An operation and maintenance audit method for extracting user execution script content

Abstract

The present invention discloses an operation and maintenance audit method for extracting the content of a user-executed script. An operation and maintenance connection channel A and an audit connection channel B, which are isolated from each other, are respectively established between an operation and maintenance audit system and a target asset; the target asset is connected through the operation and maintenance connection channel A, and operation and maintenance operations are performed. Once the operation characteristics of the user's executable file are analyzed, the directory of the user's executable file is located; then the operation and maintenance audit system connects to the target asset through the audit connection channel B, finds the executed file on the target asset, and judges the type of the executed file. If it is a text file type, the file content is checked and the text content is recorded in the operation and maintenance log, otherwise the event characteristics are ignored. The present invention creates a new connection from the operation and maintenance audit system to the target asset by using the operation and maintenance connection information of the user connecting to the target asset, thereby obtaining the content of the script executed by the user on the asset, and has good practicality.

Description

Technical Field

[0001] The present invention belongs to the technical field of operation and maintenance auditing, and in particular relates to an operation and maintenance auditing method for extracting user execution script content. Background Art

[0002] With the rapid development of Internet information technology, various information systems and network products emerge in an endless stream. Especially in large and medium-sized physical institutions, the rapidly constructed IT systems are expanding from the traditional closed business systems to large-scale key business systems, and the types of applications involved are also increasing. The widespread application of IT systems is a double-edged sword. On the one hand, it brings standardized, convenient and efficient office processes and business models, and on the other hand, it also causes security issues for IT systems, as well as problems such as the difficulty of defense, control and traceability of internal operation and maintenance. These problems threaten the security of the information center, such as: internal business data is tampered with, leaked, and stolen; malicious spread of viruses, access to illegal websites on the server, misoperation, random operation on important servers, etc. Therefore, the operation and maintenance security upgrade product (hereinafter referred to as the "operation and maintenance audit system") is widely used in more and more network environments to prevent internal information security issues and record the access logs of internal personnel to network resources for post-audit. In the design of audit functions, most audit systems will record the operation and maintenance events of users on assets and record the user's operation and maintenance operations.

[0003] Common operation and maintenance audit systems mainly design operation and maintenance audit solutions in two parts: operation and maintenance event records and event audits. Event records mainly record the user's operation commands on the target asset, file upload and download operations, and record the user's entire operation process. However, when processing event records, there are limitations on the user's operation records. For example, when a user executes a script, both event records and video records can only record that the user has executed a script, but the content of the script is not recorded. There is no way to know what expected results will be produced by script execution. However, it is very likely that there are some dangerous operations in the script executed by the user. However, if the script content is not recorded, the subsequent audit will be very difficult, because it is impossible to intuitively restore what operations the script specifically did on the asset when the user executed the script. Therefore, it is critical to enrich the content of the operation and maintenance event record and record the content of the user's execution script to improve the accuracy and efficiency of the subsequent audit.

[0004] In some existing operation and maintenance audit systems, in order to record the operation and maintenance events of user assets, an audit client engine needs to be installed on the user's assets. From the user's perspective, the step of installing the client engine increases the user's usage burden. At the same time, in the eyes of some users, installing a third-party engine software on their assets will cause security risks to their assets. They are worried that this engine will have a so-called "backdoor" in addition to recording operation and maintenance events or other operation and maintenance security management operations. This solution can achieve the effect of recording operation and maintenance events without installing a client engine on the user's assets, so it is superior in terms of ease of use and dispelling user security concerns. From the perspective of the operation and maintenance audit service provider, the solution of installing the client engine needs to consider software development, upgrade maintenance and iteration. However, this solution does not require the development and maintenance of the asset client engine, which greatly reduces the maintenance cost of the entire operation and maintenance audit system.

[0005] Some existing operation and maintenance audit systems have limited records of user operations when processing event records. For example, when a user executes a script, both event records and video records can only record that the user has executed a script, but the content of the script is not recorded. In the process of asset operation and maintenance, this solution not only records the commands of the user to execute the script, but also records the content of the script, which improves the diversity of user operation and maintenance event records and facilitates post-audit restoration of the scene with more information for audit.

[0006] The usual way to conduct post-audit is to locate the time point and specific illegal operation by viewing the operation and maintenance video and operation and maintenance log records. However, when auditing the operation and maintenance event records of script execution, whether by viewing the video or analyzing the operation and maintenance log records, you can only see which script is executed and what the script output is, but you cannot know what specific operations the script has performed, nor what impact the script execution will have, which increases the difficulty of judging the audit results. In order to analyze the specific impact of script execution, it is only possible to analyze the content of the script, so it is critical to be able to see the content of the script when auditing script execution events. This solution records the content of the script while recording the operation and maintenance events of the user executing the script. It provides more objective judgment information for post-audit and improves the efficiency and accuracy of the audit. Summary of the invention

[0007] The purpose of the present invention is to provide an operation and maintenance audit method for extracting the content of user-executed scripts, aiming to solve the above-mentioned problems.

[0008] The present invention is mainly achieved through the following technical solutions:

[0009] An operation and maintenance audit method for extracting the content of a user-executed script, wherein an operation and maintenance connection channel A and an audit connection channel B, which are isolated from each other, are respectively established between an operation and maintenance audit system and a target asset; the target asset is connected through the operation and maintenance connection channel A, and operation and maintenance operations are performed. Once the operation characteristics of the user-executed file are analyzed, the directory of the user-executed file is located; then the operation and maintenance audit system connects to the target asset through the audit connection channel B, finds the executed file on the target asset, and determines the type of the executed file. If it is a text file type, the file content is checked and recorded in the operation and maintenance log, otherwise the event characteristics are ignored.

[0010] In order to better implement the present invention, the following steps are further included:

[0011] Step S1: Log in to the operation and maintenance audit system and select the target assets that need operation and maintenance through the operation and maintenance audit system;

[0012] Step S2: The operation and maintenance audit system establishes an operation and maintenance connection channel A connected to the target asset;

[0013] Step S3: The operation and maintenance audit system creates an audit connection channel B connected to the target asset based on the credential information for establishing the operation and maintenance connection channel A;

[0014] Step S4: The operation and maintenance audit system records the operation and maintenance events of the target asset by the user through the operation and maintenance connection channel A through the protocol proxy, and records them in the operation and maintenance log;

[0015] Step S5: The operation and maintenance audit system parses the user's operation and maintenance logs of the target asset in real time and analyzes the operation and maintenance logs. When the analyzed operation and maintenance events meet the event characteristics of executing script files, the user's behavior is marked as the behavior of executing the file; then the path of the executed file is obtained by backtracking the user's operation and maintenance logs;

[0016] Step S6: The operation and maintenance audit system connects to the audit connection channel B and finds the executed file on the target asset; determines the text type of the executed file. If it is a text file type, checks the file content and records the text content in the operation and maintenance log, otherwise ignores the event characteristics.

[0017] In order to better implement the present invention, further, in step S2, the operation and maintenance audit system uses the credentials input by the user or the credentials of the target asset hosted by the user on the operation and maintenance audit system, and establishes an operation and maintenance connection channel A connected to the target asset through a protocol agent.

[0018] In order to better implement the present invention, further, the event feature of executing the script file in step S5 is to execute a file using a bash command line or directly execute a file.

[0019] In order to better implement the present invention, further, the method for obtaining the path of the executed file in step S5 is: by backtracing and analyzing the backtracing of the cd command performed by the user on the target asset to switch the directory.

[0020] In order to better implement the present invention, further, in step S6, the text type of the executed file is determined by using the file command on Linux.

[0021] Beneficial effects of the present invention:

[0022] (1) The present invention creates a new connection from the operation and maintenance audit system to the target asset by using the operation and maintenance connection information of the user connecting to the target asset, thereby obtaining the content of the script executed by the user on the asset. The present invention improves the diversity of operation and maintenance audit event records, enriches the meta-information of user operation and maintenance event records, provides more resources for restoring the scene of the incident for post-audit, and improves the efficiency and accuracy of post-audit; the solution has low implementation cost, high accuracy, and good practicality.

[0023] (2) In addition to recording the user's script execution events during the asset operation and maintenance process, the present invention adds the script content to the operation and maintenance records, thereby increasing the diversity of user operation and maintenance event records; more abundant and complete operation and maintenance records can more accurately and objectively restore the user's operation and maintenance scene for later audit and accountability. This can improve the efficiency of operators in auditing operation and maintenance videos, and improve the accuracy of attributing malicious operation and maintenance events, thus having good practicality.

[0024] (3) The present invention avoids the redundant settings in the prior art. From the user's perspective, the user does not need to install any client engine software for auditing on the asset, which reduces the user's usage burden. From the perspective of project maintenance, it is precisely because there is no need to install the client engine on the user's asset that there is no need to consider the upgrade and maintenance of the engine. This greatly reduces the maintenance cost of the entire operation and maintenance audit system. BRIEF DESCRIPTION OF THE DRAWINGS

[0025] Figure 1 It is a principle block diagram of the present invention. DETAILED DESCRIPTION

[0026] Embodiment 1:

[0027] An operation and maintenance audit method for extracting the content of a user-executed script, wherein an operation and maintenance connection channel A and an audit connection channel B, which are isolated from each other, are respectively established between an operation and maintenance audit system and a target asset; the target asset is connected through the operation and maintenance connection channel A, and operation and maintenance operations are performed. Once the operation characteristics of the user-executed file are analyzed, the directory of the user-executed file is located; then the operation and maintenance audit system connects to the target asset through the audit connection channel B, finds the executed file on the target asset, and determines the type of the executed file. If it is a text file type, the file content is checked and recorded in the operation and maintenance log, otherwise the event characteristics are ignored.

[0028] The present invention creates a new connection from the operation and maintenance audit system to the target asset by using the operation and maintenance connection information of the user connecting to the target asset, thereby obtaining the content of the script executed by the user on the asset. The present invention improves the diversity of operation and maintenance audit event records, enriches the meta-information of user operation and maintenance event records, provides more resources for restoring the scene of the incident for post-audit, and improves the efficiency and accuracy of post-audit; the solution has low implementation cost, high accuracy, and good practicality.

[0029] Embodiment 2:

[0030] An operation and maintenance audit method for extracting the content of a user-executed script comprises the following steps:

[0031] Step S1: Log in to the operation and maintenance audit system and select the target assets that need operation and maintenance through the operation and maintenance audit system;

[0032] Step S2: The operation and maintenance audit system establishes an operation and maintenance connection channel A connected to the target asset;

[0033] Step S3: The operation and maintenance audit system creates an audit connection channel B connected to the target asset based on the credential information for establishing the operation and maintenance connection channel A;

[0034] Step S4: The operation and maintenance audit system records the operation and maintenance events of the target asset by the user through the operation and maintenance connection channel A through the protocol proxy, and records them in the operation and maintenance log;

[0035] Step S5: The operation and maintenance audit system parses the user's operation and maintenance logs of the target asset in real time and analyzes the operation and maintenance logs. When the analyzed operation and maintenance events meet the event characteristics of executing script files, the user's behavior is marked as the behavior of executing the file; then the path of the executed file is obtained by backtracking the user's operation and maintenance logs;

[0036] Step S6: The operation and maintenance audit system connects to the audit connection channel B and finds the executed file on the target asset; determines the text type of the executed file. If it is a text file type, checks the file content and records the text content in the operation and maintenance log, otherwise ignores the event characteristics.

[0037] The present invention creates a new connection from the operation and maintenance audit system to the target asset by using the operation and maintenance connection information of the user connecting to the target asset, thereby obtaining the content of the script executed by the user on the asset. The present invention improves the diversity of operation and maintenance audit event records, enriches the meta-information of user operation and maintenance event records, provides more resources for restoring the scene of the incident for post-audit, and improves the efficiency and accuracy of post-audit; the solution has low implementation cost, high accuracy, and good practicality.

[0038] Embodiment 3:

[0039] This embodiment is optimized on the basis of Embodiment 1 or 2. In step S2, the operation and maintenance audit system uses the credentials input by the user or the credentials of the target assets hosted by the user on the operation and maintenance audit system, and establishes an operation and maintenance connection channel A connected to the target asset through a protocol agent.

[0040] Furthermore, the event feature of executing the script file in step S5 is executing a file using a bash command line or directly executing a file.

[0041] Taking the Linux system as an example, a user can execute a file in the following ways:

[0042] (1) Execute files through shell programs such as bash or sh: bash filepath;

[0043] (2) Directly execute the executable file: . / filename.

[0044] Furthermore, the method for obtaining the path of the executed file in step S5 is: by backtracing and analyzing the backtracing of the cd command performed by the user on the target asset to switch the directory.

[0045] For example, the directory that the user connects to the target asset is / root. The user executes cd test to switch to the current directory, and then executes the command . / test.sh. Then we can trace back the user's operation of switching directories, and then obtain the path of the test.sh file executed by the user in the target asset: / root / test / test.sh.

[0046] Among them: cd test: switch the current working directory to the test directory;

[0047] . / test.sh: executes the test.sh file.

[0048] Furthermore, in step S6, the text type of the executed file is determined by using the file command on Linux.

[0049] To determine the file type, you can use system tools. On Linux, you can use the file command directly. For example, to determine the type of the test.sh file in the above example, you can execute sh / root / test / test.sh to get the file type. If it is a text type, you will see the "ASCII text" mark.

[0050] The other parts of this embodiment are the same as those of the above-mentioned embodiment 1 or 2, and thus will not be described in detail.

[0051] Embodiment 4:

[0052] An operation and maintenance audit method for extracting the content of user-executed scripts, such as Figure 1 As shown, the following steps are included:

[0053] 1User authentication module:

[0054] S1.1 The user logs in to the operation and maintenance audit system by using an account password or secret key;

[0055] 2. Operation and maintenance connection management module:

[0056] S2.1 The user selects the target assets that need maintenance through the operation and maintenance audit system;

[0057] S2.2 The user enters the account and password of the target asset through the operation and maintenance audit system or uses the asset account hosted on the operation and maintenance audit system to establish an operation and maintenance connection A with the target asset;

[0058] S2.3 The operation and maintenance audit system uses the information of operation and maintenance connection A to create a connection B to the target asset for script content extraction.

[0059] 3. Operation and maintenance log recording and analysis module:

[0060] S3.1 The operation and maintenance audit system records the operation and maintenance events of the target asset by the user through the operation and maintenance connection A through the protocol proxy, and records the events into the operation and maintenance log;

[0061] S3.2 The operation and maintenance audit system analyzes the user's operation and maintenance logs of the asset in real time and analyzes the operation and maintenance events;

[0062] S3.3 When the analyzed operation and maintenance events meet the event characteristics of executing script files (such as executing sh xxx.sh; bash xxx.sh; . / xxx.sh; . / xxx on Linux assets), mark the user's behavior as the behavior of executing files. Then, by backtracking the user's operation and maintenance logs, obtain the path of the executed file to prepare for auditing the file content;

[0063] S3.4 The operation and maintenance audit system finds the executed file on the target asset through the audit connection B and determines whether the file is a text file type. If it is a non-text file type, the event feature is ignored; if it is a text file type, the file content is checked and recorded in the operation and maintenance log;

[0064] S3.5 Repeat S3.2-S3.4.

[0065] 4. Operation and maintenance connection management module:

[0066] S4.1 The user disconnects from the operation and maintenance audit system, and the operation and maintenance audit system controls the disconnection of operation and maintenance connection A and asset connection B at the same time.

[0067] The present invention creates a new connection from the operation and maintenance audit system to the target asset by using the operation and maintenance connection information of the user connecting to the target asset, thereby obtaining the content of the script executed by the user on the asset. The present invention improves the diversity of operation and maintenance audit event records, enriches the meta-information of user operation and maintenance event records, provides more resources for restoring the scene of the incident for post-audit, and improves the efficiency and accuracy of post-audit; the solution has low implementation cost, high accuracy, and good practicality.

[0068] The above description is only a preferred embodiment of the present invention and does not limit the present invention in any form. Any simple modification or equivalent change made to the above embodiment based on the technical essence of the present invention shall fall within the protection scope of the present invention.

Claims

1. An operation and maintenance audit method for extracting the content of a user-executed script, characterized in that: Establish mutually isolated operation and maintenance connection channel A and audit connection channel B between the operation and maintenance audit system and the target asset; connect to the target asset through operation and maintenance connection channel A and perform operation and maintenance operations. Once the operation characteristics of the user's executable file are analyzed, locate the directory of the user's executable file; then the operation and maintenance audit system connects to the target asset through audit connection channel B, finds the executed file on the target asset, and determines the type of the executed file. If it is a text file type, check the file content and record the text content in the operation and maintenance log, otherwise ignore the event characteristics; The following steps are involved: Step S1: Log in to the operation and maintenance audit system and select the target assets that need operation and maintenance through the operation and maintenance audit system; Step S2: The operation and maintenance audit system establishes an operation and maintenance connection channel A connected to the target asset; Step S3: The operation and maintenance audit system creates an audit connection channel B connected to the target asset based on the credential information for establishing the operation and maintenance connection channel A; Step S4: The operation and maintenance audit system records the operation and maintenance events of the target asset by the user through the operation and maintenance connection channel A through the protocol proxy, and records them in the operation and maintenance log; Step S5: The operation and maintenance audit system parses the user's operation and maintenance logs of the target asset in real time and analyzes the operation and maintenance logs. When the analyzed operation and maintenance events meet the event characteristics of executing script files, the user's behavior is marked as the behavior of executing the file; then the path of the executed file is obtained by backtracking the user's operation and maintenance logs; Step S6: The operation and maintenance audit system connects to the audit connection channel B and finds the executed file on the target asset; determines the text type of the executed file. If it is a text file type, checks the file content and records the text content in the operation and maintenance log, otherwise ignores the event characteristics.

2. According to claim 1, a method for extracting the contents of user-executed scripts for operation and maintenance auditing is characterized in that: In step S2, the operation and maintenance audit system uses the credentials input by the user or the credentials of the target asset hosted by the user on the operation and maintenance audit system, and establishes an operation and maintenance connection channel A connected to the target asset through a protocol proxy.

3. According to claim 1, a method for extracting the contents of user-executed scripts for operation and maintenance auditing is characterized in that: The event feature of executing the script file in step S5 is to execute a file using a bash command line or to directly execute a file.

4. The operation and maintenance audit method for extracting the content of user-executed scripts according to claim 1 or 3, characterized in that: The method for obtaining the path of the executed file in step S5 is: by backtracking and analyzing the backtracking of the cd command performed by the user on the target asset to switch the directory.

5. According to claim 1, a method for extracting the contents of user-executed scripts for operation and maintenance auditing is characterized in that: In step S6, the text type of the executed file is determined by using the file command on Linux.

Images