Shell command detection method and device, electronic equipment and computer readable medium

Abstract

The application discloses a shell command detection method and device, electronic equipment and a computer readable medium, and relates to the technical field of system operation and maintenance. A specific embodiment of the method comprises the following steps: receiving a shell command submitted by an operation and maintenance personnel and writing the shell command into a command log file; matching the shell command in a dangerous command library, and in response to a dangerous command in the dangerous command, throwing a reminder to the operation and maintenance personnel; in response to a continue execution instruction submitted by the operation and maintenance personnel, continuing to execute the shell command; or in response to an abandon execution instruction submitted by the operation and maintenance personnel, abandoning the execution of the shell command. The embodiment can solve the technical problem that production accidents caused by misoperation and the like cannot be avoided occasionally.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of system operation and maintenance, and in particular to a shell command detection method and device, an electronic device and a computer readable medium. BACKGROUND

[0002] Most of the background programs of Internet systems are deployed in a Linux environment. When Windows performs a certain operation, the mouse operation failure rate is small, but in a Linux system, basically, a keyboard input command form is used to perform a certain operation, which greatly increases the operation risk.

[0003] In the process of implementing the present application, the inventors have found that at least the following problems exist in the prior art:

[0004] An operation and maintenance personnel performs operation and maintenance on a Linux system. Regardless of whether it is through direct connection, a bastion host, a cloud host or various channels, it is connected to a server through an ssh protocol, and then a shell of the system is entered by default. The shell inputs a required command, and then the shell interprets the command as a binary language and submits it to a computer for execution. The shell only checks the syntax compliance of the input command and does not prompt the danger of the command. The control of operation and maintenance risks mainly relies on the personal ability of the operation and maintenance personnel and a human management and control mode such as double-checking to ensure that occasional production accidents caused by misoperation and the like cannot be avoided. SUMMARY

[0005] Therefore, the embodiments of the present application provide a shell command detection method and device, an electronic device and a computer readable medium to solve the technical problem that occasional production accidents caused by misoperation and the like cannot be avoided.

[0006] To achieve the above object, according to one aspect of the embodiments of the present application, a shell command detection method is provided, comprising:

[0007] receiving a shell command submitted by an operation and maintenance personnel and writing the shell command into a command log file;

[0008] matching the shell command in a dangerous command library, and in response to a dangerous command in the dangerous command, throwing a prompt to the operation and maintenance personnel to prompt whether to continue executing the shell command;

[0009] in response to a continue execution instruction submitted by the operation and maintenance personnel, continuing to execute the shell command, or in response to an abandon execution instruction submitted by the operation and maintenance personnel, abandoning to execute the shell command; and writing the shell command and its execution result into an execution log file;

[0010] According to the execution log file, a risk value of each command in the command log file is calculated, so that the command in the dangerous command library is updated according to the risk value of the each command.

[0011] Optionally, calculating the risk value of each command in the command log file according to the execution log file comprises:

[0012] For each command in the command log file, the number of submissions of the command is calculated;

[0013] For each command in the execution log file, the number of abandoned executions and / or the number of continued executions of the command is calculated;

[0014] For each command in the command log file, a first risk parameter is obtained by multiplying the number of submissions of the command by a first risk coefficient, a second risk parameter is obtained by multiplying the number of abandoned executions of the command by a second risk coefficient, a third risk parameter is obtained by multiplying the number of continued executions of the command by a third risk coefficient, and the risk value of the command is calculated according to the first risk parameter, the second risk parameter and the third risk parameter.

[0015] Optionally, updating the command in the dangerous command library according to the risk value of the each command comprises:

[0016] The risk values of the each command are sorted, N commands with high risk values in a current period are filtered out, the N commands are recommended to the operation and maintenance personnel, and the operation and maintenance personnel selects a command from the N commands to add to the dangerous command;

[0017] M commands with risk values less than or equal to zero in continuous periods are filtered out, the M commands are recommended to the operation and maintenance personnel, and the operation and maintenance personnel selects a command from the M commands to delete from the dangerous command;

[0018] According to whether the each command is added to the dangerous command library or deleted from the dangerous command library, the second risk coefficient and the third risk coefficient are updated.

[0019] Optionally, before receiving the shell command submitted by the operation and maintenance personnel, the method further comprises:

[0020] Receiving a login account and a login password of the operation and maintenance personnel for logging into an operation and maintenance server, so as to log into the operation and maintenance server and enter a default shell;

[0021] Entering a shell command detection environment.

[0022] Optionally, before receiving the login account and login password submitted by the operation and maintenance personnel for logging into the operation and maintenance server, the method further comprises:

[0023] The operation and maintenance server is configured with a self-starting parameter for starting up, so that the operation and maintenance server automatically enters a shell command detection environment after starting up.

[0024] Optionally, the method further comprises:

[0025] In response to not hitting a dangerous command in the dangerous commands, the shell command is submitted to a shell, and the shell command is further submitted to the operation and maintenance server by the shell.

[0026] Optionally, continuing to execute the shell command comprises:

[0027] The shell command is submitted to a shell, and the shell command is further submitted to the operation and maintenance server by the shell.

[0028] Optionally, after throwing a prompt to the operation and maintenance personnel to prompt whether the operation and maintenance personnel continue to execute the shell command, the method further comprises:

[0029] In response to not receiving a continue-to-execute instruction or a give-up-to-execute instruction submitted by the operation and maintenance personnel within a preset time threshold, the shell command is given up to be executed.

[0030] In addition, according to another aspect of an embodiment of the present application, a shell command detection device is provided, comprising:

[0031] A receiving module is configured to receive a shell command submitted by an operation and maintenance personnel and write the shell command into a command log file;

[0032] A detection module is configured to match the shell command in a dangerous command library, and in response to hitting a dangerous command in the dangerous commands, throw a prompt to the operation and maintenance personnel to prompt whether the operation and maintenance personnel continue to execute the shell command;

[0033] A processing module is configured to, in response to a continue-to-execute instruction submitted by the operation and maintenance personnel, continue to execute the shell command, or in response to a give-up-to-execute instruction submitted by the operation and maintenance personnel, give up to execute the shell command, and write the shell command and an execution result of the shell command into an execution log file;

[0034] An updating module is configured to calculate risk values of respective commands in the command log file according to the execution log file, and update the commands in the dangerous command library according to the risk values of the respective commands.

[0035] Optionally, the updating module is further configured to:

[0036] for each command in the command log file, calculate the number of submissions of the command;

[0037] for each command in the execution log file, calculate the number of abandoned executions and / or the number of continued executions of the command;

[0038] for each command in the command log file, multiply the number of submissions of the command by a first risk coefficient to obtain a first risk parameter, multiply the number of abandoned executions of the command by a second risk coefficient to obtain a second risk parameter, multiply the number of continued executions of the command by a third risk coefficient to obtain a third risk parameter, and calculate the risk value of the command according to the first risk parameter, the second risk parameter and the third risk parameter.

[0039] Optionally, the updating module is further configured to:

[0040] sort the risk values of the commands, filter out N commands with high risk values in the current period, recommend the N commands to the operation and maintenance personnel, and select a command from the N commands by the operation and maintenance personnel to add to the dangerous command;

[0041] filter out M commands with risk values less than or equal to zero in consecutive periods, recommend the M commands to the operation and maintenance personnel, and select a command from the M commands by the operation and maintenance personnel to delete from the dangerous command;

[0042] update the second risk coefficient and the third risk coefficient according to whether the commands are added to or deleted from the dangerous command library.

[0043] Optionally, the receiving module is further configured to:

[0044] before receiving the shell command submitted by the operation and maintenance personnel, receive a login account and a login password submitted by the operation and maintenance personnel for logging into the operation and maintenance server, so as to log into the operation and maintenance server and enter a default shell;

[0045] enter a shell command detection environment.

[0046] Optionally, the system further comprises a configuration module configured to:

[0047] before receiving the login account and the login password submitted by the operation and maintenance personnel for logging into the operation and maintenance server, configure a startup self-starting parameter of the operation and maintenance server, so that the operation and maintenance server automatically enters the shell command detection environment after startup.

[0048] Optionally, the detection module is further configured to:

[0049] in response to a hit of a dangerous command in the dangerous commands, submitting the shell command to a shell, and submitting the shell command to an operation and maintenance server by the shell.

[0050] Optionally, the processing module is further configured to:

[0051] submitting the shell command to a shell, and submitting the shell command to an operation and maintenance server by the shell.

[0052] Optionally, the processing module is further configured to:

[0053] throwing a reminder to the operation and maintenance personnel to prompt the operation and maintenance personnel whether to continue executing the shell command, and in response to not receiving a continue execution instruction or an abandon execution instruction submitted by the operation and maintenance personnel within a preset time threshold, abandoning executing the shell command.

[0054] According to another aspect of the embodiments of the present application, an electronic device is also provided, comprising:

[0055] one or more processors;

[0056] a storage device configured to store one or more programs,

[0057] When the one or more programs are executed by the one or more processors, the one or more processors implement the method in any of the above embodiments.

[0058] According to another aspect of the embodiments of the present application, a computer readable medium is also provided, which stores a computer program, and the program is executed by a processor to implement the method in any of the above embodiments.

[0059] According to another aspect of the embodiments of the present application, a computer program product is also provided, which comprises a computer program, and the computer program is executed by a processor to implement the method in any of the above embodiments.

[0060] An embodiment of the above application has the following advantages or beneficial effects: because the technique of matching according to a shell command in a dangerous command library, throwing a reminder to an operation and maintenance personnel in response to a dangerous command in a hit dangerous command, continuing to execute the shell command in response to a continue execution instruction submitted by the operation and maintenance personnel, or abandoning the execution of the shell command in response to an abandon execution instruction submitted by the operation and maintenance personnel, the technical problem of being unable to avoid occasional production accidents caused by misoperation and the like in the prior art is overcome. The embodiment of the application intervenes in detection before the submission of a shell command, rather than merely recording the operation after execution, and the command danger audit is completed without adding too much complexity to the original operation and maintenance operation and changing the original operation and maintenance habits, thereby guaranteeing the safety of the operation and maintenance operation of the operation and maintenance personnel, avoiding operation and maintenance risks caused by unfamiliarity and misoperation and the like, and thus avoiding operation and maintenance risks as much as possible.

[0061] The further effects of the above non-conventional optional mode will be described below in combination with the specific embodiments. BRIEF DESCRIPTION OF DRAWINGS

[0062] In order to more clearly illustrate the technical solutions in the embodiments of the application or the prior art, the following will briefly introduce the drawings needed to be used in the embodiments or the prior art description. Obviously, the drawings in the following description only constitute some embodiments of the application, and for those skilled in the art, other drawings can also be obtained without creative labor on the basis of these drawings. Among them:

[0063] Figure 1 is a flowchart of a shell command detection method according to an embodiment of the application;

[0064] Figure 2 is a flowchart of a shell command detection method according to an embodiment of the application;

[0065] Figure 3 is a flowchart of a shell command detection method according to another embodiment of the application;

[0066] Figure 4 is a flowchart of a shell command detection method according to another embodiment of the application;

[0067] Figure 5 is a schematic diagram of a shell command detection device according to an embodiment of the application;

[0068] Figure 6 is an exemplary system architecture diagram to which the embodiment of the application can be applied;

[0069] Figure 7Fig. 1 is a structural schematic diagram of a computer system of a terminal device or a server suitable for implementing an embodiment of the present application. DETAILED DESCRIPTION

[0070] Exemplary embodiments of the present application are described herein with reference to the accompanying drawings, which are meant to be exemplary and not limiting. Therefore, it should be recognized that many changes and modifications can be made to the embodiments described herein, without departing from the spirit and scope of the application. Also, for the sake of brevity and clarity, descriptions of well-known functions and constructions are omitted herein.

[0071] It should be noted that in the technical solutions of the present application, the collection, analysis, use, transmission, storage, etc. of user personal information are in line with relevant laws and regulations, are used for legal and reasonable purposes, are not shared, disclosed or sold outside these legal uses, and are subject to supervision and management by regulatory authorities. Necessary measures should be taken to prevent illegal access to such personal information data, to ensure that personnel with access to personal information data comply with relevant laws and regulations, and to ensure the security of user personal information. Once these user personal information data are no longer needed, the risk should be minimized by limiting or even prohibiting data collection and / or deleting data.

[0072] When applicable, including in certain related applications, user privacy is protected by de-identifying data, such as by removing specific identifiers (e.g., date of birth, etc.), controlling the amount or specificity of data stored, controlling how data is stored, and / or other methods of de-identification, as applicable.

[0073] Figure 1 Fig. 1 is a structural schematic diagram of a computer system of a terminal device or a server suitable for implementing an embodiment of the present application. Figure 1 As shown in Fig. 1, the shell command detection method can include:

[0074] Step 101, receiving a shell command submitted by an operation and maintenance personnel and writing the shell command into a command log file.

[0075] Shell is a user interface of a system, providing an interface for a user to interact with a kernel. It receives a command input by a user and sends it to the kernel for execution. In fact, shell is a command interpreter, which interprets commands input by a user and sends them to the kernel. The command log file records various shell commands and their submission times.

[0076] Optionally, before step 101, further comprising: receiving a login account and a login password of the operation and maintenance personnel for logging into the operation and maintenance server, so as to log into the operation and maintenance server and enter a default shell; and entering a shell command detection environment. First, receiving the login account and the login password of the operation and maintenance personnel for logging into the operation and maintenance server, if the login account and the login password of the operation and maintenance personnel for logging into the operation and maintenance server are the same as pre-configured login account and login password, then successfully logging into the operation and maintenance server and entering a default shell, and then entering a shell command detection environment. After entering the shell command detection environment, the shell command submitted by the operation and maintenance personnel is detected, that is, steps 101-103 are executed.

[0077] Optionally, before receiving the login account and the login password of the operation and maintenance personnel for logging into the operation and maintenance server, further comprising: configuring a startup self-starting parameter of the operation and maintenance server, so that the operation and maintenance server automatically enters a shell command detection environment after starting. In order to successfully enter a default shell after logging into the operation and maintenance server, it is necessary to pre-configure a startup self-starting parameter of the operation and maintenance server, so that the operation and maintenance personnel automatically enter a shell command detection environment after logging into the operation and maintenance server, and ensure that the operation and maintenance personnel perform operation and maintenance in the shell command detection environment.

[0078] Step 102, according to the shell command, matching in the dangerous command library, in response to hitting the dangerous command in the dangerous command, throwing a prompt to the operation and maintenance personnel, prompting the operation and maintenance personnel whether to continue to execute the shell command.

[0079] In the embodiment of the application, it is necessary to maintain a dangerous command library. Specifically, the shell commands considered dangerous by various demanders are added to the dangerous command library, such as dangerous shell commands such as rm-rf, mkfs, chomod, shutdown, etc. It should be noted that the dangerous commands in the dangerous command library can be updated every certain period of time to ensure system security. The shell commands considered dangerous can be configured according to the situation of the system.

[0080] In this step, according to the shell command submitted by the operation and maintenance personnel in step 101, matching in the dangerous command library, if the shell command submitted by the operation and maintenance personnel hits the dangerous command in the dangerous command library, it is indicated that the shell command submitted by the operation and maintenance personnel belongs to the dangerous command, and a prompt is thrown to the operation and maintenance personnel to further prompt the operation and maintenance personnel whether to execute the shell command.

[0081] Optionally, the method further comprises: in response to a dangerous command in the dangerous command not being hit, submitting the shell command to the shell, and then submitting the shell command to the operation and maintenance server by the shell. If the shell command submitted by the operation and maintenance personnel does not hit the dangerous command in the dangerous command library, it means that the shell command submitted by the operation and maintenance personnel does not belong to the dangerous command, and the shell command is directly submitted to the shell, and then the shell command is submitted to the operation and maintenance server by the shell, so that the operation and maintenance server executes the shell command.

[0082] Step 103, in response to the continue execution instruction submitted by the operation and maintenance personnel, continue executing the shell command; or in response to the abandon execution instruction submitted by the operation and maintenance personnel, abandon executing the shell command; and write the shell command and its execution result into an execution log file.

[0083] The operation and maintenance personnel can choose to continue executing the shell command submitted in step 101, or choose to abandon executing the shell command submitted in step 101. If the operation and maintenance personnel chooses to continue executing, in response to the continue execution instruction submitted by the operation and maintenance personnel, the shell command is continued to be executed; if the operation and maintenance personnel chooses to abandon executing, in response to the abandon execution instruction submitted by the operation and maintenance personnel, the shell command is abandoned to be executed. Further, the execution result (continue executing or abandoning executing) is written into an execution log file. Therefore, each shell command and its execution result are recorded, and if it is continued to be executed, the execution time of the command also needs to be recorded.

[0084] Optionally, continuing to execute the shell command comprises: submitting the shell command to the shell, and then submitting the shell command to the operation and maintenance server by the shell. In a shell command detection environment, if the operation and maintenance personnel submits a shell command, the shell will not directly submit the shell command to the operation and maintenance server, but will capture the shell command, judge whether it hits the dangerous command library, if it hits, it means that the shell command has risks, and a prompt is thrown to the operation and maintenance personnel, and the operation and maintenance personnel continues to execute the shell command after insisting on executing, and the operation and maintenance personnel abandons executing the shell command. If it is not hit, it means that the shell command has no risk, and the command is continued to be submitted to the shell, and then submitted to the operation and maintenance server by the shell.

[0085] Optionally, after step 102, further comprising: in response to not receiving the continue execution instruction or the abandon execution instruction submitted by the operation and maintenance personnel within a preset time threshold, abandoning execution of the shell command. If no instruction (including the continue execution instruction or the abandon execution instruction) submitted by the operation and maintenance personnel is received within the preset time threshold, execution of the shell command is abandoned to avoid operation and maintenance risks as much as possible.

[0086] Step 104: calculating a risk value of each command in the command log file according to the execution log file, and updating the commands in the dangerous command library according to the risk value of each command.

[0087] According to the execution log file, the risk value of each shell command in the command log file is calculated, and if the risk value of each shell command is calculated within a current period (such as within a month, a week, or three months, etc.), the top N commands in the risk value are screened out, and the N commands are pushed to the operation and maintenance personnel, and whether the operation and maintenance personnel decides to update them to the dangerous command library. The operation and maintenance personnel can select part of the N commands to join the dangerous command library according to actual needs, or all the N commands can be joined in the dangerous command library.

[0088] Optionally, M commands with a risk value less than or equal to zero in a plurality of continuous periods can be screened out, and the M commands are pushed to the operation and maintenance personnel, and whether the operation and maintenance personnel decides to delete them from the dangerous command library. The operation and maintenance personnel can select part of the M commands to delete from the dangerous command library according to actual needs, or all the M commands can be deleted from the dangerous command library.

[0089] According to the various embodiments described above, it can be seen that the embodiments of the present application solve the technical problem that production accidents caused by misoperation and the like cannot be avoided in the prior art by matching the shell command in the dangerous command library, throwing a reminder to the operation and maintenance personnel in response to a dangerous command in the dangerous command, continuing to execute the shell command in response to the continue execution instruction submitted by the operation and maintenance personnel, or abandoning execution of the shell command in response to the abandon execution instruction submitted by the operation and maintenance personnel. The embodiments of the present application intervene in detection before the shell command is submitted, rather than only recording the operation after execution, and complete the command danger audit without adding too much complexity to the original operation and maintenance operation and changing the original operation and maintenance habits, thereby guaranteeing the safety of the operation and maintenance operation of the operation and maintenance personnel, avoiding operation and maintenance risks caused by unfamiliarity and misoperation, and thereby avoiding operation and maintenance risks as much as possible.

[0090] Figure 2 is a flowchart of a shell command detection method according to one reference embodiment of the present application. As another embodiment of the present application, as shown inFigure 2 As shown, the shell command detection method can include:

[0091] Step 201, configuring a startup self-starting parameter of an operation and maintenance server, so that the operation and maintenance server automatically enters a shell command detection environment after starting up.

[0092] Step 202, receiving a login account and a login password of the operation and maintenance server submitted by an operation and maintenance personnel, so as to log in the operation and maintenance server and enter a default shell.

[0093] Step 203, entering the shell command detection environment.

[0094] Step 204, receiving a shell command submitted by the operation and maintenance personnel and writing the shell command into a command log file.

[0095] Step 205, matching the shell command in a dangerous command library, and in response to a dangerous command in the dangerous command, throwing a prompt to the operation and maintenance personnel to prompt whether to continue executing the shell command.

[0096] Step 206, in response to a continue execution instruction submitted by the operation and maintenance personnel, continuing to execute the shell command; or, in response to an abandonment execution instruction submitted by the operation and maintenance personnel, abandoning to execute the shell command; and writing the shell command and an execution result thereof into an execution log file.

[0097] Step 207, calculating a risk value of each command in the command log file according to the execution log file, so as to update a command in the dangerous command library according to the risk value of the each command.

[0098] Optionally, calculating the risk value of each command in the command log file according to the execution log file includes: for each command in the command log file, calculating a submission times of the command; for each command in the execution log file, calculating an abandonment execution times and / or a continue execution times of the command; for each command in the command log file, multiplying the submission times of the command by a first risk coefficient to obtain a first risk parameter, multiplying the abandonment execution times of the command by a second risk coefficient to obtain a second risk parameter, multiplying the continue execution times of the command by a third risk coefficient to obtain a third risk parameter, and calculating the risk value of the command according to the first risk parameter, the second risk parameter and the third risk parameter.

[0099] For example, the risk value array CW = [] is created by taking the commands in the command log file as array subscripts, the risk value of each command is calculated and assigned to the variable CW[command] in the corresponding subscript in the array. The calculation idea of the risk value of the command is as follows: after triggering the risk reminder each time, if the operation and maintenance personnel chooses to give up execution, the risk value is increased, and if the operation and maintenance personnel chooses to continue execution, the risk value is reduced.

[0100] Optionally, the risk value of the command can be calculated by the following formula:

[0101] CW[command] = C1*times1 + C2*times2 - C3*times3

[0102] Wherein, times1 is the submission times of the command (obtained by counting the commands in the command log file), times2 is the number of times of giving up execution of the command (obtained by counting the commands in the execution log file), and times3 is the number of times of continuing execution of the command (obtained by counting the commands in the execution log file); C1, C2 and C3 are respectively the first risk coefficient, the second risk coefficient and the third risk coefficient.

[0103] The values of C1, C2 and C3 can be configured as needed, for example, the initial value of C1 can be configured as 1, 1.2 or 2, etc., and then can be optimized; for example, the initial value of C2 can be configured as 8, 10 or 12, etc., and then can be optimized; for example, the initial value of C3 can be configured as 3, 4 or 5, etc., and then can be optimized, and the embodiments of the present application do not limit this.

[0104] Optionally, the second risk coefficient and the third risk coefficient can also be updated according to whether each recommended command is added to the dangerous command library or deleted from the dangerous command library. For example, for the command selected by the user to be added to the dangerous command library, if it is not in the screened N commands, it means that the risk coefficient is too low, and the second risk coefficient C2 is increased by 5% and the third risk coefficient C3 is decreased; for the screened N commands, if it is not added to the dangerous command library, it means that the risk coefficient is too high, and the third risk coefficient C3 is increased by 5% and the second risk coefficient C2 is decreased. With multiple cycles of regression, the risk coefficient will stabilize at a more reasonable value.

[0105] For example, the A command is submitted 10 times, the operation and maintenance personnel selects to give up execution once and selects to insist on execution 9 times, and thus the risk value CW[A] of the command = 10 + 1*10 - 5*9 = -25, the command is low risk, but the operation and maintenance personnel selects to add the A command into the dangerous command library to remind, and thus it is indicated that the risk value calculated under the current risk coefficient is low, after the risk coefficient is adjusted, the new risk value is as follows: CW[A] = 10 + 10*(1 + 0.05)*1 - 5(1 - 0.05)*9 = -22.25. Compared with before, the new risk value is slightly reduced, and the coefficient after being adjusted for multiple rounds will be more accurate and consistent with user behavior.

[0106] For example, the B command is submitted 6 times, the operation and maintenance personnel selects to give up execution twice and selects to insist on execution 4 times, and thus the risk value CW[B] of the command = 6 + 10*2 - 5*4 = 6. Supposing that the command belongs to the N commands with the highest risk values, but the user does not select to add the command into the risk command library or delete the command from the risk command library, and thus it is indicated that the risk value calculated under the current risk coefficient is high, after the risk coefficient is adjusted, the new risk value is as follows: CW[B] = 6 + 10(1 - 0.05)*2 - 5(1 + 0.05)*4 = 4. Compared with before, the new risk value is slightly reduced, and the coefficient after being adjusted for multiple rounds will be more accurate and consistent with user behavior.

[0107] In addition, the specific implementation content of the shell command detection method in one reference embodiment of the present application has been described in detail in the shell command detection method described above, and thus the repeated content is not described again.

[0108] Figure 3 is a flowchart of a shell command detection method according to another reference embodiment of the present application. As another embodiment of the present application, as shown in Figure 3 the shell command detection method can include:

[0109] Step 301, receiving a shell command submitted by an operation and maintenance personnel and writing the shell command into a command log file.

[0110] Step 302, performing matching in a dangerous command library according to the shell command, judging whether the dangerous command library is hit or not; if yes, executing step 303; if no, executing step 305.

[0111] Step 303, throwing a prompt to the operation and maintenance personnel to prompt whether the operation and maintenance personnel continues to execute the shell command or not.

[0112] Step 304, in response to the continue execution instruction submitted by the operation and maintenance personnel, submitting the shell command to the shell, and then submitting the shell command to the operation and maintenance server by the shell; or, in response to the abandon execution instruction submitted by the operation and maintenance personnel, abandoning the execution of the shell command.

[0113] Step 305, submitting the shell command to the shell, and then submitting the shell command to the operation and maintenance server by the shell.

[0114] Step 306, writing the shell command and its execution result into an execution log file.

[0115] Step 307, calculating the risk value of each command in the command log file according to the execution log file, and updating the command in the dangerous command library according to the risk value of each command.

[0116] In addition, the specific implementation of the shell command detection method in another embodiment of the present application has been described in detail in the above-described shell command detection method, and thus the repeated content will not be described here.

[0117] Figure 4 is a flowchart of the shell command detection method according to another embodiment of the present application. As shown in Figure 4 the shell command detection method can include:

[0118] Step 401, receiving the shell command submitted by the operation and maintenance personnel and writing the shell command into a command log file.

[0119] Step 402, performing matching in a dangerous command library according to the shell command, and judging whether the dangerous command library is hit; if yes, executing step 403; if no, executing step 407.

[0120] Step 403, throwing a prompt to the operation and maintenance personnel to prompt whether the operation and maintenance personnel continues to execute the shell command.

[0121] Step 404, judging whether the continue execution instruction or the abandon execution instruction submitted by the operation and maintenance personnel is received within a preset time threshold; if yes, executing step 405; if no, executing step 407.

[0122] Step 405, judging whether the operation and maintenance personnel submits the continue execution instruction; if yes, executing step 406; if no, executing step 407.

[0123] Step 406, submitting the shell command to the shell, and then submitting the shell command to the operation and maintenance server by the shell.

[0124] Step 407, abandoning the execution of the shell command.

[0125] Step 408, writing the shell command and its execution result into an execution log file.

[0126] Step 409, calculating the risk value of each command in the command log file according to the execution log file, and updating the commands in the dangerous command library according to the risk value of each command.

[0127] In addition, the specific implementation of the shell command detection method in another embodiment of the present application has been described in detail in the above-described shell command detection method, and thus the repeated content will not be described here.

[0128] Figure 5 is a schematic diagram of a shell command detection device according to an embodiment of the present application. As shown in Figure 5 The shell command detection device 500 includes a receiving module 501, a detection module 502, a processing module 503, and an updating module 504. The receiving module 501 is configured to receive a shell command submitted by an operation and maintenance personnel and write the shell command into a command log file. The detection module 502 is configured to perform matching in a dangerous command library according to the shell command, and in response to hitting a dangerous command in the dangerous command library, throw a prompt to the operation and maintenance personnel to prompt the operation and maintenance personnel whether to continue executing the shell command. The processing module 503 is configured to continue executing the shell command in response to a continue execution instruction submitted by the operation and maintenance personnel, or abandon the execution of the shell command in response to an abandon execution instruction submitted by the operation and maintenance personnel, and write the shell command and its execution result into an execution log file. The updating module 504 is configured to calculate the risk value of each command in the command log file according to the execution log file, and update the commands in the dangerous command library according to the risk value of each command.

[0129] Optionally, the updating module 504 is further configured to:

[0130] For each command in the command log file, calculate the number of submissions of the command.

[0131] For each command in the execution log file, calculate the number of abandon executions and / or the number of continue executions of the command.

[0132] For each command in the command log file, multiply the number of submission times of the command by a first risk coefficient to obtain a first risk parameter, multiply the number of abandonment execution times of the command by a second risk coefficient to obtain a second risk parameter, multiply the number of continuous execution times of the command by a third risk coefficient to obtain a third risk parameter, and calculate a risk value of the command according to the first risk parameter, the second risk parameter and the third risk parameter.

[0133] Optionally, the updating module 504 is further configured to:

[0134] sort the risk values of the commands, filter out N commands with top risk values in the current period, recommend the N commands to the operation and maintenance personnel, and select a command from the N commands by the operation and maintenance personnel to add to the dangerous command;

[0135] filter out M commands with risk values less than or equal to zero in consecutive periods, recommend the M commands to the operation and maintenance personnel, and select a command from the M commands by the operation and maintenance personnel to delete from the dangerous command;

[0136] update the second risk coefficient and the third risk coefficient according to whether the commands are added to or deleted from the dangerous command library.

[0137] Optionally, the receiving module 501 is further configured to:

[0138] receive a login account and a login password submitted by the operation and maintenance personnel before receiving a shell command submitted by the operation and maintenance personnel, so as to log in to the operation and maintenance server and enter a default shell;

[0139] enter a shell command detection environment.

[0140] Optionally, the configuration module is further configured to:

[0141] configure a startup self-starting parameter of the operation and maintenance server before receiving a login account and a login password submitted by the operation and maintenance personnel, so that the operation and maintenance server automatically enters a shell command detection environment after startup.

[0142] Optionally, the detection module 502 is further configured to:

[0143] in response to not hitting a dangerous command in the dangerous command, submit the shell command to a shell, and then submit the shell command to an operation and maintenance server by the shell.

[0144] Optionally, the processing module 503 is further configured to:

[0145] The shell command is submitted to a shell, and the shell submits the shell command to an operation and maintenance server.

[0146] Optionally, the processing module 503 is further configured to:

[0147] After throwing a reminder to the operation and maintenance personnel to prompt the operation and maintenance personnel whether to continue to execute the shell command, in response to not receiving the operation and maintenance personnel submitted execution instruction or abandonment execution instruction within a preset time threshold, the shell command is abandoned.

[0148] It should be noted that the specific implementation of the shell command detection device of the present application has been described in detail in the shell command detection method described above, and therefore the repeated content will not be described here.

[0149] Figure 6 An exemplary system architecture 600 to which embodiments of the present application can be applied is shown.

[0150] As shown in Figure 6 The system architecture 600 can include terminal devices 601, 602, 603, a network 604 and a server 605. The network 604 is used to provide a communication link medium between the terminal devices 601, 602, 603 and the server 605. The network 604 can include various connection types, such as wired, wireless communication links or optical fiber cables, etc.

[0151] The user can use the terminal devices 601, 602, 603 to interact with the server 605 through the network 604 to receive or send messages, etc. Various communication client applications can be installed on the terminal devices 601, 602, 603, such as shopping applications, web browser applications, search applications, instant messaging tools, email clients, social platform software, etc. (only as examples).

[0152] The terminal devices 601, 602, 603 can be various electronic devices with display screens and supporting web browsing, including but not limited to smart phones, tablet computers, laptop computers and desktop computers, etc.

[0153] The server 605 can be a server providing various services, such as a background management server supporting shopping websites browsed by the user using the terminal devices 601, 602, 603 (only as an example). The background management server can analyze and process received item information query requests and other data, and feed back the processing results to the terminal device.

[0154] It should be noted that the shell command detection method provided by the embodiment of the present application is generally executed by the server 605, and accordingly, the shell command detection apparatus is generally arranged in the server 605.

[0155] It should be understood that, Figure 6 The number of terminal devices, networks and servers in the system is merely illustrative. Any number of terminal devices, networks and servers can be provided according to implementation needs.

[0156] Reference is made below in conjunction with Figure 7 which shows a structural schematic diagram of a computer system 700 of a terminal device suitable for use to implement the embodiment of the present application. Figure 7 The terminal device shown is merely an example and should not bring any limitation to the function and use range of the embodiment of the present application.

[0157] As shown in Figure 7 , the computer system 700 includes a central processing unit (CPU) 701 which can perform various appropriate actions and processes according to programs stored in a read-only memory (ROM) 702 or loaded from a storage portion 708 into a random access memory (RAM) 703. Various programs and data required for the operation of the system 700 are also stored in the RAM 703. The CPU 701, the ROM 702 and the RAM 703 are connected to each other through a bus 704. An input / output (I / O) interface 705 is also connected to the bus 704.

[0158] The following components are connected to the I / O interface 705: an input portion 706 including a keyboard, a mouse, etc.; an output portion 707 including a display such as a cathode ray tube (CRT), a liquid crystal display (LCD), etc., and a speaker, etc.; a storage portion 708 including a hard disk, etc.; and a communication portion 709 including a network interface card such as a LAN card, a modem, etc. The communication portion 709 performs communication processing via a network such as the Internet. A drive 710 is also connected to the I / O interface 705 as needed. A removable recording medium 711 such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, etc. is attached to the drive 710 as needed, so that a computer program read therefrom is installed in the storage portion 708 as needed.

[0159] In particular, the processes described above with reference to the flow charts can be implemented as a computer software program in accordance with the embodiments disclosed herein. For example, embodiments disclosed herein include a computer program comprising a computer program carried on a computer readable medium, the computer program comprising program code for performing the methods illustrated by the flow charts. In such embodiments, the computer program can be downloaded and installed from a network via the communications portion 709 and / or installed from the removable media 711. When the computer program is executed by the central processing unit (CPU) 701, the above-described functions defined in the system of the present invention are performed.

[0160] It should be noted that the computer readable medium shown in the present invention can be a computer readable signal medium or a computer readable storage medium or any combination thereof. The computer readable storage medium may, for example, but is not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or apparatus, or any combination thereof. More specific examples of the computer readable storage medium can include, but are not limited to, an electrical connection having one or more wires, a portable computer diskette, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination thereof. In the present invention, the computer readable storage medium can be any tangible medium that contains or stores a program that can be used by or in connection with an instruction execution system, apparatus or device. In the present invention, the computer readable signal medium can include a data signal carried in a baseband or as a part of a carrier wave, which carries computer readable program code. Such a propagated data signal can take many forms, including but not limited to, an electromagnetic signal, an optical signal or any suitable combination thereof. The computer readable signal medium can also be any computer readable medium that can send, propagate or transfer a program for use by or in connection with an instruction execution system, apparatus or device. The program code contained on the computer readable medium can be transmitted using any suitable medium, including but not limited to, wireless, wire line, optical fiber cable, RF, etc., or any suitable combination thereof.

[0161] The computer program product can include a computer readable medium, the computer readable medium including instructions for causing a processor to implement a method according to the embodiments of the present application.

[0162] The modules described in the embodiments of the present application can be implemented by software, or by hardware, or by a combination of software and hardware. The modules described can be arranged in a processor, for example, can be described as: a processor includes a receiving module, a detecting module, a processing module and an updating module, and the names of the modules do not constitute limitation on the modules themselves in some cases.

[0163] As another aspect, the present application also provides a computer readable medium, which can be included in the device described in the above embodiments, or can exist independently without being assembled into the device. The computer readable medium carries one or more programs, and when the one or more programs are executed by the device, the device implements the following method: receiving a shell command submitted by an operation and maintenance personnel and writing the shell command into a command log file; matching the shell command in a dangerous command library, and in response to a dangerous command in the dangerous command, throwing a prompt to the operation and maintenance personnel; in response to a continue execution instruction submitted by the operation and maintenance personnel, continuing to execute the shell command; or in response to an abandon execution instruction submitted by the operation and maintenance personnel, abandoning the execution of the shell command; and writing the shell command and the execution result into an execution log file; calculating a risk value of each command in the command log file according to the execution log file, so as to update the commands in the dangerous command library according to the risk values of the commands.

[0164] As another aspect, the embodiments of the present application also provide a computer program product, including a computer program, and the computer program is executed by a processor to implement the method described in any of the above embodiments.

[0165] According to the technical scheme of the embodiment of the present application, because the shell command is matched in the dangerous command library according to the shell command, a prompt is thrown to the operation and maintenance personnel in response to a dangerous command in the dangerous command, the shell command is continued to execute in response to a continue-to-execute instruction submitted by the operation and maintenance personnel, or the shell command is abandoned to execute in response to an abandon-to-execute instruction submitted by the operation and maintenance personnel, the technical scheme overcomes the technical problem that a production accident caused by a misoperation and the like cannot be avoided in the prior art. The embodiment of the present application intervenes in detection before the shell command is submitted, rather than merely records an operation after execution, and thus completes dangerous command auditing without adding too much complexity to original operation and maintenance operation and without changing original operation and maintenance habits, guarantees the safety of operation and maintenance operation of the operation and maintenance personnel, avoids operation and maintenance risks caused by unfamiliarity and misoperation and the like, and thus avoids operation and maintenance risks as much as possible.

[0166] The above detailed description does not constitute a limitation on the protection scope of the present application. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations and replacements can occur depending on design requirements and other factors. Any modification, equivalent replacement and improvement within the spirit and principle of the present application shall be included in the protection scope of the present application.

Claims

1. A shell command detection method, characterized by, The method comprises the following steps: receiving a shell command submitted by an operation and maintenance personnel and writing the shell command into a command log file; matching the shell command in a dangerous command library, and in response to a dangerous command in the dangerous command library, throwing a prompt to the operation and maintenance personnel to prompt whether to continue executing the shell command; in response to a continue execution instruction submitted by the operation and maintenance personnel, continuing to execute the shell command, or in response to an abandon execution instruction submitted by the operation and maintenance personnel, abandoning the execution of the shell command; and writing the shell command and its execution result into an execution log file; calculating the risk value of each command in the command log file according to the execution log file, thereby updating the command in the dangerous command library according to the risk value of each command; calculating the risk value of each command in the command log file according to the execution log file, comprising: for each command in the command log file, calculating the number of submissions of the command; for each command in the execution log file, calculating the number of abandon executions and / or the number of continue executions of the command; for each command in the command log file, multiplying the number of submissions of the command by a first risk coefficient to obtain a first risk parameter, multiplying the number of abandon executions of the command by a second risk coefficient to obtain a second risk parameter, multiplying the number of continue executions of the command by a third risk coefficient to obtain a third risk parameter, and calculating the risk value of the command according to the first risk parameter, the second risk parameter and the third risk parameter.

2. The method of claim 1, wherein, updating the command in the dangerous command library according to the risk value of each command, comprising: sorting the risk values of the commands, screening out N commands with high risk values in the current period, recommending the N commands to the operation and maintenance personnel, and selecting a command from the N commands by the operation and maintenance personnel to add to the dangerous command library; screening out M commands with risk values less than or equal to zero in continuous periods, recommending the M commands to the operation and maintenance personnel, and selecting a command from the M commands by the operation and maintenance personnel to delete from the dangerous command library; updating the second risk coefficient and the third risk coefficient according to whether the command is added to the dangerous command library or deleted from the dangerous command library.

3. The method of claim 1, wherein, Before receiving the shell command submitted by the operation and maintenance personnel, the method further comprises the following steps: receiving a login account and a login password submitted by the operation and maintenance personnel for logging into an operation and maintenance server, thereby logging into the operation and maintenance server and entering a default shell; entering a shell command detection environment.

4. The method of claim 3, wherein, Before receiving the login account and the login password submitted by the operation and maintenance personnel for logging into the operation and maintenance server, the method further comprises the following steps: configuring a startup self-starting parameter of the operation and maintenance server to automatically enter the shell command detection environment after the operation and maintenance server is started.

5. The method of claim 1, wherein, The method further comprises the following steps: in response to not hitting the dangerous command in the dangerous command library, submitting the shell command to a shell, and then submitting the shell command to the operation and maintenance server by the shell.

6. The method of claim 1, wherein, continuing to execute the shell command, including: submitting the shell command to a shell, and submitting the shell command to an operation and maintenance server by the shell; 7. The method of claim 1, wherein, throwing a prompt to the operation and maintenance personnel to prompt whether to continue to execute the shell command, and further including: abandoning to execute the shell command in response to not receiving a continue-to-execute instruction or an abandon-to-execute instruction submitted by the operation and maintenance personnel within a preset time threshold.

8. A shell command detection apparatus characterized by comprising: including: a receiving module, configured to receive a shell command submitted by an operation and maintenance personnel and write the shell command into a command log file; a detecting module, configured to match the shell command in a dangerous command library, and throw a prompt to the operation and maintenance personnel in response to hitting a dangerous command in the dangerous command library to prompt whether to continue to execute the shell command; a processing module, configured to continue to execute the shell command in response to a continue-to-execute instruction submitted by the operation and maintenance personnel, or abandon to execute the shell command in response to an abandon-to-execute instruction submitted by the operation and maintenance personnel, and write the shell command and an execution result of the shell command into an execution log file; an updating module, configured to calculate a risk value of each command in the command log file according to the execution log file, and update a command in the dangerous command library according to the risk value of the each command; the updating module is further configured to: calculate a submission frequency of the each command in the command log file; calculate an abandon-to-execute frequency and / or a continue-to-execute frequency of the each command in the execution log file; multiply the submission frequency of the each command in the command log file by a first risk coefficient to obtain a first risk parameter, multiply the abandon-to-execute frequency of the each command by a second risk coefficient to obtain a second risk parameter, multiply the continue-to-execute frequency of the each command by a third risk coefficient to obtain a third risk parameter, and calculate a risk value of the each command according to the first risk parameter, the second risk parameter and the third risk parameter.

9. The apparatus of claim 8, wherein, the updating module is further configured to: sort the risk values of the each command, filter out N commands with risk values in the front in a current period, recommend the N commands to the operation and maintenance personnel, and select a command from the N commands by the operation and maintenance personnel to add to the dangerous command library; filter out M commands with risk values less than or equal to zero in continuous periods, recommend the M commands to the operation and maintenance personnel, and select a command from the M commands by the operation and maintenance personnel to delete from the dangerous command library; update the second risk coefficient and the third risk coefficient according to whether the each command is added to the dangerous command library or deleted from the dangerous command library.

10. The apparatus of claim 8, wherein, the receiving module is further configured to: receive a login account and a login password of an operation and maintenance personnel submitted for logging into an operation and maintenance server before receiving a shell command submitted by the operation and maintenance personnel, so as to log into the operation and maintenance server and enter a default shell; enter a shell command detection environment.

11. The apparatus of claim 10, wherein, The application further comprises a configuration module configured to: Before receiving a login account and a login password submitted by an operation and maintenance personnel for logging into an operation and maintenance server, configure a startup self-starting parameter of the operation and maintenance server, so that the operation and maintenance server automatically enters a shell command detection environment after being started up.

12. The apparatus of claim 8, wherein, The detection module is further configured to: In response to not hitting a dangerous command in the dangerous command library, submit the shell command to a shell, and then submit the shell command to the operation and maintenance server by the shell.

13. The apparatus of claim 8, wherein, The processing module is further configured to: Submit the shell command to a shell, and then submit the shell command to the operation and maintenance server by the shell.

14. The apparatus of claim 8, wherein, The processing module is further configured to: After throwing a prompt to the operation and maintenance personnel to prompt whether to continue to execute the shell command, in response to not receiving a continue-to-execute instruction or an abandon-to-execute instruction submitted by the operation and maintenance personnel within a preset time threshold, abandon to execute the shell command.

15. An electronic device, comprising: The application comprises: one or more processors; a storage device configured to store one or more programs, when the one or more programs are executed by the one or more processors, the one or more processors implement the method as claimed in any one of claims 1-7.

16. A computer readable medium having stored thereon a computer program, characterized in that, The program is executed by the processor to implement the method as claimed in any one of claims 1-7.

17. A computer program product comprising a computer program, characterized in that, The computer program is executed by the processor to implement the method as claimed in any one of claims 1-7.

Images