Business behavior monitoring method, monitoring system, storage medium and electronic device

Abstract

The application provides a business behavior monitoring method, a monitoring system, a storage medium and an electronic device. The method comprises the following steps: obtaining a first behavior information group, wherein the first behavior information group comprises information of at least one business behavior; determining whether each information in the first behavior information group meets condition one and condition two, and obtaining a determination result; determining whether each behavior corresponding to the first behavior information group is credible according to the determination result; wherein the condition one is that each information in the first behavior information group is information of a preset business behavior; and the condition two is that an execution sequence of each behavior corresponding to the first behavior information group meets a preset execution sequence, and an occurrence time of each behavior corresponding to the first behavior information group meets a preset time condition. It can be seen that the application can accurately determine whether each behavior is credible in time, find the untrustworthy behavior in time, and improve the security and reliability of the system.

Description

Technical Field

[0001] This invention relates to the field of industrial control systems, and in particular to a method, system, storage medium, and electronic device for monitoring business activities. Background Technology

[0002] Industrial Control Systems (ICS), as a crucial strategic resource, are applied to over 80% of critical infrastructure. They possess the capability to control functions such as hydropower station switches, monitor power grid status, and regulate the pressure of fuel and gas pipelines, playing a vital role in national infrastructure development. With the rise of the "Internet Plus" concept, following "Industry 4.0" and the "Industrial Internet," my country has also proposed the "Made in China 2025" strategy, further deepening and developing the integration of industrialization and informatization.

[0003] At the same time, its underdeveloped network security system also poses significant security risks to this management approach, bringing communication security threats from the internet to industrial control systems. Current industrial control systems have poor capabilities to prevent unauthorized access and malware, particularly in terms of security and reliability for business operations. Summary of the Invention

[0004] In view of the above problems, the present invention provides a method, system, storage medium and electronic device for monitoring business activities that overcomes or at least partially solves the above problems.

[0005] Firstly, a method for monitoring business activities, including:

[0006] Obtain a first behavior information group, wherein the first behavior information group includes information on at least one business behavior;

[0007] Determine whether each piece of information in the first behavior information group satisfies conditions one and two, and obtain the determination result;

[0008] Based on the judgment result, determine whether each behavior corresponding to the first behavior information group is trustworthy;

[0009] Among them, the first condition is: each piece of information in the first behavior information group is information of a preset business behavior;

[0010] The second condition is that the execution order of each behavior corresponding to the first behavior information group conforms to the preset execution order, and the occurrence time of each behavior corresponding to the first behavior information group conforms to the preset time condition.

[0011] With reference to the first aspect, in some optional embodiments, the determining, according to the judgment result, whether each behavior corresponding to the first behavior information group is trustworthy comprises:

[0012] if the judgment result is that each information in the first behavior information group satisfies the condition one and the condition two, it is determined that each behavior corresponding to the first behavior information group is trustworthy;

[0013] if the judgment result is that there is information in the first behavior information group that does not satisfy the condition one and the condition two at the same time, it is determined that there is untrustworthy behavior in each behavior corresponding to the first behavior information group.

[0014] With reference to the first aspect, in some optional embodiments, the method further comprises:

[0015] obtaining object information of a trustworthy computing object, the trustworthy computing object comprising at least one of the following running environment objects: operating system code and driver code;

[0016] calculating the object information by using a hash algorithm, so as to obtain a trustworthy computing result of the trustworthy computing object;

[0017] comparing the trustworthy computing result with a preset trustworthy benchmark value of the trustworthy computing object, so as to determine a current state of the trustworthy computing object, wherein if the trustworthy computing result matches the preset trustworthy benchmark value of the trustworthy computing object, it is determined that the current state of the trustworthy computing object is a safe state, otherwise, it is determined that the current state of the trustworthy computing object is a risky state;

[0018] the determining, according to the judgment result, whether each behavior corresponding to the first behavior information group is trustworthy comprises:

[0019] determining, according to the judgment result and the current state of the trustworthy computing object, whether each behavior corresponding to the first behavior information group is trustworthy;

[0020] if the current state of the trustworthy computing object is the safe state, and the judgment result is that each information in the first behavior information group satisfies the condition one and the condition two, it is determined that each behavior corresponding to the first behavior information group is trustworthy;

[0021] if the current state of the trustworthy computing object is the risky state, or the judgment result is that there is information in the first behavior information group that does not satisfy the condition one and the condition two at the same time, it is determined that there is untrustworthy behavior in each behavior corresponding to the first behavior information group.

[0022] In combination with the previous embodiment, in some optional embodiments, the method further comprises: obtaining the current state of the trusted computing object determined last time as the last state of the trusted computing object.

[0023] The determining whether each behavior corresponding to the first behavior information group is trusted according to the judgment result comprises:

[0024] The determining whether each behavior corresponding to the first behavior information group is trusted according to the judgment result, the current state of the trusted computing object and the last state of the trusted computing object;

[0025] If the current state of the trusted computing object is the safe state, the last state of the trusted computing object is the safe state, and the judgment result is that each information in the first behavior information group satisfies condition one and condition two, it is determined that each behavior corresponding to the first behavior information group is trusted.

[0026] If the current state of the trusted computing object is the risky state, or the last state of the trusted computing object is the risky state, or the judgment result is that there is information in the first behavior information group that does not satisfy condition one and condition two at the same time, it is determined that there is an untrusted behavior in each behavior corresponding to the first behavior information group.

[0027] In combination with the first aspect, in some optional embodiments, the preset business behavior group at least comprises: a data acquisition behavior, a logic control operation behavior, a redundant synchronous data behavior and an operation result output behavior.

[0028] In combination with the first aspect, in some optional embodiments, the method further comprises:

[0029] Monitoring a preset monitoring period, and when the monitoring period arrives, performing the monitoring method of claim 1.

[0030] In combination with the first aspect, in some optional embodiments, the method further comprises:

[0031] If there is an untrusted behavior in each behavior corresponding to the first behavior information group, audit data of the untrusted behavior is generated.

[0032] Second aspect, a business behavior monitoring system, the monitoring system comprises: a proactive monitoring module;

[0033] The proactive monitoring module comprises: a behavior information obtaining unit, a behavior information judging unit and a behavior result determining unit.

[0034] The behavior information obtaining unit is configured to obtain a first behavior information set, the first behavior information set including information of at least one business behavior;

[0035] The behavior information judging unit is configured to judge whether each information in the first behavior information set meets condition one and condition two, and obtain a judgment result;

[0036] The behavior result determining unit is configured to determine whether each behavior corresponding to the first behavior information set is credible according to the judgment result;

[0037] The condition one is that each information in the first behavior information set is information of a preset business behavior set;

[0038] The condition two is that an execution order of each behavior corresponding to the first behavior information set meets a preset execution order, and an occurrence time of each behavior corresponding to the first behavior information set meets a preset time condition.

[0039] In a third aspect, a storage medium has a program stored thereon, and the program is executed by a processor to implement any of the monitoring methods.

[0040] In a fourth aspect, an electronic device includes at least one processor, and at least one memory connected with the processor through a bus; the processor and the memory complete communication with each other through the bus; the processor is used to call program instructions in the memory to execute any of the monitoring methods.

[0041] According to the above technical solution, the business behavior monitoring method, the monitoring system, the storage medium and the electronic device provided by the application obtain a first behavior information set, the first behavior information set including information of at least one business behavior; judge whether each information in the first behavior information set meets condition one and condition two, and obtain a judgment result; determine whether each behavior corresponding to the first behavior information set is credible according to the judgment result; the condition one is that each information in the first behavior information set is information of a preset business behavior; the condition two is that an execution order of each behavior corresponding to the first behavior information set meets a preset execution order, and an occurrence time of each behavior corresponding to the first behavior information set meets a preset time condition. Therefore, it can be seen that the application can timely and accurately determine whether each behavior is credible, timely find the behavior that is not credible, and improve the security and reliability of the system.

[0042] The above description is only a summary of the technical scheme of the present application. In order to make the technical means of the present application more clearly understood and implemented according to the content of the description, and in order to make the above and other purposes, features and advantages of the present application more obvious and easy to understand, the following specific embodiments of the present application are described. BRIEF DESCRIPTION OF DRAWINGS

[0043] Various other advantages and benefits will become apparent to those of ordinary skill in the art upon reading the following detailed description of the preferred embodiments. The accompanying drawings are included to provide a description of the preferred embodiments and are not meant to limit the present application. Furthermore, the same reference numerals in the attached drawings are intended to represent the same components throughout the several drawings. In the drawings:

[0044] Figure 1 A flow chart of a method for monitoring business behavior is shown;

[0045] Figure 2 A schematic diagram of a behavior trace table is shown;

[0046] Figure 3 A structural schematic diagram of a system for monitoring business behavior is shown;

[0047] Figure 4 A structural schematic diagram of an electronic device is shown. DETAILED DESCRIPTION

[0048] Exemplary embodiments of the present disclosure will be described in detail with reference to the accompanying drawings. Although exemplary embodiments of the present disclosure are shown in the drawings, it should be understood that the present disclosure can be implemented in various forms and should not be limited by the embodiments set forth herein. Rather, these embodiments are provided so that the present disclosure can be more thoroughly understood and the scope of the present disclosure can be accurately conveyed to those skilled in the art.

[0049] As Figure 1 shown, the present application provides a method for monitoring business behavior, comprising:

[0050] S100, obtaining a first behavior information group, the first behavior information group at least including information of one business behavior;

[0051] Optionally, the first behavior information group can include information of multiple behaviors, that is, information of one behavior can be understood as one information in the first behavior information group. The information of one behavior can include occurrence time information, occurrence sequence information and behavior identification information. The occurrence time information can include a starting time, a termination time and a duration of the corresponding behavior. The occurrence sequence information can be understood as the sequence of occurrence of each behavior corresponding to the first behavior information group. The behavior identification information can be understood as each behavior can be provided with corresponding identification, so that subsequent preset business behaviors can be distinguished from other behaviors according to the identification, and the present application does not limit this.

[0052] Optionally, the present application does not limit the number of behaviors corresponding to the first behavior information group, and the number of behaviors corresponding to the first behavior information group can be set according to actual needs. For example, if the number of preset business behaviors is N, the number of behaviors corresponding to the first behavior information group can also be N, that is, the number of behaviors covered by the first behavior information group is the same as the number of preset business behaviors, and the present application does not limit this.

[0053] Optionally, each behavior corresponding to the first behavior information group can be understood as one behavior trace, that is, one behavior trace can cover multiple behaviors, and the present application does not limit this.

[0054] S200, judging whether each information in the first behavior information group satisfies condition one and condition two, and obtaining a judgment result;

[0055] Optionally, judging whether each information in the first behavior information group satisfies condition one and condition two can be understood as judging whether each behavior in one behavior trace satisfies the preset requirement, and the present application does not limit this.

[0056] S300, determining whether each behavior corresponding to the first behavior information group is credible according to the judgment result;

[0057] Optionally, if each information in the first behavior information group satisfies condition one and condition two, it means that each behavior in the corresponding behavior trace is credible, that is, the whole behavior trace is credible, otherwise, it means that there is an uncredible behavior in the corresponding behavior trace, that is, the behavior trace is uncredible, and the present application does not limit this.

[0058] For example, in combination with the embodiment shown in Figure 1 In some optional embodiments, the S300 includes steps 310 and 311.

[0059] Step 310, if the judgment result is that each information in the first behavior information group satisfies condition one and condition two, it is determined that each behavior corresponding to the first behavior information group is credible.

[0060] Step 311, if the result of the judgment is that there is information in the first behavior information group that does not simultaneously satisfy condition one and condition two, it is determined that there is an untrustworthy behavior in each behavior corresponding to the first behavior information group.

[0061] The condition one is that each information in the first behavior information group is information of a preset business behavior.

[0062] Optionally, the application can be applied to a controller of an industrial control system, such as a PLC controller. Generally, the industrial control system requires the controller to sequentially execute each business behavior according to a preset program, and this is repeated in a cycle. However, in the process of execution, the controller can be attacked or fail, causing the controller to not sequentially execute each business behavior according to the preset program, and situations such as chaotic execution order, missing part of the business behavior, and executing unknown behaviors can occur. Therefore, only when each information in the first behavior information group is information of a preset business behavior, can it be determined that each behavior in the corresponding behavior trace is a preset business behavior, and there is no unknown behavior.

[0063] Optionally, the condition one can also be that each information in the first behavior information group is not only information of a preset business behavior, but also covers all information of a preset business behavior, and each information in the first behavior information group is not repeated, which is not limited by the application.

[0064] Optionally, the application does not specifically limit the preset business behavior. For example, in combination with the embodiment shown in FIG. 1, in some optional embodiments, the preset business behavior group at least includes a data acquisition behavior, a logic control operation behavior, a redundant synchronous data behavior, and an operation result output behavior. Of course, other business behaviors can also be included, which is not limited by the application. Figure 1

[0065] The condition two is that the execution order of each behavior corresponding to the first behavior information group conforms to a preset execution order, and the occurrence time of each behavior corresponding to the first behavior information group conforms to a preset time condition.

[0066] Optionally, in combination with the application scenario of the aforementioned industrial control system. Only when the execution order of each behavior corresponding to the first behavior information group conforms to the preset execution order, can it be determined that the execution order of each business behavior in the corresponding behavior trace is not chaotic. Otherwise, even if each behavior in the corresponding behavior trace is a preset business behavior, if the execution order between these business behaviors is chaotic, it also indicates that the corresponding behavior trace is untrustworthy, which is not limited by the application.

[0067] ​Optionally, in practice, the occurrence time of each business behavior can also be limited. For example, the maximum duration of each preset business behavior is specified, i.e., it is specified that the business behavior must be executed within a time range, and if the time exceeds the time range, it is determined that the execution of the business behavior is not trusted, and the behavior trace is not trusted. The present application does not limit this.

[0068] Optionally, in addition to the maximum duration of each preset business behavior, the start time and the end time of each preset business behavior can also be determined according to the duration of each business behavior and the timer. If a specific business behavior does not start within the specified time range or does not end within the specified time range, it means that the execution of the business behavior is not trusted. The present application does not limit this.

[0069] Optionally, the above-mentioned determination of whether each behavior is trusted according to the first behavior information group is based on the behavior information to determine whether the behavior is trusted, without considering the running environment on which the behavior is executed. Therefore, in order to further improve the security and reliability of the present application, the running environment on which the behavior is executed is considered in some optional embodiments. Figure 1 As shown in the embodiments, in some optional embodiments, the method further comprises steps 400, 500 and 600.

[0070] Step 400: obtaining object information of a trusted computing object, wherein the trusted computing object comprises at least one of the following running environment objects: operating system code and driver code.

[0071] Optionally, the above-mentioned trusted computing object is obtained so as to subsequently perform trusted computing on each trusted computing object to determine whether each trusted computing object is trusted.

[0072] Optionally, the present application uses operating system code and driver code as optional embodiments to illustrate the scheme, but the present application is not limited to obtaining object information of operating system code and object information of driver code. Any feasible object information of a trusted computing object belongs to the protection scope of the present application, and the present application does not limit this.

[0073] Step 500: performing trusted computing on the object information by using a hash algorithm to obtain a trusted computing result of the trusted computing object.

[0074] Optionally, the present application can perform trusted computing on the object information of each trusted computing object by using a hash algorithm to obtain a trusted computing result of each trusted computing object. Of course, according to actual conditions, a suitable trusted computing method can be selected to perform trusted computing on the object information of each trusted computing object, and the present application does not limit this.

[0075] Step 600, comparing the trusted computing result with the preset trusted reference value of the trusted computing object, to determine the current state of the trusted computing object, wherein if the trusted computing result matches the preset trusted reference value of the trusted computing object, it is determined that the current state of the trusted computing object is a safe state, otherwise, it is determined that the current state of the trusted computing object is a risky state.

[0076] Optionally, the "match" described herein can be understood as: the trusted computing result of the trusted computing object is exactly the same as the preset trusted reference value of the trusted computing object, or the error between the trusted computing result of the trusted computing object and the preset trusted reference value of the trusted computing object is within the allowable error range, and the present application does not limit this.

[0077] Optionally, the trusted reference value of each trusted computing object can be an ideal value obtained and stored through multiple experiments and trusted computing in advance, and the present application does not limit this.

[0078] Optionally, the current state of the trusted computing object being a safe state can be understood as: the running environment on which the behaviors corresponding to the first behavior information group are executed is safe and trusted. On the contrary, the current state of the trusted computing object being a risky state can be understood as: the running environment on which the behaviors corresponding to the first behavior information group are executed has vulnerabilities or risks.

[0079] Optionally, if the current state of the trusted computing object is a risky state, even if each information in the first behavior information group satisfies condition one and condition two, it is determined that there is an untrusted behavior in the behaviors corresponding to the first behavior information group. Only when the current state of the trusted computing object is a safe state and each information in the first behavior information group satisfies condition one and condition two, it can be determined that each behavior corresponding to the first behavior information group is trusted, and the present application does not limit this.

[0080] For example, the S300 includes steps 320, 321 and 322.

[0081] Step 320, determining whether each behavior corresponding to the first behavior information group is trusted according to the judgment result and the current state of the trusted computing object.

[0082] Step 321, if the current state of the trusted computing object is the safe state and the judgment result is that each information in the first behavior information group satisfies condition one and condition two, it is determined that each behavior corresponding to the first behavior information group is trusted.

[0083] Step 322, if the current state of the trusted computing object is the risky state, or the result of the judgment is that there is information in the first behavior information group that does not simultaneously satisfy condition one and condition two, it is determined that there is untrusted behavior in each behavior corresponding to the first behavior information group.

[0084] Optionally, by combining the result of the judgment and the current state of the trusted computing object, the safety and reliability of the present application can be further improved by comprehensively judging whether each behavior corresponding to the first behavior information group is trusted or not, and the present application does not limit this.

[0085] Optionally, in order to further improve the safety and reliability of the present application, more judgment conditions can be combined when judging whether each behavior corresponding to the first behavior information group is trusted or not. For example, in some optional embodiments, the method further comprises:

[0086] Step 700, obtaining the current state of the trusted computing object determined last time as the last state of the trusted computing object;

[0087] Optionally, combining the current state of the trusted computing object determined last time is more conducive to accurately determining whether the trusted computing object is safe and trusted, and the present application does not limit this.

[0088] The S300 comprises steps 330, 331 and 332.

[0089] Step 330, according to the result of the judgment, the current state of the trusted computing object and the last state of the trusted computing object, it is determined whether each behavior corresponding to the first behavior information group is trusted or not;

[0090] Step 331, if the current state of the trusted computing object is the safe state, the last state of the trusted computing object is the safe state, and the result of the judgment is that each information in the first behavior information group satisfies condition one and condition two, it is determined that each behavior corresponding to the first behavior information group is trusted.

[0091] Step 332, if the current state of the trusted computing object is the risky state, or the last state of the trusted computing object is the risky state, or the result of the judgment is that there is information in the first behavior information group that does not simultaneously satisfy condition one and condition two, it is determined that there is untrusted behavior in each behavior corresponding to the first behavior information group.

[0092] Optionally, as mentioned above, the present application can measure each behavior in the behavior trace to determine whether there is an untrustworthy behavior in the behavior trace. That is, the present application can be executed in parallel with the behaviors performed by the controller, and the present application does not limit this.

[0093] Optionally, the present application can be executed repeatedly continuously or triggered when a triggering condition is reached. For example, in combination with the embodiment shown in Figure 1 In some optional embodiments, the method further comprises:

[0094] monitoring a preset monitoring period, and when the monitoring period is reached, executing the monitoring method shown in Figure 1

[0095] Optionally, the present application does not limit the monitoring period, which can be fixed or variable, and the present application does not limit this.

[0096] Optionally, the present application can also be triggered in a condition-triggered manner. For example, a timeout period can be set for a complete behavior trace. Because the business behaviors included in a trustworthy behavior trace can be fixed and unchangeable, the total execution time of a trustworthy behavior trace can be set to a corresponding time length range, and the present application is triggered when the timeout period is reached each time, and the present application does not limit this.

[0097] In combination with the embodiment shown in Figure 1 In some optional embodiments, the method further comprises:

[0098] If there is an untrustworthy behavior in each behavior corresponding to the first behavior information group, audit data of the untrustworthy behavior is generated.

[0099] Optionally, the present application can also audit the untrustworthy behavior, for example, record the number of times and the identity of the occurrence of the untrustworthy behavior, so that these untrustworthy behaviors can be targetedly defended, and the security and reliability of the present application are further improved, and the present application does not limit this.

[0100] Optionally, the execution order of each business behavior in the present application can be marked by bit sequence, for example, the bit sequence of the data acquisition behavior, the logical control operation behavior, the redundant synchronous data behavior, and the operation result output behavior is set to A1, A2, A3, and A4 in sequence.

[0101] The process of sequentially executing the above-mentioned data acquisition behavior, logical control operation behavior, redundant synchronous data behavior, and operation result output behavior can be understood as a complete behavior trace, and a behavior trace can be defined as: Trace(n)=A1·A2·A3·A4, n is the behavior trace number;

[0102] ​For any business behavior, its definition in the behavior trace is: p(Ai, Trace(n)) is, i is the business behavior label, that is, i is any one of 1, 2, 3 and 4;

[0103] Define the function t(Ai) as the time when the business behavior Ai occurs, and the trusted execution process should meet: If p(A1, Trace(n)) < p(A2, Trace(n)), then t(A1) < t(A2), wherein ActionSet can be understood as a preset business behavior set.

[0104] Moreover, the trusted execution process should also consider whether the environment is running is trusted. If the behavior trace is still trusted in combination with the running environment, the behavior trace should be complete, that is, it should meet: Run(AMIB, Trace(1)) = Run(AMIB, Trace(n)), wherein AMIB represents the basic trusted base of the running environment, and Run(AMIB, Trace(n)) represents the behavior track formed by the business behaviors described in Trace(n) in the specified time sequence.

[0105] Based on the above definition, in combination with Figure 2 the behavior trace table, it is judged whether A1, A2, A3 and A4 in Figure 2 are arranged in a fixed bit sequence, that is, whether the corresponding business behaviors are executed in a fixed bit sequence, that is, it meets: t1(A1) < t2(A2) < t3(A3) < t4(A3), and the time difference of time t1 to t4 meets the safe and trusted strategy requirement.

[0106] The completeness of each behavior trace can also be judged, for example: the last behavior A4 of Trace1, the behavior that will occur afterwards will be A1 behavior, which is not limited by the application.

[0107] As shown in Figure 3 , the application provides a business behavior monitoring system, which comprises: an active monitoring module 100;

[0108] The active monitoring module 100 comprises: a behavior information obtaining unit 110, a behavior information judging unit 120 and a behavior result determining unit 130.

[0109] The behavior information obtaining unit 110 is configured to execute obtaining a first behavior information group, wherein the first behavior information group comprises information of at least one business behavior;

[0110] The behavior information judging unit 120 is configured to execute judging whether each information in the first behavior information group meets condition one and condition two, and obtaining a judgment result;

[0111] The behavior result determination unit 130 is configured to determine whether each behavior corresponding to the first behavior information group is credible according to the determination result.

[0112] The first condition is that each information in the first behavior information group is information of a preset business behavior group.

[0113] The second condition is that an execution order of each behavior corresponding to the first behavior information group meets a preset execution order, and an occurrence time of each behavior corresponding to the first behavior information group meets a preset time condition.

[0114] In combination with the embodiment shown in Figure 3 In some optional embodiments, the behavior result determination unit 130 includes a first result unit and a second result unit.

[0115] The first result unit is configured to determine that each behavior corresponding to the first behavior information group is credible if the determination result is that each information in the first behavior information group meets the first condition and the second condition.

[0116] The second result unit is configured to determine that there is an uncredible behavior in each behavior corresponding to the first behavior information group if the determination result is that there is information in the first behavior information group that does not meet the first condition and the second condition at the same time.

[0117] In combination with the embodiment shown in Figure 3 In some optional embodiments, the active monitoring module 100 further includes an object information obtaining unit, an object information calculating unit, a result comparing unit, a security determination unit, and a risk determination unit.

[0118] The object information obtaining unit is configured to obtain object information of a trusted computing object, and the trusted computing object includes at least one of the following running environment objects: operating system code and driver code.

[0119] The object information calculating unit is configured to calculate the object information by using a hash algorithm, so as to obtain a trusted computing result of the trusted computing object.

[0120] The result comparing unit is configured to compare the trusted computing result with a preset trusted benchmark value of the trusted computing object, so as to determine a current state of the trusted computing object. If the trusted computing result matches the preset trusted benchmark value of the trusted computing object, the security determination unit is triggered, otherwise, the risk determination unit is triggered.

[0121] the security determination unit is configured to determine that the current state of the trusted computing object is a safe state;

[0122] the risk determination unit is configured to determine that the current state of the trusted computing object is a risky state;

[0123] the behavior result determination unit 130 comprises a first judgment subunit, a first trusted subunit and a first untrusted subunit;

[0124] the first judgment subunit is configured to determine whether each behavior corresponding to the first behavior information group is trusted according to the judgment result and the current state of the trusted computing object;

[0125] the trusted subunit is configured to determine that each behavior corresponding to the first behavior information group is trusted if the current state of the trusted computing object is the safe state and the judgment result is that each information in the first behavior information group satisfies condition one and condition two;

[0126] the untrusted subunit is configured to determine that there is an untrusted behavior in each behavior corresponding to the first behavior information group if the current state of the trusted computing object is the risky state or the judgment result is that there is information in the first behavior information group that does not simultaneously satisfy condition one and condition two.

[0127] In combination with the previous embodiment, in some optional embodiments, the active monitoring module 100 further comprises a last state obtaining unit;

[0128] the last state obtaining unit is configured to obtain the current state of the trusted computing object determined last time as the last state of the trusted computing object;

[0129] the behavior result determination unit 130 comprises a second judgment subunit, a second trusted subunit and a second untrusted subunit;

[0130] the second judgment subunit is configured to determine whether each behavior corresponding to the first behavior information group is trusted according to the judgment result, the current state of the trusted computing object and the last state of the trusted computing object;

[0131] the second trusted subunit is configured to determine that each behavior corresponding to the first behavior information group is trusted if the current state of the trusted computing object is the safe state, the last state of the trusted computing object is the safe state and the judgment result is that each information in the first behavior information group satisfies condition one and condition two;

[0132] The second untrusted subunit is configured to determine that there is untrusted behavior in each behavior corresponding to the first behavior information group if the current state of the trusted computing object is the risky state, or the last state of the trusted computing object is the risky state, or the determination result is that there is information in the first behavior information group that does not simultaneously satisfy condition one and condition two.

[0133] In combination Figure 3 In some optional embodiments of the embodiments shown, the monitoring system further comprises a security management module and a collaboration module.

[0134] The collaboration module comprises a monitoring method obtaining unit, a monitoring method sending unit, an audit data generating unit, and an audit data sending unit.

[0135] The security management module comprises a monitoring method issuing unit and an audit data collecting unit.

[0136] The monitoring method obtaining unit is configured to obtain the monitoring method issued by the security management module.

[0137] The monitoring method sending unit is configured to send the monitoring method to the active monitoring module 100.

[0138] The audit data generating unit is configured to generate audit data for untrusted behavior if there is untrusted behavior in each behavior corresponding to the first behavior information group.

[0139] The audit data sending unit is configured to send the audit data to the security management module.

[0140] The monitoring method issuing unit is configured to issue the monitoring method to the collaboration module.

[0141] The audit data collecting unit is configured to collect the audit data.

[0142] In combination Figure 3 In some optional embodiments of the embodiments shown, the monitoring system further comprises an environment extractor, a behavior information module, a trusted benchmark library, and a capture module.

[0143] The environment extractor is configured to periodically obtain information of the trusted computing object from a running environment and send the information of the trusted computing object to the active monitoring module 100.

[0144] The trusted benchmark library is configured to store a trusted benchmark value of the trusted computing object for the active monitoring module 100 to obtain the trusted benchmark value.

[0145] The capture module is configured to monitor the execution process of each behavior corresponding to the first behavior information group. When the behavior transitions from one behavior to the next, the capture module obtains the information of the previous behavior.

[0146] The behavior information module is configured to obtain information about each behavior acquired by the capture module, and to arrange and group the information about each behavior according to preset rules, thereby forming a first behavior information group for the active monitoring module 100 to acquire.

[0147] The present invention provides a storage medium storing a program thereon, characterized in that the program, when executed by a processor, implements the monitoring method described in any of the preceding claims.

[0148] like Figure 4 As shown, the present invention provides an electronic device 70, which includes at least one processor 701, at least one memory 702 and a bus 703 connected to the processor 701; wherein the processor 701 and the memory 702 communicate with each other through the bus 703; the processor 701 is used to call program instructions in the memory 703 to execute the monitoring method described above.

[0149] In this application, relational terms such as "first" and "second" are used merely to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitation, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0150] The various embodiments in this specification are described in a related manner. Similar or identical parts between embodiments can be referred to mutually. Each embodiment focuses on describing the differences from other embodiments. In particular, the system embodiments are basically similar to the method embodiments, so the description is relatively simple; relevant parts can be referred to the descriptions of the method embodiments.

[0151] The foregoing description of the disclosed embodiments enables a person skilled in the art to make or use the application. Numerous modifications to these embodiments would be readily apparent to those skilled in the art, and the generic principles defined herein can be applied to other embodiments without the use of the innovation falling outside the spirit or scope of the application. Therefore, the present application is not intended to be limited to the described embodiments, but rather is intended to encompass any and all modifications within the spirit and scope of the claimed application.

[0152] The above description is merely illustrative of the application, and is not intended to limit the scope of the application that is defined by the appended claims. Any modification, equivalent substitution, improvement, and the like that are made within the spirit and principle of the application are included in the scope of the application.

Claims

1. A method for monitoring business activities, characterized in that, include: Obtain a first behavior information group, wherein the first behavior information group includes information on at least one business behavior; Determine whether each piece of information in the first behavior information group satisfies conditions one and two, and obtain the determination result; Based on the judgment result, determine whether each behavior corresponding to the first behavior information group is trustworthy; Among them, the first condition is: each piece of information in the first behavior information group is not only information of the preset business behavior, but also covers information of all preset business behaviors, and each piece of information in the first behavior information group is unique; the second condition is: the execution order of each behavior corresponding to the first behavior information group conforms to the preset execution order, and the occurrence time of each behavior corresponding to the first behavior information group conforms to the preset time condition.

2. The monitoring method according to claim 1, characterized in that, The step of determining whether each behavior corresponding to the first behavior information group is trustworthy based on the judgment result includes: If the judgment result is that each piece of information in the first behavior information group satisfies both condition one and condition two, then it is determined that each behavior corresponding to the first behavior information group is reliable. If the judgment result is that there is information in the first behavior information group that does not simultaneously meet both condition one and condition two, then it is determined that there is an untrustworthy behavior in each behavior corresponding to the first behavior information group.

3. The monitoring method according to claim 1, characterized in that, The method further includes: Obtain object information of a trusted computing object, wherein the trusted computing object includes at least one of the following runtime environment objects: operating system code and driver code; The object information is calculated using a hash algorithm to obtain the trusted computing result of the trusted computing object; The trusted computing result is compared with the preset trusted benchmark value of the trusted computing object to determine the current state of the trusted computing object. If the trusted computing result matches the preset trusted benchmark value of the trusted computing object, the current state of the trusted computing object is determined to be a safe state; otherwise, the current state of the trusted computing object is determined to be a risky state. The step of determining whether each behavior corresponding to the first behavior information group is trustworthy based on the judgment result includes: Based on the judgment result and the current state of the trusted computing object, determine whether each behavior corresponding to the first behavior information group is trustworthy; If the current state of the trusted computing object is the secure state, and the judgment result is: each piece of information in the first behavior information group satisfies condition one and condition two, then it is determined that each behavior corresponding to the first behavior information group is trustworthy; If the current state of the trusted computing object is the risky state, or if the judgment result is that there is information in the first behavior information group that does not simultaneously meet condition one and condition two, then it is determined that there is an untrustworthy behavior in each behavior corresponding to the first behavior information group.

4. The monitoring method according to claim 3, characterized in that, The method further includes: obtaining the current state of the previously determined trusted computing object and using it as the previous state of the trusted computing object; The step of determining whether each behavior corresponding to the first behavior information group is trustworthy based on the judgment result includes: Based on the judgment result, the current state of the trusted computing object, and the previous state of the trusted computing object, determine whether each behavior corresponding to the first behavior information group is trustworthy; If the current state of the trusted computing object is the secure state, and the previous state of the trusted computing object was the secure state, and the judgment result is: each piece of information in the first behavior information group satisfies condition one and condition two, then it is determined that each behavior corresponding to the first behavior information group is trustworthy; If the current state of the trusted computing object is the risky state, or the previous state of the trusted computing object was the risky state, or the judgment result is: there is information in the first behavior information group that does not simultaneously satisfy condition one and condition two, then it is determined that there is an untrustworthy behavior in each behavior corresponding to the first behavior information group.

5. The monitoring method according to claim 1, characterized in that, The preset business behavior group includes at least: data acquisition behavior, logic control operation behavior, redundant synchronization data behavior, and operation result output behavior.

6. The monitoring method according to claim 1, characterized in that, The method further includes: The system monitors the system for a preset monitoring period. When the monitoring period arrives, the monitoring method described in claim 1 is executed.

7. The monitoring method according to claim 1, characterized in that, The method further includes: If there is an untrusted behavior among the behaviors corresponding to the first behavior information group, then audit data for the untrusted behavior is generated.

8. A business behavior monitoring system, characterized in that, The monitoring system includes: an active monitoring module; The active monitoring module includes: a behavior information acquisition unit, a behavior information judgment unit, and a behavior result determination unit; The behavior information acquisition unit is configured to acquire a first behavior information group, wherein the first behavior information group includes at least one business behavior information; The behavior information judgment unit is configured to judge whether each piece of information in the first behavior information group satisfies condition one and condition two, and obtain the judgment result; The behavior result determination unit is configured to determine, based on the judgment result, whether each behavior corresponding to the first behavior information group is trustworthy; Among them, the first condition is: each piece of information in the first behavior information group is not only information of the preset business behavior, but also covers information of all preset business behaviors, and each piece of information in the first behavior information group is unique; the second condition is: the execution order of each behavior corresponding to the first behavior information group conforms to the preset execution order, and the occurrence time of each behavior corresponding to the first behavior information group conforms to the preset time condition.

9. A storage medium having a program stored thereon, characterized in that, When the program is executed by the processor, it implements the monitoring method as described in any one of claims 1 to 7.

10. An electronic device, characterized in that, The electronic device includes at least one processor, and at least one memory and bus connected to the processor; wherein the processor and the memory communicate with each other through the bus; the processor is used to call program instructions in the memory to execute the monitoring method as described in any one of claims 1 to 7.

Images