Instruction processing method, device, electronic device and non-volatile storage medium

Abstract

The present application discloses a method, device, electronic device and non-volatile storage medium for processing instructions. The method includes: obtaining a network instruction detected by a target monitoring task, wherein the network instruction is a network instruction generated by a network device, and the target monitoring task is at least used to perform risk monitoring on a login account of the network device; in the case where the network instruction is a risk instruction, the network instruction is processed according to a disposal rule corresponding to the risk instruction; in the case where the network instruction is a non-risk instruction, whether the network instruction is a risky suspicious instruction is determined; in the case where the judgment result indicates that the network instruction is a risky suspicious instruction, the judgment rule corresponding to the network instruction is determined, and the network instruction is subjected to risk judgment according to the judgment rule. The present application solves the technical problem that the prior art uses manual verification of the security of network instructions generated by network devices, which is inefficient.

Description

Technical Field

[0001] The present application relates to the field of data operation and maintenance technology, and specifically, to an instruction processing method, device, electronic device and non-volatile storage medium. Background Art

[0002] The various operations of metropolitan area network equipment are related to the Internet access of thousands of households. Therefore, it is necessary to ensure the safe execution of security instructions. Under the premise of the continuous expansion of network scale and the continuous deepening of instruction automation, how to ensure the safe and efficient automatic execution of various instructions is particularly important. The existing technology generally uses manual verification to verify the security of the operation instructions of network equipment. However, the manual verification method has the problems of low efficiency and inflexibility.

[0003] To address the above-mentioned problems, no effective solution has been proposed yet. Summary of the invention

[0004] The embodiments of the present application provide a method, device, electronic device and non-volatile storage medium for processing instructions, so as to at least solve the technical problem that the prior art uses manual verification of the security of network instructions generated by network devices, which has low efficiency.

[0005] According to one aspect of an embodiment of the present application, a method for processing instructions is provided, including: obtaining a network instruction detected by a target monitoring task, wherein the network instruction is a network instruction generated by a network device, and the target monitoring task is at least used to perform risk monitoring on a login account of the network device; when the network instruction is a risk instruction, processing the network instruction according to a handling rule corresponding to the risk instruction; when the network instruction is a non-risk instruction, determining whether the network instruction is a risky and suspicious instruction; when the judgment result indicates that the network instruction is a risky and suspicious instruction, determining a judgment rule corresponding to the network instruction, and performing a risk judgment on the network instruction according to the judgment rule.

[0006] Optionally, the network instruction is processed according to the handling rules corresponding to the risk instruction, including: determining the life stage of the risk instruction to which the network instruction belongs; when the life stage is in the early life stage, rolling back the network instruction; when the life stage is in the life transition period, sending the network instruction to the target object for confirmation; when the life stage is in the end of life period, storing the network instruction in a pending confirmation area.

[0007] Optionally, determining the life stage of a risk instruction to which the network instruction belongs includes: when the network instruction enters a set area for the first time, determining that the network instruction is in the early stage of its life; when the probability that the network instruction in the set area is a risk instruction is lower than a first threshold, determining that the network instruction is in a life transition period; when the duration of the network instruction in the life transition period exceeds a second threshold, determining that the network instruction is in a life history period; when the network instruction in the life history period continues without changing for a preset period of time, determining that the network instruction has entered the end of its life period; when the network instruction in the set area is in the life transition period and the life history period and is hit by an alarm, determining that the network instruction has re-entered the early stage of its life.

[0008] Optionally, determining whether a network instruction is a risky and suspicious instruction includes: obtaining a regular matching formula in a database; performing regular matching on the network instruction and the regular matching formula; and determining that the network instruction is a risky and suspicious instruction when a risk keyword is matched.

[0009] Optionally, determining a judgment rule corresponding to a network instruction includes: obtaining path depth information of the network instruction, wherein the path depth information is used to represent information of a directory path where the network instruction is located; classifying the network instruction based on the path depth information and a judgment criterion for the instruction risk depth to obtain a risk scenario category to which the network instruction belongs, wherein the judgment criterion for the instruction risk depth is determined by at least a device type and a depth identifier of the network device; determining a judgment rule corresponding to the network instruction based on the risk scenario category to which the network instruction belongs.

[0010] Optionally, a risk judgment is made on the network instruction based on the judgment rules, including: when the risk scenario category is the first category, monitoring whether there is an association between the network device corresponding to the network instruction and the network device generating the alarm; when there is an association, determining that the network instruction of the first category is at risk; when the risk scenario category is the second category, sending the network instruction to the target object, and receiving the judgment result returned by the target object, wherein the judgment result is used to indicate whether there is an association between the network device corresponding to the network instruction and the network device generating the alarm; when the judgment result indicates that there is an association, determining that the network instruction of the second category is at risk; when the risk scenario category is the third category, making a risk judgment on the association between the network device corresponding to the network instruction and the network device generating the alarm based on the correspondence of historical commands, wherein the correspondence of historical commands is the correspondence between the network device corresponding to the historical network instruction and the network device generating the historical alarm; when the risk judgment result indicates that there is an association, determining that the network instruction of the third category is at risk.

[0011] Optionally, after performing risk judgment on the network instructions according to the judgment rules, the method also includes: storing the network instructions that hit the risk instructions or the risk-suspicious instructions in a database, and performing periodic error statistics on the target objects corresponding to the network instructions in the database to obtain error records corresponding to the target objects, wherein the error records are determined by at least one of the following: the number of network instructions in the early stage of life, the number of network instructions in the transition period of life, and the number of network instructions in the end of life; when the numerical value corresponding to the error record exceeds a third threshold, marking the target object corresponding to the error record as a first type of user, wherein the first type of user is used to indicate that the target object is a high-risk user; when the first type of user meets a preset condition, marking the first type of user as a second type of user, wherein the second type of user is used to indicate that the target object is a non-high-risk user, and the preset condition is that the first type of user is marked as a second type of user for a preset period of time.

[0012] According to another aspect of an embodiment of the present application, there is also provided an instruction processing device, including: an acquisition module, used to acquire network instructions detected by a target monitoring task, wherein the network instructions are network instructions generated by a network device, and the target monitoring task is at least used to perform risk monitoring on a login account of the network device; a processing module, used to process the network instructions according to a handling rule corresponding to the risk instruction when the network instructions are risk instructions; a judgment module, used to judge whether the network instructions are risky and suspicious instructions when the network instructions are non-risk instructions; and a determination module, used to determine a judgment rule corresponding to the network instructions when the judgment result indicates that the network instructions are risky and suspicious instructions, and perform risk judgment on the network instructions according to the judgment rule.

[0013] According to another aspect of the embodiments of the present application, an electronic device is also provided, including: a memory for storing program instructions; a processor, connected to the memory, for executing program instructions to implement the following functions: obtaining network instructions detected by a target monitoring task, wherein the network instructions are network instructions generated by a network device, and the target monitoring task is at least used to perform risk monitoring on a login account of the network device; in the case where the network instructions are risk instructions, processing the network instructions according to the handling rules corresponding to the risk instructions; in the case where the network instructions are non-risk instructions, determining whether the network instructions are risky and suspicious instructions; in the case where the judgment result indicates that the network instructions are risky and suspicious instructions, determining a judgment rule corresponding to the network instructions, and performing a risk judgment on the network instructions according to the judgment rule.

[0014] According to another aspect of the embodiments of the present application, a non-volatile storage medium is provided, which includes a stored computer program, wherein a device where the non-volatile storage medium is located executes a processing method for executing the above instructions by running the computer program.

[0015] In an embodiment of the present application, by acquiring the network instructions detected by the target monitoring task, wherein the network instructions are network instructions generated by the network device, and the target monitoring task is at least used to perform risk monitoring on the login account of the network device; when the network instruction is a risk instruction, the network instruction is processed according to the handling rules corresponding to the risk instruction; when the network instruction is a non-risk instruction, it is determined whether the network instruction is a risky suspicious instruction; when the judgment result indicates that the network instruction is a risky suspicious instruction, the judgment rule corresponding to the network instruction is determined, and the network instruction is risk-judged according to the judgment rule, thereby achieving the purpose of improving the efficiency of risk identification of network instructions, thereby realizing the technical effect of dynamic judgment of risk instructions, and further solving the technical problem that the prior art uses manual verification of the security of network instructions generated by network devices, and has low efficiency. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] The drawings described herein are used to provide a further understanding of the present application and constitute a part of the present application. The illustrative embodiments of the present application and their descriptions are used to explain the present application and do not constitute an improper limitation on the present application. In the drawings:

[0017] Figure 1 It is a hardware structure block diagram of a computer terminal (or electronic device) for implementing an instruction processing method according to an embodiment of the present application;

[0018] Figure 2 is a flowchart of a method for processing an instruction according to an embodiment of the present application;

[0019] Figure 3 is a structural diagram of an instruction processing device according to an embodiment of the present application;

[0020] Figure 4 This is a schematic diagram of a risk instruction judgment process according to an embodiment of the present application;

[0021] Figure 5 It is a schematic diagram of a risk personnel marking process according to an embodiment of the present application. DETAILED DESCRIPTION

[0022] In order to enable those skilled in the art to better understand the solution of the present application, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present application.

[0023] It should be noted that the terms "first", "second", etc. in the specification and claims of the present application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments of the present application described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device comprising a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0024] The instruction processing method embodiment provided in the embodiment of the present application can be executed in a mobile terminal, a computer terminal or a similar computing device. Figure 1 The hardware structure block diagram of a computer terminal (or electronic device) for implementing the instruction processing method is shown. Figure 1 As shown, the computer terminal 10 (or electronic device 10) may include one or more (102a, 102b, ..., 102n are used to illustrate) processors (the processor may include but is not limited to a processing device such as a microprocessor MCU or a programmable logic device FPGA), a memory 104 for storing data, and a transmission module 106 for communication functions. In addition, it may also include: a display, an input / output interface (I / O interface), a universal serial bus (USB) port (which may be included as one of the ports of the I / O interface), a network interface, a power supply and / or a camera. It can be understood by those skilled in the art that Figure 1 The structure shown is only for illustration and does not limit the structure of the above electronic device. Figure 1 More or fewer components as shown, or with Figure 1 Different configurations are shown.

[0025] It should be noted that the one or more processors and / or other data processing circuits described above may generally be referred to herein as "data processing circuits". The data processing circuits may be embodied in whole or in part as software, hardware, firmware, or any other combination thereof. In addition, the data processing circuit may be a single independent processing module, or may be incorporated in whole or in part into any of the other components in the computer terminal 10 (or electronic device). As described in the embodiments of the present application, the data processing circuit acts as a processor control (e.g., selection of a variable resistor terminal path connected to an interface).

[0026] The memory 104 can be used to store software programs and modules of application software, such as the program instruction / data storage device corresponding to the instruction processing method in the embodiment of the present application. The processor executes various functional applications and data processing by running the software programs and modules stored in the memory 104, that is, realizing the above-mentioned instruction processing method. The memory 104 may include a high-speed random access memory, and may also include a non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some examples, the memory 104 may further include a memory remotely arranged relative to the processor, and these remote memories may be connected to the computer terminal 10 via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0027] The transmission module 106 is used to receive or send data via a network. The specific example of the above network may include a wireless network provided by a communication provider of the computer terminal 10. In one example, the transmission device 106 includes a network adapter (Network Interface Controller, NIC), which can be connected to other network devices through a base station so as to communicate with the Internet. In one example, the transmission device 106 can be a radio frequency (RF) module, which is used to communicate with the Internet wirelessly.

[0028] The display may be, for example, a touch screen liquid crystal display (LCD) that enables a user to interact with a user interface of the computer terminal 10 (or electronic device).

[0029] It should be noted that, in some optional embodiments, the above Figure 1 The computer device (or electronic device) shown may include hardware elements (including circuits), software elements (including computer code stored on a computer-readable medium), or a combination of hardware elements and software elements. It should be noted that Figure 1 This is merely one example of a particular embodiment and is intended to illustrate the types of components that may be present in the above-described computer device (or electronic device).

[0030] In the above-mentioned operating environment, an embodiment of the present application provides an embodiment of an instruction processing method. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and although the logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0031] Figure 2 is a flowchart of a method for processing an instruction according to an embodiment of the present application, such as Figure 2 As shown, the method comprises the following steps:

[0032] Step S202, obtaining a network instruction detected by a target monitoring task, wherein the network instruction is a network instruction generated by a network device, and the target monitoring task is at least used to perform risk monitoring on a login account of the network device.

[0033] In an embodiment of the present application, an operator logs in to a network device by logging into his or her own account, and uses the account login as a trigger event to collect the operator's account information and the device information of the logged-in network device. The device information and account information are used as monitoring identifiers to form a monitoring task corresponding to the monitoring identifier, i.e., the above-mentioned target monitoring task, and trigger the tracking of network instructions generated by the network device logged in by the operator, as well as risk marking of the logged-in account.

[0034] Step S204: When the network instruction is a risk instruction, the network instruction is processed according to the handling rule corresponding to the risk instruction.

[0035] In the above steps, the network instructions are detected in real time by the target monitoring task, and it is determined whether the network instructions (hereinafter referred to as network instructions) generated in real time by the network device match the risk instructions. The risk instructions are risk instructions determined by the risk response rules. When the judgment result is yes, that is, when the network instructions are risk instructions, the network instructions are processed according to the risk response disposal rules corresponding to the risk instructions.

[0036] Step S206: When the network instruction is a non-risk instruction, determine whether the network instruction is a risky or suspicious instruction.

[0037] In the above step S206, if it is determined that the network instruction does not match the risk instruction, that is, the network instruction is a non-risk instruction, then it is determined whether the network instruction is a risky and suspicious instruction by performing a regular match between the network instruction and the keyword regular match formula contained in the pre-established risk instruction regular match data model library to determine whether the network instruction is a risky and suspicious instruction.

[0038] Step S208: When the judgment result indicates that the network instruction is a risky and suspicious instruction, a judgment rule corresponding to the network instruction is determined, and a risk judgment is performed on the network instruction according to the judgment rule.

[0039] In the above step S208, if the network instruction is determined to be a risky and suspicious instruction, the path depth information of the network instruction is obtained, and the network instruction is classified based on the path depth information of the network instruction and the pre-established instruction risk depth (the directory path where the instruction is located) judgment standard, and the risk of the network instruction is judged according to the judgment rules corresponding to different categories.

[0040] In step S204 of the above instruction processing method, the network instruction is processed according to the handling rules corresponding to the risk instruction, specifically including the following steps: determining the life stage of the risk instruction to which the network instruction belongs; when the life stage is the early life stage, rolling back the network instruction; when the life stage is the life transition period, sending the network instruction to the target object for confirmation; when the life stage is the end of life, storing the network instruction in the area to be confirmed.

[0041] In an embodiment of the present application, after determining that the acquired network instruction is a risk instruction, a risk response and disposal rule is established according to the conditions satisfied by the network instruction. Specifically, it is necessary to determine the life stage of the risk instruction to which the network instruction belongs, and the life stage may include but is not limited to the early life stage, the life transition stage, the end of life stage, the life history stage, etc. For network instructions whose risks are determined to be in the early life stage, the network equipment involved in the network instruction is notified to automatically roll back the risky network instructions, wherein the notification method includes but is not limited to the text message method. For network instructions whose risks are determined to be in the life transition stage, the network instruction is sent to the target object for confirmation, and the target object may be a maintenance personnel, and the sending method may be, for example, a text message notification method. For network instructions whose risks are determined to be in the end of life, the relevant network instructions are stored in a pending confirmation area, which is a 24-hour pending confirmation area, so as to facilitate manual evaluation by experts at a later stage.

[0042] In the above steps, determining the life stage of the risk instruction to which the network instruction belongs specifically includes the following steps: when the network instruction enters the set area for the first time, determining that the network instruction is in the early stage of life; when the probability that the network instruction in the set area is a risk instruction is lower than a first threshold, determining that the network instruction is in the life transition period; when the duration of the network instruction in the life transition period exceeds a second threshold, determining that the network instruction is in the life history period; when the network instruction in the life history period continues without changing for a preset period of time, determining that the network instruction enters the end of life period; in the case of a network instruction in the life transition period and the life history period in the set area, and being hit by an alarm, determining that the network instruction has re-entered the early stage of life.

[0043] In the embodiment of the present application, after obtaining the network instruction, it is necessary to make a risk judgment on the network instruction. The judgment method includes risk instruction judgment and risk suspicious instruction judgment. After the network instruction enters the risk judgment, the whole process adopts a periodic management method. Specifically, the network instruction that enters the set area for the first time is in the early stage of life. The set area can also be called the judgment area; after the risk judgment, the network instruction whose risk hit rate in the set area is lower than the first threshold will enter the life transition period. The risk hit rate is the probability of judging that the network instruction is a risk instruction; for the network instruction whose life transition period lasts for more than the second threshold, the network instruction enters the life history period; if the network instruction in the life history period continues for a preset long time without a state change, the network instruction will enter the end of life period; for the network instruction in the set area that is in the life transition period and the life history period and is activated by the alarm hit, the network instruction will re-enter the early stage of life. According to the judgment criteria of the above different cycles, the risk instructions judged by the existing risk response and disposal rules are updated in real time.

[0044] In step S206 of the above instruction processing method, it is determined whether the network instruction is a risky and suspicious instruction, which specifically includes the following steps: obtaining a regular matching formula in the database; performing regular matching on the network instruction and the regular matching formula; and determining that the network instruction is a risky and suspicious instruction when a risk keyword is matched.

[0045] In an embodiment of the present application, if it is determined that the network instruction does not match the risk instruction, that is, if the network instruction is a non-risk instruction, then it is determined whether the network instruction is a risk suspicious instruction. Specifically, a risk instruction set is established in advance for each network device, and in the risk instruction set, commonly used risk instructions are formed into a regular matching text (using a single string to describe and match a string of a certain syntactic rule) according to keywords to form a risk instruction regular matching data model library (which can be referred to as a database). The network instruction is regularly matched with the keyword regular matching formula contained in the pre-established risk instruction regular matching data model library to determine whether the network instruction is a risk suspicious instruction. When the risk keyword is matched, the network instruction is characterized as a risk suspicious instruction, otherwise, the network instruction is characterized as not a risk suspicious instruction.

[0046] In step S208 of the above instruction processing method, a judgment rule corresponding to the network instruction is determined, which specifically includes the following steps: obtaining path depth information of the network instruction, wherein the path depth information is used to represent information of the directory path where the network instruction is located; classifying the network instruction according to the path depth information and the judgment standard of the instruction risk depth to obtain the risk scenario category to which the network instruction belongs, wherein the judgment standard of the instruction risk depth is determined by at least the device type and depth identification of the network device; determining the judgment rule corresponding to the network instruction according to the risk scenario category to which the network instruction belongs.

[0047] In the embodiment of the present application, when a network instruction is judged to be a risky and suspicious instruction, the path depth information of the network instruction is obtained, and based on the path depth information of the network instruction and the pre-established instruction risk depth (directory path where the instruction is located) judgment standard, the network instruction is classified to obtain the risk scenario category to which the network instruction belongs. In the embodiment of the present application, three risk scenario categories may be included, namely the first category (real-time judgment risk group), the second category (post-expert judgment risk group) and the third category (big data judgment risk group), so as to determine the judgment rule corresponding to the network instruction according to the risk scenario category to which the network instruction belongs. It should be noted that the above-mentioned pre-established instruction risk depth judgment standard can be to establish a dynamic query based on the device resource network management to form a device command depth judgment rule of variable length "device type + depth identifier".

[0048] In step S208 of the above instruction processing method, a risk judgment is made on the network instruction according to the judgment rule, which specifically includes the following steps: when the risk scenario category is the first category, monitor whether there is an association relationship between the network device corresponding to the network instruction and the network device that generates the alarm; when there is an association relationship, determine that the network instruction of the first category has a risk; when the risk scenario category is the second category, send the network instruction to the target object, and receive the judgment result returned by the target object, wherein the judgment result is used to indicate whether there is an association relationship between the network device corresponding to the network instruction and the network device that generates the alarm; when the judgment result indicates that there is an association relationship, determine that the network instruction of the second category has a risk; when the risk scenario category is the third category, perform a risk judgment on the association relationship between the network device corresponding to the network instruction and the network device that generates the alarm based on the correspondence relationship of historical commands, wherein the correspondence relationship of historical commands is the correspondence relationship between the network device corresponding to the historical network instruction and the network device of the historical alarm; when the risk judgment result indicates that there is an association relationship, determine that the network instruction of the third category has a risk.

[0049] In an embodiment of the present application, the risk judgment rule for network instructions in the real-time judgment risk group corresponding to the first category is real-time judgment, specifically: storing the network instructions in a set area (i.e., the judgment area), monitoring whether the network device corresponding to the network instruction and the network device that generates the real-time alarm have an association relationship, and if there is an association relationship, it means that a risk instruction is hit, that is, the network instruction belonging to the first category is at risk.

[0050] The risk judgment rule for network instructions in the post-expert judgment risk group corresponding to the second category is that experts perform manual judgment, specifically: storing the network instructions in a set area (i.e., the judgment area), and sending the network instructions to the target object, which may be an expert, etc. The experts regularly determine whether there is a correlation between the network equipment corresponding to the network instructions in the set area and the network equipment that generates real-time alarms, and receive the judgment results returned by the experts. If the judgment result indicates that there is a correlation, it means that a risk instruction is hit, i.e., the network instructions of the second category are at risk.

[0051] The risk judgment rule for network instructions in the big data risk judgment group corresponding to the third category is determined by the K-Means clustering algorithm. Specifically, the network instructions are stored in a set area (i.e., the judgment area), and the K-Means clustering algorithm is used to record the correspondence of historical commands based on the big data formed by various risk instruction rules. Based on the correspondence of historical commands, a risk association judgment is performed on the network devices corresponding to the network instructions and the network devices that generate alarms. When the risk association judgment result indicates that there is an association, it means that a risk instruction is hit, i.e., the network instructions of the third category are at risk.

[0052] In the above-mentioned instruction processing method, after the network instructions are judged for risk according to the judgment rules, the method also includes the following steps: storing the network instructions that hit the risk instructions or the risk-suspicious instructions in a database, and performing periodic error statistics on the target objects corresponding to the network instructions in the database to obtain error records corresponding to the target objects, wherein the error records are determined by at least one of the following: the number of network instructions in the early stage of life, the number of network instructions in the transition period of life, and the number of network instructions in the end of life; when the numerical value corresponding to the error record exceeds the third threshold, marking the target object corresponding to the error record as a first type of user, wherein the first type of user is used to indicate that the target object is a high-risk user; when the first type of user meets the preset condition, marking the first type of user as a second type of user, wherein the second type of user is used to indicate that the target object is a non-high-risk user, and the preset condition is that the first type of user is marked as a second type of user for a preset period of time.

[0053] In the embodiment of the present application, after the risk judgment of the network instruction is made, it is also necessary to mark the personnel risk of the operator, that is, the network instruction that hits the risk instruction or the risk suspicious instruction is stored in the historical hit library (i.e., the above-mentioned database), and the target object (i.e., the operator) corresponding to the network instruction in the historical hit library is periodically counted for errors, for example, monthly statistics, and the error records corresponding to the target object are calculated according to the following weighted formula: the number of network instructions in the early stage of life * A + the number of network instructions in the transition period of life * B + the number of network instructions in the end of life * C + impact events * D, (A, B, C, D are weight values, which can be specified by empirical values), forming an audit work for the target object (i.e., the operator), and the impact event in the above formula generally refers to a fault event. The personnel whose error records exceed the third threshold are marked as the first type of users, i.e., high-risk users or high-risk personnel, otherwise, they are marked as the second type of users, i.e., non-high-risk users or non-high-risk personnel. The operation instructions of the high-risk operators marked as the first type of users need to be manually approved in real time to facilitate real-time personnel control. For users who are audited as Category 1 users (i.e. high-risk personnel) and are marked as Category 2 users (i.e. non-high-risk personnel) for a continuous preset period (if statistics are conducted on a monthly basis, the preset period can be set to two months, for example), the Category 1 users will be marked as Category 2 users, i.e. the high-risk personnel identification will be changed to a non-high-risk identification.

[0054] The embodiment of the present application starts from the identification of risk instructions and the audit of risk instructions for metropolitan area network equipment, and provides a method for processing instructions, aiming to improve the efficiency and flexibility of risk identification for network instructions, and realize dynamic, learnable, and interactive classification adjustment of risk identification. This method is a method that takes risk instructions as the entry point, combines the instruction depth and the equipment type combination to form automatic risk identification, and then enters the risk response area, combines expert judgment and real-time alarm linkage, forms a risk response full life management process, realizes efficient judgment of risk instructions, and forms a dynamic generation and organic exit mechanism of risk instructions, so as to achieve the purpose of precise control. In addition, by auditing and identifying the work numbers with high-risk operation commands, a high-risk command judgment is formed for a future prediction, and an effective intervention process for manual approval is recommended, which provides a benchmark for future predictions of risk audits and makes it possible to minimize risk control.

[0055] Figure 3 is a structural diagram of an instruction processing device according to an embodiment of the present application, such as Figure 3 As shown, the device comprises:

[0056] An acquisition module 302 is used to acquire a network instruction detected by a target monitoring task, wherein the network instruction is a network instruction generated by a network device, and the target monitoring task is at least used to perform risk monitoring on a login account of the network device;

[0057] A processing module 304 is used to process the network instruction according to a handling rule corresponding to the risk instruction when the network instruction is a risk instruction;

[0058] A judgment module 306 is used to judge whether the network instruction is a risky and suspicious instruction when the network instruction is a non-risky instruction;

[0059] The determination module 308 is used to determine a judgment rule corresponding to the network instruction when the judgment result indicates that the network instruction is a risky and suspicious instruction, and perform risk judgment on the network instruction according to the judgment rule.

[0060] In the processing module in the processing device of the above-mentioned instructions, the network instructions are processed according to the handling rules corresponding to the risk instructions, which specifically include the following processes: determining the life stage of the risk instructions to which the network instructions belong; when the life stage is the early life stage, rolling back the network instructions; when the life stage is the life transition period, sending the network instructions to the target object for confirmation; when the life stage is the end of life, storing the network instructions in the area to be confirmed.

[0061] In the processing module in the processing device of the above-mentioned instructions, the life stage of the risk instruction to which the network instruction belongs is determined, which specifically includes the following processes: when the network instruction enters the set area for the first time, it is determined that the network instruction is in the early stage of life; when the probability that the network instruction in the set area is a risk instruction is lower than a first threshold, it is determined that the network instruction is in the life transition period; when the duration of the network instruction in the life transition period exceeds a second threshold, it is determined that the network instruction is in the life history period; when the network instruction in the life history period continues without changing for a preset period of time, it is determined that the network instruction enters the end of life period; when the network instruction in the set area is in the life transition period and the life history period, and is hit by an alarm, it is determined that the network instruction has re-entered the early stage of life.

[0062] In the judgment module in the processing device of the above-mentioned instruction, whether the network instruction is a risky and suspicious instruction is judged, which specifically includes the following processes: obtaining a regular matching formula in the database; performing regular matching on the network instruction and the regular matching formula; when a risk keyword is matched, determining that the network instruction is a risky and suspicious instruction.

[0063] In the determination module in the processing device of the above-mentioned instruction, the judgment rule corresponding to the network instruction is determined, which specifically includes the following processes: obtaining the path depth information of the network instruction, wherein the path depth information is used to represent the information of the directory path where the network instruction is located; classifying the network instruction according to the path depth information and the judgment standard of the instruction risk depth to obtain the risk scenario category to which the network instruction belongs, wherein the judgment standard of the instruction risk depth is determined by at least the device type and depth identification of the network device; determining the judgment rule corresponding to the network instruction according to the risk scenario category to which the network instruction belongs.

[0064] In the determination module in the processing device of the above-mentioned instructions, a risk judgment is made on the network instructions according to the judgment rules, which specifically includes the following processes: when the risk scenario category is the first category, whether there is an association relationship between the network device corresponding to the network instruction and the network device that generates the alarm is monitored; when there is an association relationship, it is determined that the network instruction of the first category has a risk; when the risk scenario category is the second category, the network instruction is sent to the target object, and the judgment result returned by the target object is received, wherein the judgment result is used to indicate whether there is an association relationship between the network device corresponding to the network instruction and the network device that generates the alarm; when the judgment result indicates that there is an association relationship, it is determined that the network instruction of the second category has a risk; when the risk scenario category is the third category, the association relationship between the network device corresponding to the network instruction and the network device that generates the alarm is judged based on the correspondence relationship of historical commands, wherein the correspondence relationship of historical commands is the correspondence relationship between the network device corresponding to the historical network instruction and the network device of the historical alarm; when the risk judgment result indicates that there is an association relationship, it is determined that the network instruction of the third category has a risk.

[0065] In the processing device of the above-mentioned instructions, the device also includes a statistical module 310, which is used to store network instructions that hit risk instructions or risk-suspicious instructions in a database, and perform periodic error statistics on the target objects corresponding to the network instructions in the database to obtain error records corresponding to the target objects, wherein the error records are determined by at least one of the following: the number of network instructions in the early stage of life, the number of network instructions in the transition period of life, and the number of network instructions in the end of life; when the numerical value corresponding to the error record exceeds the third threshold, the target object corresponding to the error record is marked as a first type of user, wherein the first type of user is used to indicate that the target object is a high-risk user; when the first type of user meets the preset condition, the first type of user is marked as a second type of user, wherein the second type of user is used to indicate that the target object is a non-high-risk user, and the preset condition is that the first type of user is marked as a second type of user for a preset period of time.

[0066] It should be noted that Figure 3The processing device of the instructions shown is used to execute Figure 2 Therefore, the relevant explanations in the above instruction processing method are also applicable to the instruction processing device, which will not be repeated here.

[0067] Figure 4 is a schematic diagram of a risk instruction judgment process according to an embodiment of the present application, such as Figure 4 As shown, the operator logs in to the network device by logging in to his own account, and conducts a personnel audit on the currently logged-in operator to determine whether he is a marked user (including high-risk users or non-high-risk users), and determines whether the network instruction generated by the network device logged in by the operator is a risk instruction. In the case where it is determined that the network instruction generated by the network device logged in by the operator is not a risk instruction, it is necessary to determine whether the network instruction is a risk-suspicious instruction, that is, the network instruction is matched with the keyword regular matching formula contained in the pre-established risk instruction regular matching data model library. When the risk keyword is matched, the network instruction is characterized as a risk-suspicious instruction, otherwise, the network instruction is characterized as not a risk-suspicious instruction. If the risk keyword is matched, the path depth information of the network instruction is obtained, the path depth of the network instruction is classified, and the network instruction is classified according to the judgment standard of the path depth information and the instruction risk depth, and the risk scenario category to which the network instruction belongs is obtained. The risk scenario category includes the first category, the second category, and the third category. Different risk scenarios use different judgment principles. Specifically, the first category uses alarm association for risk judgment, the second category uses experts for risk judgment, and the third category uses big data for risk judgment. If the network instruction meets one of the above categories, it can be understood that the network instruction is a risk instruction, and then enter the risk response stage.

[0068] In the case where it is determined that the network instruction generated by the network device logged in by the operator is a risk instruction, the network instruction is processed through the risk response and disposal rules corresponding to the risk instruction. In the risk response, the life stages of the risk instructions to which the network instruction belongs are defined, including the early stage of the risk instruction life, the transition period of the risk instruction life, the historical period of the risk instruction life, and the end period of the risk instruction life. After determining the life stage of the risk instruction to which the network instruction belongs, a risk response and disposal rule is established according to the conditions satisfied by the network instruction, that is, for the early stage of the risk instruction life, the transition period of the risk instruction life, and the historical period of the risk instruction life, after the risk judgment and disposal of the network instruction according to the judgment rules, the risk personnel need to be marked and the operator's mark updated.

[0069] In the risk response phase, for each network device, a risk command regular matching data model library is built based on the device type. Account login is used as the trigger event, and the command echo text is divided into the command part and the path part:

[0070] For example:<JX-NC-XJX-BAS-3.MAN.NE40E-X16> is the shallowest directory;

[0071] [JX-NC-XJX-BAS-3.MAN.NE40E-X16] is the configuration directory;

[0072] [JX-NC-XJX-BAS-3.MAN.NE40E-X16-bgp] is the bgp configuration directory;

[0073] [JX-NC-XJX-BAS-3.MAN.NE40E-X16-bgp-CTVPN3001007-JXjianhang] is the deep directory of the VPN CTVPN3001007-JXjianhang that has entered the BGP configuration directory.

[0074] By analogy, the path part, command part and device type are combined to form a configuration command.

[0075] In the process of risk management, each instruction combination in the process of execution is matched in the risk response. If it matches the existing risk response rules, it will directly enter the risk management. If it does not match the existing risk response rules, it will determine whether the network instruction is a risk instruction.

[0076] Risk disposal combines the initial risk response, risk transition period response, and risk historical period response. The disposal methods are as follows:

[0077]

[0078]

[0079] For risk instructions that do not match the existing risk response rules, first enter the alarm judgment to determine whether the commands corresponding to this device or other involved devices have alarm associations in the time-sensitive area. If there is an alarm association, the risk instruction will enter the risk response at the beginning of its life, and the response method is as above; if there is no alarm association, enter the expert judgment. Experts judge whether the commands corresponding to this device or other involved devices have alarm associations in the time-sensitive area. If there is an alarm association, the risk instruction will enter the risk response at the beginning of its life, and the response method is as above; if there is no alarm association, enter the big data judgment. The big data judgment uses the K-Means clustering algorithm to record the command correspondence of the historical command combination (composed of the combination deposition before the end of the risk instruction), and judge whether the commands corresponding to this device or other involved devices have alarm associations in the time-sensitive area. If there is an association, enter the risk instruction at the beginning of its life, and the response method is as above. The big data records the probability of alarm formation caused by each command combination, as well as some probability density curves corresponding to each combination.

[0080] The big data matching process uses the K-Means clustering algorithm for matching, and the process is as follows:

[0081] The k in the K-Means algorithm represents the number of clusters and is interpreted as a command path. Means represents the mean of the data objects in the cluster (this mean is a description of the center of the cluster). The alarm is used as the origin and the distance is used as the standard for measuring the similarity between data objects. That is, the smaller the distance between data objects, the higher their similarity, and the more likely they are to be associated with the same cluster.

[0082] The distance calculation formula is: Where D represents the distance between data objects, (x1, y1) represents the coordinates of data 1, and (x2, y2) represents the coordinates of data 2.

[0083] Figure 5 is a schematic diagram of a risk personnel marking process according to an embodiment of the present application, Figure 5 The following steps are included:

[0084] S001: Risk personnel login operation. First, the login personnel must be a non-risk personnel (i.e., non-high-risk user). When entering the path deep classification matching stage, risk response identification is performed.

[0085] S002: When the initial stage of risk instructions is matched, the risk personnel will be marked. When this person enters the command again, he must undergo personnel identification review before the instruction can be matched again.

[0086] S003: When the risk instruction transition period is matched, the risk personnel will be marked and enter the personnel inspection and identification area. When this person enters the command again and matches the initial risk instruction, the number of times will be accumulated. Once the threshold is exceeded, personnel identification review must be carried out before the instruction can be matched again.

[0087] S004: When the end period of the risk instruction is matched, the personnel will enter the personnel inspection and identification area for audit history identification. When this person matches the specific rules in the big data verification, the risk personnel will be marked and enter the cumulative counting threshold judgment. Only when the threshold is exceeded and the personnel identification review is entered, the instruction can be entered again. At the same time, the monthly audit matching of the operator is carried out in parallel. If a match is found, it is directly defined as a risk person. This matching method is to perform monthly weighted statistics on all operators in the historical hit library. The error rate of the operator is counted according to the following weighted formula: the number of hits in the early life period * A + the number of hits in the transition period of life * B + the number of hits in the end period of life * C + the impact event * D, forming the audit work of the personnel who execute the risk instruction.

[0088] Check the table below. When the cumulative matching risk rate (or error rate) exceeds 100, it is considered a match.

[0089]

[0090] S005: Risk personnel labels will be automatically removed when a certain period of time has passed. When a person who is a manager marks a label, it must be cleared by the manager.

[0091] The following is an explanation and introduction to the command activation process of the risk instruction history period and the supplementary part of the risk instruction regular expression:

[0092] S001: If the command combination of the risk command history period is matched, the command is set to inactive and enters the 24-hour observation area for query during equipment failure processing.

[0093] S002: When a fault occurs and no alarm is displayed, it is most likely caused by manual operation. Search and query the commands in the 24-hour observation area, and the commands will be judged as related commands within 24 hours of the device.

[0094] S003: When it is found that there is a command causing a fault, this command is set to be activated and recorded.

[0095] S004: When no regular expression is matched and thus no risk instruction can be formed, the command will also be put into the 24-hour observation area and activated in real time according to the historical activation process of risk instructions. At this time, the activation risk command will be supplemented with a command set of regular expression rules.

[0096] The embodiment of the present application is triggered by regular matching of risk instructions, and is a combined method for risk response combined with deep classification of generated instructions. This combined method can be effectively applied in metropolitan area network equipment command identification and risk response. The embodiment of the present application also provides a risk personnel marking process method, which is dynamically generated by personnel when performing risk instruction matching, and statically generated in combination with the risk audit cycle. The dynamic and static methods complement each other to form timely discovery and identification of risk personnel, reducing the possibility of human error. Risk instructions are identified by the full life cycle of risk instructions, that is, the precipitation and active activation of risk instructions are formed, the dynamic update of risk instructions is increased, and a dynamic update process is formed for the regular expression of risk instructions.

[0097] An embodiment of the present application also provides a non-volatile storage medium, which includes a stored computer program, wherein a device where the non-volatile storage medium is located executes a processing method for the following instructions by running the computer program: obtaining a network instruction detected by a target monitoring task, wherein the network instruction is a network instruction generated by a network device, and the target monitoring task is at least used to perform risk monitoring on a login account of the network device; in the case where the network instruction is a risk instruction, processing the network instruction according to a handling rule corresponding to the risk instruction; in the case where the network instruction is a non-risk instruction, determining whether the network instruction is a risk-suspicious instruction; in the case where the judgment result indicates that the network instruction is a risk-suspicious instruction, determining a judgment rule corresponding to the network instruction, and performing a risk judgment on the network instruction according to the judgment rule.

[0098] The serial numbers of the above-mentioned embodiments of the present application are for description only and do not represent the advantages or disadvantages of the embodiments.

[0099] In the above embodiments of the present application, the description of each embodiment has its own emphasis. For parts that are not described in detail in a certain embodiment, please refer to the relevant description of other embodiments.

[0100] In the several embodiments provided in this application, it should be understood that the disclosed technical content can be implemented in other ways. Among them, the device embodiments described above are only schematic. For example, the division of the units can be a logical function division. There may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of units or modules, which can be electrical or other forms.

[0101] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple units. Some or all of the units may be selected according to actual needs to achieve the purpose of the present embodiment.

[0102] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0103] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application, in essence, or the part that contributes to the prior art or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions to enable a computer device (which can be a personal computer, a server or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: U disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), mobile hard disk, disk or optical disk and other media that can store program codes.

[0104] The above is only a preferred implementation of the present application. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principles of the present application. These improvements and modifications should also be regarded as the scope of protection of the present application.

Claims

1. A method for processing an instruction, characterized in that: include: Acquire a network instruction detected by a target monitoring task, wherein the network instruction is a network instruction generated by a network device, and the target monitoring task is at least used to perform risk monitoring on a login account of the network device; In the case where the network instruction is a risk instruction, processing the network instruction according to the handling rule corresponding to the risk instruction; In the case where the network instruction is a non-risk instruction, determining whether the network instruction is a risky and suspicious instruction; In the case where the judgment result indicates that the network instruction is the risky and suspicious instruction, determining a judgment rule corresponding to the network instruction, and performing risk judgment on the network instruction according to the judgment rule; Determine the judgment rule corresponding to the network instruction, including: obtaining path depth information of the network instruction, wherein the path depth information is used to represent information of the directory path where the network instruction is located; classify the network instruction according to the path depth information and the judgment standard of the instruction risk depth to obtain the risk scenario category to which the network instruction belongs, wherein the judgment standard of the instruction risk depth is determined by at least the device type and depth identification of the network device; determine the judgment rule corresponding to the network instruction according to the risk scenario category to which the network instruction belongs.

2. The method according to claim 1, characterized in that Processing the network instruction according to the handling rule corresponding to the risk instruction includes: Determine the life stage of the risk instruction to which the network instruction belongs; When the life stage is in the early stage of life, performing rollback processing on the network instruction; In the case where the life stage is a life transition period, sending the network instruction to the target object for confirmation; When the life stage is the end of life stage, the network instruction is stored in a to-be-confirmed area.

3. The method according to claim 2, characterized in that Determine the life stage of the risk instruction to which the network instruction belongs, including: When the network instruction enters the set area for the first time, determining that the network instruction is in the early stage of life; When the probability that the network instruction in the set area is the risk instruction is lower than a first threshold, determining that the network instruction is in the life transition period; When the duration of the network instruction being in the life transition period exceeds a second threshold, determining that the network instruction is in the life history period; If the network instruction in the life history period does not change for a preset period of time, determining that the network instruction enters the end of life period; In the case where a network instruction is in the life transition period and the life history period in the set area and is hit by an alarm, it is determined that the network instruction has re-entered the early life period.

4. The method according to claim 1, characterized in that: Determining whether the network instruction is a risky and suspicious instruction includes: Get the regular expression in the database; Perform regular matching on the network instruction and the regular matching formula; When the risk keyword is matched, the network instruction is determined to be the risky suspicious instruction.

5. The method according to claim 1, characterized in that Performing risk judgment on the network instruction according to the judgment rule includes: When the risk scenario category is the first category, monitoring whether the network device corresponding to the network instruction has an association relationship with the network device generating the alarm; In the case where the association relationship exists, determining that the first category of network instructions has risks; When the risk scenario category is the second category, the network instruction is sent to the target object, and a determination result returned by the target object is received, wherein the determination result is used to indicate whether there is an association relationship between the network device corresponding to the network instruction and the network device generating the alarm; If the determination result indicates that the association relationship exists, determining that the second category of network instructions has a risk; In the case where the risk scenario category is the third category, a risk determination is performed on the association relationship between the network device corresponding to the network instruction and the network device generating the alarm according to the correspondence relationship of the historical commands, wherein the correspondence relationship of the historical commands is the correspondence relationship between the network device corresponding to the historical network instruction and the network device generating the historical alarm; When the risk determination result indicates that the association relationship exists, it is determined that the network instructions of the third category exist risks.

6. The method according to claim 2, characterized in that After performing risk judgment on the network instruction according to the judgment rule, the method further includes: The network instructions that hit the risk instructions or the risky suspicious instructions are stored in a database, and periodic error statistics are performed on the target objects corresponding to the network instructions in the database to obtain error records corresponding to the target objects, wherein the error records are determined by at least one of the following: the number of network instructions in the early stage of the life cycle, the number of network instructions in the transition period of the life cycle, and the number of network instructions in the end of the life cycle; When the value corresponding to the error record exceeds a third threshold, marking the target object corresponding to the error record as a first type of user, wherein the first type of user is used to indicate that the target object is a high-risk user; When the first category of users meets a preset condition, the first category of users is marked as a second category of users, wherein the second category of users is used to indicate that the target object is a non-high-risk user, and the preset condition is that the first category of users is marked as the second category of users for a preset period of time.

7. A device for processing instructions, characterized in that: include: An acquisition module, used for acquiring a network instruction detected by a target monitoring task, wherein the network instruction is a network instruction generated by a network device, and the target monitoring task is at least used for risk monitoring of a login account of the network device; a processing module, configured to process the network instruction according to a handling rule corresponding to the risk instruction when the network instruction is a risk instruction; A judgment module, used for judging whether the network instruction is a risky and suspicious instruction when the network instruction is a non-risky instruction; A determination module, configured to determine a judgment rule corresponding to the network instruction when the judgment result indicates that the network instruction is the risky and suspicious instruction, and perform risk judgment on the network instruction according to the judgment rule; The determination module is also used to obtain path depth information of the network instruction, wherein the path depth information is used to represent information of the directory path where the network instruction is located; classify the network instruction according to the path depth information and the judgment standard of the instruction risk depth to obtain the risk scenario category to which the network instruction belongs, wherein the judgment standard of the instruction risk depth is determined by at least the device type and depth identification of the network device; determine the judgment rule corresponding to the network instruction according to the risk scenario category to which the network instruction belongs.

8. An electronic device, characterized in that: include: A memory for storing program instructions; A processor is connected to the memory and is used to execute program instructions that implement the following functions: obtaining a network instruction detected by a target monitoring task, wherein the network instruction is a network instruction generated by a network device, and the target monitoring task is at least used to perform risk monitoring on a login account of the network device; in a case where the network instruction is a risk instruction, processing the network instruction according to a handling rule corresponding to the risk instruction; in a case where the network instruction is a non-risk instruction, determining whether the network instruction is a risk-suspicious instruction; in a case where the judgment result indicates that the network instruction is the risk-suspicious instruction, determining a judgment rule corresponding to the network instruction, and performing risk judgment on the network instruction according to the judgment rule; determining the judgment rule corresponding to the network instruction, including: obtaining path depth information of the network instruction, wherein the path depth information is used to represent information of a directory path where the network instruction is located; classifying the network instruction according to the path depth information and a judgment standard of the instruction risk depth, and obtaining a risk scenario category to which the network instruction belongs, wherein the judgment standard of the instruction risk depth is at least determined by a device type and a depth identifier of the network device; determining a judgment rule corresponding to the network instruction according to the risk scenario category to which the network instruction belongs.

9. A non-volatile storage medium, characterized in that: The non-volatile storage medium includes a stored computer program, wherein the device where the non-volatile storage medium is located executes the instruction processing method described in any one of claims 1 to 6 by running the computer program.

Images