A method and device for detecting high-risk instructions

Abstract

The present application discloses a method and device for detecting high-risk instructions, which relates to the field of computer technology and solves the problem that when an operation instruction of a data communication device is detected as a high-risk instruction, the operation instruction is directly prohibited, resulting in an excessively high misjudgment rate of the operation instruction of the data communication device. The method for detecting high-risk instructions comprises: obtaining an operation instruction of the data communication device; the operation instruction comprises: an instruction parameter; determining that the instruction parameter belongs to a high-risk instruction parameter; determining that the instruction parameter does not belong to an authorized high-risk instruction parameter; generating an early warning message; the early warning message is used to prompt that the operation instruction is an unauthorized high-risk instruction.

Description

Technical Field

[0001] The present invention relates to the field of computer technology, and in particular to a method and device for detecting high-risk instructions. Background Art

[0002] With the rapid development of the fifth generation mobile communication technology (5G), the number of operation instructions for data communication devices in the 5G mobile core network using service-based architecture (SBA) has increased exponentially. When using these operation instructions to configure data communication devices, since there may be high-risk instructions in the operation instructions, if the high-risk instructions are directly executed, it will affect the operation of the data communication devices and bring huge network risks to the entire core network, threatening network security and causing irreparable economic losses.

[0003] The current management method for the operation instructions of data communication equipment is to detect the operation instructions before they are executed. When an operation instruction of the data communication equipment is detected to be a high-risk instruction, the operation instruction is directly prohibited to prevent the data communication equipment from executing it, or the operation instruction is submitted to the manual review system for manual review to see whether the operation instruction can be authorized for execution. Summary of the invention

[0004] The present invention provides a high-risk instruction detection method and device for solving the problem that when a management system detects that an operation instruction of a data communication device is a high-risk instruction, the management system directly prohibits the operation instruction, resulting in an excessively high misjudgment rate of the operation instruction of the data communication device.

[0005] In order to achieve the above object, the present invention adopts the following technical scheme:

[0006] In the first aspect, the present invention provides a method for detecting high-risk instructions, which is applied to a management system, wherein a management list is established in the management system, and the management list is used to store device information of data communication devices, wherein the device information includes: operation instructions of the data communication devices, and the method includes: obtaining operation instructions of the data communication devices; the operation instructions include: instruction parameters. Determining that the instruction parameters belong to high-risk instruction parameters, determining that the instruction parameters do not belong to authorized high-risk instruction parameters, and generating warning information; the warning information is used to prompt that the operation instruction is an unauthorized high-risk instruction.

[0007] The high-risk instruction detection method provided in the present application can determine that the operation instruction of the data communication device is an unauthorized high-risk instruction by determining that the instruction parameters of the operation instruction are high-risk instruction parameters and that the instruction parameters are not authorized high-risk instruction parameters after the instruction management device obtains the operation instruction of the data communication device. Warning information is generated to indicate that the operation instruction is an unauthorized high-risk instruction, so as to remind the user that the operation instruction is an unauthorized high-risk instruction that affects the operation of the data communication device, and to issue a warning for the unauthorized high-risk instruction in advance to avoid accidents with the data communication device.

[0008] In one possible implementation, a high-risk instruction library is also established in the management system, and high-risk instruction parameters are stored in the high-risk instruction library. Determining whether the instruction parameters are high-risk instruction parameters includes: obtaining the high-risk instruction parameters in the high-risk instruction library, and judging whether the instruction parameters are high-risk instruction parameters; determining that the instruction parameters are not authorized high-risk instruction parameters includes: obtaining a work order with an authorization status of authorized in the work order approval system; parsing the work order to determine the authorized high-risk instruction parameters; the work order approval system is used to store the work order; and using the authorized high-risk instruction parameters to judge whether the instruction parameters are authorized high-risk instruction parameters.

[0009] In a possible implementation, the high-risk instruction detection method provided in the present application further includes: determining that the instruction parameter does not belong to the high-risk instruction parameter, and executing the operation instruction.

[0010] In a possible implementation, the high-risk instruction detection method provided in the present application further includes: determining that the instruction parameters belong to authorized high-risk instruction parameters, and executing the operation instruction.

[0011] In one possible implementation, the high-risk instruction detection method provided in the present application also includes: receiving device information reported by the data communication device; the device information also includes one or more of the following information: the name of the data communication device, the address of the data communication device, and the type of the data communication device; according to the device information, updating the management list in the management system.

[0012] In the second aspect, the present invention provides a high-risk instruction detection device, which is applied to a management system. A management list is established in the management system. The management list is used to store device information of data communication equipment. The device information includes: operation instructions of the data communication equipment. The device includes: an acquisition module, a processing module, and a generation module.

[0013] The acquisition module is used to acquire the operation instructions of the data communication device; the operation instructions include: instruction parameters.

[0014] The processing module is used to determine whether the instruction parameter belongs to a high-risk instruction parameter; and determine whether the instruction parameter does not belong to an authorized high-risk instruction parameter.

[0015] A generation module generates warning information; the warning information is used to prompt that the operation instruction is an unauthorized high-risk instruction.

[0016] In one possible implementation, a high-risk instruction library is also established in the management system, and high-risk instruction parameters are stored in the high-risk instruction library. The acquisition module is also used to obtain work orders with an authorization status of authorized in the work order approval system; the processing module is specifically used to obtain high-risk instruction parameters in the high-risk instruction library, and determine whether the instruction parameters belong to high-risk instruction parameters; after the acquisition module obtains the work order with an authorization status of authorized in the work order approval system, the work order is parsed to determine the authorized high-risk instruction parameters; the work order approval system is used to store authorized work orders; and the authorized high-risk instruction parameters are used to determine whether the instruction parameters belong to authorized high-risk instruction parameters.

[0017] In a possible implementation, the high-risk instruction detection device provided in the present application further includes: an execution module, which is used to execute the operation instruction after the processing module determines that the instruction parameter does not belong to the high-risk instruction parameter.

[0018] In a possible implementation, the execution module is further configured to execute the operation instruction after the processing module determines that the instruction parameter is an authorized high-risk instruction parameter.

[0019] In a possible implementation, the high-risk instruction detection device provided in the present application further includes: a receiving module and an updating module.

[0020] The receiving module is used to receive device information reported by the data communication device; the device information also includes one or more of the following information: the name of the data communication device, the address of the data communication device, and the type of the data communication device.

[0021] The update module is used to update the management list in the management system according to the device information.

[0022] In a third aspect, an instruction management device is provided, which has the function of implementing the detection method of high-risk instructions described in the first aspect or any possible implementation method. The function can be implemented by hardware, or by hardware executing corresponding software. The hardware or software includes one or more modules corresponding to the above functions.

[0023] In a fourth aspect, a computer-readable storage medium is provided, in which instructions are stored. When the computer-readable storage medium is run on a computer, the computer can execute the method for detecting high-risk instructions described in the first aspect or any possible implementation method.

[0024] In a fifth aspect, a computer program product comprising instructions is provided, which, when executed on a computer, enables the computer to execute the method for detecting high-risk instructions as described in the first aspect or any possible implementation manner.

[0025] Among them, the technical effects brought about by any design method in the third to fifth aspects can refer to the technical effects brought about by different possible implementation methods in the first aspect, and will not be repeated here.

[0026] For the specific description of the second to fifth aspects and their various implementations in the present application, reference may be made to the detailed description in the first aspect and its various implementations; and for the beneficial effects of the second to fifth aspects and their various implementations, reference may be made to the beneficial effects analysis in the first aspect and its various implementations, which will not be repeated here.

[0027] These and other aspects of the present application will become more apparent from the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0028] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0029] Figure 1 An architectural diagram of a high-risk instruction detection system provided in an embodiment of the present application;

[0030] Figure 2 A schematic diagram of the structure of the instruction management device provided in the embodiment of the present application;

[0031] Figure 3 A system schematic diagram of the management system provided in the embodiment of the present application;

[0032] Figure 4 A schematic diagram of a management list provided in an embodiment of the present application;

[0033] Figure 5 A schematic diagram of an instruction list provided in an embodiment of the present application;

[0034] Figure 6 A schematic diagram of a high-risk instruction library provided in an embodiment of the present application;

[0035] Figure 7 A flowchart of a method for detecting high-risk instructions provided in an embodiment of the present application;

[0036] Figure 8A schematic diagram of a work order approval system provided in an embodiment of the present application;

[0037] Fig. 9 Another flowchart of a high-risk instruction detection method provided in an embodiment of the present application;

[0038] Fig.10 A specific example diagram of a high-risk instruction detection method provided in an embodiment of the present application;

[0039] Fig.11 A structural schematic diagram of a high-risk instruction detection device provided in an embodiment of the present application;

[0040] Fig.12 Another structural schematic diagram of a high-risk instruction detection device provided in an embodiment of the present application;

[0041] Fig.13 A structural diagram of an instruction management device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0042] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0043] The terms "first" and "second" are used for descriptive purposes only and should not be understood as indicating or implying relative importance or implicitly indicating the number of the indicated technical features. Thus, a feature defined as "first" or "second" may explicitly or implicitly include one or more of the features. In the description of the present invention, unless otherwise specified, "plurality" means two or more.

[0044] In addition, the network architecture and business scenarios described in the embodiments of the present application are intended to more clearly illustrate the technical solutions of the embodiments of the present application, and do not constitute a limitation on the technical solutions provided in the embodiments of the present application. Ordinary technicians in this field can know that with the evolution of network architecture and the emergence of new business scenarios, the technical solutions provided in the embodiments of the present application are also applicable to similar technical problems.

[0045] In order to facilitate understanding, the terms designed in this application are first explained.

[0046] High-risk instructions refer to operation instructions that may cause significant network risks when executed on data communication devices. For example, high-risk instructions may include: reboot instructions to restart the system, remove instructions to delete one or more files or directories, etc.

[0047] Data communication equipment, whose full name is data communication equipment, refers to the general term for switching equipment, transmission equipment and terminal equipment in data communication systems, such as switches, routers, etc.

[0048] At present, when the instruction management device detects that the operation instruction of the data communication device is a high-risk instruction, it directly prohibits the operation instruction without considering whether the operation instruction is an authorized operation instruction, resulting in the need to repeatedly review the authorized operation instructions, and the management efficiency is too low. Based on this, the present application provides a detection method and device for high-risk instructions. After the instruction management device obtains the operation instruction of the data communication device, by determining that the instruction parameters of the operation instruction belong to the high-risk instruction parameters, and the instruction parameters do not belong to the authorized high-risk instruction parameters, it can be determined that the operation instruction is an unauthorized high-risk instruction, and generate warning information for prompting that the operation instruction is an unauthorized high-risk instruction, so as to warn the unauthorized high-risk instructions in advance and avoid accidents of the data communication equipment.

[0049] The implementation of the embodiments of the present application will be described in detail below with reference to the accompanying drawings.

[0050] The solution provided in this application can be applied to Figure 1 In the high-risk instruction detection system 100 shown in FIG. Figure 1 As shown, the high-risk instruction detection system includes an instruction management device 101 and multiple data communication devices 102.

[0051] The data communication device 102 is used to carry the operation instructions of the data communication device, which can be configured by the user according to the business requirements. The data communication device 102 can be a router, a switch or other data communication device, and the embodiment of the application does not limit the type and function of the data communication device 102.

[0052] The instruction management device 101 may be a centralized control device of the data communication device 102 in the detection system 100 for high-risk instructions, or may be a third-party server or others.

[0053] It should be noted that the number of data communication devices 102 included in the high-risk instruction detection system 100 can be configured according to actual needs. Figure 1 This is only for illustration and is not a specific limitation on the scale of the high-risk instruction detection system 100 .

[0054] The solution provided in this application can be applied to Figure 2In the illustrated instruction management device 101, the instruction management device 101 can be deployed in Figure 1 In the high-risk instruction detection system 100 shown, the instruction management device 101 can be a computer, a switch, a router or other product forms, which are not specifically limited. The instruction management device 101 includes: a processor 201 and a memory 202.

[0055] Among them, the processor 201 can be a central processing unit (CPU), and the processor 201 can also be other general-purpose processors, digital signal processors (DSP), application specific integrated circuits (ASIC), field-programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components and other chips, or a combination of the above-mentioned chips.

[0056] The memory 202 may be a volatile memory, such as a random-access memory (RAM); or a non-volatile memory, such as a read-only memory (ROM), a flash memory, a hard disk drive (HDD) or a solid-state drive (SSD); or a combination of the above types of memories, for storing applications, configuration files, data information or other content that can implement the method of the present application.

[0057] The processor 201 performs the following functions by running or executing software programs and / or modules stored in the memory 202 and calling data stored in the memory 202:

[0058] An operation instruction of a data communication device is obtained, and after determining that an instruction parameter of the operation instruction is a high-risk instruction parameter and determining that the instruction parameter is not an authorized high-risk instruction parameter, a warning message is generated to indicate that the operation instruction is an unauthorized high-risk instruction.

[0059] The solution provided in this application can be applied to Figure 3 In the illustrated management system 300, the management system 300 can be deployed in Figure 1The instruction management device 101 is shown. A management list 301 and a high-risk instruction library 302 are established in the management system 300. Among them, an instruction list 303 is established in the management list.

[0060] For example, Figure 4 The figure shows a management list 301 established in the management system 300 for storing device information of data communication devices.

[0061] Among them, the device information may include the name of the data communication device, the address of the data communication device, the type of the data communication device, the operating user who operates the data communication device, the operating instructions of the data communication device, the operating status and other information, which is not limited in this application.

[0062] Exemplarily, the managed list 301 may include multiple lists, one list corresponding to the device information of a data communication device. A list in the managed list 301 may include the name of the data communication device, the address of the data communication device, and the type of the data communication device.

[0063] It should be noted that a list in the management list may include the name of the above-mentioned data communication device, the address of the data communication device, the type of the data communication device, and may also include device information such as the management group to which the data communication device belongs and the creation time of the data communication device. This application does not limit this.

[0064] Further, such as Figure 5 As shown, in the list included in the management list 301, a device instruction list 303 is also established under the list. Each instruction list 303 includes the operating user who operates the data communication device, the operation instruction of the data communication device, and the operation status.

[0065] It should be noted that each instruction list 303 may include the above-mentioned operating user who operates the data communication device, the operating instructions of the data communication device, and the operating status, and may also include device information such as the device name of the data communication device, the address of the data communication device, and the operation time. This application does not limit this.

[0066] For example, Figure 6 As shown, a high-risk instruction library 302 for storing high-risk instructions of data communication equipment is also established in the management system 300.

[0067] The high-risk instruction of the data communication device may be a user-defined high-risk instruction, which may include an operation instruction, instruction parameters, and may also include the authorization status of the high-risk instruction, the creation time of the high-risk instruction, etc., which is not limited in this application.

[0068] It should be noted that the above Figure 3 Schematic management system, Figure 4 Schematic list of management, Figure 5 A schematic list of instructions and Figure 6 The illustrated high-risk instruction library is only an example of the application scenario of the present application solution, and is not a limitation of the application scenario of the present application solution.

[0069] On the one hand, the present application discloses a method for detecting high-risk instructions, which can be executed by an instruction management device, for example, Figure 2 The instruction management device 101 shown in FIG. Figure 7 As shown, the method may include the following steps:

[0070] S701, the instruction management device obtains the operation instruction of the data communication device.

[0071] The operation instruction of the instruction management device includes instruction parameters.

[0072] Exemplarily, the process of determining the operation instructions of the data communication device may be as follows: when the user needs to configure the operation of the data communication device, the user may select a suitable instruction according to the configuration requirements and configure specific instruction parameters to generate the operation instructions of the data communication device in the data communication device.

[0073] For example, when a user needs to restart a data communication device, the user selects a reboot operation instruction on the data communication device and configures reboot instruction parameters, and finally a reboot instruction is generated in the data communication device.

[0074] Further, after the data communication device determines the operation instruction of the data communication device, the instruction management device may receive the operation instruction of the data communication device sent by the data communication device through a communication connection with the data communication device.

[0075] Exemplarily, the communication process between the instruction management device and the data communication device may be that the data communication device actively reports the operation instructions of the data communication device, or after the instruction management device requests the operation instructions of the data communication device, the data communication device responds to the request sent by the instruction management device and sends the operation instructions of the data communication device to the instruction management device. The embodiments of the present application are not limited to this.

[0076] S702: The instruction management device determines that the instruction parameters are high-risk instruction parameters.

[0077] Exemplarily, after obtaining the operation instruction of the data communication device, the instruction management device extracts the instruction parameter in the operation instruction and compares the instruction parameter with the above-mentioned Figure 5 The command parameters in the illustrated high-risk command library are compared to determine whether the command parameters of the data communication device are high-risk command parameters.

[0078] S703: The instruction management device determines that the instruction parameters do not belong to authorized high-risk instruction parameters.

[0079] Specifically, after the instruction management device determines in the above S702 that the instruction parameter of the operation instruction of the data communication device is a high-risk instruction parameter, the instruction management device will compare the instruction parameter with the instruction parameter in the work order approval system.

[0080] Among them, Figure 8 The figure shows a specific example of a work order approval system 801. The work order approval system 801 may include the work order number of the work order, all the operation instructions in the work order corresponding to each work order, and the authorization status of the instructions in the work order. At the same time, the work order approval system 801 stores all the high-risk instructions of the work order and the instruction parameters of the high-risk instructions under each work order.

[0081] It should be noted that the work order approval system 801 may include the work order number of the above-mentioned work order, the authorization status of the work order, and may also include the work order number, work order title, work order creation time, feedback deadline, scheduling function, professional domain, applicant, department to which the applicant belongs, the urgency of the work order, whether the work order affects the business and other information, which is not limited in this application.

[0082] Exemplarily, after determining that the instruction parameters of the operating instructions of the data communication device are high-risk instruction parameters, the instruction management device will parse the work order with the authorization status of authorized in the work order approval system, obtain the high-risk instruction parameters under the work order, and compare the instruction parameters of the operating instructions of the data communication device with the high-risk instruction parameters of the authorized work order to determine whether the instruction parameters of the operating instructions of the data communication device are authorized high-risk instruction parameters.

[0083] S704, instructing the management device to generate warning information.

[0084] Among them, the early warning information is used to prompt that the operation instruction of the data communication equipment is an unauthorized high-risk instruction.

[0085] Exemplarily, after determining that the instruction parameter of the operation instruction of the data communication device is a high-risk instruction parameter, and the instruction parameter of the operation instruction of the data communication device is not an authorized high-risk instruction parameter, the instruction management device generates warning information for prompting that the operation instruction of the data communication device is an unauthorized high-risk instruction. Then, the instruction management device can send the warning information to the user to remind the user that the operation instruction of the data communication device is an unauthorized high-risk instruction.

[0086] It should be noted that the instruction management device can send warning information to the user through software or text messages, or it can send a buzzer to remind the user after determining that the instruction parameters of the operation instruction of the data communication device are high-risk instruction parameters and that the instruction parameters of the operation instruction of the data communication device are not authorized high-risk instruction parameters. This application is not limited to this.

[0087] The solution provided by the present application, after obtaining the operation instruction of the data communication equipment, determines that the instruction parameters of the operation instruction are high-risk instruction parameters, and that the instruction parameters of the operation instruction are not authorized high-risk instruction parameters, then the operation instruction can be determined to be an unauthorized high-risk instruction, and generate a warning message, indicating that executing the operation instruction may cause an accident in the operation of the data communication equipment, and issues a warning in advance for unauthorized high-risk instructions to avoid accidents in the data communication equipment.

[0088] Furthermore, in the following cases, the instruction management device may allow the data communication device to execute the operation instruction:

[0089] Case 1: In S702, the instruction management device determines that the instruction parameter does not belong to a high-risk instruction parameter.

[0090] Case 2: In S702, the instruction management device determines that the instruction parameter is a high-risk instruction parameter, and in S703, the instruction management device determines that the instruction parameter is an authorized high-risk instruction parameter.

[0091] Furthermore, in order to obtain the operation instructions of the data communication equipment in real time, the data communication equipment needs to be managed in the management system. Fig. 9 As shown, the method provided in the embodiment of the present application may further include: S705, S706.

[0092] S705, instructing the management device to receive device information reported by the data communication device.

[0093] The device information also includes one or more of the following information: the name of the data communication device, the address of the data communication device, and the type of the data communication device.

[0094] Exemplarily, the data communication device reports the device information of the data communication device to the instruction management device through the communication connection between the data communication device and the instruction management device.

[0095] S706, instructing the management device to update the management list in the management system according to the device information.

[0096] Exemplarily, after receiving the device information of the data communication device reported by the data communication device, the instruction management device adds the name, address and type of the data communication device to the management list of the instruction management device. The management list may be as described above. Figure 4 shown.

[0097] The solution of the present application is described in detail below through specific examples.

[0098] For example, Fig.10 The diagram shows a scenario example of a high-risk instruction detection method provided by the present application. The instruction management device receives device information reported by all data communication devices, and uses the device information to update the management list of the management system of the instruction management device. When a user needs to restart a data communication device, a reboot operation instruction is initiated on the data communication device, and the instruction parameter of the operation instruction is reboot. At this time, the instruction management device obtains the instruction parameter reboot of the operation instruction on the management system, and compares the operation instruction with the above Figure 6 The high-risk instructions in the high-risk instruction library are compared to determine whether the instruction parameter reboot of the operation instruction belongs to the high-risk instruction parameter recorded in the high-risk instruction library. At the same time, the instruction management device uses an infinite loop to monitor and obtain the operation instructions of the data communication device connected to the instruction management device in real time, and instructs the above-mentioned operation instruction to be compared with the high-risk instructions in the high-risk instruction library to determine whether the instruction parameter of the operation instruction belongs to the high-risk instruction parameter recorded in the high-risk instruction library.

[0099] Further, the instruction management device makes a further judgment on the instruction, by comparing the instruction parameter reboot with the above Figure 8 The instruction parameters of the work order approval system are compared to determine that the instruction parameter reboot of the operation instruction is an unauthorized instruction parameter in the work order approval system. The instruction management system generates an early warning message and sends the early warning message to the user in real time, indicating that the operation instruction is an unauthorized high-risk instruction, thereby realizing an early warning of the unauthorized high-risk instruction.

[0100] The above mainly introduces the solution provided by the embodiment of the present application from the perspective of the working principle of the device. It is understandable that, in order to realize the above functions, the computing device includes a hardware structure and / or software module corresponding to each function. Those skilled in the art should easily realize that, in combination with the algorithm steps of each example described in the embodiments disclosed herein, the present application can be implemented in the form of hardware or a combination of hardware and computer software. Whether a function is executed in the form of hardware or computer software driving hardware depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0101] The embodiment of the present application can divide the computing device into functional modules according to the above method example. For example, each functional module can be divided according to each function, or two or more functions can be integrated into one processing module. The above integrated module can be implemented in the form of hardware or in the form of software functional modules. It should be noted that the division of modules in the embodiment of the present application is schematic and is only a logical function division. There may be other division methods in actual implementation.

[0102] In the case of dividing each functional module into corresponding functional modules, Fig.11 A possible schematic diagram of the composition of the high-risk instruction detection device involved in the above-mentioned embodiments is shown. Fig.11 As shown, the high-risk instruction detection device 1100 may include: an acquisition module 1101 , a processing module 1102 , and a generation module 1103 .

[0103] The acquisition module 1101 is used to support the detection device 1100 of high-risk instructions to execute Figure 7 or Fig. 9 S701 in the high-risk instruction detection method shown.

[0104] Processing module 1102, used to support the detection device 1100 of high-risk instructions to execute Figure 7 or Fig. 9 S702 and S703 in the high-risk instruction detection method shown.

[0105] Generating module 1103, used to support the detection device 1100 of high-risk instructions to execute Figure 7 or Fig. 9 S704 in the high-risk instruction detection method shown.

[0106] In the embodiments of the present application, further, Fig.12 As shown, the high-risk instruction detection device 1100 may further include: an execution module 1104 , a receiving module 1105 , and an update module 1106 .

[0107] The execution module 1104 is used to support the step of the high-risk instruction detection device 1100 executing the operation instruction of the data communication device.

[0108] Receiving module 1105, used to support the detection device 1100 of high-risk instructions to execute Fig. 9 S705 in the high-risk instruction detection method shown.

[0109] Update module 1106, used to support the detection device 1100 of high-risk instructions to execute Fig. 9 S706 in the high-risk instruction detection method shown.

[0110] It should be noted that all relevant contents of each step involved in the above method embodiment can be referred to the functional description of the corresponding functional module and will not be repeated here.

[0111] The high-risk instruction detection device 1100 provided in the embodiment of the present application is used to execute the above-mentioned high-risk instruction detection method, and thus can achieve the same effect as the above-mentioned high-risk instruction detection method.

[0112] The present application embodiment also provides an instruction management device 1300, such as Fig.13 As shown, the instruction management device 1300 may include a memory 1301, a processor 1302, and a transceiver 1303, wherein the memory 1301 and the processor 1302 may be connected via a bus or a network or other means. Fig.13 The example of connecting through bus is taken in the following.

[0113] The processor 1302 may be a central processing unit (CPU). The processor 1302 may also be other general-purpose processors, digital signal processors (DSP), application specific integrated circuits (ASIC), field-programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, or a combination of the above chips.

[0114] Memory 1301 may be a volatile memory, such as a random-access memory (RAM); or a non-volatile memory, such as a read-only memory (ROM), a flash memory, a hard disk drive (HDD) or a solid-state drive (SSD); or a combination of the above types of memories, used to store application code, configuration files, data information or other content that can implement the method of the present application.

[0115] The memory 1301 is a non-transitory computer-readable storage medium that can be used to store non-transitory software programs, non-transitory computer executable programs and modules, such as the metadata acquisition module in the embodiment of the present application. The processor 1302 executes various functional applications and data processing of the processor by running the non-transitory software programs, instructions and modules stored in the memory 1301.

[0116] The memory 1301 may include a program storage area and a data storage area, wherein the program storage area may store an operating system, an application required by at least one function; the data storage area may store data created by the processor 1302, etc. In addition, the memory 1301 may include a high-speed random access memory, and may also include a non-transitory memory, such as at least one disk storage device, a flash memory device, or other non-transitory solid-state storage device. In some embodiments, the memory 1301 may optionally include a memory remotely arranged relative to the processor 1302, and these remote memories may be connected to the processor 1302 via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0117] The transceiver 1303 is used for information exchange between the instruction management device 1300 and other devices.

[0118] The one or more modules are stored in the memory 1301, and when executed by the processor 1302, the following is performed: Figure 7 or Fig. 9 The method for detecting high-risk instructions in the illustrated embodiment.

[0119] An embodiment of the present application also provides a computer-readable storage medium having instructions stored thereon, which, when executed, execute the high-risk instruction detection method and related steps in the above method embodiment.

[0120] Through the description of the above implementation methods, technical personnel in the relevant field can clearly understand that for the convenience and simplicity of description, only the division of the above-mentioned functional modules is used as an example. In actual applications, the above-mentioned functions can be assigned to different functional modules as needed, that is, the internal structure of the device can be divided into different functional modules to complete all or part of the functions described above.

[0121] In the several embodiments provided in the present application, it should be understood that the disclosed devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of the modules or units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another device, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0122] The units described as separate components may or may not be physically separated, and the components shown as units may be one physical unit or multiple physical units, that is, they may be located in one place or distributed in multiple different places. Some or all of the units may be selected according to actual needs to achieve the purpose of the present embodiment.

[0123] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0124] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a readable storage medium. Based on this understanding, the technical solution of the embodiment of the present application is essentially or the part that contributes or all or part of the technical solution can be embodied in the form of a software product, which is stored in a storage medium, including several instructions to enable a device (which can be a single-chip microcomputer, chip, etc.) or a processor (processor) to perform all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read only memory (ROM), random access memory (RAM), disk or optical disk and other media that can store program code.

[0125] The above contents are only specific implementation methods of the present application, but the protection scope of the present application is not limited thereto. Any changes or substitutions within the technical scope disclosed in the present application shall be included in the protection scope of the present application. Therefore, the protection scope of the present application shall be subject to the protection scope of the claims.

Claims

1. A method for detecting high-risk instructions, characterized in that: Applied to a management system, a management list is established in the management system, and the management list is used to store device information of data communication devices, the device information includes: operation instructions of the data communication devices, and the method includes: Obtaining an operation instruction of the data communication device; the operation instruction includes: an instruction parameter; Determining that the instruction parameters are high-risk instruction parameters; Determining that the instruction parameter does not belong to an authorized high-risk instruction parameter; Generate warning information; the warning information is used to indicate that the operation instruction is an unauthorized high-risk instruction; The management system also establishes a high-risk instruction library, which stores high-risk instruction parameters. Determining that the instruction parameter is a high-risk instruction parameter includes: Obtaining high-risk instruction parameters in the high-risk instruction library, and determining whether the instruction parameters belong to high-risk instruction parameters; Determining that the instruction parameter does not belong to an authorized high-risk instruction parameter includes: Get the work order with the authorization status of authorized in the work order approval system; Parsing the work order to determine the authorized high-risk instruction parameters; the work order approval system is used to store the work order; Using the authorized high-risk instruction parameters, determining whether the instruction parameters belong to authorized high-risk instruction parameters; Determining that the instruction parameter does not belong to the high-risk instruction parameter, and executing the operation instruction; Determining that the instruction parameter belongs to the authorized high-risk instruction parameter, and executing the operation instruction; Receive device information reported by the data communication device; the device information also includes: the name of the data communication device, the address of the data communication device, the type of the data communication device, the management group to which the data communication device belongs, and the creation time of the data communication device; According to the device information, the management list in the management system is updated.

2. A high-risk instruction detection device, characterized in that: Applied to a management system, a management list is established in the management system, and the management list is used to store device information of data communication devices, the device information includes: operation instructions of the data communication devices, and the device includes: The acquisition module is used to acquire the operation instruction of the data communication device; the operation instruction includes: instruction parameters; A processing module, used to determine that the instruction parameter belongs to a high-risk instruction parameter; determine that the instruction parameter does not belong to an authorized high-risk instruction parameter; A generating module generates warning information; the warning information is used to indicate that the operation instruction is an unauthorized high-risk instruction; The management system also establishes a high-risk instruction library, which stores high-risk instruction parameters. The acquisition module is also used to acquire the work order with the authorization status as authorized in the work order approval system; The processing module is specifically used to obtain the high-risk instruction parameters in the high-risk instruction library and determine whether the instruction parameters belong to high-risk instruction parameters; after the acquisition module obtains the work order with the authorization status as authorized in the work order approval system, the work order is parsed to determine the authorized high-risk instruction parameters; the work order approval system is used to store authorized work orders; using the authorized high-risk instruction parameters, it is determined whether the instruction parameters belong to the authorized high-risk instruction parameters; an execution module, configured to execute the operation instruction after the processing module determines that the instruction parameter does not belong to the high-risk instruction parameter; The execution module is further configured to execute the operation instruction after the processing module determines that the instruction parameter belongs to the authorized high-risk instruction parameter; A receiving module, configured to receive device information reported by the data communication device; the device information further includes: the name of the data communication device, the address of the data communication device, the type of the data communication device, the management group to which the data communication device belongs, and the creation time of the data communication device; An updating module is used to update the management list in the management system according to the device information.

3. An instruction management device, characterized in that: include: at least one processor; And a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor executes the high-risk instruction detection method as described in claim 1.

4. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the method for detecting high-risk instructions as claimed in claim 1 is implemented.

Images