Remote control abnormality determination method, device, storage medium and electronic device

Abstract

The present application provides a method, device, storage medium and electronic device for determining remote control anomalies. The anomaly determination method includes: obtaining data packets transmitted by intranet assets; extracting security information corresponding to the data packets through a security engine when there is a security threat in the data packets; and determining whether there is a remote control anomaly in the intranet assets based on the security information and the remote control record table updated in real time. The present application determines whether there is a remote control anomaly in the intranet assets through the remote control record table updated in real time and the security information, which can avoid the abnormal behavior of the intranet assets controlled by the vulnerabilities that are not blocked by the gateway device, and greatly improves the accuracy and comprehensiveness of anomaly detection.

Description

Technical Field

[0001] The present application relates to the field of network asset communication security technology, and in particular to a method, device, storage medium, and electronic device for determining remote control anomalies. Background Art

[0002] During intranet penetration, if the intranet server is attacked by several network vulnerabilities, the gateway device may successfully block the attacks and generate alerts. However, there may still be remote control protocol vulnerabilities that are not blocked by the gateway device. At this time, external attackers can exploit these vulnerabilities to bypass authentication and directly connect to the intranet server using the remote control protocol. After compromising the intranet server, external attackers can steal the user names, passwords, and other permissions of the intranet system, thereby controlling more intranet assets. These intranet assets can then use the remote control protocol to transmit data to the attacker, thereby stealing intranet data.

[0003] Currently, one method is to reduce the vulnerability of remote control protocols to password cracking through brute force cracking to prevent intranet assets from being compromised. However, this method is based on the connection rate and the number of failed logins. Both the connection rate and the number of failed logins are empirical values, so the accuracy of this method is low. Another method is to attract and lure attackers through honeypot hosts with built-in high-risk vulnerabilities, and to study the attackers' attack objectives and methods, so as to delay or even block the attack and destructive behavior. However, high-interaction honeypot technology relies on virtual honeypot hosts and cannot identify unknown vulnerabilities. Therefore, the accuracy and comprehensiveness of this method are low. Summary of the Invention

[0004] In view of this, the purpose of the embodiments of the present application is to provide a method, device, storage medium and electronic device for determining remote control anomalies, so as to solve the problem of low accuracy and comprehensiveness of anomaly detection in the prior art.

[0005] In a first aspect, an embodiment of the present application provides a method for determining a remote control anomaly, comprising:

[0006] Obtain data packets transmitted by intranet assets;

[0007] In the event that there is a security threat to the data message, extracting security information corresponding to the data message through a security engine;

[0008] Based on the security information and the remote control record table updated in real time, it is determined whether there is a remote control anomaly on the intranet asset.

[0009] In a possible implementation, the determination method further includes:

[0010] Extracting attribute information of the data message from the data message, wherein the attribute information includes at least a source address and a destination address of the data message and an application protocol corresponding to the data message;

[0011] The data message is verified based on the attribute information.

[0012] In a possible implementation, the verifying the data message based on the attribute information includes:

[0013] Determine whether the source address and destination address of the data message belong to an external network address;

[0014] If not, determining whether the application protocol corresponding to the data message belongs to a remote control protocol;

[0015] If so, determining whether the application protocol corresponding to the data message is successfully logged in;

[0016] If the login is successful, it is determined that the data message has passed the verification.

[0017] In a possible implementation manner, when the verification is passed, the updating method of the remote control record table includes:

[0018] Determining whether the source address and destination address of the data message and the application protocol corresponding to the data message exist in the remote control record table;

[0019] If so, update the remote control record table using the login time of the intranet asset;

[0020] If not, the remote control record table is updated using the source address, the destination address, the application protocol, and the login time.

[0021] In a possible implementation, when there is a security threat in the data message, extracting security information corresponding to the data message by a security engine includes:

[0022] Detecting the data message by the security engine to determine whether the data message poses a security threat;

[0023] In the case that there is a security threat in the data message, the threat source address, threat destination address and threat level corresponding to the data message are extracted.

[0024] In one possible implementation, determining whether the intranet asset has a remote control anomaly based on the security information and the remote control record table updated in real time includes:

[0025] determining whether the threat source address or the threat destination address included in the security information exists in the current remote control record table;

[0026] If so, it is determined that there is a remote control anomaly in the intranet asset.

[0027] In a second aspect, an embodiment of the present application further provides a device for determining a remote control anomaly, comprising:

[0028] An acquisition module configured to acquire data packets transmitted by intranet assets;

[0029] an extraction module configured to extract security information corresponding to the data message through a security engine when there is a security threat in the data message;

[0030] The determination module is configured to determine whether there is a remote control anomaly on the intranet asset based on the security information and the remote control record table updated in real time.

[0031] In a possible implementation, the abnormality determination device further includes a verification module configured to:

[0032] Extracting attribute information of the data message from the data message, wherein the attribute information includes at least a source address and a destination address of the data message and an application protocol corresponding to the data message;

[0033] The data message is verified based on the attribute information.

[0034] In a third aspect, an embodiment of the present application further provides a storage medium, wherein the computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the following steps are performed:

[0035] Obtain data packets transmitted by intranet assets;

[0036] In the event that there is a security threat to the data message, extracting security information corresponding to the data message through a security engine;

[0037] Based on the security information and the remote control record table updated in real time, it is determined whether there is a remote control anomaly on the intranet asset.

[0038] In a fourth aspect, an embodiment of the present application further provides an electronic device, comprising: a processor and a memory, wherein the memory stores machine-readable instructions executable by the processor, and when the electronic device is running, the processor and the memory communicate via a bus, and when the machine-readable instructions are executed by the processor, the following steps are performed:

[0039] Obtain data packets transmitted by intranet assets;

[0040] In the event that there is a security threat to the data message, extracting security information corresponding to the data message through a security engine;

[0041] Based on the security information and the remote control record table updated in real time, it is determined whether there is a remote control anomaly on the intranet asset.

[0042] The embodiment of the present application determines whether there is a remote control anomaly in the intranet assets through a real-time updated remote control record table and security information, which can prevent the intranet assets from being controlled by vulnerabilities that are not blocked by the gateway device to perform abnormal behavior, greatly improving the accuracy and comprehensiveness of anomaly detection.

[0043] In order to make the above-mentioned objects, features and advantages of the present application more obvious and easy to understand, preferred embodiments are given below and described in detail with reference to the accompanying drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0044] In order to more clearly illustrate the technical solutions in this application or the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are only some embodiments recorded in this application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative labor.

[0045] Figure 1 A flowchart of a method for determining a remote control anomaly provided by the present application is shown;

[0046] Figure 2 A flowchart showing updating a remote control record table based on attribute information of a data message in a method for determining a remote control anomaly provided by the present application is shown;

[0047] Figure 3 A flowchart of verifying a data message based on attribute information in a method for determining a remote control anomaly provided by the present application is shown;

[0048] Figure 4 A schematic diagram showing the structure of a device for determining a remote control anomaly provided by the present application is shown;

[0049] Figure 5 A schematic structural diagram of an electronic device provided in this application is shown. DETAILED DESCRIPTION

[0050] Various aspects and features of the present application are described herein with reference to the accompanying drawings.

[0051] It should be understood that various modifications may be made to the embodiments of the present application. Therefore, the above description should not be considered as limiting, but merely as an example of an embodiment. Other modifications within the scope and spirit of the present application will occur to those skilled in the art.

[0052] The accompanying drawings, which are incorporated in and constitute a part of the specification, illustrate embodiments of the present application and, together with the general description of the present application given above and the detailed description of the embodiments given below, serve to explain the principles of the present application.

[0053] These and other characteristics of the present application will become apparent from the following description of a preferred form of embodiment given as a non-limiting example with reference to the accompanying drawings.

[0054] It should also be understood that although the present application has been described with reference to certain specific examples, those skilled in the art will be able to implement many other equivalent forms of the present application that have the features described in the claims and are therefore within the scope of protection defined thereby.

[0055] The above and other aspects, features and advantages of the present application will become more apparent from the following detailed description when taken in conjunction with the accompanying drawings.

[0056] Specific embodiments of the present application will be described hereinafter with reference to the accompanying drawings; however, it should be understood that the embodiments described are merely examples of the present application and may be implemented in a variety of ways. Familiar and / or repetitive functions and structures are not described in detail to avoid obscuring the present application with unnecessary or redundant details. Therefore, the specific structural and functional details described herein are not intended to be limiting, but rather serve merely as a basis and representative basis for the claims to teach those skilled in the art to variously utilize the present application with substantially any suitable detailed structure.

[0057] This specification may use the phrases "in one embodiment," "in another embodiment," "in yet another embodiment," or "in other embodiments," which may all refer to one or more of the same or different embodiments according to the present application.

[0058] First, in order to facilitate understanding of this application, a method for determining remote control abnormality provided by this application is first introduced in detail. Figure 1 As shown, the abnormality determination method provided by the embodiment of the present application is as follows Figure 1 The method steps shown can solve the problem of low accuracy and comprehensiveness of anomaly detection in the prior art. Specific steps include S101-S103.

[0059] S101, obtaining data packets transmitted by intranet assets.

[0060] In a specific implementation, electronic devices can identify assets in a local area network (LAN) based on a scheduled task, thereby obtaining the intranet assets belonging to the LAN. Assets refer to valuable information or resources in the LAN, such as services enabled by hosts in the LAN and basic devices associated with the hosts, such as routers and printers.

[0061] In an embodiment of the present application, the server or controller obtains data packets transmitted by each intranet asset in real time. The data packets may be packets transmitted between other assets in the local area network to which the intranet asset belongs and the intranet asset, or packets transmitted between an external network asset and the intranet asset.

[0062] S102: When a data message has a security threat, security information corresponding to the data message is extracted through a security engine.

[0063] In practice, a security engine is typically installed within the local area network, such as an intrusion prevention system (IPS) or a web application firewall (WAF). During data packet transmission, the security engine detects the data packet to determine whether it poses a security threat. Optionally, the security engine has pre-set judgment rules. For example, if a virus is transmitted from an external network address to the external or internal network, the attack chain is "attack and intrusion," while other cases are "intranet diffusion." For the security engine IPS, an internal network source address is considered "intranet diffusion," while an external network source address is considered "attack and intrusion." For the security engine WAF, the attack chain can also be determined based on other rule names. It is worth noting that for command-control-related security incidents, the attack chain is "command and control."

[0064] When a data message has a security threat, the threat source address, threat destination address, and threat level corresponding to the data message are extracted.

[0065] S103: Based on the security information and the remote control record table updated in real time, determine whether there is any remote control anomaly in the intranet assets.

[0066] After obtaining the security information, determine whether the threat source address or threat destination address included in the security information exists in the current remote control record table, which is the remote control record table updated in real time; if so, determine that there is a remote control anomaly in the intranet asset, that is, the event executed by the intranet asset is an attack event; if the threat source address or threat destination address does not exist in the current remote control record table, determine that there is no remote control anomaly in the intranet asset.

[0067] Optionally, it is possible to further determine whether the threat source address or threat destination address in the current remote control record table is an intranet address or an extranet address, respectively. As one example, for attack events such as advertising Trojans and backdoor software, if the threat source address is an intranet address and the threat destination address is an intranet address or an extranet address, the risk level of the intranet asset is determined to be high risk. Except for this case, the risk level of the intranet asset is determined to be low risk. For attack events involving browsing malicious Uniform Resource Locators (URLs), if the threat source address is an intranet address and the threat destination address is an intranet address or an extranet address, the risk level of the intranet asset is determined to be medium risk. Except for this case, the risk level of the intranet asset is determined to be low risk.

[0068] Of course, it can also be set to determine the risk level of the intranet assets when executing each event within a preset period, and then determine the highest risk level as the final risk level of the intranet assets. The embodiment of the present application does not make specific limitations on this.

[0069] The embodiment of the present application determines whether there is a remote control anomaly in the intranet assets through a real-time updated remote control record table and security information, which can prevent the intranet assets from being controlled by vulnerabilities that are not blocked by the gateway device to perform abnormal behavior, greatly improving the accuracy and comprehensiveness of anomaly detection.

[0070] In the abnormality determination method provided in the embodiment of the present application, reference can be made to Figure 2 The method flow chart shown is used to verify the data message based on attribute information, and the specific steps include S201-S204.

[0071] S201, determining whether the source address and destination address of the data message belong to external network addresses.

[0072] S202: If not, determine whether the application protocol corresponding to the data message belongs to the remote control protocol.

[0073] S203: If yes, determine whether the application protocol corresponding to the data message is successfully logged in.

[0074] S204: If the login is successful, determine whether the data message has passed the verification.

[0075] Optionally, when verifying the data message based on the attribute information, it is determined whether the source address and destination address of the data message belong to the external network address, wherein the source address and destination address belonging to the intranet address can be pre-set, and then it is determined whether the source address and destination address of the data message exist in the source address and destination address of the intranet address. If so, it is determined that the source address and destination address of the data message belong to the intranet address, that is, the data message transmission is normal and the intranet asset is also in a normal state. At this time, there is no need to record in the remote control record table.

[0076] If the source address and destination address of the data message do not exist in the source address and destination address of the intranet address, it is determined that the source address or destination address of the data message belongs to the extranet address. At this time, it is further determined whether the application protocol corresponding to the data message belongs to the remote control protocol, where the remote control protocol includes the command line interface remote management protocol (Secure Shell Protocol, SSH), the command line interface remote management protocol Telnet, the Remote Desktop Protocol (Remote Desktop Protocol, RDP), etc.

[0077] When the application protocol corresponding to the data message does not belong to the remote control protocol, it indicates that the data message transmission is normal and the intranet asset is also in a normal state. In this case, there is no need to record in the remote control record table.

[0078] If the application protocol corresponding to the data packet is a remote control protocol, a determination is made as to whether the login to the application protocol corresponding to the data packet is successful. If the login is successful, the data packet is deemed to have passed verification, and a record is then made in the remote control record table. For the SSH protocol, a preset number of consecutive SSH2 login failures, such as 5, can be allowed. In this case, approximately 31 SSH packets are generated, and the number of SSH packets used to determine login success or failure is then used. For the telnet protocol, if the packet string contains "Login Failed" or "%Username or password incorrect!", it indicates a login failure. For the RDP protocol, login failure can also be determined based on the number of RDP packets.

[0079] When the verification is passed, the remote control record table is updated based on the attribute information of the data message to obtain the current remote control record table in real time.

[0080] Considering the possibility of message transmission errors, such as errors in the source and / or destination addresses, there is no need to perform subsequent transmission records, or update the remote control record table. Records in the remote control record table are only made when data message transmission is normal. Therefore, after acquiring data messages transmitted by intranet assets, attribute information of the data messages is extracted from the data messages. This attribute information includes at least the source and destination addresses of the data messages, as well as the application protocol corresponding to the data messages. Furthermore, the data messages are verified based on this attribute information. If the data messages pass verification, the remote control record table is updated based on the attribute information of the data messages.

[0081] Optionally, when the data stream transmitted by the intranet assets flows through a device such as a gateway, external network address check, control protocol check, control protocol login success check, etc. can be performed.

[0082] As one example, Figure 3 The flowchart shows a method for updating the remote control record table when the verification is passed, wherein the specific steps include S301-S303.

[0083] S301: Determine whether the source address and destination address of the data message and the application protocol corresponding to the data message exist in the remote control record table.

[0084] S302: If it exists, update the remote control record table using the login time of the intranet asset.

[0085] S303: If it does not exist, update the remote control record table using the source address, destination address, application protocol and login time.

[0086] In a specific implementation, after extracting the source address, destination address and application protocol corresponding to the data message, it is determined whether the source address and destination address of the data message and the application protocol corresponding to the data message exist in the remote control record table, wherein the remote control record table includes at least the historical data message of each transmission, its corresponding historical source address, historical destination address, historical application protocol, historical login time, etc.

[0087] If the remote control record table contains the source address, destination address, and application protocol corresponding to the datagram, the datagram's login time is extracted from the datagram. This login time is the time when the intranet asset was accessed by another intranet asset or an extranet asset, or when the intranet asset accessed another intranet asset or an extranet asset. Alternatively, it can be the time when the application protocol was logged in. The remote control record table is then updated with the login time of the intranet asset.

[0088] If the source address, destination address, and application protocol corresponding to the data message do not exist in the remote control record table, the remote control record table is updated using the source address, destination address, application protocol, and login time. That is, the intranet assets, source address, destination address, application protocol, and login time are added to the remote control record table.

[0089] Based on the same inventive concept, the second aspect of this application also provides an abnormality determination device corresponding to the abnormality determination method. Since the principle of solving the problem by the abnormality determination device in this application is similar to that of the above-mentioned abnormality determination method of this application, the implementation of the abnormality determination device can refer to the implementation of the method, and the repeated parts will not be repeated.

[0090] Figure 4 A schematic diagram of an abnormality determination device provided in an embodiment of the present application is shown, specifically comprising:

[0091] An acquisition module 401 is configured to acquire data packets transmitted by intranet assets;

[0092] An extraction module 402 configured to extract security information corresponding to the data message through a security engine when there is a security threat in the data message;

[0093] The determination module 403 is configured to determine whether there is any remote control anomaly on the intranet asset based on the security information and the remote control record table updated in real time.

[0094] In yet another embodiment, the abnormality determination apparatus further includes a verification module 404 configured to:

[0095] Extracting attribute information of the data message from the data message, wherein the attribute information includes at least a source address and a destination address of the data message and an application protocol corresponding to the data message;

[0096] The data message is verified based on the attribute information.

[0097] In another embodiment, the verification module 404 is specifically configured as follows:

[0098] Determine whether the source address and destination address of the data message belong to an external network address;

[0099] If not, determining whether the application protocol corresponding to the data message belongs to a remote control protocol;

[0100] If so, determining whether the application protocol corresponding to the data message is successfully logged in;

[0101] If the login is successful, it is determined that the data message has passed the verification.

[0102] In another embodiment, the abnormality determination device further includes an updating module 405 specifically configured to:

[0103] Determining whether the source address and destination address of the data message and the application protocol corresponding to the data message exist in the remote control record table;

[0104] If so, update the remote control record table using the login time of the intranet asset;

[0105] If not, the remote control record table is updated using the source address, the destination address, the application protocol, and the login time.

[0106] In another embodiment, the extraction module 402 is specifically configured as follows:

[0107] Detecting the data message by the security engine to determine whether the data message poses a security threat;

[0108] In the case that there is a security threat in the data message, the threat source address, threat destination address and threat level corresponding to the data message are extracted.

[0109] In yet another embodiment, the determining module 403 is specifically configured as follows:

[0110] determining whether the threat source address or the threat destination address included in the security information exists in the current remote control record table;

[0111] If so, it is determined that there is a remote control anomaly in the intranet asset.

[0112] The embodiment of the present application determines whether there is a remote control anomaly in the intranet assets through a real-time updated remote control record table and security information, which can prevent the intranet assets from being controlled by vulnerabilities that are not blocked by the gateway device to perform abnormal behavior, greatly improving the accuracy and comprehensiveness of anomaly detection.

[0113] An embodiment of the present application provides a storage medium, which is a computer-readable medium and stores a computer program. When the computer program is executed by a processor, the method provided in any embodiment of the present application is implemented, including the following steps S11 to S13:

[0114] S11, obtain the data message transmitted by the intranet asset;

[0115] S12, when there is a security threat in the data message, extracting security information corresponding to the data message through a security engine;

[0116] S13: Based on the security information and the remote control record table updated in real time, determine whether there is any remote control anomaly on the intranet asset.

[0117] When the computer program is executed by the processor to determine the method, the processor specifically performs the following steps: extracting attribute information of the data message from the data message, wherein the attribute information includes at least the source address and destination address of the data message and the application protocol corresponding to the data message; based on the attribute information, verifying the data message.

[0118] When the computer program is executed by the processor to verify the data message based on the attribute information, the processor also executes the following steps: determining whether the source address and destination address of the data message belong to the external network address; if not, determining whether the application protocol corresponding to the data message belongs to the remote control protocol; if so, determining whether the application protocol corresponding to the data message is successfully logged in; if the login is successful, determining that the data message passes the verification.

[0119] When the computer program is executed and verified by the processor and the remote control record table is updated, the processor also executes the following steps: determining whether the source address and destination address of the data message and the application protocol corresponding to the data message exist in the remote control record table; if so, updating the remote control record table using the login time of the intranet asset; if not, updating the remote control record table using the source address, the destination address, the application protocol and the login time.

[0120] When the computer program is executed by the processor and, in the case where a security threat exists in the data message, the security information corresponding to the data message is extracted through the security engine, the processor also executes the following steps: detecting the data message through the security engine to determine whether the data message exists a security threat; and, in the case where a security threat exists in the data message, extracting the threat source address, threat destination address, and threat level corresponding to the data message.

[0121] When the computer program is executed by the processor to determine whether the intranet asset has a remote control anomaly based on the security information and the real-time updated remote control record table, the processor also executes the following steps: determining whether the threat source address or the threat destination address included in the security information exists in the current remote control record table; if so, determining that the intranet asset has a remote control anomaly.

[0122] The embodiment of the present application determines whether there is a remote control anomaly in the intranet assets through a real-time updated remote control record table and security information, which can prevent the intranet assets from being controlled by vulnerabilities that are not blocked by the gateway device to perform abnormal behavior, greatly improving the accuracy and comprehensiveness of anomaly detection.

[0123] The embodiment of the present application also provides an electronic device. The structural diagram of the electronic device can be as follows: Figure 5 As shown, the electronic device comprises at least a memory 501 and a processor 502. The memory 501 stores a computer program. The processor 502 implements the method provided by any embodiment of the present application when executing the computer program on the memory 501. For example, the steps of the electronic device computer program are as follows S21 to S23:

[0124] S21, obtaining data packets transmitted by intranet assets;

[0125] S22, when there is a security threat in the data message, extracting security information corresponding to the data message through a security engine;

[0126] S23: Determine whether there is any remote control anomaly on the intranet asset based on the security information and the remote control record table updated in real time.

[0127] When executing the determination method stored in the memory, the processor also executes the following computer program: extracting attribute information of the data message from the data message, wherein the attribute information includes at least the source address and destination address of the data message and the application protocol corresponding to the data message; based on the attribute information, verifying the data message.

[0128] When the processor verifies the data message based on the attribute information stored in the execution memory, it also executes the following computer program: determining whether the source address and destination address of the data message belong to the external network address; if not, determining whether the application protocol corresponding to the data message belongs to the remote control protocol; if so, determining whether the application protocol corresponding to the data message is successfully logged in; if the login is successful, determining that the data message passes the verification.

[0129] When executing the remote control record table update method stored in the memory when the verification is passed, the processor also executes the following computer program: determining whether the source address and destination address of the data message and the application protocol corresponding to the data message exist in the remote control record table; if so, updating the remote control record table using the login time of the intranet asset; if not, updating the remote control record table using the source address, the destination address, the application protocol and the login time.

[0130] When the processor extracts security information corresponding to the data message through the security engine when there is a security threat in the data message stored in the execution memory, it also executes the following computer program: detecting the data message through the security engine to determine whether there is a security threat in the data message; and extracting the threat source address, threat destination address and threat level corresponding to the data message when there is a security threat in the data message.

[0131] When the processor determines whether the intranet asset has a remote control anomaly based on the security information and the real-time updated remote control record table stored in the execution memory, it also executes the following computer program: determining whether the threat source address or the threat destination address included in the security information exists in the current remote control record table; if so, determining that the intranet asset has a remote control anomaly.

[0132] The embodiment of the present application determines whether there is a remote control anomaly in the intranet assets through a real-time updated remote control record table and security information, which can prevent the intranet assets from being controlled by vulnerabilities that are not blocked by the gateway device to perform abnormal behavior, greatly improving the accuracy and comprehensiveness of anomaly detection.

[0133] Optionally, in this embodiment, the above-mentioned storage medium may include, but is not limited to, various media that can store program codes, such as a USB flash drive, a read-only memory (ROM), a random access memory (RAM), a mobile hard disk, a magnetic disk, or an optical disk. Optionally, in this embodiment, the processor executes the method steps recorded in the above-mentioned embodiment according to the program code stored in the storage medium. Optionally, the specific examples in this embodiment can refer to the examples described in the above-mentioned embodiment and the optional implementation mode, and this embodiment will not be repeated here. Obviously, those skilled in the art should understand that the above-mentioned modules or steps of the present application can be implemented using a general-purpose computing device, which can be concentrated on a single computing device or distributed on a network composed of multiple computing devices. Optionally, they can be implemented using program codes executable by a computing device, so that they can be stored in a storage device and executed by the computing device, and in some cases, the steps shown or described can be performed in a different order than here, or they can be made into individual integrated circuit modules, or multiple modules or steps therein can be made into a single integrated circuit module for implementation. In this way, the present application is not limited to any specific combination of hardware and software.

[0134] In addition, although exemplary embodiments have been described herein, the scope includes any and all embodiments based on the present application with equivalent elements, modifications, omissions, combinations (e.g., solutions that intersect various embodiments), adaptations, or changes. The elements in the claims are to be interpreted broadly based on the language employed in the claims and are not limited to the examples described in this specification or during the prosecution of this application, which examples are to be interpreted as non-exclusive. Therefore, this specification and examples are intended to be considered as examples only, with the true scope and spirit being indicated by the following claims and the full scope of their equivalents.

[0135] The above description is intended to be illustrative rather than restrictive. For example, the above examples (or one or more of their solutions) can be used in combination with each other. For example, a person of ordinary skill in the art may use other embodiments when reading the above description. In addition, in the above-mentioned specific embodiments, various features can be grouped together to simplify the application. This should not be interpreted as an intention that a disclosed feature that is not required to be protected is necessary for any claim. On the contrary, the subject matter of the present application may be less than all the features of a specific disclosed embodiment. Thus, the following claims are incorporated into the specific embodiments as examples or embodiments, wherein each claim is independently a separate embodiment, and it is considered that these embodiments can be combined with each other in various combinations or arrangements. The scope of this application should be determined with reference to the appended claims and the full scope of equivalents to which these claims are entitled.

[0136] The above describes in detail several embodiments of the present application, but the present application is not limited to these specific embodiments. Those skilled in the art can make various variations and modifications to the embodiments based on the concept of the present application, and these variations and modifications should all fall within the scope of protection claimed by the present application.

Claims

1. A method for determining remote control abnormality, characterized in that: include: Obtain data packets transmitted by intranet assets; In the case where there is a security threat to the data message, extracting security information corresponding to the data message through a security engine; Based on the security information and the remote control record table updated in real time, determining whether there is a remote control anomaly on the intranet asset; The determining whether there is a remote control anomaly on the intranet asset based on the security information and the remote control record table updated in real time includes: Determine whether the threat source address or the threat destination address included in the security information exists in the current remote control record table; If so, it is determined that the intranet asset has a remote control anomaly; After obtaining the data message transmitted by the intranet asset, determining whether the data message poses a security threat includes: Extracting attribute information of the data message from the data message, wherein the attribute information at least includes a source address and a destination address of the data message and an application protocol corresponding to the data message; Determine whether the source address and the destination address of the data message belong to an external network address; If yes, determining whether the application protocol corresponding to the data message belongs to a remote control protocol; If so, determining whether the application protocol corresponding to the data message is successfully logged in; If the login is successful, it is determined that the data message has passed the verification.

2. The determination method according to claim 1, characterized in that: When the verification is passed, the updating method of the remote control record table includes: Determine whether the source address and destination address of the data message and the application protocol corresponding to the data message exist in the remote control record table; If it exists, update the remote control record table using the login time of the intranet asset; If not, the remote control record table is updated using the source address, the destination address, the application protocol and the login time.

3. The determination method according to claim 1, characterized in that: In the case where the data message has a security threat, extracting security information corresponding to the data message through a security engine includes: Detecting the data message by the security engine to determine whether the data message poses a security threat; In the case that there is a security threat in the data message, the threat source address, the threat destination address and the threat level corresponding to the data message are extracted.

4. A remote control abnormality determination device, characterized in that: include: An acquisition module configured to acquire data packets transmitted by intranet assets; An extraction module, configured to extract security information corresponding to the data message through a security engine when there is a security threat in the data message; A determination module configured to determine whether there is a remote control anomaly on the intranet asset based on the security information and a remote control record table updated in real time; The specific configuration of the determination module is as follows: Determine whether the threat source address or the threat destination address included in the security information exists in the current remote control record table; If so, it is determined that the intranet asset has a remote control anomaly; The determining device also includes a verification module, which is configured as follows: After acquiring the data message transmitted by the intranet asset, extracting attribute information of the data message from the data message, wherein the attribute information at least includes a source address and a destination address of the data message and an application protocol corresponding to the data message; Determine whether the source address and the destination address of the data message belong to an external network address; If yes, determining whether the application protocol corresponding to the data message belongs to a remote control protocol; If so, determining whether the application protocol corresponding to the data message is successfully logged in; If the login is successful, it is determined that the data message has passed the verification.

5. A storage medium, characterized in that: The computer readable storage medium stores a computer program, which executes the following steps when executed by a processor: Obtain data packets transmitted by intranet assets; In the case where there is a security threat to the data message, extracting security information corresponding to the data message through a security engine; Based on the security information and the remote control record table updated in real time, determining whether there is a remote control anomaly on the intranet asset; The determining whether there is a remote control anomaly on the intranet asset based on the security information and the remote control record table updated in real time includes: Determine whether the threat source address or the threat destination address included in the security information exists in the current remote control record table; If so, it is determined that the intranet asset has a remote control anomaly; After obtaining the data message transmitted by the intranet asset, determining whether the data message poses a security threat includes: Extracting attribute information of the data message from the data message, wherein the attribute information at least includes a source address and a destination address of the data message and an application protocol corresponding to the data message; Determine whether the source address and the destination address of the data message belong to an external network address; If yes, determining whether the application protocol corresponding to the data message belongs to a remote control protocol; If so, determining whether the application protocol corresponding to the data message is successfully logged in; If the login is successful, it is determined that the data message has passed the verification.

6. An electronic device, characterized in that: include: A processor and a memory, wherein the memory stores machine-readable instructions executable by the processor. When the electronic device is running, the processor and the memory communicate via a bus. When the machine-readable instructions are executed by the processor, the following steps are performed: Obtain data packets transmitted by intranet assets; In the case where there is a security threat to the data message, extracting security information corresponding to the data message through a security engine; Based on the security information and the remote control record table updated in real time, determining whether there is a remote control anomaly on the intranet asset; The determining whether there is a remote control anomaly on the intranet asset based on the security information and the remote control record table updated in real time includes: Determine whether the threat source address or the threat destination address included in the security information exists in the current remote control record table; If so, it is determined that the intranet asset has a remote control anomaly; After obtaining the data message transmitted by the intranet asset, determining whether the data message poses a security threat includes: Extracting attribute information of the data message from the data message, wherein the attribute information at least includes a source address and a destination address of the data message and an application protocol corresponding to the data message; Determine whether the source address and the destination address of the data message belong to an external network address; If yes, determining whether the application protocol corresponding to the data message belongs to a remote control protocol; If so, determining whether the application protocol corresponding to the data message is successfully logged in; If the login is successful, it is determined that the data message has passed the verification.

Images