Non-office behavior monitoring method and system for power system browser

Abstract

The invention discloses a non-office behavior monitoring method for a browser of a power system. The method comprises the following steps: starting non-office behavior monitoring when a computer of the power system is started; acquiring an office website and office time of the power system; analyzing a browser file of a computer of the power system in real time to extract access information; and performing comparative analysis on the obtained access information and the obtained data information to realize non-office behavior monitoring for the power system browser. The invention also discloses a system for realizing the non-office behavior monitoring method for the power system browser. According to the non-office behavior monitoring method and system for the electric power system browser, through analysis of the data of the browser and through the corresponding disposal behaviors, monitoring of the non-office behavior of the electric power system browser is achieved, and the method and system are higher in reliability, better in accuracy and higher in efficiency.

Description

Technical Field

[0001] The invention belongs to the field of electrical automation, and in particular relates to a non-office behavior monitoring method and system for power system browsers. Background Art

[0002] With the development of economy and technology and the improvement of people's living standards, electricity has become an indispensable secondary energy source in people's production and life, bringing endless convenience to people's production and life. Therefore, ensuring the stable and reliable supply of electricity has become one of the most important tasks of the power system.

[0003] At present, the power system has gradually begun to develop digitalization and networking, and browser access to the power system has become a common operation method, and this operation method has also significantly improved work efficiency. However, the number of non-office behaviors performed through the browser of the power system has gradually increased. The emergence and proliferation of such non-office behaviors may affect the normal work of employees, and thus affect the safe and stable operation of the power system.

[0004] At present, the network security monitoring schemes of power systems mainly monitor external attacks and internal malicious behaviors of power systems, while there is almost no monitoring of non-office behaviors of power system browsers. In addition, even if there is monitoring of non-office behaviors of power system browsers, such monitoring schemes simply classify and restrict the visited websites at the network boundary. If non-office behaviors are performed through power system browsers through illegal routers or wireless hotspots, the existing schemes cannot effectively monitor them. Summary of the invention

[0005] One of the purposes of the present invention is to provide a non-office behavior monitoring method for power system browsers with high reliability, good accuracy and high efficiency.

[0006] A second objective of the present invention is to provide a system for implementing the non-office behavior monitoring method for power system browsers.

[0007] The non-office behavior monitoring method for power system browsers provided by the present invention comprises the following steps:

[0008] S1. When the computers in the power system are turned on, start non-office behavior monitoring;

[0009] S2. Obtain the office website and office hours of the power system;

[0010] S3. Analyze the browser files of the computers in the power system in real time to extract access information;

[0011] S4. Compare and analyze the access information obtained in step S3 and the data information obtained in step S2 to monitor the non-office behavior of the power system browser.

[0012] The step S2 of obtaining the office website and office hours of the power system specifically includes the following steps:

[0013] Use C++ to write the power system office website library and power system office time library in json format;

[0014] The office hours mentioned above include the time for rest during statutory holidays on working days, and the time for work during rest days;

[0015] The time includes year, month, day, hour, minute and second; wherein the hour, minute and second are divided into the hour, minute and second of winter time and the hour, minute and second of summer time.

[0016] The real-time analysis of the browser files of the computers in the power system to extract access information described in step S3 includes the following steps:

[0017] Query and analyze browser files of computers in the power system at set times;

[0018] Obtain office hours based on query and analysis results;

[0019] According to the query and analysis results, the browser URL is obtained.

[0020] The step S3 specifically includes the following steps:

[0021] Query and analyze browser files of computers in the power system at set times;

[0022] Obtain office hours based on query and analysis results;

[0023] According to the query and analysis results, obtain the browser URL:

[0024] If the browser is Google Chrome, the browser's files are located in C:\Users\[current user name]\AppData\Local\Google\Chrome\User Data\Default;

[0025] If the browser is Microsoft Edge, the browser's files are located in C:\Users\[current user name]\AppData\Local\Microsoft\Edge\User Data\Default;

[0026] If the browser is Tencent QQ Browser, the browser file is under C:\Users\[Current User Name]\AppData\Local\Tencent\QQBrowser\User Data\Default;

[0027] Access the browser's data folders; the data folders include the History folder, the Login Data folder, and the Web Data folder;

[0028] Parse the obtained browser data file:

[0029] Use C++ SQLite API to execute the query statement of SQLite database, query the urls and visits tables of History folder, query the logins table of Login Data folder and query the autofill table of Web Data folder to obtain the last visited URLs of the day and the corresponding last_visit_time and visit_duration fields; at this time, the query results include the URL of the most recent day, the last visit time of the URL and the duration of the visit to the URL;

[0030] Through the database query statement, the origin_url and the corresponding action_url, username_value and username_value fields are queried; at this time, the query results include the access URL, the form URL and the user name;

[0031] Through the database query statement, query the autofill table with the value containing "name" in the name field; at this time, the query result includes the user's username.

[0032] Step S4 compares and analyzes the access information obtained in step S3 and the data information obtained in step S2 to implement non-office behavior monitoring of power system browsers, including the following steps:

[0033] Compare the last visited URLs and corresponding last_visit_time and visit_duration fields of the day obtained with the data in the power system office URL database obtained in step S2 to determine whether the behavior of visiting the website is non-office behavior:

[0034] If the website visited is a website in the power system office website library, then the act of visiting the website is an office act;

[0035] If the website visited is not in the power system office website library, the behavior of visiting the website is considered non-office behavior;

[0036] Compare the URL of the website, the last access time of the website and the duration of access to the website obtained on the most recent day with the data in the power system office time database obtained in step S2 to determine whether the current time is a working day or a statutory holiday;

[0037] Finally, the judgment is made:

[0038] If non-office activities are performed on working days, it is determined as non-office activities performed through the power system browser; at the same time, the execution frequency of step S3 and step S4 is increased;

[0039] If the office behavior is performed by a non-working person, or on a working day, it should be recorded;

[0040] If non-office activities are performed on non-working days, it is determined as non-office activities performed through the power system browser; and at the same time, the execution frequency of step S3 and step S4 is increased.

[0041] The non-office behavior monitoring method for power system browsers also includes the following steps:

[0042] S5. Based on the monitoring results obtained in step S4, take corresponding measures to deal with non-office behaviors.

[0043] Step S5, in response to the monitoring result obtained in step S4, takes corresponding measures to achieve the disposal of non-office behavior, which specifically includes the following steps:

[0044] When a non-office activity is first recorded via the power system browser, the duration of the non-office activity is recorded:

[0045] If the duration exceeds the first set value, a light blocking of non-office activities is performed;

[0046] If the duration exceeds the second set value, a re-blocking of non-office behavior is performed and the non-office behavior is reported at the same time; the second set value is greater than the first set value;

[0047] The light blocking is performed by modifying C:\Windows\System32\drivers\etc\hosts; mapping the domain name accessed during non-office hours with the office system IP of the power system, and all access to the non-office system domain name is temporarily directed to the office system of the power system;

[0048] The re-blocking is to immediately close the browser, then reopen the browser and automatically access the office system of the power system, and report the analyzed data information to the server of the power system; the analyzed data information includes the user name with historical login to the office system, computer IP, computer name, MAC address, computer user name, access URL information, access time, access duration and user name information that has logged into the office system.

[0049] The present invention also provides a system for implementing the non-office behavior monitoring method for the power system browser, comprising a monitoring startup module, a data acquisition module, a data extraction module, a behavior monitoring module and a behavior disposal module; the monitoring startup module, the data acquisition module, the data extraction module, the behavior monitoring module and the behavior disposal module are connected in series in sequence; the monitoring startup module is used to start the non-office behavior monitoring when the computer of the power system is turned on, and upload the data information to the data acquisition module; the data acquisition module is used to obtain the office website and office hours of the power system according to the received data information, and upload the data information to the data extraction module; the data extraction module is used to analyze the browser files of the computer of the power system in real time according to the received data information to extract access information, and upload the data information to the behavior monitoring module; the behavior monitoring module is used to compare and analyze the access information obtained and the data information obtained according to the received data information, to realize the non-office behavior monitoring of the power system browser, and upload the data information to the behavior disposal module; the behavior disposal module is used to take corresponding measures according to the received data information and the obtained monitoring results to realize the disposal of non-office behavior.

[0050] The method and system for monitoring the non-office behavior of power system browsers provided by the present invention not only realizes the monitoring of the non-office behavior of power system browsers by analyzing the browser data and taking corresponding disposal actions, but also has higher reliability, better accuracy and higher efficiency. BRIEF DESCRIPTION OF THE DRAWINGS

[0051] Figure 1 The figure is a schematic diagram of the method flow of the present invention.

[0052] Figure 2 Schematic diagram of the functional modules of the system of the present invention. DETAILED DESCRIPTION

[0053] like Figure 1 The method flow diagram of the method of the present invention is shown as follows: The non-office behavior monitoring method for power system browsers disclosed in the present invention comprises the following steps:

[0054] S1. When the computers in the power system are turned on, start non-office behavior monitoring;

[0055] S2. Obtain the office website and office hours of the power system; specifically, the steps include:

[0056] Use C++ to write the power system office website library and power system office time library in json format;

[0057] The office hours mentioned above include the time for rest during statutory holidays on working days, and the time for work during rest days;

[0058] The time includes year, month, day, hour, minute and second; the hour, minute and second are divided into winter time hour, minute and second and summer time hour, minute and second;

[0059] S3. Analyze the browser files of the computers of the power system in real time to extract access information; including the following steps:

[0060] According to the set time, query and analyze the browser files of the power system computers;

[0061] Obtain office hours based on query and analysis results;

[0062] Obtain the browser URL based on the query and analysis results;

[0063] When implementing it, you can take the following steps:

[0064] Query and analyze browser files of computers in the power system at set times;

[0065] Obtain office hours based on query and analysis results;

[0066] According to the query and analysis results, obtain the browser URL:

[0067] If the browser is Google Chrome, the browser's files are located in C:\Users\[Current User Name]\AppData\Local\Google\Chrome\User Data\Default;

[0068] If the browser is Microsoft Edge, the browser's files are located in C:\Users\[current user name]\AppData\Local\Microsoft\Edge\User Data\Default;

[0069] If the browser is Tencent QQ Browser, the browser files are under C:\Users\[Current User Name]\AppData\Local\Tencent\QQBrowser\User Data\Default;

[0070] Access the browser's data folders; the data folders include the History folder, the Login Data folder, and the Web Data folder;

[0071] Parse the obtained browser data file:

[0072] Use C++ SQLite API to execute the query statement of SQLite database, query the urls and visits tables of History folder, query the logins table of Login Data folder and query the autofill table of Web Data folder to obtain the last visited URLs of the day and the corresponding last_visit_time and visit_duration fields; at this time, the query results include the URL of the most recent day, the last visit time of the URL and the duration of the visit to the URL;

[0073] Through the database query statement, the origin_url and the corresponding action_url, username_value and username_value fields are queried; at this time, the query results include the access URL, the form URL and the user name;

[0074] Use the database query statement to query the autofill table for the value containing "name" in the name field; at this time, the query result includes the user's username;

[0075] S4. Compare and analyze the access information obtained in step S3 and the data information obtained in step S2 to implement non-office behavior monitoring of power system browsers; comprising the following steps:

[0076] Compare the last visited URLs (preferably 30) and the corresponding last_visit_time and visit_duration fields of the day with the data in the power system office URL database obtained in step S2 to determine whether the behavior of visiting the website is non-office behavior:

[0077] If the website visited is a website in the power system office website library, then the act of visiting the website is an office act;

[0078] If the website visited is not in the power system office website library, the behavior of visiting the website is considered non-office behavior;

[0079] Compare the URL of the website, the last access time of the website and the duration of access to the website obtained on the most recent day with the data in the power system office time database obtained in step S2 to determine whether the current time is a working day or a statutory holiday;

[0080] Finally, the judgment is made:

[0081] If non-office activities are performed on working days, it is determined as non-office activities performed through the power system browser; at the same time, the execution frequency of step S3 and step S4 is increased;

[0082] If the office behavior is performed by a non-working person, or on a working day, it should be recorded;

[0083] If non-office activities are performed on non-working days, it is determined as non-office activities performed through the power system browser; at the same time, the execution frequency of step S3 and step S4 is increased;

[0084] At the same time, if no non-office behavior is detected through the power system browser for a certain period of time, the execution frequency of step S3 and step S4 is reduced synchronously;

[0085] S5. Take corresponding measures for the monitoring results obtained in step S4 to achieve the disposal of non-office behavior; specifically, the following steps are included:

[0086] When a non-office activity is first recorded via the power system browser, the duration of the non-office activity is recorded:

[0087] If the duration exceeds the first set value, a light blocking of non-office activities is performed;

[0088] If the duration exceeds the second set value, a re-blocking of non-office behavior is performed and the non-office behavior is reported at the same time; the second set value is greater than the first set value;

[0089] The light blocking is performed by modifying C:\Windows\System32\drivers\etc\hosts; mapping the domain name accessed during non-office hours with the office system IP of the power system, and all access to the non-office system domain name is temporarily directed to the office system of the power system;

[0090] The re-blocking is to immediately close the browser, then reopen the browser and automatically access the office system of the power system, and report the analyzed data information to the server of the power system; the analyzed data information includes the user name with historical login to the office system, computer IP, computer name, MAC address, computer user name, access URL information, access time, access duration and user name information that has logged into the office system.

[0091] like Figure 2 The functional module schematic diagram of the system of the present invention is shown as follows: the system disclosed in the present invention for realizing the non-office behavior monitoring method for the power system browser includes a monitoring start-up module, a data acquisition module, a data extraction module, a behavior monitoring module and a behavior disposal module; the monitoring start-up module, the data acquisition module, the data extraction module, the behavior monitoring module and the behavior disposal module are connected in series in sequence; the monitoring start-up module is used to start the non-office behavior monitoring when the computer of the power system is turned on, and upload the data information to the data acquisition module; the data acquisition module is used to obtain the office website and office hours of the power system according to the received data information, and upload the data information to the data extraction module; the data extraction module is used to analyze the browser files of the computer of the power system in real time according to the received data information to extract access information, and upload the data information to the behavior monitoring module; the behavior monitoring module is used to compare and analyze the access information obtained and the data information obtained according to the received data information, realize the non-office behavior monitoring for the power system browser, and upload the data information to the behavior disposal module; the behavior disposal module is used to take corresponding measures according to the received data information and the obtained monitoring results to realize the disposal of non-office behavior.

Claims

1. A method for monitoring non-office behavior of power system browsers, comprising the following steps: S1. When the computers in the power system are turned on, start non-office behavior monitoring; S2. Obtain the office website and office hours of the power system; S3. Analyze the browser files of the computers in the power system in real time to extract access information; S4. Compare and analyze the access information obtained in step S3 and the data information obtained in step S2 to monitor the non-office behavior of the power system browser.

2. The non-office behavior monitoring method for power system browsers according to claim 1 is characterized in that The step S2 of obtaining the office website and office hours of the power system specifically includes the following steps: Use C++ to write the power system office website library and power system office time library in json format; The office hours mentioned above include the time for rest during statutory holidays on working days, and the time for work during rest days; The time includes year, month, day, hour, minute and second; wherein the hour, minute and second are divided into the hour, minute and second of winter time and the hour, minute and second of summer time.

3. The non-office behavior monitoring method for power system browsers according to claim 2 is characterized in that The real-time analysis of the browser files of the computers in the power system to extract access information described in step S3 includes the following steps: Query and analyze browser files of computers in the power system at set times; Obtain office hours based on query and analysis results; According to the query and analysis results, the browser URL is obtained.

4. The non-office behavior monitoring method for power system browsers according to claim 3 is characterized in that The step S3 specifically includes the following steps: Query and analyze browser files of computers in the power system at set times; Obtain office hours based on query and analysis results; According to the query and analysis results, obtain the browser URL: If the browser is Google Chrome, the browser's files are located in C:\Users\[Current User Name]\AppData\Local\Google\Chrome\User Data\Default; If the browser is Microsoft Edge, the browser's files are located in C:\Users\[current user name]\AppData\Local\Microsoft\Edge\User Data\Default; If the browser is Tencent QQ Browser, the browser file is under C:\Users\[Current User Name]\AppData\Local\Tencent\QQBrowser\User Data\Default; Access the browser's data folders; the data folders include the History folder, the Login Data folder, and the Web Data folder; Parse the obtained browser data file: Use C++ SQLite API to execute the query statement of SQLite database, query the urls and visits tables of History folder, query the logins table of Login Data folder and query the autofill table of Web Data folder to obtain the last visited URLs of the day and the corresponding last_visit_time and visit_duration fields; at this time, the query results include the URL of the most recent day, the last visit time of the URL and the duration of the visit to the URL; Through the database query statement, the origin_url and the corresponding action_url, username_value and username_value fields are queried; at this time, the query results include the access URL, the form URL and the user name; Through the database query statement, query the autofill table with the value containing "name" in the name field; at this time, the query result includes the user's username.

5. The non-office behavior monitoring method for power system browsers according to claim 4 is characterized in that Step S4 compares and analyzes the access information obtained in step S3 and the data information obtained in step S2 to implement non-office behavior monitoring of power system browsers, including the following steps: Compare the last visited URLs and corresponding last_visit_time and visit_duration fields of the day obtained with the data in the power system office URL database obtained in step S2 to determine whether the behavior of visiting the website is non-office behavior: If the website visited is a website in the power system office website library, then the act of visiting the website is an office act; If the website visited is not in the power system office website library, the behavior of visiting the website is considered non-office behavior; Compare the URL of the website, the last access time of the website and the duration of access to the website obtained on the most recent day with the data in the power system office time database obtained in step S2 to determine whether the current time is a working day or a statutory holiday; Finally, the judgment is made: If non-office activities are performed on working days, it is determined as non-office activities performed through the power system browser; at the same time, the execution frequency of step S3 and step S4 is increased; If the office behavior is performed by a non-working person, or on a working day, it should be recorded; If non-office activities are performed on non-working days, it is determined as non-office activities performed through the power system browser; and at the same time, the execution frequency of step S3 and step S4 is increased.

6. The non-office behavior monitoring method for power system browsers according to claim 5 is characterized in that The non-office behavior monitoring method for power system browsers also includes the following steps: S5. Based on the monitoring results obtained in step S4, take corresponding measures to deal with non-office behaviors.

7. The non-office behavior monitoring method for power system browsers according to claim 6 is characterized in that Step S5, in response to the monitoring result obtained in step S4, takes corresponding measures to achieve the disposal of non-office behavior, which specifically includes the following steps: When a non-office activity is first recorded via the power system browser, the duration of the non-office activity is recorded: If the duration exceeds the first set value, a light blocking of non-office activities is performed; If the duration exceeds the second set value, a re-blocking of non-office behavior is performed and the non-office behavior is reported at the same time; the second set value is greater than the first set value; The light blocking is performed by modifying C:\Windows\System32\drivers\etc\hosts; mapping the domain name accessed during non-office hours with the office system IP of the power system, and all access to the non-office system domain name is temporarily directed to the office system of the power system; The re-blocking is to immediately close the browser, then reopen the browser and automatically access the office system of the power system, and report the analyzed data information to the server of the power system; the analyzed data information includes the user name with historical login to the office system, computer IP, computer name, MAC address, computer user name, access URL information, access time, access duration and user name information that has logged into the office system.

8. A system for implementing the non-office behavior monitoring method for power system browsers according to any one of claims 1 to 7, characterized in that It includes a monitoring start module, a data acquisition module, a data extraction module, a behavior monitoring module and a behavior disposal module; the monitoring start module, the data acquisition module, the data extraction module, the behavior monitoring module and the behavior disposal module are connected in series in sequence; the monitoring start module is used to start non-office behavior monitoring when the computer of the power system is turned on, and upload the data information to the data acquisition module; the data acquisition module is used to obtain the office website and office hours of the power system according to the received data information, and upload the data information to the data extraction module; The data extraction module is used to analyze the browser files of the computers of the power system in real time according to the received data information, so as to extract the access information and upload the data information to the behavior monitoring module; The behavior monitoring module is used to compare and analyze the access information obtained and the data information obtained according to the received data information, realize the non-office behavior monitoring of the power system browser, and upload the data information to the behavior disposal module; The behavior handling module is used to take corresponding measures according to the received data information and the obtained monitoring results to achieve the handling of non-office behaviors.

Images