Mobile terminal behavior management method and device and processing system

Abstract

The invention provides a mobile terminal behavior management method, a mobile terminal behavior management device and a processing system, provides a mobile terminal behavior management scheme corresponding to mobile terminals of remote office and mobile office, and has higher adaptability and higher security compared with traditional network security technologies such as IPS, IDS and IPsec agency. Good network security guarantee can be provided for the mobile terminal, and the behavior management requirement of the mobile terminal can be met in high quality.

Description

Technical Field

[0001] The present application relates to the field of network security, and in particular to a mobile terminal behavior management method, device and processing system. Background Art

[0002] Network security is an important issue in today's Internet era. As network attacks become increasingly complex and frequent, traditional security protection methods can no longer meet the needs of combating new threats. Traditional network security technologies mainly include firewalls, intrusion detection systems (IDS) and intrusion prevention systems (IPS). However, these technologies usually only provide limited threat detection and defense capabilities and cannot fully respond to increasingly complex and hidden network attacks. With the continuous evolution of network attack technologies, many new threats have emerged, such as advanced persistent threats (APT), zero-day vulnerability exploits, ransomware, etc. These threats are often highly hidden and destructive, and traditional security technologies are difficult to effectively detect and defend against.

[0003] Specifically, a firewall is a device or software located at the edge of the network. It implements security protection by monitoring and filtering network traffic. It can use rule sets to decide which traffic is allowed to pass and which needs to be blocked. It can filter based on information such as source IP address, destination IP address, port number, etc., and can detect and block malicious network connections, such as denial of service attacks (DDoS) and port scans, etc. It can perform deep inspections on data packets to prevent malicious code and attacks from entering the network. However, traditional firewalls mainly filter based on rules such as ports, protocols, and IP addresses, and cannot effectively respond to complex application layer threats and advanced attacks. Firewalls are deployed at the network edge, but cannot detect and prevent malicious activities and data leaks in the internal network. It is difficult to provide fine-grained access control, and it is not possible to flexibly control policies based on factors such as user identity, application, or content type;

[0004] An intrusion detection system is a security device that monitors network activities and detects potential attacks. It can be deployed at key locations in the network to monitor network traffic and system logs and analyze abnormal behaviors. It can use predefined rules, signatures, or behavior-based analysis to identify known attack patterns or abnormal behaviors. Once an anomaly is detected, the IDS will generate an alert to notify the administrator or automatically take action to prevent the attack. It can help discover unknown attacks, but it cannot actively prevent attacks. However, intrusion detection systems may generate a large number of false alarms (false positives), causing security teams to waste time and resources on investigations. At the same time, it may not be able to detect certain new and unknown attacks (false negatives). Usually, intrusion detection systems can only provide basic information about the attack, lack context awareness, and it is difficult to gain an in-depth understanding of the impact and threat level of the attack. Similarly, it can usually only provide alerts, but cannot take proactive measures to respond in real time and block attacks;

[0005] An IPsec proxy is a network security device used to establish a secure connection between two or more networks. It uses the Internet Protocol Security (IPSec) to provide encryption, authentication, and integrity protection. It is usually used to connect two or more networks located in different locations, such as a company's internal network and a remote office network. However, IPsec proxy configuration is relatively complex and requires the correct setting of parameters such as encryption algorithms, key management, and security policies. It is prone to configuration errors that lead to security vulnerabilities. The encryption and decryption process of data will introduce certain performance overhead, which may affect network throughput and response time. IPsec proxies are usually deployed at the network boundary and cannot provide end-to-end protection for terminal devices, especially in the case of mobile devices and remote users.

[0006] Against the above background, remote work and mobile work are becoming more and more common worldwide. This trend requires companies to provide secure remote access channels so that employees can safely access corporate resources. However, remote access also increases the risk of cyber attacks.

[0007] Based on the above existing network security technologies, many companies have established Security Operations Centers (SOCs) to monitor and respond to security incidents. However, due to the large amount of security incident data and alerts, traditional security operations centers often face manpower, technology and time constraints and are unable to handle and respond to threats in a timely and effective manner. Summary of the invention

[0008] The present application provides a mobile terminal behavior management method, device and processing system, corresponding to mobile terminals for remote office and mobile office, and provides a mobile terminal behavior management solution. Compared with traditional network security technologies such as IPS, IDS and IPsec proxy, it has higher adaptability, can provide good network security protection for mobile terminals, and meet the mobile terminal behavior management needs with high quality.

[0009] In a first aspect, the present application provides a mobile terminal behavior management method, the method comprising:

[0010] The server configures an XDR policy corresponding to the behavior management of the mobile terminal, wherein the mobile terminal is installed with a mobile terminal installation package file, which is generated by compiling the XDR project source code and the SSL VPN project source code together;

[0011] The server configures the SSL VPN policy corresponding to the network access work of the mobile terminal;

[0012] The mobile terminal performs SSL VPN dial-up to the server to access the SSL VPN network;

[0013] The server sends threat detection configuration to mobile terminals based on the SSL VPN network to achieve XDR policy synchronization;

[0014] The mobile terminal reports the corresponding work log to the server based on the SSL VPN network when the threat detection configuration is triggered;

[0015] The server performs threat detection processing based on the work log to achieve behavior management for mobile terminals.

[0016] In combination with the first aspect of the present application, in a first possible implementation manner of the first aspect of the present application, the method further includes:

[0017] The mobile terminal installs the mobile terminal installation package file stored in the local specified location following the confirmation of the user operation.

[0018] In combination with the first aspect of the present application, in a second possible implementation manner of the first aspect of the present application, the method further includes:

[0019] The server sends the mobile terminal installation package file to the mobile terminal;

[0020] The mobile terminal installs the mobile terminal installation package file under the triggering of the server.

[0021] In combination with the first aspect of the present application, in the third possible implementation method of the first aspect of the present application, the XDR policy is specifically a policy for the IM audit business, the corresponding processing object is the IM file with a backup size threshold of 2M, and the event response action is log reporting.

[0022] In combination with the first aspect of the present application, in a fourth possible implementation of the first aspect of the present application, the content of the SSL VPN policy includes:

[0023] The access port is 1194, the address segment allocated to the terminal is 123.123.123.0 / 24, and the terminal accessible address is 10.2.2.0 / 24, which is the account and password used to access the SSLVPN network.

[0024] In combination with the first aspect of the present application, in a fifth possible implementation of the first aspect of the present application, for a mobile terminal, a ring mechanism is used between the XDR process and the SSLVPN process to solve the problem of process resource synchronization.

[0025] In combination with the first aspect of the present application, in a sixth possible implementation manner of the first aspect of the present application, the method further includes:

[0026] The mobile terminal separately stores the work log reported when the threat detection configuration is triggered.

[0027] In a second aspect, the present application provides a mobile terminal behavior management device, the device comprising:

[0028] A first configuration unit is used to configure an XDR policy corresponding to the behavior management work of the mobile terminal, wherein the mobile terminal is installed with a mobile terminal installation package file, and the mobile terminal installation package file is compiled and generated by combining the XDR project source code and the SSL VPN project source code;

[0029] The second configuration unit is used to configure the SSL VPN policy corresponding to the network access work of the mobile terminal;

[0030] A dial-up unit is used to dial up the SSL VPN to the server to access the SSL VPN network;

[0031] A synchronization unit, used to send threat detection configurations to mobile terminals based on the SSL VPN network to achieve XDR policy synchronization;

[0032] A reporting unit, used to report corresponding work logs to the server based on the SSL VPN network as triggered by threat detection configuration;

[0033] The processing unit is used to carry out threat detection processing based on the work log to achieve behavior management for the mobile terminal.

[0034] In conjunction with the second aspect of the present application, in a first possible implementation manner of the second aspect of the present application, the device further includes an installation unit, which is used to:

[0035] With the confirmation of the user operation, the mobile terminal installation package file stored in the local specified location is installed.

[0036] In conjunction with the second aspect of the present application, in a second possible implementation manner of the second aspect of the present application, the device further includes:

[0037] A sending unit, used for sending the mobile terminal installation package file to the mobile terminal;

[0038] The installation unit is used to install the mobile terminal installation package file under the triggering of the server.

[0039] In combination with the second aspect of the present application, in a third possible implementation of the second aspect of the present application, the XDR policy is specifically a policy for IM audit services, the corresponding processing object is an IM file with a backup size threshold of 2M, and the event response action is log reporting.

[0040] In conjunction with the second aspect of the present application, in a fourth possible implementation of the second aspect of the present application, the content of the SSL VPN policy includes:

[0041] The access port is 1194, the address segment allocated to the terminal is 123.123.123.0 / 24, and the terminal accessible address is 10.2.2.0 / 24, which is the account and password used to access the SSLVPN network.

[0042] In combination with the second aspect of the present application, in a fifth possible implementation of the second aspect of the present application, for a mobile terminal, a ring mechanism is used between the XDR process and the SSLVPN process to solve the problem of process resource synchronization.

[0043] In combination with the second aspect of the present application, in a sixth possible implementation manner of the second aspect of the present application, the device further includes a storage unit, which is used to:

[0044] Separately store the work logs reported when threat detection configuration is triggered.

[0045] In a third aspect, the present application provides a processing system, including a server and a mobile terminal, for executing the method provided in the first aspect of the present application or any possible implementation of the first aspect of the present application.

[0046] In a fourth aspect, the present application provides a computer-readable storage medium, which stores multiple instructions, and the instructions are suitable for a processor to load to execute the method provided by the first aspect of the present application or any possible implementation of the first aspect of the present application.

[0047] From the above content, it can be concluded that the present application has the following beneficial effects:

[0048] Corresponding to mobile terminals for remote office and mobile office, the present application configures an XDR policy corresponding to the behavior management of the mobile terminal by the server on the one hand, wherein the mobile terminal is installed with a mobile terminal installation package file, and the mobile terminal installation package file is compiled and generated by combining the XDR project source code and the SSL VPN project source code. On the other hand, the SSL VPN policy corresponding to the network access work of the mobile terminal is configured, and then the mobile terminal dials up the SSL VPN to the server to access the SSLVPN network. Then the server sends the threat detection configuration to the mobile terminal based on the SSL VPN network to achieve XDR policy synchronization. Subsequently, the mobile terminal reports the corresponding work log to the server based on the SSL VPN network when the threat detection configuration is triggered. At this time, the server carries out threat detection processing based on the work log to achieve behavior management for the mobile terminal. Therefore, based on XDR and SSL VPN, a mobile terminal behavior management solution is provided. Compared with traditional network security technologies such as IPS, IDS and IPsec agent, it has higher adaptability, can provide good network security protection for mobile terminals, and meet the behavior management needs of mobile terminals with high quality. BRIEF DESCRIPTION OF THE DRAWINGS

[0049] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For those skilled in the art, other drawings can be obtained based on these drawings without creative work.

[0050] Figure 1 A flowchart of the mobile terminal behavior management method of the present application;

[0051] Figure 2 This is a schematic diagram of a scenario of the ring mechanism for this application;

[0052] Figure 3 This is another scenario diagram of the ring mechanism for this application;

[0053] Figure 4 This is another scenario diagram of the ring mechanism for this application;

[0054] Figure 5 A schematic diagram of a scenario for the overall solution of this application;

[0055] Figure 6 A schematic diagram of the structure of the mobile terminal behavior management device of the present application;

[0056] Figure 7 A structural schematic diagram of the processing equipment involved in the processing system of this application. DETAILED DESCRIPTION

[0057] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative work are within the scope of protection of this application.

[0058] The terms "first", "second", etc. in the specification and claims of this application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments described here can be implemented in an order other than that illustrated or described here. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or modules is not necessarily limited to those steps or modules clearly listed, but may include other steps or modules that are not clearly listed or inherent to these processes, methods, products or devices. The naming or numbering of steps in this application does not mean that the steps in the method flow must be executed in the time / logical sequence indicated by the naming or numbering. The process steps that have been named or numbered can change the execution order according to the technical purpose to be achieved, as long as the same or similar technical effects can be achieved.

[0059] The division of modules in this application is a logical division. There may be other division methods when it is implemented in actual applications. For example, multiple modules can be combined or integrated into another system, or some features can be ignored or not executed. In addition, the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, and the indirect coupling or communication connection between modules can be electrical or other similar forms, which are not limited in this application. In addition, the modules or submodules described as separate components may or may not be physically separated, may or may not be physical modules, or may be distributed in multiple circuit modules, and some or all of the modules may be selected according to actual needs to achieve the purpose of the present application.

[0060] Before introducing the mobile terminal behavior management method provided by this application, the background content involved in this application is first introduced.

[0061] The mobile terminal behavior management method, device and computer-readable storage medium provided in the present application can be applied to a processing system, and provides a mobile terminal behavior management solution for mobile terminals for remote office and mobile office. Compared with traditional network security technologies such as IPS, IDS and IPsec proxy, it has higher adaptability, can provide good network security protection for mobile terminals, and meet the mobile terminal behavior management needs with high quality.

[0062] The mobile terminal behavior management method mentioned in the present application may be executed by a mobile terminal behavior management device, or a processing system integrating the mobile terminal behavior management device, and the processing system includes two parts: a server and a mobile terminal. The mobile terminal behavior management device may be implemented in hardware or software, and the mobile terminal may be a portable terminal device such as a smart phone, a tablet computer, a laptop computer, or a personal digital assistant (PDA), so as to meet the work requirements of remote office and mobile office. In addition, for the server, it may also be configured in a device cluster manner.

[0063] Next, we will introduce the mobile terminal behavior management method provided by this application.

[0064] First, see Figure 1 , Figure 1 A flow chart of the mobile terminal behavior management method of the present application is shown. The mobile terminal behavior management method provided by the present application may specifically include the following steps S101 to S106:

[0065] Step S101, the server configures an XDR policy corresponding to the behavior management work of the mobile terminal, wherein the mobile terminal is installed with a mobile terminal installation package file, and the mobile terminal installation package file is compiled and generated by integrating the XDR project source code and the SSL VPN project source code;

[0066] For organizations / enterprises, in actual situations, it usually involves the behavior management needs of multiple or a large number of mobile terminals. It is understandable that, in order to facilitate the description of the solution, this application describes the solution for one mobile terminal. In actual situations, the behavior management work for each mobile terminal will involve this aspect of solution processing.

[0067] What can be seen here is that this application combines XDR technology and SSL VPN technology to achieve the goal of mobile terminal behavior management.

[0068] XDR, or Extended Detection and Response, can integrate security event information from networks, endpoints, clouds, and other data sources, and use automatic learning and behavioral analysis to automatically identify and correlate the relationships between different events. It provides automated response capabilities and can collect and store event data from various security data sources.

[0069] SSL VPN, or Secure Socket Layer Virtual Private Network, is a virtual private network technology used for remote access and secure connection to enterprise internal network resources. It provides a secure remote access mechanism through encryption and identity authentication mechanisms.

[0070] Corresponding to the integrated application of XDR and SSL VPN, the present application can specifically implement the technical deployment work on the mobile terminal through a specific mobile terminal installation package file, and the specific mobile terminal installation package file needs to be generated / obtained in advance by compiling the XDR project source code and the SSL VPN project source code together.

[0071] After the mobile terminal has installed the specific mobile terminal installation package file, it forms an SSL VPN mobile terminal with built-in XDR function, which can have built-in XDR module and SSL VPN module for subsequent data processing involved in mobile terminal behavior management.

[0072] In terms of details, for the deployment of the specific mobile terminal installation package file, as an exemplary embodiment, the method of the present application may also include:

[0073] The mobile terminal installs the mobile terminal installation package file stored in the local specified location following the confirmation of the user operation.

[0074] It can be understood that in the embodiment here, the deployment of the mobile terminal installation package file on the mobile terminal side can be manually completed by the terminal user, i.e., the terminal user or the staff, which corresponds to the settings manually configured by the company personnel in actual situations. The source of the mobile terminal installation package file is relatively arbitrary, and the transmission of specific files is provided through different channels such as email, network disk, communication platform or USB flash drive. After all, the installation package file does not involve specific privacy content. In the early stage of formal work, it is also necessary to cooperate with the server to complete the specific configuration work.

[0075] Thus, the embodiments herein provide an application solution with high visualization and convenient operation in actual situations.

[0076] In addition, in another aspect, as an exemplary embodiment, the method of the present application may further include:

[0077] The server sends the mobile terminal installation package file to the mobile terminal;

[0078] The mobile terminal installs the mobile terminal installation package file under the triggering of the server.

[0079] It can be seen that compared with the previous manual deployment operations, the embodiment here directly performs real-time file distribution and installation trigger operations by the server. Behind the real-time and targeted installation of the mobile terminal installation package file on a specific mobile terminal, the corresponding mobile terminal identity confirmation settings can be deployed, which may involve the preliminary confirmation of the terminal identity and / or user identity. In this way, in terms of details, the mobile terminal installation package file and the installation trigger instruction can be accurately distributed (the instruction can be distributed together with the installation package file or separately), so as to accurately realize the automated deployment of the mobile terminal installation package file.

[0080] In addition, for the integrated application of XDR and SSL VPN on the mobile terminal side, or in other words, the linkage work of the XDR module and the SSL VPN module on the mobile terminal side, based on the consideration of optimizing processing efficiency, as an exemplary embodiment, for the mobile terminal, the ring mechanism can be used between the XDR process and the SSLVPN process to solve the process resource synchronization problem.

[0081] It can be understood that the ring mechanism is a lock-free queue mechanism with the attribute of first-in-first-out, which ensures the timing between processing processes. Then the reading and writing of resources will naturally not conflict or overlap, and lock-free is more efficient.

[0082] Taking the application scenario involving producers and consumers as an example, the application of the ring mechanism has the following relevant content:

[0083] 1.1, the main structure of the Ring mechanism implementation:

[0084] struct rte_ring{

[0085] char name[RTE_MEMZONE_NAMESIZE]__rte_cache_aligned;

[0086] int flags;

[0087] const struct rte_memzone*memzone;

[0088] uint32_t size;

[0089] uint32_t mask;

[0090] uint32_t capacity;

[0091] struct rte_ring_headtail prod__rte_cache_aligned;

[0092] struct rte_ring_headtail cons__rte_cache_aligned; ...

[0094] };

[0095] Among them, __rte_cache_aligned is the name of the ring. When looking up, the corresponding ring is found according to the name;

[0096] Flags, which are tags used to describe whether the queue is single / multi-producer or single / multi-consumer safe;

[0097] Memzone, that is, the memzone to which it belongs. Memzone is the underlying data structure of dpdk memory management;

[0098] Size, i.e. queue length, is 2^n. If flags is RING_F_EXACT_SZ, the queue size is the queue length at initialization raised to the power of 2. For example, if it is 7, then the nearest 2^n power is 8. If flags is not RING_F_EXACT_SZ, then the queue length must be a power of 2^n when the queue is initialized;

[0099] Mask, which is the queue length minus 1, is used to take the remainder when calculating the position;

[0100] Prod: The producer header is also called the write header, and there is also a tail corresponding to it;

[0101] Cons: The consumer head, also called the read head. Similarly, there is a tail corresponding to it.

[0102] 1.2 An rte_ring represents a ring. The two important parts are prod and cons. The former represents the producer and the latter represents the consumer. There are two tags in each. The data stored in the ring is distributed in the space adjacent to the struct rte_ring. For easy understanding, you can also refer to Figure 2 A schematic diagram of a scenario of the ring mechanism of the present application is shown.

[0103] 1.3 The producer writes resources. For example, there are 4 elements in the queue: obj1, obj2, obj3, and obj4. When a new element is added to the queue, prod.head is offset to the new producer head. If the position is 5, and if 2 elements are produced, the new position will be 7. Of course, there may be other producers (XDR or SSLVPN). They will occupy the position here first and write elements later. After writing the elements, the producer's position prod.tail must be updated. The purpose of this step is to notify the consumer that it can be consumed. Then the consumer starts to consume the elements, and prod.tail must also be updated synchronously. After the tail of cons.tail is updated, the consumed element space can be used again. For easy understanding, you can also refer to Figure 3 and Figure 4 Schematic diagrams showing different scenarios of the ring mechanism of the present application.

[0104] Back to the XDR policy to be configured by the server, it can be understood that the XDR policy corresponds to the behavior management of the mobile terminal. Specifically, it is a policy to be synchronized with the mobile terminal side in the future. It is used to describe / limit what the mobile terminal needs to do in the mobile terminal behavior management work, and configure terminal auditing, detection and event response, etc. It can be set specifically through corresponding threat detection events.

[0105] The strategy may be specifically configured based on a corresponding configuration entry that is pre-configured, by an automatic configuration strategy on the server side or by manual operation.

[0106] In addition, on the server side, it can be configured with two services, namely, XDR service and SSL VPN service, to provide two aspects of technical support and management for mobile terminals.

[0107] As for the XDR policy configured in step S101 or involved in the present application, it can be understood that in actual situations, the specific content of the policy can be configured according to the specific fields / levels / businesses involved in the network security that the company is concerned about.

[0108] In this regard, as an exemplary embodiment, the XDR policy of the present application may specifically be a policy for IM audit services, the corresponding processing object is an IM file with a backup size threshold of 2M, and the event response action is log reporting.

[0109] Among them, IM stands for Instant Messaging.

[0110] Specifically, the present application can focus on the network security goal of the IM audit business type, and implement it by reporting logs to specifically report the backup files of the corresponding IM files where threats are detected or suspected.

[0111] Among them, it is easy to understand that when facing the goal of mobile terminal behavior management, the user on the mobile terminal side knows / is aware of the existence of mobile terminal behavior management work involving network security, and the relevant designated IM services on the mobile terminal are also related to the company's business, so there will be no corresponding privacy issues / concerns.

[0112] Thus, the embodiment herein provides a specific implementation supporting solution based on the content of the XDR policy for the application scenarios involved in the specific mobile terminal behavior management solution in actual situations.

[0113] Step S102, the server configures the SSL VPN policy corresponding to the network access work of the mobile terminal;

[0114] In addition to the XDR policy, the SSL VPN policy also needs to be configured on the server side. The SSL VPN policy is related to the network access of mobile terminals and describes how to enable mobile terminals to access the SSL VPN network provided by the server. This is achieved by configuring the account and password used for the VPN proxy.

[0115] In addition, it can be understood that the execution timing of step S101 and step S102 can be adjusted in specific operations. Step S101 can be executed first, and then step S102, or step S102 can be executed first, and then step S101, or step S101 and step S102 can be executed at the same time. This application does not make any specific limitations here.

[0116] In practical terms, the present application also provides a set of practical operation schemes. Specifically, as an exemplary embodiment, the content of the SSL VPN policy of the present application may specifically include:

[0117] The access port is 1194, the address segment allocated to the terminal is 123.123.123.0 / 24, the terminal accessible address is 10.2.2.0 / 24, and the account and password used to access the SSL VPN network.

[0118] Among them, it should be noted that the account and password required for the subsequent mobile terminal to dial up to the server through SSL VPN can be specifically configured by the server during the configuration of the SSL VPN policy here, and correspondingly, the account and password can be issued / synchronized.

[0119] Step S103, the mobile terminal performs SSL VPN dialing to the server to access the SSL VPN network;

[0120] After the server has completed the configuration of the corresponding XDR service and SSL VPN service for the mobile terminal behavior management work on the mobile terminal side, the mobile terminal can make an SSL VPN dial-up to the server to request access to the SSLVPN network, and after passing, it can access the SSL VPN network.

[0121] In actual situations, the server's work in the two aspects mentioned above usually takes a relatively short processing time, so the mobile terminal usually has completed the configuration before initiating the SSL VPN dial-up.

[0122] In addition, in actual situations, the server side may also have a certain degree of interaction with the mobile terminal side, which can be manual interaction, such as direct manual notification that SSL VPN dial-up can be initiated, or manual initiation of SSL VPN dial-up, or interaction between machines. In addition, as mentioned above, the account and password involved in SSL VPN dial-up can also be configured and issued by the server, which itself is also a signal that the server has completed the configuration and informed the mobile terminal side that SSL VPN dial-up can be initiated.

[0123] Step S104, the server sends threat detection configuration to the mobile terminal based on the SSL VPN network to achieve XDR policy synchronization;

[0124] After the mobile terminal completes the SSL VPN access work, the server can synchronize the XDR policy.

[0125] Among them, it can be understood that in the process of synchronizing the XDR policy, the XDR policy on the server side is not directly sent to the mobile terminal, but the corresponding threat detection settings are sent. The threat detection settings can be understood as secondary processing of the policy content of the XDR policy, so that the XDR module on the mobile terminal side loads the threat detection configuration to achieve the purpose of synchronizing the policy content of the XR policy.

[0126] Step S105, the mobile terminal reports corresponding work logs to the server based on the SSL VPN network as the threat detection configuration is triggered;

[0127] After the mobile terminal completes the XDR policy synchronization, XDR automatically responds when encountering a trigger event condition, sending which process of which IP did what to cause the exception. The detailed log information is then sent back to the server via the SSLVPN tunnel.

[0128] Specifically, during normal operation, the mobile terminal can perform real-time threat detection according to the policy content of the synchronized XDR policy. During this process, if a threat or suspected threat occurs, it can be triggered by the threat detection configuration and reported to the server in the form of a work log to inform the server to perform corresponding response processing and promote corresponding network security work. Specifically, the work log is reported by using the connected SSL VPN network.

[0129] In addition, in some cases, the mobile terminal may not report the work log that was originally required to be reported when the threat detection configuration is triggered, but instead store it separately for local processing. This corresponds to the actual situation where some mobile terminals themselves are configured with threat response strategies or some terminal users themselves have threat response capabilities, or for subsequent backtracking processing.

[0130] Alternatively, in some cases, the response processing situations on the mobile terminal side and the server side may also be considered simultaneously, in which case the work log may be reported or stored separately locally.

[0131] In this regard, as an exemplary embodiment, for this situation, the method of the present application may further include:

[0132] The mobile terminal separately stores the work log reported when the threat detection configuration is triggered.

[0133] Step S106: The server performs threat detection processing based on the work log to implement behavior management for the mobile terminal.

[0134] After the mobile terminal reports the current abnormal situation and triggers the reporting work log, it is easy to understand that the server side can carry out specific threat detection processing based on the work log, determine the specific threat situation and carry out corresponding response processing, such as outputting warnings and other preset different response measures, which corresponds to different degrees / aspects of mobile terminal behavior management needs in actual situations.

[0135] Specifically, you can also combine Figure 5 A scenario schematic diagram of the overall solution of the present application is shown to provide a more vivid understanding of the above solution content.

[0136] Finally, for the above solution content, in general, corresponding to the mobile terminals for remote office and mobile office, this application configures the XDR policy corresponding to the behavior management work of the mobile terminal by the server on the one hand, wherein the mobile terminal is installed with a mobile terminal installation package file, and the mobile terminal installation package file is compiled and generated by the XDR project source code and the SSL VPN project source code. On the other hand, the SSL VPN policy corresponding to the network access work of the mobile terminal is configured, and then the mobile terminal dials the SSL VPN to the server to access the SSL VPN network. Then the server sends the threat detection configuration to the mobile terminal based on the SSL VPN network to achieve XDR policy synchronization. Subsequently, the mobile terminal reports the corresponding work log to the server based on the SSL VPN network as the threat detection configuration is triggered. At this time, the server carries out threat detection processing based on the work log to achieve behavior management for the mobile terminal. Therefore, based on XDR and SSL VPN, a mobile terminal behavior management solution is provided. Compared with traditional network security technologies such as IPS, IDS and IPsec agent, it has higher adaptability, can provide good network security protection for mobile terminals, and meet the behavior management needs of mobile terminals with high quality.

[0137] The above is an introduction to the mobile terminal behavior management method provided by this application. In order to facilitate better implementation of the mobile terminal behavior management method provided by this application, this application also provides a mobile terminal behavior management device from the perspective of functional modules.

[0138] See also Figure 6 , Figure 6 This is a schematic diagram of the structure of the mobile terminal behavior management device of the present application. In the present application, the mobile terminal behavior management device 600 may specifically include the following structure:

[0139] The first configuration unit 601 is used to configure an XDR policy corresponding to the behavior management work of the mobile terminal, wherein the mobile terminal is installed with a mobile terminal installation package file, and the mobile terminal installation package file is compiled and generated by combining the XDR project source code and the SSL VPN project source code;

[0140] The second configuration unit 602 is used to configure the SSL VPN policy corresponding to the network access work of the mobile terminal;

[0141] The dialing unit 603 is used to perform SSL VPN dialing to the server to access the SSL VPN network;

[0142] A synchronization unit 604 is used to send threat detection configuration to the mobile terminal based on the SSL VPN network to achieve XDR policy synchronization;

[0143] A reporting unit 605, configured to report corresponding work logs to the server based on the SSL VPN network as the threat detection configuration is triggered;

[0144] The processing unit 606 is used to carry out threat detection processing based on the work log to achieve behavior management for the mobile terminal.

[0145] In an exemplary embodiment, the apparatus further includes an installation unit 607, configured to:

[0146] With the confirmation of the user operation, the mobile terminal installation package file stored in the local specified location is installed.

[0147] In yet another exemplary embodiment, the apparatus further comprises:

[0148] The sending unit 608 is used to send the mobile terminal installation package file to the mobile terminal;

[0149] The installation unit 607 is used to install the mobile terminal installation package file under the triggering of the server.

[0150] In another exemplary embodiment, the XDR policy is specifically a policy for IM audit services, the corresponding processing object is an IM file with a backup size threshold of 2M, and the event response action is log reporting.

[0151] In another exemplary embodiment, the content of the SSL VPN policy includes:

[0152] The access port is 1194, the address segment allocated to the terminal is 123.123.123.0 / 24, and the terminal accessible address is 10.2.2.0 / 24, which is the account and password used to access the SSLVPN network.

[0153] In another exemplary embodiment, for a mobile terminal, a ring mechanism is used between the XDR process and the SSLVPN process to solve the process resource synchronization problem.

[0154] In yet another exemplary embodiment, the apparatus further includes a storage unit 609, configured to:

[0155] Separately store the work logs reported when threat detection configuration is triggered.

[0156] The present application also provides a processing system from the perspective of hardware structure. The processing system includes two parts: a server and a mobile terminal. For the convenience of explanation, both parts can be referred to as a processing device. Figure 7 , Figure 7701, a memory 702, and an input / output device 703. The processor 701 is used to execute the computer program stored in the memory 702 to implement the following Figure 1 The steps of the mobile terminal behavior management method in the corresponding embodiment; or, the processor 701 is used to execute the computer program stored in the memory 702 to implement the following Figure 6 Corresponding to the functions of each unit in the embodiment, the memory 702 is used to store the processor 701 executing the above Figure 1 The mobile terminal behavior management method in the corresponding embodiment corresponds to the computer program required by the execution subject.

[0157] Exemplarily, the computer program may be divided into one or more modules / units, one or more modules / units are stored in the memory 702, and executed by the processor 701 to complete the present application. One or more modules / units may be a series of computer program instruction segments capable of completing specific functions, and the instruction segments are used to describe the execution process of the computer program in the computer device.

[0158] The processing device may include, but is not limited to, a processor 701, a memory 702, and an input / output device 703. Those skilled in the art will appreciate that the illustration is merely an example of a processing device and does not constitute a limitation on the processing device, and may include more or fewer components than shown in the illustration, or a combination of certain components, or different components. For example, the processing device may also include a network access device, a bus, etc., and the processor 701, the memory 702, the input / output device 703, etc. are connected via a bus.

[0159] The processor 701 may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor may be a microprocessor or any conventional processor, etc. The processor is the control center of the processing device, and uses various interfaces and lines to connect various parts of the entire device.

[0160] The memory 702 can be used to store computer programs and / or modules. The processor 701 implements various functions of the computer device by running or executing the computer programs and / or modules stored in the memory 702 and calling the data stored in the memory 702. The memory 702 can mainly include a program storage area and a data storage area, wherein the program storage area can store an operating system, at least one application required for a function, etc.; the data storage area can store data created according to the use of the processing device, etc. In addition, the memory can include a high-speed random access memory, and can also include a non-volatile memory, such as a hard disk, a memory, a plug-in hard disk, a smart memory card (Smart Media Card, SMC), a secure digital (SecureDigital, SD) card, a flash card (Flash Card), at least one disk storage device, a flash memory device, or other volatile solid-state storage devices.

[0161] When the processor 701 is used to execute the computer program stored in the memory 702, it can specifically implement the following functions of the corresponding execution subject:

[0162] The server configures an XDR policy corresponding to the behavior management of the mobile terminal, wherein the mobile terminal is installed with a mobile terminal installation package file, which is generated by compiling the XDR project source code and the SSL VPN project source code together;

[0163] The server configures the SSL VPN policy corresponding to the network access work of the mobile terminal;

[0164] The mobile terminal performs SSL VPN dial-up to the server to access the SSL VPN network;

[0165] The server sends threat detection configuration to mobile terminals based on the SSL VPN network to achieve XDR policy synchronization;

[0166] The mobile terminal reports the corresponding work log to the server based on the SSL VPN network when the threat detection configuration is triggered;

[0167] The server performs threat detection processing based on the work log to achieve behavior management for mobile terminals.

[0168] Those skilled in the art can clearly understand that for the convenience and simplicity of description, the specific working process of the mobile terminal behavior management device, processing system and its corresponding units described above can refer to the following. Figure 1 The description of the mobile terminal behavior management method in the corresponding embodiment will not be repeated here.

[0169] A person of ordinary skill in the art will appreciate that all or part of the steps in the various methods of the above embodiments may be completed by instructions, or by controlling related hardware through instructions. The instructions may be stored in a computer-readable storage medium and loaded and executed by a processor.

[0170] To this end, the present application provides a computer-readable storage medium, in which a plurality of instructions are stored, and the instructions can be loaded by a processor to execute the present application as follows: Figure 1 The steps of the mobile terminal behavior management method in the corresponding embodiment, the specific operations can refer to the following Figure 1 The description of the mobile terminal behavior management method in the corresponding embodiment will not be repeated here.

[0171] The computer-readable storage medium may include: a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, etc.

[0172] Due to the instructions stored in the computer-readable storage medium, the present application can be executed. Figure 1 The steps of the mobile terminal behavior management method in the corresponding embodiment, therefore, the present application can be implemented as follows Figure 1 The beneficial effects that can be achieved by the mobile terminal behavior management method in the corresponding embodiment are detailed in the previous description and will not be repeated here.

[0173] The mobile terminal behavior management method, device, processing system and computer-readable storage medium provided by the present application are introduced in detail above. Specific examples are used in this article to illustrate the principles and implementation methods of the present application. The description of the above embodiments is only used to help understand the method of the present application and its core idea; at the same time, for technical personnel in this field, according to the idea of ​​the present application, there will be changes in the specific implementation method and application scope. In summary, the content of this specification should not be understood as a limitation on the present application.

Claims

1. A mobile terminal behavior management method, characterized in that: The method comprises: The server configures an XDR policy corresponding to the behavior management work of the mobile terminal, wherein the mobile terminal is installed with a mobile terminal installation package file, and the mobile terminal installation package file is generated by compiling the XDR project source code and the SSL VPN project source code together; The server configures the SSL VPN policy corresponding to the network access work of the mobile terminal; The mobile terminal performs SSL VPN dialing to the server to access the SSL VPN network; The server sends a threat detection configuration to the mobile terminal based on the SSL VPN network to achieve the XDR policy synchronization; The mobile terminal reports a corresponding work log to the server based on the SSL VPN network when the threat detection configuration is triggered; The server carries out threat detection processing based on the work log to achieve behavior management of the mobile terminal.

2. The method according to claim 1, characterized in that The method further comprises: The mobile terminal installs the mobile terminal installation package file stored in the local designated location following confirmation of the user operation.

3. The method according to claim 1, characterized in that The method further comprises: The server sends the mobile terminal installation package file to the mobile terminal; The mobile terminal installs the mobile terminal installation package file under the triggering of the server.

4. The method according to claim 1, characterized in that: The XDR policy is specifically a policy for IM audit services, the corresponding processing object is an IM file with a backup size threshold of 2M, and the event response action is log reporting.

5. The method according to claim 1, characterized in that The content of the SSL VPN policy includes: The access port is 1194, the address segment allocated to the terminal is 123.123.123.0 / 24, and the terminal accessible address is 10.2.2.0 / 24, which is used to access the account and password of the SSLVPN network.

6. The method according to claim 1, characterized in that For the mobile terminal, a ring mechanism is used between the XDR process and the SSLVPN process to solve the problem of process resource synchronization.

7. The method according to claim 1, characterized in that The method further comprises: The mobile terminal separately stores the work log reported when the threat detection configuration is triggered.

8. A mobile terminal behavior management device, characterized in that: The device comprises: A first configuration unit is used to configure an XDR policy corresponding to the behavior management work of the mobile terminal, wherein the mobile terminal is installed with a mobile terminal installation package file, and the mobile terminal installation package file is generated by compiling the XDR project source code and the SSL VPN project source code together; A second configuration unit, used to configure an SSL VPN policy corresponding to the network access work of the mobile terminal; A dial-up unit is used to dial up the SSL VPN to the server to access the SSL VPN network; A synchronization unit, configured to send a threat detection configuration to the mobile terminal based on the SSL VPN network to achieve synchronization of the XDR policy; A reporting unit, configured to report a corresponding work log to the server based on the SSL VPN network in response to the triggering of the threat detection configuration; A processing unit is used to carry out threat detection processing based on the work log to achieve behavior management of the mobile terminal.

9. A processing system, characterized in that: The method comprises a server and a mobile terminal, and is used to execute the method according to any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a plurality of instructions, and the instructions are suitable for being loaded by a processor to execute the method according to any one of claims 1 to 7.

Images