A method and system for customizing adding, deleting and modifying operations by applying an operation strategy white list

Abstract

This invention proposes a method and system for customizing the addition, deletion, and modification of an application operation policy whitelist, comprising: Step 1: The user submits the application operation policy whitelist to the management terminal, which adds the time range and application operation of the application to the whitelist of the security protection service backend; Step 2: When the security protection service backend detects a violation in the protected application, it determines whether there is an application operation in the whitelist that matches the violation. If not, proceed to Step 3; if yes, it further determines whether the time range corresponding to the application operation that matches the violation includes the timestamp of the violation. If yes, proceed to Step 4; otherwise, proceed to Step 3; Step 3: The security protection service backend sends an alarm with the violation to the user; Step 4: The security protection service backend blocks the alarm with the violation from the user.

Description

Technical Field

[0001] This invention relates to the field of security technology, and in particular to a method and system for customizing the addition, deletion, and modification of an application operation policy whitelist. Background Technology

[0002] In terms of internal host security protection, due to the needs of business lines, a large number of unauthorized and sensitive operations may be performed on the host, such as setting up unauthorized proxies, security testing, adding users without authorization, and modifying system configuration files. This will generate a large number of security alerts and increase the audit workload of security operations and maintenance personnel. In particular, for subsidiary businesses, it is necessary to contact multiple parties to verify the true purpose of the employees' operations. Summary of the Invention

[0003] To address the shortcomings of existing technologies, this invention proposes a customizable add, delete, and modify function for an application operation policy whitelist. This function can meet current needs and adapt to the internal security needs of other enterprises by allowing them to set alarm ranges according to their own requirements. This function can submit an operation whitelist to the security administrator upon user request, thereby preventing related operation alarms from being triggered within a specified time frame. Specifically, this application provides a method for customizing the add, delete, and modify functions of an application operation policy whitelist, including:

[0004] Step 1: The user submits a whitelist of application operation policies to the management terminal, which then adds the time range and application operations in the application to the whitelist of the security protection service backend.

[0005] Step 2: When the security protection service backend detects a violation in the protected application, it determines whether there is an application operation in the whitelist that is consistent with the violation. If not, proceed to step 3. If yes, it continues to determine whether the time range corresponding to the application operation consistent with the violation includes the timestamp of the violation. If yes, proceed to step 4. Otherwise, proceed to step 3.

[0006] Step 3: The security protection service backend sends an alarm to the user's client indicating the violation.

[0007] Step 4: The security protection service backend blocks the alarm for the user client that contains the violation.

[0008] The method for customizing the addition, deletion, and modification of the application operation policy whitelist includes step 3: the user terminal, based on the alarm, applies to the management terminal to add the violation operation to the whitelist.

[0009] The method for customizing the addition, deletion, and modification of the application operation strategy whitelist, wherein the application operations in the whitelist include regular operations.

[0010] The method for customizing the addition, deletion, and modification of the application operation strategy whitelist, wherein the application operations in the whitelist include sensitive operations.

[0011] The method for customizing the addition, deletion, and modification of the application operation strategy whitelist, wherein the application operations in the whitelist include URL operations.

[0012] The method for customizing the addition, deletion, and modification of the application operation strategy whitelist includes common operations such as ls, cd, and pwd.

[0013] The method for customizing the addition, deletion, and modification of the application operation strategy whitelist, wherein the sensitive operations include history-c, history-d, and rm-rf.

[0014] The method for customizing the addition, deletion, and modification of the application operation strategy whitelist includes URL operations such as wget and curl.

[0015] The method for customizing the addition, deletion, and modification of the application operation policy whitelist includes step 1: the user adds operations other than those specified in the security manual to the application operation policy whitelist.

[0016] The method for customizing the addition, deletion, and modification of the application operation policy whitelist includes step 1: the user submits an application to the management terminal to delete or modify items that need to be removed from the whitelist, so as to modify the whitelist in the security protection service backend.

[0017] The method for customizing the addition, deletion, and modification of the application operation strategy whitelist includes step 1: focusing on machines that have been added to the whitelist within the allowed operation time range.

[0018] This invention also provides a customizable operating system for adding, deleting, and modifying application operation policy whitelists, including:

[0019] Module 1: The user submits a whitelist of application operation policies to the management terminal, which then adds the time range and application operations in the application to the whitelist of the security protection service backend.

[0020] Module 2: When the security protection service backend detects a violation in the protected application, it determines whether there is an application operation in the whitelist that is consistent with the violation. If not, it executes Module 3. If yes, it continues to determine whether the time range corresponding to the application operation consistent with the violation includes the timestamp of the violation. If yes, it executes Module 4; otherwise, it executes Module 3.

[0021] Module 3: The security protection service backend sends an alarm to the user terminal indicating the violation.

[0022] Module 4: The security protection service backend blocks alarms from the user terminal for the violation.

[0023] The customizable addition, deletion, and modification operating system for the application operation policy whitelist includes module 3, which allows the user terminal to request the management terminal to add the violation operation to the whitelist based on the alarm.

[0024] The application operation strategy whitelist is a customizable operating system for adding, deleting, and modifying applications, where the whitelist includes regular operations.

[0025] The aforementioned application operation policy whitelist allows for the customization of adding, deleting, and modifying operating systems, where the application operations in the whitelist include sensitive operations.

[0026] The aforementioned application operation policy whitelist allows for the customization of adding, deleting, and modifying operating systems, where application operations in the whitelist include URL operations.

[0027] The application operation policy whitelist allows for custom addition, deletion, and modification of the operating system, where the common operations include ls, cd, and pwd.

[0028] The application operation policy whitelist allows for custom addition, deletion, and modification of operating systems, where the sensitive operations include history-c, history-d, and rm-rf.

[0029] The application operation strategy whitelist allows for custom addition, deletion, and modification of the operating system, where the URL operation includes wget and curl.

[0030] The customizable addition, deletion, and modification operating system for the application operation policy whitelist includes module 1, which allows the user to add operations outside the security manual operation specifications to the application operation policy whitelist.

[0031] The customizable addition, deletion, and modification operating system for the application operation policy whitelist includes module 1: the user submits an application to the management terminal to delete or modify items from the whitelist, so as to modify the whitelist in the security protection service backend.

[0032] The customizable addition, deletion, and modification operating system for the application operation strategy whitelist includes module 1, which includes: focusing on whitelisted machines within the allowed operation time range.

[0033] The present invention also provides a storage medium for storing a program that performs custom add, delete, and modify operations on an application operation policy whitelist.

[0034] As can be seen from the above solutions, the advantages of the present invention are:

[0035] This invention utilizes massive amounts of data through big data analysis and machine learning ensemble learning (SoftVotingClassifier, which uses the average of prediction probabilities (votes) from multiple weak classifiers for classification, for example, ... Figure 3 The combined technology can cover various operation commands, and can add, modify, and add operation whitelists in the background according to special needs at special stages when operators are alerted, so as not to affect the normal audit work of security auditors, thus greatly improving audit efficiency. Attached Figure Description

[0036] Figure 1 This is a flowchart of the method of the present invention;

[0037] Figure 2 This is a system block diagram of the present invention;

[0038] Figure 3 This is a schematic diagram of an embodiment of the present invention. Detailed Implementation

[0039] Specifically, this application provides a method for customizing the addition, deletion, and modification of an application operation policy whitelist, including:

[0040] Step 1: The user submits a whitelist of application operation policies to the management terminal, which then adds the time range and application operations in the application to the whitelist of the security protection service backend.

[0041] Step 2: When the security protection service backend detects a violation in the protected application, it determines whether there is an application operation in the whitelist that is consistent with the violation. If not, proceed to step 3. If yes, it continues to determine whether the time range corresponding to the application operation consistent with the violation includes the timestamp of the violation. If yes, proceed to step 4. Otherwise, proceed to step 3.

[0042] Step 3: The security protection service backend sends an alarm to the user's client indicating the violation.

[0043] Step 4: The security protection service backend blocks the alarm for the user client that contains the violation.

[0044] The method for customizing the addition, deletion, and modification of the application operation policy whitelist includes step 3: the user terminal, based on the alarm, applies to the management terminal to add the violation operation to the whitelist.

[0045] The method for customizing the addition, deletion, and modification of the application operation strategy whitelist, wherein the application operations in the whitelist include regular operations.

[0046] The method for customizing the addition, deletion, and modification of the application operation strategy whitelist, wherein the application operations in the whitelist include sensitive operations.

[0047] The method for customizing the addition, deletion, and modification of the application operation strategy whitelist, wherein the application operations in the whitelist include URL operations.

[0048] The method for customizing the addition, deletion, and modification of the application operation strategy whitelist includes common operations such as ls, cd, and pwd.

[0049] The method for customizing the addition, deletion, and modification of the application operation strategy whitelist, wherein the sensitive operations include history-c, history-d, and rm-rf.

[0050] The method for customizing the addition, deletion, and modification of the application operation strategy whitelist includes URL operations such as wget and curl.

[0051] The method for customizing the addition, deletion, and modification of the application operation policy whitelist includes step 1: the user adds operations other than those specified in the security manual to the application operation policy whitelist.

[0052] The method for customizing the addition, deletion, and modification of the application operation policy whitelist includes step 1: the user submits an application to the management terminal to delete or modify items that need to be removed from the whitelist, so as to modify the whitelist in the security protection service backend.

[0053] The method for customizing the addition, deletion, and modification of the application operation strategy whitelist includes step 1: focusing on machines that have been added to the whitelist within the allowed operation time range.

[0054] To make the above features and effects of the present invention clearer and easier to understand, specific embodiments are described below, and detailed descriptions are provided in conjunction with the accompanying drawings.

[0055] Combining the massive amounts of log data (hundreds of millions) generated by the company's 100,000 servers, and through big data analysis and machine learning techniques, we can identify the following operations: Common commands such as `ls`, `cd`, and `pwd`; prohibited operations such as `useradd`, `userdel`, and `groupadd`; sensitive operations such as `history -c`, `history -d`, and `rm -rf`; proxy operations such as `http_proxy`, `https_proxy`, and `gost`; URL operations such as `wget` and `curl`; and other operations with various parameters, such as `bash -i>& / dev / tcp / host / 8`. Operations such as 0810>&1, totaling over 4000 common and sensitive operations, are listed. Users can submit alarm whitelists to the system administrator based on operations that are about to occur (when the operation involves procedures outside the company's security manual) or have already triggered alarms. The administrator can add to the whitelist in the backend, thus not affecting the auditing work of security operations personnel (if an alarm occurs, security operations personnel must conduct security investigations to determine whether it is an external intrusion, an insider attack, or an employee's mistake, and the reason for the mistake, etc.). It also strengthens the security protection of whitelisted hosts (whitelisted machines will be under close monitoring during the allowed operation period).

[0056] Department A is responsible for the big data HDFS cluster for a certain business line of the company. To introduce HA functionality while maintaining compatibility with older HDFS virtual IPs, they need to perform the `chomdo +w / etc / sudoers` operation on the host's ` / etc / sudoers` file. This will allow them to add or modify permissions within the configuration file, granting passwordless access. This will facilitate the HA program's automatic installation and uninstallation of virtual IPs on the cluster, resolving the pain point of manually switching accounts and performing installations / uninstalls on a large number of servers. During the cluster upgrade, there may be numerous modifications to such files. To avoid disrupting the normal auditing work of security auditors, the head of Department A can submit a whitelist based on the files requiring modification and internal regulations regarding prohibited operations. After evaluation by security auditors, appropriate additions, deletions, and modifications can be made to the whitelist in the background.

[0057] The following are system embodiments corresponding to the above method embodiments. This embodiment can be implemented in conjunction with the above embodiments. The relevant technical details mentioned in the above embodiments are still valid in this embodiment, and will not be repeated here to reduce repetition. Accordingly, the relevant technical details mentioned in this embodiment can also be applied to the above embodiments.

[0058] This invention also provides a customizable operating system for adding, deleting, and modifying application operation policy whitelists, including:

[0059] Module 1: The user submits a whitelist of application operation policies to the management terminal, which then adds the time range and application operations in the application to the whitelist of the security protection service backend.

[0060] Module 2: When the security protection service backend detects a violation in the protected application, it determines whether there is an application operation in the whitelist that is consistent with the violation. If not, it executes Module 3. If yes, it continues to determine whether the time range corresponding to the application operation consistent with the violation includes the timestamp of the violation. If yes, it executes Module 4; otherwise, it executes Module 3.

[0061] Module 3: The security protection service backend sends an alarm to the user terminal indicating the violation.

[0062] Module 4: The security protection service backend blocks alarms from the user terminal for the violation.

[0063] The customizable addition, deletion, and modification operating system for the application operation policy whitelist includes module 3, which allows the user terminal to request the management terminal to add the violation operation to the whitelist based on the alarm.

[0064] The application operation strategy whitelist is a customizable operating system for adding, deleting, and modifying applications, where the whitelist includes regular operations.

[0065] The aforementioned application operation policy whitelist allows for the customization of adding, deleting, and modifying operating systems, where the application operations in the whitelist include sensitive operations.

[0066] The aforementioned application operation policy whitelist allows for the customization of adding, deleting, and modifying operating systems, where application operations in the whitelist include URL operations.

[0067] The application operation policy whitelist allows for custom addition, deletion, and modification of the operating system, where the common operations include ls, cd, and pwd.

[0068] The application operation policy whitelist allows for custom addition, deletion, and modification of operating systems, where the sensitive operations include history-c, history-d, and rm-rf.

[0069] The application operation strategy whitelist allows for custom addition, deletion, and modification of the operating system, where the URL operation includes wget and curl.

[0070] The customizable addition, deletion, and modification operating system for the application operation policy whitelist includes module 1, which allows the user to add operations outside the security manual operation specifications to the application operation policy whitelist.

[0071] The customizable addition, deletion, and modification operating system for the application operation policy whitelist includes module 1: the user submits an application to the management terminal to delete or modify items from the whitelist, so as to modify the whitelist in the security protection service backend.

[0072] The customizable addition, deletion, and modification operating system for the application operation strategy whitelist includes module 1, which includes: focusing on whitelisted machines within the allowed operation time range.

[0073] The present invention also provides a storage medium for storing a program that performs custom add, delete, and modify operations on an application operation policy whitelist.

Claims

1. A method for customizing adding, deleting and modifying operations by applying an operation policy white list, characterized in that, The application comprises the following steps: Step 1, the user end submits an application operation strategy whitelist to the management end, and the management end adds the time range and the application operation in the application to the whitelist in the security protection service background; Step 2, when the security protection service background finds that there is a violation operation in the application protected by the security protection service background, it is judged whether there is an application operation consistent with the violation operation in the whitelist, if not, step 3 is executed, if yes, it is further judged whether the time range corresponding to the application operation consistent with the violation operation includes the time stamp of the violation operation, if yes, step 4 is executed, otherwise, step 3 is executed; Step 3, the security protection service background sends an alarm with the violation operation to the user end; Step 4, the security protection service background shields the alarm with the violation operation from the user end; Step 3 comprises: the user end applies to the management end to add the violation operation to the whitelist according to the alarm; The application operation in the whitelist comprises a normal operation, a sensitive operation and a URL operation; Step 1 comprises: the user end adds an operation other than the operation specification in the security manual to the application operation strategy whitelist.

2. The method for customizing adding, deleting and modifying operation of operation policy white list according to claim 1, wherein, The normal operation comprises ls, cd and pwd. 3.The method of claim 1, wherein the custom add, delete, and modify operation method of the application operation policy white list is characterized in that, The sensitive operation comprises history-c, history-d and rm-rf.

4. The method of claim 1, wherein the custom add, delete, and modify operation of the application operation policy white list is characterized by, The URL operation comprises wget and curl.

5. The method of claim 1, wherein the custom add, delete, and modify operation method of the application operation policy white list is characterized by, Step 1 comprises: the user end submits an application to the management end for deleting or modifying the whitelist in the security protection service background.

6. The method of claim 1, wherein the custom add, delete, and modify operation of the application operation policy white list is characterized by, Step 1 comprises: for the machine added to the whitelist, the machine is focused on within the allowed operation time range.

7. A customizable operating system for adding, deleting, and modifying application operation policy whitelists, characterized in that, The application comprises the following modules: Module 1, the user end submits an application operation strategy whitelist to the management end, and the management end adds the time range and the application operation in the application to the whitelist in the security protection service background; Module 2, when the security protection service background finds that there is a violation operation in the application protected by the security protection service background, it is judged whether there is an application operation consistent with the violation operation in the whitelist, if not, module 3 is executed, if yes, it is further judged whether the time range corresponding to the application operation consistent with the violation operation includes the time stamp of the violation operation, if yes, module 4 is executed, otherwise, module 3 is executed; Module 3, the security protection service background sends an alarm with the violation operation to the user end; Module 4, the security protection service background shields the alarm with the violation operation from the user end; Module 3 comprises: the user end applies to the management end to add the violation operation to the whitelist according to the alarm; The application operation in the whitelist comprises a normal operation, a sensitive operation and a URL operation; Module 1 comprises: the user end adds an operation other than the operation specification in the security manual to the application operation strategy whitelist.

8. The custom add-delete-modify operating system applying the operation policy white list according to claim 7, wherein, The normal operation comprises ls, cd and pwd.

9. The custom add-delete-modify operating system applying the operation policy white list according to claim 7, wherein, The sensitive operation comprises history-c, history-d and rm-rf.

10. The custom add-delete-modify operating system applying the operation policy white list according to claim 7, wherein, The URL operation comprises wget and curl.

11. The custom add-delete-modify operating system applying the operation policy white list according to claim 7, wherein, Module 1 comprises: the user end submits an application to the management end for deleting or modifying the whitelist in the security protection service background.

12. The custom add-delete-modify operating system applying the operation policy white list according to claim 7, wherein, The module 1 comprises: a machine whitelisted, which is focused on within the allowed operating time range.

13. A storage medium for storing a program for executing the method of any one of claims 1 to 6.

Images