A method, system and device for processing server alarms

Abstract

The present invention discloses a method, system and device for processing server alarms. The method obtains first alarm information when a server accesses a malicious domain name, and determines whether a first virus program corresponding to the first alarm information exists in the server through the first alarm information. When it is determined that the first virus program exists in the server, it is determined whether the first virus program poses a threat. If it is determined that the first virus program poses a threat, the first virus program is cleared. There is no need for staff to process security alarm information, which improves the efficiency of processing alarm information and prevents omissions.

Description

Technical Field

[0001] The present invention relates to the field of network information security, and in particular to a method, system and device for processing server alarms. Background Art

[0002] When hackers can use virus programs to make servers access malicious domain names, when the server accesses the malicious domain name, the malicious domain name will obtain the address of the server, and then transmit malicious code to the server to steal information in the server, causing user information leakage and property loss. The big data security analysis system will generate security alarm information when it detects that a server has accessed a malicious domain name. In order to judge the threat of security alarm information, the existing technology usually requires staff to judge the threat of the security alarm information based on factors such as the alarm start time, alarm duration, and impact range in the security alarm information, and then the staff selects a method for processing the security alarm information based on the threat. When a large number of security alarm information appears, the staff cannot process all the security alarm information in a timely manner, and the efficiency of processing the alarm information is low, which may cause hackers to successfully steal information in the server. In addition, since the staff will become tired after processing the security alarm information for a long time, it may cause the omission of security alarm information. Summary of the invention

[0003] The purpose of the present invention is to provide a method, system and device for processing server alarms, which can eliminate the need for staff to process security alarm information, improve the efficiency of processing alarm information, and avoid omissions.

[0004] In order to solve the above technical problems, the present invention provides a method for processing server alarms, which is applied to a processor and includes:

[0005] Obtain the first warning information generated when the server accesses a malicious domain name;

[0006] Determining whether a first virus program corresponding to the first warning information exists in the server;

[0007] If the first virus program exists in the server, determining whether the first virus program is a threat;

[0008] If the first virus program is a threat, the first virus program is removed.

[0009] Preferably, determining whether a first virus program corresponding to the first warning information exists in the server includes:

[0010] Obtaining the five-tuple in the first alarm information;

[0011] Determine whether a process name corresponding to the five-tuple in the server is obtained;

[0012] If so, it is determined that the first virus program corresponding to the first alarm information exists in the server.

[0013] Preferably, determining whether the first virus program poses a threat includes:

[0014] Determining a first identification value of the first virus program;

[0015] Determine whether the first identification value exists in a preset identification value library;

[0016] If so, it is determined that the first virus program is a threat.

[0017] Preferably, if the first virus program does not exist in the server, the method further includes:

[0018] Obtaining second identification values ​​of N designated programs in the server, where N is an integer not less than 2;

[0019] Determine whether a second identification value among the N second identification values ​​exists in the preset identification value library;

[0020] If a second identification value among the N second identification values ​​exists in the preset identification value library, the second virus program corresponding to the second identification value existing in the preset identification value library is cleared.

[0021] Preferably, if none of the N second identification values ​​exist in the preset identification value library, the method further includes:

[0022] Obtaining log information of the server within a first preset time period;

[0023] Determine whether there is second alarm information generated when the server conducts a lateral attack on the intranet in the log information;

[0024] If the second alarm information exists in the log information, the server is taken offline.

[0025] Preferably, if the second alarm information does not exist in the log information, the method further includes:

[0026] When receiving the warning no-misjudgment instruction sent by the user, the server is blocked from accessing the malicious domain name.

[0027] Preferably, if the first virus program does not pose a threat, the method further includes:

[0028] Obtaining the number of times the server accesses the malicious domain name within a second preset time period;

[0029] Determine whether the number of times is greater than a preset number of times;

[0030] If yes, proceed to the step of obtaining the second identification values ​​of N designated programs in the server;

[0031] If not, it is determined that the first warning information is a false positive.

[0032] Preferably, clearing the first virus program includes:

[0033] Ending the task of the first virus program;

[0034] Obtaining a backup file of the first virus program;

[0035] Delete the first virus program.

[0036] The present invention also provides a server alarm processing system, comprising:

[0037] A first alarm information acquisition unit, used to acquire first alarm information generated when the server accesses a malicious domain name;

[0038] A first virus program determination unit, configured to determine whether a first virus program corresponding to the first alarm information exists in the server; if the first virus program exists in the server, triggering a threat determination unit;

[0039] The threat judgment unit is used to judge whether the first virus program poses a threat; if the first virus program poses a threat, the first virus program removal unit is triggered;

[0040] The first virus program clearing unit is used to clear the first virus program.

[0041] The present invention also provides a server alarm processing device, comprising:

[0042] Memory for storing computer programs;

[0043] A processor is used to implement the steps of the above-mentioned server alarm processing method when executing the computer program.

[0044] The present invention provides a method, system and device for processing server alarms. The method obtains first alarm information when a server accesses a malicious domain name, and determines whether a first virus program corresponding to the first alarm information exists in the server through the first alarm information. When it is determined that the first virus program exists in the server, it is determined whether the first virus program poses a threat. If it is determined that the first virus program poses a threat, the first virus program is cleared. This eliminates the need for staff to process security alarm information, improves the efficiency of processing alarm information, and prevents omissions. BRIEF DESCRIPTION OF THE DRAWINGS

[0045] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the prior art and the drawings required for use in the embodiments are briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0046] Figure 1 A flowchart of a method for processing server alarms provided by the present invention;

[0047] Figure 2 A schematic diagram of the structure of a server alarm processing system provided by the present invention;

[0048] Figure 3 A schematic diagram of the structure of a server alarm processing device provided by the present invention. DETAILED DESCRIPTION

[0049] The core of the present invention is to provide a method, system and device for processing server alarms, which can eliminate the need for staff to process security alarm information, improve the efficiency of processing alarm information, and avoid omissions.

[0050] In order to make the purpose, technical solution and advantages of the embodiments of the present invention clearer, the technical solution in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0051] Please refer to Figure 1 , Figure 1 A flowchart of a method for processing a server alarm provided by the present invention is applied to a processor, and the method includes:

[0052] S11: Obtaining the first alarm information generated when the server accesses a malicious domain name;

[0053] S12: Determine whether there is a first virus program corresponding to the first warning information in the server;

[0054] S13: If the first virus program exists in the server, determine whether the first virus program is a threat;

[0055] S14: If the first virus program is a threat, the first virus program is removed.

[0056] Taking into account the low efficiency of staff in processing the first alarm information and the inability to process all the first alarm information in a timely manner, in this embodiment, the first alarm information generated by the server when accessing the malicious domain name is first obtained, and it is determined whether the first virus program corresponding to the first alarm information exists in the server. When it is determined that the first virus program exists, it is then determined whether the first virus program poses a threat. When it is determined that a threat exists, the first virus program is cleared.

[0057] Specifically, when accessing a domain name, the server generates a piece of information. First, the server obtains the piece of information and compares it with the known malicious domain name information. If the piece of information is the same as the known malicious domain name information, it is determined that the server has accessed the malicious domain name and the piece of information is used as the first alarm information. Based on the first alarm information, it is determined whether there is a program corresponding to the first alarm information in the server. Since the program corresponding to the first alarm information is unique, when the program corresponding to the first alarm information exists in the server, it means that the program is the first virus program that enables the server to access the malicious domain name. Finally, it is determined whether the first virus program is a threat and the first virus program is compared with the known first virus program. If the first virus program is the same as the known first virus program, the first virus program is a threat, and the first virus program is cleared to complete the processing of the first virus program.

[0058] In addition, in this embodiment, a piece of information generated by the server when accessing a domain name can be directly obtained, or information in an information database storing this piece of information can be obtained, and this application does not limit this.

[0059] To summarize, by obtaining the first alarm information when the server accesses a malicious domain name, it is determined through the first alarm information whether there is a first virus program corresponding to the first alarm information in the server; when it is determined that the first virus program exists in the server, it is determined whether the first virus program poses a threat; if it is determined that the first virus program poses a threat, the first virus program is cleared, which eliminates the need for staff to process security alarm information, improves the efficiency of processing alarm information, and prevents omissions.

[0060] Based on the above embodiments:

[0061] As a preferred embodiment, determining whether a first virus program corresponding to the first warning information exists in the server includes:

[0062] Obtain the five-tuple in the first alarm information;

[0063] Determine whether the process name corresponding to the five-tuple in the server is obtained;

[0064] If so, it is determined that a first virus program corresponding to the first warning information exists in the server.

[0065] In order to be able to simply and directly determine whether there is a first virus program corresponding to the first alarm information in the server, in this embodiment, firstly, the quintuple in the first alarm information is obtained, and then it is determined whether there is a process name corresponding to the first alarm information in the server based on the quintuple. When it is determined that there is a process name corresponding to the first alarm information during the service period, it is determined that the first virus program exists.

[0066] Specifically, first obtain the quintuple in the first alarm information. Since the quintuple can reflect the connection relationship between the two terminals, and the connection relationship is unique, when the server accesses the malicious domain name, the quintuple is also unique, and can simply and directly reflect the information of the virus program corresponding to the first alarm information. The quintuple includes the source IP address, source port, destination IP address, destination port and transport layer protocol. For example, the quintuple in the first alarm information is 192.168.1.1, 8832, 255.255.1.1, 80 and TCP, which means that the IP address of the process in the server is 192.168.1.1, and the TCP protocol is used to connect to the 80 port of the other terminal with the IP address of 255.255.1.1 through port 8832. Then, you can, but are not limited to, execute the netstat-ano command through the five-tuple linkage antivirus software, first obtain the usage of all ports in the server, then obtain the information of occupied ports among all ports, and obtain the process name corresponding to the five-tuple by comparing the information of occupied ports with the five-tuple. The process of obtaining the five-tuple requires that a long connection is maintained between the server and the malicious domain name. Because when the relationship between the server and the malicious domain name is a short connection, the connection between the server and the malicious domain name will be disconnected after the data exchange is completed, and there is no connection relationship, and there may be a situation where the five-tuple cannot be obtained. Therefore, before obtaining the first virus program corresponding to the first alarm information, it is necessary to first determine whether the process name corresponding to the five-tuple can be obtained. Only when the corresponding process name is obtained, it will be determined that the first virus program corresponding to the first alarm information exists in the server.

[0067] In addition, the quintuple-linked antivirus software may be AiGent or other software that can implement the antivirus software function, and this application does not limit this.

[0068] In summary, by obtaining the five-tuple in the first warning information and determining whether the process name corresponding to the five-tuple can be obtained to obtain the first virus program corresponding to the first warning information, the first virus program can be found simply and directly.

[0069] As a preferred embodiment, determining whether the first virus program is a threat includes:

[0070] Determining a first identification value of a first virus program;

[0071] Determine whether the first identification value exists in a preset identification value library;

[0072] If so, it is determined that the first virus program is a threat.

[0073] In order to avoid mistakenly deleting a harmless program by identifying it as a first virus program, in this embodiment, before clearing the first virus program, it is necessary to first determine the first identification value of the first virus program and judge whether the first identification value exists in a preset identification value library. If so, it is determined that the first virus program poses a threat.

[0074] Specifically, since the first identification value corresponding to each program is unique and there are no multiple programs corresponding to the same first identification value, after determining the first identification value of the first virus program, only when it is determined that the first identification value exists in the preset identification value library, will the first virus program be determined to be a threat, and other harmless programs will not be determined to be threats. For example, in this embodiment, it can be but not limited to linking the anti-virus software to execute the certutil-hashfilefilename instruction to determine the MD5 value in the first virus program through the MD5 information digest algorithm, and then compare the MD5 value of the first virus program with the MD5 value in the preset identification value library to determine whether the MD5 value of the first virus program exists in the preset identification value library. Since the MD5 value of each program is unique, when the harmless program is determined to be the first virus program, since the MD5 value of the harmless program does not exist in the preset identification value library, it will not be determined that the harmless program is a threat.

[0075] As a preferred embodiment, if the first virus program does not exist in the server, the method further includes:

[0076] Obtain second identification values ​​of N specified programs in the server, where N is an integer not less than 2;

[0077] Determine whether there is a second identification value among the N second identification values ​​in a preset identification value library;

[0078] If a second identification value among the N second identification values ​​exists in the preset identification value library, the second virus program corresponding to the second identification value existing in the preset identification value library is cleared.

[0079] Taking into account that some first virus programs will use short connections to connect malicious domain names to the server, in order to find the first virus program using short connections, in this embodiment, when the process name corresponding to the five-tuple in the first alarm information cannot be obtained, the second identification values ​​of N specified programs in the server will be obtained, and then it will be determined one by one whether one or more of these second identification values ​​exist in the preset identification value library. When there is one or more second identification values ​​in the preset identification value library, the program corresponding to the second identification value is regarded as the second virus program, and finally the second virus program is cleared. For example, in this application, it is possible but not limited to obtaining the MD5 values ​​of N specified programs in the server, and comparing the MD5 values ​​of the N specified programs with the preset identification value library one by one to determine whether one or more of the MD5 values ​​of the programs exist in the preset identification value library. If so, the program corresponding to the MD5 value in the preset identification value library is determined to be the second virus program, and finally the second virus program is cleared.

[0080] In addition, in this embodiment, the N specified programs may be all programs in the server, or may be all programs under a specified path or other user-specified programs, and this application does not limit this.

[0081] In summary, by obtaining the second identification values ​​of N designated programs in the server to determine whether the second virus program exists in the server, the second virus program that uses a short connection to connect a malicious domain name to the server can be removed.

[0082] As a preferred embodiment, if none of the N second identification values ​​exist in the preset identification value library, the method further includes:

[0083] Obtaining log information of the server within a first preset time period;

[0084] Determine whether there is a second alarm information generated when the server conducts a lateral attack on the intranet in the log information;

[0085] If the second alarm information exists in the log information, the server is taken offline.

[0086] Taking into account that some first virus programs may cause the server to conduct lateral attacks on other servers in the intranet, in order to quickly block lateral attacks on the intranet, in this embodiment, when the second identification values ​​of N specified programs in the server do not exist in the preset identification value library, the log information of the server within the first preset time period will be obtained. If the log information contains the second alarm information generated when the server conducts a lateral attack on the intranet, it means that the first virus program that can cause the server to conduct a lateral attack on the intranet exists in the server. At this time, the server is taken offline and the connection between the server and other servers is disconnected.

[0087] In addition, the first preset time period can be a time period of a preset length with the time point when the first alarm information is obtained as the time end point, or it can be a time period of a preset length at any time node specified by the user, and this application is not limited here.

[0088] In summary, when it is determined that the second alarm information exists in the log information, the server will be directly taken offline, eliminating the time spent on searching and deleting the virus first, and can quickly block the intranet lateral attack behavior and avoid the expansion of the impact of the intranet lateral attack.

[0089] As a preferred embodiment, if the second alarm information does not exist in the log information, the method further includes:

[0090] When receiving the warning instruction sent by the user without misjudgment, the server is blocked from accessing the malicious domain name.

[0091] Taking into account that some first virus programs have high anti-reconnaissance technology, it takes a lot of time to find such first virus programs. In order to avoid taking too long to find the first virus program, which may cause hackers to successfully steal information from the server, in this embodiment, when the alarm sent by the user is received without misjudgment, the server's access to the malicious domain name is blocked, avoiding the situation where it takes a lot of time to find the first virus program and the hackers successfully steal information from the server.

[0092] As a preferred embodiment, if the first virus program does not pose a threat, the method further includes:

[0093] Obtaining the number of times the server accesses the malicious domain name within a second preset time period;

[0094] Determine whether the number of times is greater than the preset number of times;

[0095] If yes, proceed to the step of obtaining the second identification values ​​of N designated programs in the server;

[0096] If not, it is determined that the first warning information is a false positive.

[0097] In order to further determine whether there is a program in the server that can cause the server to access a malicious domain name, in this embodiment, when the first virus program does not pose a threat, the number of times the server accesses the malicious domain name within a second preset time period is obtained. If the number of times the malicious domain name is accessed within the second preset time period is greater than the preset number, it means that the server has accessed the malicious domain name multiple times within the second preset time period, and there is an act of deliberately accessing the malicious domain name, and the malicious domain name is not accessed by mistake. At this time, the step of obtaining the second identification values ​​of N specified programs in the server is entered to determine whether there is a program in the server that causes the server to access the malicious domain name. If the number is less than the preset number, it means that the server may have accessed the malicious domain name due to user error, and there is no program that can cause the server to access the malicious domain name. At this time, it is determined that the first alarm information is a false positive.

[0098] In addition, the first preset time period can be a time period of a preset length with the time point when the first alarm information is obtained as the time end point, or it can be a time period of a preset length at any time node specified by the user, and this application is not limited here.

[0099] As a preferred embodiment, clearing the first virus program includes:

[0100] The mission to end the first virus program;

[0101] Obtaining a backup file of the first virus program;

[0102] Delete the first virus program.

[0103] In order to quickly identify and process the same first virus program when it is encountered in the future, in this embodiment, the task of the virus program is first terminated, then the backup file of the first virus program is obtained, and finally the first virus program is deleted.

[0104] Specifically, since it is impossible to operate the running first virus program, it is first necessary to close the running first virus program, end the task of the first virus program, and then back up the information of the first virus program. For example, it can be but not limited to backing up the MD5 value of the first virus program and then saving it to a preset identification value library, so that the first virus program can be quickly identified and processed the next time it is encountered, and finally the first virus program is deleted to complete the processing of the first virus program.

[0105] Please refer to Figure 2 , Figure 2 A schematic diagram of the structure of a server alarm processing system provided by the present invention; comprising:

[0106] A first alarm information obtaining unit 11 is used to obtain first alarm information generated when the server accesses a malicious domain name;

[0107] A first virus program determination unit 12 is used to determine whether a first virus program corresponding to the first alarm information exists in the server; if the first virus program exists in the server, the threat determination unit 13 is triggered;

[0108] The threat judgment unit 13 is used to judge whether the first virus program is a threat; if the first virus program is a threat, the first virus program removal unit 14 is triggered;

[0109] The first virus program removing unit 14 is used for removing the first virus program.

[0110] For the relevant introduction of a server alarm processing system provided by the present invention, please refer to the embodiment of the above-mentioned server alarm processing method, and this application will not go into details here.

[0111] Please refer to Figure 3 , Figure 3 A schematic diagram of the structure of a server alarm processing device provided by the present invention includes:

[0112] A memory 21, used for storing computer programs;

[0113] The processor 22 is used to implement the steps of the above-mentioned server alarm processing method when executing the computer program.

[0114] For the relevant introduction of a server alarm processing device provided by the present invention, please refer to the embodiment of the above-mentioned server alarm processing method, and this application will not go into details here.

[0115] It should also be noted that, in this specification, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "comprise", "include" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, an element defined by the statement "comprises a ..." does not exclude the presence of other identical elements in the process, method, article or device including the element.

[0116] The above description of the disclosed embodiments enables those skilled in the art to implement or use the present invention. Various modifications to these embodiments will be apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present invention. Therefore, the present invention will not be limited to the embodiments shown herein, but rather to the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A method for processing server alarms, characterized in that: Applicable to processors, including: Obtain the first warning information generated when the server accesses a malicious domain name; Determining whether a first virus program corresponding to the first warning information exists in the server; If the first virus program exists in the server, determining whether the first virus program is a threat; If the first virus program is a threat, clearing the first virus program; If the first virus program does not exist in the server, the method further includes: Obtaining second identification values ​​of N designated programs in the server, where N is an integer not less than 2; Determine whether a second identification value among the N second identification values ​​exists in a preset identification value library; If a second identification value among the N second identification values ​​exists in the preset identification value library, then clearing the second virus program corresponding to the second identification value existing in the preset identification value library; Determining whether a first virus program corresponding to the first alarm information exists in the server includes: Obtaining the five-tuple in the first alarm information; Determine whether a process name corresponding to the five-tuple in the server is obtained; If so, it is determined that the first virus program corresponding to the first alarm information exists in the server.

2. The method for processing server alarms according to claim 1, characterized in that: Determining whether the first virus program is a threat includes: Determining a first identification value of the first virus program; Determine whether the first identification value exists in a preset identification value library; If so, it is determined that the first virus program is a threat.

3. The method for processing server alarms according to claim 1, characterized in that: If none of the N second identification values ​​exist in the preset identification value library, the method further includes: Obtaining log information of the server within a first preset time period; Determine whether there is second alarm information generated when the server conducts a lateral attack on the intranet in the log information; If the second alarm information exists in the log information, the server is taken offline.

4. The method for processing server alarms according to claim 3, characterized in that: If the second alarm information does not exist in the log information, the method further includes: When receiving the warning no-misjudgment instruction sent by the user, the server is blocked from accessing the malicious domain name.

5. The method for processing server alarms according to claim 1, characterized in that: If the first virus program does not pose a threat, the method further includes: Obtaining the number of times the server accesses the malicious domain name within a second preset time period; Determining whether the number of times is greater than a preset number of times; If yes, proceed to the step of obtaining the second identification values ​​of N designated programs in the server; If not, it is determined that the first warning information is a false positive.

6. The method for processing server alarms according to any one of claims 1 to 5, characterized in that: Removing the virus program, including: The task of terminating the virus program; Obtaining a backup file of the virus program; Delete the virus program.

7. A server alarm processing system, characterized in that: include: A first alarm information acquisition unit, used to acquire first alarm information generated when the server accesses a malicious domain name; A first virus program determination unit, configured to determine whether a first virus program corresponding to the first alarm information exists in the server; If the first virus program exists in the server, triggering a threat determination unit; The threat judgment unit is used to judge whether the first virus program poses a threat; If the first virus program is a threat, triggering a first virus program removal unit; The first virus program clearing unit is used to clear the first virus program; The server alarm processing system is further used for obtaining second identification values ​​of N designated programs in the server if the first virus program does not exist in the server, where N is an integer not less than 2; Determine whether a second identification value among the N second identification values ​​exists in a preset identification value library; If a second identification value among the N second identification values ​​exists in the preset identification value library, then clearing the second virus program corresponding to the second identification value existing in the preset identification value library; The first virus program determination unit is specifically used for: Obtaining the five-tuple in the first alarm information; Determine whether a process name corresponding to the five-tuple in the server is obtained; If so, it is determined that the first virus program corresponding to the first alarm information exists in the server.

8. A server alarm processing device, characterized in that: include: Memory for storing computer programs; A processor, configured to implement the steps of the method for processing server alarms as described in any one of claims 1 to 6 when executing the computer program.

Images