Patch update method, device and system based on bypass monitoring

Abstract

The present invention provides a patch update method, device and system based on bypass monitoring, which adopts bypass monitoring mode to monitor network traffic data packets received by multiple terminal devices from the external network through network links, and when it is determined that the network traffic data packet contains a target data packet for patch update of the Windows system in the corresponding terminal device, the patch file and patch information are parsed from the target data packet; after the patch file is checked and passed, the patch update content is updated to the preset patch library; in response to receiving a patch file download request sent by an intranet server; according to the patch library and the download request, the target patch file requested for download is sent to the intranet server, so that the intranet server uses the target patch file to provide the Windows system update patch file for the terminal deployed in the intranet. This solution can timely and easily obtain the patch file to be updated, so as to provide the required patch file for the terminal deployed in the intranet.

Description

Technical Field

[0001] The embodiments of the present invention relate to the field of computer technology, and in particular to a patch updating method, device and system based on bypass monitoring. Background Art

[0002] The Windows system of the computer needs to be patched and updated in time to avoid vulnerabilities in the system installed on the terminal. At present, there are some enterprises in the intranet environment. Due to security reasons, the terminals in the enterprise cannot access the external Internet, which leads to interruptions when these terminals are updating the system, causing these terminals to have vulnerabilities and other security risks.

[0003] The traditional method of patching intranet terminals is to obtain updated patch files from the external network through web crawlers, and then upload the crawled patch files to the intranet server deployed by the enterprise, and the intranet server provides patch files for patch updates to the intranet terminals. However, this method is not only difficult to crawl, but also has poor timeliness in obtaining patch files. Summary of the invention

[0004] The embodiments of the present invention provide a patch updating method, device and system based on bypass monitoring, which can timely and easily obtain the patch files to be updated, so as to provide the required patch files for the terminals deployed in the intranet.

[0005] In a first aspect, an embodiment of the present invention provides a patch update method based on bypass monitoring, which is applied to a server, and the method includes:

[0006] Using bypass monitoring mode to monitor network traffic data packets received by multiple terminal devices from the external network through network links, and determine whether the monitored network traffic data packets contain target data packets for patch updates of Windows systems in corresponding terminal devices; if so, parse the patch files and patch information from the target data packets;

[0007] Performing a security check on the patch file, and when the check passes, updating the patch update content to a preset patch library; the patch update content at least includes the patch file, the patch information, and the Windows system version of the corresponding terminal device;

[0008] In response to receiving a patch file download request sent by an intranet server, the target patch file requested for download is sent to the intranet server according to the patch library and the download request, so that the intranet server uses the target patch file to provide Windows system update patch files for terminals deployed in the intranet.

[0009] In a possible implementation, the server is connected to the network link of each terminal device in parallel by accessing the mirror port of the external switch; wherein each terminal device establishes a network link through the switch;

[0010] The method of monitoring network traffic data packets received by multiple terminal devices from an external network through a network link in a bypass monitoring manner includes: receiving the network traffic data packets forwarded by the switch through the mirror port.

[0011] In a possible implementation, determining whether the monitored network traffic data packet contains a target data packet for patch update of the Windows system in the corresponding terminal device includes:

[0012] Determine whether the network traffic data packet contains a target data packet for patch update of the Windows system in the terminal device according to at least one of whether the network traffic data packet contains an IP address of a Microsoft server, whether the network traffic data packet contains an HTTP domain name of a Microsoft server, and whether patch information is contained in the content of the network traffic data packet; and / or, after determining the first target data packet according to at least one of whether the network traffic data packet contains an IP address of a Microsoft server, whether the network traffic data packet contains an HTTP domain name of a Microsoft server, and whether patch information is contained in the content of the network traffic data packet, determine subsequent target data packets according to a data stream length specified by a protocol to which the network traffic data packet belongs;

[0013] and / or,

[0014] The patch file parsing method includes: sorting a plurality of continuously monitored target data packets according to TCP numbers to recover a TCP link; restoring a file in a TCP data stream corresponding to the TCP link to obtain a patch file for patch update of the Windows system in the terminal device;

[0015] and / or,

[0016] Before updating the patch update content to the preset patch library, the method further includes: determining whether the patch library stores the patch file; if not, updating the patch update content to the preset patch library.

[0017] In a possible implementation, the plurality of terminal devices cover a plurality of different Windows system versions; and the patch library includes patch files and patch information corresponding to different Windows system versions.

[0018] In a possible implementation, the method further includes: establishing a patch whitelist list, and updating the patch whitelist list whenever the patch library is updated; the patch whitelist list includes corresponding relationships between different Windows system versions and patch information;

[0019] Before the responding to the patch file download request received from the intranet server, it also includes: responding to the query request received from the intranet server, and sending the patch whitelist list to the intranet server, so that the intranet server determines whether there is a patch file that needs to be updated based on the patch whitelist list and the patch installation status of the terminal deployed in the intranet, so as to request to download the patch file that needs to be updated; the patch installation status includes: the Windows system version corresponding to the terminal deployed in the intranet and the patch information of the currently installed patch file.

[0020] In a second aspect, an embodiment of the present invention further provides a patch updating device based on bypass monitoring, which is located on a server, and the patch updating device based on bypass monitoring includes:

[0021] A processing module is used to monitor network traffic data packets received by multiple terminal devices from an external network through a network link in a bypass monitoring manner, and determine whether the monitored network traffic data packets contain a target data packet for patch update of a Windows system in the corresponding terminal device; if so, parse the patch file and patch information from the target data packet;

[0022] An update module, configured to perform a security check on the patch file, and when the check passes, update the patch update content to a preset patch library; the patch update content at least includes the patch file, the patch information, and the Windows system version of the corresponding terminal device;

[0023] The communication module is used to respond to a patch file download request sent by an intranet server, and send the target patch file requested for download to the intranet server according to the patch library and the download request, so that the intranet server uses the target patch file to provide the Windows system update patch file for the terminal deployed in the intranet.

[0024] In a third aspect, an embodiment of the present invention further provides a patch update system based on bypass monitoring, comprising: a patch management server and at least one bypass monitoring server; wherein,

[0025] The at least one bypass monitoring server is used to monitor network traffic data packets received by multiple terminal devices from the external network through the network link in a bypass monitoring manner, and determine whether the monitored network traffic data packets contain target data packets for patch updates of the Windows system in the corresponding terminal device; if so, parse the patch file and patch information from the target data packet; and report the patch update content to the patch management server; the patch update content at least includes the patch file, the patch information and the Windows system version of the corresponding terminal device;

[0026] The patch management server is used to perform a security check on the patch file, and when the check passes, update the patch update content to a preset patch library; and in response to receiving a patch file download request sent by an intranet server, send the target patch file requested for download to the intranet server according to the patch library and the download request, so that the intranet server uses the target patch file to provide Windows system update patch files for terminals deployed in the intranet.

[0027] In a possible implementation, the bypass monitoring server is connected to the network link of each corresponding terminal device in parallel by accessing the mirror port of the external switch; wherein each terminal device establishes a network link through the corresponding switch;

[0028] When the bypass monitoring server monitors the network traffic data packets received by multiple terminal devices from the external network through the network link in a bypass monitoring manner, it is specifically used to receive the network traffic data packets forwarded by the switch through the mirror port.

[0029] In a fourth aspect, an embodiment of the present invention further provides an electronic device, including a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, the method described in any embodiment of this specification is implemented.

[0030] In a fifth aspect, an embodiment of the present invention further provides a computer-readable storage medium on which a computer program is stored. When the computer program is executed in a computer, the computer is caused to execute the method described in any embodiment of this specification.

[0031] The embodiment of the present invention provides a patch update method, device and system based on bypass monitoring. By adopting the bypass monitoring mode to monitor the network traffic data packets received by multiple terminal devices from the external network through the network link, it is possible to monitor whether the terminal device performs the patch update of the Windows system. When it is determined that the terminal device performs the patch update of the Windows system, the patch file and patch information can be obtained to update to the preset patch library. The patch library manages the patch file, thereby providing the required patch file to the intranet server, and then the intranet server provides the Windows system patch update for the terminal deployed in the intranet. It can be seen that in this scheme, it is relatively easy to monitor whether the terminal device performs the patch update of the Windows system by monitoring the network traffic data packet; and when it is determined that the terminal device performs the patch update of the Windows system, the patch file can be quickly updated to the patch library, so that the patch file in the patch library is the latest, thereby ensuring the timeliness of the acquisition of the patch file required by the intranet terminal. BRIEF DESCRIPTION OF THE DRAWINGS

[0032] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0033] Figure 1 This is a patch update system architecture diagram provided by an embodiment of the present invention;

[0034] Figure 2 This is a flow chart of a patch updating method based on bypass monitoring provided by an embodiment of the present invention;

[0035] Figure 3 is a hardware architecture diagram of an electronic device provided by an embodiment of the present invention;

[0036] Figure 4 It is a structural diagram of a patch updating device based on bypass monitoring provided by an embodiment of the present invention;

[0037] Figure 5 It is a structural diagram of another patch updating device based on bypass monitoring provided by an embodiment of the present invention;

[0038] Figure 6 The present invention provides a patch update system structure diagram based on bypass monitoring according to an embodiment of the present invention. DETAILED DESCRIPTION

[0039] In order to make the purpose, technical solutions and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, rather than all the embodiments. Based on the embodiments in the present invention, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present invention.

[0040] As mentioned above, if you need to obtain the latest patch files from the external network through web crawlers, you need to crawl the network continuously. However, web crawlers are not only costly but also difficult to crawl. For example, if there is network supervision, web crawlers will be prohibited. Therefore, it is impossible to guarantee that the latest patch files can be crawled in time. If the timeliness is poor, the required patch files cannot be provided to the terminals deployed in the intranet, affecting the security of the intranet terminals.

[0041] Based on the above problems, the inventive concept of the present invention is to obtain patch files from terminal devices that are in a networked state. When the terminal device is performing a patch update for the Windows system, it needs to transmit network traffic data packets through a network link to download the patch files. It can be considered to use a bypass monitoring method to obtain the network traffic data packets received by the terminal device from the external network to monitor the terminal device. When it is determined that the terminal device is performing a patch update for the Windows system, the patch file of the patch update is obtained, and the patch library is quickly updated, so that the required patch files can be provided for the terminals managed by the intranet server, thereby ensuring the security of the intranet terminals.

[0042] Based on the above concept, the system architecture of the embodiment of the present invention is described.

[0043] Please refer to Figure 1 An embodiment of the present invention provides a patch update system, including: a patch management server 10 and at least one bypass listening server 20. The patch management server 10 can be connected to each bypass listening server 20 when needed. The patch management server 10 can be connected to an intranet server 30 when needed, and the intranet server 30 is connected to multiple terminals 40 through an intranet, and the multiple terminals 40 are all deployed in an intranet environment. The bypass listening server 20 is connected in parallel to the network link of multiple terminal devices 50, and is used to monitor the transmission of network traffic data packets between each terminal device 50 and the Microsoft server 60.

[0044] In the embodiment of the present invention, the patch management server and the bypass monitoring server may be implemented by the same physical server or by different physical servers.

[0045] The specific implementation of the above concept is described below.

[0046] Please refer to Figure 2 The embodiment of the present invention provides a patch update method based on bypass monitoring, which is applied to a server. The method includes:

[0047] Step 200, using bypass monitoring mode to monitor network traffic data packets received by multiple terminal devices from the external network through network links, and determine whether the monitored network traffic data packets contain target data packets for patch updates of the Windows system in the corresponding terminal device; if so, parse the patch file and patch information from the target data packets.

[0048] In the embodiment of the present invention, in order to monitor the network traffic data packets received by multiple terminal devices from the external network through the network link, the server can be connected in parallel to the network links of the multiple terminal devices. Specifically, when the server is connected in parallel to the network links of the multiple terminal devices, it can be achieved in at least the following two ways:

[0049] The first method is switch mirroring.

[0050] The second method is shared HUB.

[0051] When the first method is used, specifically, the server is connected to the network link of each terminal device in parallel by accessing the mirror port of the external switch; wherein each terminal device establishes a network link through the switch.

[0052] Then, in this step, monitoring the network traffic data packets received by multiple terminal devices from the external network through the network link includes: receiving the network traffic data packets forwarded by the switch through the mirror port. When the terminal device establishes a network connection with the outside, the network traffic data packets are forwarded through the switch. In addition to processing the network traffic data packets interacting between the terminal device and the outside in normal business, the switch can also forward the network traffic data packets to the server through the mirror port.

[0053] The first method is more convenient and flexible in deployment. You only need to configure the mirror port on the switch, and there is no need to change the existing network structure of multiple terminal devices. In addition, when the server connected to the mirror port stops working, it will not affect the normal operation of the network.

[0054] In the second method, the HUB is a multi-port repeater. When the HUB is the central device, a failure in a line in the network does not affect the operation of other lines. By connecting multiple terminal devices and servers to the same HUB, the server can be connected in parallel to the network links of multiple terminal devices. The network traffic data packets received by the terminal device from the external network can be shared with the server through the HUB.

[0055] Similarly, after the second method is deployed, the server can monitor the network traffic data packets received by each terminal device from the external network through the network link, and when the server stops working, it will not affect the normal operation of the network.

[0056] In one embodiment of the present invention, it is possible to determine whether the corresponding terminal device is performing a patch update for the Windows system by determining whether there is a target data packet for patch update for the Windows system in the corresponding terminal device in the network traffic data packet. If so, it is determined that the corresponding terminal device is performing a patch update for the Windows system.

[0057] In one embodiment of the present invention, the method of determining whether there is a target data packet for patch update of the Windows system in the terminal device in the network traffic data packet may be at least one of the following methods:

[0058] Method 1: Determine whether the network traffic data packet contains a target data packet for patch update of the Windows system in the terminal device, based on whether the network traffic data packet contains the IP address of the Microsoft server.

[0059] Method 2: Determine whether the network traffic data packet contains a target data packet for patch update of the Windows system in the terminal device, based on whether the network traffic data packet contains the HTTP domain name of the Microsoft server.

[0060] Method 3: Determine whether the network traffic data packet contains a target data packet for patch update of the Windows system in the terminal device, based on whether there is patch information in the content of the network traffic data packet.

[0061] Method 4: After determining the first target data packet using at least one of the above three methods, determine the subsequent target data packets according to the data stream length specified by the protocol to which the network traffic data packet belongs.

[0062] Since the terminal device needs to establish a connection with the Microsoft server to obtain the patch file from the Microsoft server when performing a patch update for the Windows system, therefore, in Method 1 and Method 2, the IP address of the Microsoft server and / or the HTTP domain name of the Microsoft server can be pre-set, and when it is determined that the IP address and / or the HTTP domain name in the network traffic data packet is the IP address and / or the HTTP domain name of the Microsoft server, it is determined that the network traffic data packet contains a target data packet for the patch update of the Windows system in the corresponding terminal device.

[0063] In method 3, the content of the network traffic data packet can be parsed to determine whether there is patch information in the parsed content. If there is patch information, it is determined that there is a target data packet for patch update of the Windows system in the corresponding terminal device in the network traffic data packet.

[0064] It should be noted that in the above-mentioned method 1 or method 2, when it is determined that the IP address in the network traffic data packet is the IP address of the Microsoft server or the HTTP domain name is the HTTP domain name of the Microsoft server, method 3 can be further used to determine whether there is patch information in the content of the network traffic data packet, so as to determine whether there is a target data packet for patch update of the Windows system in the terminal device in the network traffic data packet, thereby further improving the determination accuracy.

[0065] In method 4, since the data transmission protocol has regulations on the length of the transmitted data stream, after the first target data packet is determined using any of the above three methods, if the length of the first target data packet does not reach the data stream length specified by the protocol to which the network traffic data packet belongs, then subsequent network traffic data packets also have target data packets. Therefore, the determination of subsequent target data can be determined based on the data stream length specified by the protocol to which the network traffic data packet belongs, thereby increasing the speed of determining the target data packet.

[0066] Regardless of which of the above methods is used to determine whether there is a target data packet in the network traffic data packet, if it is determined that the network traffic data packet does not contain a target data packet for patch updates for the Windows system in the terminal device, the network traffic data packet will not be processed; if the network traffic data packet contains a target data packet for patch updates for the Windows system in the terminal device, the patch file and patch information will be parsed from the target data packet.

[0067] Furthermore, the patch file parsing method may include: sorting multiple target data packets monitored continuously according to TCP numbers to restore the TCP link; restoring the file in the TCP data stream corresponding to the TCP link to obtain a patch file for patch updating of the Windows system in the terminal device.

[0068] Since the patch file needs to be sent by multiple target data packets, and there may be a problem of discontinuous TCP numbers in the target data packets when sending, in order to be able to restore the TCP link, it is necessary to sort the multiple target data packets that are continuously intercepted according to the TCP numbers. After restoring the TCP link, the corresponding TCP data stream can be obtained, and the patch file can be obtained through file restoration.

[0069] It should be noted that the patch information can also be parsed from the header of the target data packet. In the embodiment of the present invention, the patch information may include: the operating system to which the patch belongs, a patch list, hardware information and drivers, a patch acquisition method, and official information of the patch file.

[0070] Step 202, perform a security check on the patch file, and when the check passes, update the patch update content to the preset patch library; the patch update content at least includes the patch file, the patch information and the Windows system version of the corresponding terminal device.

[0071] In one embodiment of the present invention, when performing security checks on patch files, it is possible to connect to an external threat intelligence center and various antivirus engines, and use the threat intelligence center and various antivirus engines to check the legitimacy and security of the patch files to ensure the security of the patch files.

[0072] Since the server monitors the network traffic data packets of multiple terminal devices, when it monitors any terminal device for patch update of Windows system, the patch file of the corresponding patch update can be obtained. And only one copy of the same patch file of the same Windows system version needs to be maintained in the patch library, and there is no need to store it repeatedly. Therefore, in one embodiment of the present invention, before updating the patch update content to the preset patch library, it can also include: determining whether the patch file is stored in the patch library, and if not, updating the patch update content to the preset patch library.

[0073] In one embodiment of the present invention, it can be determined whether the patch file is stored in the patch library by comparing the hash value of the patch file and / or the patch information.

[0074] When using the hash value method to determine whether the patch file is stored in the patch library, specifically, the server calculates the hash value for each patch file stored in the patch library in advance to form a hash value list; after obtaining a new patch file, the hash value of the new patch file is calculated. If the hash value of the new patch file exists in the hash value list, it indicates that the patch file is stored in the patch library, otherwise it indicates that the patch file is not stored in the patch library.

[0075] When using patch information to determine whether the patch file is stored in the patch library, specifically, the server can compare the parsed patch information with the patch information stored in the patch library. If the patch information exists in the patch library, it indicates that the patch file has been stored in the patch library, otherwise it indicates that the patch file is not stored in the patch library.

[0076] In one embodiment of the present invention, there are many Windows system versions of terminal devices, the types of patch files are complex, and the Windows system version corresponds to the patch file. Therefore, it is necessary to obtain the Windows system version of the corresponding terminal device and store it in the patch library together with the patch file and patch information.

[0077] Among them, the Windows system version can be Windows XP, Windows Vista, Windows 7, Windows 8 / Windows 8.1, Windows 10, Windows 11, etc.

[0078] Furthermore, the patch library needs to provide the required patch files for the terminals managed by the intranet server, and each client managed by the intranet server may correspond to multiple Windows system versions. Therefore, in order to enrich the Windows system versions corresponding to the patch files in the patch library, the multiple terminal devices monitored by the server cover multiple different Windows system versions; the patch library includes patch files and patch information corresponding to different Windows system versions.

[0079] Step 204, in response to receiving the patch file download request sent by the intranet server, the target patch file requested for download is sent to the intranet server according to the patch library and the download request, so that the intranet server uses the target patch file to provide the Windows system update patch file for the terminal deployed in the intranet.

[0080] The intranet server is deployed within the enterprise and is used to provide Windows system patch updates to terminals deployed on the intranet. The server provides services for the intranet server to download the required patch files.

[0081] In order to improve user experience and ensure the timeliness of patch updates for intranet terminals, in one embodiment of the present invention, it may also include: establishing a patch whitelist list, and updating the patch whitelist list whenever patch update content reported by a terminal device is received; the patch whitelist list includes the correspondence between different Windows system versions and patch information. Among them, the patch whitelist list may include only the latest patch information for the same Windows system version, or may include the latest patch information and historical patch information for selection by the intranet server.

[0082] Before the responding to the patch file download request received from the intranet server, it also includes: responding to the query request received from the intranet server, and sending the patch whitelist list to the intranet server, so that the intranet server determines whether there is a patch file that needs to be updated based on the patch whitelist list and the patch installation status of the terminal deployed in the intranet, so as to request to download the patch file that needs to be updated; the patch installation status includes: the Windows system version corresponding to the terminal deployed in the intranet and the patch information of the currently installed patch file.

[0083] Specifically, the intranet server can know the patch installation status of the intranet terminal in advance, and determine whether there is a patch file that needs to be updated according to the received patch whitelist. The patch file that needs to be updated can be a patch file corresponding to the latest patch information or a patch file corresponding to historical patch information.

[0084] When the intranet server determines that there is a patch file that needs to be updated, it sends a patch file download request to the server, and the patch file download request carries the Windows system version and patch information.

[0085] In the embodiment of the present invention, the intranet server may periodically send a query request to the server to determine whether there is a patch file that needs to be updated.

[0086] Furthermore, the server can also classify patch files according to the degree of urgency. When the degree of urgency meets the set conditions, the corresponding patch files can be directly sent to the intranet server so that the intranet server can provide Windows system patch updates to the intranet terminals in a timely manner to ensure the security of the intranet terminals.

[0087] In addition, after obtaining the patch file that needs to be updated, the intranet server can control the intranet terminal to perform patch update within an appropriate time period.

[0088] In the embodiment of the present invention, the patch files of the terminal devices are obtained by monitoring the patch updates of the Windows systems of the terminal devices, so as to update the patch library, so that the patch library can provide the required patch files to the intranet server in a timely manner, and then the intranet server can provide the Windows system patch updates to the terminals deployed in the intranet, thereby ensuring the security of the terminals in the intranet.

[0089] like Figure 3 , Figure 4 As shown, an embodiment of the present invention provides a patch update device based on bypass monitoring. The device embodiment can be implemented by software, or by hardware or a combination of software and hardware. From the hardware level, Figure 3As shown, a hardware architecture diagram of an electronic device where a patch updating device based on bypass monitoring is provided in an embodiment of the present invention is located, except Figure 3 In addition to the processor, memory, network interface, and non-volatile memory shown, the electronic device in the embodiment may also include other hardware, such as a forwarding chip responsible for processing messages, etc. Taking software implementation as an example, Figure 4 As shown, as a device in a logical sense, the CPU of the electronic device in which it is located reads the corresponding computer program in the non-volatile memory into the memory and runs it. This embodiment provides a patch update device based on bypass monitoring, which is located on the server and includes:

[0090] The processing module 401 is used to monitor the network traffic data packets received by multiple terminal devices from the external network through the network link in a bypass monitoring manner, and determine whether the monitored network traffic data packets contain a patch update for the Windows system in the corresponding terminal device; if so, parse the patch file and patch information from the target data packet;

[0091] An update module 402 is used to perform a security check on the patch file, and when the check passes, update the patch update content to a preset patch library; the patch update content at least includes the patch file, the patch information and the Windows system version of the corresponding terminal device;

[0092] The communication module 403 is used to respond to a patch file download request received from an intranet server, and send the target patch file requested for download to the intranet server according to the patch library and the download request, so that the intranet server uses the target patch file to provide Windows system update patch files for terminals deployed in the intranet.

[0093] In one embodiment of the present invention, the server is connected to the network link of each terminal device in parallel by accessing the mirror port of the external switch; wherein each terminal device establishes a network link through the switch;

[0094] The processing module 401 is specifically used to receive the network traffic data packets forwarded by the switch through the mirror port when monitoring the network traffic data packets received by multiple terminal devices from the external network through the network link in a bypass monitoring manner.

[0095] In one embodiment of the present invention, when determining whether the monitored network traffic data packet contains a target data packet for patch update of the Windows system in the corresponding terminal device, the processing module 401 is specifically used to: determine whether the network traffic data packet contains a target data packet for patch update of the Windows system in the terminal device based on at least one of whether the network traffic data packet contains the IP address of a Microsoft server, whether the network traffic data packet contains the HTTP domain name of a Microsoft server, and whether patch information is contained in the content of the network traffic data packet; and / or, after determining the first target data packet based on at least one of whether the network traffic data packet contains the IP address of a Microsoft server, whether the network traffic data packet contains the HTTP domain name of a Microsoft server, and whether patch information is contained in the content of the network traffic data packet, determine subsequent target data packets based on the data stream length specified by the protocol to which the network traffic data packet belongs.

[0096] In one embodiment of the present invention, when parsing a patch file, the processing module 401 is specifically used to sort multiple target data packets that are continuously monitored according to TCP numbers to restore the TCP link; restore the files in the TCP data stream corresponding to the TCP link to obtain a patch file for patch updates of the Windows system in the terminal device.

[0097] In one embodiment of the present invention, the update module 402 is further configured to determine whether the patch library stores the patch file, and if not, update the patch update content to the preset patch library.

[0098] In one embodiment of the present invention, the plurality of terminal devices cover a plurality of different Windows system versions; the patch library includes patch files and patch information corresponding to different Windows system versions.

[0099] In one embodiment of the present invention, please refer to Figure 5 The patch update device based on bypass monitoring also includes: a list establishment module 404, which is used to establish a patch whitelist list, and update the patch whitelist list every time the patch library is updated; the patch whitelist list includes the corresponding relationship between different Windows system versions and patch information;

[0100] The communication module 403 is also used to send the patch whitelist to the intranet server in response to receiving a query request from the intranet server, so that the intranet server can determine whether there is a patch file that needs to be updated based on the patch whitelist and the patch installation status of the terminal deployed in the intranet, and request to download the patch file that needs to be updated; the patch installation status includes: the Windows system version corresponding to the terminal deployed in the intranet and the patch information of the currently installed patch file.

[0101] It is to be understood that the structure illustrated in the embodiment of the present invention does not constitute a specific limitation on a patch updating device based on bypass monitoring. In other embodiments of the present invention, a patch updating device based on bypass monitoring may include more or fewer components than those shown in the figure, or combine some components, or split some components, or arrange the components differently. The components shown in the figure may be implemented in hardware, software, or a combination of software and hardware.

[0102] The information interaction, execution process and other contents between the modules in the above-mentioned device are based on the same concept as the embodiment of the method of the present invention. For the specific contents, please refer to the description in the embodiment of the method of the present invention, and no further description is given here.

[0103] Please refer to Figure 6 The embodiment of the present invention further provides a patch update system based on bypass monitoring, comprising: a patch management server 601 and at least one bypass monitoring server 602; wherein,

[0104] The at least one bypass monitoring server 602 is used to monitor the network traffic data packets received by multiple terminal devices from the external network through the network link in a bypass monitoring manner, and determine whether the monitored network traffic data packets contain target data packets for patch updates of the Windows system in the corresponding terminal device; if so, parse the patch file and patch information from the target data packet; and report the patch update content to the patch management server; the patch update content at least includes the patch file, the patch information and the Windows system version of the corresponding terminal device;

[0105] The patch management server 601 is used to perform a security check on the patch file, and when the check passes, update the patch update content to a preset patch library; and in response to receiving a patch file download request sent by an intranet server, send the target patch file requested for download to the intranet server according to the patch library and the download request, so that the intranet server uses the target patch file to provide Windows system update patch files for terminals deployed in the intranet.

[0106] In one embodiment of the present invention, the bypass monitoring server is connected to the network link of each corresponding terminal device in parallel by accessing the mirror port of the external switch; wherein each terminal device establishes a network link through the corresponding switch;

[0107] When the bypass monitoring server monitors the network traffic data packets received by multiple terminal devices from the external network through the network link in a bypass monitoring manner, it is specifically used to receive the network traffic data packets forwarded by the switch through the mirror port.

[0108] In one embodiment of the present invention, when determining whether the monitored network traffic data packet contains a target data packet for patch update of the Windows system in the corresponding terminal device, the bypass monitoring server is specifically used to determine whether the network traffic data packet contains a target data packet for patch update of the Windows system in the terminal device based on at least one of whether the network traffic data packet contains the IP address of a Microsoft server, whether the network traffic data packet contains the HTTP domain name of a Microsoft server, and whether patch information is contained in the content of the network traffic data packet; and / or, after determining the first target data packet based on at least one of whether the network traffic data packet contains the IP address of a Microsoft server, whether the network traffic data packet contains the HTTP domain name of a Microsoft server, and whether patch information is contained in the content of the network traffic data packet, the subsequent target data packets are determined based on the data stream length specified by the protocol to which the network traffic data packet belongs.

[0109] In one embodiment of the present invention, the bypass monitoring server is specifically used when parsing a patch file to: sort multiple target data packets that are continuously monitored according to TCP numbers to restore the TCP link; restore the files in the TCP data stream corresponding to the TCP link to obtain a patch file for patch updates of the Windows system in the terminal device.

[0110] In one embodiment of the present invention, the bypass monitoring server is further used to determine whether it is necessary to report the patch file to the patch management server, and if so, to report the patch update content to the patch management server.

[0111] In one embodiment of the present invention, when determining whether the patch file needs to be reported to the patch management server, the bypass monitoring server is specifically used to calculate the hash value of the patch file and send the hash value and / or patch information to the patch management server; when receiving the reporting instruction sent by the patch management server, it is determined that the patch file needs to be uploaded to the patch management server;

[0112] The patch management server is also used to receive the hash value and / or patch information sent by the bypass monitoring server, and determine whether the patch file is stored in the patch library based on the hash value and / or patch information. If not, a reporting instruction is sent to the terminal device.

[0113] In one embodiment of the present invention, the plurality of terminal devices cover a plurality of different Windows system versions; the patch library includes patch files and patch information corresponding to different Windows system versions.

[0114] In one embodiment of the present invention, the patch management server is also used to establish a patch whitelist list, and the patch whitelist list is updated every time the patch library is updated; the patch whitelist list includes the corresponding relationships between different Windows system versions and patch information; and in response to receiving a query request from an intranet server, the patch whitelist list is sent to the intranet server, so that the intranet server determines whether there is a patch file that needs to be updated based on the patch whitelist list and the patch installation status of the terminal deployed in the intranet, so as to request to download the patch file that needs to be updated; the patch installation status includes: the Windows system version corresponding to the terminal deployed in the intranet and the patch information of the currently installed patch file.

[0115] An embodiment of the present invention further provides an electronic device, including a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, a patch update method based on bypass monitoring in any embodiment of the present invention is implemented.

[0116] An embodiment of the present invention further provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the processor executes a patch update method based on bypass monitoring in any embodiment of the present invention.

[0117] Specifically, a system or device equipped with a storage medium can be provided, on which software program code that implements the functions of any of the above-mentioned embodiments is stored, and a computer (or CPU or MPU) of the system or device can be enabled to read and execute the program code stored in the storage medium.

[0118] In this case, the program code itself read from the storage medium can realize the function of any one of the above-mentioned embodiments, and thus the program code and the storage medium storing the program code constitute a part of the present invention.

[0119] The storage medium embodiments for providing the program code include a floppy disk, a hard disk, a magneto-optical disk, an optical disk (such as CD-ROM, CD-R, CD-RW, DVD-ROM, DVD-RAM, DVD-RW, DVD+RW), a magnetic tape, a non-volatile memory card, and a ROM. Alternatively, the program code can be downloaded from a server computer by a communication network.

[0120] In addition, it should be clear that the functions of any of the above embodiments can be implemented not only by executing the program code read by the computer, but also by enabling an operating system operating on the computer to complete part or all of the actual operations based on instructions from the program code.

[0121] In addition, it can be understood that the program code read from the storage medium is written to a memory provided in an expansion board inserted into the computer or to a memory provided in an expansion module connected to the computer, and then based on the instructions of the program code, a CPU installed on the expansion board or expansion module is enabled to perform part or all of the actual operations, thereby realizing the functions of any of the above-mentioned embodiments.

[0122] It should be noted that, in this article, relational terms such as first and second are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the statement "comprise a ..." do not exclude the presence of other identical factors in the process, method, article or device including the elements.

[0123] A person of ordinary skill in the art can understand that all or part of the steps of implementing the above method embodiments can be completed by hardware related to program instructions, and the aforementioned program can be stored in a computer-readable storage medium. When the program is executed, it executes the steps of the above method embodiments; and the aforementioned storage medium includes: ROM, RAM, magnetic disk or optical disk, etc., various media that can store program codes.

[0124] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A patch update method based on bypass monitoring, characterized in that: Applied to a server, the method comprises: Using bypass monitoring mode to monitor network traffic data packets received by multiple terminal devices from the external network through network links, and determine whether the monitored network traffic data packets contain target data packets for patch updates of Windows systems in corresponding terminal devices; if so, parse the patch files and patch information from the target data packets; Performing a security check on the patch file, and when the check passes, updating the patch update content to a preset patch library; the patch update content at least includes the patch file, the patch information, and the Windows system version of the corresponding terminal device; In response to receiving a patch file download request sent by an intranet server, the target patch file requested for download is sent to the intranet server according to the patch library and the download request, so that the intranet server uses the target patch file to provide Windows system update patch files for terminals deployed in the intranet.

2. The method according to claim 1, characterized in that The server is connected to the network link of each terminal device in parallel by accessing the mirror port of the external switch; wherein each terminal device establishes a network link through the switch; The method of monitoring network traffic data packets received by multiple terminal devices from an external network through a network link in a bypass monitoring manner includes: receiving the network traffic data packets forwarded by the switch through the mirror port.

3. The method according to claim 1, characterized in that The step of determining whether the monitored network traffic data packet contains a target data packet for patch update of the Windows system in the corresponding terminal device comprises: Determine whether the network traffic data packet contains a target data packet for patch update of the Windows system in the terminal device according to at least one of whether the network traffic data packet contains an IP address of a Microsoft server, whether the network traffic data packet contains an HTTP domain name of a Microsoft server, and whether patch information is contained in the content of the network traffic data packet; and / or, after determining the first target data packet according to at least one of whether the network traffic data packet contains an IP address of a Microsoft server, whether the network traffic data packet contains an HTTP domain name of a Microsoft server, and whether patch information is contained in the content of the network traffic data packet, determine subsequent target data packets according to a data stream length specified by a protocol to which the network traffic data packet belongs; and / or, The patch file parsing method includes: sorting a plurality of continuously monitored target data packets according to TCP numbers to recover a TCP link; restoring a file in a TCP data stream corresponding to the TCP link to obtain a patch file for patch update of the Windows system in the terminal device; and / or, Before updating the patch update content to the preset patch library, the method further includes: determining whether the patch library stores the patch file; if not, updating the patch update content to the preset patch library.

4. The method according to claim 1, characterized in that: The multiple terminal devices cover multiple different Windows system versions; the patch library includes patch files and patch information corresponding to different Windows system versions.

5. The method according to claim 4, characterized in that The method also includes: establishing a patch whitelist list, and updating the patch whitelist list whenever the patch library is updated; the patch whitelist list includes the corresponding relationship between different Windows system versions and patch information; Before the responding to the patch file download request received from the intranet server, it also includes: responding to the query request received from the intranet server, and sending the patch whitelist list to the intranet server, so that the intranet server determines whether there is a patch file that needs to be updated based on the patch whitelist list and the patch installation status of the terminal deployed in the intranet, so as to request to download the patch file that needs to be updated; the patch installation status includes: the Windows system version corresponding to the terminal deployed in the intranet and the patch information of the currently installed patch file.

6. A patch updating device based on bypass monitoring, characterized in that: Located on the server, the patch updating device based on bypass monitoring includes: A processing module is used to monitor network traffic data packets received by multiple terminal devices from an external network through a network link in a bypass monitoring manner, and determine whether the monitored network traffic data packets contain a target data packet for patch update of a Windows system in the corresponding terminal device; if so, parse the patch file and patch information from the target data packet; An update module, configured to perform a security check on the patch file, and when the check passes, update the patch update content to a preset patch library; the patch update content at least includes the patch file, the patch information, and the Windows system version of the corresponding terminal device; The communication module is used to respond to a patch file download request sent by an intranet server, and send the target patch file requested for download to the intranet server according to the patch library and the download request, so that the intranet server uses the target patch file to provide the Windows system update patch file for the terminal deployed in the intranet.

7. A patch update system based on bypass monitoring, characterized in that: include: A patch management server and at least one bypass listening server; wherein, The at least one bypass monitoring server is used to monitor network traffic data packets received by multiple terminal devices from the external network through the network link in a bypass monitoring manner, and determine whether the monitored network traffic data packets contain target data packets for patch updates of the Windows system in the corresponding terminal device; if so, parse the patch file and patch information from the target data packet; and report the patch update content to the patch management server; the patch update content at least includes the patch file, the patch information and the Windows system version of the corresponding terminal device; The patch management server is used to perform a security check on the patch file, and when the check passes, update the patch update content to a preset patch library; and in response to receiving a patch file download request sent by an intranet server, send the target patch file requested for download to the intranet server according to the patch library and the download request, so that the intranet server uses the target patch file to provide Windows system update patch files for terminals deployed in the intranet.

8. The patch update system based on bypass monitoring according to claim 7, characterized in that: The bypass monitoring server is connected to the mirror port of the external switch in parallel to the network link of each corresponding terminal device; wherein each terminal device establishes a network link through the corresponding switch; When the bypass monitoring server monitors the network traffic data packets received by multiple terminal devices from the external network through the network link in a bypass monitoring manner, it is specifically used to receive the network traffic data packets forwarded by the switch through the mirror port.

9. An electronic device, comprising a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, the method according to any one of claims 1 to 5 is implemented.

10. A computer-readable storage medium having a computer program stored thereon, which, when executed in a computer, causes the computer to execute the method according to any one of claims 1 to 5.

Images