Safety patch system, and method and device for monitoring protected system

Abstract

The invention relates to a security patch system and a method and device for monitoring a protected system, and effectively solves the problems that the state outside a honeypot system cannot be monitored, the possibility of being identified and bypassed exists, and the network behavior simulation complexity of the honeypot system is increased, so that the network behavior simulation complexity is reduced. The system comprises a security patch, a flow monitor, an interaction monitor, a time monitor and a patch controller.

Description

Technical Field

[0001] The present disclosure relates to the technical field of network security management, and in particular to a security patch system, and a monitoring method and device for a protected system. Background Art

[0002] Network security is an important guarantee for information construction. Network security technical means and equipment include firewalls, antivirus and IDS (intrusion detection system), honeypot system, VPN, security audit, etc. However, in related technologies, honeypot system has certain limitations. It cannot monitor the status outside the honeypot system, and there is a possibility of being identified and bypassed. At the same time, due to the increase in the complexity of the honeypot system's simulation of network behavior, the possibility of the honeypot system being attacked will also increase. Summary of the invention

[0003] In order to solve the above technical problems, the present invention provides a security patch system, and a monitoring method and device for a protected system, which effectively solves the technical problems that the status outside the honeypot system cannot be monitored and there is a possibility of being identified and bypassed. At the same time, due to the increased complexity of the honeypot system's simulation of network behavior, the possibility of the honeypot system being attacked will also increase.

[0004] In a first aspect, an embodiment of the present disclosure provides a safety patch system, including a safety patch, a flow monitor, an interaction monitor, a time monitor, and a patch controller, wherein:

[0005] The security patch is used to be installed on the protected system and obtain the flow data and system resource data of the protected system;

[0006] The time monitor is used to monitor the operating time of the safety patch;

[0007] The flow monitor is used to monitor the flow status of the protected system based on the flow data;

[0008] The interaction monitor is used to monitor the interaction status of the protected system based on the system resource data;

[0009] The patch controller is used to install the safety patch on the protected system and determine the operating status of the safety patch.

[0010] In a second aspect, an embodiment of the present disclosure provides a monitoring method for a protected system, the method comprising:

[0011] Obtain traffic data and system resource data of the protected system;

[0012] Determine the operating status of the security patch based on the traffic data and system resource data;

[0013] When the operating status is determined to be abnormal, an alarm message is issued.

[0014] In a possible implementation, in the method provided by the embodiment of the present invention, determining the operating status of the security patch based on the traffic data and the system resource data includes:

[0015] Monitor the flow status of the protected system based on flow data;

[0016] Monitor the interaction status of protected systems based on system resource data;

[0017] The flow state and the interaction state are determined as the operation state of the security patch.

[0018] In a possible implementation, in the method provided by the embodiment of the present invention, the method further includes:

[0019] When the flow data and system resource data are not received within a preset period of time, the operating status is determined to be abnormal and an alarm message is issued.

[0020] In a third aspect, an embodiment of the present disclosure provides a monitoring device for a protected system, the device comprising:

[0021] An acquisition unit, used for acquiring flow data and system resource data of a protected system;

[0022] A determination unit, configured to determine an operating state of the security patch based on the traffic data and the system resource data;

[0023] The alarm unit is used to issue an alarm message when it is determined that the operating status is abnormal.

[0024] In a possible implementation manner, in the device provided by the embodiment of the present invention, the determining unit is specifically configured to:

[0025] Monitor the flow status of the protected system based on flow data;

[0026] Monitor the interaction status of protected systems based on system resource data;

[0027] The flow state and the interaction state are determined as the operation state of the security patch.

[0028] In a possible implementation manner, in the device provided by the embodiment of the present invention, the alarm unit is further used for:

[0029] When the flow data and system resource data are not received within a preset period of time, the operating status is determined to be abnormal and an alarm message is issued.

[0030] In a fourth aspect, an embodiment of the present disclosure provides an electronic device, including:

[0031] Memory;

[0032] Processor; and

[0033] Computer programs;

[0034] The computer program is stored in the memory and is configured to be executed by the processor to implement the monitoring method of the protected system as described above.

[0035] In a fifth aspect, an embodiment of the present disclosure provides a computer-readable storage medium having a computer program stored thereon, which implements the steps of the monitoring method for a protected system as described above when the computer program is executed by a processor.

[0036] In a sixth aspect, an embodiment of the present disclosure further provides a computer program product, including a computer program, which, when executed by a processor, implements any of the above-mentioned monitoring methods for a protected system.

[0037] The embodiment of the present disclosure provides a security patch system, including a security patch, a flow monitor, an interaction monitor, a time monitor and a patch controller. By applying the security patch system provided by the present disclosure, through lightweight deployment, and while occupying only a small amount of resources, through corresponding control and interaction steps, a variety of network security detection and defense capabilities are realized, more accurate detection and services are achieved, and platform-based and multi-dimensional security protection is provided. BRIEF DESCRIPTION OF THE DRAWINGS

[0038] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present disclosure and, together with the description, serve to explain the principles of the present disclosure.

[0039] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, for ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative labor.

[0040] Figure 1 A schematic diagram of the structure of a safety patch system provided in an embodiment of the present disclosure;

[0041] Figure 2 A flowchart of a monitoring method for a protected system provided by an embodiment of the present disclosure;

[0042] Figure 3 An interactive schematic diagram of a monitoring method for a protected system provided by an embodiment of the present disclosure;

[0043] Figure 4 A schematic diagram of the structure of a monitoring device for a protected system provided in an embodiment of the present disclosure;

[0044] Figure 5A schematic diagram of the structure of an electronic device provided in an embodiment of the present disclosure. DETAILED DESCRIPTION

[0045] In order to more clearly understand the above-mentioned objectives, features and advantages of the present disclosure, the scheme of the present disclosure will be further described below. It should be noted that the embodiments of the present disclosure and the features in the embodiments can be combined with each other without conflict.

[0046] In the following description, many specific details are set forth to facilitate a full understanding of the present disclosure, but the present disclosure may also be implemented in other ways different from those described herein; it is obvious that the embodiments in the specification are only part of the embodiments of the present disclosure, rather than all of the embodiments.

[0047] 1. In the embodiments of the present invention, the term "and / or" describes the association relationship of associated objects, indicating that three relationships may exist. For example, A and / or B may represent: A exists alone, A and B exist at the same time, and B exists alone. The character " / " generally indicates that the associated objects are in an "or" relationship.

[0048] Network security is an important guarantee for information construction. Network security technical means and equipment include firewalls, antivirus and IDS (intrusion detection system), honeypot system, VPN, security audit, etc. As network technology and services are constantly developing, the number and types of software and hardware security vulnerabilities of networks and hosts are also constantly changing, so it is necessary to continuously improve and upgrade network security protection technologies and methods. The network security honeypot system is a commonly used security protection method. It is based on risk vulnerability camouflage technology. By deploying detectable vulnerabilities on the key path of attackers' invasion, it makes it easy for attackers to regard the vulnerabilities as targets and launch attacks. Then, the attack behaviors can be monitored in a timely and effective manner, and the security and stability of the network and system can be improved. Taking the commonly used network security honeypot system as an example, by deploying information interaction strategies with different degrees of interaction in the honeypot system, it is possible to attract and prevent various network attack behaviors.

[0049] Honeypot systems have certain limitations. (1) Existing technical solutions mainly focus on the deployment of honeypot systems in various scenarios, as well as the optimization of honeypot functions and the enhancement of protection functions. Although honeypot network security technology will help to discover network threats, honeypots will not see everything that is happening, but only activities targeting the honeypot. (2) Although the goal of a honeypot is to deceive attackers into believing that they have gained access to the real system. However, if an attacker successfully identifies it as a disguised honeypot, the attacker will continue to attack other systems without engaging with the honeypot. (3) Once a honeypot is identified by an attacker, the attacker can conduct deceptive attacks to divert attention and actually attack the production system. They will also provide false information to the honeypot. (4) Attackers may use honeypots as a way to enter the system. Honeypots may be used as a stepping stone for further intrusion. As the complexity of the honeypot system's simulation of network behavior increases, the possibility of the honeypot system being attacked will also increase.

[0050] Figure 1 A schematic diagram of the structure of a safety patch system provided by an embodiment of the present disclosure is shown in FIG. Figure 1As shown in the figure, in actual use, it includes the protected system and the applications on the system, network security patch, traffic monitor, interaction monitor, time monitor and patch controller. The network security patch is a software and hardware integrated functional module that is lightweight, runs in isolation, is dynamically generated, and is managed by the patch controller. It includes honeypot bait, risk identification, security protection, security monitoring, content security, security vulnerability scanning, security penetration, threat intelligence, situational awareness, capability orchestration, physical security and other functions. The honeypot bait function of the network security patch can be combined with the protected system for simulation customization. Common simulation system types include various common network services and applications related to the protected system, such as mailbox systems, office systems and other network security assets with high attack value. When it is necessary to customize the honeypot simulation function for the target protection system, the network security patch can be deployed on the corresponding system that needs to be protected, and the security patch with network monitoring capability can monitor the traffic of the target system, analyze its interaction protocol and traffic characteristics, and learn its characteristic behavior. (2) The patch controller, as the master control system, has universal simulation software and simulation logic for various network services. It can customize and generate corresponding bait functions according to protection needs and hand them over to the network security patch for execution. The protected system first obtains the network and system resources used by each application in the system, and then submits the data of the applications in the registration system and the network and system resources they use to the network security patch controller. The network security patch controller needs to confirm the validity of the relevant data with the protected system. The network security patch controller produces dynamic network security patches based on these data and scenarios, and installs the network security patches in the protected system. After the network security patch is installed, the traffic monitor detects the network security patch traffic and reports to the network security patch controller; the interaction monitor monitors the network security patch interaction behavior and reports to the network security patch controller; the time monitor monitors the network security patch operation time and reports to the network security patch controller; the network security patch controller notifies the network security patch to execute the corresponding strategy according to the operation status.

[0051] Figure 2 A flow chart of a monitoring method for a protected system provided in an embodiment of the present disclosure, specifically including the following steps: Figure 2 The following steps S201 to S203 are shown:

[0052] S201. Obtain flow data and system resource data of the protected system.

[0053] During the specific implementation, the security patch must first be installed in the protected system. During the installation, the network and system resources used by the application must first be obtained. The protected system should provide the network and system resources used by this system, including the name of each application in the system, the occupied IP address, protocol, port, network interface, file directory, protection requirements and other information.

[0054] The following are examples of network and system resources.

[0055]

[0056]

[0057] The protected system submits application data to the network security patch controller to apply for the installation of the network security patch in the system. The following is an example of applying for the installation of the network security patch for two applications (webserver and dbserver).

[0058]

[0059] At this time, the patch controller can confirm the application data list with the protected system, and then the patch controller will make and install a dynamic network security patch for the protected system. The steps involved include analyzing the application situation, formulating protection strategies, making network security patches, and deploying network security patches. The steps for installing a dynamic network security patch (hereinafter referred to as: patch startup method A) are:

[0060] (1) Copy or download the basic module of the Dynamic Network Security Patch (hereinafter referred to as DCSPROC) to the corresponding directory of the protected system.

[0061] (2) The protected system limits the resources that the dynamic network security patch dcsproc can occupy, including CPU (abbreviated as C), memory (abbreviated as M), hard disk resources (abbreviated as H), directory (abbreviated as D), and network bandwidth (abbreviated as B), so as to prevent it from being used as a springboard after being attacked by third-party applications; since the availability of resources is constantly changing, these resource restrictions need to be continuously updated to the patch.

[0062] (3) Modify the corresponding configuration of the protected system to hide dcsproc. For example, modify common process viewing list tools such as ps, pslist, and task manager so that they do not display any information about dcsproc, thereby hiding the dcsproc process.

[0063] (4) The protected system starts dcsproc through the system management authority, giving it the authority to monitor network traffic.

[0064] (5) dcsproc with system management privileges monitors the traffic of each network card of the protected system and sends data directly at the network card level without calling other library functions in the protected system, thereby reducing the possibility of being discovered and intercepted by third-party processes.

[0065] (6) After completing the above steps, the dcsproc process will reside in the protected system as a dynamic network security patch, and has extremely high concealment, isolation and security.

[0066] S202: Determine the operating status of the security patch based on the traffic data and the system resource data.

[0067] During specific implementation, after the network security patch completes its residency in the protected system, it dynamically realizes a variety of honeypot bait forms and capabilities, and provides corresponding simulation responses and trapping according to the simulated business type; it performs risk identification, security protection, security monitoring, content security, security vulnerability scanning, security penetration, threat intelligence, situational awareness, capability orchestration, physical security and other functions as required.

[0068] The traffic monitor monitors the traffic of the network security patch. The method adopted is that the network security patch monitors the network card data packets and sends the traffic data statistics to the traffic monitor through the network card. For various network protocols and service primitives, the {request, response} feature pairs of their interaction process are monitored by the patch and directly fed back to the patch controller through the network card, so as to learn the behavior of the target system without affecting the business. The learning result is a series of interactive {request, response} feature pairs, which will be reported to the patch controller as the interactive logical characteristics of the target protected system. The representation of the request (req) set by this proposal is: {IP version, protocol, source port, destination port, request data packet}; the representation of the response (res) set by this proposal is: {IP version, protocol, source port, destination port, response data packet}.

[0069] The traffic monitor reports the network security patch traffic to the network security patch controller as follows: After receiving the traffic information reported by the patch, the patch controller first learns and adjusts the {response} information therein. The patch controller can judge the threat level of various {requests, responses} for this series of {requests, responses}, such as {request 1, response 1}, {request 2, response 2}, {request 3, response 3},..., according to the characteristics of the protected system. This can be based on the sensitive keywords or action features contained in the request or response information, or it can be judged based on the commonly used intrusion detection mechanism. The patch controller assigns a value according to the threat level of {request, response}. The higher the threat, the higher the value assigned, and the threat value ranges from 0 to 100, thereby obtaining the trapping simulation logic triple (Decoy3): {request, response, threat value}. The patch controller can also further formulate a trapping action based on {request, response}, thereby obtaining the trapping simulation logic quadruple (Decoy4): {request, response, threat value, trapping action}. The trapping action is defined as the action information sent to the attacker, which may include {bait information, delayed waiting, social account interception, fingerprint identification}, etc. This information can be sent to the attacker by the patch in the form of an IP data packet to obtain feedback and take further actions based on the feedback. It should be noted that the above-mentioned interactive learning, threat assignment and trapping strategy formulation process is also applicable to other general network services, thereby realizing a more comprehensive simulation trapping capability for the patch controller. The network security patch monitors network traffic, analyzes possible security attacks, and feeds back the behavior sequence, i.e., {request 1, request 2,...}, to the patch controller in real time. The patch controller combines its own trapping simulation logic and the newly learned logic to analyze the behavior sequence and find the business trapping simulation logic quad (Decoy4) that is most similar to the behavior, and then sends a series of trapping simulation logic quads (Decoy4) corresponding to the logic to the network security patch.

[0070] The network security patch responds to the attack based on the data set.

[0071] When the corresponding threat value of the request behavior reaches the preset threshold value, that is, the corresponding alarm threshold is triggered, the patch sends an alarm to the patch controller and starts the trapping function locally. In the above steps, the request information req0 provided by the patch includes {IP version, protocol, source port, destination port, request data packet}, and the patch controller stores a large number of request feature libraries based on its own storage records. According to the request information provided by the patch, the following method is used to find and identify the attack that is most similar to the request.

[0072] (a) For all requests reqx stored by the patch controller, calculate the similarity distance with req0 respectively:

[0073] Dx=|IP version difference|+|protocol difference|+|destination port difference|+|request packet difference|+|source port difference|*alpha

[0074] (b) The difference value is the edit distance of the string, and alpha is the matching degree of the source port, with a default value of 0. If the Dx values ​​of two reqx are the same, it is necessary to further determine whether the data is sent from the same source port. In this case, the alpha value can be set to 1 to calculate the Dx value again.

[0075] (c) The Dx corresponding request with the smallest distance is judged as the target of the current attack, and the corresponding simulation logic quadruple series can be returned to the patch.

[0076] The interactive monitor monitors the interactive behavior of the network security patch as follows. The method adopted is to intercept and record the read and write operations of the corresponding file directory of the network security patch.

[0077] S203: When it is determined that the operating status is abnormal, an alarm message is issued.

[0078] During specific implementation, the interaction monitor reports the network security patch interaction behavior to the network security patch controller.

[0079] The time monitor monitors the running time of the network security patch by monitoring the process running status of the network security patch from the beginning of execution to the current moment, and regularly reporting the running status to the patch controller.

[0080] The following is a monitoring example of the network security patch (tiepian1).

[0081]

[0082]

[0083] The time monitor reports the network security patch operation time to the network security patch controller. After receiving the network security patch operation time report, the patch controller can determine the operation status of the corresponding patch. If no report is received for a long time, it is judged that the patch is operating abnormally and intervention should be notified; if the running time of the honeypot bait function exceeds a certain threshold, in order to avoid the honeypot bait function being identified by the attacker, the patch controller can dynamically and randomly generate a new trapping simulation logic (Decoy4) based on the application service information simulated by the patch, and send it to the patch for replacement execution; if other security functions are executed abnormally, the patch controller will repair the function according to the abnormal information.

[0084] The network security patch controller analyzes the running status of the network security patch and needs to execute corresponding strategies according to the running status. Since the resources available to the network security patch are limited, this proposal needs to limit the resources that the dynamic network security patch dcsproc can occupy in the aforementioned steps, including CPU (abbreviated as C), memory (abbreviated as M), hard disk resources (abbreviated as H), directory (abbreviated as D), etc. On the other hand, the patch needs to run multiple programs on the protected system according to the policy requirements, so it is necessary to plan the deployment and operation of these programs and formulate corresponding execution strategies.

[0085] Assume that the resources that the network security patch dcsproc can occupy are: including CPU (abbreviated as C), memory (abbreviated as M), hard disk resources (abbreviated as H), directory (abbreviated as D), network bandwidth (abbreviated as B)

[0086] Suppose the patch controller can run programs P = {p1, p2, ..., pi, ...} according to the patch protection requirements, where pi corresponds to security protection capabilities such as risk identification, security protection, security monitoring, content security, security vulnerability scanning, security penetration, threat intelligence, situational awareness, capability orchestration, and physical security.

[0087] (1) First, count the CPU, memory, hard disk, and directory occupied by the programs P = {p1, p2, ..., pi, ...} corresponding to various protection requirements, and record them as (ci, mi, hi, di, bi) respectively;

[0088] (2) When formulating policies, the network security patch controller needs to load and run programs on the patch according to security needs under given resource conditions;

[0089] (3) Based on these conditions, the following planning algorithm can be set to calculate the list of applications that the patch controller can plan to run. Due to limited resources, the scheduling frequency of each application also needs to be considered during scheduling. If an application has been scheduled, the CPU and memory values ​​of the application can be temporarily increased, thereby transferring the scheduling priority to other applications with fewer schedules, and generally ensuring that each application can be executed by the patch within a certain period. The above-increased CPU and memory values ​​need to be restored to their original values ​​in the next period.

[0090] As mentioned above, the network security patch controller notifies the network security patch to execute the corresponding strategy according to the operating status. The overall process is as follows: Figure 3 As shown, after various application functions are executed on the patch, the relevant execution results need to be fed back to the patch controller through the patch so that further protective measures can be taken.

[0091] It should be pointed out that since different patches have different available resources and different protection requirements, the patch controller needs to plan the application list for each patch. Even for the same patch, its protection requirements and resource conditions change dynamically at different time points, so the patch controller needs to continuously plan and update applications for the patch and publish them to the corresponding patch.

[0092] Figure 4 The structure diagram of the monitoring device of the protected system provided by the embodiment of the present disclosure is as follows. The monitoring device 400 of the protected system provided by the embodiment of the present disclosure can execute the processing flow provided by the above-mentioned monitoring method of the protected system, such as Figure 4 As shown, the monitoring device 400 of the protected system includes an acquisition unit 401, a determination unit 402 and an alarm unit 403, wherein:

[0093] The acquisition unit 401 is used to acquire the flow data and system resource data of the protected system;

[0094] A determination unit 402, configured to determine the operating state of the security patch based on the traffic data and the system resource data;

[0095] The alarm unit 403 is used to issue an alarm message when it is determined that the operating state is abnormal.

[0096] In a possible implementation manner, in the device provided by the embodiment of the present invention, the determining unit 402 is specifically configured to:

[0097] Monitor the flow status of the protected system based on flow data;

[0098] Monitor the interaction status of protected systems based on system resource data;

[0099] The flow state and the interaction state are determined as the operation state of the security patch.

[0100] In a possible implementation manner, in the device provided by the embodiment of the present invention, the alarm unit 403 is further used for:

[0101] When the flow data and system resource data are not received within a preset period of time, the operating status is determined to be abnormal and an alarm message is issued.

[0102] Figure 4 The monitoring device of the protected system in the illustrated embodiment can be used to execute the technical solution of the above-mentioned method embodiment, and its implementation principle and technical effect are similar, which will not be described in detail here.

[0103] In addition, combined Figure 1-Figure 4 The monitoring method and device of the protected system described in the embodiments of the present application can be implemented by an electronic device. Figure 5A schematic diagram of the hardware structure of an electronic device provided in an embodiment of the present application is shown.

[0104] like Figure 5 As shown, the electronic device 800 may include a processing device (e.g., a central processing unit, a graphics processing unit, etc.) 801, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 802 or a program loaded from a storage device 808 to a random access memory (RAM) 803 to implement the monitoring method of the protected system according to the embodiment of the present disclosure. In the RAM 803, various programs and data required for the operation of the electronic device 800 are also stored. The processing device 801, the ROM 802, and the RAM 803 are connected to each other via a bus 804. An input / output (I / O) interface 805 is also connected to the bus 804.

[0105] Typically, the following devices may be connected to the I / O interface 805: input devices 806 including, for example, a touch screen, a touch pad, a keyboard, a mouse, a camera, a microphone, an accelerometer, a gyroscope, etc.; output devices 807 including, for example, a liquid crystal display (LCD), a speaker, a vibrator, etc.; storage devices 808 including, for example, a magnetic tape, a hard disk, etc.; and communication devices 809. The communication device 809 may allow the electronic device 800 to communicate with other devices wirelessly or by wire to exchange data. Although Figure 5 The electronic device 800 is shown with various devices, but it should be understood that it is not required to implement or possess all the devices shown. More or fewer devices may be implemented or possessed instead.

[0106] In particular, according to an embodiment of the present disclosure, the process described above with reference to the flowchart can be implemented as a computer software program. For example, an embodiment of the present disclosure includes a computer program product, which includes a computer program carried on a non-transitory computer-readable medium, and the computer program includes a program code for executing the method shown in the flowchart, thereby implementing the voice control method as described above. In such an embodiment, the computer program can be downloaded and installed from the network through the communication device 809, or installed from the storage device 808, or installed from the ROM 802. When the computer program is executed by the processing device 801, the above-mentioned functions defined in the method of the embodiment of the present disclosure are executed.

[0107] It should be noted that the computer-readable medium disclosed above may be a computer-readable signal medium or a computer-readable storage medium or any combination of the above two. The computer-readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples of computer-readable storage media may include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In the present disclosure, a computer-readable storage medium may be any tangible medium containing or storing a program that may be used by or in combination with an instruction execution system, device or device. In the present disclosure, a computer-readable signal medium may include a data signal propagated in a baseband or as part of a carrier wave, in which a computer-readable program code is carried. This propagated data signal may take a variety of forms, including but not limited to an electromagnetic signal, an optical signal, or any suitable combination of the above. The computer readable signal medium may also be any computer readable medium other than a computer readable storage medium, which may send, propagate or transmit a program for use by or in conjunction with an instruction execution system, apparatus or device. The program code contained on the computer readable medium may be transmitted using any suitable medium, including but not limited to: wires, optical cables, RF (radio frequency), etc., or any suitable combination of the above.

[0108] In some embodiments, the client and the server may communicate using any currently known or future developed network protocol such as HTTP (HyperText Transfer Protocol), and may be interconnected with any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include a local area network ("LAN"), a wide area network ("WAN"), an internet (e.g., the Internet), and a peer-to-peer network (e.g., an ad hoc peer-to-peer network), as well as any currently known or future developed network.

[0109] The computer-readable medium may be included in the electronic device, or may exist independently without being incorporated into the electronic device.

[0110] The computer-readable medium carries one or more programs. When the one or more programs are executed by the electronic device, the electronic device:

[0111] Obtain traffic data and system resource data of the protected system;

[0112] Determine the operating status of the security patch based on the traffic data and system resource data;

[0113] When the operating status is determined to be abnormal, an alarm message is issued.

[0114] Optionally, when the above one or more programs are executed by the electronic device, the electronic device may also execute other steps described in the above embodiments.

[0115] Computer program code for performing the operations of the present disclosure may be written in one or more programming languages ​​or a combination thereof, including, but not limited to, object-oriented programming languages, such as Java, Smalltalk, C++, and conventional procedural programming languages, such as "C" or similar programming languages. The program code may be executed entirely on the user's computer, partially on the user's computer, as a separate software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving a remote computer, the remote computer may be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., through the Internet using an Internet service provider).

[0116] The flow chart and block diagram in the accompanying drawings illustrate the possible architecture, function and operation of the system, method and computer program product according to various embodiments of the present disclosure. In this regard, each square box in the flow chart or block diagram can represent a module, a program segment or a part of a code, and the module, the program segment or a part of the code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some implementations as replacements, the functions marked in the square box can also occur in a sequence different from that marked in the accompanying drawings. For example, two square boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each square box in the block diagram and / or flow chart, and the combination of the square boxes in the block diagram and / or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0117] The units involved in the embodiments described in the present disclosure may be implemented by software or hardware, wherein the name of a unit does not, in some cases, limit the unit itself.

[0118] The functions described above herein may be performed at least in part by one or more hardware logic components. For example, without limitation, exemplary types of hardware logic components that may be used include: field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), complex programmable logic devices (CPLDs), and the like.

[0119] In the context of the present disclosure, a machine-readable medium may be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, device, or equipment. A machine-readable medium may be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium may include, but is not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, device, or equipment, or any suitable combination of the foregoing. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0120] The embodiment of the present disclosure provides a security patch system, including a security patch, a flow monitor, an interaction monitor, a time monitor and a patch controller. By applying the security patch system provided by the present disclosure, through lightweight deployment, and while occupying only a small amount of resources, through corresponding control and interaction steps, a variety of network security detection and defense capabilities are realized, more accurate detection and services are achieved, and platform-based and multi-dimensional security protection is provided.

[0121] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented in one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that include computer-usable program code.

[0122] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0123] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0124] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0125] Although the preferred embodiments of the present application have been described, those skilled in the art may make additional changes and modifications to these embodiments once they have learned the basic creative concept. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications falling within the scope of the present application.

[0126] Obviously, those skilled in the art can make various changes and modifications to the present invention without departing from the spirit and scope of the present invention. Thus, if these modifications and variations of the present invention fall within the scope of the claims of the present invention and their equivalents, the present invention is also intended to include these modifications and variations.

Claims

1. A safety patch system, characterized in that: The system includes a safety patch, a flow monitor, an interaction monitor, a time monitor and a patch controller, wherein: The security patch is used to be installed on the protected system and obtain the flow data and system resource data of the protected system; The time monitor is used to monitor the operation time of the safety patch; The flow monitor is used to monitor the flow status of the protected system based on the flow data; The interaction monitor is used to monitor the interaction status of the protected system based on the system resource data; The patch controller is used to install the safety patch on the protected system and determine the operating status of the safety patch.

2. A method for monitoring a protected system, characterized in that: The method comprises: Obtaining flow data and system resource data of the protected system; determining an operating state of the security patch based on the traffic data and the system resource data; When it is determined that the operating state is abnormal, an alarm message is issued.

3. The method according to claim 2, characterized in that The determining the operating state of the security patch based on the traffic data and the system resource data includes: monitoring a flow status of the protected system based on the flow data; monitoring the interaction status of the protected system based on the system resource data; The flow state and the interaction state are determined as the operation state of the safety patch.

4. The method according to claim 3, characterized in that: The method further comprises: When the flow data and the system resource data are not received within a preset time period, it is determined that the operating state is abnormal and an alarm message is issued.

5. A monitoring device for a protected system, characterized in that: The device comprises: An acquisition unit, used for acquiring flow data and system resource data of the protected system; a determining unit, configured to determine an operating state of the security patch based on the traffic data and the system resource data; The alarm unit is used to issue an alarm message when it is determined that the operating state is abnormal.

6. The device according to claim 5, characterized in that The determining unit is specifically used for: monitoring a flow status of the protected system based on the flow data; monitoring the interaction status of the protected system based on the system resource data; The flow state and the interaction state are determined as the operation state of the safety patch.

7. The device according to claim 6, characterized in that The alarm unit is also used for: When the flow data and the system resource data are not received within a preset time period, it is determined that the operating state is abnormal and an alarm message is issued.

8. An electronic device, characterized in that: include: Memory; processor; as well as Computer programs; The computer program is stored in the memory and is configured to be executed by the processor to implement the monitoring method for a protected system as claimed in any one of claims 2 to 4.

9. A computer-readable storage medium having computer program instructions stored thereon, characterized in that: When the computer program instructions are executed by a processor, a monitoring method for a protected system according to any one of claims 2 to 4 is implemented.

10. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the method for monitoring a protected system as claimed in any one of claims 2 to 4 is implemented.

Images