Computer device configuration detection method, apparatus, device, and medium

Abstract

The present disclosure provides a configuration detection method, device and equipment of a computer device, and a storage medium, which can be applied to the fields of artificial intelligence and financial technology. The method comprises the following steps: sending a detection command to a target computer device in a target area to enable the target computer device to execute the detection command, wherein the detection command comprises a configuration index detection command and an Internet Protocol address detection command, and the detection command is determined based on a pre-configured script library; receiving an execution result obtained after the target computer device executes the detection command; matching the execution result with a rule library and an exception library respectively to determine a matching result, wherein the rule library is pre-configured according to standard rules corresponding to the configuration index, and the exception library is pre-configured according to exception conditions of the Internet Protocol address and the configuration index; and determining a configuration detection result for the target computer device based on the matching result.

Description

Technical Field

[0001] This disclosure relates to the fields of artificial intelligence and big data technology, and in particular to configuration detection methods, apparatus, devices, media and program products for computer equipment. Background Technology

[0002] With social progress and economic development, information security is receiving increasing attention. For enterprises, it is necessary to regularly check whether the configuration of network equipment complies with security standards, specifications, and baselines, and to identify potential information security risks in order to meet information security requirements.

[0003] In the process of implementing this disclosure, it was found that in the prior art, the common approach is to purchase software and install an agent on computer equipment to perform configuration checks on the computer equipment within the enterprise. However, this approach suffers from problems such as data incompatibility, inflexible modification of the check logic, high maintenance costs, and the potential for omissions. Summary of the Invention

[0004] In view of the above problems, this disclosure provides a method, apparatus, device, medium and program product for detecting the configuration of computer equipment.

[0005] According to a first aspect of this disclosure, a configuration detection method for a computer device is provided, comprising: sending a detection command to a target computer device within a target area to cause the target computer device to execute the detection command, wherein the detection command includes: a configuration indicator detection command and an Internet Protocol address detection command, the detection command being determined based on a pre-configured script library; receiving an execution result obtained after the target computer device sends the execution detection command; matching the execution result with a rule library and an exception library respectively to determine a matching result, wherein the rule library is pre-configured according to standard rules corresponding to the configuration indicators, and the exception library is pre-configured according to exceptions to Internet Protocol addresses and configuration indicators; and determining a configuration detection result for the target computer device based on the matching result.

[0006] According to embodiments of this disclosure, the script library includes: operating system type, configuration indicator name of computer device, and script commands corresponding to the operating system type;

[0007] The configuration detection method for computer equipment also includes: determining the target operating system type corresponding to the target computer equipment; and selecting script commands that match the target operating system type from a pre-configured script library in order to determine the detection commands.

[0008] According to embodiments of this disclosure, the configuration detection method for a computer device further includes: obtaining a device list of the target computer device; and generating a script command corresponding to the operating system type based on the device list.

[0009] According to embodiments of this disclosure, the configuration detection method for computer devices further includes: scanning the network segment associated with the computer device to obtain scanning results; and updating the device list based on the scanning results.

[0010] According to embodiments of this disclosure, the execution result includes: the indicator value and Internet Protocol address information corresponding to the configuration indicator, the rule base includes the standard value corresponding to the configuration indicator, and the matching result includes the first sub-matching result and the second sub-matching result;

[0011] The configuration detection method for computer equipment also includes: matching the indicator values ​​corresponding to the configuration indicators with standard values ​​to obtain the first sub-matching result; and matching the Internet Protocol address information and the indicators corresponding to the configuration indicators with the exception library to obtain the second sub-matching result.

[0012] According to embodiments of this disclosure, determining the configuration detection result for a target computer device based on the matching result includes: determining that the configuration detection result indicates normal configuration when the first sub-matching result indicates successful matching and the second sub-matching result indicates unsuccessful matching; and determining that the configuration detection result indicates abnormal configuration when both the first sub-matching result and the second sub-matching result indicate unsuccessful matching.

[0013] According to embodiments of this disclosure, the device list includes: Internet Protocol address information, operating system type information, configuration indicator name, and attribute information of the target object with operating permissions;

[0014] The configuration detection method for computer equipment also includes: generating a result message based on the configuration detection result when the configuration detection result indicates an abnormal configuration; and sending the result message to the target object based on the attribute information of the target object with operation permissions.

[0015] A second aspect of this disclosure provides a configuration detection apparatus for a computer device, comprising: a sending module for sending a detection command to a target computer device within a target area, causing the target computer device to execute the detection command, wherein the detection command includes a configuration indicator detection command and an Internet Protocol address detection command, the detection command being determined based on a pre-configured script library; a receiving module for receiving the execution result obtained after the target computer device sends the execution detection command; a first determining module for matching the execution result with a rule library and an exception library respectively to determine a matching result, wherein the rule library is pre-configured according to standard rules corresponding to the configuration indicator, and the exception library is pre-configured according to exceptions to the Internet Protocol address and the configuration indicator; and a second determining module for determining a configuration detection result for the target computer device based on the matching result.

[0016] A third aspect of this disclosure provides an electronic device comprising: one or more processors; and a memory for storing one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors perform a configuration detection method for a computer device.

[0017] A fourth aspect of this disclosure also provides a computer-readable storage medium having executable instructions stored thereon, which, when executed by a processor, cause the processor to perform a configuration detection method for a computer device.

[0018] The fifth aspect of this disclosure also provides a computer program product, including a computer program that, when executed by a processor, implements a configuration detection method for a computer device.

[0019] According to embodiments of this disclosure, the computer device configuration detection method provided by this disclosure allows the detection system to periodically and automatically send detection commands to target computer devices, automatically detecting the configuration of computer devices within the target area. The execution results of the target computer device are analyzed and matched against a pre-configured rule base and exception base. Based on the matching results, the configuration detection result for the target computer device is determined. This detection logic can be modified through the detection system without requiring production version deployment, making it faster and more convenient. It also does not rely on additional software or require the installation of an agent on the computer device, reducing daily maintenance costs. Furthermore, it offers high detection accuracy and is beneficial for uncovering potential information security risks. Attached Figure Description

[0020] The foregoing contents, as well as other objects, features, and advantages of this disclosure, will become clearer from the following description of embodiments with reference to the accompanying drawings, in which:

[0021] Figure 1 The illustration schematically depicts an application scenario of a configuration detection method, apparatus, device, medium, and program product for a computer device according to embodiments of the present disclosure.

[0022] Figure 2 A flowchart illustrating a configuration detection method for a computer device according to an embodiment of the present disclosure is shown schematically.

[0023] Figure 3 A flowchart illustrating a configuration detection method for a computer device according to an embodiment of the present disclosure is shown schematically.

[0024] Figure 4 A flowchart illustrating a configuration detection method for a computer device according to another embodiment of the present disclosure is shown schematically.

[0025] Figure 5 A flowchart illustrating a configuration detection method for a computer device according to another embodiment of the present disclosure is shown schematically.

[0026] Figure 6 A schematic diagram illustrating a configuration detection apparatus for a computer device according to an embodiment of the present disclosure is shown; and

[0027] Figure 7 A block diagram schematically illustrates an electronic device suitable for implementing a configuration detection method for a computer device according to an embodiment of the present disclosure. Detailed Implementation

[0028] The embodiments of the present disclosure will now be described with reference to the accompanying drawings. However, it should be understood that these descriptions are exemplary only and are not intended to limit the scope of the disclosure. In the following detailed description, numerous specific details are set forth to provide a thorough understanding of the embodiments of the present disclosure for ease of explanation. However, it will be apparent that one or more embodiments may be practiced without these specific details. Furthermore, descriptions of well-known structures and techniques are omitted in the following description to avoid unnecessarily obscuring the concepts of the present disclosure.

[0029] The terminology used herein is for the purpose of describing particular embodiments only and is not intended to limit this disclosure. The terms “comprising,” “including,” etc., as used herein indicate the presence of the stated features, steps, operations, and / or components, but do not exclude the presence or addition of one or more other features, steps, operations, or components.

[0030] All terms used herein (including technical and scientific terms) have the meanings commonly understood by those skilled in the art, unless otherwise defined. It should be noted that the terms used herein are to be interpreted in a manner consistent with the context of this specification, and not in an idealized or overly rigid way.

[0031] When using expressions such as "at least one of A, B, and C", they should generally be interpreted in accordance with the meaning that is commonly understood by a person skilled in the art (e.g., "a system having at least one of A, B, and C" should include, but is not limited to, a system having A alone, a system having B alone, a system having C alone, a system having A and B, a system having A and C, a system having B and C, and / or a system having A, B, and C, etc.).

[0032] In the technical solution disclosed herein, the user information (including but not limited to user personal information, user image information, user device information, such as location information) and data (including but not limited to data used for analysis, stored data, and displayed data) involved are all information and data authorized by the user or fully authorized by all parties. Furthermore, the collection, storage, use, processing, transmission, provision, disclosure, and application of the relevant data all comply with the relevant laws, regulations, and standards of the relevant countries and regions, necessary confidentiality measures have been taken, and they do not violate public order and good morals. Corresponding operation entry points are provided for users to choose to authorize or refuse.

[0033] In the technical solutions of this disclosure, user authorization or consent is obtained before acquiring or collecting user personal information.

[0034] During the implementation of this disclosure, it was found that the inspection is typically conducted using professionally purchased software. Logs and analysis results are stored within the purchased software, which cannot interconnect with the enterprise's internal information systems, thus failing to maximize the value of the data. Modifying the inspection logic usually requires adjusting the program source code, involving recompilation and deployment, which is generally inflexible. The costs of purchasing software and daily maintenance are high, and billing methods are typically based on the number of servers or the volume of logs, making it uneconomical for enterprises. Furthermore, installing agents on devices can easily impact device performance. Purchased software generally collects logs by installing agents on computer devices or directly deploying scripts. Devices where agents are not installed or cannot be installed cannot collect inspection logs, easily leading to incomplete inspection coverage and inadequate risk assessment.

[0035] This disclosure provides a configuration detection method for a computer device, comprising: sending a detection command to a target computer device within a target area to cause the target computer device to execute the detection command, wherein the detection command includes a configuration indicator detection command and an Internet Protocol address (IPA) detection command, the detection command being determined based on a pre-configured script library; receiving the execution result obtained after the target computer device sends the execution of the detection command; matching the execution result with a rule library and an exception library respectively to determine a matching result, wherein the rule library is pre-configured according to standard rules corresponding to the configuration indicators, and the exception library is pre-configured according to exceptions to the IPA and configuration indicators; and determining a configuration detection result for the target computer device based on the matching result.

[0036] Figure 1 The illustration schematically depicts an application scenario of a configuration detection method, apparatus, device, medium, and program product for a computer device according to embodiments of the present disclosure.

[0037] like Figure 1As shown, application scenario 100 according to this embodiment may include a first terminal device 101, a second terminal device 102, a third terminal device 103, a network 104, and a server 105. The network 104 serves as a medium for providing communication links between the first terminal device 101, the second terminal device 102, the third terminal device 103, and the server 105. The network 104 may include various connection types, such as wired or wireless communication links, or fiber optic cables, etc. The first terminal device 101, the second terminal device 102, and the third terminal device 103 may be different types of computer devices or the same type of computer devices.

[0038] Users can interact with server 105 via network 104 using at least one of the first terminal device 101, second terminal device 102, and third terminal device 103 to receive or send messages, etc. Various communication client applications can be installed on the first terminal device 101, second terminal device 102, and third terminal device 103, such as shopping applications, web browser applications, search applications, instant messaging tools, email clients, social media platform software, etc. (for example only).

[0039] The first terminal device 101, the second terminal device 102, and the third terminal device 103 can be various electronic devices with displays and support web browsing, including but not limited to smartphones, tablets, laptops, and desktop computers.

[0040] Server 105 can be a server that provides various services, such as a backend management server that supports websites browsed by users using the first terminal device 101, the second terminal device 102, and the third terminal device 103 (this is just an example). The backend management server can analyze and process data such as received user requests, and feed back the processing results (such as web pages, information, or data obtained or generated according to user requests) to the terminal devices.

[0041] It should be noted that the computer device configuration detection method provided in this embodiment can generally be executed by server 105. Correspondingly, the computer device configuration detection device provided in this embodiment can generally be located in server 105. The computer device configuration detection method provided in this embodiment can also be executed by a server or server cluster that is different from server 105 and capable of communicating with the first terminal device 101, the second terminal device 102, the third terminal device 103, and / or server 105. Correspondingly, the computer device configuration detection device provided in this embodiment can also be located in a server or server cluster that is different from server 105 and capable of communicating with the first terminal device 101, the second terminal device 102, the third terminal device 103, and / or server 105.

[0042] It should be understood that Figure 1 The number of terminal devices, networks, and servers shown is merely illustrative. Depending on implementation needs, any number of terminal devices, networks, and servers can be included.

[0043] The following will be based on Figure 1 The described scene, through Figures 2-6 The configuration detection method for a computer device according to the disclosed embodiments will be described in detail.

[0044] Figure 2 A flowchart illustrating a configuration detection method for a computer device according to an embodiment of the present disclosure is shown schematically.

[0045] like Figure 2 As shown, the method 200 of this embodiment includes operations S210 to S240.

[0046] In operation S210, a detection command is sent to the target computer device within the target area to cause the target computer device to execute the detection command. The detection command includes a configuration index detection command and an Internet Protocol address detection command, which are determined based on a pre-configured script library.

[0047] According to embodiments of this disclosure, during periodic testing by the detection system, a detection command can be sent from a server to a target computer device within a target area. Upon receiving the detection command, the target computer device executes it. The detection command can be sent using a proxy-less protocol communication method.

[0048] For example, the target area could be the entire enterprise or a portion of it. The target computer device could be a network device with computing capabilities. Security administrators can pre-configure detection scripts for each computer device based on its configuration and operating system type, creating a script library. The system can then retrieve the corresponding detection script from this library based on the target computer device's operating system type and send it to the target computer device for execution.

[0049] According to embodiments of this disclosure, the target computer devices within the target area can be determined from a device list obtained from a configuration management system for the target area, or from a device list obtained by performing a full scan of computer devices in the corresponding network segment. Furthermore, it eliminates the need to install agents or deploy scripts on the computer devices being tested. Execution results are collected by remotely executing commands from the detection system, ensuring full coverage of the detection scope. This solves the problem in existing technologies where execution results cannot be collected for devices with missing scripts or unable to install agents, easily leading to incomplete detection coverage and potential risks.

[0050] In operation S220, the execution result is obtained after receiving the execution detection command sent by the target computer device.

[0051] According to embodiments of this disclosure, the target computer device receives and executes a detection command sent in operation S210, obtaining an execution result. The target computer device then sends the execution result to a server. The server receives the execution result.

[0052] For example, the execution result may include the metric values ​​corresponding to the configured metrics and Internet Protocol address information.

[0053] In operation S230, the execution results are matched with the rule base and the exception base respectively to determine the matching results. The rule base is pre-configured according to the standard rules corresponding to the configuration indicators, and the exception base is pre-configured according to the Internet Protocol address and the exception cases of the configuration indicators.

[0054] According to embodiments of this disclosure, security administrators can pre-configure standard values ​​corresponding to configuration indicators in the rule base within the detection system, based on the standard rules corresponding to the configuration indicators. Security administrators can also pre-configure configuration indicators with exceptions, the corresponding computer devices, and the corresponding Internet Protocol addresses in the exception database within the detection system, based on Internet Protocol addresses and exception cases for configuration indicators. Furthermore, the exception duration and expiration time can also be configured in the exception database. An exception can be understood as a rule or regulation that must be followed outside of general rules and regulations.

[0055] In operation S240, based on the matching results, the configuration detection results for the target computer device are determined.

[0056] According to embodiments of this disclosure, the matching result can be used to characterize the matching status, such as a successful match or an unsuccessful match. The configuration detection result can be used to characterize the status of the configuration detection for the target computer device, such as a normal status or an abnormal status. If the matching result is determined to characterize a successful match, the configuration detection result for the target computer device is determined to characterize a normal configuration. If the matching result is determined to characterize an unsuccessful match, the configuration detection result for the target computer device is determined to characterize an abnormal configuration.

[0057] According to embodiments of this disclosure, the computer device configuration detection method provided by this disclosure allows the detection system to periodically and automatically send detection commands to target computer devices, automatically detecting the configuration of computer devices within the target area. The execution results of the target computer device are analyzed and matched with a pre-configured rule base and exception base. Based on the matching results, the configuration detection result for the target computer device is determined. This detection logic can be modified through the detection system without requiring production deployment, making it faster and more convenient. It also eliminates the need for additional software or the installation of agents on the computer device, reducing daily maintenance costs. Furthermore, it offers high detection accuracy and is beneficial for uncovering potential information security risks.

[0058] Figure 3 A flowchart illustrating a configuration detection method for a computer device according to an embodiment of the present disclosure is shown.

[0059] like Figure 3 As shown, the configuration detection method 300 for computer equipment in this embodiment may include operations S310 to S320 in addition to the operations S210 to S240 described above.

[0060] When operating S310, the target operating system type corresponding to the target computer device is determined based on the target computer device.

[0061] According to embodiments of this disclosure, the target operating system type may include Windows operating systems and non-Windows operating systems.

[0062] When operating the S320, script commands that match the target operating system type are filtered from a pre-configured script library to determine the detection command.

[0063] According to embodiments of this disclosure, the script library may include: operating system type, configuration indicator name of computer device, and script commands corresponding to the operating system type.

[0064] For example, the operating system type can be either Windows or a non-Windows operating system. Configuration metric names for computer devices can include "Disable configuration for non-interactive accounts" or "Configure for obtaining user password complexity," etc.

[0065] According to embodiments of this disclosure, the method of executing detection commands differs for computer devices with different operating system types.

[0066] For example, for Windows operating systems: the psexec tool (port 445) in pstools can be used to remotely execute commands, provided that the target server has $ADMIN shared access enabled. For non-Windows systems: the ssh protocol (port 22) can be used to access the target machine and remotely execute commands.

[0067] According to embodiments of this disclosure, script commands pre-configured in a script library facilitate the execution of commands by the target computer device, resulting in execution results, and thereby determining the configuration detection results.

[0068] According to embodiments of this disclosure, in addition to operations S210 to S240 and S310 to S320 described above, the configuration detection method for computer devices may further include: obtaining a device list of the target computer device; and generating a script command corresponding to the operating system type based on the device list.

[0069] According to embodiments of this disclosure, within a preset detection period, the detection system can obtain a device list of target computer devices from the configuration management system. The device list may include: Internet Protocol address information, operating system type information, configuration indicator names, and attribute information of target objects with operating permissions.

[0070] According to the embodiments of this disclosure, by obtaining the device list, the script commands corresponding to the operating system type can be determined. There is no need to install agents or deploy scripts on the computer device being tested, which helps to reduce daily maintenance costs and solves the problems in the prior art where the cost of purchasing software and daily maintenance is high, and the installation of agents on computer devices can easily affect the performance of computer devices.

[0071] According to another embodiment of this disclosure, the configuration detection method for computer devices may further include: scanning a network segment associated with the computer device to obtain scanning results; and updating the device list based on the scanning results.

[0072] According to the embodiments of this disclosure, by scanning the network segments associated with computer devices and updating the device list, it is possible to collect execution results remotely from the detection system without installing agents or deploying scripts on the computer devices being inspected, thus ensuring full coverage of the detection scope. This solves the problem in the prior art that execution results cannot be collected for devices that have omitted deployed scripts or cannot install agents, which can easily lead to incomplete detection coverage and potential risks.

[0073] According to embodiments of this disclosure, the configuration detection method for computer equipment may further include: matching the indicator value corresponding to the configuration indicator with a standard value to obtain a first sub-matching result; and matching the Internet Protocol address information and the indicator corresponding to the configuration indicator with an exception library to obtain a second sub-matching result.

[0074] According to embodiments of this disclosure, the execution result may include: the indicator value corresponding to the configuration indicator and Internet Protocol address information; the rule base may include the standard value corresponding to the configuration indicator; and the matching result may include the first sub-matching result and the second sub-matching result.

[0075] According to embodiments of this disclosure, the corresponding fields in the execution result may include: operating system type, configuration indicator name, etc. The corresponding fields in the rule base may include: operating system type, configuration indicator name, standard value corresponding to the configuration indicator, specification name, specification clause, and importance level. The corresponding fields in the exception base may include: internet protocol address information of the computer device, machine name, configuration indicator name, specification name, specification clause, exception time, exception expiration time, etc. The standard value corresponding to the configuration indicator can be determined based on the specification clause and specification name.

[0076] According to the embodiments of this disclosure, the detection logic can be modified by the apparatus or system that executes the configuration detection method of the computer device of this disclosure, without the need for production deployment, which is faster and more convenient. This solves the problem that in the prior art, modifying the detection logic usually involves recompiling and deploying to production, which is not flexible enough overall.

[0077] According to embodiments of this disclosure, determining the configuration detection result for the target computer device based on the matching result may include: determining that the configuration detection result indicates normal configuration when the first sub-matching result indicates successful matching and the second sub-matching result indicates unsuccessful matching; and determining that the configuration detection result indicates abnormal configuration when both the first sub-matching result and the second sub-matching result indicate unsuccessful matching.

[0078] According to embodiments of this disclosure, if the indicator value corresponding to the configuration indicator matches the standard value, the first sub-matching result is determined to indicate a successful match; otherwise, the first sub-matching result is determined to indicate a failed match. The Internet Protocol address information and the indicator corresponding to the configuration indicator are compared and matched with records in the exception database. If a match fails, the second sub-matching result is determined to indicate a failed match; otherwise, the second sub-matching result is determined to indicate a successful match. If any of the first sub-matching results indicates a failed match, the configuration detection result indicates a configuration anomaly. If both the first and second sub-matching results indicate a successful match, the exception details in the exception database can be used to further determine whether the exception specifications are met. If they are met, the configuration detection result indicates a normal configuration; otherwise, the configuration detection result indicates a configuration anomaly.

[0079] According to embodiments of this disclosure, by combining a rule base and an exception base, configuration detection of computer devices is performed, resulting in more accurate detection results and facilitating the discovery of potential information security risks.

[0080] Figure 4 A flowchart illustrating a configuration detection method for a computer device according to another embodiment of the present disclosure is shown.

[0081] like Figure 4 As shown, the configuration detection method 400 for computer equipment in this embodiment may include operations S410 to S440 in addition to the operations S210 to S240 and S310 to S320 described above.

[0082] Using S410, obtain the device list of the target computer device.

[0083] According to embodiments of this disclosure, the device list may include: Internet Protocol address information, operating system type information, configuration indicator names, and attribute information of target objects with operating permissions. The detection system can obtain the device list of target computer devices from the configuration management system within a preset detection period.

[0084] For example, the preset detection cycle can be customized, such as daily, weekly, or monthly. The attribute information of the target object with operation permissions can include, for example, the maintenance department and the maintainer.

[0085] When operating the S420, generate script commands corresponding to the operating system type based on the device list.

[0086] When operating S430, if the configuration detection result indicates a configuration anomaly, a result message is generated based on the configuration detection result.

[0087] According to embodiments of this disclosure, statistical analysis can be performed based on configuration indicator categories and specification names to provide visualized detection result messages. The fields in the generated result message may include: computer device Internet Protocol address, operating system type, configuration indicator name, standard value, current value, comparison result, corresponding specification name, specification clause, importance level, whether it is an exception, exception time, exception expiration time, application name, maintenance department, and maintainer, among other information.

[0088] In operation S440, based on the attribute information of the target object with operation permissions, a result message is sent to the target object.

[0089] According to embodiments of this disclosure, result messages can be sent to the client where the target object with operation permissions resides, enabling the corresponding target object to perform rectification. When different computer devices correspond to the same target object with operation permissions, result messages from computer devices with configuration anomalies can be aggregated and sent to the client where the target object with operation permissions resides. This avoids the same target object receiving a large number of result messages, improving the user experience for the target object.

[0090] According to embodiments of this disclosure, by obtaining a device list and determining script commands corresponding to the operating system type, it is unnecessary to install agents or deploy scripts on the detected computer device. This helps reduce daily maintenance costs and solves the problems of high costs associated with purchasing software and daily maintenance in the prior art, as well as the potential impact of installing agents on computer devices on performance. By generating and sending result messages to the target object, the user experience for the target object is improved, while also addressing the high costs of purchasing software and daily maintenance, and the potential impact of installing agents on device performance.

[0091] Figure 5 A flowchart illustrating a configuration detection method for a computer device according to another embodiment of the present disclosure is shown.

[0092] like Figure 5As shown, the configuration detection method for computer devices in this embodiment may include: the detection system obtaining a device list from a configuration management system for a target area; determining the target computer devices within the target area based on the device list; the detection system sending detection commands to the target computer devices within the target area to cause the target computer devices to execute the detection commands, and then returning the execution results of the detection commands to the command distribution control terminal of the detection system. For example, this can be transmitted using syslog protocol messages. The control terminal receives the data and then transmits it to the data warehouse via a message queue. Security management personnel configure the rule base and exception base. A modeling and analysis platform can be created in the detection system for matching and comparing with the rule base and exception base. The modeling and analysis platform can automatically initiate analysis and statistics, generate analysis results from the obtained detection results, and provide feedback on the analysis results to users of security management and device maintenance.

[0093] According to embodiments of this disclosure, test results can be stored in a data warehouse for easy reuse and big data analysis to uncover deeper risks. This solves the problem in the prior art where test results are stored inside purchased software, which cannot be interconnected with the enterprise's internal information system and cannot maximize the value of the data.

[0094] According to embodiments of this disclosure, by obtaining a device list from the configuration management system and performing a full scan of computer devices in the corresponding network segment, it is not necessary to install agents or deploy scripts on the computer devices being inspected. The detection results are collected by remotely executing commands from the detection system, ensuring full coverage of the detection range.

[0095] Based on the above-described configuration detection method for computer equipment, this disclosure also provides a configuration detection device for computer equipment. The following will be combined with... Figure 6 The device is described in detail.

[0096] Figure 6 A schematic block diagram of a configuration detection apparatus for a computer device according to an embodiment of the present disclosure is shown.

[0097] like Figure 6 As shown, the configuration detection device 600 of the computer device in this embodiment includes a sending module 610, a receiving module 620, a first determining module 630, and a second determining module 640.

[0098] The sending module 610 is used to send detection commands to target computer devices within the target area, causing the target computer devices to execute the detection commands. The detection commands include a configuration index detection command and an Internet Protocol address detection command, and are determined based on a pre-configured script library. In one embodiment, the sending module 610 can be used to perform the operation S210 described above, which will not be repeated here.

[0099] The receiving module is used to receive the execution result obtained after the execution detection command is sent by the target computer device; in one embodiment, the receiving module 620 can be used to perform the operation S220 described above, which will not be repeated here.

[0100] The first determining module is used to match the execution result with the rule base and the exception base respectively to determine the matching result. The rule base is pre-configured based on the standard rules corresponding to the configuration indicators, and the exception base is pre-configured based on the Internet Protocol address and the exception cases of the configuration indicators. In one embodiment, the first determining module 630 can be used to execute the operation S230 described above, which will not be repeated here.

[0101] The second determining module is used to determine the configuration detection result for the target computer device based on the matching result. In one embodiment, the second determining module 640 can be used to perform the operation S240 described above, which will not be repeated here.

[0102] According to embodiments of this disclosure, the script library may include: operating system type, configuration indicator name of computer device, and script commands corresponding to the operating system type.

[0103] According to embodiments of this disclosure, the configuration detection device 600 for computer equipment may further include a third determination module and a screening module.

[0104] The third determining module is used to determine the target operating system type corresponding to the target computer device based on the target computer device.

[0105] The filtering module is used to filter script commands from a pre-configured script library that match the target operating system type in order to determine the detection commands.

[0106] According to embodiments of this disclosure, the configuration detection device 600 for computer equipment may further include: an acquisition module and a first generation module.

[0107] The acquisition module is used to obtain the device list of the target computer device.

[0108] The first generation module is used to generate script commands corresponding to the operating system type.

[0109] According to embodiments of this disclosure, the configuration detection device 600 for computer equipment may further include a scanning module and an updating module.

[0110] The scanning module is used to scan the network segments associated with computer devices and obtain the scan results.

[0111] The update module is used to update the device list based on the scan results.

[0112] According to embodiments of this disclosure, the execution result may include: the indicator value corresponding to the configuration indicator and Internet Protocol address information; the rule base may include the standard value corresponding to the configuration indicator; and the matching result includes a first sub-matching result and a second sub-matching result.

[0113] According to embodiments of this disclosure, the configuration detection device 600 for computer equipment may further include: a first matching module and a second matching module.

[0114] The first matching module is used to match the indicator value corresponding to the configured indicator with the standard value to obtain the first sub-matching result.

[0115] The second matching module is used to match the Internet protocol address information and the corresponding indicators of the configuration indicators with the exception library to obtain the second sub-matching result.

[0116] According to embodiments of this disclosure, the second determining module 640 may include: a first determining unit and a second determining unit.

[0117] The first determining unit is used to determine that the configuration detection result indicates that the configuration is normal when the first sub-matching result indicates that the matching is successful and the second sub-matching result indicates that the matching is unsuccessful.

[0118] The second determining unit is used to determine that the configuration detection result indicates a configuration anomaly when both the first sub-matching result and the second sub-matching result indicate that the matching was unsuccessful.

[0119] According to embodiments of this disclosure, the device list may include: Internet Protocol address information, operating system type information, configuration indicator names, and attribute information of target objects with operating permissions.

[0120] According to embodiments of this disclosure, the configuration detection device 600 for computer equipment may further include a second generation module and a sending module.

[0121] The second generation module is used to generate a result message based on the configuration detection result when it is determined that the configuration detection result indicates an abnormal configuration.

[0122] The sending module is used to send result messages to the target object based on the attribute information of the target object with operation permissions.

[0123] According to embodiments of this disclosure, any plurality of modules among the transmitting module 610, receiving module 620, first determining module 630, and second determining module 640 may be combined into one module, or any one of these modules may be split into multiple modules. Alternatively, at least part of the functionality of one or more of these modules may be combined with at least part of the functionality of other modules and implemented in one module. According to embodiments of this disclosure, at least one of the transmitting module 610, receiving module 620, first determining module 630, and second determining module 640 may be at least partially implemented as hardware circuitry, such as a field-programmable gate array (FPGA), a programmable logic array (PLA), a system-on-a-chip, a system-on-a-substrate, a system-on-package, an application-specific integrated circuit (ASIC), or implemented in hardware or firmware by any other reasonable means of integrating or packaging the circuitry, or implemented in any one of software, hardware, and firmware methods, or in a suitable combination of any of these methods. Alternatively, at least one of the sending module 610, receiving module 620, first determining module 630 and second determining module 640 may be at least partially implemented as a computer program module, which can perform corresponding functions when the computer program module is run.

[0124] Figure 7 A block diagram schematically illustrates an electronic device suitable for implementing a configuration detection method for a computer device according to an embodiment of the present disclosure.

[0125] like Figure 7 As shown, an electronic device 700 according to an embodiment of the present disclosure includes a processor 701, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 702 or a program loaded from a storage portion 708 into a random access memory (RAM) 703. The processor 701 may include, for example, a general-purpose microprocessor (e.g., a CPU), an instruction set processor and / or an associated chipset and / or a special-purpose microprocessor (e.g., an application-specific integrated circuit (ASIC)), etc. The processor 701 may also include onboard memory for caching purposes. The processor 701 may include a single processing unit or multiple processing units for performing different actions of the method flow according to an embodiment of the present disclosure.

[0126] RAM 703 stores various programs and data required for the operation of electronic device 700. Processor 701, ROM 702, and RAM 703 are interconnected via bus 704. Processor 701 performs various operations of the method flow according to embodiments of the present disclosure by executing programs in ROM 702 and / or RAM 703. It should be noted that the programs may also be stored in one or more memories other than ROM 702 and RAM 703. Processor 701 may also perform various operations of the method flow according to embodiments of the present disclosure by executing programs stored in said one or more memories.

[0127] According to embodiments of this disclosure, the electronic device 700 may further include an input / output (I / O) interface 705, which is also connected to a bus 704. The electronic device 700 may also include one or more of the following components connected to the I / O interface 705: an input section 706 including a keyboard, mouse, etc.; an output section 707 including a cathode ray tube (CRT), liquid crystal display (LCD), etc., and a speaker, etc.; a storage section 708 including a hard disk, etc.; and a communication section 709 including a network interface card such as a LAN card, modem, etc. The communication section 709 performs communication processing via a network such as the Internet. A drive 710 is also connected to the I / O interface 705 as needed. A removable medium 711, such as a disk, optical disk, magneto-optical disk, semiconductor memory, etc., is installed on the drive 710 as needed so that computer programs read from it can be installed into the storage section 708 as needed.

[0128] This disclosure also provides a computer-readable storage medium, which may be included in the device / apparatus / system described in the above embodiments; or it may exist independently and not assembled into the device / apparatus / system. The computer-readable storage medium carries one or more programs that, when executed, implement the method according to the embodiments of this disclosure.

[0129] According to embodiments of this disclosure, the computer-readable storage medium may be a non-volatile computer-readable storage medium, such as, but not limited to: portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof. In this disclosure, the computer-readable storage medium may be any tangible medium that contains or stores a program that can be used by or in conjunction with an instruction execution system, apparatus, or device. For example, according to embodiments of this disclosure, the computer-readable storage medium may include ROM 702 and / or RAM 703 and / or one or more memories other than ROM 702 and RAM 703 described above.

[0130] Embodiments of this disclosure also include a computer program product comprising a computer program containing program code for performing the methods shown in the flowchart. When the computer program product is run on a computer system, the program code is used to cause the computer system to implement the methods provided in the embodiments of this disclosure.

[0131] When the computer program is executed by the processor 701, it performs the functions defined in the system / apparatus of this disclosure embodiments. According to embodiments of this disclosure, the systems, apparatuses, modules, units, etc., described above can be implemented by computer program modules.

[0132] In one embodiment, the computer program may rely on a tangible storage medium such as an optical storage device or a magnetic storage device. In another embodiment, the computer program may also be transmitted and distributed in the form of signals over a network medium, and may be downloaded and installed via the communication section 709, and / or installed from a removable medium 711. The program code contained in the computer program can be transmitted using any suitable network medium, including but not limited to: wireless, wired, etc., or any suitable combination thereof.

[0133] In such an embodiment, the computer program can be downloaded and installed from a network via the communication section 709, and / or installed from the removable medium 711. When the computer program is executed by the processor 701, it performs the functions defined in the system of this disclosure embodiment. According to embodiments of this disclosure, the systems, devices, apparatuses, modules, units, etc., described above can be implemented by computer program modules.

[0134] According to embodiments of this disclosure, program code for executing the computer programs provided in embodiments of this disclosure can be written in any combination of one or more programming languages. Specifically, these computational programs can be implemented using high-level procedural and / or object-oriented programming languages, and / or assembly / machine languages. Programming languages ​​include, but are not limited to, languages ​​such as Java, C++, Python, "C", or similar programming languages. The program code can execute entirely on the user's computing device, partially on the user's device, partially on a remote computing device, or entirely on a remote computing device or server. In cases involving remote computing devices, the remote computing device can be connected to the user's computing device via any type of network, including a local area network (LAN) or a wide area network (WAN), or it can be connected to an external computing device (e.g., via the Internet using an Internet service provider).

[0135] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of this disclosure. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in a block diagram or flowchart, and combinations of blocks in a block diagram or flowchart, may be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.

[0136] Those skilled in the art will understand that the features described in the various embodiments and / or claims of this disclosure can be combined or combined in various ways, even if such combinations or combinations are not explicitly described in this disclosure. In particular, the features described in the various embodiments and / or claims of this disclosure can be combined or combined in various ways without departing from the spirit and teachings of this disclosure. All such combinations and / or combinations fall within the scope of this disclosure.

[0137] The embodiments of this disclosure have been described above. However, these embodiments are for illustrative purposes only and are not intended to limit the scope of this disclosure. Although various embodiments have been described above, this does not mean that the measures in the various embodiments cannot be used advantageously in combination. The scope of this disclosure is defined by the appended claims and their equivalents. Various substitutions and modifications can be made by those skilled in the art without departing from the scope of this disclosure, and all such substitutions and modifications should fall within the scope of this disclosure.

Claims

1. A method for detecting the configuration of a computer device, comprising: The target computer devices within the target area are determined from a device list obtained from a configuration management system for the target area, or from a device list obtained by performing a full scan of computer devices in the corresponding network segment. A detection command is sent to the target computer device to cause the target computer device to execute the detection command, wherein the detection command includes: a configuration index detection command and an Internet Protocol address detection command, and the detection command is determined based on a pre-configured script library; The system receives the execution result obtained after executing the detection command sent by the target computer device. The execution result includes: the indicator value corresponding to the configuration indicator and Internet Protocol address information. The execution result is matched with the rule base and the exception database respectively to determine the matching result. The rule base is pre-configured based on the standard rules corresponding to the configuration indicator, and the exception database is pre-configured based on the Internet Protocol address and the exception cases of the configuration indicator. The rule base includes the standard value corresponding to the configuration indicator, and the exception database includes: the computer device's Internet Protocol address information, machine name, configuration indicator name, specification name, specification clause, exception time, and exception expiration time. The matching result includes a first sub-matching result and a second sub-matching result. The execution result is matched with the rule base and the exception database respectively to determine the matching result, including: matching the indicator value corresponding to the configuration indicator with... The standard value is matched to obtain the first sub-matching result; the Internet Protocol address information and the indicator corresponding to the configuration indicator are matched with the exception library to obtain the second sub-matching result; if the first sub-matching result indicates that the match is unsuccessful, the configuration detection result is determined to indicate that the configuration is abnormal; if both the first sub-matching result and the second sub-matching result indicate that the match is successful, and the current time is between the exception time and the exception expiration time, the configuration detection result is determined to indicate that the configuration is normal; if the first sub-matching result indicates that the match is successful and the second sub-matching result indicates that the match is unsuccessful, the configuration detection result is determined to indicate that the configuration is normal. Based on the matching results, the configuration detection results for the target computer device are determined.

2. The method according to claim 1, wherein, The script library includes: operating system type, configuration indicator name of computer device, and script commands corresponding to the operating system type; The method further includes: Based on the target computer device, determine the target operating system type corresponding to the target computer device; The pre-configured script library is used to filter script commands that match the target operating system type in order to determine the detection command.

3. The method according to claim 2, further comprising: Obtain the device list of the target computer device; Based on the device list, generate script commands corresponding to the operating system type.

4. The method according to claim 3, further comprising: The network segment associated with the computer device is scanned to obtain the scan results; Update the device list based on the scan results.

5. The method according to claim 3, wherein, The device list includes: Internet Protocol address information, operating system type information, configuration indicator name, and attribute information of target objects with operation permissions; The method further includes: If the configuration detection result indicates a configuration anomaly, a result message is generated based on the configuration detection result; Based on the attribute information of the target object with operation permissions, the result message is sent to the target object.

6. A configuration detection device for a computer device, comprising: A sending module is used to send detection commands to target computer devices within a target area, so that the target computer devices execute the detection commands. The detection commands include: a configuration index detection command and an Internet Protocol address detection command, which are determined based on a pre-configured script library. The receiving module is configured to receive the execution result obtained after executing the detection command sent by the target computer device, wherein the execution result includes: the indicator value corresponding to the configuration indicator and Internet Protocol address information; The first determining module is used to match the execution result with the rule base and the exception database respectively to determine the matching result. The rule base is pre-configured based on the standard rules corresponding to the configuration indicator, and the exception database is pre-configured based on the Internet Protocol address and the exception cases of the configuration indicator. The rule base includes standard values ​​corresponding to the configuration indicator, and the exception database includes: Internet Protocol address information of the computer device, machine name, configuration indicator name, specification name, specification clause, exception time, and exception expiration time. The matching result includes a first sub-matching result and a second sub-matching result. Matching the execution result with the rule base and the exception database respectively to determine the matching result includes: matching the execution result with the rule base and the exception database respectively to determine the matching result. The indicator value is matched with the standard value to obtain the first sub-matching result; the Internet Protocol address information and the indicator corresponding to the configuration indicator are matched with the exception library to obtain the second sub-matching result; if the first sub-matching result indicates that the match is unsuccessful, the configuration detection result indicates that the configuration is abnormal; if both the first sub-matching result and the second sub-matching result indicate that the match is successful, and the current time is between the exception time and the exception expiration time, the configuration detection result indicates that the configuration is normal; if the first sub-matching result indicates that the match is successful and the second sub-matching result indicates that the match is unsuccessful, the configuration detection result indicates that the configuration is normal. The second determining module is used to determine the configuration detection result for the target computer device based on the matching result; The configuration detection device is also used to determine the target computer devices in the target area from a device list obtained from a configuration management system for the target area, or from a device list obtained by performing a full scan of computer devices in the corresponding network segment.

7. An electronic device, comprising: One or more processors; Storage device for storing one or more programs. Wherein, when the one or more programs are executed by the one or more processors, the one or more processors perform the method according to any one of claims 1 to 5.

8. A computer-readable storage medium having executable instructions stored thereon, which, when executed by a processor, cause the processor to perform the method according to any one of claims 1 to 5.

9. A computer program product comprising a computer program that, when executed by a processor, implements the method according to any one of claims 1 to 5.

Images