File monitoring method, device, electronic device and storage medium for application system

Abstract

The present disclosure provides a file monitoring method, device, electronic device and storage medium for an application system, which can be applied to the field of artificial intelligence, finance or other fields. The method includes: inserting a monitoring code into at least one application code of the application system by inserting a stub; determining the operation information involved in the business operation of the application system according to the monitoring code; comparing the operation information with the information in the operation information library corresponding to the business operation, determining the abnormal operation information in the operation information, and automatically intercepting and processing the corresponding business operation according to at least one abnormal operation information.

Description

Technical Field

[0001] The present disclosure relates to the field of computer security technology, and more specifically to a file monitoring method, device, electronic device, and readable storage medium for an application system. Background Art

[0002] With the development of Internet technology, system security has become particularly important. After the system is connected to the Internet, how to use more effective technical means to monitor and deal with Internet application attack behaviors in real time is a topic of widespread concern. Among the Internet application attack methods, the attack methods involving file operations such as illegal uploading, reading, writing, and deleting files are particularly harmful. Not only will it cause network assets to be leaked and lost, it is also likely to cause the server where the network assets are located to be uploaded with a webshell by hackers, and then the server will be controlled by hackers, becoming an entry point for hackers to penetrate the intranet.

[0003] In related technologies, for example, monitoring file operations through logs usually requires monitoring personnel to manually review a large number of logs and investigate attack behaviors one by one. Since there are many normal businesses involving file operations, this method is often inefficient and cannot block attacks in real time; while through traffic monitoring, monitoring may fail due to traffic encryption. Moreover, these peripheral monitoring methods cannot penetrate deep into the application, nor can they determine in real time whether the file contains malicious content, which often results in the monitoring software being unable to distinguish between normal business and attack requests, resulting in asset leakage in the system and attacks by malicious file operation requests. Summary of the invention

[0004] In view of the above problems, the present disclosure provides a file monitoring method, device, electronic device, readable storage medium and computer program product for an application system, which can effectively implement file monitoring of the application system and improve the security of the application system.

[0005] According to a first aspect of the present disclosure, a file monitoring method for an application system is provided, comprising: inserting a monitoring code into at least one application code of the application system by means of an insertion method; determining operation information involved in a business operation of the application system according to the monitoring code; comparing the operation information with information in an operation information library corresponding to the business operation, determining abnormal operation information in the operation information, and automatically intercepting and processing the corresponding business operation according to at least one of the abnormal operation information.

[0006] In some exemplary embodiments of the present disclosure, before comparing the operation information with the information in the operation information library corresponding to the business operation, the method also includes constructing the operation information library, and the operation information library includes a normal operation information library and an abnormal operation information library; constructing the operation information library includes: obtaining normal business operations corresponding to the application system, and generating a normal operation information library; obtaining abnormal business operations fed back by the application system and / or input by the user, and generating an abnormal operation information library.

[0007] In some exemplary embodiments of the present disclosure, the operation information includes an operation file; the operation information is compared with the information in the operation information library corresponding to the business operation to determine the abnormal operation information in the operation information, including: transcoding the operation file to generate the source code of the operation file, comparing the consistency of the source code with the type source code of the operation file, and generating a first comparison result; and comparing the type of the operation file and / or the size of the operation file with the type of the operation file and / or the size of the operation file in the normal operation information library to generate a second comparison result; when at least one of the first comparison result and the second comparison result is abnormal, determining that the operation file is abnormal operation information.

[0008] In some exemplary embodiments of the present disclosure, the operation information also includes a current operation path; comparing the operation information with the information in an operation information library corresponding to the business operation to determine the abnormal operation information in the operation information includes: comparing the current operation path with the operation path in the operation information library corresponding to the current business operation; if the current operation path is inconsistent with the operation path in the normal operation information library, and / or the current operation path is consistent with the operation path in the abnormal operation information library, then determining that the current operation path is abnormal operation information.

[0009] In some exemplary embodiments of the present disclosure, the operation information also includes a current operation action; the operation information is compared with the information in the operation information library corresponding to the business operation to determine the abnormal operation information in the operation information, including: comparing the current operation action with the operation action in the operation information library corresponding to the current business operation; if the current operation action is inconsistent with the operation action in the normal operation information library, and / or the current operation action is consistent with the operation action in the abnormal operation information library, then the current operation action is determined to be abnormal operation information.

[0010] In some exemplary embodiments of the present disclosure, the operation information also includes a current operation time; comparing the operation information with the information in an operation information library corresponding to the business operation to determine the abnormal operation information in the operation information includes: comparing the current operation time with the range of operation times in the operation information library corresponding to the current business operation; if the current operation time is greater than the operation time in the normal operation information library, and / or the current operation time satisfies the operation time in the abnormal operation information library, then determining that the current operation time is abnormal operation information.

[0011] In some exemplary embodiments of the present disclosure, the automatic interception and processing of the corresponding business operation based on at least one of the abnormal operation information includes: generating an attack method record of the business operation based on the abnormal operation information; and obtaining a preset interception and processing method to intercept and process the business operation based on the specific content corresponding to each abnormal operation information.

[0012] In some exemplary embodiments of the present disclosure, after automatically intercepting and processing a business operation corresponding to at least one of the abnormal operation information, it also includes: analyzing and processing the result of the automatic interception processing to generate a monitoring result.

[0013] According to a second aspect of the present disclosure, there is provided a file monitoring device for an application system, comprising: a monitoring code insertion module, configured to insert a monitoring code into at least one application code of the application system by means of an insertion method; an operation information determination module, configured to determine operation information involved in a business operation of the application system according to the monitoring code; and an automatic interception module, configured to compare the operation information with information in an operation information library corresponding to the business operation, determine abnormal operation information in the operation information, and automatically intercept and process the corresponding business operation according to at least one of the abnormal operation information.

[0014] In some exemplary embodiments of the present disclosure, the file monitoring device further includes an information base construction module, and the information base construction module is configured to construct the operation information base before comparing the operation information with the information in the operation information base corresponding to the business operation. The operation information base includes a normal operation information base and an abnormal operation information base.

[0015] In some exemplary embodiments of the present disclosure, the information base construction module includes a first construction submodule and a second construction submodule. The first construction submodule is configured to obtain normal business operations corresponding to the application system and generate a normal operation information base; the second construction submodule is configured to obtain abnormal business operations fed back by the application system and / or input by the user and generate an abnormal operation information base.

[0016] In some exemplary embodiments of the present disclosure, the automatic interception module includes a first submodule. The operation information includes an operation file; the first submodule is configured to transcode the operation file to generate a source code of the operation file, compare the consistency of the source code with the type source code of the operation file, and generate a first comparison result; and compare the type of the operation file and / or the size of the operation file with the type of the operation file and / or the size of the operation file in the normal operation information library to generate a second comparison result; when at least one of the first comparison result and the second comparison result is abnormal, determine that the operation file is abnormal operation information.

[0017] In some exemplary embodiments of the present disclosure, the automatic interception module includes a second submodule. The operation information also includes a current operation path. The second submodule is configured to compare the current operation path with the operation path in the operation information library corresponding to the current business operation, and if the current operation path is inconsistent with the operation path in the normal operation information library, and / or the current operation path is consistent with the operation path in the abnormal operation information library, then the current operation path is determined to be abnormal operation information.

[0018] In some exemplary embodiments of the present disclosure, the automatic interception module includes a third submodule. The operation information also includes a current operation action. The third submodule is configured to compare the current operation action with the operation action in the operation information library corresponding to the current business operation, and if the current operation action is inconsistent with the operation action in the normal operation information library, and / or the current operation action is consistent with the operation action in the abnormal operation information library, then determine that the current operation action is abnormal operation information.

[0019] In some exemplary embodiments of the present disclosure, the automatic interception module includes a fourth submodule. The operation information also includes a current operation time. The fourth submodule is configured to compare the current operation time with the range of operation time in the operation information library corresponding to the current business operation, and if the current operation time is greater than the operation time in the normal operation information library, and / or the current operation time meets the operation time in the abnormal operation information library, then the current operation time is determined to be abnormal operation information.

[0020] In some exemplary embodiments of the present disclosure, the automatic interception module includes a fifth submodule. The fifth submodule is configured to: generate an attack method record of the business operation according to the abnormal operation information; and obtain a preset interception processing method to intercept the business operation according to the specific content corresponding to each abnormal operation information.

[0021] In some exemplary embodiments of the present disclosure, the file monitoring device further includes a monitoring result generation module. The monitoring result generation module is configured to analyze and process the result of the automatic interception process after the business operation corresponding to at least one abnormal operation information is automatically intercepted and processed to generate a monitoring result.

[0022] According to a third aspect of the present disclosure, an electronic device is provided, comprising: one or more processors; a storage device for storing executable instructions, wherein when the executable instructions are executed by the processors, the method described above is implemented.

[0023] According to a fourth aspect of the present disclosure, a computer-readable storage medium is provided, on which executable instructions are stored. When the instructions are executed by a processor, the method described above is implemented.

[0024] According to a fifth aspect of the present disclosure, a computer program product is provided, comprising a computer program, wherein when the computer program is executed by a processor, the method described above is implemented.

[0025] According to the embodiments of the present disclosure, the monitoring code is inserted into the application code of the application system by means of insertion, so as to realize the monitoring of the business operations of the application system. By comparing the information corresponding to the business operations in the business operation information base, the business operations are intercepted and processed according to the abnormal operation information, which can improve the monitoring efficiency. By comparing with the business operation information base, the monitoring accuracy can be improved and erroneous interception can be effectively reduced. BRIEF DESCRIPTION OF THE DRAWINGS

[0026] The above contents and other objects, features and advantages of the present disclosure will become more apparent through the following description of the embodiments of the present disclosure with reference to the accompanying drawings, in which:

[0027] Figure 1 A schematic diagram schematically shows a system architecture of a file monitoring method of an application system to which an embodiment of the present disclosure can be applied;

[0028] Figure 2 A flowchart of a file monitoring method according to an embodiment of the present disclosure is schematically shown;

[0029] Figure 3 The flowchart of the file monitoring method according to the embodiment of the present disclosure before operation S230 is schematically shown;

[0030] Figure 4 A flowchart of the file monitoring method according to an embodiment of the present disclosure when the operation information is an operation file is schematically shown;

[0031] Figure 5The flowchart of the file monitoring method according to the embodiment of the present disclosure when the operation information is the current operation path is schematically shown;

[0032] Figure 6 A flowchart of the file monitoring method according to an embodiment of the present disclosure when the operation information is a current operation action is schematically shown;

[0033] Figure 7 A flowchart of the file monitoring method according to an embodiment of the present disclosure when the operation information is the current operation time is schematically shown;

[0034] Figure 8 A flowchart schematically shows the automatic interception process of the file monitoring method according to an embodiment of the present disclosure;

[0035] Fig. 9 A flowchart of the file monitoring method according to an embodiment of the present disclosure after automatic interception processing is performed is schematically shown;

[0036] Fig.10 A structural block diagram of a file monitoring device according to an embodiment of the present disclosure is schematically shown; and

[0037] Fig.11 A block diagram of an electronic device suitable for implementing a file monitoring method according to an embodiment of the present disclosure is schematically shown. DETAILED DESCRIPTION

[0038] Hereinafter, embodiments of the present disclosure will be described with reference to the accompanying drawings. However, it should be understood that these descriptions are exemplary only and are not intended to limit the scope of the present disclosure. In the following detailed description, for ease of explanation, many specific details are set forth to provide a comprehensive understanding of the embodiments of the present disclosure. However, it is apparent that one or more embodiments may also be implemented without these specific details. In addition, in the following description, descriptions of known structures and technologies are omitted to avoid unnecessary confusion of the concepts of the present disclosure.

[0039] The terms used herein are only for describing specific embodiments and are not intended to limit the present disclosure. The terms "comprise", "include", etc. used herein indicate the existence of the features, steps, operations and / or components, but do not exclude the existence or addition of one or more other features, steps, operations or components.

[0040] All terms (including technical and scientific terms) used herein have the meanings commonly understood by those skilled in the art, unless otherwise defined. It should be noted that the terms used herein should be interpreted as having a meaning consistent with the context of this specification, and should not be interpreted in an idealized or overly rigid manner.

[0041] When using expressions such as "at least one of A, B, and C, etc.", they should generally be interpreted according to the meaning of the expression commonly understood by those skilled in the art (for example, "a system having at least one of A, B, and C" should include but is not limited to a system having A alone, B alone, C alone, A and B, A and C, B and C, and / or A, B, C, etc.).

[0042] In the technical solution disclosed in the present invention, the acquisition, storage and application of user personal information involved are in compliance with the provisions of relevant laws and regulations, necessary confidentiality measures are taken, and do not violate public order and good morals.

[0043] In order to solve the problem in the related art that malicious content received by the system cannot be monitored quickly and effectively, the present disclosure provides a file monitoring method, device, electronic device, readable storage medium and computer program product for application system files. The file monitoring method includes but is not limited to: inserting monitoring code into at least one application code of the application system by inserting a stub; determining the operation information involved in the business operation of the application system according to the monitoring code; comparing the operation information with the information in the operation information library corresponding to the business operation, determining the abnormal operation information in the operation information, and automatically intercepting and processing the corresponding business operation according to at least one abnormal operation information.

[0044] According to the embodiments of the present disclosure, the monitoring code is inserted into the application code of the application system by means of insertion, thereby realizing the monitoring of the business operations of the application system. By comparing the information corresponding to the business operations in the business operation information library, the business operations are automatically intercepted and processed according to the abnormal operation information, thereby improving the monitoring efficiency. By comparing the operation information with the business operation information library, the monitoring accuracy can be improved and erroneous interception can be effectively reduced.

[0045] Figure 1 The following is a schematic diagram showing the system architecture of the file monitoring method of the application system to which the present disclosure embodiment can be applied. It should be noted that: Figure 1 What is shown is only an example of a system architecture to which the embodiments of the present disclosure can be applied, in order to help those skilled in the art understand the technical content of the present disclosure, but it does not mean that the embodiments of the present disclosure cannot be used in other devices, systems, environments or scenarios. It should be noted that the file monitoring method and device of the application system provided by the embodiments of the present disclosure can be used in the field of computer security technology, in the financial field in computer security related aspects, and can also be used in any field other than the financial field. The file monitoring method and device of the application system provided by the embodiments of the present disclosure do not limit the application field.

[0046] like Figure 1As shown, an exemplary system architecture 100 to which the file monitoring method can be applied may include terminal devices 101, 102, 103, a network 104, and a server 105. The network 104 is used to provide a medium for a communication link between the terminal devices 101, 102, 103 and the server 105. The network 104 may include various connection types, such as wired, wireless communication links, or optical fiber cables, etc.

[0047] Users can use terminal devices 101, 102, 103 to interact with server 105 through network 104 to receive or send messages, etc. Various communication client applications can be installed on terminal devices 101, 102, 103, such as file processing applications, shopping applications, web browser applications, search applications, instant messaging tools, email clients, social platform software, etc. (only as examples).

[0048] The terminal devices 101, 102, 103 may be various electronic devices having display screens and supporting functions such as data analysis, data processing, and web browsing, including but not limited to smart phones, tablet computers, laptop computers, and desktop computers.

[0049] The server 105 may be a server that provides various services, such as a background management server that provides support for the data obtained or websites browsed by the user using the terminal devices 101, 102, and 103 (for example only). The background management server may analyze and process the received data such as user requests, and feed back the processing results (such as web pages, information, or data obtained or generated according to the user request) to the terminal device. It may also analyze or process the files sent by the user, and control the terminal device based on the processing results, such as limiting the access of the terminal device.

[0050] It should be noted that the file monitoring method of the application system provided in the embodiment of the present disclosure can generally be executed by the server 105. Accordingly, the file monitoring device of the application system provided in the embodiment of the present disclosure can generally be set in the server 105. The file monitoring method of the application system provided in the embodiment of the present disclosure can also be executed by a server or server cluster that is different from the server 105 and can communicate with the terminal devices 101, 102, 103 and / or the server 105. Accordingly, the file monitoring device of the application system provided in the embodiment of the present disclosure can also be set in a server or server cluster that is different from the server 105 and can communicate with the terminal devices 101, 102, 103 and / or the server 105.

[0051] It should be understood that Figure 1 The number of terminal devices, networks and servers in the embodiment is only for illustration. Any number of terminal devices, networks and servers may be provided according to implementation requirements.

[0052] The following will be passed Figures 2 to 9 The file monitoring method of the application system of the disclosed embodiment is described in detail.

[0053] Figure 2 The flowchart of the file monitoring method according to the embodiment of the present disclosure is schematically shown.

[0054] like Figure 2 As shown, the process 200 of the file monitoring method disclosed in the present invention includes operations S210 to S230.

[0055] In operation S210, the monitoring code is inserted into at least one application code of the application system by using an insertion method.

[0056] For example, the monitoring code is inserted into the application of the application system by using an agent program in an insertion manner, wherein the agent program is another program independent of the application. Specifically, the monitoring code can be inserted into the application code of the application, but the function and structure of the code of the original application will not be changed. In this embodiment, the inserted monitoring code can be inserted into one application code or multiple application codes, thereby realizing the monitoring of the application of the application system.

[0057] In the embodiments of the present disclosure, the instrumentation is to insert a probe into the monitored application program, and then obtain the control flow and data flow information of the program through the execution of the probe, thereby realizing the monitoring of the application program and related files of the application system.

[0058] After the monitoring code is inserted into at least one application code of the application system, operation S220 is performed.

[0059] In operation S220, operation information related to the business operation of the application system is determined according to the monitoring code.

[0060] Since the monitoring code can obtain the control flow, data flow information and other contents of the program, it can track the operational information of the business operation design of the application system.

[0061] For example, the operation information may include the operation file, the current operation path, the current operation action, the current operation time, etc. Based on the acquired operation information, the operation information may be analyzed in subsequent operations to acquire the content corresponding to the business operation of the referenced system.

[0062] According to the monitoring code, for example, the type of the operation file executed by the business operation, the size of the operation file, and other information can be determined. For another example, the current operation path of the business operation can be determined, the path to move the file corresponding to the business operation, or the file path moved from another location, etc. For example, the current operation action of the business operation can be determined, including copying and modifying the file, etc. For another example, the current operation time of the business operation can be determined, including the time spent by the corresponding business operation, etc.

[0063] After the operation information involved in the business operation is determined, operation S230 is performed.

[0064] In operation S230, the operation information is compared with information in an operation information library corresponding to the business operation, abnormal operation information in the operation information is determined, and the corresponding business operation is automatically intercepted and processed according to at least one abnormal operation information.

[0065] In an embodiment of the present disclosure, after the operation information is acquired, the acquired operation information is compared with the information in the corresponding operation information library to determine whether the operation information is abnormal operation information.

[0066] If the operation information is determined to be abnormal operation information, the corresponding business operation is automatically intercepted and processed according to the determined abnormal operation information. In an embodiment of the present disclosure, when at least one operation information corresponding to a business operation is determined to be abnormal operation information, automatic interception processing is performed, which can improve the accuracy of the file monitoring method.

[0067] In other optional embodiments, adjustments may also be made according to actual circumstances to meet the file monitoring requirements of different application systems.

[0068] Figure 3 The flowchart of the file monitoring method according to the embodiment of the present disclosure before operation S230 is schematically shown.

[0069] In an embodiment of the present disclosure, before comparing the operation information with the information in the operation information library corresponding to the business operation, the file monitoring method of the present disclosure further includes constructing the operation information library.

[0070] The operation information base includes a normal operation information base and an abnormal operation information base.

[0071] like Figure 3 As shown, the process 300 of constructing the operation information library includes operation S310 and operation S320.

[0072] In operation S310, normal business operations corresponding to the application system are obtained, and a normal operation information library is generated.

[0073] In the embodiments of the present disclosure, when the application system performs normal business operations, it has corresponding operation information. For example, the file format of the normal business operation is a specific format, such as when opening a picture file, the format of the picture file is a jpg format file. For another example, when opening a text file, the format of the text file is a txt, word format file, etc.

[0074] For another example, when the operation information corresponds to an operation path, when opening certain files, the files may be stored in a specific path. For example, when opening a word file, a temporary file is generated and stored in a preset folder.

[0075] For another example, when the operation information corresponds to an operation action, a temporary file may be generated when opening certain files, or an action such as copying the file may not be generated when opening the file.

[0076] For another example, when the operation information corresponds to the operation time, when opening certain files, the time to open the file has a certain length range, and within this length range, it indicates normal operation. For example, opening a word document takes 1 to 3 seconds, which is a normal operation. When the time to open a word document exceeds this time, it may be considered as an abnormal operation.

[0077] In an embodiment of the present disclosure, the normal operation information library is generated by acquiring the operation information corresponding to the normal business operation. If the operation information acquired in operation S220 corresponds to the operation information of the business operation in the journey operation information library, it can be determined that the operation information acquired in operation S220 is normal operation information.

[0078] In operation S320, abnormal business operations fed back by the application system and / or input by the user are obtained, and an abnormal operation information library is generated.

[0079] In the embodiments of the present disclosure, during the operation of the application system, there may be abnormal business operations. These abnormal business operations may cause problems such as the application system being attacked. Therefore, the application system can identify certain business operations as abnormal operations in a preset manner. When the business operation of the application system executes the preset manner, the application system feeds back the abnormal operation information, thereby generating an abnormal operation information library. In addition, in addition to the application system automatically feeding back abnormal operation information, the abnormal operation information library can also be improved and strengthened by user input, thereby collecting more abnormal operation information, facilitating comparison in subsequent processes, and further improving the accuracy of the file monitoring method disclosed in the present disclosure.

[0080] According to the embodiments of the present disclosure, by generating a normal operation information library and an abnormal operation information library, the efficiency and accuracy of the file monitoring method in automatically intercepting and processing business operations corresponding to abnormal operation information can be effectively improved. In addition, since the abnormal operation information library can be improved by user input, the abnormal operation information library is continuously updated, so that the abnormal operation information library can always be updated, thereby further improving the defense of the application system.

[0081] Figure 4 The flowchart of the file monitoring method according to the embodiment of the present disclosure when the operation information is an operation file is schematically shown.

[0082] like Figure 4 As shown, when the operation information asks the operation file, the operation information is compared with the information in the operation information library corresponding to the business operation, and the process 400 of determining abnormal operation information in the operation information includes operation S410 to operation S430.

[0083] In operation S410, the operation file is transcoded to generate a source code of the operation file, and the source code is compared with a type source code of the operation file for consistency to generate a first comparison result.

[0084] In an embodiment of the present disclosure, the operation information library includes type source codes of operation files, and each type of file has a corresponding type source code.

[0085] For example, a picture type file has a source code of that type, and a word document has a source code of that type corresponding to the document.

[0086] After the operation file is obtained, the operation file is transcoded to obtain a source code of the operation file, and the source code is compared with a type source code of the operation file to generate a first comparison result.

[0087] By transcoding and comparing the source code of the operation file with the type source code to determine whether the operation file is an operation file of the corresponding type, it can effectively prevent attackers from evading the monitoring of the application system by modifying the suffix name of the operation file.

[0088] In an embodiment of the present disclosure, if the source code of the operation file obtained after transcoding is consistent with the type source code of the operation file, the operation file is deemed consistent and the first comparison result is normal. If the source code of the operation file obtained after transcoding is inconsistent with the type source code of the operation file, the first comparison result is abnormal.

[0089] In operation S420, the type of the operation file and / or the size of the operation file are compared with the type of the operation file and / or the size of the operation file in the normal operation information library to generate a second comparison result.

[0090] In an embodiment of the present disclosure, the type of the operation file is compared with the type of the operation file in the operation information library. For example, during the file generation operation of the application system, the generated operation file is a txt file, and the type of the generated txt file is compared with the type of the operation file in the operation information library. If, in the operation information library, for the same file generation operation, the generated file is also a txt file, then it is determined that the operation file of the business operation is the same as the type of the operation file of the business operation in the operation information library, and the second comparison result is normal. If the type of the operation file corresponding to the same business operation is inconsistent with the type of the operation file in the operation information library, the generated second comparison result is abnormal.

[0091] In an embodiment of the present disclosure, the size of the operation file corresponding to the same business operation needs to be compared with the size of the operation file in the operation information library. If the size of the operation file exceeds a preset threshold, a second comparison result exception is generated.

[0092] For example, when the type of the operation file is an executable script file and contains malicious content, the type or size of the file may be obviously abnormal. For example, the file type is inconsistent with the type in the normal operation information library, or the file size is inconsistent with the size in the normal operation information library, then it is determined as abnormal operation information.

[0093] According to the embodiments of the present disclosure, firstly, the source code of the operation file is obtained by transcoding the operation file, and then compared with the source code of the same type, so as to avoid the method in which the attacker evades monitoring by only modifying the suffix of the operation file. Secondly, by further comparing the type and size of the operation file, the abnormal operation information can be screened more accurately, which can effectively improve the accuracy of the file monitoring method of the present disclosure and improve the ability of the application system to resist abnormal operation attacks.

[0094] In operation S430, when at least one of the first comparison result and the second comparison result is abnormal, the operation file is determined to be abnormal operation information.

[0095] In the embodiment of the present disclosure, abnormal operation information can be effectively checked out through operation S430, and then the business operation in the application system can be automatically intercepted and processed according to the abnormal operation information, thereby improving the accuracy of automatic interception.

[0096] Figure 5 The flowchart of the file monitoring method according to the embodiment of the present disclosure when the operation information is the current operation path is schematically shown.

[0097] like Figure 5As shown, in the embodiment of the present disclosure, the operation information also includes the current operation path. The process 500 of comparing the operation information with the information in the operation information library corresponding to the business operation and determining the abnormal operation information in the operation information also includes operations S510 to S520.

[0098] In operation S510, the current operation path is compared with the operation path in the operation information library corresponding to the current business operation.

[0099] In the embodiments of the present disclosure, when performing business operations, normal business operations have the same business operation path, and abnormal business operations have current operation paths that are different from normal business operation paths. Therefore, abnormal operation information can be screened out by comparing the operation paths.

[0100] In operation S520, if the current operation path is inconsistent with the operation path in the normal operation information library, and / or the current operation path is consistent with the operation path in the abnormal operation information library, the current operation path is determined to be abnormal operation information.

[0101] In an embodiment of the present disclosure, during the comparison process, comparing the current operation path with the operation in the operation information library corresponding to the current business operation includes comparing with a normal operation information library and comparing with an abnormal operation information library.

[0102] If the current operation path is inconsistent with the operation path in the normal operation information library, it indicates that the current operation path is abnormal operation information. In addition, if the current operation path is consistent with the operation path in the abnormal operation information library, it also indicates that the current operation path is abnormal operation information. When determining the abnormal operation information, as long as one of the comparison processes determines that the current operation path is abnormal operation information, the business operation corresponding to the abnormal operation information is automatically intercepted.

[0103] According to the embodiments of the present disclosure, the accuracy of the acquired abnormal operation information can be improved by comparing with the normal operation information library and the abnormal operation information library. In addition, the abnormal operation information library is updated in real time by the user and has more accurate data, so that the acquired abnormal operation information is more accurate and more credible.

[0104] In an optional embodiment of the present disclosure, if the current operation path is inconsistent with the operation path in the normal operation information library, and the current operation path is also inconsistent with the operation path in the abnormal operation information library, the operation information can be sent to the user for manual review to reduce misjudgment of the application system and improve efficiency.

[0105] Figure 6 The flowchart of the file monitoring method according to the embodiment of the present disclosure when the operation information is the current operation action is schematically shown.

[0106] like Figure 6 As shown, in an embodiment of the present disclosure, the operation information also includes the current operation action, and the operation information is compared with the information in the operation information library corresponding to the business operation. The process 600 of determining abnormal operation information in the operation information includes operations S610 to S620.

[0107] In operation S610, the current operation action is compared with the operation action in the operation information library corresponding to the current business operation.

[0108] In the embodiments of the present disclosure, business operations correspond to different operation actions, such as the action of reading a file or the action of writing a file. Different operation actions present different risks. For example, reading system sensitive files such as etc., password, or reading application configuration files such as we.xml, has the risk of abnormality. In this regard, the efficiency of determining abnormal operation information is improved by comparing the current operation action with the operation action in the operation information library.

[0109] In operation S620, if the current operation action is inconsistent with the operation action in the normal operation information library, and / or the current operation action is consistent with the operation action in the abnormal operation information library, the current operation action is determined to be abnormal operation information.

[0110] In the embodiment of the present disclosure, the comparison process includes comparison with a normal operation information library and comparison with an abnormal operation information library.

[0111] For example, if the current operation action is inconsistent with the operation action in the normal operation information library, it indicates that the current operation path is abnormal operation information. In addition, if the current operation action is consistent with the operation action in the abnormal operation information library, it also indicates that the current operation action is abnormal operation information. When determining the abnormal operation information, as long as one of the comparison processes determines that the current operation action is abnormal operation information, the business operation corresponding to the abnormal operation information is automatically intercepted.

[0112] Figure 7 The flowchart of the file monitoring method according to the embodiment of the present disclosure when the operation information is the current operation time is schematically shown.

[0113] like Figure 7 As shown, in an embodiment of the present disclosure, the operation information also includes the current operation time.

[0114] The process 700 of comparing the operation information with the information in the operation information library corresponding to the business operation to determine abnormal operation information in the operation information includes operations S710 to S720.

[0115] In operation S710, the current operation time is compared with a range of operation time in an operation information library corresponding to the current business operation.

[0116] For example, during business operations, it takes a certain amount of time to process files, so the operation time can be used as a factor to determine whether the business operation information is abnormal. For example, during the same business operation, if the operation time of the file processing process is not much different, it can be considered as normal operation information. If the operation time of the file processing process is significantly different, it can be considered as abnormal operation information.

[0117] In operation S720, if the current operation time is greater than the operation time in the normal operation information library, and / or the current operation time satisfies the operation time in the abnormal operation information library, the current operation time is determined to be abnormal operation information.

[0118] According to an embodiment of the present disclosure, by comparing the current operation path, current operation action, current operation time and other information in the operation information with a normal operation information library and an abnormal operation information library, the accuracy of determining abnormal operation information is improved, thereby reducing misjudgment of the application system and improving efficiency.

[0119] Figure 8 The flowchart of the file monitoring method according to the embodiment of the present disclosure during automatic interception processing is schematically shown.

[0120] like Figure 8 As shown, automatically intercepting and processing a corresponding business operation according to at least one abnormal operation information includes operations S810 to S820.

[0121] In operation S810, an attack method record of the business operation is generated according to the abnormal operation information.

[0122] In an embodiment of the present disclosure, after determining the abnormal operation information, an attack method record corresponding to the abnormal operation information is generated according to the content of the abnormal operation information, for example, an attack method record corresponding to an inconsistent operation file type, or an attack method record corresponding to an inconsistent operation path, or an attack method record corresponding to an inconsistent operation action.

[0123] In addition, if the attack method record is not recorded in the abnormal operation information database, the abnormal operation information database is updated according to the abnormal operation information, thereby improving the abnormal operation information database.

[0124] In operation S820, according to the specific content corresponding to each abnormal operation information, a preset interception processing method is obtained to intercept and process the business operation.

[0125] In the embodiments of the present disclosure, there are preset interception processing methods for different abnormal operation information. For example, when the abnormal operation information is the current operation action, file interception processing is performed to stop the reading and writing of files and other operations. For example, when the abnormal operation information is the current operation path, access to a specific path can be blocked, and operations such as access process, log recording, and IP blocking can be blocked.

[0126] Since the abnormal operation information is different, using different interception and processing methods to intercept and process business operations can effectively improve the efficiency of interception and processing.

[0127] Fig. 9 The flowchart of the file monitoring method according to the embodiment of the present disclosure after automatic interception processing is schematically shown.

[0128] like Fig. 9 As shown, after operation S230, operation S240 is further included.

[0129] In operation S240, the result of the automatic interception process is analyzed and processed to generate a monitoring result.

[0130] For example, the abnormal operation information obtained from each monitoring is recorded and stored, and the abnormal operation information is classified and counted, such as the attack type involved in the abnormal operation information, the files involved, whether the automatic interception is blocked, the time consumed by the automatic interception, etc., so that users can query, analyze, trace the monitoring results, etc. In addition, the monitoring results can be sent to the corresponding display device for real-time viewing by users, such as sending to the front-end web interface, etc.

[0131] According to the embodiments of the present disclosure, the monitoring code is inserted into the application code of the application system by means of insertion, thereby realizing the monitoring of the business operations of the application system. By comparing the information corresponding to the business operations in the business operation information library, the business operations are automatically intercepted and processed according to the abnormal operation information, thereby improving the monitoring efficiency. By comparing the operation information with the business operation information library, the monitoring accuracy can be improved and erroneous interception can be effectively reduced.

[0132] Fig.10 The structural block diagram of the file monitoring device according to an embodiment of the present disclosure is schematically shown.

[0133] like Fig.10 As shown, the file monitoring device 1000 of the embodiment of the present disclosure includes a monitoring code insertion module 1010 , an operation information determination module 1020 , and an automatic interception module 1030 .

[0134] The monitoring code insertion module 1010 is configured to insert the monitoring code into at least one application code of the application system by using an instrumentation method. In one embodiment, the monitoring code insertion module 1010 can be used to perform the operation S210 described above, which will not be described in detail here.

[0135] The operation information determination module 1020 is configured to determine the operation information related to the business operation of the application system according to the monitoring code. In one embodiment, the operation information determination module 1020 can be used to perform the operation S220 described above, which will not be repeated here.

[0136] The automatic interception module 1030 is configured to compare the operation information with the information in the operation information library corresponding to the business operation, determine the abnormal operation information in the operation information, and automatically intercept the corresponding business operation according to at least one abnormal operation information. In one embodiment, the automatic interception module 1030 can be used to perform the operation S230 described above, which will not be repeated here.

[0137] In an embodiment of the present disclosure, the file monitoring device 1000 further includes an information base construction module, which is configured to construct an operation information base before comparing the operation information with information in the operation information base corresponding to the business operation. The operation information base includes a normal operation information base and an abnormal operation information base.

[0138] The information base construction module includes a first construction submodule and a second construction submodule. The first construction submodule is configured to obtain normal business operations corresponding to the application system and generate a normal operation information base.

[0139] The second construction submodule is configured to obtain abnormal business operations fed back by the application system and / or input by the user, and generate an abnormal operation information library.

[0140] In an embodiment of the present disclosure, the automatic interception module includes a first submodule. The operation information includes an operation file; the first submodule is configured to transcode the operation file to generate a source code of the operation file, compare the consistency of the source code with the type source code of the operation file, and generate a first comparison result; and compare the type of the operation file and / or the size of the operation file with the type of the operation file and / or the size of the operation file in the normal operation information library to generate a second comparison result; when at least one of the first comparison result and the second comparison result is abnormal, determine that the operation file is abnormal operation information.

[0141] In an embodiment of the present disclosure, the automatic interception module includes a second submodule. The operation information also includes a current operation path. The second submodule is configured to compare the current operation path with the operation path in the operation information library corresponding to the current business operation, and if the current operation path is inconsistent with the operation path in the normal operation information library, and / or the current operation path is consistent with the operation path in the abnormal operation information library, then the current operation path is determined to be abnormal operation information.

[0142] In an embodiment of the present disclosure, the automatic interception module includes a third submodule. The operation information also includes a current operation action. The third submodule is configured to compare the current operation action with the operation action in the operation information library corresponding to the current business operation, and if the current operation action is inconsistent with the operation action in the normal operation information library, and / or the current operation action is consistent with the operation action in the abnormal operation information library, then the current operation action is determined to be abnormal operation information.

[0143] In an embodiment of the present disclosure, the automatic interception module includes a fourth submodule. The operation information also includes the current operation time. The fourth submodule is configured to compare the current operation time with the range of operation time in the operation information library corresponding to the current business operation, and if the current operation time is greater than the operation time in the normal operation information library, and / or the current operation time meets the operation time in the abnormal operation information library, then the current operation time is determined to be abnormal operation information.

[0144] In an embodiment of the present disclosure, the automatic interception module includes a fifth submodule. The fifth submodule is configured to: generate an attack method record of a business operation according to abnormal operation information; and obtain a preset interception processing method to intercept the business operation according to the specific content corresponding to each abnormal operation information.

[0145] In an embodiment of the present disclosure, the file monitoring device 1000 further includes a monitoring result generation module, wherein the monitoring result generation module is configured to analyze and process the result of the automatic interception process after automatically intercepting the business operation corresponding to at least one abnormal operation information to generate a monitoring result.

[0146] According to an embodiment of the present disclosure, any multiple modules among the monitoring code insertion module 1010, the operation information determination module 1020, the automatic interception module 1030, the information library construction module, the first construction submodule, the second construction submodule, the first submodule, the second submodule, the third submodule, the fourth submodule, the fifth submodule and the monitoring result generation module can be combined into one module for implementation, or any one of the modules can be split into multiple modules. Alternatively, at least part of the functions of one or more of these modules can be combined with at least part of the functions of other modules and implemented in one module. According to an embodiment of the present disclosure, at least one of the monitoring code insertion module 1010, the operation information determination module 1020, the automatic interception module 1030, the information library construction module, the first construction submodule, the second construction submodule, the first submodule, the second submodule, the third submodule, the fourth submodule, the fifth submodule and the monitoring result generation module can be at least partially implemented as a hardware circuit, such as a field programmable gate array (FPGA), a programmable logic array (PLA), a system on a chip, a system on a substrate, a system on a package, an application specific integrated circuit (ASIC), or can be implemented by hardware or firmware such as any other reasonable way of integrating or packaging the circuit, or can be implemented in any one of the three implementation methods of software, hardware and firmware or in an appropriate combination of any of them. Alternatively, at least one of the monitoring code insertion module 1010, the operation information determination module 1020, the automatic interception module 1030, the information library construction module, the first construction sub-module, the second construction sub-module, the first sub-module, the second sub-module, the third sub-module, the fourth sub-module, the fifth sub-module and the monitoring result generation module can be at least partially implemented as a computer program module, which can perform corresponding functions when the computer program module is executed.

[0147] Fig.11 A block diagram of an electronic device suitable for implementing a file monitoring method according to an embodiment of the present disclosure is schematically shown. Fig.11 The electronic device shown is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present disclosure.

[0148] like Fig.11As shown, the electronic device 1100 according to an embodiment of the present disclosure includes a processor 1101, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 1102 or a program loaded from a storage part 1108 to a random access memory (RAM) 1103. The processor 1101 may include, for example, a general-purpose microprocessor (e.g., a CPU), an instruction set processor and / or a related chipset and / or a special-purpose microprocessor (e.g., an application-specific integrated circuit (ASIC)), etc. The processor 1101 may also include an onboard memory for caching purposes. The processor 1101 may include a single processing unit or multiple processing units for performing different actions of the method flow according to an embodiment of the present disclosure.

[0149] In RAM 1103, various programs and data required for the operation of electronic device 1100 are stored. Processor 1101, ROM 1102 and RAM 1103 are connected to each other through bus 1104. Processor 1101 performs various operations of the method flow according to the embodiment of the present disclosure by executing the program in ROM 1102 and / or RAM 1103. It should be noted that the program can also be stored in one or more memories other than ROM 1102 and RAM 1103. Processor 1101 can also perform various operations of the method flow according to the embodiment of the present disclosure by executing the program stored in the one or more memories.

[0150] According to an embodiment of the present disclosure, the electronic device 1100 may further include an input / output (I / O) interface 1105, which is also connected to the bus 1104. The electronic device 1100 may further include one or more of the following components connected to the I / O interface 1105: an input portion 1106 including a keyboard, a mouse, etc.; an output portion 1107 including a cathode ray tube (CRT), a liquid crystal display (LCD), etc., and a speaker, etc.; a storage portion 1108 including a hard disk, etc.; and a communication portion 1109 including a network interface card such as a LAN card, a modem, etc. The communication portion 1109 performs communication processing via a network such as the Internet. A drive 1110 is also connected to the I / O interface 1105 as needed. A removable medium 1111, such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, etc., is installed on the drive 1110 as needed, so that a computer program read therefrom is installed into the storage portion 1108 as needed.

[0151] The present disclosure also provides a computer-readable storage medium, which may be included in the device / apparatus / system described in the above embodiments; or may exist independently without being assembled into the device / apparatus / system. The above computer-readable storage medium carries one or more programs, and when the above one or more programs are executed, the file monitoring method according to the embodiment of the present disclosure is implemented.

[0152] According to an embodiment of the present disclosure, a computer-readable storage medium may be a non-volatile computer-readable storage medium, for example, may include but is not limited to: a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination thereof. In the present disclosure, a computer-readable storage medium may be any tangible medium containing or storing a program, which may be used by or in combination with an instruction execution system, an apparatus, or a device. For example, according to an embodiment of the present disclosure, a computer-readable storage medium may include the ROM 1102 and / or RAM 1103 described above and / or one or more memories other than ROM 1102 and RAM 1103.

[0153] The embodiment of the present disclosure also includes a computer program product, which includes a computer program, and the computer program contains program code for executing the method shown in the flowchart. When the computer program product is run in a computer system, the program code is used to enable the computer system to implement the file monitoring method provided by the embodiment of the present disclosure.

[0154] The above functions defined in the system / device of the embodiment of the present disclosure are performed when the computer program is executed by the processor 1101. According to the embodiment of the present disclosure, the system, device, module, unit, etc. described above can be implemented by a computer program module.

[0155] In one embodiment, the computer program may rely on tangible storage media such as optical storage devices, magnetic storage devices, etc. In another embodiment, the computer program may also be transmitted and distributed in the form of signals on a network medium, and downloaded and installed through the communication part 1109, and / or installed from a removable medium 1111. The program code contained in the computer program may be transmitted using any appropriate network medium, including but not limited to: wireless, wired, etc., or any suitable combination of the above.

[0156] In such an embodiment, the computer program can be downloaded and installed from the network through the communication part 1109, and / or installed from the removable medium 1111. When the computer program is executed by the processor 1101, the above functions defined in the system of the embodiment of the present disclosure are performed. According to the embodiment of the present disclosure, the system, device, means, module, unit, etc. described above can be implemented by a computer program module.

[0157] According to an embodiment of the present disclosure, the program code for executing the computer program provided by the embodiment of the present disclosure can be written in any combination of one or more programming languages. Specifically, these computing programs can be implemented using high-level process and / or object-oriented programming languages, and / or assembly / machine languages. Programming languages ​​include, but are not limited to, Java, C++, python, "C" language or similar programming languages. The program code can be executed entirely on the user computing device, partially on the user device, partially on the remote computing device, or entirely on the remote computing device or server. In the case of a remote computing device, the remote computing device can be connected to the user computing device through any type of network, including a local area network (LAN) or a wide area network (WAN), or can be connected to an external computing device (for example, using an Internet service provider to connect through the Internet).

[0158] The flow charts and block diagrams in the accompanying drawings illustrate the possible architecture, functions and operations of the systems, methods and computer program products according to various embodiments of the present disclosure. In this regard, each box in the flow chart or block diagram can represent a module, a program segment, or a part of a code, and the above-mentioned module, program segment, or a part of a code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order from the order marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram or flow chart, and the combination of the boxes in the block diagram or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0159] It will be appreciated by those skilled in the art that the features described in the various embodiments and / or claims of the present disclosure may be combined and / or combined in a variety of ways, even if such combinations and / or combinations are not explicitly described in the present disclosure. In particular, the features described in the various embodiments and / or claims of the present disclosure may be combined and / or combined in a variety of ways without departing from the spirit and teachings of the present disclosure. All of these combinations and / or combinations fall within the scope of the present disclosure.

[0160] The embodiments of the present disclosure are described above. However, these embodiments are only for illustrative purposes and are not intended to limit the scope of the present disclosure. Although the embodiments are described above separately, this does not mean that the measures in the various embodiments cannot be used in combination to advantage. The scope of the present disclosure is defined by the attached claims and their equivalents. Without departing from the scope of the present disclosure, those skilled in the art may make a variety of substitutions and modifications, which should all fall within the scope of the present disclosure.

Claims

1. A file monitoring method for an application system, comprising: Inserting the monitoring code into at least one application code of the application system by using an insertion method; Determining operation information related to the business operation of the application system according to the monitoring code, wherein the operation information includes an operation file; The operation information is compared with information in an operation information library corresponding to the business operation, abnormal operation information in the operation information is determined, and the corresponding business operation is automatically intercepted according to at least one abnormal operation information, including: Transcoding the operation file to generate a source code of the operation file, comparing the source code with a type source code of the operation file for consistency, and generating a first comparison result; Compare the type of the operation file and / or the size of the operation file with the type of the operation file and / or the size of the operation file in the normal operation information library to generate a second comparison result; When at least one of the first comparison result and the second comparison result is abnormal, the operation file is determined to be abnormal operation information.

2. The file monitoring method according to claim 1, wherein: Before comparing the operation information with information in an operation information base corresponding to the business operation, the method further includes constructing the operation information base, wherein the operation information base includes a normal operation information base and an abnormal operation information base; Constructing the operation information library includes: Obtaining normal business operations corresponding to the application system and generating a normal operation information database; Abnormal business operations fed back by the application system and / or input by the user are acquired, and an abnormal operation information base is generated.

3. The file monitoring method according to claim 1, wherein: The operation information also includes the current operation path; The comparing the operation information with information in an operation information database corresponding to the business operation to determine abnormal operation information in the operation information includes: Compare the current operation path with the operation path in the operation information library corresponding to the current business operation, If the current operation path is inconsistent with the operation path in the normal operation information library, and / or the current operation path is consistent with the operation path in the abnormal operation information library, It is determined that the current operation path is abnormal operation information.

4. The file monitoring method according to claim 1, wherein: The operation information also includes the current operation action; The comparing the operation information with information in an operation information database corresponding to the business operation to determine abnormal operation information in the operation information includes: Compare the current operation action with the operation action in the operation information library corresponding to the current business operation, If the current operation action is inconsistent with the operation action in the normal operation information library, and / or the current operation action is consistent with the operation action in the abnormal operation information library, Then it is determined that the current operation action is abnormal operation information.

5. The file monitoring method according to claim 1, wherein: The operation information also includes the current operation time; The comparing the operation information with information in an operation information database corresponding to the business operation to determine abnormal operation information in the operation information includes: Compare the current operation time with the range of operation time in the operation information database corresponding to the current business operation, If the current operation time is greater than the operation time in the normal operation information library, and / or the current operation time meets the operation time in the abnormal operation information library, The current operation time is determined to be abnormal operation information.

6. The file monitoring method according to any one of claims 1 to 5, wherein: The automatically intercepting and processing the corresponding business operation according to at least one abnormal operation information includes: Generate an attack method record of the business operation according to the abnormal operation information; According to the specific content corresponding to each abnormal operation information, a preset interception processing method is obtained to intercept and process the business operation.

7. The file monitoring method according to claim 1, wherein: After automatically intercepting and processing the business operation corresponding to at least one of the abnormal operation information, the method further includes: The results of the automatic interception processing are analyzed and processed to generate monitoring results.

8. A file monitoring device for an application system, comprising: A monitoring code insertion module, configured to insert the monitoring code into at least one application code of the application system by using an insertion method; an operation information determination module, configured to determine operation information involved in the business operation of the application system according to the monitoring code, wherein the operation information includes an operation file; The automatic interception module is configured to compare the operation information with the information in the operation information library corresponding to the business operation, determine the abnormal operation information in the operation information, and automatically intercept the corresponding business operation according to at least one of the abnormal operation information, including: a first submodule, used to transcode the operation file to generate the source code of the operation file, compare the consistency of the source code with the type source code of the operation file, and generate a first comparison result; compare the type of the operation file and / or the size of the operation file with the type of the operation file and / or the size of the operation file in the normal operation information library to generate a second comparison result; when at least one of the first comparison result and the second comparison result is abnormal, determine that the operation file is abnormal operation information.

9. An electronic device, comprising: one or more processors; A storage device, used for storing executable instructions, wherein when the executable instructions are executed by the processor, the method according to any one of claims 1 to 7 is implemented.

10. A computer-readable storage medium having executable instructions stored thereon, wherein when the instructions are executed by a processor, the method according to any one of claims 1 to 7 is implemented.

11. A computer program product, comprising a computer program, wherein when the computer program is executed by a processor, the method according to any one of claims 1 to 7 is implemented.

Images