Software running state monitoring method based on software safe running

Abstract

The invention discloses a software operation state monitoring method based on software safe operation, relates to the technical field of software operation, and solves the problem that the trend and continuity of flow change are ignored because only matching is carried out for a flow value at a single moment or an isolated attack feature. According to the method, through the multi-layer verification process of feature mean value comparison, recognition section locking and curve overlap ratio analysis, the undetermined attack features can be quickly screened out, and through the movement comparison of the recognition sections in the flow change curve, the matching degree is quantified through the overlap ratio, so that the attack feature recognition accuracy is greatly improved; meanwhile, in combination with secondary verification of historical interaction characteristics, buffer testing is carried out on abnormal traffic appearing for the first time, and data security is judged according to registry generation conditions, so that misjudgment on known normal fluctuation is avoided, novel attack data can be effectively identified, and double targets of'reducing false alarms' and'covering unknown threats' are achieved.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of software running, in particular to a software running state monitoring method based on software safe running. BACKGROUND

[0002] In the process of software running, network attack means is increasingly hidden and diversified, and the traditional security monitoring method often relies on fixed attack feature library or single flow threshold judgment, which is difficult to cope with complex and variable threat scenarios. For example, some attack behaviors penetrate by gradually adjusting the network flow trend, and their flow mutation characteristics are not obvious, so relying on static threshold may easily miss the report. While some normal network fluctuations (such as sudden data transmission demand) may be misjudged as attacks due to instantaneous flow growth, resulting in high false alarm rate.

[0003] The application with publication number CN118427837A discloses a software platform safe running state monitoring system and method based on cloud computing, relating to the technical field of data processing. The system obtains data based on an internal server, extracts double-end information through a collection module and an environment monitoring module, pre-processes the extracted data, configures and trains a model based on the pre-processed data using a deep reinforcement learning module, outputs a strategy based on the configured model, realizes adaptive security monitoring and response through the deep reinforcement learning module, and realizes automatic judgment and execution of security decisions based on an action judgment module. At the same time, the system realizes data quality and accuracy through a pre-processing module, avoids the technical problem that conventional systems are difficult to adapt to changing security threats in a timely manner by using static rules or adjusting parameters, avoids the use problem that it is difficult to realize real-time judgment of security problems, and solves the subsequent problem that security vulnerabilities are not found.

[0004] The prior art lacks correlation analysis of attack features, and most of them only match single-time flow values or isolated attack features, ignoring the trend and continuity of flow changes. For example, some attacks will show a specific flow climbing rule, and the traditional method is difficult to capture this dynamic trend feature, resulting in the inability to accurately lock the complete period of attack occurrence. SUMMARY

[0005] To overcome the shortcomings of the prior art, the present application provides a software running state monitoring method based on software safe running, which solves the problem of matching only single-time flow values or isolated attack features, ignoring the trend and continuity of flow changes.

[0006] To achieve the above purpose, the present application realizes the following technical scheme: a software running state monitoring method based on software safe running, comprising the following steps:

[0007] Step one, confirm the attack characteristics recorded in the history process by the current software, and confirm the trend from the recorded attack characteristics, lock the trend characteristics associated with the attack characteristics, the specific way is:

[0008] Confirm the network interaction traffic associated with the attack characteristics, and mark the network interaction traffic associated with adjacent time as L1 and L2, wherein L1 is the network traffic of the previous time, L2 is the network traffic of the next time, and the difference Cz associated with the network interaction traffic of adjacent time is confirmed by Cz=(L2-L1);

[0009] From the several differences Cz associated with the network interaction traffic, select the minimum value and the maximum value, and generate the trend interval belonging to the trend characteristics associated with the current attack characteristics based on the locked minimum value and the maximum value, and take this trend interval as the trend characteristics associated with the corresponding attack characteristics;

[0010] The same processing method is used again to confirm the trend characteristics associated with different attack characteristics in turn;

[0011] Step two, real-time monitor the interaction traffic generated in the running interaction process of the current software, and confirm the change characteristics of the interaction traffic, and lock the interaction abnormal traffic segment according to the confirmation result, the specific way is:

[0012] According to the interaction traffic generated in real time in the interaction process, confirm the flow variable value associated with adjacent time, which is the difference between the interaction flow of the next time and the interaction flow of the previous time;

[0013] Compare the real-time confirmed flow variable value with the preset threshold value: if the flow variable value is greater than the preset threshold value, generate a clipping signal, otherwise, continue to monitor;

[0014] According to the generated clipping signal, confirm the corresponding time, mark the network traffic point associated with the corresponding time as the starting point, and select the traffic segment from the starting point, determine the subsequent continuously rising traffic segment from the starting point, and take the determined traffic segment as the determined interaction abnormal traffic segment;

[0015] Step three, according to the determined interaction abnormal traffic segment and the trend characteristics associated with the attack characteristics, identify whether the interaction abnormal traffic segment has associated attack characteristics, and then synchronize and verify the interaction abnormal traffic segment and the network traffic associated with the attack characteristics, identify whether the current interaction data is attack data, the specific way is:

[0016] Identify the traffic variations associated with adjacent moments in the determined interactive abnormal traffic segment, perform mean processing on the confirmed traffic variations, determine the feature mean, and then compare the confirmed feature mean with the trend features associated with different attack features: Attack features that satisfy the feature mean ∈ trend feature are recorded as pending features, otherwise, no confirmation is performed;

[0017] The specific methods to determine whether the currently interacted data is attack data are:

[0018] According to the trend characteristics associated with the pending features, an identification segment is selected from the interactive abnormal flow segments, the flow variation value associated with the current interactive abnormal flow segment is confirmed, the flow segment with the flow variation value∈trend characteristics is determined, and the determined flow segment is marked as the identification segment, and different identification segments associated with different pending features are locked;

[0019] According to the different network interaction flows associated with different pending features, a network interaction flow change curve belonging to the corresponding pending features is generated, the determined identification segment is placed in the coordinate system of the network interaction flow change curve, and the identification segment is controlled to move back and forth. The overlapped segments generated by the identification segment and the network interaction flow change curve during the movement process are calibrated, and the overlap ratio CH associated with different movement processes is recorded. k , where k represents different mobile processes, CH k = Total length of overlap section ÷ Total length of identification section, identifying the number of overlap ratios CH k Is there a single CH k Meet: CH k ≥90%, if it exists, the associated pending feature is directly used as the confirmed feature, and the attack signal belonging to the confirmed feature is generated, and the currently interacted data is marked as the attack data for display. If it does not exist, the attack confirmation is performed on other pending features. If all the coincidence ratios of all the pending features associated with CH k None of them meet CH k If the value is ≥90%, a secondary check is performed on the currently confirmed abnormal interactive traffic segment;

[0020] Step 4: Based on the identified abnormal interaction traffic segment, confirm the target object that the current software is interacting with, identify whether the abnormal interaction traffic segment exists based on the historical interaction characteristics, and based on the identification results, determine whether a buffer test is required for the interaction data to assess whether the interaction data is attack data. The specific method is as follows:

[0021] Confirm the target object associated with the abnormal interaction traffic segment, confirm the different interaction processes associated with the current software and the corresponding target object in the historical interaction process, and confirm the network traffic associated with each group of different interaction processes to identify the network traffic change segment of each different interaction process;

[0022] Comparing and checking the interaction abnormal traffic segment with different network traffic change segments: the interaction abnormal traffic segment is placed in the coordinate system of the network traffic change segment, and the interaction abnormal traffic segment is controlled to move forward and backward, according to the specific moving processing process, whether the interaction abnormal traffic segment exists completely same consistent overlapping segment is identified, if exists, it represents that the current interaction abnormal traffic segment appears in the historical processing process, then any processing is not needed, attack confirmation is not needed, if not exists, the interaction data associated with the interaction abnormal traffic segment is confirmed, and the confirmed interaction data is subjected to buffer test processing:

[0023] The interaction data is read and written, and the initial time and the end time of reading and writing are recorded, and other interaction data cannot be read and written in the reading and writing process, after reading and writing are completed, the number G1 of the registry tables that need to be newly added in the reading and writing period of the current Internet of Things device is confirmed, and the number G2 of the registry tables generated by the interaction data in the reading and writing period is confirmed;

[0024] If G1 is not equal to G2, the interaction data is marked as attack data, and is displayed through the associated display end, and the registry tables newly added in the reading and writing period of the current Internet of Things device are synchronously deleted;

[0025] If G1 is equal to G2, normal interaction is performed.

[0026] The application provides a software running state monitoring method based on software safe running. Compared with the prior art, the following beneficial effects are achieved:

[0027] By calculating the flow difference value of adjacent moments and generating a trend interval, a unique "behavior fingerprint" is constructed for different attack characteristics, so that potential attack types can be quickly matched from abnormal traffic in monitoring, invalid analysis of irrelevant traffic is reduced, and attack identification is more targeted;

[0028] Through the multi-layer verification process of "feature mean comparison, segment locking and curve coincidence degree analysis", not only the pending attack characteristics can be quickly screened out, but also the recognition segment is moved and compared in the traffic change curve, the matching degree is quantified by the coincidence ratio, the accuracy of attack characteristic identification is greatly improved. At the same time, combined with the secondary verification of historical interaction characteristics, the abnormal traffic appearing for the first time is subjected to buffer test, and the data safety is judged by the generation of the registry table, which not only avoids the misjudgment of known normal fluctuations, but also effectively identifies new attack data, realizes the dual goals of "reducing false positives" and "covering unknown threats";

[0029] From the historical feature extraction to the real-time traffic monitoring, to the anomaly identification and security response (such as deleting the abnormal registry), a complete security monitoring closed loop is formed; not only can the attack behavior be found in time, but also the attack process can be directly blocked through the calibration and processing of the attack data, so as to prevent data leakage or system damage, and provide full-cycle and multi-level protection for the safe and stable operation of the software. BRIEF DESCRIPTION OF DRAWINGS

[0030] Figure 1 It is a flowchart of the method of the application. DETAILED DESCRIPTION

[0031] The technical solutions in the embodiments of the application will be clearly and completely described below with reference to the drawings in the embodiments of the application. Obviously, the described embodiments are only part of the embodiments of the application, rather than all the embodiments. Based on the embodiments in the application, all other embodiments obtained by those skilled in the art without creative labor fall within the scope of protection of the application.

[0032] Please refer to Figure 1 The application provides a software running state monitoring method based on software security operation, comprising the following steps:

[0033] Step one, confirming the attack features recorded in the historical process of the current software, and confirming the trend features associated with the attack features from the recorded attack features, specifically, when the attack features exist, the corresponding software will appear traffic mutation in the data interaction process, and the associated traffic change trend will also appear large changes, so the trend features can be confirmed according to the change trend;

[0034] The specific way of locking the trend features is:

[0035] Confirm the network interaction traffic associated with the attack features, and mark the network interaction traffic associated with adjacent time as L1 and L2, wherein L1 is the network traffic of the previous time, L2 is the network traffic of the next time, and the difference Cz associated with the network interaction traffic of adjacent time is confirmed by Cz=(L2-L1);

[0036] From the several differences Cz associated with the network interaction traffic, the minimum value and the maximum value are selected, and based on the locked minimum value and the maximum value, the trend interval belonging to the trend features associated with the current attack features is generated, and the trend interval is taken as the trend features associated with the corresponding attack features;

[0037] The trend features associated with different attack features are confirmed in turn by using the same processing method as above;

[0038] Specifically, different network traffic features exist for different attack features. According to the change of the corresponding network traffic features, the change trend between adjacent time points can be locked, and based on the associated change trend, the corresponding trend interval can be quickly confirmed, facilitating subsequent traffic interaction monitoring.

[0039] Step two, real-time monitoring of the interaction traffic generated during the running of the current software, and confirming the change characteristics of the interaction traffic. According to the confirmation result, the interaction abnormal traffic segment is locked. Specifically, the so-called interaction abnormal traffic segment is also the specific traffic segment of abnormal increase. Under normal circumstances, the traffic during the interaction process should be relatively stable. If there is an abnormal increase, it means that the corresponding traffic segment is an abnormal segment and needs to be compared and verified subsequently.

[0040] The specific way to lock the interaction abnormal traffic segment is as follows:

[0041] According to the interaction traffic generated in real time during the interaction process, the traffic variable value associated with adjacent time points is confirmed. The traffic variable value is the difference between the interaction traffic at the next time point and the interaction traffic at the previous time point. The traffic difference = the interaction traffic at the next time point - the interaction traffic at the previous time point.

[0042] Compare the real-time confirmed traffic variable value with the preset threshold value: if the traffic variable value > the preset threshold value, generate a clipping signal, otherwise, continue to monitor.

[0043] According to the generated clipping signal, the corresponding time is confirmed, the network traffic point associated with the corresponding time is recorded as the starting point, and the traffic segment selection starts from the starting point. From the starting point, the subsequent continuously rising traffic segment is determined, and the determined traffic segment is taken as the determined interaction abnormal traffic segment. Specifically, the so-called interaction abnormal traffic segment is the continuously rising traffic segment starting from the corresponding starting point. The continuously rising traffic segment is the traffic segment with abnormal traffic change, which facilitates subsequent feature determination and identification of whether the interaction abnormal traffic segment associated with the corresponding time is an attack feature.

[0044] Step three, according to the determined interaction abnormal traffic segment and the trend feature associated with the attack feature, identify whether the interaction abnormal traffic segment has the associated attack feature, and then synchronize the interaction abnormal traffic segment and the network traffic associated with the attack feature to verify whether the current interaction data is attack data.

[0045] The specific way to identify the attack feature associated with the interaction abnormal traffic segment is as follows:

[0046] Identify the traffic variable associated with adjacent moments from the determined interactive abnormal traffic segment, then process the confirmed traffic variable by averaging, confirm the feature mean, and compare the confirmed feature mean with the trend feature associated with different attack features: the attack feature that satisfies the feature mean ∈ trend feature is recorded as a pending feature, otherwise, no confirmation is made;

[0047] According to the trend feature associated with the pending feature, select the identification segment from the interactive abnormal traffic segment, confirm the traffic variable associated with the current interactive abnormal traffic segment, determine the traffic segment with traffic variable ∈ trend feature, and mark the determined traffic segment as the identification segment, and lock different identification segments associated with different pending features;

[0048] According to different network interaction traffic associated with different pending features, generate network interaction traffic change curve belonging to the corresponding pending feature, the horizontal coordinate axis of the corresponding curve is the time line, and the vertical coordinate axis is the network interaction traffic. Place the identified segment in the coordinate system of the network interaction traffic change curve, and control the identification segment to move forward and backward, mark the overlapping segment generated by the identification segment and the network interaction traffic change curve in the moving process, and record the overlapping ratio CH k associated with different moving processes, where k represents different moving processes, CH k = total length of overlapping segment ÷ total length of identification segment, identify the confirmed several overlapping ratios CH k Whether there is a single CH k satisfies: CH k ≥ 90%, if there is, then directly take the associated pending feature as the determined feature, generate the attack signal belonging to the determined feature, and mark the currently interacted data as attack data for display, if there is not, then confirm the attack of other pending features, if all overlapping ratios CH k associated with all pending features do not satisfy CH k ≥ 90%, then perform secondary verification on the currently confirmed interactive abnormal traffic segment to achieve the optimal verification process and identify whether the currently associated interactive abnormal traffic segment is attack traffic;

[0049] Specifically, each different attack feature has different traffic features. When the traffic feature has a huge change, the corresponding interactive abnormal traffic segment is generated. Then the generated interactive abnormal traffic segment and the determined pending feature are verified. From the specific verification process, the trend of the corresponding pending feature associated with the corresponding trend interval can be identified from the corresponding traffic segment. Then the traffic segments associated with different partial segments are compared and verified to confirm whether the corresponding traffic segment is a normal change segment or an abnormal change segment, and the attack feature is locked and displayed in time.

[0050] Step four, according to the calibrated interaction abnormal traffic segment, confirm the target object of the current software interaction, identify whether the interaction abnormal traffic segment exists from the historical characteristics of the interaction, and judge whether the interaction data needs to be buffered based on the identification result, and evaluate whether the interaction data is attack data;

[0051] Wherein, the specific way to identify whether the interaction abnormal traffic segment exists is:

[0052] Confirm the target object associated with the interaction abnormal traffic segment, and confirm the different interaction processes associated with the corresponding target object in the historical interaction process of the current software and the corresponding target object, and confirm the network traffic associated with each group of different interaction processes to lock the network traffic change segment of each different interaction process;

[0053] Compare and verify the interaction abnormal traffic segment and different network traffic change segments: place the interaction abnormal traffic segment in the coordinate system of the network traffic change segment, and control the interaction abnormal traffic segment to move forward and backward, identify whether there is a completely identical overlapping segment according to the specific moving process, if there is, it means that the current interaction abnormal traffic segment has appeared in the historical processing process, then no further processing is needed, and no attack confirmation is needed, if there is not, the interaction data associated with the interaction abnormal traffic segment is confirmed, and the confirmed interaction data is buffered for testing:

[0054] Read and write this interaction data, record the initial time and the end time of reading and writing, and other interaction data cannot be read and written during the reading and writing process, after reading and writing is completed, confirm the number of registry G1 that needs to be added in this reading and writing period of the Internet of Things device (that is, a numerical standard, which can be directly confirmed from the associated interaction protocol), and then confirm the number of registry G2 generated by the interaction data in the reading and writing period;

[0055] If G1=G2, it means that there is no abnormal registry or split registry in this interaction data, and this interaction data may be caused by network fluctuations or other abnormal situations, and such interaction data has no problem and can be normally interacted, if G1≠G2, the interaction data is marked as attack data, and is displayed through the associated display terminal, and the newly added registry of the Internet of Things device in this reading and writing period is deleted synchronously, to avoid the Internet of Things being attacked by interaction data or causing data leakage, and to protect the data security of the Internet of Things device, specifically, when the corresponding interaction data is abnormal, the Internet of Things device will permit and identify the generated registry, if the registry is permitted, it means that the corresponding data is correct, but some attack data will tamper or split the registry after permission, forming a new registry, and based on the specific data in the registry, related attacks are carried out, causing data loss or software self-starting behavior and situation.

[0056] Some data in the above formula are dimensionless in numerical calculation, and the contents not described in detail in the specification are all prior art known to those skilled in the art.

[0057] The above examples are only used to illustrate the technical method of the present application and not to limit it. Although the present application is described in detail with reference to the preferred embodiments, those skilled in the art should understand that the technical method of the present application can be modified or replaced equivalently without departing from the spirit and scope of the technical method of the present application.

Claims

1. A software operation status monitoring method based on software safe operation, characterized in that: The following steps are involved: Step 1: Confirm the attack features recorded by the current software in the historical process, confirm the trend from the recorded attack features, and lock the trend features associated with the attack features; Step 2: Monitor the interactive traffic generated by the current software in real time during operation, identify the changing characteristics of the interactive traffic, and identify the abnormal interactive traffic segment based on the identification results; Step 3: Based on the determined abnormal interaction traffic segment and the trend characteristics associated with the attack characteristics, identify whether the abnormal interaction traffic segment has the associated attack characteristics, and then synchronously verify the abnormal interaction traffic segment with the network traffic associated with the attack characteristics to identify whether the current interaction data is attack data; Step 4: Based on the marked abnormal interaction traffic segment, confirm the target object with which the current software interacts, identify whether the abnormal interaction traffic segment exists from the historical characteristics of the interaction, and based on the identification results, determine whether a buffer test is required for the interaction data and assess whether the interaction data is attack data.

2. The software operation status monitoring method based on software safe operation according to claim 1 is characterized in that: In step 1, the specific method of locking the trend feature is: Confirm the network interaction traffic associated with the attack signature and mark the network interaction traffic associated with adjacent moments as L1 and L2, where L1 is the network traffic at the previous moment and L2 is the network traffic at the next moment. Use Cz = (L2 - L1) to determine the difference Cz associated with the network interaction traffic at adjacent moments. Selecting a minimum and a maximum value from a plurality of difference values ​​Cz associated with network interaction traffic, generating a trend interval associated with the current attack signature based on the locked minimum and maximum values, and using this trend interval as the trend signature associated with the corresponding attack signature; Then, the same processing method as above is used to confirm the trend features associated with different attack features in turn.

3. The software operation status monitoring method based on software safe operation according to claim 1 is characterized in that: In step 2, the specific method of locking the abnormal interactive traffic segment is: Based on the real-time interactive traffic generated during the interaction process, the traffic change values ​​associated with adjacent moments are determined. The traffic change value is the difference between the interactive traffic at the next moment and the interactive traffic at the previous moment. Compare the real-time confirmed flow rate change value with the preset threshold value: if the flow rate change value is greater than the preset threshold value, an interception signal is generated; otherwise, continuous monitoring is performed; Based on the intercepted signal generated, the corresponding moment is confirmed, the network traffic point associated with the corresponding moment is recorded as the starting point, and the traffic segment is selected from the starting point. The subsequent traffic segment that continues to climb from the starting point is determined, and the determined traffic segment is used as the determined interactive abnormal traffic segment.

4. The software operation status monitoring method based on software safe operation according to claim 1 is characterized in that: In step 3, the specific method for identifying the attack characteristics associated with the abnormal interactive traffic segment is: Identify the traffic variation values ​​associated with adjacent moments from the determined interactive abnormal traffic segment, perform mean processing on the confirmed traffic variation values, determine the feature mean, and then compare the confirmed feature mean with the trend features associated with different attack features: the attack feature that satisfies the feature mean ∈ trend feature is recorded as the pending feature. Otherwise, no confirmation is performed.

5. The software operation status monitoring method based on software safe operation according to claim 4 is characterized in that: In step 3, the specific method of identifying whether the currently interacted data is attack data is as follows: According to the trend characteristics associated with the pending features, an identification segment is selected from the interactive abnormal flow segments, the flow variation value associated with the current interactive abnormal flow segment is confirmed, the flow segment with the flow variation value∈trend characteristics is determined, and the determined flow segment is marked as the identification segment, and different identification segments associated with different pending features are locked; According to the different network interaction flows associated with different pending features, a network interaction flow change curve belonging to the corresponding pending features is generated, the determined identification segment is placed in the coordinate system of the network interaction flow change curve, and the identification segment is controlled to move back and forth. The overlapped segments generated by the identification segment and the network interaction flow change curve during the movement process are calibrated, and the overlap ratio CH associated with different movement processes is recorded. k , where k represents different mobile processes, CH k = Total length of overlap section ÷ Total length of identification section, identifying the number of overlap ratios CH k Is there a single CH k Meet: CH k ≥90%, if it exists, the associated pending feature is directly used as the confirmed feature, and the attack signal belonging to the confirmed feature is generated, and the currently interacted data is marked as the attack data for display. If it does not exist, the attack confirmation is performed on other pending features. If all the coincidence ratios of all the pending features associated with CH k None of them meet CH k If the value is ≥90%, a secondary check will be performed on the currently confirmed abnormal interactive traffic segment.

6. The software operation status monitoring method based on software safe operation according to claim 1 is characterized in that: In step 4, the specific method of identifying whether an abnormal interactive traffic segment exists is: Confirm the target object associated with the abnormal interaction traffic segment, confirm the different interaction processes associated with the current software and the corresponding target object in the historical interaction process, and confirm the network traffic associated with each group of different interaction processes to identify the network traffic change segment of each different interaction process; Compare and verify the abnormal interactive traffic segment with different network traffic change segments: place the abnormal interactive traffic segment in the coordinate system where the network traffic change segment is located, and control the abnormal interactive traffic segment to move back and forth. According to the specific movement processing process, identify whether there are completely identical overlapping segments in the abnormal interactive traffic segment. If so, it means that the current abnormal interactive traffic segment has appeared in the historical processing process, then no processing is required, and no attack confirmation is required. If not, confirm the interactive data associated with the abnormal interactive traffic segment, and perform buffer test processing on the confirmed interactive data.

7. The software running status monitoring method based on software safe operation according to claim 6 is characterized in that: The buffer test processing process of the interactive data includes: Read and write this interactive data, and record the start and end time of reading and writing. No other interactive data can be read or written during the reading and writing process. After reading and writing are completed, confirm the number of registration tables G1 that this IoT device needs to add during this reading and writing period, and then confirm the number of registration tables G2 generated by this interactive data during the reading and writing period; If G1≠G2, this interactive data is marked as attack data and displayed through the associated display terminal, and the registry newly added by this IoT device during this reading and writing period is deleted simultaneously.

8. The software running status monitoring method based on software safe operation according to claim 7 is characterized in that: If G1=G2, normal interaction is performed.

Images