Host security baseline management method, device, equipment and medium

Abstract

The application discloses a kind of host security baseline management method, device, equipment and medium, method includes: issuing security baseline detection instruction to the host to be examined or host group;Receive the host security baseline detection parameter information collected according to the security baseline detection item set reported by the host to be examined or host group;The compliance verification processing of host security baseline is carried out to the host security baseline detection parameter information;If the compliance verification of host security baseline does not pass, then show or push the host security baseline risk alarm information to the host to be examined or host group;According to the host security baseline risk alarm information, issue security baseline repair configuration, to automatically repair the host security baseline risk detected.Processing.This application embodiment can reduce the complexity of detection, improve repair efficiency and repair comprehensiveness, and can be widely applied in computer security technical field.

Description

Technical Field

[0001] This invention relates to the field of computer security technology, and in particular to a host security baseline management method, apparatus, device, and medium. Background Technology

[0002] A security baseline is a detailed description of how to configure and manage a computer. It describes all the relevant configuration settings for enabling the computer to operate securely, including service and application settings, operating system component configurations, permission settings, and so on.

[0003] CIS is an abbreviation for Center for Internet Security, which defines a series of security baseline testing items and risk level standards for internationally accepted security baseline standards.

[0004] The relevant technologies for detecting host security baselines mainly involve implementing a detection logic for each security baseline detection item, and then performing the detection and verification of the items on the client side based on each detection logic. However, the detection logic for each security baseline detection item is independent and cannot be shared, and the coupling between the detection logics is high. When there are a large number of security baseline detection items to be detected, deploying multiple detection logics separately is inefficient and increases the complexity of the detection process.

[0005] In addition, after completing the safety baseline test, the relevant technologies usually only provide repair suggestions, followed by manual repair, which is inefficient. Moreover, the manual repair process is prone to omissions due to negligence, resulting in incomplete repair. Summary of the Invention

[0006] In view of this, embodiments of this application provide a host security baseline management method, apparatus, device, and medium to improve the detection efficiency of host security baselines and the repair efficiency and comprehensiveness of host security baselines.

[0007] One aspect of this application provides a host security baseline management method, including:

[0008] A security baseline detection instruction is issued to the host or host group to be inspected, wherein the security baseline detection instruction includes a set of security baseline detection items configured for the host or host group to be inspected, and the set of security baseline detection items includes at least one security baseline detection item composed of a logical AND-OR combination of multiple meta-detection points;

[0009] Receive host security baseline detection parameter information collected based on the security baseline detection item set reported by the host under inspection or host group;

[0010] The host security baseline detection parameter information is subjected to compliance verification processing for the host security baseline;

[0011] If the compliance verification of the host security baseline fails, a host security baseline risk alarm message will be displayed or pushed to the host or host group under inspection.

[0012] Based on the host security baseline risk alarm information, a security baseline repair configuration is issued to automatically repair the detected host security baseline risks.

[0013] Another aspect of this application embodiment provides a host security baseline management device, including:

[0014] The first module is used to issue a security baseline detection instruction to the host or host group to be inspected. The security baseline detection instruction includes a set of security baseline detection items configured for the host or host group to be inspected. The set of security baseline detection items includes at least one security baseline detection item composed of a logical AND-OR combination of multiple meta-detection points.

[0015] The second module is used to receive host security baseline detection parameter information collected based on the security baseline detection item set reported by the host under test or host group;

[0016] The third module is used to perform compliance verification processing on the host security baseline detection parameter information.

[0017] The fourth module is used to display or push host security baseline risk alarm information to the host or host group under inspection if the compliance verification of the host security baseline fails.

[0018] The fifth module is used to issue security baseline repair configuration based on the host security baseline risk alarm information, so as to automatically repair the detected host security baseline risks.

[0019] Another aspect of this application embodiment provides an electronic device, including a processor and a memory;

[0020] The memory is used to store programs;

[0021] The processor executes the program to implement the host security baseline management method as described above.

[0022] Another aspect of this application provides a computer-readable storage medium storing a program that is executed by a processor to implement the host security baseline management method as described above.

[0023] This application also discloses a computer program product or computer program that includes computer instructions stored in a computer-readable storage medium. A processor of a computer device can read the computer instructions from the computer-readable storage medium and execute the computer instructions, causing the computer device to perform the aforementioned host security baseline management method.

[0024] The host security baseline management method of this invention first issues a security baseline detection instruction to the host or host group to be inspected. The security baseline detection instruction includes a set of security baseline detection items configured for the host or host group to be inspected. The set of security baseline detection items includes at least one security baseline detection item composed of multiple meta-detection point logical AND / OR combinations. In this embodiment, multiple meta-detection points are obtained from each security baseline detection item, and detection is then implemented through the detection logic of each meta-detection point. Compared to deploying the detection logic for each security baseline detection item, deploying the detection logic for each meta-detection point is faster and more efficient. Furthermore, different security baseline detection items share common meta-detection points, therefore different security baseline detection items can share the same meta-detection point. The detection logic improves the implementation efficiency. Next, this embodiment receives host security baseline detection parameter information reported by the host under inspection or host group, collected according to the security baseline detection item set. It performs compliance verification processing on the host security baseline detection parameter information. If the compliance verification fails, it displays or pushes host security baseline risk alarm information to the host under inspection or host group. Based on the host security baseline risk alarm information, it issues a security baseline repair configuration to automatically repair the detected host security baseline risks. This embodiment can automatically repair detected host security baseline risks based on host security baseline risk alarm information, effectively improving repair efficiency and comprehensiveness. Attached Figure Description

[0025] To more clearly illustrate the technical solutions in the embodiments of this application, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0026] Figure 1 This is a schematic diagram of an implementation environment of an embodiment of this application;

[0027] Figure 2 A flowchart illustrating the host security baseline management method provided in this application embodiment;

[0028] Figure 3A flowchart illustrating the steps for data backup provided in this application embodiment;

[0029] Figure 4 This is a schematic diagram of the first interface of a terminal device provided in an embodiment of the present invention;

[0030] Figure 5 This is a schematic diagram of the second interface of a terminal device provided in an embodiment of the present invention;

[0031] Figure 6 A flowchart illustrating the steps of the host security baseline detection and repair process provided in this application embodiment;

[0032] Figure 7 This is a schematic diagram of the host security baseline management device provided in an embodiment of this application. Detailed Implementation

[0033] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0034] To facilitate understanding of the embodiments of this application, the relevant concepts involved in this application will be briefly introduced below:

[0035] Security baseline: A security baseline is the minimum security guarantee a system must meet; that is, the most basic security requirements the system must satisfy. System security often requires a balance between the security costs and the security risks that can be tolerated, and the security baseline is the reasonable dividing line of this balance. The significance of a security baseline lies in the series of rules established to achieve the most basic protection requirements, and any security baseline testing revolves around different security baselines. Security baselines include, but are not limited to, service and application settings, operating system component configurations, and permission settings.

[0036] The Center for Internet Security (CIS) is an internationally recognized security baseline standard that defines a series of security baseline testing items and risk level standards.

[0037] VxFS (Veritas File System): VxFS is a commercial journaling file system, and also an intentionally journaling file system based on extended extents. VxFS is designed for operating environments that require high performance and high availability and can handle large amounts of data. The main components of VxFS include: journaling, extended extents, and file system disk layout.

[0038] In related technologies, the process of detecting host security baselines typically involves implementing a separate detection logic for each security baseline detection item to complete the detection and verification of that item. However, in this approach, the detection logic for each security baseline detection item cannot be reused, resulting in high coupling and increased complexity of security baseline detection, leading to low detection efficiency. Furthermore, due to the high complexity of host security baseline detection, the detection process is time-consuming and consumes significant host resources.

[0039] Furthermore, the relevant technologies lack solutions for automatically repairing security baselines. After the host security baseline is detected, users often need to manually repair it based on the repair recommendations for security baseline risks. In addition to low efficiency, manual baseline repair may fail due to user misunderstanding or limitations in ability, resulting in incomplete repairs or errors.

[0040] Therefore, this application provides a host security baseline management method. First, a security baseline detection instruction is issued to the host or host group to be inspected. The security baseline detection instruction includes a set of security baseline detection items configured for the host or host group to be inspected. The set of security baseline detection items includes at least one security baseline detection item composed of multiple meta-detection point logical AND / OR combinations. This application decomposes each security baseline detection item into multiple meta-detection points, and then implements detection through the detection logic of each meta-detection point. Compared to deploying the detection logic of each security baseline detection item, deploying the detection logic of each meta-detection point is faster and more efficient. Furthermore, different security baseline detection items share common meta-detection points, thus different security baseline detection items can share the same... The detection logic of individual detection points improves the implementation efficiency of the detection logic. Next, this embodiment of the application receives host security baseline detection parameter information collected based on the set of security baseline detection items reported by the host under inspection or host group; performs compliance verification processing on the host security baseline detection parameter information; if the compliance verification of the host security baseline fails, it displays or pushes host security baseline risk alarm information to the host under inspection or host group; and issues security baseline repair configuration according to the host security baseline risk alarm information to automatically repair the detected host security baseline risks. This embodiment of the application can automatically repair the detected host security baseline risks according to the host security baseline risk alarm information, which can effectively improve the repair efficiency and the comprehensiveness of the repair.

[0041] refer to Figure 1This illustration shows a schematic diagram of an implementation environment according to an embodiment of this application, which includes at least one terminal device 101. The terminal device can be, for example, a personal computer (PC), mobile phone, smartphone, personal digital assistant (PDA), wearable device, pocket PC (PPC), tablet computer, etc. It is understood that the security baseline represents the minimum configuration required for the secure operation of the terminal device. Therefore, effectively detecting the security baseline and repairing it based on the detection results is beneficial for maintaining the secure and stable operation of the terminal device.

[0042] It is understood that the host security baseline management in this application embodiment can manage insecure configurations in systems, software, and services. That is, the host can include any device such as network devices, security devices, servers, middleware, or terminal devices. The aforementioned terminal devices are only illustrative examples and are not limited herein. Furthermore, the security baseline management object in this application embodiment can be a single host device (e.g., the host under inspection) or multiple host devices (e.g., a host group), and is not limited herein.

[0043] Furthermore, the terminal device can be any electronic product that enables human-computer interaction through one or more methods such as a keyboard, touchpad, touchscreen, remote control, voice interaction, or handwriting device. The terminal device can receive instructions sent by the user, which are used to execute the host security baseline management method of this application embodiment. In this application embodiment, the terminal device can perform security baseline management on one or more hosts.

[0044] like Figure 1As shown, to ensure the secure operation of terminal device 101, security baseline management is implemented on the terminal device. First, the terminal device sends a security baseline detection command to the host or host group under inspection. This command includes a set of security baseline detection items configured for the host or host group under inspection. Each set includes at least one security baseline detection item composed of multiple meta-detection points logically ANDed or ORed. Next, the terminal device receives host security baseline detection parameter information collected based on the set of security baseline detection items, reported by the host or host group under inspection. Then, it performs compliance verification on the host security baseline detection parameter information. If the compliance verification fails, a host security baseline risk alarm is displayed or pushed to the host or host group under inspection. Finally, a security baseline repair configuration is issued based on the host security baseline risk alarm information to automatically repair the detected host security baseline risks. This application embodiment detects each element detection point. The detection results of the first element detection point, which exists in different security baseline detection items, can be shared. Furthermore, the coupling between the element detection points is low, reducing detection complexity compared to directly detecting each security baseline detection item. Additionally, this application embodiment automatically repairs risks and faults existing in the host security baseline based on the detection results, effectively improving repair efficiency and comprehensiveness. For example, as... Figure 1 As shown, the host security baseline is detected and repaired on the terminal device 101.

[0045] It is understood that in the implementation environment of the host security baseline management method disclosed in this application embodiment, blockchain can also be used for data storage; that is, during the implementation process, parameter data of host security baselines of other blockchain nodes can be obtained from existing blocks in the blockchain; the parameter data of the host security baseline is packaged into a new block and uploaded to the blockchain. Through the decentralized data storage method of blockchain, the data is more public and secure, and malicious data tampering is also avoided. In addition, the result data of the host security baseline management method disclosed in this application embodiment (such as the first detection result, the second detection result, the third detection result, and automatic repair instructions, etc.) can also be stored through blockchain, so that all blocks in the blockchain can obtain and use the above result data in real time.

[0046] In addition, the embodiments of this application are implemented through Figure 1This example illustrates one application scenario: a terminal device proactively executes a host security baseline management method without requiring user input. In other application scenarios, the user can proactively input instructions to the terminal device, requesting it to perform security baseline detection on the host or host group under inspection, and to issue security baseline repair configurations based on host security baseline risk alarm information, thereby automatically repairing detected host security baseline risks. It is understood that the user can input the same instruction for both security baseline detection and repair, or different instructions can be input, with one instruction controlling the terminal device to perform security baseline detection and another instruction controlling the terminal device to repair the host security baseline based on the detection results. This application does not limit specific application scenarios; the above... Figure 1 The application scenarios described are provided as examples only.

[0047] refer to Figure 2 , Figure 2 This is a flowchart illustrating a host security baseline management method provided in an embodiment of this application. This method can be applied to... Figure 1 This is implemented using terminal device 101. (See reference...) Figure 2 The host security baseline management method of this application embodiment can be executed on the aforementioned terminal device or any device with data processing capabilities, such as a personal computer. The method specifically includes, but is not limited to, steps S100-S500:

[0048] S100. Issue a security baseline detection instruction to the host or host group under test. The security baseline detection instruction includes a set of security baseline detection items configured for the host or host group under test. The set of security baseline detection items includes at least one security baseline detection item composed of a logical AND-OR combination of multiple meta-detection points.

[0049] Specifically, the security baseline detection mentioned in this application embodiment refers to scanning the security baseline within the host to detect the existence of security risks. The objects of the detection scan include system baselines and component baselines. The security baseline detection items mentioned in this application embodiment refer to host security risk items in the system or components that the security baseline needs to detect, which may exist due to improper configuration, settings, or other reasons. Since multiple security baseline detection items need to be scanned and detected in each host security baseline detection process, the terminal device obtains a set of security baseline detection items in the host security baseline. This set of security baseline detection items includes multiple security baseline detection items, and each security baseline detection item can be further broken down into multiple meta-detection points.

[0050] "Meta" refers to a unit, and a meta-detection point is the smallest detection unit for security baseline detection. This application embodiment breaks down security baseline detection items into meta-detection points and performs detection on these points. Since meta-detection points require less content to be detected and have simpler logic, compared to related technologies that directly detect security baseline detection items, the host security baseline management method in this application embodiment helps reduce detection complexity and improve detection efficiency by detecting meta-detection points.

[0051] It's important to note that determining meta-detection points doesn't simply involve breaking down security baseline detection items into smaller projects. Instead, it involves logically reorganizing and categorizing the security baseline detection items based on the verification rules required for each item. For example, in this host security baseline detection, security baseline detection item A needs to detect the openness of ports a and c, while security baseline detection item B needs to detect the openness of ports b and c. In related technologies, since these solutions operate on a per-security baseline detection item basis, different verification rules would need to be set for security baseline detection item A and security baseline detection item B. Furthermore, because a security baseline detection item might need to detect more than just the openness of a port, it might also need to detect the loading status of a module, etc., making the verification rules highly complex as multiple scenarios need to be considered. This application proposes to decompose security baseline detection items into meta-detection points. In the above situation, we can first identify the openness of port c in both security baseline detection items A and B, and determine the openness detection of port c as meta-detection point C. When performing the detection of security baseline detection item A, the verification rule corresponding to meta-detection point C can be used to detect port c in security baseline detection item A. Similarly, the verification rule corresponding to meta-detection point C is also used to detect port c in security baseline detection item B, realizing the reuse of verification rules and improving the efficiency of verification rule implementation. Meanwhile, since port c in security baseline detection item A already has a dedicated meta-detection point C for detection, other detection items in security baseline detection item A (such as the openness of port a) are detected using the verification rules corresponding to other meta-detection points. That is, the verification rules of each meta-detection point in the same security baseline detection item do not interfere with each other, thereby reducing the coupling between meta-detection points and helping to reduce the detection complexity in the security baseline detection process.

[0052] S200: Receive host security baseline detection parameter information collected based on the set of security baseline detection items reported by the host or host group under inspection.

[0053] Specifically, host security baseline detection parameter information refers to the parameter information of meta-detection points. In this embodiment, when performing compliance verification of the host security baseline, it is necessary to combine the parameter information of each meta-detection point of the host security baseline. For example, when the meta-detection point is network configuration detection, the parameter information corresponding to that meta-detection point is network configuration information; when the meta-detection point is kernel loading detection, the parameter information corresponding to that meta-detection point is kernel loading information. This embodiment obtains the parameter information of the scanned object and verifies and analyzes the obtained parameters to obtain the detection result of the security baseline. Therefore, the terminal device obtains the parameter information of at least one scanned object from the system baseline and component baseline, on a unit basis of meta-detection points, for subsequent verification and analysis.

[0054] S300: Perform compliance verification processing on the host security baseline detection parameter information.

[0055] Specifically, this embodiment of the application determines all meta-detection points for each security baseline detection item in the security baseline detection item set, based on the detection content of each security baseline detection item. Since different security baseline detection items can have the same meta-detection points, such as the "security baseline detection item A and security baseline detection item B both need to detect the open status of port c" mentioned in step S100 above, this embodiment of the application determines the meta-detection points that exist simultaneously in multiple different security baseline detection items as first meta-detection points, and determines the meta-detection points that exist alone in a security baseline detection item as second meta-detection points, and performs compliance verification processing of the host security baseline based on the first meta-detection points and the second meta-detection points. This embodiment of the application can eliminate the need for repeated detection of the first meta-detection points in different security baseline detection items during subsequent compliance detection of meta-detection points, thereby improving detection efficiency.

[0056] The host security baseline detection parameter information includes at least one of the following: network configuration, kernel loading module, file system, and configuration file parameters. In this embodiment, after obtaining the host security baseline detection parameter information, a first compliance verification is performed on the meta-detection point according to the compliance verification mode corresponding to that meta-detection point. For example, the compliance verification mode includes a regular expression matching mode. Regular expression matching refers to using a series of regular expressions to match the parameter information of the meta-detection point. A regular expression is a logical formula for string manipulation; it uses predefined specific characters and combinations of these characters to form a "rule string," which expresses a filtering logic for the string. By performing regular expression matching on the parameter information of the meta-detection point, the first compliance verification is completed, and the first detection result of the meta-detection point is obtained. The first detection result is either verification passed or verification failed.

[0057] S400 If the compliance verification of the host security baseline fails, display or push host security baseline risk alarm information to the host or host group under inspection.

[0058] Specifically, the host security baseline risk alarm information is used to describe the status of the security baseline detection items in this security baseline detection. Therefore, the risk alarm information includes at least one of the following: the name of the risk security baseline detection item, a description of the risk content, or a risk remediation suggestion. It can be understood that the risk alarm information may also include the risk level, detection time, etc. Users can decide whether to perform subsequent security baseline remediation steps based on the risk alarm information.

[0059] Through step S400, this embodiment of the application obtains compliance verification results and risk alarm information, and displays them through the terminal device, allowing users to intuitively understand the detection results of this host security baseline.

[0060] It is understood that the host security baseline management method proposed in this application embodiment can be initiated by the terminal device itself or by the user. In this application embodiment, after the security baseline detection is completed, the terminal device can also automatically repair the security baseline based on compliance verification results and risk alarm information, or the user can initiate automatic repair through the human-computer interaction options on the terminal device's display interface. It is understood that the automatic repair process in this application embodiment can be applied to… Figure 1 The host security baseline management method can be implemented on the terminal device 101, or it can be executed on any device with data processing capabilities and a security baseline set, such as a personal computer.

[0061] S500 issues security baseline repair configuration based on host security baseline risk alarm information to automatically repair detected host security baseline risks.

[0062] Specifically, the terminal device generates a security baseline repair configuration based on the host security baseline risk alarm information to repair the host security baseline. It is understood that the user can select the security baseline detection items they want to be automatically repaired. The security baseline repair configuration received by the terminal device can then repair either the user-selected security baseline detection items or all risky security baseline detection items. Once the security baseline repair is complete, a repair result is generated.

[0063] It should be noted that, in a single automatic repair process, this application embodiment can repair one or more meta-detection points. After the repair of the meta-detection points is completed, a repair result is generated. For example, since the security baseline detection item contains multiple meta-detection points, the result of each compliance verification can include the detection results for multiple meta-detection points. When multiple meta-detection points in the security baseline detection item pass compliance verification, and multiple meta-detection points fail compliance verification, only the meta-detection points that fail compliance verification can be repaired to reduce the repair workload and improve repair efficiency. Alternatively, when multiple meta-detection points fail compliance verification, the repair can be targeted at those meta-detection points that can cause substantial impact, based on the importance of the multiple meta-detection points, such as determining whether these meta-detection points have a substantial impact on the operation of the security baseline.

[0064] The embodiments of this application, under the premise of completing the detection of the host security baseline, can automatically repair the risks and faults existing in the host security baseline based on the detection results, which can effectively improve the repair efficiency and the comprehensiveness of the repair.

[0065] In some embodiments, the host security baseline detection parameter information is subjected to host security baseline compliance verification processing, including S310-S330:

[0066] S310. Perform a first compliance verification on all meta-detection points in the security baseline detection item set to obtain a first detection result; wherein, the security baseline detection item set includes a first meta-detection point and a second meta-detection point, the first meta-detection point exists in at least two different security baseline detection items, and the second meta-detection point exists in a unique security baseline detection item.

[0067] Specifically, in this embodiment, the detection is performed on a per-meta-detection-point basis. The detection of meta-detection-points is called the first compliance verification. It should be noted that the first compliance verification may include multiple verification rules or verification methods. The same or different verification rules can be used for the meta-detection-points within the security baseline detection items. After completing the first compliance verification, a detection result can be obtained for each meta-detection-point. These detection results obtained after performing the first compliance verification on all meta-detection-points are called the first detection result, which indicates whether the meta-detection-point has passed the first compliance verification.

[0068] S320. Extract the first compliance verification results corresponding to the first and second element detection points contained in each security baseline detection item from the first detection results, perform second compliance verification on each security baseline detection item, and obtain the second detection result of each security baseline detection item.

[0069] Specifically, as described above, breaking down security baseline detection items into multiple meta-detection points reduces detection complexity. Since each security baseline detection item contains multiple meta-detection points, the first detection results of these points need to be integrated to perform a second compliance verification. It should be noted that different security baseline detection items may contain the same first meta-detection points. Therefore, this application avoids repeatedly detecting the same first meta-detection points across multiple security baseline detection items; it only needs to reuse the results of a single detection across multiple security baseline detection items, thus improving detection efficiency. Furthermore, the second compliance verification can include multiple verification rules or methods. The same or different verification rules can be used for different security baseline detection items. After completing the second compliance verification, a detection result for each security baseline detection item can be obtained. These detection results obtained after performing the second compliance verification on the security baseline detection items are called the second detection results, which indicate whether the security baseline detection item passes the second compliance verification.

[0070] S330. Perform a logical AND-OR operation on the second detection result of each security baseline detection item in the security baseline detection item set to generate the third detection result of the host or host group to be inspected.

[0071] Specifically, after obtaining the second detection result of the security baseline detection items in the above steps, since all security baseline detection items in the security baseline detection item set need to be detected each time the host security baseline detection is performed, the second detection results of each security baseline detection item in the security baseline detection item set are summarized to generate the third detection result of the host security baseline, thus completing this host security baseline detection. The third detection result includes the overall evaluation of this security baseline detection, which is either passed or failed. It can be understood that the determination of the third detection result can be based on the pass rate of all security baseline detection items. Different security baseline detection items can have different weights. For example, if the pass rate of a security baseline detection item is less than 50%, the overall evaluation of this security baseline detection is judged as failed; if the pass rate is higher than or equal to 50%, it is considered passed.

[0072] In this embodiment, the host security baseline is detected through steps S310-S330. Each element detection point is detected, and the coupling between the element detection points is low, which can reduce the complexity of the detection.

[0073] In some embodiments, the step of performing a first compliance verification on all meta-detection points in the security baseline detection item set in S310 to obtain a first detection result includes steps S311-S313:

[0074] S311. Classify and standardize all meta-detection points in the safety baseline detection item set to determine the types of meta-detection points with different fine-grainedness.

[0075] Specifically, determining meta-detection points is not simply breaking down security baseline detection items into smaller projects. Instead, it involves logically reclassifying and integrating security baseline detection items based on the verification rules required for each item. Therefore, it's necessary to classify the meta-detection points extracted from each security baseline detection item and determine the types of meta-detection points at different granularities. Furthermore, since different security baseline detection items may contain the same type of meta-detection points, the relationship between meta-detection points and security baseline detection items can be many-to-many. That is, each security baseline detection item can consist of multiple meta-detection points, and each meta-detection point corresponds to one or more different security baseline detection items.

[0076] S312. Determine the corresponding compliance verification mode for each type of meta-detection point.

[0077] Specifically, in this embodiment of the application, the corresponding compliance verification mode is determined for the meta-detection point based on the type of meta-detection point.

[0078] S313. Based on the host security baseline detection parameter information, perform the first compliance verification on the meta detection points through the compliance verification mode corresponding to the meta detection points, obtain the first compliance verification result of each meta detection point, and take the first compliance verification result of all meta detection points as the first detection result; wherein, the compliance verification mode includes the regular expression matching mode.

[0079] Specifically, the parameter information of the aforementioned meta-detection points includes at least one of the following: network configuration, kernel loading module, file system, and configuration file parameters. In this embodiment, after obtaining the parameter information of each meta-detection point, a first compliance verification is performed on the meta-detection point according to the corresponding compliance verification mode. For example, the compliance verification mode includes a regular expression matching mode. Regular expression matching refers to using a series of regular expressions to match the parameter information of the meta-detection point. A regular expression is a logical formula for string manipulation; it uses predefined specific characters and combinations of these characters to form a "rule string," which expresses a filtering logic for the string. By performing regular expression matching on the parameter information of the meta-detection point, the first compliance verification is completed, and the first detection result of the meta-detection point is obtained. The first detection result is either verification passed or verification failed.

[0080] Through steps S311-S313, this embodiment of the application completes the classification of meta-detection points and determines the corresponding compliance verification mode according to the type of meta-detection point; then, according to the parameter information of the meta-detection point, the first compliance verification is performed on all meta-detection points in the security baseline detection item through the compliance verification mode corresponding to the meta-detection point, and the first detection result of each meta-detection point is obtained.

[0081] In some embodiments, step S320 includes S321-S322:

[0082] S321. Obtain the first compliance verification results of all first-dimensional and second-dimensional test points in the security baseline test items.

[0083] Specifically, since the security baseline test item contains multiple meta-test points, after completing the first compliance verification, the first test results of all meta-test points (including the first meta-test point and the second meta-test point) within the security baseline test item can be obtained.

[0084] S322. Perform a logical AND-OR operation on the first compliance verification results of all first-element detection points and second-element detection points to obtain the second detection result of the security baseline detection item.

[0085] Specifically, meta-detection points are a reclassification and integration of security baseline detection items. From another perspective, a security baseline detection item can be seen as a logical combination of several meta-detection points. Therefore, performing a logical AND-OR operation on the first detection result corresponding to a meta-detection point yields the second detection result of the security baseline detection item. In the logical AND-OR operation, AND is used to represent AND, and OR is used to represent OR. For example, assuming the security baseline detection item contains four meta-detection points a, b, c, and d, the logical operation (a OR b) AND (c AND d) can be set. This logical operation indicates that meta-detection points a or b pass the test, and c and d also pass the test. If this logical operation is true, the second detection result of the security baseline detection item is "pass"; if the logical operation is false, the second detection result of the security baseline detection item is "fail".

[0086] Through steps S321-S322, this embodiment of the application performs a logical AND-OR operation on the first detection results of all meta-detection points to obtain the second detection result of the security baseline detection item.

[0087] In some embodiments, step S200 above, receiving host security baseline detection parameter information collected based on the security baseline detection item set reported by the host under test or host group, includes steps S201-S202:

[0088] S201. Receive host security baseline detection parameter information, wherein the host security baseline detection parameter information includes at least one of the following: network configuration information, kernel loading information, file system information, or configuration file information.

[0089] Specifically, in this embodiment of the application, when performing the first compliance verification on the meta-detection points, it is necessary to combine the parameter information of each meta-detection point. For example, when the meta-detection point is a network configuration detection, the parameter information corresponding to the meta-detection point is network configuration information; when the meta-detection point is a kernel loading detection, the parameter information corresponding to the meta-detection point is kernel loading information. This embodiment of the application obtains the parameter information of the scanned object and verifies and analyzes the obtained parameters to obtain the detection result of the security baseline. Therefore, the terminal device obtains the parameter information of at least one scanned object from the system baseline and component baseline on a unit basis of meta-detection points for subsequent verification and analysis.

[0090] S202. Determine the first parameter information of the meta-detection point that the file system is not loaded and the second parameter information that is disabled after the file system is loaded from the host security baseline detection parameter information.

[0091] The first parameter information and the second parameter information are used to input the compliance verification mode to perform the first compliance verification and obtain the first detection result.

[0092] Specifically, in this application embodiment, the first parameter information indicates that the file system is not loaded. That is, for the current host or host group under inspection, obtaining the first parameter information indicates that the specified file system is not loaded. It should be noted that there are objectively situations where different security baseline detection items all require loading the file system. Therefore, different security baseline detection items can share the same verification rule for the same meta-detection point. For example, when different security baseline detection items share a meta-detection point, for module a in security baseline detection item A, the obtained first parameter information could be that module a is not loaded in the current security baseline; while for module b in security baseline detection item B, the obtained first parameter information could be that module b is not loaded in the current security baseline. In this case, the detection of whether module a and module b are loaded can be implemented using the same verification rule for the meta-detection point. Specifically, only the module name and other parameters in the verification rule need to be replaced to achieve the detection of different modules. This application embodiment improves the implementation efficiency of verification rules by reusing the verification rules of the meta-detection point.

[0093] Specifically, the second parameter information in this application embodiment is used to indicate the case where the file system is loaded but disabled. For example, when different security baseline detection items share a single meta-detection point, for module a in security baseline detection item A, the obtained second parameter information could be that the current security baseline has loaded module a and disabled module a; while for module b in security baseline detection item B, the obtained second parameter information could be that the current security baseline has loaded module b and disabled module b. This application embodiment improves the implementation efficiency of verification rules through the reuse of verification rules for meta-detection points.

[0094] Reference Figure 3 , Figure 3 This is a flowchart illustrating the steps for data backup provided in an embodiment of this application. Figure 3 All the steps shown are steps of the host security baseline management method provided in the embodiments of this application. Figure 3 The methods for performing data backup include, but are not limited to, steps S600-S1000:

[0095] S600. Obtain the detection item information from the safety baseline detection item set. The detection item information includes at least one of the following: detection item name, detection item content description, detection item repair suggestions, or detection item risk level.

[0096] Specifically, as described above, the security baseline detection item set contains multiple security baseline detection items. After completing the detection of these items, information about them is obtained. This information is called detection item information, which includes at least one of the following: detection item name, description of the detection item content, remediation suggestions, or risk level of the detection item. Understandably, for users, the purpose of performing host security baseline detection is to identify where risks exist on the host. In other words, the risk items detected in the system baseline or component baseline are of concern to the user. Users can use the detection item information to understand which security baseline detection items in this host security baseline detection have risks, their risk levels, and then decide whether further security baseline remediation work is necessary.

[0097] S700. Obtain the logical relationship information between the security baseline detection item and the meta detection point; wherein, the logical relationship information is used to characterize whether the security baseline detection item contains the meta detection point.

[0098] Specifically, a security baseline detection item is a logical combination of multiple meta-detection points. Therefore, the logical relationship information between the security baseline detection item and the meta-detection points can be obtained. The logical relationship information is used to characterize whether the security baseline detection item contains the meta-detection point. Based on the logical relationship information, a suitable logical operation formula can be designed in the future, and the second detection result of the security baseline detection item can be determined based on the first detection result of each meta-detection point.

[0099] S800. Obtain the meta-detection point information of the meta-detection point. The meta-detection point information includes at least one of the following: meta-detection point name or rule parameters for compliance verification.

[0100] Specifically, the meta-detection point information is obtained, which includes at least one of the meta-detection point name or compliance verification rule parameters. Since different types of meta-detection points exist, their names can be used to distinguish them. The compliance verification mode includes a regular expression matching mode, which filters strings using predefined "rule strings." In this embodiment, the obtained compliance verification rule parameters act as the "rule strings." Regular expression matching is performed between these rule parameters and the obtained meta-detection point parameter information to determine whether the first compliance verification of the meta-detection point passes, obtaining a first detection result of pass or fail. Because different types of meta-detection points have different compliance verification modes, the obtained compliance verification rule parameters can also be used to distinguish meta-detection points. After obtaining the meta-detection point information, the terminal device can obtain parameter information on a per-meta-detection-point basis for subsequent first compliance verification.

[0101] It is understood that compliance verification rule parameters can be obtained during the first compliance verification process. In other words, this application embodiment supports user-defined rule parameters for customized security baseline detection. Furthermore, this application embodiment also supports existing baseline detection standards, such as the security baseline detection items specified in the international standard for security baselines (CIS).

[0102] S900: Obtain the first and second detection results.

[0103] S1000: Store the detection item information, logical relationship information, meta detection point information, first detection result, and second detection result in multiple database tables.

[0104] Through steps S600-S1000, this embodiment of the application obtains various data including detection item information, logical relationship information, meta-detection point information, and compliance verification results, and stores these data in different database tables.

[0105] In some embodiments, the security baseline of the host or host group under test includes a system baseline and a component baseline. Step S100 above issues a security baseline detection instruction to the host or host group under test, including S110-S130:

[0106] S110. Obtain the first set of security baseline detection items in the system baseline, wherein the system baseline includes at least one of the following: Windows system baseline, Windows Server system baseline, CentOS system baseline, or Ubuntu system baseline.

[0107] Specifically, as described above, the host security baseline scan targets both system baselines and component baselines. The terminal device acquires several security baseline detection items from the system baseline; the set of these security baseline detection items is called the first security baseline detection item set. For example, the system baseline can be multiple Windows / Linux system baselines, including but not limited to Windows 10, CentOS 6 / 7 / 8, Windows Server 2008, Windows Server 2012, Windows Server 2019, Ubuntu 12 / 14 / 16 / 18, Debian 7 / 8 / 9 / 10, etc.

[0108] S120. Obtain the second security baseline detection item set in the component baseline, wherein the component baseline includes the database baseline and the web application baseline.

[0109] Specifically, as described above, the objects of host security baseline scanning include system baselines and component baselines. The terminal device acquires several security baseline detection items from the system baseline; the set of these security baseline detection items is called the first security baseline detection item set. Component baselines can be the component baselines of multiple mainstream databases, web applications, etc., including but not limited to NGINX, MongoDB, Oracle_MySQL_Enterprise_Edition, CIS_Oracle_MySQL_Community_Server, PostgreSQL, Kubernetes, Apache, etc.

[0110] S130. Based on the first set of security baseline detection items and the second set of security baseline detection items, issue a security baseline detection command to the host or host group to be inspected.

[0111] The security baseline detection items include at least one of the following: file permission items, weak password items, risky port openness items, file system partition settings items, secure boot settings items, access control items, installation update and patch settings items, host service check items, network parameter check items, firewall configuration items, network protocol configuration items, logging settings items, or root privilege login settings items.

[0112] Through steps S110-S120, the terminal device scans the system baseline in the host to obtain a first set of security baseline detection items, and scans the component baseline to obtain a second set of security baseline detection items, so as to determine the security baseline detection items that need to be detected in this host security baseline detection.

[0113] It should be noted that the security baseline detection items mentioned in this application embodiment refer to the host security risk items that the security baseline needs to detect in the system or components. These security baseline detection items include, but are not limited to, file permissions, weak passwords, risky port openings, file system partition settings, secure boot settings, access control, installation, update and patch settings, host service checks, network parameter checks, firewall configuration, network protocol configuration, log recording settings, root privilege login settings, etc.

[0114] It is understandable that during each host security baseline detection process, these security baseline detection items can be flexibly combined to form a security baseline detection item set. The specific combination method of this set can be determined according to user needs, and different detection cycles can be set for different security baseline detection items. For example, a scan of file system partition settings can be performed every 30 days, and a scan of network parameters can be performed every 60 days. Similarly, this set can also include mandatory and optional items. For example, setting update and patch installation settings and firewall configuration settings as mandatory items, and setting logging settings and root privilege login settings as optional items. This application embodiment does not specifically limit the specific combination method of security baseline detection items in the security baseline detection item set.

[0115] In some embodiments, step S500 above issues a security baseline repair configuration based on the host security baseline risk alarm information to automatically repair the detected host security baseline risks, including steps S501-S503:

[0116] S501. Match the security baseline detection items to be repaired in the host or host group to be inspected based on the security baseline risk alarm information.

[0117] Specifically, as mentioned earlier, the third detection result is obtained by summarizing the second detection results, which in turn are obtained by performing a second compliance verification on the security baseline detection items. Therefore, based on the third detection result, it is possible to identify security baseline detection items in the host security baseline that pose a risk, which is the security baseline risk alarm information. During an automatic repair process, one or more security baseline detection items can be repaired.

[0118] S502. Determine the element detection points to be repaired based on the safety baseline detection items to be repaired.

[0119] Specifically, as described above, this embodiment of the application breaks down the security baseline detection item into several meta-detection points. A first compliance verification is performed on each meta-detection point. Then, a second compliance verification is performed based on the logical relationship between the security baseline detection item and the meta-detection points. The obtained second detection results are summarized to obtain a third detection result, thus completing the host security baseline detection. Therefore, the meta-detection points to be repaired within the security baseline detection item can be determined through the security baseline detection item to be repaired.

[0120] S503. Generate a security baseline repair configuration based on the meta-detection points to be repaired, so as to automatically repair the meta-detection points to be repaired and generate repair results.

[0121] Specifically, the automatic host security baseline repair method in this application embodiment repairs based on meta-detection points as the basic unit. The terminal device repairs the meta-detection points to be repaired according to the automatic repair instructions. In one automatic repair process, one or more meta-detection points can be repaired. After the repair of the meta-detection points is completed, a repair result is generated. It should be noted that since the security baseline detection item contains multiple meta-detection points, only the meta-detection points that failed the first compliance verification can be repaired; the meta-detection points that passed the first compliance verification do not need to be repaired, thereby reducing the repair workload.

[0122] For example, in the automatic repair process of this application embodiment, an abnormal meta-detection point of the host or host group under test can be repaired, an abnormal security baseline detection item of multiple abnormal meta-detection points can be repaired, or all abnormal security baseline detection items in the security baseline detection item set can be repaired. The above repair process can be determined according to the operating status of the host or host group under test. For example, if only one meta-detection point will affect the operation of the host or host group under test, only that meta-detection point can be repaired to reduce the repair workload and improve the repair efficiency. This application does not limit the repair object here.

[0123] Through steps S501-S503, this embodiment of the application determines the security baseline detection items to be repaired in the host security baseline based on the risk alarm information corresponding to the third detection result, determines the meta-detection points to be repaired based on the security baseline detection items to be repaired, performs automatic repair on the meta-detection points as units, and generates repair results.

[0124] In some embodiments, a method for obtaining risk alarm information is also provided, the method for obtaining risk alarm information including steps S504-S505:

[0125] S504. Obtain host security baseline risk alarm information. Host security baseline risk alarm information includes at least one of the following: risk security baseline detection item name, risk content description or risk remediation suggestion.

[0126] Specifically, risk alarm information is used to describe the status of the security baseline detection items in this security baseline detection. Therefore, risk alarm information includes at least one of the following: the name of the risk security baseline detection item, a description of the risk content, or a risk remediation suggestion. It can be understood that risk alarm information may also include the risk level, detection time, etc. Users can decide whether to perform subsequent security baseline remediation steps based on the risk alarm information.

[0127] S505 displays host security baseline risk alarm information.

[0128] Specifically, the third detection result of this security baseline detection and risk alarm information are displayed through the output device of the terminal equipment. (Refer to...) Figure 4 , Figure 4 This is a schematic diagram of the first interface of a terminal device provided in an embodiment of the present invention. Figure 4 As shown, the terminal device performs security baseline detection on the host according to the host security baseline management method provided in this application embodiment. Through the above steps, it obtains a third detection result and risk alarm information, and displays the third detection result and risk alarm information on the first interface 901 of the terminal device. The displayed content can be presented in various ways, such as a pie chart or a table. For example, as mentioned above, the third detection result can be determined by the pass rate of all security baseline detection items. Therefore, the display interface can simultaneously display the third detection result 910 and the pass rate 920 of all security baseline detection items, and present the risk alarm information 930 in a table format.

[0129] Additionally, refer to Figure 5 , Figure 5 This is a schematic diagram of the second interface of a terminal device provided in an embodiment of the present invention, such as... Figure 5As shown, the terminal device displays more detailed risk alarm information 1010 on the display interface, including detailed risk content description and handling suggestions. In addition, the second interface 1001 also displays human-computer interaction options 1020. The human-computer interaction options include, but are not limited to, re-detection, ignoring risks and automatic repair. Users can use the human-computer interaction options to select to initiate specified operations on specific security baseline detection items or all security baseline detection items. Specified operations include, but are not limited to, re-detection, ignoring risks and automatic repair.

[0130] This application embodiment is passed through Figure 4 This displays the third detection results and risk alerts obtained after implementing the host security baseline management method; through Figure 5 It displays more detailed risk warning information and human-computer interaction options. Users can understand the security risks existing in the host security baseline of the current terminal device through the terminal device interface, which is clear and intuitive. Users can also choose the subsequent operations for each security baseline detection item through human-computer interaction options.

[0131] Through steps S504-S505, this embodiment of the application obtains the third detection result and risk alarm information, and displays them through the terminal device, so that users can intuitively understand the detection results of the host security baseline.

[0132] It is understood that the host security baseline management method proposed in this application embodiment can be initiated by the terminal device itself or by the user. In this application embodiment, after the security baseline detection is completed, the terminal device can also automatically repair the security baseline based on the third detection result and risk alarm information, or the user can initiate the repair through methods such as... Figure 5 The human-computer interaction options shown initiate automatic repair. It is understood that the automatic repair process of this application embodiment can be applied to... Figure 1 The host security baseline management method can be implemented on the terminal device 101, or it can be executed on any device with data processing capabilities and a security baseline set, such as a personal computer.

[0133] In some embodiments, the method further includes the step of sending a repair result, wherein the method of sending the repair result includes, but is not limited to, steps S506-S507:

[0134] S506. Obtain the repair results.

[0135] Specifically, the terminal device obtains the repair results, which include repair success results and repair failure results. When all the meta-detection points to be repaired are repaired, a repair success result is generated; when there are meta-detection points that are not repaired successfully, a repair failure result is generated.

[0136] S507. Generate repair status information based on the repair results and send the repair status information to the server.

[0137] Specifically, the terminal device generates repair status information based on the acquired repair results. The repair results include successful and failed repair results. Therefore, a successful repair result corresponds to a successful repair status, and a failed repair result corresponds to a reason for failure. The terminal device sends the generated repair status information to a server. This server, hosted in the cloud, can be a single server, a server cluster consisting of several servers, or a cloud computing service center. The server can receive and store the repair status information for host security baseline repair, facilitating traceability and repair record recording during routine maintenance of the host security baseline.

[0138] Through steps S506-S507, this embodiment of the application generates repair status information based on the repair result and sends the repair status information to the server.

[0139] In some embodiments, a method for data restoration is also provided, the method comprising S508-S509:

[0140] S508. Based on the security baseline, repair the configuration and determine the configuration information to be repaired.

[0141] Specifically, the security baseline repair configuration can be an automatic repair instruction received by the terminal device, used to determine the configuration information to be repaired. The configuration information to be repaired includes, but is not limited to, system configurations, files, and other information that may be changed during the automatic repair process.

[0142] S509. Generate backup information based on the configuration information to be repaired. The backup information is used to restore the host security baseline of the repaired host or host group to the host security baseline before the repair.

[0143] Specifically, the configuration information to be repaired includes system configurations and files. Backup information is generated based on this information, meaning files that may be modified during the repair process are backed up locally and in the background, and system configurations that may be modified during the repair process are backed up in the background. The backup information for system configurations may include the path information and corresponding values ​​of configuration items. This embodiment of the application, by generating backup information, can effectively improve the disaster recovery capability and recoverability during the automatic repair process. When problems occur during the automatic repair process, users can use the backup information to roll back the security baseline detection items to their state before automatic repair. In this embodiment, rollback is based on meta-detection points as the basic unit, sequentially restoring the files, configurations, and other information modified during the repair process at each meta-detection point to their state before repair. For example, file rollback replaces the files backed up locally or in the background with the files backed up before repair; while configuration rollback restores the system settings and configuration information backed up in the background to their state before repair.

[0144] It is understandable that after the host security baseline is repaired, the repaired security baseline detection items can be re-initiated for detection. The host security baseline management method proposed in this application is used for detection. If the detection passes, it means that the automatic repair is successful and a repair success result is generated; if the detection fails, a repair failure result is generated.

[0145] Through steps S508-S509, this embodiment of the application determines the configuration information to be repaired according to the automatic repair instruction, and generates backup information based on the configuration information to be repaired, backing up information including system configuration and files to the local machine and the background, so that the repaired host security baseline can be restored to the host security baseline before the repair when needed.

[0146] In summary, the embodiments of this application can obtain the third detection result of the security baseline detection items; then, based on the third detection result, generate an automatic repair instruction; and, in response to the triggering of the automatic repair instruction, repair the host security baseline and generate a repair result. The embodiments of this application can automatically repair risks and faults existing in the host security baseline based on the detection results, effectively improving repair efficiency and the comprehensiveness of the repair.

[0147] Based on the security baseline detection and repair processes included in the host security baseline management method mentioned in the above embodiments, the following describes the process by which the terminal device performs security baseline detection and repair. (Refer to...) Figure 6 , Figure 6 This application provides a flowchart of the host security baseline detection and repair process, which includes, but is not limited to, steps S1100-S2300:

[0148] S1100: Establish a communication connection with the host or host group to be inspected, and issue a security baseline test command to the host or host group to be inspected to which the communication connection has been established.

[0149] Specifically, embodiments of this application can be implemented as follows: Figure 1 The mobile terminal 101 shown sends a security baseline detection command to the host or host group under inspection. This command could be a security baseline scan configuration, which includes a set of security baseline detection items configured for the host or host group under inspection. The security baseline detection item set includes at least one security baseline detection item composed of multiple meta-detection points logically ANDed or ORed. For example, the host security baseline items to be scanned can be selected in the console, and a scan can be initiated. Specifically, the scan is performed by sending a scan configuration, which includes information such as the system to be scanned, the detection items, and the corresponding data acquisition scripts.

[0150] S1200: Receive host security baseline detection parameter information collected based on the set of security baseline detection items reported by the host or host group under test.

[0151] Specifically, this embodiment of the application scans and collects all compliance parameter data required for all meta-detection points, such as network configuration, kernel loaded modules, file system, configuration file parameters, etc. For example, for meta-detection points of module loading type, it is necessary to collect information on all loaded modules. Data collection in this embodiment of the application is performed using meta-detection points as the basic unit. The specific implementation method of step S1200 can be referred to the preceding step S200.

[0152] S1300: Perform the first compliance verification on all meta-detection points in the security baseline detection item set based on the host security baseline detection parameter information.

[0153] Specifically, this application embodiment can obtain compliance parameters for multiple meta-detection points. These compliance parameters can be obtained from local files on the terminal device or from files stored on a server. Based on the obtained compliance parameters of the meta-detection points, this application embodiment performs a first compliance verification on the parameter data and compliance parameters of the meta-detection points, and outputs a first detection result. The first detection result indicates whether the current meta-detection point passes the first compliance check. The specific implementation method of step S1300 can be referred to the preceding step S310.

[0154] S1400. Extract the first compliance verification results corresponding to the first meta-detection point and the second meta-detection point contained in each security baseline detection item from the first detection result, perform second compliance verification on each security baseline detection item, and obtain the second detection result of each security baseline detection item.

[0155] Specifically, in this embodiment of the application, after performing the first compliance verification and outputting the first detection result, since the security baseline detection item is a logical combination of multiple meta-detection points, a logical AND-OR operation can be performed on the security baseline detection item through the first detection results of the multiple meta-detection points to perform logical AND-OR operation verification, which is the second compliance verification, thereby obtaining the second detection result. The specific implementation method of step S1400 can be referred to the previous step S320.

[0156] S1500: Perform a logical AND-OR operation on the second detection result of each security baseline detection item in the security baseline detection item set to generate the third detection result of the host or host group to be inspected.

[0157] Specifically, in this embodiment, the second detection results of all security baseline detection items are summarized to generate a third detection result. The third detection result includes an overall evaluation of the security baseline detection, which is either passed or failed. The specific implementation method of step S1500 can be referred to the previous step S330.

[0158] S1600. Based on the third test result, determine whether the compliance verification process of the host security baseline test has passed.

[0159] Specifically, in this application embodiment, the compliance verification process can be determined based on the third test result. For example, the determination of the third test result can be based on the pass rate of all security baseline test items. Different security baseline test items can have different weights. For example, if the pass rate of a security baseline test item is less than 50%, the overall evaluation of this security baseline test is judged to be unsuccessful; if the pass rate is higher than or equal to 50%, it is considered successful.

[0160] S1700 If the compliance verification of the host security baseline fails, display or push host security baseline risk alarm information to the host or host group under inspection.

[0161] Specifically, the risk warning information in this application embodiment includes information such as failed security baseline checks and remediation suggestions. For example, if compliance verification fails, risk warning information, including failed security baseline checks and remediation suggestions, can be displayed on the terminal device's interface. Users can then decide whether to initiate automatic security baseline remediation based on this risk information; for example, they can... Figure 1 The terminal device 101 shown initiates an automatic repair command.

[0162] S1800, in response to the triggering of the automatic repair command, issues a security baseline repair configuration based on the host security baseline risk alarm information.

[0163] Specifically, in response to the automatic repair command issued by the terminal device 101, this embodiment determines to perform automatic repair of the security baseline and then issues a repair configuration file. The repair configuration file includes: information on the detection items to be repaired, backup information on the detection items to be repaired, etc. The information on the detection items to be repaired refers to the fact that multiple failed detection items can be repaired in a single repair process. Each detection item contains one or more meta-detection points to be repaired, and each meta-detection point contains a set of repair instructions. Furthermore, the backup information on the detection items refers to the fact that each detection item contains one or more meta-detection points, and each meta-detection point contains a set of backup instructions.

[0164] S1900: Backs up settings and files to be modified during the repair process, and automatically repairs detected host security baseline risks.

[0165] Specifically, to improve disaster recovery capabilities and recoverability during the automatic repair process, this application embodiment backs up information including, but not limited to, configurations, files, and system settings that may be modified during the repair process. For files, the backup method can be to back up the target file locally and in the background; while for system configurations and configuration information, the backup method can be to save the data to be backed up in the background, and the backup data includes the path information and corresponding values ​​of the configuration items.

[0166] S2000: Check the completion status of repairs for all risky meta-detection points to determine whether all risky meta-detection points have been repaired.

[0167] Specifically, this application embodiment can automatically repair risky meta-detection points. For example, if the meta-detection point that fails compliance verification is "ensure the freevxfs module is not loaded," then the repair command that this application embodiment can use for this meta-detection point is: `rmmod freevxfs`. Similarly, this application can complete the repair of all risky meta-detection points. After the repair is completed, this application embodiment determines in step S2000 whether all risky meta-detection points have been repaired to ensure that the security baseline repair is complete.

[0168] S2100: Re-initiate compliance verification processing for the security baseline detection items after the repair is completed.

[0169] Specifically, in this embodiment of the application, after the baseline risk repair is completed, the repaired test items can be re-initiated for testing. If the compliance test result passes, the information of successful repair is returned to the terminal device or cloud server; otherwise, the information of the test items that fail the test is reported. The information of the test items that fail the test includes the meta-test points that failed the test and the reason for the test failure.

[0170] S2200: Based on the compliance verification results of the repaired security baseline detection items, display the automatic repair results.

[0171] S2300, in response to the rollback command, restores the files, configurations and other information modified during the automatic repair process to their state before the repair.

[0172] Specifically, the rollback instructions in this application embodiment may include file data recovery instructions, system information recovery instructions, and configuration information recovery instructions, etc.

[0173] Through steps S1100-S2300, this embodiment of the application executes a host security baseline management method on the terminal device. First, a security baseline detection command is issued to determine the security baseline detection items and meta-detection points to be detected. Then, parameters are collected on a per-meta-detection-point basis, and the collected parameters and the obtained meta-detection-point compliance parameters are subjected to a first compliance verification to obtain a first detection result. Once all meta-detection points have been detected, a second compliance verification is performed on the security baseline detection items according to the logical relationship between each meta-detection point to obtain a second detection result. The second detection results are then summarized to obtain a third detection result. Based on the third detection result, it is determined whether the compliance verification of this host security baseline has passed. If the host security baseline detection fails, risk information, including the failed security baseline detection items, is displayed on the terminal device's interface. Users can intuitively view the risk information and initiate automatic repair of the security baseline through human-computer interaction options. When the terminal system determines that automatic repair is required, it first issues a repair configuration, identifies the items to be checked and the backup instructions, and backs up and saves all system configurations and files that may be changed during the automatic repair process. After all the detected items have been automatically repaired, a host security baseline check is performed again to determine whether the automatic repair passed, and the repair results are displayed on the terminal system's interface. When the automatic repair is complete, the user can choose to restore the detected items to their pre-repair state. The terminal device, based on the series of rollback operation instructions and the backup information stored locally or in the background, sequentially restores the files, configurations, and other information modified during the repair process of each meta-detection point to their pre-repair state.

[0174] Reference Figure 7 , Figure 7 This is a schematic diagram of the host security baseline management device provided in an embodiment of this application. The management device 1401 can be applied to... Figure 1 The terminal device 101 shown can, for example, implement some or all of its functions through hardware or a combination of hardware and software, to achieve the steps described in the host security baseline management method above. Figure 7 As shown, the management device 1401 may include:

[0175] The first module 1410 is used to issue a security baseline detection instruction to the host or host group under test. The security baseline detection instruction includes a set of security baseline detection items configured for the host or host group under test. The set of security baseline detection items includes at least one security baseline detection item composed of a logical AND-OR combination of multiple meta-detection points.

[0176] The second module 1420 is used to receive host security baseline detection parameter information collected based on the set of security baseline detection items reported by the host or host group under inspection.

[0177] The third module 1430 is used to perform compliance verification processing on the host security baseline detection parameter information.

[0178] The fourth module 1440 is used to display or push host security baseline risk alarm information to the host or host group under inspection if the compliance verification of the host security baseline fails.

[0179] The fifth module 1450 is used to issue security baseline repair configurations based on host security baseline risk alarm information, so as to automatically repair the detected host security baseline risks.

[0180] In some embodiments, the management device may further include a core processing module unit, which may include a backup and rollback module, a repair module, a repair verification module, a communication module, and a console module.

[0181] Specifically, the repair module in this application embodiment can serve as the core module for automatic repair, used to automatically repair each security baseline detection item.

[0182] After the above repair module completes the automatic repair of the security baseline detection items, it can call the repair verification module to perform baseline security detection on all security baseline detection items. If the detection result is passed, the repair success status information is reported to the cloud server or terminal device through the host or host group under test. If the detection result is failed, the reason for the repair failure is reported.

[0183] The aforementioned communication module is used to implement functions such as data communication, distribution, and reporting between the mobile terminal and the cloud server.

[0184] In addition, before automatically repairing the security baseline detection items through the above repair module, the backup and rollback module can be used to back up and record the configuration, files and other information that need to be repaired and modified. When needed, users can choose to roll back and restore to the state before the repair.

[0185] This application embodiment can also configure the automatic repair strategy through the console module and send automatic repair instructions to the repair module to control the repair module to perform repair processing; it can also display the repair results in response to the user's input result display instructions.

[0186] In summary, the management device provided in this application first issues a security baseline detection instruction to the host or host group under inspection. The security baseline detection instruction includes a set of security baseline detection items configured for the host or host group under inspection. The set of security baseline detection items includes at least one security baseline detection item composed of multiple meta-detection point logical AND / OR combinations. This application embodiment decomposes each security baseline detection item into multiple meta-detection points, and then implements detection through the detection logic of each meta-detection point. Compared to deploying the detection logic of each security baseline detection item, deploying the detection logic of each meta-detection point is faster and more efficient. Furthermore, different security baseline detection items share common meta-detection points, therefore different security baseline detection items can share the same meta-detection point. The point detection logic improves the implementation efficiency of the detection logic; next, this embodiment of the application receives host security baseline detection parameter information reported by the host to be inspected or the host group, which is collected according to the set of security baseline detection items; performs host security baseline compliance verification processing on the host security baseline detection parameter information; if the host security baseline compliance verification fails, it displays or pushes host security baseline risk alarm information to the host to be inspected or the host group; and issues security baseline repair configuration according to the host security baseline risk alarm information to automatically repair the detected host security baseline risks; this embodiment of the application can automatically repair the detected host security baseline risks according to the host security baseline risk alarm information, which can effectively improve the repair efficiency and the comprehensiveness of the repair.

[0187] This application also provides an electronic device, which includes a processor and a memory;

[0188] The memory stores the program;

[0189] The processor executes the program to perform Figure 2 The host security baseline management method is shown below;

[0190] The electronic device has the function of running the message queue proposed in the embodiments of this application, such as a personal computer (PC), mobile phone, smartphone, personal digital assistant (PDA), wearable device, handheld computer (PPC), tablet computer, etc.

[0191] In this embodiment of the application, the processor included in the terminal device has the following functions:

[0192] A security baseline detection instruction is issued to the host or host group to be inspected. The security baseline detection instruction includes a set of security baseline detection items configured for the host or host group to be inspected. The set of security baseline detection items includes at least one security baseline detection item composed of a logical AND-OR combination of multiple meta-detection points.

[0193] Receive host security baseline detection parameter information collected based on the set of security baseline detection items reported by the host or host group under inspection;

[0194] Perform compliance verification processing on the host security baseline detection parameter information;

[0195] If the compliance verification of the host security baseline fails, a host security baseline risk alert will be displayed or pushed to the host or host group under inspection.

[0196] Based on the host security baseline risk alarm information, a security baseline repair configuration is issued to automatically repair the detected host security baseline risks.

[0197] This application also discloses a computer program product or computer program, which includes computer instructions stored in a computer-readable storage medium. A processor of a computer device can read the computer instructions from the computer-readable storage medium and execute the computer instructions, causing the computer device to perform... Figure 2 The host security baseline management method is shown.

[0198] In some alternative embodiments, the functions / operations mentioned in the block diagrams may not occur in the order shown in the operation diagrams. For example, depending on the functions / operations involved, two consecutively shown blocks may actually be executed substantially simultaneously, or the blocks may sometimes be executed in reverse order. Furthermore, the embodiments presented and described in the flowcharts of this invention are provided by way of example to provide a more comprehensive understanding of the technology. The disclosed methods are not limited to the operations and logic flows presented herein. Alternative embodiments are contemplated in which the order of various operations is changed and sub-operations described as part of a larger operation are executed independently.

[0199] Furthermore, although the invention has been described in the context of functional modules, it should be understood that, unless otherwise stated, one or more of the functions and / or features may be integrated into a single physical device and / or software module, or one or more functions and / or features may be implemented in a separate physical device or software module. It is also understood that a detailed discussion of the actual implementation of each module is unnecessary for understanding the invention. Rather, given the properties, functions, and internal relationships of the various functional modules in the apparatus disclosed herein, the actual implementation of the module will be understood within the scope of conventional skill of an engineer. Therefore, those skilled in the art can implement the invention as set forth in the claims using ordinary techniques without excessive experimentation. It is also understood that the specific concepts disclosed are merely illustrative and not intended to limit the scope of the invention, which is determined by the full scope of the appended claims and their equivalents.

[0200] If a function is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this invention, or the part that contributes to the prior art, or a part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods of the various embodiments of this invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0201] The logic and / or steps represented in the flowchart or otherwise described herein, for example, can be considered as a sequenced list of executable instructions for implementing logical functions, and can be embodied in any computer-readable medium for use by, or in conjunction with, an instruction execution system, apparatus, or device (such as a computer-based system, a processor-included system, or other system that can fetch and execute instructions from, an instruction execution system, apparatus, or device). For the purposes of this specification, "computer-readable medium" can be any means that can contain, store, communicate, propagate, or transmit programs for use by, or in conjunction with, an instruction execution system, apparatus, or device.

[0202] More specific examples of computer-readable media (a non-exhaustive list) include: electrical connections (electronic devices) having one or more wires, portable computer disk drives (magnetic devices), random access memory (RAM), read-only memory (ROM), erasable and editable read-only memory (EPROM or flash memory), fiber optic devices, and portable optical disc read-only memory (CDROM). Furthermore, computer-readable media can even be paper or other suitable media on which programs can be printed, because programs can be obtained electronically, for example, by optically scanning the paper or other medium, followed by editing, interpreting, or otherwise processing as necessary, and then stored in computer memory.

[0203] It should be understood that various parts of the present invention can be implemented in hardware, software, firmware, or a combination thereof. In the above embodiments, multiple steps or methods can be implemented in software or firmware stored in memory and executed by a suitable instruction execution system. For example, if implemented in hardware, as in another embodiment, it can be implemented using any one or a combination of the following techniques known in the art: discrete logic circuits having logic gates for implementing logical functions on data signals, application-specific integrated circuits (ASICs) having suitable combinational logic gates, programmable gate arrays (PGAs), field-programmable gate arrays (FPGAs), etc.

[0204] In the description of this specification, references to terms such as "one embodiment," "some embodiments," "example," "specific example," or "some examples," etc., indicate that a specific feature, structure, material, or characteristic described in connection with that embodiment or example is included in at least one embodiment or example of the invention. In this specification, the illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in one or more embodiments or examples.

[0205] Although embodiments of the invention have been shown and described, those skilled in the art will understand that various changes, modifications, substitutions and alterations can be made to these embodiments without departing from the principles and spirit of the invention, the scope of which is defined by the claims and their equivalents.

[0206] The above is a detailed description of the preferred embodiments of the present invention. However, the present invention is not limited to the embodiments. Those skilled in the art can make various equivalent modifications or substitutions without departing from the spirit of the present invention. All such equivalent modifications or substitutions are included within the scope defined by the claims of this application.

Claims

1. A host security baseline management method, characterized in that, include: A security baseline detection instruction is issued to the host or host group to be inspected, wherein the security baseline detection instruction includes a set of security baseline detection items configured for the host or host group to be inspected, and the set of security baseline detection items includes at least one security baseline detection item composed of a logical AND-OR combination of multiple meta-detection points; Receive host security baseline detection parameter information collected according to the security baseline detection item set reported by the host under inspection or host group, wherein the host security baseline detection parameter information includes parameter information of multiple meta-detection points corresponding to at least one security baseline detection item; The parameter information of the multiple meta-detection points is subjected to compliance verification processing of the host security baseline; If the compliance verification of the host security baseline fails, a host security baseline risk alarm message will be displayed or pushed to the host or host group under inspection. Based on the host security baseline risk alarm information, a security baseline repair configuration is issued to automatically repair the detected host security baseline risks.

2. The host security baseline management method according to claim 1, characterized in that, The compliance verification process for the host security baseline of the parameter information of the multiple meta-detection points includes: A first compliance verification is performed on all meta-detection points in the security baseline detection item set to obtain a first detection result; wherein, the security baseline detection item set includes a first meta-detection point and a second meta-detection point, the first meta-detection point exists in at least two different security baseline detection items, and the second meta-detection point exists in a unique security baseline detection item; Extract the first compliance verification result corresponding to the first meta-detection point and the second meta-detection point contained in each of the security baseline detection items from the first detection result, perform a second compliance verification on each of the security baseline detection items, and obtain a second detection result for each of the security baseline detection items; Perform a logical AND-OR operation on the second detection result of each security baseline detection item in the security baseline detection item set to generate the third detection result of the host or host group to be inspected.

3. The host security baseline management method according to claim 2, characterized in that, The first compliance verification is performed on all meta-detection points in the security baseline detection item set to obtain the first detection result, including: All meta-detection points in the security baseline detection item set are classified and standardized to determine the types of meta-detection points with different fine granularities; For each of the aforementioned meta-detection point types, a corresponding compliance verification mode is determined; Based on the host security baseline detection parameter information, the first compliance verification is performed on the meta detection points through the compliance verification mode corresponding to the meta detection points to obtain the first compliance verification result of each meta detection point, and the first compliance verification result of all meta detection points is used as the first detection result. The compliance verification mode includes the regular expression matching mode.

4. The host security baseline management method according to claim 2, characterized in that, The step of extracting the first compliance verification result corresponding to the first meta-detection point and the second meta-detection point contained in each of the security baseline detection items from the first detection result, performing a second compliance verification on each of the security baseline detection items, and obtaining a second detection result for each of the security baseline detection items includes: Obtain the first compliance verification results of all first-element and second-element detection points in the security baseline detection item; Perform a logical AND-OR operation on the first compliance verification results of all the first-element detection points and the second-element detection points to obtain the second detection result of the security baseline detection item.

5. The host security baseline management method according to claim 3, characterized in that, The step of receiving host security baseline detection parameter information collected according to the security baseline detection item set reported by the host under inspection or host group includes: Receive host security baseline detection parameter information, wherein the host security baseline detection parameter information includes at least one of the following: network configuration information, kernel loading information, file system information, or configuration file information; Determine the first parameter information of the meta detection point that the file system is not loaded and the second parameter information that is disabled after the file system is loaded from the host security baseline detection parameter information; The first parameter information and the second parameter information are used to input the compliance verification mode to perform the first compliance verification and obtain the first detection result.

6. The host security baseline management method according to any one of claims 2-5, characterized in that, The method also includes a data backup step, which includes: Obtain the detection item information from the set of security baseline detection items, wherein the detection item information includes at least one of the following: detection item name, detection item content description, detection item remediation suggestion, or detection item risk level; Obtain the logical relationship information between the security baseline detection item and the meta detection point; wherein, the logical relationship information is used to characterize whether the security baseline detection item contains the meta detection point; Obtain the meta-detection point information of the meta-detection point, wherein the meta-detection point information includes at least one of the following: meta-detection point name or compliance verification rule parameters; Obtain the first detection result and the second detection result; The detection item information, the logical relationship information, the meta-detection point information, the first detection result, and the second detection result are stored in multiple database tables.

7. The host security baseline management method according to claim 5, characterized in that, The security baseline of the host or host group under test includes the system baseline and the component baseline. The step of issuing a security baseline detection command to the host or host group under test includes: Obtain the first set of security baseline detection items in the system baseline, wherein the system baseline includes at least one of the following: Windows system baseline, Windows Server system baseline, CentOS system baseline, or Ubuntu system baseline; Obtain the second set of security baseline detection items in the component baseline, wherein the component baseline includes the database baseline and the web application baseline; Based on the first set of security baseline detection items and the second set of security baseline detection items, a security baseline detection instruction is issued to the host or host group to be inspected. The security baseline detection items include at least one of the following: file permission items, weak password items, risky port openness items, file system partition settings items, secure boot settings items, access control items, installation update and patch settings items, host service check items, network parameter check items, firewall configuration items, network protocol configuration items, log recording settings items, or root privilege login settings items.

8. The host security baseline management method according to claim 1, characterized in that, The step of issuing a security baseline repair configuration based on the host security baseline risk alarm information to automatically repair detected host security baseline risks includes: Match the security baseline detection items to be repaired in the host or host group under inspection based on the security baseline risk alarm information; The element detection points to be repaired are determined based on the security baseline detection items to be repaired; The security baseline repair configuration is generated based on the meta-detection points to be repaired, so as to automatically repair the meta-detection points to be repaired and generate repair results.

9. The host security baseline management method according to claim 8, characterized in that, The method further includes: Obtain the host security baseline risk alarm information, which includes at least one of the following: risk security baseline detection item name, risk content description, or risk remediation suggestion; Displays the host security baseline risk warning information.

10. The host security baseline management method according to claim 8 or 9, characterized in that, The method further includes: Obtain the repair results, which include successful repair results and failed repair results; Based on the repair results, repair status information is generated and sent to the server for parsing and processing. The repair status information includes either a successful repair status or a reason for a repair failure.

11. The host security baseline management method according to claim 10, characterized in that, The method further includes a data restoration step, which includes: Based on the security baseline repair configuration, determine the configuration information to be repaired; Backup information is generated based on the configuration information to be repaired. The backup information is used to restore the host security baseline of the host or host group to be repaired to the host security baseline before repair.

12. A host security baseline management device, characterized in that, include: The first module is used to issue a security baseline detection instruction to the host or host group to be inspected. The security baseline detection instruction includes a set of security baseline detection items configured for the host or host group to be inspected. The set of security baseline detection items includes at least one security baseline detection item composed of a logical AND-OR combination of multiple meta-detection points. The second module is used to receive host security baseline detection parameter information collected according to the security baseline detection item set reported by the host under inspection or host group. The host security baseline detection parameter information includes parameter information of multiple meta-detection points corresponding to at least one security baseline detection item. The third module is used to perform compliance verification processing on the parameter information of the multiple meta-detection points for host security baseline. The fourth module is used to display or push host security baseline risk alarm information to the host or host group under inspection if the compliance verification of the host security baseline fails. The fifth module is used to issue security baseline repair configuration based on the host security baseline risk alarm information, so as to automatically repair the detected host security baseline risks.

13. An electronic device, characterized in that, Including the processor and memory; The memory is used to store programs; The processor executes the program to implement the method as described in any one of claims 1-11.

14. A computer-readable storage medium, characterized in that, The storage medium stores a program that is executed by a processor to implement the method as described in any one of claims 1-11.

Images