A state detection method, device, apparatus and computer readable storage medium

Abstract

Embodiments of the present application disclose a state detection method, which comprises: receiving a first orchestration service sent by a security platform, and sending the first orchestration service to a virtual machine managed by a management platform; wherein the first orchestration service is based on detection information set by a target application; in a case where it is determined based on the first orchestration service in the virtual machine that the target application is not in a target operation state, determining whether the running state of the target application is abnormal based on a parameter value of the target application; wherein the target operation state represents that the current operation of the target application does not appear abnormal. Embodiments of the present application also disclose a state detection device, equipment and a computer readable storage medium.

Description

Technical Field

[0001] This application relates to the field of communication technology, and in particular to a state detection method, apparatus, device, and computer-readable storage medium. Background Technology

[0002] An agent, translated as intelligent agent, refers to a software or hardware entity capable of autonomous action; agents can detect viruses and block their operation. However, agents in operating systems such as Windows and Linux are easily uninstalled by hackers, making the operating system vulnerable to virus intrusion. Currently, third-party security platforms connect with cloud platforms to monitor the agent status in virtual machines managed by the cloud platform. When the third-party security platform detects abnormal agent status in a virtual machine, it sends a snapshot command to the cloud platform, allowing the cloud platform to save the current state of the virtual machine and prevent malicious attacks. However, the above method can only monitor agent anomalies and cannot eliminate false alarms caused by agent upgrades or uninstallation. Summary of the Invention

[0003] To address the aforementioned technical problems, this application aims to provide a status detection method, apparatus, device, and computer-readable storage medium, which solves the problem in related technologies that can only monitor agent anomalies but cannot rule out false alarms caused by agent upgrades or uninstallation.

[0004] The technical solution of this application is implemented as follows:

[0005] A state detection method, the method comprising:

[0006] The system receives a first orchestration service sent by a security platform and sends the first orchestration service to a virtual machine managed by a management platform; wherein the first orchestration service is based on detection information set by the target application.

[0007] If the target application is determined not to be in the target operation state based on the first orchestration service in the virtual machine, the running state of the target application is determined to be abnormal based on the parameter values ​​of the target application; wherein, the target operation state indicates that the current operation of the target application is not abnormal.

[0008] In the above scheme, if it is determined that the target application is not in the target operation state based on the first orchestration service in the virtual machine, determining whether the running state of the target application is abnormal based on the parameter values ​​of the target application includes:

[0009] After detecting that the target application is installed on the virtual machine, it is determined whether the target application is in the target operation state based on the first orchestration service; wherein, the target application is installed by the virtual machine using an installation package obtained from the first orchestration service;

[0010] If it is determined that the target application is not in the target operation state, the abnormality of the target application's running state is determined based on the parameter values ​​of the target application.

[0011] In the above scheme, determining whether the target application is in the target operation state based on the first orchestration service includes:

[0012] Determine the operating system of the virtual machine;

[0013] When the operating system of the virtual machine is the first operating system, the system commands of the virtual machine are invoked to determine whether the target application is in the target operation state based on the first orchestration service.

[0014] When the operating system of the virtual machine is a second operating system, the system application programming interface (API) of the virtual machine is invoked to determine whether the target application is in the target operating state based on the first orchestration service.

[0015] In the above scheme, determining whether the target application is in the target operation state based on the first orchestration service includes:

[0016] The target process of the target application is determined based on the first orchestration service;

[0017] The list of processes in the virtual machine can be obtained by calling the system API of the virtual machine;

[0018] If the target process exists in the process list, it is determined that the target application is in the target operation state;

[0019] If the target process is not present in the process list, it is determined that the target application is not in the target operation state.

[0020] In the above scheme, determining whether the target application's running status is abnormal or normal based on the target application's parameter values ​​includes:

[0021] The system API is invoked to obtain the virtual machine's registry.

[0022] Obtain the parameter values ​​of the target process of the target application from the registry;

[0023] If the parameter value meets the target value, the target application is determined to be running normally.

[0024] If the parameter value does not meet the target value, it is determined that the running status of the target application is abnormal.

[0025] In the above scheme, determining the operating system of the virtual machine includes:

[0026] Obtain the first orchestration identifier of the first orchestration service;

[0027] Receive the second orchestration identifier of the second orchestration service sent by the security platform;

[0028] If the second orchestration identifier is the same as the first orchestration identifier, the operating system of the virtual machine is determined.

[0029] The method in the above scheme further includes:

[0030] If the second orchestration identifier is different from the second orchestration identifier, the verification result indicating that the first orchestration service in the virtual machine needs to be updated is obtained.

[0031] A state detection device, the device comprising:

[0032] The sending unit is configured to receive a first orchestration service sent by the security platform and send the first orchestration service to the virtual machine managed by the management platform; wherein, the first orchestration service is detection information set based on the target application.

[0033] The determining unit is configured to determine whether the running state of the target application is abnormal based on the parameter values ​​of the target application when the target application is determined not to be in the target operation state based on the first orchestration service in the virtual machine; wherein the target operation state indicates that the current operation of the target application is not abnormal.

[0034] A state detection device, the device comprising: a processor, a memory, and a communication bus;

[0035] The communication bus is used to realize the communication connection between the processor and the memory;

[0036] The processor is used to execute the state detection program in the memory to implement the steps of the state detection method described above.

[0037] A computer-readable storage medium storing one or more programs that can be executed by one or more processors to implement the steps of the state detection method described above.

[0038] The state detection method, apparatus, device, and computer-readable storage medium provided in the embodiments of this application can receive a first orchestration service sent by a security platform and send the first orchestration service to a virtual machine managed by a management platform. If it is determined based on the first orchestration service in the virtual machine that the target application in the virtual machine is not in a target operation state that represents that the current operation of the target application is not abnormal, the running state of the target application is determined based on the parameter value of the target application. In this way, the running state of the target application can be determined based on the parameter value of the target application even when the current operation of the target application is not abnormal. This can eliminate false alarms caused by the target application during upgrades, uninstallation, and disabling. It solves the problem in related technologies that can only monitor agent abnormalities but cannot eliminate false alarms caused by agent upgrades or uninstallation, thus improving the accuracy of state detection. Attached Figure Description

[0039] Figure 1 A schematic flowchart of a state detection method provided for an embodiment of this application;

[0040] Figure 2 A flowchart illustrating another state detection method provided for an embodiment of this application;

[0041] Figure 3 A schematic diagram illustrating a process for a security platform to obtain a first orchestration service, provided for an embodiment of this application;

[0042] Figure 4 A schematic flowchart of yet another state detection method provided for an embodiment of this application;

[0043] Figure 5 A schematic flowchart of a state detection method provided for another embodiment of this application;

[0044] Figure 6 A schematic diagram of the structure of a state detection device provided for an embodiment of this application;

[0045] Figure 7 This is a schematic diagram of the structure of a state detection device provided for an embodiment of this application. Detailed Implementation

[0046] The technical solutions in the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings.

[0047] It should be understood that the phrases "embodiments of this application" or "foreign embodiments" throughout the specification mean that a specific feature, structure, or characteristic related to an embodiment is included in at least one embodiment of this application. Therefore, "embodiments of this application" or "in the foreign embodiments" appearing throughout the specification do not necessarily refer to the same embodiment. Furthermore, these specific features, structures, or characteristics can be combined in any suitable manner in one or more embodiments. In the various embodiments of this application, the sequence numbers of the above-described processes do not imply a sequential order of execution; the execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of this application. The sequence numbers of the above-described embodiments are merely descriptive and do not represent the superiority or inferiority of the embodiments.

[0048] Unless otherwise specified, any step in the embodiments of this application performed by the electronic device may be executed by the processor of the electronic device. It is also worth noting that the embodiments of this application do not limit the order in which the electronic device performs the following steps. Furthermore, the methods used to process data in different embodiments may be the same or different methods. It should also be noted that any step in the embodiments of this application can be executed independently by the electronic device; that is, when the electronic device performs any step in the following embodiments, it may not depend on the execution of other steps.

[0049] It should be understood that the specific embodiments described herein are for illustrative purposes only and are not intended to limit the scope of this application.

[0050] This application provides a state detection method, which can be applied to a management platform, as described above. Figure 1 As shown, the method includes the following steps:

[0051] Step 101: Receive the first orchestration service sent by the security platform and send the first orchestration service to the virtual machine managed by the management platform.

[0052] The first orchestration service is based on the detection information set by the target application.

[0053] In this embodiment, the management platform can manage multiple virtual machines. The management platform may include a security platform, which can generate a first orchestration service. Optionally, the management platform may be a Hyper-Converged Infrastructure (HCI), and the security platform may be a cloud-built-in safety platform (CBSP). The target application can detect viruses and block their intrusion, thereby protecting the security of the virtual machine. If the target application in the virtual machine is compromised and uninstalled by a hacker, the security of the virtual machine will be compromised. Therefore, it is necessary to detect the running status of the target application to ensure the security of the virtual machine. Optionally, the target application may be a virus detection agent. After the management platform sends the first orchestration service to the virtual machine, it can obtain the running status of the target application in the virtual machine through the first orchestration service. If the running status of the target application is abnormal, timely protective measures can be taken to ensure the security of the virtual machine.

[0054] In this embodiment of the application, after receiving the first orchestration service sent by the security platform, the management platform can send a success message to the security platform, so that the security platform will not reissue the first orchestration service.

[0055] Step 102: If the first orchestration service in the virtual machine determines that the target application is not in the target operation state, determine whether the running state of the target application is abnormal based on the parameter values ​​of the target application.

[0056] The target operation status is used to characterize that the target application is currently operating without any abnormalities.

[0057] In this embodiment, the target operation state can be uninstalling, upgrading, or any other non-abnormal operation state of the target application; this embodiment does not limit this. Based on the parameter values ​​of the target process of the target application, it can be determined whether the target application is disabled or has been uninstalled. Only after the management platform determines that the target application is not in the target operation state based on the first orchestration service does it determine whether the target application's running state is abnormal based on the target application's parameter values. This eliminates false alarms caused by the target application being uninstalled, upgraded, disabled, or uninstalled, thereby more accurately determining whether the target application's running state is abnormal.

[0058] The state detection method provided in this application, when the first orchestration service in the virtual machine determines that the target application in the virtual machine is not in the target operation state used to characterize that the current operation of the target application is not abnormal, determines whether the running state of the target application is abnormal based on the parameter value of the target application. This can eliminate false alarms caused by the target application during upgrades, uninstallation, and disabling, and solves the problem in related technologies that can only monitor agent abnormalities but cannot eliminate false alarms caused by agent upgrades or uninstallation, thus improving the accuracy of state detection.

[0059] Based on the foregoing embodiments, this application provides a state detection method, referring to... Figure 2 As shown, the method includes the following steps:

[0060] Step 201: The management platform receives the first orchestration service sent by the security platform and sends the first orchestration service to the virtual machine managed by the management platform.

[0061] The first orchestration service is based on the detection information set by the target application.

[0062] In this embodiment, the security platform can pre-generate different orchestration services based on the virtual machine's operating system and store them in the corresponding mapping between the operating system and the orchestration services, as follows: Figure 3 As shown, the security platform can obtain the virtual machine's operating system from the mapping between virtual machines and operating systems, and then obtain the latest orchestration service corresponding to that operating system (i.e., the first orchestration service) from the mapping between operating systems and orchestration services. The first orchestration service is then sent to the management platform, and it can carry the installation package of the target application. Upon receiving the first orchestration service from the security platform, the management platform sends it to the virtual machines managed by the platform. In this way, the virtual machines can obtain the installation package of the target application from the first orchestration service, install the target application, and send the installation result back to the management platform.

[0063] Step 202: After the management platform detects that the target application is installed on the virtual machine, it determines whether the target application is in the target operation state based on the first orchestration service.

[0064] The target application is installed by the virtual machine using an installation package obtained from the first orchestration service, and the target operation status is used to indicate that the current operation of the target application is not abnormal.

[0065] In this embodiment of the application, the first orchestration service may carry the installation package of the target application, so that the virtual machine can install the target application based on the installation package of the target application, and after the target application is installed, the first orchestration service can be used to obtain whether the running status of the target application is abnormal.

[0066] The management platform can determine whether a target application is in the target operation state based on the first orchestration service through the following steps:

[0067] Step 202a: The management platform determines the operating system of the virtual machine.

[0068] In this embodiment of the application, the operating system of the virtual machine can be a Linux system or a Windows system, and this embodiment of the application does not limit it.

[0069] Step 202b: When the operating system of the virtual machine is the first operating system, the management platform determines whether the target application is in the target operation state based on the first orchestration service by calling the system commands of the virtual machine.

[0070] In this embodiment of the application, the first operating system can be a Linux system. When the operating system of the virtual machine is a Linux system, the management platform can directly determine whether the target application is in the target operation state based on the first orchestration service by calling the system commands of the virtual machine, and then determine whether the running state of the target application is abnormal.

[0071] Step 202c: When the virtual machine's operating system is the second operating system, the management platform determines whether the target application is in the target operating state based on the first orchestration service by calling the virtual machine's system application programming interface (API).

[0072] In this embodiment, the second operating system can be a Windows system. Since Windows has weak support for native commands, and there are security issues with calling commands via PowerShell (a third tool), where PowerShell commands may be restricted from execution by the target application, the management platform, when the virtual machine's operating system is Windows, can determine whether the target application is in a target operating state based on the first orchestration service by calling the virtual machine's system API, thereby determining whether the target application's running state is abnormal.

[0073] In this embodiment of the application, different orchestration services can be generated based on the operating system of the virtual machine. After determining the operating system of the virtual machine, the corresponding orchestration service is used to determine whether the target application is in the target operating state, and then to determine whether the running state of the target application is abnormal.

[0074] Step 203: If the management platform determines that the target application is not in the target operation state based on the parameter values ​​of the target application, it determines whether the running state of the target application is abnormal.

[0075] It should be noted that the descriptions of the same steps and contents as in other embodiments in this embodiment can be found in the descriptions in other embodiments, and will not be repeated here.

[0076] The state detection method provided in this application, when the first orchestration service in the virtual machine determines that the target application in the virtual machine is not in the target operation state used to characterize that the current operation of the target application is not abnormal, determines whether the running state of the target application is abnormal based on the parameter value of the target application. This can eliminate false alarms caused by the target application during upgrades, uninstallation, and disabling, and solves the problem in related technologies that can only monitor agent abnormalities but cannot eliminate false alarms caused by agent upgrades or uninstallation, thus improving the accuracy of state detection.

[0077] Based on the foregoing embodiments, this application provides a state detection method, referring to... Figure 4 As shown, the method includes the following steps:

[0078] Step 301: The management platform receives the first orchestration service sent by the security platform and sends the first orchestration service to the virtual machine managed by the management platform.

[0079] The first orchestration service is based on the detection information set by the target application.

[0080] Step 302: After the management platform detects that the target application is installed on the virtual machine, it obtains the first orchestration identifier of the first orchestration service.

[0081] The target application was installed by the virtual machine using an installation package obtained from the first orchestration service.

[0082] In this embodiment, after detecting that a target application is installed on a virtual machine, the management platform can verify the first orchestration service in the virtual machine using an orchestration identifier. Optionally, the management platform can verify the orchestration service in the virtual machine every 5 minutes to ensure that the orchestration service is up-to-date. As one possible approach, the security platform can generate a first orchestration identifier for the first orchestration service at the same time as generating the first orchestration service, so that each version of the orchestration service will have a corresponding orchestration identifier.

[0083] Step 303: The management platform receives the second orchestration identifier of the second orchestration service sent by the security platform.

[0084] In this embodiment, the second orchestration service is the latest orchestration service received by the management platform from the security platform. The security platform can improve the generated first orchestration service to generate a new orchestration service and a new orchestration identifier, and then send the new orchestration service and the new orchestration identifier to the management platform.

[0085] Step 304: If the second orchestration identifier is the same as the first orchestration identifier, the management platform determines the operating system of the virtual machine.

[0086] In this embodiment of the application, the second orchestration identifier is the same as the first orchestration identifier, indicating that the first orchestration service is up-to-date. In this case, the first orchestration service in the virtual machine does not need to be updated, and step 306 can be executed.

[0087] Step 305: If the second orchestration identifier is different from the first orchestration identifier, the management platform updates the first orchestration service in the virtual machine to the second orchestration service corresponding to the second orchestration identifier.

[0088] In this embodiment, the second orchestration identifier is different from the first orchestration identifier, indicating that the first orchestration service is not up-to-date. In this case, the first orchestration service in the virtual machine needs to be updated. The management platform can send the second orchestration service corresponding to the second orchestration identifier to the virtual machine so that the virtual machine updates its stored first orchestration service to the second orchestration service.

[0089] Step 306: When the operating system of the virtual machine is the first operating system, the management platform determines whether the target application is in the target operation state based on the first orchestration service by calling the system commands of the virtual machine.

[0090] The target operation status is used to characterize that the target application is currently operating without any abnormalities.

[0091] In this embodiment, although the management platform obtains information from the virtual machine by calling the virtual machine's system commands when the virtual machine's operating system is the first operating system, and by calling the virtual machine's system API when the virtual machine's operating system is the second operating system, the operation of the management platform determining whether the target application is in the target operating state based on the first orchestration service, and then determining whether the target application's running state is abnormal, is similar. This embodiment uses the virtual machine's operating system as the second operating system as an example to illustrate the operation of the management platform determining whether the target application is in the target operating state based on the first orchestration service, and then determining whether the target application's running state is abnormal. The management platform can execute steps 307-310 to determine whether the target application is in the target operating state based on the first orchestration service when the virtual machine's operating system is the second operating system; the management platform can execute steps 311-314 to determine whether the target application's running state is abnormal.

[0092] Step 307: When the operating system of the virtual machine is the second operating system, the management platform determines the target process of the target application based on the first orchestration service.

[0093] In this embodiment of the application, the first orchestration service is based on the detection information determined by the target process. Therefore, the management platform can determine the target process used to detect whether the running status of the target application is abnormal based on the first orchestration service.

[0094] Step 308: The management platform obtains the list of processes in the virtual machine by calling the system API.

[0095] In this embodiment, the management platform can obtain the current process list of the virtual machine by calling the system API in the virtual machine to create a process snapshot.

[0096] Step 309: If the target process exists in the process list, the management platform determines that the target application is in the target operation state.

[0097] Among them, the target operation status indicates that the current operation of the target application is not abnormal.

[0098] In this embodiment of the application, the presence of a target process in the process list indicates that the target application is in the process of uninstallation or upgrading. In this case, the operation of the target application is not abnormal.

[0099] Step 310: If the target process is not found in the process list, the management platform determines that the target application is not in the target operation state.

[0100] In this embodiment of the application, after the management platform determines that the target application is not in the target operation state, it executes step 311, which can eliminate false alarms caused by the target application being uninstalled or upgraded, thereby more accurately determining whether the target application's running state is abnormal.

[0101] Step 311: If the management platform determines that the target application is not in the target operation state based on the first orchestration service in the virtual machine, it obtains the virtual machine's registry by calling the system API.

[0102] In this embodiment of the application, the registry includes the application in the virtual machine, various parameters of the application, and the parameter values ​​of each parameter.

[0103] Step 312: The management platform obtains the parameter values ​​of the target process of the target application from the registry.

[0104] In the embodiments of this application, the parameter values ​​of the target process of the target application can be used to detect the current running status of the target application.

[0105] Step 313: If the parameter values ​​meet the target values, the management platform determines that the target application is running normally.

[0106] In this embodiment, the target value is a pre-set value. If the parameter value meets the target value, it indicates that the target application is running normally. For example, if the parameter value of the target application indicates that the target application is currently disabled, the target application is functioning normally.

[0107] Step 314: If the parameter value does not meet the target value, the management platform determines that the target application's running status is abnormal.

[0108] In this embodiment of the application, if the parameter value does not meet the target value, it indicates that the running status of the target application is abnormal. In this case, the management platform can automatically trigger a snapshot to retain the data in the virtual machine. The snapshot retention time can also be adjusted to 7 days, and an email alert can be automatically triggered. After receiving the email alert, the user can log in to the management platform to locate the event and quickly handle it.

[0109] It should be noted that the descriptions of the same steps and contents as in other embodiments in this embodiment can be found in the descriptions in other embodiments, and will not be repeated here.

[0110] The state detection method provided in this application, when the first orchestration service in the virtual machine determines that the target application in the virtual machine is not in the target operation state used to characterize that the current operation of the target application is not abnormal, determines whether the running state of the target application is abnormal based on the parameter value of the target application. This can eliminate false alarms caused by the target application during upgrades, uninstallation, and disabling, and solves the problem in related technologies that can only monitor agent abnormalities but cannot eliminate false alarms caused by agent upgrades or uninstallation, thus improving the accuracy of state detection.

[0111] like Figure 5 As shown, the management platform can obtain the running status of the target application every 5 seconds based on the first orchestration service. Specifically, the management platform first determines the operating system of the virtual machine. If the virtual machine's operating system is Linux, it obtains the target process based on the first orchestration service by calling the virtual machine's system commands. It then obtains the process list in the virtual machine. If the target process exists in the process list, it is determined that the target application is in the target operation state, and in this case, the operation state of the target process is determined to be normal. If the target process does not exist in the process list, it is determined that the target application is not in the target operation state. In this case, it obtains the virtual machine's registry and retrieves the parameter values ​​of the target process of the target application from the registry. If the parameter values ​​meet the target values, the running status of the target application is determined to be normal. If the parameter values ​​do not meet the target values, the running status of the target application is determined to be abnormal.

[0112] When the virtual machine's operating system is Windows, the system API of the virtual machine is called to obtain the target process based on the first orchestration service. This retrieves the process list within the virtual machine. If the target process exists in the process list, the target application is determined to be in the target operation state, indicating normal operation. If the target process does not exist in the process list, the target application is determined not to be in the target operation state. In this case, the virtual machine's registry is accessed, and the parameter values ​​of the target process of the target application are obtained. If the parameter values ​​meet the target values, the target application's running state is determined to be normal. If the parameter values ​​do not meet the target values, the target application's running state is determined to be abnormal.

[0113] Based on the foregoing embodiments, embodiments of this application provide a state detection device, which can be applied to... Figures 1-2 In the state detection method provided in the embodiment corresponding to 4, refer to Figure 6 As shown, the state detection device 4 includes:

[0114] The sending unit 41 is used to receive the first orchestration service sent by the security platform and send the first orchestration service to the virtual machine managed by the management platform; wherein, the first orchestration service is detection information based on the target application settings;

[0115] The determining unit 42 is used to determine whether the running state of the target application is abnormal based on the parameter values ​​of the target application when the first orchestration service in the virtual machine determines that the target application is not in the target operation state; wherein, the target operation state indicates that the current operation of the target application is not abnormal.

[0116] In this embodiment of the application, the determining unit 42 is further configured to determine whether the target application is in a target operation state based on the first orchestration service after detecting that a target application is installed on the virtual machine; wherein the target application is installed by the virtual machine using an installation package obtained from the first orchestration service;

[0117] The determining unit is also used to determine whether the running state of the target application is abnormal based on the parameter values ​​of the target application when it is determined that the target application is not in the target operation state.

[0118] In this embodiment of the application, the determining unit 42 is further configured to determine the operating system of the virtual machine;

[0119] The determining unit 42 is also used to determine whether the target application is in the target operation state by calling the system commands of the virtual machine and based on the first orchestration service when the operating system of the virtual machine is the first operating system.

[0120] The determining unit 42 is also used to determine whether the target application is in the target operating state by calling the system application programming interface (API) of the virtual machine when the operating system of the virtual machine is a second operating system, based on the first orchestration service.

[0121] In this embodiment of the application, the determining unit 42 is further configured to determine the target process of the target application based on the first orchestration service;

[0122] Unit 42 is also used to obtain a list of processes in the virtual machine by calling system APIs;

[0123] The determining unit 42 is also used to determine that the target application is in the target operation state if the target process exists in the process list;

[0124] The determining unit 42 is also used to determine that the target application is not in the target operation state if the target process does not exist in the process list.

[0125] In this embodiment of the application, the determining unit 42 is further configured to obtain the virtual machine's registry by calling a system API;

[0126] The determining unit 42 is also used to obtain the parameter values ​​of the target process of the target application from the registry;

[0127] The determination unit 42 is also used to determine that the target application is running normally when the parameter values ​​meet the target values;

[0128] The determination unit 42 is also used to determine that the running status of the target application is abnormal when the parameter value does not meet the target value.

[0129] In this embodiment of the application, the determining unit 42 is further configured to obtain the first orchestration identifier of the first orchestration service;

[0130] The determining unit 42 is also used to receive the second orchestration identifier of the second orchestration service sent by the security platform;

[0131] The determining unit 42 is also used to determine the operating system of the virtual machine when the second arrangement identifier is the same as the first arrangement identifier.

[0132] In this embodiment of the application, the determining unit 42 is further configured to update the first orchestration service in the virtual machine to the second orchestration service corresponding to the second orchestration identifier when the second orchestration identifier is different from the first orchestration identifier.

[0133] The state detection device provided in this application, when determining that the target application in the virtual machine is not in the target operation state used to characterize that the current operation of the target application is not abnormal based on the first orchestration service in the virtual machine, determines whether the running state of the target application is abnormal based on the parameter value of the target application. It can eliminate false alarms caused by the target application during upgrades, uninstallation, and disabling, and solves the problem in related technologies that can only monitor agent abnormalities but cannot eliminate false alarms caused by agent upgrades or uninstallation, thereby improving the accuracy of state detection.

[0134] Based on the foregoing embodiments, embodiments of this application provide a state detection device that can be applied to... Figures 1-2 In the state detection method provided in the embodiment corresponding to 4, refer to Figure 7 As shown, the status detection device 5 may include: a processor 51, a memory 52, and a communication bus 53, wherein:

[0135] Communication bus 53 is used to realize the communication connection between processor 51 and memory 52;

[0136] The processor 51 is used to execute the status detection program in the memory 52 to perform the following steps:

[0137] The system receives the first orchestration service sent by the security platform and sends the first orchestration service to the virtual machine managed by the management platform; wherein, the first orchestration service is based on the detection information set by the target application.

[0138] If the first orchestration service in the virtual machine determines that the target application is not in the target operation state, the target application's running state is determined to be abnormal based on the target application's parameter values; whereby the target operation state indicates that the target application's current operation is not abnormal.

[0139] In other embodiments of this application, the processor 51 is configured to execute a state detection program in the memory 52 to determine whether the running state of the target application is abnormal based on parameter values ​​of the target application when the first orchestration service in the virtual machine determines that the target application is not in the target operating state. This is to achieve the following steps:

[0140] After detecting that the target application is installed on the virtual machine, it is determined whether the target application is in the target operation state based on the first orchestration service; wherein, the target application is installed by the virtual machine using an installation package obtained from the first orchestration service;

[0141] If it is determined that the target application is not in the target operation state, the abnormal running state of the target application is determined based on the parameter values ​​of the target application.

[0142] In other embodiments of this application, the processor 51 is used to execute the state detection program in the memory 52 to determine whether the target application is in a target operating state based on the first orchestration service after detecting that a target application is installed on the virtual machine, so as to implement the following steps:

[0143] Determine the operating system of the virtual machine;

[0144] When the virtual machine's operating system is the first operating system, the system commands of the virtual machine are invoked to determine whether the target application is in the target operating state based on the first orchestration service.

[0145] When the virtual machine's operating system is a secondary operating system, the system application programming interface (API) of the virtual machine is called to determine whether the target application is in the target operating state based on the first orchestration service.

[0146] In other embodiments of this application, the first processor 51 is used to execute the state detection program in the first memory 52 to determine whether the target application is in a target operating state based on the first orchestration service, and may also implement the following steps:

[0147] The target process of the target application is determined based on the first orchestration service;

[0148] Obtain the list of processes in the virtual machine by calling the system API;

[0149] If the target process exists in the process list, it is determined that the target application is in the target operation state;

[0150] If the target process is not found in the process list, it is determined that the target application is not in the target operation state.

[0151] In other embodiments of this application, the processor 51 is used to execute the state detection program in the memory 52 based on the parameter values ​​of the target application to determine whether the running state of the target application is abnormal or normal, and can also implement the following steps:

[0152] The virtual machine's registry is obtained by calling the system API;

[0153] Retrieve parameter values ​​of the target process of the target application from the registry;

[0154] If the parameter values ​​meet the target values, the target application is considered to be running normally.

[0155] If the parameter values ​​do not meet the target values, it is determined that the target application's running status is abnormal.

[0156] In other embodiments of this application, processor 51 is used to execute a state detection program in memory 52 to determine the operating system of the virtual machine in order to perform the following steps:

[0157] Obtain the first orchestration identifier for the first orchestration service;

[0158] Receive the second orchestration identifier for the second orchestration service sent by the security platform;

[0159] If the second orchestration identifier is the same as the first orchestration identifier, the operating system of the virtual machine is determined.

[0160] In other embodiments of this application, the processor 51 may execute the state detection program in the memory 52 to perform the following steps:

[0161] If the second orchestration identifier is different from the first orchestration identifier, the first orchestration service in the virtual machine will be updated to the second orchestration service corresponding to the second orchestration identifier.

[0162] It should be noted that a detailed description of the steps performed by the processor can be found in [reference needed]. Figures 1-2 The state detection method provided in the embodiment corresponding to 4 will not be described again here.

[0163] The state detection device provided in this application, when the first orchestration service in the virtual machine determines that the target application in the virtual machine is not in the target operation state used to characterize that the current operation of the target application is not abnormal, determines whether the running state of the target application is abnormal based on the parameter value of the target application. It can eliminate false alarms caused by the target application during upgrades, uninstallation, or disabling, and solves the problem in related technologies that can only monitor agent abnormalities but cannot eliminate false alarms caused by agent upgrades or uninstallation, thereby improving the accuracy of state detection.

[0164] Based on the foregoing embodiments, embodiments of this application provide a computer-readable storage medium storing one or more programs, which can be executed by one or more processors to implement... Figures 1-2 The steps of the state detection method provided in the embodiment corresponding to 4.

[0165] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of hardware embodiments, software embodiments, or embodiments combining software and hardware aspects. Furthermore, this application can take the form of a computer program product implemented on one or more computer-usable storage media (including, but not limited to, disk storage and optical storage) containing computer-usable program code.

[0166] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this application. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart... Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0167] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0168] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0169] The above description is merely a preferred embodiment of this application and is not intended to limit the scope of protection of this application.

Claims

1. A state detection method, characterized in that, The method includes: The system receives a first orchestration service sent by a security platform and sends the first orchestration service to a virtual machine managed by the management platform; wherein the first orchestration service is detection information generated by the operating system of the virtual machine and set for the target application, and the target application is a virus detection agent; If, based on the first orchestration service in the virtual machine, it is determined that the target application is not in the target operation state, the abnormal running state of the target application is determined based on the parameter values ​​of the target application, specifically including: After detecting that the target application is installed on the virtual machine, the operating system of the virtual machine is determined; If the operating system of the virtual machine is a second operating system, the target process of the target application is determined based on the first orchestration service; The list of processes in the virtual machine can be obtained by calling the system API of the virtual machine; If the target process is not present in the process list, it is determined that the target application is not in the target operation state, wherein the target operation state indicates that the current operation of the target application is not abnormal; Determining whether the running status of the target application is abnormal based on the parameter values ​​of the target application includes: The system API is invoked to obtain the virtual machine's registry. Obtain the parameter values ​​of the target process of the target application from the registry; If the parameter value meets the target value, the target application is determined to be running normally. If the parameter value does not meet the target value, it is determined that the running status of the target application is abnormal.

2. The method according to claim 1, characterized in that, The method further includes: The target application is installed by the virtual machine using an installation package obtained from the first orchestration service.

3. The method according to claim 1, characterized in that, The method further includes: When the operating system of the virtual machine is the first operating system, the system commands of the virtual machine are invoked to determine whether the target application is in the target operating state based on the first orchestration service.

4. The method according to claim 1, characterized in that, The method further includes: If the target process exists in the process list, the target application is determined to be in the target operation state.

5. The method according to claim 3, characterized in that, Determining the operating system of the virtual machine includes: Obtain the first orchestration identifier of the first orchestration service; Receive the second orchestration identifier of the second orchestration service sent by the security platform; If the second orchestration identifier is the same as the first orchestration identifier, the operating system of the virtual machine is determined.

6. The method according to claim 5, characterized in that, The method further includes: If the second orchestration identifier is different from the second orchestration identifier, the first orchestration service in the virtual machine is updated to the second orchestration service corresponding to the second orchestration identifier.

7. A state detection device, characterized in that, The device includes: The sending unit is configured to receive a first orchestration service sent by the security platform and send the first orchestration service to a virtual machine managed by the management platform; wherein, the first orchestration service is detection information generated by the operating system of the virtual machine and set for the target application, and the target application is a virus detection agent; The determining unit is configured to determine whether the running state of the target application is abnormal based on the parameter values ​​of the target application when the target application is determined not to be in the target operation state based on the first orchestration service in the virtual machine. Specifically, it includes determining the operating system of the virtual machine after detecting that the target application is installed on the virtual machine. If the operating system of the virtual machine is a second operating system, the target process of the target application is determined based on the first orchestration service; The list of processes in the virtual machine can be obtained by calling the system API of the virtual machine; If the target process is not present in the process list, it is determined that the target application is not in the target operation state, wherein the target operation state indicates that the current operation of the target application is not abnormal; Determining whether the running status of the target application is abnormal based on the parameter values ​​of the target application includes: The system API is invoked to obtain the virtual machine's registry. Obtain the parameter values ​​of the target process of the target application from the registry; If the parameter value meets the target value, the target application is determined to be running normally. If the parameter value does not meet the target value, it is determined that the running status of the target application is abnormal.

8. A condition detection device, characterized in that, The device includes: a processor, a memory, and a communication bus; The communication bus is used to realize the communication connection between the processor and the memory; The processor is used to execute a state detection program in memory to implement the steps of the state detection method as described in any one of claims 1 to 6.

9. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores one or more programs, which can be executed by one or more processors to implement the steps of the state detection method as described in any one of claims 1 to 6.

Images