, by linking with the asset management system and the user identity authentication system, the terminal's unit and terminal user can be accurately located, and asset positioning is efficient and accurate. Virus event work orders are pushed to security operation and maintenance personnel and terminal users to quickly carry out emergency response after the terminal is infected with the virus. Emergency response is convenient, fast, and efficient.

[0055] This embodiment automatically matches and collides the alarm information after the terminal is infected with a virus with the threat intelligence library to obtain a virus analysis report, and links the asset management system and user authentication system of the enterprise or organization to quickly and accurately locate the assets of the terminal infected with the virus, form an event work order, and accurately push the work order to the security operation and maintenance personnel and terminal users of the relevant specific units to complete the disposal in a timely manner. In this way, after the terminal is infected with a virus, the terminal's asset location, specific virus information infected, and disposal opinions can be quickly and accurately analyzed and judged, thereby improving the response and disposal efficiency of terminal viruses.

[0056] It should be noted that in the existing technology, the original alarm information of the above-mentioned multiple network security devices does not have a unified format and content specification, and there are a large number of false alarms. The response interfaces and operation steps of each network security device are different, resulting in the inability to form accurate linkage with the asset management system and user authentication system, which in turn affects the accurate positioning of the virus-infected terminal and the efficiency of virus response and disposal.

[0057] Therefore, based on the above embodiments, in one embodiment, before obtaining the alarm information data set, the original terminal alarm data information of different network security devices is collected in real time through the system log, and the original terminal alarm data information is preprocessed to obtain the alarm information data set; wherein the preprocessing includes removing repeated alarm data within a preset time length, denoising the alarm data, and converting the alarm data into a unified format.

[0058] For example, Syslog system log or system record, on the operating system, syslog log messages can be recorded in local files or sent to a server receiving syslog through the network. The server receiving syslog can uniformly manage and store log records from different types of operating systems of many different network security devices, or parse the content and perform corresponding processing.

[0059] In this embodiment, the alarm information of network security devices scattered in different locations is collected in real time through syslog. After process-based processing, an initial alarm information data set with a unified content format is obtained. Then, data noise reduction processing is performed to remove repeated alarm data within 1 minute, and the alarm information data set is finally obtained for collision matching with the threat intelligence library.

[0060] Among them, data denoising is to remove or reduce interfering data from the data set, including random errors in measurement variables, outliers or other data that inaccurately describe the scene, improve the quality and accuracy of the data, and make the final data analysis results more reliable.

[0061] Existing methods for handling terminal virus infections require security monitoring personnel to spend a significant amount of time analyzing and assessing alerts, as each network security device generates alerts in a different format and produces numerous false positives. This embodiment, however, processes alerts from distributed network security devices according to a unified format and content specification, performs data noise reduction, and generates accurate and timely alerts. This alert is then matched against an attack threat intelligence database to determine whether the alert represents a true terminal virus infection. The matching results are then compiled into a virus analysis report, enabling rapid and effective analysis and assessment of terminal virus infections, enabling accurate location of infected terminals and improving virus response efficiency.

[0062] In the existing technology, different network security devices have different response interfaces and operation commands, resulting in insufficient linkage depth. After the terminal is infected with a virus, it is complicated and time-consuming to block and restrict the alarm IP.

[0063] Therefore, in one embodiment, the method further includes: calling a unified interface and passing in preset parameters to enable different network security devices to automatically perform a blocking operation on the IP of the target terminal based on the preset parameters; wherein the unified interface is pre-templated and customized based on the response interfaces and operation commands of different network security devices.

[0064] In this embodiment, in order to solve the problem that the response interfaces and operation commands of different network security devices are different, which leads to complex and time-consuming operations for blocking and restricting the alarm IP after the terminal is infected with a virus, different network security device IP blocking and unblocking templates can be configured in advance, and a unified response interface can be customized and developed to support calling the interface to achieve one-click blocking and unblocking on the network.

[0065] Specifically, the operation commands and response interfaces of different network security devices can be customized and developed in advance according to the needs, such as template customization of unified interfaces, configuration of blocking scripts, and passing in preset parameters such as blocking operation parameters to complete the unified operation of IP blocking of virus-infected terminals by different network security devices by calling the same unified interface once. In this way, the disposal can be completed quickly and the operational efficiency can be improved.

[0066] In one embodiment, the method further includes: receiving feedback information sent by security operation and maintenance personnel after performing virus disposal on the target terminal; in response to receiving the feedback information, calling the unified interface and passing in another preset parameter to enable different network security devices to automatically perform an unblocking operation on the IP of the target terminal based on the other preset parameter.

[0067] In this embodiment, by passing in preset parameters such as the unbanning operation parameters and calling the same unified interface once, different network security devices can complete the unified operation of unbanning the IP of the virus-infected terminal, so that the disposal can be completed quickly and the operation efficiency is improved.

[0068] The existing technology also does not conduct full life cycle management of terminal virus infection events, resulting in a lack of accurate and efficient means to verify the effectiveness of the treatment measures after the virus-infected terminals are treated.

[0069] Therefore, in one embodiment, the method further includes: after receiving the feedback information, obtaining network information and file information of the target terminal within a specified period; analyzing the network information and file information to determine whether the target terminal is infected with a virus again, and if so, sending a notification message instructing security operations personnel to further address the infected virus; if not, closing the virus infection incident work ticket. In one embodiment, the specified period is at least two hours.

[0070] In this embodiment, generated work tickets for terminal virus infection incidents are directly pushed to the security operations and maintenance personnel of the terminal's organization and the terminal user, avoiding delayed responses caused by multiple layers of communication. After the work ticket for the terminal virus infection incident receives feedback that the incident has been resolved, it can continuously collect terminal network and file information for, for example, two hours. Based on this network and file information, it can accurately analyze and determine whether the target terminal has been infected with the virus again, thereby accurately verifying the effectiveness of the terminal resolution measures. This allows for full lifecycle management of terminal virus infection incidents, completes the closed-loop management of the entire process of terminal virus infection incident work tickets, and ensures timely response and effective resolution of terminal virus infections.

[0071] That is to say, in this embodiment, the entire process of handling terminal virus infection incidents can be tracked to ensure that measures are timely and effective. After monitoring the terminal infection with a virus, an event ticket is automatically generated and pushed to security operation and maintenance personnel and terminal users. After the event ticket is responded to, terminal-related information is continuously tracked to verify the effectiveness of the terminal handling measures.

[0072] The above-mentioned solution of the embodiment of the present disclosure integrates the alarm information and threat intelligence library information of network security equipment of different manufacturers, links the user identity authentication system and asset management system, connects the capabilities of various network security devices, and builds a centralized and integrated "discovery-response-handling-retesting" processing system, so as to accurately, promptly and efficiently analyze, respond to and protect terminal virus infection incidents, and ensure the network and information security of enterprises and organizations.

[0073] It should be noted that although the steps of the method disclosed herein are depicted in a particular order in the accompanying drawings, this does not require or imply that the steps must be performed in that particular order, or that all steps must be performed to achieve the desired result. Additionally or alternatively, certain steps may be omitted, multiple steps may be combined into a single step, and / or a single step may be decomposed into multiple steps. Furthermore, it is readily understood that these steps may be executed synchronously or asynchronously, for example, in multiple modules / processes / threads.

[0074] like Figure 3 As shown, the embodiment of the present disclosure provides a terminal virus infection processing system, including:

[0075] An information acquisition module 401 is configured to acquire an alarm information dataset, wherein the alarm information dataset includes multiple terminal alarm information from different network security devices, each terminal alarm information including at least the source IP address, destination IP address, source port, destination port, transport protocol, destination domain name, file name, and file hash value;

[0076] Matching and linkage module 402 is used to match the target terminal alarm information with the threat intelligence library. If at least one of the source IP address, destination IP address, source port number, destination port number, transport protocol, destination domain name, file name, and file hash value in the target terminal alarm information matches the threat intelligence library, then linkage is performed with the asset management system and identity authentication system to determine the terminal's affiliated unit and terminal user information; the target terminal alarm information is any one of the multiple terminal alarm information.

[0077] Information generation module 403, used to generate a virus analysis report and disposal suggestions based on the source IP, destination IP, source port, destination port, transmission protocol, file name, file hash value in the target terminal alarm information and the matching virus information in the threat intelligence library;

[0078] The virus handling module 404 is used to generate a virus infection event work order for the target terminal based on the terminal's affiliated unit and terminal user information, and send the virus infection event work order, the virus analysis report and disposal opinions to the security operation and maintenance personnel of the target terminal's affiliated unit and the terminal user to handle the virus of the target terminal.

[0079] In one embodiment, the system may also include a preprocessing module, which is used to collect original terminal alarm data information of different network security devices in real time through system logs before the information acquisition module obtains the alarm information data set, and preprocess the original terminal alarm data information to obtain the alarm information data set; wherein the preprocessing includes removing repeated alarm data within a preset time period, denoising the alarm data, and converting the alarm data into a unified format.

[0080] In one embodiment, the system may further include a blocking module for:

[0081] Call a unified interface and pass in preset parameters to enable different network security devices to automatically block the IP address of the target terminal based on the preset parameters. The unified interface is pre-customized based on the response interfaces and operation commands of different network security devices.

[0082] In one embodiment, the system further includes a banning module for:

[0083] Receive feedback from security operations personnel after they handle virus attacks on target terminals;

[0084] In response to receiving the feedback information, the unified interface is called and another preset parameter is passed in, so as to enable different network security devices to automatically perform an unblocking operation on the IP of the target terminal based on the another preset parameter.

[0085] In one embodiment, the virus processing module may further be used to:

[0086] After receiving the feedback information, obtaining the network information and file information of the target terminal within a specified time period;

[0087] Based on the analysis of the network information and file information, it is determined whether the target terminal is infected with the virus again. If so, a notification message is sent to instruct the security operation and maintenance personnel to further deal with the infected virus; otherwise, the virus infection event work order is closed.

[0088] In one embodiment, the specified duration comprises at least two hours.

[0089] In one embodiment, the different network security devices include at least two of an IP protocol cipher, a security router, a line cipher, a firewall, an anti-virus software system, a network / system scanning system, an intrusion detection system, and a network security early warning and auditing system.

[0090] Regarding the system in the above embodiment, the specific manner in which each module performs operations and the corresponding technical effects brought about have been described in detail in the embodiment of the method, and will not be elaborated here.

[0091] It should be noted that although several modules or units of the device for action execution are mentioned in the above detailed description, this division is not mandatory. In fact, according to the embodiment of the present disclosure, the features and functions of two or more modules or units described above can be concretized in one module or unit. Conversely, the features and functions of one module or unit described above can be further divided into multiple modules or units for concretization. The components displayed as modules or units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules can be selected according to actual needs to achieve the purpose of the disclosed solution. Those of ordinary skill in the art can understand and implement it without paying any creative work.

[0092] The embodiments of the present disclosure further provide a computer-readable storage medium having a computer program stored thereon. When the computer program is executed by a processor, the terminal virus infection processing method according to any of the above embodiments is implemented.

[0093] Exemplarily, the readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device, or device, or any combination thereof. More specific examples of readable storage media (a non-exhaustive list) include: an electrical connection having one or more wires, a portable disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination thereof.

[0094] The computer-readable storage medium may include a data signal propagated in baseband or as part of a carrier wave, wherein the readable program code is carried. The data signal propagated may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. The readable storage medium may also be any readable medium other than a readable storage medium, which may send, propagate, or transmit a program for use by or in conjunction with an instruction execution system, device, or component. The program code contained on the readable storage medium may be transmitted using any suitable medium, including but not limited to wireless, wired, optical cable, RF, etc., or any suitable combination thereof.

[0095] The present disclosure also provides an electronic device comprising a processor and a memory for storing a computer program, wherein the processor is configured to execute the computer program to perform the terminal virus infection processing method of any of the above embodiments.

[0096] Refer to the following Figure 4 An electronic device 600 according to this embodiment of the present invention will be described. Figure 4 The electronic device 600 shown is merely an example and should not limit the functions and scope of use of the embodiments of the present invention.

[0097] like Figure 4 As shown, electronic device 600 is implemented as a general-purpose computing device. Components of electronic device 600 may include, but are not limited to, at least one processing unit 610, at least one storage unit 620, a bus 630 connecting various system components (including storage unit 620 and processing unit 610), a display unit 640, and the like.

[0098] The storage unit stores program codes, which can be executed by the processing unit 610, so that the processing unit 610 performs the steps according to various exemplary embodiments of the present invention described in the above method embodiment section of this specification. For example, the processing unit 610 can perform the following steps: Figure 1 The steps of the method shown in .

[0099] The storage unit 620 may include a readable medium in the form of a volatile storage unit, such as a random access memory unit (RAM) 6201 and / or a cache memory unit 6202 , and may further include a read-only memory unit (ROM) 6203 .

[0100] The storage unit 620 may also include a program / utility 6204 having a set (at least one) of program modules 6205, such program modules 6205 including but not limited to: an operating system, one or more application programs, other program modules and program data, each of which or some combination may include an implementation of a network environment.

[0101] Bus 630 may represent one or more of several types of bus structures, including a memory bus or memory controller, a peripheral bus, an accelerated graphics port, a processing unit, or a local bus using any of a variety of bus architectures.

[0102] The electronic device 600 can also communicate with one or more external devices 700 (e.g., a keyboard, a pointing device, a Bluetooth device, etc.), one or more devices that enable a user to interact with the electronic device 600, and / or any device that enables the electronic device 600 to communicate with one or more other computing devices (e.g., a router, a modem, etc.). Such communication can occur via an input / output (I / O) interface 650. Furthermore, the electronic device 600 can communicate with one or more networks (e.g., a local area network (LAN), a wide area network (WAN), and / or a public network such as the Internet) via a network adapter 660. The network adapter 660 can communicate with other modules of the electronic device 600 via the bus 630. It should be understood that, although not shown in the figures, other hardware and / or software modules can be used in conjunction with the electronic device 600, including but not limited to microcode, device drivers, redundant processing units, external disk drive arrays, RAID systems, tape drives, and data backup storage systems.

[0103] Through the description of the above embodiments, it is easy for those skilled in the art to understand that the example embodiments described herein can be implemented by software or by combining software with necessary hardware. Therefore, the technical solution according to the embodiments of the present disclosure can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (which can be a CD-ROM, a USB flash drive, a mobile hard disk, etc.) or on a network, and includes a number of instructions to enable a computing device (which can be a personal computer, a server, or a network device, etc.) to execute the method steps of the above-mentioned embodiments according to the embodiments of the present disclosure.

[0104] It should be noted that, in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any actual relationship or order between these entities or operations. Moreover, the terms "comprises," "comprising," or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, article, or device comprising a series of elements includes not only those elements, but also other elements not explicitly listed, or elements inherent to such process, method, article, or device. In the absence of further limitations, an element defined by the phrase "comprising a ..." does not exclude the presence of other identical elements in the process, method, article, or device comprising the element.

[0105] The foregoing description is intended only to provide specific embodiments of the present disclosure, intended to enable those skilled in the art to understand and implement the present disclosure. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present disclosure. Therefore, the present disclosure is not intended to be limited to the embodiments described herein, but rather to be construed in the broadest manner consistent with the principles and novel features disclosed herein.

Claims

1. A method for processing terminal virus infection, characterized in that: include: Acquire an alarm information data set, wherein the alarm information data set includes multiple terminal alarm information from different network security devices, each terminal alarm information includes at least a source IP, a destination IP, a source port, a destination port, a transmission protocol, a destination domain name, a file name, and a file hash value; Match the target terminal alarm information with the threat intelligence library. If at least one of the source IP, destination IP, source port, destination port, transmission protocol, destination domain name, file name, and file hash value in the target terminal alarm information matches the threat intelligence library, the asset management system and the identity authentication system are linked to determine the terminal's affiliated unit and the terminal user information; the target terminal alarm information is any one of the multiple terminal alarm information; Generate a virus analysis report and disposal opinions based on the source IP, destination IP, source port, destination port, transmission protocol, file name, file hash value in the target terminal alarm information and the matching virus information in the threat intelligence library; A virus infection event work order for the target terminal is generated based on the terminal's unit and terminal user information, and the virus infection event work order, the virus analysis report and disposal opinions are sent to the security operation and maintenance personnel of the unit to which the target terminal belongs and the terminal user to handle the virus of the target terminal.

2. The method according to claim 1, characterized in that Before obtaining the alarm information data set, the original terminal alarm data information of different network security devices is collected in real time through the system log, and the original terminal alarm data information is preprocessed to obtain the alarm information data set; wherein the preprocessing includes removing repeated alarm data within a preset time length, denoising the alarm data, and converting the alarm data into a unified format.

3. The method according to claim 1, characterized in that The method further includes: The unified interface is called and preset parameters are passed in, so as to enable different network security devices to automatically perform a blocking operation on the IP of the target terminal based on the preset parameters at the same time; wherein the unified interface is pre-templated and customized based on the response interfaces and operation commands of different network security devices.

4. The method according to claim 3, characterized in that The method further includes: Receive feedback from security operations personnel after they handle virus on target terminals; In response to receiving the feedback information, the unified interface is called and another preset parameter is passed in, so as to enable different network security devices to automatically perform an unblocking operation on the IP of the target terminal based on the other preset parameter at the same time.

5. The method according to claim 4, characterized in that The method further includes: After receiving the feedback information, obtaining the network information and file information of the target terminal within a specified time period; Based on the analysis of the network information and file information, it is determined whether the target terminal is infected with the virus again. If so, a notification message is sent to instruct the security operation and maintenance personnel to further deal with the infected virus; otherwise, the virus infection event work order is closed.

6. The method according to claim 5, characterized in that The specified duration includes at least two hours.

7. The method according to any one of claims 1 to 6, characterized in that: The different network security devices include at least two of an IP protocol cipher machine, a security router, a line cipher machine, a firewall, an anti-virus software system, a network / system scanning system, an intrusion detection system, and a network security early warning and auditing system.

8. A terminal virus infection processing system, characterized in that: include: An information acquisition module is used to acquire an alarm information data set, wherein the alarm information data set includes multiple terminal alarm information from different network security devices, and each terminal alarm information includes at least a source IP, a destination IP, a source port, a destination port, a transmission protocol, a destination domain name, a file name, and a file hash value; A matching linkage module is used to match the target terminal alarm information with the threat intelligence library. If at least one of the source IP, destination IP, source port, destination port, transmission protocol, destination domain name, file name, and file hash value in the target terminal alarm information matches the threat intelligence library, the asset management system and the identity authentication system are linked to determine the terminal's affiliated unit and the terminal user information; the target terminal alarm information is any one of the multiple terminal alarm information; An information generation module, used to generate a virus analysis report and disposal opinions based on the source IP, destination IP, source port, destination port, transmission protocol, file name, file hash value in the target terminal alarm information and the matching virus information in the threat intelligence library; The virus handling module is used to generate a virus infection event work order for the target terminal based on the terminal's affiliated unit and the terminal user information, and send the virus infection event work order, the virus analysis report and the disposal opinions to the security operation and maintenance personnel of the target terminal's affiliated unit and the terminal user to handle the virus of the target terminal.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the terminal virus infection processing method according to any one of claims 1 to 7 is implemented.

10. An electronic device, characterized in that: include: processor; as well as Memory for storing computer programs; The processor is configured to execute the terminal virus infection processing method according to any one of claims 1 to 7 by executing the computer program.

Images