Log auditing method and device, state machine and storage medium

Abstract

The application discloses a log auditing method and device, a state machine and a storage medium, and the method comprises the following steps: acquiring an access path contained in an operation log to be audited; controlling a finite state machine to be converted to a target working state according to an operation command corresponding to the access path, and acquiring state conversion process information of the finite state machine converted to the target working state; generating path switching process information of the access path according to the state conversion process information; and outputting the path switching process information and illegal operation alarm information when preset sensitive path is included in the path switching process information. The application realizes the monitoring of the whole access path when a user accesses a system, and improves the accuracy of illegal operation log auditing and the efficiency of operation log auditing.

Description

Technical Field

[0001] This invention relates to the field of information security technology, and in particular to a log auditing method, apparatus, state machine, and storage medium. Background Technology

[0002] Existing operation log auditing methods mainly analyze user operation logs through two approaches: manual auditing and keyword recognition. These methods identify special instructions in the operation logs and determine whether the user has engaged in any violations based on the identification results. However, these two methods are relatively limited and cannot monitor access to system paths. Summary of the Invention

[0003] This application provides a log auditing method, apparatus, state machine, and storage medium, aiming to solve the technical problem that the access status of system paths cannot be monitored when analyzing operation logs through manual auditing and keyword recognition methods.

[0004] This application provides a log auditing method applied to a finite state machine, the log auditing method comprising:

[0005] Obtain the access paths contained in the operation logs to be audited;

[0006] The finite state machine is controlled to transition to the target working state according to the operation command corresponding to the access path, and the state transition process information of the finite state machine to the target working state is obtained;

[0007] The path switching process information of the access path is generated based on the state transition process information;

[0008] When the path switching process information includes a preset sensitive path, the path switching process information and violation operation alarm information are output.

[0009] In one embodiment, the target working state includes an initial state, a first dwell state corresponding to the initial state, a sensitive state, and a second dwell state corresponding to the sensitive state.

[0010] In one embodiment, the step of controlling the finite state machine to transition to the target working state according to the operation command corresponding to the access path includes:

[0011] Obtain the operation command corresponding to the access path;

[0012] When the operation command includes a first command symbol corresponding to a preset command, and the operation command includes a sensitive operation command corresponding to the preset sensitive path, the finite state machine is controlled to transition from the initial state to the sensitive state.

[0013] When the operation command does not contain the first command symbol, but contains the sensitive operation command, the finite state machine is controlled to transition from the current working state to the sensitive state.

[0014] In one embodiment, after the step of obtaining the operation command corresponding to the access path, the method further includes:

[0015] When the operation command includes the first command symbol and does not include the sensitive operation command, the finite state machine is controlled to transition from the initial state to the first lingering state.

[0016] When the operation command does not contain the first command symbol and does not contain the sensitive operation command, the finite state machine is controlled to transition from the current working state to the first lingering state or the second lingering state.

[0017] In one embodiment, when the current operating state is the first stagnant state or the second stagnant state, the step of controlling the finite state machine to transition from the current operating state to the first stagnant state or the second stagnant state includes:

[0018] Determine the full path depth and sensitive path depth corresponding to the access path;

[0019] Determine the depth parameters based on the full path depth and the sensitive path depth;

[0020] When the sensitive path depth does not change and the depth parameter increases or the sensitive path depth does not change, the finite state machine is controlled to maintain the current working state as the first lingering state or the second lingering state.

[0021] In one embodiment, after the step of obtaining the operation command corresponding to the access path, the method further includes:

[0022] When the operation command includes a second command symbol corresponding to the preset command and the operation command includes the sensitive operation command, the finite state machine is controlled to transition from the current working state to the previous working state, and the finite state machine is controlled to transition from the previous working state to the sensitive state according to the operation command.

[0023] When the operation command includes the second command symbol and does not include the sensitive operation command, the finite state machine is controlled to transition from the current working state to the previous working state, and the finite state machine is controlled to transition from the previous working state to the first lingering state or the second lingering state according to the operation command.

[0024] In one embodiment, the log auditing method further includes:

[0025] Obtain the original operation log;

[0026] The original operation logs are filtered and sorted to obtain the operation logs to be audited.

[0027] Furthermore, to achieve the above objectives, the present invention also provides a log auditing device, the log auditing device comprising:

[0028] The path acquisition module is used to obtain the access paths contained in the operation logs to be audited;

[0029] The state transition module is used to control the finite state machine to transition to the target working state according to the operation command corresponding to the access path, and to obtain the state transition process information of the finite state machine to the target working state;

[0030] The path generation module is used to generate path switching process information for the access path based on the state transition process information.

[0031] The path output module is used to output the path switching process information and the violation alarm information when the path switching process information includes a preset sensitive path.

[0032] In addition, to achieve the above objectives, the present invention also provides a finite state machine, which includes: a memory, a processor, and a log auditing program stored in the memory and executable on the processor. When the log auditing program is executed by the processor, it implements the steps of the log auditing method described above.

[0033] In addition, to achieve the above objectives, the present invention also provides a storage medium storing a log auditing program thereon, which, when executed by a processor, implements the steps of the log auditing method described above.

[0034] The log auditing method, apparatus, state machine, and storage medium provided in this application embodiment have at least the following technical effects or advantages:

[0035] This invention employs a technical solution that involves acquiring access paths contained in the operation logs to be audited, controlling a finite state machine to transition to a target working state based on the operation commands corresponding to the access paths, acquiring the state transition process information of the finite state machine to the target working state, generating path switching process information of the access paths based on the state transition process information, and outputting path switching process information and violation operation alarm information when the path switching process information includes preset sensitive paths. By simulating the user's operation process of accessing system paths through a finite state machine, this invention solves the technical problem that it is impossible to monitor the access status of system paths when analyzing operation logs through manual auditing and keyword recognition methods. It realizes the monitoring of the entire access path when a user accesses the system, which not only enhances the accuracy of violation operation log auditing but also improves the efficiency of operation log auditing. Attached Figure Description

[0036] Figure 1 This is a schematic diagram of the hardware operating environment involved in the embodiments of the present invention;

[0037] Figure 2 This is a flowchart illustrating an embodiment of the log auditing method of the present invention;

[0038] Figure 3 This is a schematic diagram of the original operation log data;

[0039] Figure 4 This is a data illustration of the operation log to be audited;

[0040] Figure 5 This is a schematic diagram illustrating the working principle of the finite state machine of the present invention;

[0041] Figure 6 This is a schematic diagram of the execution mechanism of the finite state machine in the suspended state of the present invention;

[0042] Figure 7 This is a functional block diagram of the log auditing device of the present invention. Detailed Implementation

[0043] To better understand the above technical solutions, exemplary embodiments of this disclosure will be described in more detail below with reference to the accompanying drawings. While exemplary embodiments of this disclosure are shown in the drawings, it should be understood that this disclosure can be implemented in various forms and should not be limited to the embodiments set forth herein. Rather, these embodiments are provided so that this disclosure will be thorough and complete, and will fully convey the scope of this disclosure to those skilled in the art.

[0044] like Figure 1 As shown, Figure 1 This is a schematic diagram of the hardware operating environment involved in the embodiments of the present invention.

[0045] It should be noted that, Figure 1 This can be a schematic diagram of the hardware operating environment of a finite state machine.

[0046] As one implementation method, it can be as follows Figure 1 As shown, the embodiment of the present invention relates to a finite state machine, which includes: a processor 1001, such as a CPU, a memory 1002, and a communication bus 1003. The communication bus 1003 is used to implement communication between these components.

[0047] Memory 1002 can be high-speed RAX memory or stable memory (non-volatile XeXory), such as disk storage. Figure 1 As shown, the memory 1002, which serves as a storage medium, may include a log auditing program; and the processor 1001 may be used to call the log auditing program stored in the memory 1002 and perform the following operations:

[0048] The log auditing method, applied to finite state machines, includes:

[0049] Obtain the access paths contained in the operation logs to be audited;

[0050] The finite state machine is controlled to transition to the target working state according to the operation command corresponding to the access path, and the state transition process information of the finite state machine to the target working state is obtained;

[0051] The path switching process information of the access path is generated based on the state transition process information;

[0052] When the path switching process information includes a preset sensitive path, the path switching process information and violation operation alarm information are output.

[0053] Furthermore, the processor 1001 can be used to invoke the log auditing program stored in the memory 1002 and perform the following operations:

[0054] Obtain the operation command corresponding to the access path;

[0055] When the operation command includes a first command symbol corresponding to a preset command, and the operation command includes a sensitive operation command corresponding to the preset sensitive path, the finite state machine is controlled to transition from the initial state to the sensitive state.

[0056] When the operation command does not contain the first command symbol, but contains the sensitive operation command, the finite state machine is controlled to transition from the current working state to the sensitive state.

[0057] Furthermore, the processor 1001 can be used to invoke the log auditing program stored in the memory 1002 and perform the following operations:

[0058] When the operation command includes the first command symbol and does not include the sensitive operation command, the finite state machine is controlled to transition from the initial state to the first lingering state.

[0059] When the operation command does not contain the first command symbol and does not contain the sensitive operation command, the finite state machine is controlled to transition from the current working state to the first lingering state or the second lingering state.

[0060] Furthermore, the processor 1001 can be used to invoke the log auditing program stored in the memory 1002 and perform the following operations:

[0061] Determine the full path depth and sensitive path depth corresponding to the access path;

[0062] Determine the depth parameters based on the full path depth and the sensitive path depth;

[0063] When the sensitive path depth does not change and the depth parameter increases or the sensitive path depth does not change, the finite state machine is controlled to maintain the current working state as the first lingering state or the second lingering state.

[0064] Furthermore, the processor 1001 can be used to invoke the log auditing program stored in the memory 1002 and perform the following operations:

[0065] When the operation command includes a second command symbol corresponding to the preset command and the operation command includes the sensitive operation command, the finite state machine is controlled to transition from the current working state to the previous working state, and the finite state machine is controlled to transition from the previous working state to the sensitive state according to the operation command.

[0066] When the operation command includes the second command symbol and does not include the sensitive operation command, the finite state machine is controlled to transition from the current working state to the previous working state, and the finite state machine is controlled to transition from the previous working state to the first lingering state or the second lingering state according to the operation command.

[0067] Furthermore, the processor 1001 can be used to invoke the log auditing program stored in the memory 1002 and perform the following operations:

[0068] Obtain the original operation log;

[0069] The original operation logs are filtered and sorted to obtain the operation logs to be audited.

[0070] This invention provides an embodiment of a log auditing method. It should be noted that although the logical order is shown in the flowchart, in some cases, the steps shown or described may be performed in a different order than that shown here.

[0071] like Figure 2 As shown, in the first embodiment of this application, the log auditing method is applied to a finite-state machine (FSM), also known as a finite-state finite-state machine, or simply a state machine. The log auditing method includes the following steps:

[0072] Step S210: Obtain the access path contained in the operation log to be audited.

[0073] In this embodiment, the auditable operation log refers to a series of operations performed by the user on the system in the past, which may include operations such as log clearing, permission granting, service startup and pausing, and software installation. The auditable operation log includes multiple access paths and the corresponding operation commands for each access path, for example, "vi / var / log / message", where " / var / log / message" represents the access path and "vi / var / log / message" represents the operation command.

[0074] Specifically, each access path in the operation log to be audited is different and arranged in sequence. Since the system records raw operation logs, these logs may contain malformed data, irrelevant data, data with disordered time sequence, or duplicate data. Therefore, before obtaining the operation logs to be audited, the raw operation logs need to be cleaned, i.e., removing malformed, irrelevant, disordered, and duplicate log data to obtain the operation logs to be audited. Here, "duplicate" refers to repeated operations under the same path. The cleaning process includes: obtaining the raw operation logs, filtering and sorting the raw operation logs to obtain the operation logs to be audited. The filtering settings remove malformed, irrelevant, and duplicate log data, and the remaining log data constitutes the data for the operation logs to be audited. The remaining log data is then sorted by time to obtain the operation logs to be audited. After obtaining the remaining log data, step S210, obtaining the access paths contained in the operation logs to be audited, is executed.

[0075] like Figure 3 As shown, Figure 3The original operation logs show that the first operation log entry in region ①, dated May 13, 2021, should precede the first operation log entry. The second and third operation log entries in region ①, dated 16:00, are later than 15:00 and should follow the first operation log entry. Regions ② and ③ indicate that duplicate instructions were executed under the same path; log preprocessing will deduplicate these instructions based on their context. Figure 3 After cleaning the original operation logs, the operation logs to be audited are obtained, as shown in the example below. Figure 4 As shown.

[0076] Step S220: Control the finite state machine to transition to the target working state according to the operation command corresponding to the access path, and obtain the state transition process information of the finite state machine to the target working state.

[0077] Step S230: Generate path switching process information for the access path based on the state transition process information.

[0078] Because different servers have different sensitive paths, folders, and file contents, common log paths such as " / var / log" and "~ / .bash_history" are excluded. Some servers also run their own databases, specific websites, and other services. In this embodiment, the finite state machine provides personalized settings, supporting on-demand configuration of monitored paths, directories, and files for log auditing, offering strong flexibility to meet personalized monitoring needs. For example, suppose the server has a MySQL database installed at " / var / lib / mysql / ", and monitoring of the MySQL database is required. Users can personalize the configuration by configuring the corresponding configuration file for the finite state machine, adding the paths to be monitored in the configuration file. For example, paths to be monitored might be " / var / lib / mysql", " / usr / share / mysql", or " / var / log / *.cnf". In this embodiment, the paths to be monitored are referred to as preset sensitive paths. If the user does not configure preset sensitive paths, the finite state machine uses its own stored default paths as preset sensitive paths.

[0079] In this embodiment, the finite state machine has multiple target working states, including an initial state, a first dwell state corresponding to the initial state, a sensitive state, and a second dwell state corresponding to the sensitive state. The initial state indicates that the finite state machine is starting from scratch. A sensitive state can be understood as the user's access path, simulated by the finite state machine, entering a preset sensitive path, or as the user's access path being a preset sensitive path. The initial state corresponds to one first dwell state, and the sensitive state corresponds to one second dwell state. The first and second dwell states indicate that the user's access path is not a preset sensitive path, but the user's access path may also contain parts of the preset sensitive path. The number of sensitive states is determined by the depth of the preset sensitive path; the greater the depth of the preset sensitive path, the more sensitive states there are. For example, if the preset sensitive path is " / var" and the depth of the preset sensitive path is 1, then there is one sensitive state, corresponding to one second dwell state. As another example, if the preset sensitive path is " / var / lib / ", then there are two sensitive states, the depth of the preset sensitive path is 2, and each of the two sensitive states corresponds to one second dwell state.

[0080] Typically, when a user needs to access a specific path, they enter all available paths through corresponding operation commands. If the path the user needs to access is a preset sensitive path, meaning it is monitored by the system, and the user needs to perform operations on files within that preset sensitive path, they might try to circumvent system monitoring by circumventing the system's detection. This involves entering various different operation commands to eventually enter the preset sensitive path, and then performing unauthorized operations within that path. Based on this, the finite state machine described in this embodiment can simulate and reconstruct the paths already accessed by the user, thereby obtaining the specific processes the user goes through to enter and access the path—that is, the entire access path process. This entire access path process may involve directly reaching the desired path, or it may involve taking a detour before finally arriving at the desired path. In this embodiment, the entire access path process is referred to as path switching process information. For example, if a user needs to access the path " / var / lib", after entering the operation command, the user first enters " / var", then enters another operation command to enter " / message", then enters another operation command back to " / var", and then enters another operation command to enter " / lib / ", that is, arrives at "lib". The process of " / var" - " / message" - " / var" - " / lib" is the path switching process information.

[0081] Specifically, after obtaining the access paths contained in the operation log to be audited, the finite state machine is controlled to transition to the target working state according to the operation commands corresponding to the access paths. The current working state of the finite state machine can be any one of the following: initial state, first stagnation state, sensitive state, and second stagnation state. If the access path does not include a preset sensitive path, and the current working state is the initial state, then the machine transitions from the current working state to the first stagnation state. If the access path includes a preset sensitive path, then the machine first transitions from the first stagnation state to the initial state, and then from the initial state to the sensitive state. If the next user-inputted operation command accesses the next path based on the preset sensitive path, then the machine transitions from the sensitive state to the second stagnation state. Therefore, the state transition process information for the finite state machine to the target working state is: initial state - first stagnation state - initial state - sensitive state - second stagnation state. The path switching process information can be determined through this sequence. For example, the default sensitive path is " / var", the operation command corresponding to the initial state - first lingering state is "cd etc", the operation command corresponding to the first lingering state - initial state - sensitive state is "cd / var", the operation command corresponding to the sensitive state - second lingering state is "cd message", and the path switching process information is " / etc" - " / var" - " / message".

[0082] If the access path includes a preset sensitive path, and the current working state is the initial state, then the system transitions from the current working state to the sensitive state. That is, if the current working state is the sensitive state, the user's next input command accesses the next path based on the preset sensitive path. If this next path is not a preset sensitive path, then the system transitions from the sensitive state to the second dwell state. Therefore, the state transition process information from the initial state to the target working state is: initial state - sensitive state - second dwell state. The path switching process information can be determined through the initial state - sensitive state - second dwell state. For example, if the preset sensitive path is " / var", the operation command corresponding to the initial state - sensitive state is "cd / var", and the operation command corresponding to the sensitive state - second dwell state is "cd message", then the path switching process information is " / var / message".

[0083] Step S240: When the path switching process information includes a preset sensitive path, output the path switching process information and the violation operation alarm information.

[0084] In this embodiment, after obtaining the path switching process information, it is determined whether the path switching process information includes a preset sensitive path. If the path switching process information includes a preset sensitive path, the path switching process information and the violation operation alarm information are output. For example, if the preset sensitive path is " / var / lib / ", and the path switching process information is " / var" - " / message" - " / var" - " / lib", then the path switching process information includes " / var / lib". In this case, the path switching process information and violation operation alarm information will be output. The violation operation alarm information is used to alert backend monitoring personnel that a user is suspected of violating the preset sensitive path, allowing them to take appropriate action. Furthermore, backend monitoring personnel can also use the output path switching process information to detect which specific operations the user performed to enter the preset sensitive path. If the user entered the preset sensitive path by taking a detour, the path switching process information will clearly show which detours were taken. Additionally, after obtaining the path switching process information, the finite state machine can also directly output the path switching process information. Backend monitoring personnel can analyze the user's access path using the output path switching process information to determine whether the user took a detour to enter the preset sensitive path. This achieves monitoring of the entire access path process when a user accesses the system, enhancing both the accuracy and efficiency of violation operation log auditing.

[0085] This embodiment employs a technical solution that involves acquiring the access paths contained in the operation logs to be audited, controlling a finite state machine to transition to a target working state based on the operation commands corresponding to the access paths, acquiring the state transition process information of the finite state machine to the target working state, generating path switching process information of the access paths based on the state transition process information, and outputting path switching process information and violation operation alarm information when the path switching process information includes preset sensitive paths. By simulating the user's operation process of accessing the system path through a finite state machine, the entire access path is monitored when the user accesses the system, which not only enhances the accuracy of violation operation log auditing but also improves the efficiency of operation log auditing.

[0086] Furthermore, based on the above embodiments, the step of controlling the finite state machine to transition to the target working state according to the operation command corresponding to the access path includes:

[0087] Obtain the operation command corresponding to the access path;

[0088] When the operation command includes a first command symbol corresponding to a preset command, and the operation command includes a sensitive operation command corresponding to the preset sensitive path, the finite state machine is controlled to transition from the initial state to the sensitive state.

[0089] When the operation command does not contain the first command symbol, but contains the sensitive operation command, the finite state machine is controlled to transition from the current working state to the sensitive state.

[0090] For ease of understanding, this embodiment uses 0 to represent the initial state, denoted as state 0, A to represent the first retention state, 1 to represent the sensitive state, denoted as state 1, 2 to represent the sensitive state, denoted as state 2, and B1 and B2 to represent the second retention state, as detailed below. Figure 5 As shown. Among them, Figure 5 In this example, is a mode of operation for a finite state machine. It indicates that the depth of the preset sensitive path is 2, resulting in two sensitive states: state 1 and state 2. The second dwell state corresponding to state 1 is B1, and the second dwell state corresponding to state 2 is B2. The first dwell state corresponding to state 0 is A. A, B1, and B2 can all transition to state 0. State 0 and state 1 can transition to each other, as can state 1 and state 2, state 0 and A, state 1 and B1, and state 2 and B2.

[0091] The system mentioned above refers to the Linux system. Linux system commands are mainly divided into two categories: the first category includes commands that can change the current path, such as "cd" and "pushd"; the second category includes commands that cannot change the current path, such as "vi", "vim", and "cp". In each state of the finite state machine, when executing a command of the first category, such as "cd / var / tmp" or "cd / etc", the finite state machine first determines whether the path starts with " / ". If it does, the path transition begins from state 0 of the finite state machine; otherwise, the transition begins from the current working state.

[0092] When executing the second type of operation command, such as Figure 5 As shown, when the finite state machine is in state 2, and the current user inputs the command "vi / var / log / message", the finite state machine needs to first parse the path following "vi". If it starts with " / ", it starts from state 0 of the finite state machine, reads "var", transitions to state 1, then reads "log", and transitions to state 2. If the path following "vi" does not start with " / ", the finite state machine starts the state transition from the current working state, i.e., the path "var". If the path following "vi" starts with "..", the finite state machine needs to transition from the current working state to the previous state before inputting the path for transition.

[0093] Specifically, the preset commands include the first type of operation commands and the second type of operation commands, where " / " represents the first command symbol and ".." represents the second command symbol. After obtaining the operation log to be audited, the operation commands corresponding to the access paths contained in the operation log are obtained. If it is determined that the operation command contains the first command symbol corresponding to the preset command (i.e., starting with " / "), and the operation command contains a sensitive operation command corresponding to a preset sensitive path, then the finite state machine transitions from the initial state to the sensitive state. Here, a sensitive operation command refers to a command that, when entered by the user, will cause the system to enter a preset sensitive path. For example, if " / var / log" is the preset sensitive path and the operation command is "cd / var / log", then the finite state machine will start transitioning from state 0, first transitioning to state 1, and then from state 1 to state 2.

[0094] If the operation command does not contain " / " (i.e., does not begin with " / "), and the operation command contains a sensitive operation command, the finite state machine transitions from the current working state to the sensitive state. The current working state can be one of state 0, state 1, state 2, A, B1, or B2. For example, if the current working state is A, the machine first transitions from A to state 0, then from state 0 to state 1, and finally from state 1 to state 2.

[0095] Furthermore, after the step of obtaining the operation command corresponding to the access path, the method further includes:

[0096] When the operation command includes the first command symbol and does not include the sensitive operation command, the finite state machine is controlled to transition from the initial state to the first lingering state.

[0097] When the operation command does not contain the first command symbol and does not contain the sensitive operation command, the finite state machine is controlled to transition from the current working state to the first lingering state or the second lingering state.

[0098] If the operation command begins with " / " and does not contain a sensitive operation command, the finite state machine transitions from state 0 to state A. If the operation command does not begin with " / " and does not contain a sensitive operation command, the finite state machine transitions from the current working state to one of A, B1, or B2. The specific transition from the current working state to A, B1, or B2 depends on the current working state. For example, if the current working state is state 0, the transition is from state 0 to A; if the current working state is state 1, the transition is from state 1 to B1; and if the current working state is state 2, the transition is from state 2 to B2.

[0099] Furthermore, after the step of obtaining the operation command corresponding to the access path, the method further includes:

[0100] When the operation command includes a second command symbol corresponding to the preset command and the operation command includes the sensitive operation command, the finite state machine is controlled to transition from the current working state to the previous working state, and the finite state machine is controlled to transition from the previous working state to the sensitive state according to the operation command.

[0101] When the operation command includes the second command symbol and does not include the sensitive operation command, the finite state machine is controlled to transition from the current working state to the previous working state, and the finite state machine is controlled to transition from the previous working state to the first lingering state or the second lingering state according to the operation command.

[0102] Specifically, if the operation command contains a second command symbol corresponding to a preset command (i.e., the operation command begins with "..") and contains a sensitive operation command, then the finite state machine transitions from the current working state to the previous working state, and then transitions from the previous working state to the sensitive state according to the operation command. The current working state can be one of state 0, state 1, state 2, A, B1, and B2, and the previous working state can also be one of state 0, state 1, state 2, A, B1, and B2. For example, if the current working state is state 1, the previous working state is A, and the sensitive operation command is to enter state 2, then the finite state machine transitions from state 1 to A, then from A back to state 1, and then from state 1 to state 2.

[0103] If the operation command begins with ".." and does not contain a sensitive operation command, the finite state machine transitions from the current working state to the previous working state, and then transitions from the previous working state to either the first dwell state or the second dwell state according to the operation command. Similarly, the current working state can be one of state 0, state 1, state 2, A, B1, and B2, and the previous working state can also be one of state 0, state 1, state 2, A, B1, and B2.

[0104] For example, if the current working state is state 1 and the previous working state was state 0, and "cd.. / yum / " is detected in state 1, then the finite state machine transitions from state 1 to state 0, and then from state 0 to A. As another example, if the current working state is state 2 and the previous working state was B2, and "cd.. / yum / " is detected in state 2, then the finite state machine transitions from state 2 to B2, and then remains in state B2.

[0105] Furthermore, such as Figure 6 As shown, Figure 6 This describes the execution mechanism of the finite state machine in a suspended state. If the current operating state is the first suspended state or the second suspended state, the step of controlling the finite state machine to transition from the current operating state to the first suspended state or the second suspended state includes:

[0106] Determine the full path depth and sensitive path depth corresponding to the access path;

[0107] Determine the depth parameters based on the full path depth and the sensitive path depth;

[0108] When the sensitive path depth does not change and the depth parameter increases or the sensitive path depth does not change, the finite state machine is controlled to maintain the current working state as the first lingering state or the second lingering state.

[0109] It should be understood that the depth parameter is represented as `depth`, where `depth` = total path depth - sensitive path depth. For example, if ` / var / log` is the default sensitive path and the access path is `var / lib`, the total path depth is 2, and the sensitive path depth is 1, so `depth` = 2 - 1 = 1. As another example, if a user is located under the `var / lib` path, the total path depth is 2, and the current path is under the sensitive path `var`, the finite state machine is in state 1, B1, and the sensitive path depth is 1, therefore `depth` = 2 - 1 = 1. If the user is located under the `usr / local` path, the total path depth is 2, and the current path does not contain the sensitive path, the state machine is in state 0, the sensitive path depth is 0, therefore `depth` = 2 - 0 = 2.

[0110] Provided that the operation command does not contain the first command symbol and does not contain sensitive operation commands, after calculating the depth, if the sensitive path depth does not change (e.g., it is always 1) and the depth parameter increases, then if the current working state is one of A, B1, or B2, the current working state remains unchanged. For example, if the current working state is B1, the finite state machine remains in B1 without transitioning. Alternatively, provided that the operation command does not contain the first command symbol and does not contain sensitive operation commands, after calculating the depth, if the sensitive path depth does not change, the finite state machine remains unchanged in its current working state. That is, if the current working state is the first dwelling state, it remains in the first dwelling state; if the current working state is the second dwelling state, it remains in the second dwelling state.

[0111] Assuming " / var / log" is a default sensitive path, the following explains the transition process for states 0, 1, 2, A, B1, and B2. This transition process can be achieved through... Figure 5and Figure 6 It is shown that:

[0112] For state 0, when "cd / var" or "pushd / var" is detected, the finite state machine transitions from state 0 to state 1; when "cd / var / log" is detected, the finite state machine transitions from state 1 to state 2; when operations other than "cd / var" or "cd / var / log" are detected, the finite state machine transitions from state 0 to state A; when operations such as "cd / var / lib" or "cd / var / games" are detected, which can enter the "var" path but not the "var / log" path, the finite state machine is also in state 1, corresponding to state B1.

[0113] For state 1, when the operation command such as "cd log" is detected and executed, the finite state machine transitions from the current working state to state 2, indicating that the finite state machine is currently located under the "var / log" path; when the operation command such as "cd / usr" or "cd .. / lib" is detected and executed to change to other paths, the finite state machine transitions from state 2 to B2; when the operation command such as "cd lib" or "cd games" is detected and executed, the user enters a non-sensitive path, but it contains part of the sensitive path "var", and the finite state machine is in B1 corresponding to state 1.

[0114] For state 2, when commands such as "cd .. / " or "cd / var" are detected, the finite state machine transitions from state 2 to state 1, indicating that the current path is under the sensitive path "var". When "cd / etc" is detected, the finite state machine is in state 2, corresponding to state B2. When "cd .. / .. / lib" is detected, the finite state machine transitions from state 0 to state A. When commands such as "cd .. / lib" or "cd .. / games" are detected, the user has entered a non-sensitive path, but it contains part of the sensitive path "var", and the finite state machine is in state 1, corresponding to state B1.

[0115] For the lingering state, each state contains a lingering state. The lingering state indicates that the current user is on a non-sensitive path. There are two types of lingering states: one is being on a non-sensitive path, but the parent path contains a sensitive path, as seen in states 1 and 2. For example, "var / games" is located under the sensitive path "var", representing state 1 (B1), and "var / log / tmp" is located under the sensitive path "var / log", representing state 2 (B2). The other type does not contain any sensitive paths, such as "etc / lib", which is state 0 (A). Figure 6As shown, the lingering state includes a depth parameter, initially set to 0, which records the path depth of the current operation command. Whenever the finite state machine enters the lingering state from any state in states 0-2 or transitions from the lingering state to any state in states 0-2, the state transition is performed based on the depth.

[0116] For example, if the finite state machine detects that the user has executed "cd / etc", it is in the lingering state corresponding to state 0, i.e., A, with depth = 1. If it detects the execution of the command "cd..", then depth is reduced by 1, depth = 0, and the finite state machine returns to the initial state 0. If it detects commands containing absolute paths, such as "cd / " or "cd / var / log", it directly switches from A to the initial state 0, and then starts transitioning from state 0.

[0117] For example, if the finite state machine detects that the user has executed "cd / var / lib", and the user is located in the "var / lib" path, the machine is currently in a lingering state of state 1, i.e., B1, with depth = 1. When the "cd rpm" command is detected, if the "var / lib" path contains the "rpm" path, the depth is incremented by 1, i.e., depth = 2, and the state remains unchanged. If the "var / lib" path does not contain the "rpm" path, it is considered invalid input, and neither the depth nor the state remains unchanged. If the machine detects commands containing absolute paths, such as "cd / " or "cd / var / lib", it directly switches from B1 to state 0, and then restarts the transition process from state 0.

[0118] For example, if a finite state machine is in state 2 (B2) and located at the path "var / log / lib / rpm", when it detects the path "cd..", the depth of the finite state machine will decrease by 1, and the state will remain unchanged. When it detects "cd.. / .. / ", the depth becomes 0, and the finite state machine transitions from B2 to state 2. When it detects "cd.. / yum / ", although the depth is initially decreased by 1, it enters the "yum" path, so the finite state machine remains in B2, and the depth also remains unchanged. If it detects operation commands containing absolute paths, such as "cd / " or "cd / var / lib", it directly switches from B2 to state 0, and then transitions begin from state 0.

[0119] Based on the above method, the finite state machine transitions the target working state according to the operation command corresponding to the access path. It can determine the path switching process information corresponding to the operation log to be audited based on the transition process information between state 0, state 1, state 2, A, B1, and B2. Thus, it can determine whether the user has violated the rules by taking a detour to access the path they need. If a detour is detected, the specific detour path can be found based on the path switching process information, which improves the accuracy and efficiency of auditing violation operation logs.

[0120] like Figure 7 As shown, this application provides a log auditing device, which includes:

[0121] The path acquisition module 310 is used to acquire the access path contained in the operation log to be audited;

[0122] The state transition module 320 is used to control the finite state machine to transition to the target working state according to the operation command corresponding to the access path, and to obtain the state transition process information of the finite state machine to the target working state.

[0123] The path generation module 330 is used to generate path switching process information of the access path based on the state transition process information;

[0124] The path output module 340 is used to output the path switching process information and the violation alarm information when the path switching process information includes a preset sensitive path.

[0125] Furthermore, the target working state includes an initial state, a first stagnation state corresponding to the initial state, a sensitive state, and a second stagnation state corresponding to the sensitive state.

[0126] Furthermore, the state transition module 320, in controlling the finite state machine to transition to the target working state according to the operation command corresponding to the access path, includes:

[0127] The command acquisition unit is used to acquire the operation command corresponding to the access path;

[0128] A first control unit is configured to control the finite state machine to transition from the initial state to the sensitive state when the operation command includes a first command symbol corresponding to a preset command and the operation command includes a sensitive operation command corresponding to the preset sensitive path.

[0129] The second control unit is configured to control the finite state machine to transition from the current working state to the sensitive state when the operation command does not contain the first command symbol and the operation command contains the sensitive operation command.

[0130] Furthermore, the state transition module 320, in controlling the finite state machine to transition to the target working state according to the operation command corresponding to the access path, also includes:

[0131] A third control unit is configured to control the finite state machine to transition from the initial state to the first lingering state when the operation command includes the first command symbol and the operation command does not include the sensitive operation command.

[0132] The fourth control unit is configured to control the finite state machine to transition from the current working state to the first lingering state or the second lingering state when the operation command does not contain the first command symbol and the operation command does not contain the sensitive operation command.

[0133] Furthermore, when the current working state is the first stagnant state or the second stagnant state, the fourth control unit, in controlling the finite state machine to transition from the initial state to the first stagnant state, includes:

[0134] The depth acquisition subunit is used to determine the full path depth and sensitive path depth corresponding to the access path.

[0135] A parameter calculation subunit is used to determine depth parameters based on the full path depth and the sensitive path depth;

[0136] The state control subunit is used to control the finite state machine to maintain the current working state as the first lingering state or the second lingering state when the sensitive path depth does not change and the depth parameter increases or the sensitive path depth does not change.

[0137] Furthermore, the state transition module 320, in controlling the finite state machine to transition to the target working state according to the operation command corresponding to the access path, also includes:

[0138] The fifth control unit is configured to control the finite state machine to transition from the current working state to the previous working state when the operation command includes the second command symbol corresponding to the preset command and the operation command includes the sensitive operation command, and to control the finite state machine to transition from the previous working state to the sensitive state according to the operation command.

[0139] The sixth control unit is configured to, when the operation command includes the second command symbol and the operation command does not include the sensitive operation command, control the finite state machine to transition from the current working state to the previous working state, and control the finite state machine to transition from the previous working state to the first lingering state or the second lingering state according to the operation command.

[0140] Furthermore, the log auditing device also includes:

[0141] The log acquisition unit is used to acquire raw operation logs;

[0142] The log cleaning unit is used to filter and sort the original operation logs to obtain the operation logs to be audited.

[0143] The specific implementation of the log auditing device of the present invention is basically the same as the embodiments of the log auditing method described above, and will not be repeated here.

[0144] Furthermore, the present invention also provides a finite state machine, the finite state machine comprising: a memory, a processor, and a log auditing program stored in the memory and executable on the processor, wherein the log auditing program, when executed by the processor, implements the steps of the above-described log auditing method.

[0145] Furthermore, the present invention also provides a storage medium storing a log auditing program thereon, which, when executed by a processor, implements the steps of the above-described log auditing method.

[0146] Those skilled in the art will understand that embodiments of the present invention can be provided as methods, systems, or computer program products. Therefore, the present invention can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0147] This invention is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0148] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0149] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0150] It should be noted that any reference signs placed between parentheses in the claims should not be construed as limiting the claims. The word "comprising" does not exclude the presence of components or steps not listed in the claims. The word "a" or "an" preceding a component does not exclude the presence of a plurality of such components. The invention can be implemented by means of hardware comprising several different components and by means of a suitably programmed computer. In a unit claim enumerating several means, several of these means may be embodied by the same item of hardware. The use of the words first, second, and third, etc., does not indicate any order. These words can be interpreted as names.

[0151] Although preferred embodiments of the invention have been described, those skilled in the art, upon learning the basic inventive concept, can make other changes and modifications to these embodiments. Therefore, the appended claims are intended to be interpreted as including both the preferred embodiments and all changes and modifications falling within the scope of the invention.

[0152] Obviously, those skilled in the art can make various modifications and variations to this invention without departing from its spirit and scope. Therefore, if these modifications and variations fall within the scope of the claims of this invention and their equivalents, this invention also intends to include these modifications and variations.

Claims

1. A log auditing method, characterized in that, The log auditing method, applied to finite state machines, includes: Obtain the access paths contained in the operation logs to be audited; The finite state machine is controlled to transition to a target working state according to the operation command corresponding to the access path, and the state transition process information of the finite state machine to the target working state is obtained. The target working state includes an initial state and a sensitive state. The step of controlling the finite state machine to transition to the target working state according to the operation command corresponding to the access path includes: obtaining the operation command corresponding to the access path; when the operation command contains a first command symbol corresponding to a preset command and the operation command contains a sensitive operation command corresponding to a preset sensitive path, the finite state machine is controlled to transition from the initial state to the sensitive state; when the operation command does not contain the first command symbol and the operation command contains the sensitive operation command, the finite state machine is controlled to transition from the current working state to the sensitive state. The path switching process information of the access path is generated based on the state transition process information; When the preset sensitive path is included in the path switching process information, the path switching process information and violation operation alarm information are output.

2. The method as described in claim 1, characterized in that, The target working state also includes the first stagnation state corresponding to the initial state and the second stagnation state corresponding to the sensitive state.

3. The method as described in claim 2, characterized in that, After the step of obtaining the operation command corresponding to the access path, the method further includes: When the operation command includes the first command symbol and does not include the sensitive operation command, the finite state machine is controlled to transition from the initial state to the first lingering state. When the operation command does not contain the first command symbol and does not contain the sensitive operation command, the finite state machine is controlled to transition from the current working state to the first lingering state or the second lingering state.

4. The method as described in claim 3, characterized in that, When the current working state is the first stagnation state or the second stagnation state, the step of controlling the finite state machine to transition from the current working state to the first stagnation state or the second stagnation state includes: Determine the full path depth and sensitive path depth corresponding to the access path; Determine the depth parameters based on the full path depth and the sensitive path depth; When the sensitive path depth does not change and the depth parameter increases or the sensitive path depth does not change, the finite state machine is controlled to maintain the current working state as the first lingering state or the second lingering state.

5. The method as described in claim 2, characterized in that, After the step of obtaining the operation command corresponding to the access path, the method further includes: When the operation command includes a second command symbol corresponding to the preset command and the operation command includes the sensitive operation command, the finite state machine is controlled to transition from the current working state to the previous working state, and the finite state machine is controlled to transition from the previous working state to the sensitive state according to the operation command. When the operation command includes the second command symbol and does not include the sensitive operation command, the finite state machine is controlled to transition from the current working state to the previous working state, and the finite state machine is controlled to transition from the previous working state to the first lingering state or the second lingering state according to the operation command.

6. The method as described in claim 1, characterized in that, The log auditing method further includes: Obtain the original operation log; The original operation logs are filtered and sorted to obtain the operation logs to be audited.

7. A log auditing device, characterized in that, The log auditing device includes: The path acquisition module is used to obtain the access paths contained in the operation logs to be audited; A state transition module is used to control a finite state machine to transition to a target working state according to the operation command corresponding to the access path, and to obtain state transition process information of the finite state machine to the target working state. The target working state includes an initial state and a sensitive state. The step of controlling the finite state machine to transition to the target working state according to the operation command corresponding to the access path includes: obtaining the operation command corresponding to the access path; when the operation command contains a first command symbol corresponding to a preset command and the operation command contains a sensitive operation command corresponding to a preset sensitive path, controlling the finite state machine to transition from the initial state to the sensitive state; when the operation command does not contain the first command symbol and the operation command contains the sensitive operation command, controlling the finite state machine to transition from the current working state to the sensitive state. The path generation module is used to generate path switching process information for the access path based on the state transition process information. The path output module is used to output the path switching process information and the violation alarm information when the preset sensitive path is included in the path switching process information.

8. A finite state machine, characterized in that, The finite state machine includes: a memory, a processor, and a log auditing program stored in the memory and executable on the processor, wherein the log auditing program, when executed by the processor, implements the steps of the log auditing method as described in any one of claims 1-6.

9. A storage medium, characterized in that, It stores a log auditing program, which, when executed by a processor, implements the steps of the log auditing method according to any one of claims 1-6.

Images