Instruction control method and device and storage medium
By evaluating risk levels and judging control methods for handling operation instructions, risk control of network operations is achieved, and the problem of difficulty in preventing network failures in the existing technology is solved, and the stability and reliability of the network are improved.
Patent Information
- Application Number
- CN202510299227.9
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-03-13
- Publication Date
- 2025-06-20
AI Technical Summary
The prior art is difficult to predict or prevent network failures, network stability and reliability depend on engineers' operational compliance, and human factors remain the main threat.
By obtaining the risk level of the command to be operated, determining the control means judgment rules, and obtaining control means based on the rules, risk controls are carried out for the control instructions to prevent potential network failures.
It effectively improves engineers' compliance with network operations, prevents network failures caused by the issuance of operation instructions, and improves network stability and reliability.
Smart Images
Figure CN120186002A_ABST
Abstract
Description
Technical Field
[0001] This application relates to the field of network security technology, and particularly to an instruction control method, device, and storage medium. Background Art
[0002] With the continuous progress of network technology and the increasing wide application, a stable and reliable network has become one of the bases for the normal operation of modern society. Whether for individual users or enterprise organizations, ensuring the stability and reliability of the network is not only a necessary condition for improving user experience and ensuring data security, but also a key factor in promoting social and economic development.
[0003] In the prior art, information such as the running status, events, operations, and errors of a log recording system, application program, service, etc. is recorded, and the behavior of the application program is traced and audited, problems are diagnosed, system performance is monitored, and security analysis is carried out through the log query function. However, logs are mainly used for post-mortem analysis and problem diagnosis, and cannot directly predict or prevent problems from occurring. Large-scale network paralysis accidents caused by improper operations of engineers at home and abroad are common, and the stability and reliability of the network still face the trouble of human factors. Summary of the Invention
[0004] The purpose of the embodiments of this application is to provide an instruction control method, device, and storage medium to improve the compliance of engineers' network operations, assist network administrators in managing the network, and thus improve the stability and reliability of the network.
[0005] To solve the above technical problems, the embodiments of this application provide an instruction control method, including: obtaining the risk level of the to-be-operated instruction; determining the control means judgment rule of the to-be-operated instruction according to the risk level of the to-be-operated instruction; obtaining the control means of the to-be-operated instruction through the control means judgment rule of the to-be-operated instruction; and performing risk control on the to-be-operated instruction based on the control means.
[0006] The embodiments of this application also provide an instruction control method, where the to-be-operated instruction includes: instruction content; and the obtaining of the risk level of the to-be-operated instruction includes: obtaining the risk level of the to-be-operated instruction based on the instruction content and a preset risk operation instruction library.
[0007] The embodiments of this application also provide an instruction control method. When the risk level is the record level, obtaining the control means of the to-be-operated instruction through the control means judgment rule of the to-be-operated instruction includes: determining whether the to-be-operated instruction is compliant; if the to-be-operated instruction is compliant, the control means of the to-be-operated instruction is to release; otherwise, the control means of the to-be-operated instruction is to output a warning prompt and release.
[0008] Embodiments of the present application also provide an instruction control method. When the risk level is the warning level or the blocking level, the control means of the to-be-operated instruction is obtained through the judgment rule of the control means of the to-be-operated instruction, including: determining whether the to-be-operated instruction is compliant; if the to-be-operated instruction is non-compliant, the control means of the to-be-operated instruction is to output a warning prompt and block; otherwise, based on the risk level and the to-be-operated instruction, the control means of the to-be-operated instruction is determined.
[0009] Embodiments of the present application also provide an instruction control method. Based on the risk level and the to-be-operated instruction, the control means of the to-be-operated instruction is determined, including: if the risk level is the warning level, determining the hit range of the to-be-operated instruction; if the hit range of the to-be-operated instruction is a small hit range, the control means of the to-be-operated instruction is to output a warning prompt and release; if the hit range of the to-be-operated instruction is a large hit range, the control means of the to-be-operated instruction is determined according to the associated work order of the to-be-operated instruction.
[0010] Embodiments of the present application also provide an instruction control method. Based on the risk level and the to-be-operated instruction, the control means of the to-be-operated instruction is determined, including: if the risk level is the blocking level, the control means of the to-be-operated instruction is determined according to the associated work order of the to-be-operated instruction.
[0011] Embodiments of the present application also provide an instruction control method. The control means of the to-be-operated instruction is determined according to the associated work order of the to-be-operated instruction, including: determining whether the associated work order of the to-be-operated instruction has override authority; if it has override authority, the control means of the to-be-operated instruction is to output a warning prompt and release; otherwise, the control means of the to-be-operated instruction is to output a warning prompt and block.
[0012] Embodiments of the present application also provide an instruction control method. The to-be-operated instruction includes: operation time, operation account, and device identifier. Determining whether the to-be-operated instruction is compliant includes: determining the associated work order of the to-be-operated instruction according to the operation time; if the operation time is within the window period of the associated work order, the operation account has configuration authority, and the operation device corresponding to the operation device identifier is within the associated work order, determining that the to-be-operated instruction is compliant; otherwise, determining that the to-be-operated instruction is non-compliant.
[0013] Embodiments of the present application also provide an electronic device, including: at least one processor; and a memory communicatively connected to the at least one processor; wherein, the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute the above instruction control method.
[0014] An embodiment of the present application also provides a computer-readable storage medium storing a computer program, and when the computer program is executed by a processor, the above-mentioned instruction control method is implemented.
[0015] In the present application, the control means judgment rule of the to-be-operated instruction is determined through the risk level of the to-be-operated instruction, and then the control means is determined through the control means judgment rule of the to-be-operated instruction to perform risk control on the to-be-operated instruction. The present application pre-performs risk control on the to-be-operated instruction of the engineer in the network before it is issued, can directly predict or prevent network failures caused by the issuance of the to-be-operated instruction, improve the compliance of the engineer's network operations, assist the network administrator in controlling the network, and thus improve the stability and reliability of the network. BRIEF DESCRIPTION OF THE DRAWINGS
[0016] One or more embodiments are exemplarily illustrated by the pictures in the corresponding drawings, and these exemplary illustrations do not constitute a limitation on the embodiments.
[0017] Figure 1 is a flowchart of an instruction control method provided by an embodiment of the present application;
[0018] Figure 2 is a flowchart of a method for obtaining an instruction control means provided by an embodiment of the present application;
[0019] Figure 3 is a flowchart of another method for obtaining an instruction control means provided by an embodiment of the present application;
[0020] Figure 4 is a flowchart of a method for determining an instruction control means provided by an embodiment of the present application;
[0021] Figure 5 is a flowchart of another method for determining an instruction control means provided by an embodiment of the present application
[0022] Figure 6 is a structural diagram of an instruction control device provided by an embodiment of the present application;
[0023] Figure 7 is a flowchart of a detailed instruction control method provided by an embodiment of the present application;
[0024] Figure 8 is a schematic structural diagram of a computer device provided by an embodiment of the present application. DETAILED DESCRIPTION OF THE EMBODIMENTS
[0025] To make the objectives, technical solutions, and advantages of the embodiments of this application clearer, the following will elaborate on each embodiment of this application with reference to the accompanying drawings. However, those of ordinary skill in the art can understand that in the embodiments of this application, many technical details are provided to help readers better understand this application. However, even without these technical details and various changes and modifications based on the following embodiments, the technical solutions claimed in this application can still be implemented. The following division of each embodiment is for convenience of description and should not constitute any limitation to the specific implementation manner of this application. Each embodiment can be combined and cross-referenced with each other on the premise of not being contradictory.
[0026] In view of the fact that the prior art cannot directly predict or prevent the occurrence of problems, embodiments of this application relate to an instruction control method. Figure 1 It is a flowchart of an instruction control method provided by an embodiment of this application. As Figure 1 shown, the instruction control method specifically includes the following steps.
[0027] Step 101, obtain the risk level of the instruction to be operated.
[0028] The instruction to be operated is an instruction that has not been executed and has not been sent to the corresponding device or network. This application preprocesses the instruction to be operated, that is, performs risk analysis in advance before sending it.
[0029] The risk level of the instruction to be operated is used to indicate the risk level of the instruction to be operated to the operation of the device or network. In the embodiments of this application, the risk level of the instruction to be operated can be a record level, a warning level, a blocking level, etc. Of course, it can also be other levels, which are not specifically limited here.
[0030] Step 102, determine the control means judgment rule of the instruction to be operated according to the risk level of the instruction to be operated.
[0031] The control means judgment rule is used to judge the control means of the instruction to be operated.
[0032] Among them, each risk level corresponds to a control means judgment rule, that is, there is a pre-set mapping relationship between the risk level and the control means judgment rule. The corresponding control means judgment rule can be determined through the risk level. By way of example, the record level corresponds to the first control means judgment rule, the warning level corresponds to the second control means judgment rule, and the blocking level corresponds to the third control means judgment rule. Among them, the first control means judgment rule, the second control means judgment rule, and the third control means judgment rule can be the same or different, which are not specifically limited here.
[0033] In the embodiments of the present application, the risks of the record level, warning level, and blocking level are different, and the judgment rules of the corresponding three control means are all different, which can make risk control more accurate.
[0034] Step 103: Obtain the control means of the to-be-operated instruction according to the judgment rule of the control means of the to-be-operated instruction.
[0035] By judging the instruction content in the to-be-operated instruction according to the judgment rule of the control means, the control means of the to-be-operated instruction can be determined.
[0036] In the embodiments of the present application, the control means of the to-be-operated instruction include: release and block, and there may also be a warning at the same time. It can be understood that the control means cannot include both release and block at the same time, but release and warning can be included at the same time, and block and warning can also be included at the same time.
[0037] Among them, the release of the to-be-operated instruction refers to approving or allowing the issuance of the to-be-operated instruction. At this time, the issuance of the to-be-operated instruction should pose a relatively low risk to the device or network; the block of the to-be-operated instruction refers to intercepting and preventing the to-be-operated instruction to prevent the to-be-operated instruction from being issued. At this time, the issuance of the to-be-operated instruction should pose a relatively high risk to the device or network.
[0038] Step 104: Perform risk control on the to-be-operated instruction based on the control means.
[0039] If the control means includes release, the risk control is to allow the issuance of the to-be-operated instruction; if the control means includes block, the risk control is to prevent the to-be-operated instruction from being issued to prevent problems from occurring.
[0040] In the embodiments of the present application, through risk control, equipment failures or network failures caused by to-be-operated instructions with relatively high risks can be prevented in advance.
[0041] The present application performs risk control on the to-be-operated instructions of engineers in the network in advance before the instructions are issued, so as to predict or prevent network failures caused by the issuance of to-be-operated instructions before the instructions are issued, improve the compliance of engineers' network operations, assist network administrators in managing the network, and thus improve the stability and reliability of the network.
[0042] In the above Figure 1 On the basis of the instruction control method shown, the embodiments of the present application also provide another instruction control method. The to-be-operated instruction in step 101 includes instruction content. At this time, step 101: Obtain the risk level of the to-be-operated instruction, including: obtaining the risk level of the to-be-operated instruction based on the instruction content and the preset risk operation instruction library.
[0043] The preset risk operation instruction library includes: an instruction set corresponding to the record level of risk, an instruction set corresponding to the warning level of risk, and an instruction set corresponding to the blocking level of risk. All instruction sets form a large set and are stored in database table 1.
[0044] To provide a comparison source for comparing whether the received instruction content has risks, there should be multiple forms for a piece of instruction content to be compared, such as a fully spelled instruction, an abbreviated instruction, and a keyword.
[0045] In the embodiment of the present application, the instruction set includes: fully spelled instruction content, abbreviated instruction content, or keywords, etc. If the instruction content included in the instruction to be operated is the same as a piece of fully spelled instruction content in the instruction set, then the risk level of the instruction set corresponding to this fully spelled instruction content is the risk level of the instruction to be operated; if the instruction content included in the instruction to be operated is the same as a piece of abbreviated instruction content in the instruction set, or the abbreviation of the instruction content included in the instruction to be operated is the same as a piece of abbreviated instruction content in the instruction set, then the risk level of the instruction set corresponding to this abbreviated instruction content is the risk level of the instruction to be operated; if the instruction content included in the instruction to be operated contains a keyword in the instruction set, then the risk level of the instruction set corresponding to this keyword is the risk level of the instruction to be operated.
[0046] Optionally, the risk of instructions is divided into three levels: record, warning, and blocking. The operation device can be set with an influence range attribute. The administrator has the permissions to add, delete, edit the instruction content and the device influence range attribute.
[0047] The predefined risk instruction risk level division definition includes: the record level, indicating that the operation has no risk to network operation, such as viewing device configuration and printing logs; the warning level, indicating that the operation has a small probability of affecting network operation, such as opening device ports, adding firewall rules, and vulnerability scanning; the blocking level, indicating that the operation has a high probability of affecting network operation, such as closing device ports, deleting firewall rules, and restarting devices.
[0048] In the embodiment of the present application, by comparing the preset risk operation instruction library with the instruction content of the instruction to be operated, the risk level of the instruction to be operated can be determined conveniently and quickly.
[0049] In the above Figure 1 Based on the instruction control method shown, the embodiment of the present application also provides another instruction control method. Figure 2 It is a flowchart of a method for obtaining an instruction control means provided by the embodiment of the present application, as Figure 2As shown, when the risk level of the to-be-operated instruction in step 101 is the record level, at this time, in step 103, the control means of the to-be-operated instruction are obtained through the control means judgment rule of the to-be-operated instruction, including the following steps.
[0050] Step 201, determine whether the to-be-operated instruction is compliant.
[0051] Whether the to-be-operated instruction is compliant refers to whether there are errors in the relevant content in the to-be-operated instruction. By way of example, the relevant content in the to-be-operated instruction can be the operation time, account number, device ID (Identification), etc.
[0052] If the to-be-operated instruction is compliant, go to step 202; if the to-be-operated instruction is non-compliant, go to step 203.
[0053] Step 202, the control means of the to-be-operated instruction is release.
[0054] When the risk level is the record level, the issuance of the to-be-operated instruction poses no risk to network operation. Therefore, regardless of whether the to-be-operated instruction is compliant, the to-be-operated instruction can be released.
[0055] At the record level, if the to-be-operated instruction is compliant, then the issuance of the to-be-operated instruction poses no risk to network operation and the relevant content in the to-be-operated instruction is correct, and it can be directly released.
[0056] Step 203, the control means of the to-be-operated instruction is to output a warning prompt and release.
[0057] At the record level, if the to-be-operated instruction is non-compliant, then the issuance of the to-be-operated instruction poses no risk to network operation but there are errors in the relevant content in the to-be-operated instruction, then a warning prompt is output while releasing. By way of example, the warning prompt can be that the to-be-operated instruction is non-compliant.
[0058] In the embodiments of the present application, outputting a warning prompt can enable engineers to discover the problem in time and actively make modifications.
[0059] In the embodiments of the present application, when the risk level is the record level, the issuance of the to-be-operated instruction poses no risk to network operation. Regardless of whether the to-be-operated instruction is compliant, it can be released. It's just that when the to-be-operated instruction is non-compliant, a warning prompt also needs to be output to prompt the engineer to make modifications in time, improving the compliance of the engineer's network operations.
[0060] Based on the above Figure 1 shown instruction control method, the embodiments of the present application also provide another instruction control method. Figure 3 It is a flowchart of another method for obtaining the control means of an instruction provided by the embodiments of the present application, as Figure 3As shown, when the risk level of the to-be-operated instruction in the above step 101 is the warning level or the blocking level, at this time, in step 103, the control means of the to-be-operated instruction is obtained through the control means judgment rule of the to-be-operated instruction, including the following steps.
[0061] Step 301, determine whether the to-be-operated instruction is compliant.
[0062] Whether the to-be-operated instruction is compliant refers to whether there are errors in the relevant content in the to-be-operated instruction. For example, the relevant content in the to-be-operated instruction can be the operation time, account number, device ID (Identification), etc.
[0063] If the to-be-operated instruction is compliant, go to step 302; if the to-be-operated instruction is non-compliant, go to step 303.
[0064] Step 302, the control means of the to-be-operated instruction is to output a warning prompt and block.
[0065] The warning level and the blocking level indicate that the issuance of the to-be-operated instruction will probabilistically affect the network operation. On the basis of the probabilistic impact, adding that the to-be-operated instruction is non-compliant, then the impact probability and the impact range may be greater. Therefore, output a warning prompt and block the to-be-operated instruction.
[0066] Among them, the warning prompt can be a probabilistic impact and the to-be-operated instruction is non-compliant.
[0067] Step 303, based on the risk level and the to-be-operated instruction, determine the control means of the to-be-operated instruction.
[0068] The warning level and the blocking level indicate that the issuance of the to-be-operated instruction will probabilistically affect the network operation. When there is a probabilistic impact, the compliance of the to-be-operated instruction will not have a further impact on the impact. Therefore, it is still necessary to further determine the control means of the to-be-operated instruction.
[0069] Since the warning level indicates that the operation has a small probability of affecting the network operation, and the blocking level indicates that the operation has a high probability of affecting the network operation, therefore, when further determining the control means of the to-be-operated instruction, it is necessary to determine it in combination with the risk level on the basis of the to-be-operated instruction.
[0070] In the embodiments of the present application, when the risk level is the warning level or the blocking level and obtaining the control means of the to-be-operated instruction, there are the same steps, that is, determining whether the to-be-operated instruction is compliant. If it is compliant, continue to determine the control means of the to-be-operated instruction based on the risk level and the to-be-operated instruction. If it is not compliant, the influence probability and influence range of the issuance of the to-be-operated instruction will be greater. It is necessary to block and prompt the engineer in time to directly prevent the occurrence of network failures, improve the compliance of the engineer's network operations, assist the network administrator in managing the network, and thus improve the stability and reliability of the network.
[0071] Based on the above Figure 3 shown method for obtaining instruction control means, embodiments of the present application also provide another instruction control method. Figure 4 It is a flowchart of a method for determining instruction control means provided by an embodiment of the present application. As Figure 4 shown, step 303 above, determining the control means of the to-be-operated instruction based on the risk level and the to-be-operated instruction includes the following steps.
[0072] Step 401, determine whether the risk level is the warning level or the blocking level.
[0073] If the risk level is the warning level, go to step 402; if the risk level is the blocking level, go to step 405.
[0074] Step 402, determine the hit range of the to-be-operated instruction.
[0075] In the embodiments of the present application, when judging the influence range of the operating device, query database table 03, and determine the hit range according to the device ID included in the to-be-operated instruction. The hit range can be a small hit range or a large hit range.
[0076] Step 403, determine whether the hit range is a small hit range or a large hit range.
[0077] If the hit range is small, go to step 404; if the hit range is large, go to step 405.
[0078] Step 404, the control means of the to-be-operated instruction is to output a warning prompt and release.
[0079] At the warning level, it means that the operation has a small probability of affecting network operation. At the same time, the hit range is also small. Then, the overall influence of the to-be-operated instruction is not very large and can be released. However, since there will also be some influence, a warning prompt is output while releasing.
[0080] Step 405, determine the control means of the to-be-operated instruction according to the associated work order of the to-be-operated instruction.
[0081] When it comes to the warning level, it means that the operation has a small probability of affecting network operation. However, the hit range is large. Then, the overall impact of the pending operation instruction is relatively large, and it is necessary to continue to determine the control means.
[0082] If the risk level is the blocking level, it means that the operation has a high probability of affecting network operation. Therefore, it is also necessary to continue to determine the control means.
[0083] In the embodiment of the present application, when continuing to determine the control means of the pending operation instruction based on the risk level and the pending operation instruction, by combining the hit range, the impact of the pending operation instruction can be accurately determined, so that the determination of the control means is more accurate and the prediction of problems is also more accurate, thereby realizing the prediction or prevention of problems.
[0084] In the above Figure 4 On the basis of the method for determining an instruction control means shown, the embodiment of the present application also provides another instruction control method. Figure 5 It is a flowchart of another method for determining an instruction control means provided by the embodiment of the present application. As Figure 5 shown, in step 405 above, according to the associated work order of the pending operation instruction, to determine the control means of the pending operation instruction, the following steps are included.
[0085] Step 501, determine whether the associated work order of the pending operation instruction has override authority.
[0086] The pending operation instruction includes an operation time. According to the operation time, the associated work order of the pending operation instruction can be determined, and whether it has override authority is set in the associated work order. The override authority can be understood as having a higher authority.
[0087] If it has override authority, go to step 502; if it does not have override authority, go to step 503.
[0088] Step 502, the control means of the pending operation instruction is to output a warning prompt and release it.
[0089] If it has override authority, then the authority of this pending operation instruction is relatively large and it is not blocked. However, since the impact of the pending operation instruction is relatively large, therefore, it is still necessary to output a warning prompt to remind the engineer that the impact of this pending operation instruction is relatively large but it has been released.
[0090] Step 503, the control means of the pending operation instruction is to output a warning prompt and block it.
[0091] If it does not have override authority and the impact of the pending operation instruction is relatively large, then it is necessary to block the pending operation instruction and remind the engineer that the impact of this pending operation instruction is relatively large and it has been blocked.
[0092] In an embodiment of the present application, when continuing to determine the control means of the to-be-operated instruction according to the associated work order of the to-be-operated instruction, by combining the override authority, the determination of the control means is made more accurate.
[0093] Based on the method for obtaining an instruction control means as described above Figure 2 and Figure 3 An embodiment of the present application further provides another instruction control method. The to-be-operated instruction includes: operation time, operation account, device identifier (device ID). In steps 301 and 201 above, determining whether the to-be-operated instruction is compliant includes: determining the associated work order of the to-be-operated instruction according to the operation time; if the operation time is within the window period of the associated work order, the operation account has the configured authority, and the operation device corresponding to the device identifier is within the associated work order, determining that the to-be-operated instruction is compliant; otherwise, determining that the to-be-operated instruction is non-compliant.
[0094] The associated work order of the to-be-operated instruction can be determined according to the operation time. The associated work order has a window period and associated devices. If all of the following are satisfied: the operation time is within the window period of the associated work order, the operation account has the configured authority, and the operation device corresponding to the device identifier is within the associated devices of the associated work order, the to-be-operated instruction is compliant. If any one of the conditions is not satisfied, the to-be-operated instruction is non-compliant.
[0095] Of course, the to-be-operated instruction may also contain other information, and the conditions for the to-be-operated instruction to be compliant may also contain restrictions on other information, which are not specifically limited in the embodiments of the present application.
[0096] In an embodiment of the present application, according to the operation time, operation account, and device identifier included in the to-be-operated instruction, determining whether the to-be-operated instruction is compliant makes the compliance judgment of the to-be-operated instruction more accurate, and further makes the control means more accurate.
[0097] Based on the above embodiments, an embodiment of the present application further provides an instruction control device. Figure 6 is a structural diagram of an instruction control device provided by an embodiment of the present application, as Figure 6 shown. The instruction control device includes: an operation instruction receiver 10, a work order system 20, an operation instruction analyzer 30, an operation log 40, a risk warning processor 50, a risk operation instruction library 60, and a risk control executor 70.
[0098] Among them, the operation instruction receiver 10 provides a human-computer interaction entry for receiving operation instructions input by engineers, displaying warning prompts, displaying control means, etc. The operation instruction receiver 10 stores the received operation instructions to be processed in the database table 02 for recording, and will only actually send them to the device after risk control. The instruction control method of this application analyzes and controls the operation instructions to be processed before sending them to the device. The information stored in the database table 02 at this stage includes: operation time, operation account, device identifier, and instruction content.
[0099] The operation instruction receiver 10 is connected to the operation instruction analyzer 30, and is used to send the operation time, operation account, device identifier, and instruction content included in the operation instruction to be processed to the operation instruction analyzer 30.
[0100] The operation instruction analyzer 30 performs multi-factor analysis on the instruction information sent by the operation instruction receiver 10, including comprehensive judgment by associating with the work order system in dimensions such as operation time, operation account, device identifier, and instruction content.
[0101] Judge the operation time. Since the work order system 20 is connected to the operation instruction analyzer 30, and the work order system 20 contains the corresponding relationship between each work order and the operation time, and the window period of each work order, the operation time is combined with the information provided by the work order system 20 to analyze the associated work order (operation work order) of the operation instruction to be processed. If the operation time is within the window period of the associated work order, it is marked as 0101; if there is no associated work order or the operation time is not within the window period of the associated work order, it is marked as 0102, and the operation time marking column of the database table 02 is updated.
[0102] Judge the system operation account. An account with configured permissions is marked as 0201, and an account without configured permissions is marked as 0202, and the operation account marking column of the database table 2 is updated. Judge the device identifier. The device within the associated work order is marked as 0301, and the device outside the associated work order is marked as 0302, and the device identifier marking column of the database table 2 is updated.
[0103] Judge the instruction content. Since the risk operation instruction library 60 is connected to the operation instruction analyzer 30, and the risk operation instruction library 60 contains an instruction set corresponding to the record level of the risk level, an instruction set corresponding to the warning level of the risk level, and an instruction set corresponding to the blocking level of the risk level, the instruction content can query the database table 01 in combination with the risk operation instruction library 60. If the instruction content hits the record level, it is marked as 0401. If it hits the warning level, it is marked as 0402. If it hits the blocking level, it is marked as 0403, and the instruction mark column of the database table 2 is updated. Among them, the corresponding relationship between the risk level and the instruction set in the risk operation instruction library 60 can be updated by the administrator. At the same time, the operation log 40 is connected to the risk operation instruction library 60, and the corresponding relationship between the risk level and the instruction set in the risk operation instruction library 60 can be updated according to the operation log.
[0104] Judge the influence range of the operating device. Query the database table 03. According to the device identifier, if the hit range is small, it is marked as 0501. If the hit range is large, it is marked as 0502.
[0105] Judge the override control. The work order system 20 also contains the override permission for each work order. In combination with the work order system 20, if the override permission is set in the associated work order, it is marked as 0601. If the override permission is not set, it is marked as 0602.
[0106] After analysis, an instruction to be operated can correspond to a string of digital marking results, such as 010102010301040305010602.
[0107] The operation instruction analyzer 30 is connected to the risk warning processor 50, and is used to send the digital marking result of the instruction to be operated to the risk warning processor 50. The risk warning processor 50 is used to execute the method of obtaining the risk level of the instruction to be operated in the above instruction control method. According to the risk level of the instruction to be operated, determine the control means judgment rule of the instruction to be operated, and obtain the control means of the instruction to be operated through the control means judgment rule of the instruction to be operated. Specifically, Figure 7 is a flowchart of a detailed instruction control method provided by an embodiment of the present application, as Figure 7As shown, obtain the control means of the instruction to be operated. The combined relationship of the marked values in dimensions such as the above operation time, operation account, device identifier, and instruction content is as shown in Table 1 below (X in Table 1 represents any value), and a comprehensive judgment action and warning output are performed on the instruction to be operated. The basic principles are as follows: If the instruction risk is a warning or block, relevant information is output and returned to the operation instruction receiver 10; if the operation time, operation account, and device identifier are incorrect, only instructions with a risk level of record are allowed, and a warning is output; if the operation time, operation account, and device identifier are correct, and there is an override permission in the associated work order, it is released; if the operation time, operation account, and device identifier are all correct, and there is no override permission in the work order, only instructions with a risk level of record or a risk level of warning and a small device impact range are allowed.
[0108] Table 1
[0109]
[0110] The risk control actuator 70 is connected to the risk warning processor 50, and the risk warning processor 50 sends the control means of the instruction to be operated to the risk control actuator 70, so that the risk control actuator 70 performs risk control on the instruction to be operated based on this control means.
[0111] The operation instruction receiver 10, the operation instruction analyzer 30, and the risk warning processor 50 sequentially complete the complete record of an instruction to be operated. The operation instruction receiver 10, the operation instruction analyzer 30, and the risk warning processor 50 are all connected to the operation log 40, and all operation records are recorded through the operation log 40. Through the comprehensive query in dimensions such as operation time, device identifier, and instruction to be operated, it provides data support for network administrators to trace back, analyze, and evaluate network security control. At the same time, as one of the sources of the update content of the risk operation instruction set, by analyzing historical operation records, network administrators dynamically update the risk instruction library to improve the network operation security management level.
[0112] This application describes a method for realizing pre - analysis and early warning processing of risk operations, mainly consisting of the following five parts: 1. Risk operation instruction library, which describes the definition, source, and update of the risk instruction set. 2. Operation instruction reception, which describes how to receive instructions and the actions after receiving the instructions. 3. Operation instruction analysis, which describes the multi - factor analysis of the instruction information sent by the operation instruction receiver, including comprehensive analysis of operation time, operation account, operation network element ID, operation instruction content, and associated work order dimension. 4. Risk early warning processing, which describes how to judge release, block, and give early warning actions for the instruction after analysis. 5. Operation log, which describes the record of historical operation instructions and the function of this part. This application can analyze the risk level of the instruction by comparing the received instruction with the risk operation instruction library, and trigger early warning and blocking processing for risk operations. This application provides a method to strengthen the security control of network operations, improve the compliance of on - site operations of network maintenance engineers, and assist network administrators in managing the network.
[0113] The risk operation management method based on diversified analysis provided by this application can be flexibly deployed in various network environments. As an auxiliary security device, it can analyze instructions that may have a serious impact on the operation or status of the device before the instructions are sent to the target device, and judge the sending action, so as to realize the risk assessment and control of various operations. This method has the following important features:
[0114] 1. It can be deployed to run independently on customized security devices or embedded as a subsystem in other systems, such as bastion hosts, VPNs (Virtual Private Networks), zero - trust systems, and various professional network management systems, as a supplement and enhancement to the basic functions of their respective systems.
[0115] 2. It supports various types of network devices in different specialties such as transmission, switching, data communication, security, dynamic environment monitoring, and quantum communication, and has good scalability to support existing network environments and new network types that may appear in the future.
[0116] 3. This method maintains three data tables, database table 01, database table 02, and database table 03. Database table 01 stores the risk instruction set and the corresponding risk coefficients of each instruction. Database table 02 stores historical instruction records, that is, operation logs. A complete record includes operation time, operation account, operation device ID, operation instruction content, and analysis flag values for the corresponding dimension, and risk early warning processing results. Database table 03 stores the device IDs to be controlled and the corresponding influence scope sizes.
[0117] 4. Risk operation instruction library, the instruction set contains predefined risk operation instructions and the corresponding risk coefficients of the instructions as the source for risk operation comparison, which are stored in database table 01.
[0118] 5. Operation instruction receiver, which is accessed through a unified human-computer interaction window and serves as the receiver for analyzing operation instructions. After the operation instructions are submitted through the human-computer interaction window, the system records the received operation logs and stores them in database table 02 for recording, including the operation time, operation account, ID of the operation device, and instruction content. At the same time, it returns the issued instruction as release, warning, or block according to the result of risk warning processing.
[0119] 6. Operation instruction analysis: Compare with the risk operation instruction library, and analyze the legality of the operation command in combination with the reported operation time, operation account, operation device ID, and instruction content. Output the analysis flag values of the operation time, operation account, operation device ID, and instruction content of this instruction, which are used as the input of the risk warning processing module and are also stored in database table 2 at the same time.
[0120] 7. Risk warning processing: Process the comprehensive set of flag values of the operation time, operation account, operation device ID, and instruction content of the instruction, and output the operation actions of release, warning information, and block.
[0121] 8. Operation logs, which contain all received instructions and are stored in database table 2. The system provides comprehensive queries based on the dimensions of operation time, operation network element, operation instruction, and operation source ip (Internet Protocol), providing a data source for network administrators to analyze and evaluate network security management. At the same time, it is also one of the sources for updating the content of the operation instruction set.
[0122] This application can analyze the risk level of the received instruction by comparing it with the risk operation instruction library, trigger early warning and blocking processing for risky operations, realize pre-analysis, reduce network failures caused by engineers' random operations, improve the compliance of on-site operations of network maintenance engineers, and assist network administrators in controlling the network.
[0123] The step division of the above various methods is only for clear description. When implemented, they can be combined into one step or some steps can be split into multiple steps. As long as the same logical relationship is included, they are all within the protection scope of this patent; adding insignificant modifications or introducing insignificant designs to the algorithm or process, but not changing the core design of its algorithm and process, are all within the protection scope of this patent.
[0124] This application embodiment relates to a computer device / electronic device. Figure 8 It is a schematic structural diagram of a computer device provided by this application embodiment, as Figure 8As shown, it includes: at least one processor 801; and a memory 802 communicatively connected to the at least one processor 801; wherein, the memory 802 stores instructions executable by the at least one processor 801, and when the instructions are executed by the at least one processor 801, the at least one processor 801 is enabled to execute the instruction control methods in the above various embodiments.
[0125] Among them, the memory 802 and the processor 801 are connected by a bus, and the bus may include any number of interconnected buses and bridges, and the bus connects various circuits of one or more processors and memories together.
[0126] An embodiment of the present application relates to a computer-readable storage medium storing a computer program. When the computer program is executed by a processor, the above method embodiment is implemented.
[0127] That is, those skilled in the art can understand that all or part of the steps in implementing the above method embodiments can be completed by a program instructing relevant hardware. The program is stored in a storage medium, including several instructions for enabling a device (which can be a single-chip microcomputer, a chip, etc.) or a processor to execute all or part of the steps of the methods described in various embodiments of the present application. And the foregoing storage medium includes: various media such as USB flash drives, mobile hard disks, read-only memories (ROMs), random access memories (RAMs), magnetic disks, or optical discs that can store program codes.
[0128] An embodiment of the present application relates to a computer program product storing a computer program. When the computer program is executed by a processor, the above method embodiment is implemented.
[0129] Those of ordinary skill in the art can understand that the above various embodiments are specific embodiments for implementing the present application, and in practical applications, various changes can be made to them in form and details without departing from the spirit and scope of the present application.
Claims
1. A command control method, characterized in that: The method comprises: Get the risk level of the pending instruction; Determining a control means judgment rule for the instruction to be operated according to the risk level of the instruction to be operated; Obtaining the control means of the instruction to be operated by judging the control means rule of the instruction to be operated; The risk control of the pending operation instructions is performed based on the control means.
2. The command control method according to claim 1, characterized in that: The instruction to be operated includes: instruction content; the risk level of the instruction to be operated includes: Based on the instruction content and a preset risk operation instruction library, the risk level of the instruction to be operated is obtained.
3. The command control method according to claim 1, characterized in that: When the risk level is the record level, obtaining the control means of the instruction to be operated by judging the control means rule of the instruction to be operated includes: Determining whether the pending instruction is compliant; If the pending instruction is compliant, the control means of the pending instruction is to release it; otherwise, the control means of the pending instruction is to output a warning prompt and release it.
4. The command control method according to claim 1, characterized in that: When the risk level is a warning level or a blocking level, the control means of the instruction to be operated is obtained by judging the control means rule of the instruction to be operated, including: Determining whether the pending instruction is compliant; If the instruction to be operated is not compliant, the control means of the instruction to be operated is to output a warning prompt and block it; otherwise, based on the risk level and the instruction to be operated, the control means of the instruction to be operated is determined.
5. The command control method according to claim 4, characterized in that: Determining a control means for the instruction to be operated based on the risk level and the instruction to be operated includes: If the risk level is a warning level, determining a hit range of the instruction to be operated; If the hit range of the instruction to be operated is a small hit range, the control means of the instruction to be operated is to output a warning prompt and release it; if the hit range of the instruction to be operated is a large hit range, the control means of the instruction to be operated is determined according to the associated work order of the instruction to be operated.
6. The command control method according to claim 4, characterized in that: Determining a control means for the instruction to be operated based on the risk level and the instruction to be operated includes: If the risk level is a blocking level, a control means for the instruction to be operated is determined according to a work order associated with the instruction to be operated.
7. The command control method according to claim 5 or 6, characterized in that: Determining a control means for the instruction to be operated according to an associated work order of the instruction to be operated includes: Determine whether the work order associated with the pending instruction has an override authority; If the override authority is available, the control means for the instruction to be operated is to output a warning prompt and release the instruction; otherwise, the control means for the instruction to be operated is to output a warning prompt and block the instruction.
8. The command control method according to claim 3 or 4, characterized in that: The pending operation instruction includes: operation time, operation account, and device identification. The determining whether the pending operation instruction is compliant includes: Determine, according to the operation time, the associated work order of the instruction to be operated; If the operation time is within the window period of the associated work order, the operation account has configuration authority, and the operation device corresponding to the device identifier is within the associated work order, the instruction to be operated is determined to be compliant; otherwise, the instruction to be operated is determined to be non-compliant.
9. An electronic device, characterized in that: include: at least one processor; as well as, a memory communicatively connected to the at least one processor; wherein, The memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute the instruction control method according to any one of claims 1 to 8.
10. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, the instruction control method according to any one of claims 1 to 8 is implemented.