Risk detection method and computer device

Abstract

The application discloses a risk detection method and computer equipment, and relates to the computer field. The method comprises the following steps: receiving an operation instruction issued by a user, determining the risk degree of the operation according to the relationship between the operation and the risk degree before processing the operation instruction, and processing the operation according to the risk degree of the operation. Since the risk degree of the operation and the processing result are determined according to the early warning rule before the operation issued by the user is processed, the risk identification logic can be decoupled from the application program, the risk detection of the operation in the application program execution process can be avoided, the complexity of the application program can be avoided, and the operation with the security risk to the server can be detected more quickly. Since the operation can be an operation on any one application program in the server, the application can also simultaneously detect the risks of different application programs, thereby reducing the occupancy of the server memory and improving the execution efficiency of the application program.

Description

Technical Field

[0001] This application relates to the field of computer technology, and in particular to a risk detection method and computer equipment. Background Technology

[0002] The server has a risk identification function, capable of detecting access requests that could attack the server. Typically, the risk identification logic is embedded within the application. However, this high coupling between the risk identification logic and the application makes it difficult to flexibly adjust the logic, complicates application execution, and complicates the process of detecting potentially dangerous access requests. Therefore, how to detect attacking access requests more quickly is a pressing problem that needs to be solved. Summary of the Invention

[0003] This application provides a risk detection method and computer device, which solves the urgent problem of how to detect access requests that are intended to attack servers more quickly.

[0004] Firstly, a risk detection method is provided, which includes: receiving an operation instruction issued by a user, determining the risk level of the operation according to a warning rule before processing the operation instruction, and processing the operation according to the risk level of the operation.

[0005] By determining the risk level and processing outcome of user-issued operation instructions based on early warning rules before processing them, the risk identification logic can be decoupled from the application. This avoids the complexity of performing risk detection on operation instructions during application execution and allows for faster detection of operation instructions that pose security risks to the server. Since operation instructions can be directed at any application on the server, this application can also perform risk detection on different applications simultaneously, thereby reducing server memory usage and improving application execution efficiency.

[0006] In conjunction with the first aspect, in one possible implementation, the risk level of an operation is determined based on the operation string of the operation instruction and / or dynamic parameters.

[0007] By converting user-issued operations into operation strings or dynamic parameters, the risk level of the operation can be determined more accurately based on the warning rules.

[0008] In conjunction with the first aspect, in another possible implementation, when the first list in the warning rules contains an operation string and / or dynamic parameters, the risk level of the operation is level one, which can be used to indicate a high risk level.

[0009] Since high-risk operations can cause server attacks that alter or lose data, operations classified as Level 1 risk based on the first list in the alert rules can be detected more quickly, preventing such attacks from harming the server and ensuring its security.

[0010] In conjunction with the first aspect, in another possible implementation, when the first list in the warning rules does not contain operation strings and / or dynamic parameters, the risk level of the operation strings and / or dynamic parameters is determined according to the second list in the warning rules; when the second list contains operation strings and / or dynamic parameters, the risk level of the operation is the second level, and the first level is greater than the second level.

[0011] If the risk level of an operation is not high according to the warning rules, the operation instruction is further tested to determine whether the risk level of the operation is level two, that is, the operation has low risk. This can more accurately detect operations that may attack the server.

[0012] In conjunction with the first aspect, in another possible implementation, when the risk level of the operation is level one, the operation is discarded and an alarm message is generated; when the risk level of the operation is level two, the operation is processed and an alarm message is generated.

[0013] Handling operations according to their risk level makes risk detection more flexible. Executing different processing steps for operations with different risk levels can improve the efficiency of risk detection.

[0014] Secondly, an optical module detection device is provided, which includes a decision module, a detection module, and an alarm module.

[0015] The receiving module is used to receive operation instructions, which are used to indicate operations to be performed on the application.

[0016] The decision-making module is used to determine the risk level of an operation based on early warning rules before processing the operation instructions. The early warning rules are used to indicate the relationship between the operation and the risk level.

[0017] The processing module is used to handle operations based on their risk level.

[0018] By determining the risk level and processing outcome of user-issued operation instructions based on early warning rules before processing, the risk identification logic can be decoupled from the application. This avoids the complexity of performing risk detection on operation instructions during application execution and allows for faster detection of operations that pose security risks to the server. Since the operation can be performed on any application within the server, this application can also perform risk detection on different applications simultaneously, thereby reducing server memory usage and improving application execution efficiency.

[0019] In conjunction with the second aspect, in one possible implementation, the decision module is specifically used to determine the risk level of an operation based on the operation string of the operation instruction and / or dynamic parameters.

[0020] By converting user-issued operations into operation strings or dynamic parameters, the risk level of the operation can be determined more accurately based on the warning rules.

[0021] In conjunction with the second aspect, in another possible implementation, the decision module is specifically used to determine the risk level of an operation as Level 1 when the first list in the warning rules contains an operation string and / or dynamic parameters.

[0022] Since high-risk operations can cause data alteration or loss on the server, operations classified as Level 1 risk based on the first list in the warning rules can be detected more quickly, preventing such attacks from affecting the server and ensuring its security.

[0023] In conjunction with the second aspect, in another possible implementation, the decision module is specifically used to determine the risk level of the operation string and / or dynamic parameter based on the second list in the warning rules when the first list in the warning rules does not contain the operation string and / or dynamic parameter; when the second list contains the operation string and / or dynamic parameter, the risk level of the operation is the second level, and the first level is greater than the second level.

[0024] If the risk level of an operation is not high according to the early warning rules, the operation is further tested to determine whether the risk level of the operation is level two, that is, the operation has low risk. This can more accurately detect operations that may attack the server.

[0025] In conjunction with the second aspect, in another possible implementation, the processing module is specifically used to discard the operation and generate an alarm message when the risk level of the operation is at the first level; and to process the operation and generate an alarm message when the risk level of the operation is at the second level.

[0026] Handling operations according to their risk level makes risk detection more flexible. Executing different processing steps for operations with different risk levels can improve the efficiency of risk detection.

[0027] In conjunction with the second aspect, another possible implementation includes a storage module for the risk detection device. This storage module stores the warning rules and executable code.

[0028] Thirdly, a server is provided, comprising a processor and a memory. The memory stores executable code and warning rules. The processor receives operation instructions from a user and, before processing the operation instructions, determines the risk level of the operation according to the warning rules, and processes the operation according to the risk level. The risk level of the operation includes a first level and a second level, where the first level is greater than the second level. When the risk level of the operation is the first level, the operation is discarded and an alarm message is generated; when the risk level of the operation is the second level, the operation is processed and an alarm message is generated. When the processor executes the set of computer instructions, it performs the functions of each module of the method in the first aspect or any possible implementation of the first aspect.

[0029] Fourthly, a computer-readable storage medium is provided, including computer software instructions; when the computer software instructions are executed in a computer, they cause the computer to perform the method as described in any one of the first aspects or possible implementations of the first aspect.

[0030] Fifthly, a computer program product containing instructions is provided, which, when run on a computer, causes the computer to perform the method described in the first aspect or any implementation thereof.

[0031] Based on the implementation methods provided in the above aspects, this application can be further combined to provide more implementation methods. Attached Figure Description

[0032] Figure 1 A schematic diagram of the structure of a risk detection system provided in this application;

[0033] Figure 2 A flowchart illustrating a risk detection method provided in this application;

[0034] Figure 3 A schematic diagram illustrating the specific process of a risk detection method provided in this application;

[0035] Figure 4 This is a schematic diagram of a risk detection device provided in this application. Detailed Implementation

[0036] This application provides a risk detection method, which involves receiving operation instructions from users, determining the risk level of the operation based on the relationship between the operation and the risk level before processing the operation instructions, and then processing the operation according to the risk level. Because the risk level of the operation is determined before processing, the risk judgment logic can be decoupled from the application, avoiding complex application execution and preventing business interruptions caused by the need to redeploy the application when warning rules are updated.

[0037] The embodiments of this application will now be described in detail with reference to the accompanying drawings.

[0038] Figure 1 This is a schematic diagram of a system architecture provided for this application. The system architecture diagram is an example of a server. (Reference) Figure 1 The server 100 includes a processor 110, a communication interface 120, a bus 130, and a memory 140. The processor 110, the memory 140, and the communication interface 120 communicate with each other via the bus 130.

[0039] The processor 110 can be a central processing unit (CPU) for receiving user operation instructions, determining the risk level of the operation based on the relationship between the operation and the risk level before processing the operation instruction, and processing the operation based on the risk level of the operation.

[0040] The communication interface 120 is used to communicate with external systems, such as receiving operation instructions sent by the user.

[0041] Bus 130 can be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus, etc. Buses can be categorized as address buses, data buses, control buses, etc. For ease of representation, Figure 1 The bus is represented by a single thick line, but this does not mean that there is only one bus or one type of bus.

[0042] Memory 140 may include volatile memory, such as random access memory (RAM). Memory 140 may also include non-volatile memory, such as read-only memory (ROM), flash memory, HDD, or SSD. Executable code and warning rules are stored in memory 140, and processor 110 executes the executable code to perform a risk detection method.

[0043] The system architecture and application scenarios described in this application are intended to more clearly illustrate the technical solutions of this application and do not constitute a limitation on the technical solutions provided in this application. As those skilled in the art will know, with the evolution of system architecture and the emergence of new business scenarios, the technical solutions provided in this application are also applicable to similar technical problems.

[0044] Next, the risk detection method will be explained in detail with reference to the attached diagram. Figure 2 This is a flowchart illustrating a risk detection method provided in an embodiment of this application. Figure 3 This is a schematic flowchart illustrating a risk detection method provided in an embodiment of this application. Here, we will use... Figure 1 The processor 110 shown is used as an example for illustration.

[0045] In this embodiment of the application, the attack on the database by a user through a web server is illustrated.

[0046] Web servers can provide documents or other services to web clients (such as browsers). Any web application designed to comply with the HTTP protocol can be a web client. Its main function is to store, process, and deliver web pages to users. The content delivered is generally Hyper Text Markup Language (HTML) documents, images, style sheets, or scripts, and website files can also be placed for browsing or downloading.

[0047] A database is a repository for data; it is a computer software system that stores and manages business data according to a data structure.

[0048] Database security risks mainly fall into two categories: system data attacks and business data attacks. System data attacks primarily stem from SQL injection attacks and vulnerability exploits, which can lead to malicious intrusion, damage, and data theft from the database.

[0049] SQL injection attacks are security vulnerabilities that occur at the application and database layers. They occur when web applications fail to validate or adequately filter the validity of user input data. Attackers can add extra SQL statements to the end of predefined query statements in the application, performing illegal operations without the attacker's knowledge. This allows attackers to deceive the database server into executing unauthorized arbitrary queries, thereby obtaining relevant data information.

[0050] A vulnerability attack refers to a web container parsing flaw that allows it to parse other types of files as scripting languages ​​and execute the code within them. This vulnerability arises because the web container contains a flaw that prevents file validation when parsing maliciously crafted files, resulting in the execution of all code within the file.

[0051] Business data attacks originate from dynamic parameters passed in by malicious users, causing changes to some dynamic configuration parameters, thresholds, and business data. This may also lead to the system redirecting to execute high-risk business logic.

[0052] Step 201: The processor receives the operation instruction.

[0053] Since a web container is a service program, with one program providing the corresponding service on each port of the server, this program can handle requests from clients and provide a unified runtime environment for applications or components deployed within it. Therefore, in this embodiment, three independent programs—the application, the configuration service, and the risk detection service—can be deployed within the web container of the web server. The configuration service can obtain warning rules from the cloud server. The risk detection service can intercept user operation instructions and detect these instructions using warning rules. If the indicated operation is risky, the service will refuse to process it and generate an alarm message to protect database data security.

[0054] In one implementation, the server can receive alert rules proactively sent to it by the cloud server over a network. Alternatively, the server can send a request to the cloud server to receive the alert rules sent by the cloud server.

[0055] Example 1: The server can periodically and automatically retrieve the latest version of the alert rules from the cloud server. Since the alert rules and the application are independent of each other, the problem of application interruption caused by updating the alert rules can be avoided.

[0056] Example 2: The server can retrieve alert rules from the cloud server based on user instructions.

[0057] After the server powers on, the web container starts, at which point the applications, alert rules, and risk detection services deployed in the web container are loaded and running. When the processor receives an operation instruction from the user, it determines the risk level of the operation based on the alert rules in the web container before processing the instruction.

[0058] In this embodiment of the application, the operation instruction is used to instruct the user to perform operations on the application, which may include operations such as accessing the database, obtaining database information, deleting the database, and changing authorization, without being specifically limited here.

[0059] Step 202: Before processing the operation instruction, the processor determines the risk level of the operation based on the warning rules.

[0060] In one implementation, upon receiving an operation instruction, the server's conversion function converts the received operation instruction into an operation string and / or dynamic parameters. The operation string indicates the type of operation, and the dynamic parameters indicate the parameters specified in the operation instruction. The risk level of the operation is then determined based on the operation string and / or dynamic parameters.

[0061] Different operations pose varying levels of risk to different applications. Taking databases as an example, the risk level can be divided into two levels: Level 1 and Level 2. Level 1 indicates that the operation could cause the database to crash, meaning the operation carries a high risk. Level 2 indicates that the operation could launch an attack on the database, but this attack would not cause the database to crash, meaning the operation carries a low risk.

[0062] Warning rules are used to indicate the relationship between operations and risk levels. Warning rules include a first list and a second list. The first list indicates operations with a risk level of 1, and includes the operation string and dynamic parameters for operations with a risk level of 1. The second list indicates operations with a risk level of 2, and includes the operation string and dynamic parameters for operations with a risk level of 2. The operation strings and dynamic parameters included in the first and second lists are different.

[0063] In one example, the first list may include operation strings such as shutdown, drop, alter, create user, and grant. The operation string shutdown corresponds to shutting down the database, drop corresponds to deleting the database, alter corresponds to modifying a table, create user corresponds to adding a user, and grant corresponds to changing authorization. The first list may also include multiple dynamic parameters, which will not be illustrated here.

[0064] First, check the first list to see if the operation instruction string and / or dynamic parameters exist. If the operation instruction string and / or dynamic parameters are found in the first list, the risk level of the operation is Level 1, meaning it is a high-risk operation and needs to be blocked to prevent it from attacking the database. If the operation instruction string and / or dynamic parameters are not found in the first list, the risk level of the operation is not Level 1, meaning it is not a high-risk operation. Further testing is needed to determine if the operation is at a low risk level. This can be done using the second list, by checking if the operation instruction string and / or dynamic parameters exist in the second list.

[0065] In another example, the second list may include operation strings such as flush and lock. The operation string flush corresponds to truncating the log, and the operation string lock corresponds to locking the table. The second list may also include multiple dynamic parameters, which will not be illustrated here.

[0066] When the operation instruction string and / or dynamic parameters can be found in the second list, it indicates that the risk level of the operation is Level 2, meaning it is a low-risk operation. An alert should be issued for this operation, but it does not need to be blocked. The alert information can be sent to the server administrator via email so that the administrator can handle the operation promptly. When the operation instruction string and / or dynamic parameters are not found in the second list, it indicates that the risk level of the operation is not Level 2, meaning it poses no risk and can be handled directly.

[0067] This application first performs preliminary detection on operations based on the first list in the warning rules to identify high-risk operations, which can be intercepted in a timely manner to prevent high-risk operations from attacking the database and improve the efficiency of risk detection. Then, it further detects operations based on the second list in the warning rules to identify low-risk operations, which can be alerted in a timely manner.

[0068] Since the alert rules are retrieved from the cloud server before the server receives the user's operation, they can be flexibly configured on the cloud server. Before determining the risk level of an operation based on the updated alert rules, the updated rules can be retrieved from the cloud server for risk assessment, avoiding the need to deploy alert rules in the application. This also avoids application interruptions caused by updating alert rules, thus improving the efficiency of operational risk detection.

[0069] In one implementation, `premain` or `agentmain` is used to determine the risk level of an operation based on warning rules before processing it. `premain` instructs the program to execute before the application is loaded. Before execution, `premain` determines the risk level of the operation based on warning rules and processes the access request accordingly. `agentmain` is used to support reloading the application after it has been loaded. `agentmain` intercepts user-sent operations when updated warning rules are obtained and the application is already loaded, and processes the access request based on the risk level of the operation.

[0070] Since the operation can be performed on any application on the server, and the risk level of the operation is determined according to the warning rules before processing the operation, this application can also realize the risk detection of different applications at the same time, thereby reducing the server memory usage and improving the execution efficiency of the application.

[0071] Step 203: The processor processes the access request based on the risk level of the operation.

[0072] When an operation's risk level is classified as Level 1, it indicates a high-risk operation. Example 1: The operation involves changing database access permissions. Changing these permissions allows unauthorized users to freely access, modify, or damage data in the database, potentially leading to data tampering or database corruption. Example 2: The operation involves illegally modifying data information, such as daily business or transaction information. This has a significant impact on the operation of the information system and user privacy. In this case, the operation needs to be intercepted and discarded, generating an alert to prevent the attack on the database.

[0073] When the risk level of an operation is classified as Level 2, it indicates that the operation is of low to medium risk, and handling it will not cause irreversible damage to the database. For example, sensitive information such as user names, phone numbers, and addresses may be leaked. In this case, the operation should be processed, and an alert should be generated to notify server administrators of the security risk posed by the operation.

[0074] When the risk level of an operation is level three, it means that the operation is risk-free, can be processed, requires no alarm, and will not cause an attack on the database.

[0075] In one example, the server generates an alert for operations that pose a security risk. The alert information can be sent to the server administrator via email, SMS, or a web interface.

[0076] It is understood that, in order to achieve the functions in the above embodiments, the computer includes hardware structures and / or software modules corresponding to the execution of each function. Those skilled in the art should readily recognize that, based on the units and method steps described in conjunction with the embodiments disclosed in this application, this application can be implemented in hardware or a combination of hardware and computer software. Whether a function is executed by hardware or by computer software driving hardware depends on the specific application scenario and design constraints of the technical solution.

[0077] Figure 4 This is a schematic diagram of the structure of a risk detection device provided in the embodiments of this application. These risk detection devices can be used to implement the server functions described in the above method embodiments, and therefore can also achieve the beneficial effects of the above method embodiments. In the embodiments of this application, the risk detection device can be as follows: Figure 1 The server shown is 100.

[0078] like Figure 4 As shown, the risk detection device 400 includes a receiving module 401, a decision-making module 402, and a processing module 403. The risk detection device 400 is used to implement the above-mentioned... Figure 2 The method embodiment shown illustrates the function of server 100.

[0079] When the risk detection device 400 is used to achieve Figure 2 In the method embodiment shown, the function of server 100 is as follows:

[0080] The receiving module 401 is used to receive operation instructions, which are used to indicate operations on the application.

[0081] The decision module 402 is used to determine the risk level of an operation based on early warning rules before processing the operation instructions. The early warning rules are used to indicate the relationship between the operation and the risk level.

[0082] The processing module 403 is used to process the operation according to the risk level of the operation.

[0083] The decision module 402 is specifically used to determine the risk level of an operation based on the operation string of the operation instruction and / or dynamic parameters.

[0084] The decision module 402 is specifically used to determine the risk level of an operation as Level 1 when the first list in the warning rules contains an operation string and / or dynamic parameters.

[0085] The decision module 402 is specifically used to determine the risk level of the operation string and / or dynamic parameter according to the second list in the early warning rules when the first list in the early warning rules does not contain the operation string and / or dynamic parameter; when the second list contains the operation string and / or dynamic parameter, the risk level of the operation is the second level, and the first level is greater than the second level.

[0086] The processing module 403 is specifically used to discard the operation and generate an alarm message when the risk level of the operation is level 1; and to process the operation and generate an alarm message when the risk level of the operation is level 2.

[0087] The risk detection device 400 also includes a storage module 404. The storage module 404 is used to store warning rules and executable code.

[0088] For a more detailed description of the receiving module 401, decision module 402, processing module 403, and storage module 404 mentioned above, please refer to [reference needed]. Figure 2 The relevant descriptions in the method embodiments shown are directly obtained and will not be repeated here.

[0089] This application also provides a computer-readable storage medium including instructions that, when executed on a computer, cause the computer to perform the risk detection method described above applied to the risk detection device 400.

[0090] This application also provides a computer program product, which, when executed by a computer, causes the computer to perform any of the aforementioned methods. The computer program product can be a software installation package; when any of the aforementioned methods is required, the computer program product can be downloaded and executed on the computer.

[0091] It should also be noted that the device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs. In addition, in the device embodiment drawings provided in this application, the connection relationship between modules indicates that they have a communication connection, which can be implemented as one or more communication buses or signal lines.

[0092] Through the above description of the embodiments, those skilled in the art can clearly understand that this application can be implemented by means of software plus necessary general-purpose hardware, or it can be implemented by special-purpose hardware including application-specific integrated circuits, special-purpose CPUs, special-purpose memory, special-purpose components, etc. Generally, any function performed by a computer program can be easily implemented by corresponding hardware, and the specific hardware structure used to implement the same function can also be diverse, such as analog circuits, digital circuits, or special-purpose circuits. However, for this application, software program implementation is more often the preferred implementation method. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product is stored in a readable storage medium, such as a computer floppy disk, USB flash drive, mobile hard disk, ROM, RAM, magnetic disk, or optical disk, etc., and includes several instructions to cause a computer device (which may be a personal computer, training equipment, or network device, etc.) to execute the methods described in the various embodiments of this application.

[0093] In the above embodiments, implementation can be achieved, in whole or in part, through software, hardware, firmware, or any combination thereof. When implemented in software, it can be implemented, in whole or in part, as a computer program product.

[0094] The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, all or part of the processes or functions described in the embodiments of this application are generated. The computer may be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions may be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another. For example, the computer instructions may be transmitted from one website, computer, training device, or data center to another website, computer, training device, or data center via wired (e.g., coaxial cable, fiber optic, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) means. The computer-readable storage medium may be any available medium that a computer can store or a data storage device such as a training device or data center that integrates one or more available media. The available media may be magnetic media (e.g., floppy disks, hard disks, magnetic tapes), optical media (e.g., DVDs), or semiconductor media (e.g., solid-state drives (SSDs)).

Claims

1. A risk detection method, characterized in that, The method is applied to a server running an application and a risk detection service, and the method includes: Receive an operation instruction, the operation instruction being used to instruct an operation on any of the applications, the applications and the risk detection service being independent programs within the server; Before processing the operation instruction, the risk level of the operation is determined according to the early warning rule, which is used to indicate the relationship between the operation and the risk level. The operation is handled according to the risk level corresponding to the operation; The risk detection service intercepts user operation instructions and detects user operation instructions through the warning rules. If the operation instruction is risky, the service refuses to process the operation. The agent main method is used to determine the risk level of the operation based on the warning rules before processing the operation. When the agentmain obtains the updated warning rules and the application is already loaded, it intercepts the user's operation and processes the access request according to the risk level of the operation.

2. The method according to claim 1, characterized in that, The risk level of the operation is determined according to the early warning rules, including: The risk level of the operation is determined based on the operation string and / or dynamic parameters of the operation instruction.

3. The method according to claim 2, characterized in that, Determining the risk level of the operation based on the operation string and / or dynamic parameters of the operation instruction includes: When the operation string and / or the dynamic parameter exist in the first list of the warning rules, the risk level of the operation is level one. The first list includes the operation string and dynamic parameter with a risk level of level one.

4. The method according to claim 3, characterized in that, Determining the risk level of the operation based on the operation string and / or dynamic parameters of the operation instruction also includes: When the operation string and / or the dynamic parameter are not present in the first list of the warning rules, the risk level of the operation string and / or the dynamic parameter is determined according to the second list of the warning rules. The second list includes operation strings and dynamic parameters with a risk level of the second level. When the second list contains the operation string and / or the dynamic parameter, the risk level of the operation is the second level, which is greater than the first level.

5. The method according to claim 4, characterized in that, The operation is handled according to its risk level, including: When the risk level of the operation is at the first level, the operation is discarded and an alarm message is generated. When the risk level of the operation is Level 2, the operation is processed and an alarm message is generated.

6. A computer device, characterized in that, The computer device includes a processor, on which applications and risk detection services run, the processor being used for: Receive an operation instruction, the operation instruction being used to instruct an operation on any of the applications, the applications and the risk detection service being independent programs in the computer device; Before processing the operation instruction, the risk level of the operation is determined according to the early warning rules, which indicate the relationship between the operation and the risk level; the operation is then processed according to the risk level of the operation. The risk detection service intercepts user operation instructions and detects user operation instructions through the warning rules. If the operation instruction is risky, the service refuses to process the operation. The agent main method is used to determine the risk level of the operation based on the warning rules before processing the operation. When the agentmain obtains the updated warning rules and the application is already loaded, it intercepts the user's operation and processes the access request according to the risk level of the operation.

7. The computer device according to claim 6, characterized in that, The processor is also used for: The risk level of the operation is determined based on the operation string and / or dynamic parameters of the operation instruction.

8. The computer device according to claim 7, characterized in that, The processor is also used for: When the operation string and / or the dynamic parameter exist in the first list of the warning rules, the risk level of the operation is level one. The first list includes the operation string and dynamic parameter with a risk level of level one.

9. The computer device according to claim 8, characterized in that, The processor is also used for: When the operation string and / or the dynamic parameter are not present in the first list of the warning rules, the risk level of the operation string and / or the dynamic parameter is determined according to the second list of the warning rules. The second list includes operation strings and dynamic parameters with a risk level of the second level. When the second list contains the operation string and / or the dynamic parameter, the risk level of the operation is the second level, which is greater than the first level.

10. The computer device according to claim 9, characterized in that, The processor is also used for: When the risk level of the operation is at the first level, the operation is discarded and an alarm message is generated. When the risk level of the operation is Level 2, the operation is processed and an alarm message is generated.

Images