Review decision-making system and method based on high-risk system operation

Abstract

The invention is suitable for the technical field of information, and provides a review decision-making system and method based on high-risk system operation. In the embodiment, after a system receives a target file needing to be used for execution, sensitive information in the target file is firstly extracted; and determining whether the sensitive information has risk data which can cause danger to the system or not through a preset risk auditing method. If yes, corresponding early warning information is generated and sent to the related personnel through a plurality of preset notification interfaces, and whether the target file is executed or not is determined according to recheck decisions of the related personnel. The problem that a database and an application system face risks due to the fact that low-level engineers submit high-risk operation codes by mistake is solved. The safety and reliability of high-risk system operation are improved, and powerful technical support is provided for related industries.

Description

Technical Field

[0001] The present application relates to the field of information technology, and in particular to a review decision system and method based on high-risk system operations. Background Art

[0002] With the rapid development of information technology, the complexity and risk of system operations are increasing, and any wrong decision or operation may lead to serious consequences. In the current field of information technology operation and maintenance, especially in daily IT operation and maintenance management, we are frequently faced with the challenges of high-risk operations, such as unauthorized database deletion (commonly known as "deleting the database and running away") and improper redeployment of application servers. These operations may not only lead to permanent loss of critical data, but also seriously threaten business continuity and information security, thereby affecting the stable operation and healthy development of the enterprise. Existing IT operation and maintenance management systems and security control measures often focus on conventional permission management and access control, but are insufficient in real-time monitoring of high-risk operations, timely warnings, and prevention of potential catastrophic events. In addition, there is a lack of effective technical means for the traceability of operations and the identification of responsibilities, making subsequent audits and accountability difficult.

[0003] Therefore, ensuring the accuracy of decision-making and the safety of operations is an important challenge facing these industries. In this context, enterprises are in urgent need of a more intelligent, strict and efficient IT operation and maintenance security management solution to automatically identify and prevent dangerous operations while ensuring the smooth progress of legal operation and maintenance activities, thereby comprehensively improving the company's information security protection level and operation and maintenance efficiency. Summary of the invention

[0004] In view of this, the present application provides a review decision system and method based on high-risk system operations to improve the safety and reliability of high-risk system operations and reduce human errors.

[0005] In a first aspect, the present application provides a review decision system based on high-risk system operations, the system comprising a rule engine module, a file reading module and a trigger warning module;

[0006] The file reading module is used to determine the sensitive information in the target file by a preset information extraction method when receiving the target file to be executed, and send the sensitive information and the corresponding target file information to the rule engine module, wherein the information extraction method includes a regular expression matching method, a keyword matching method, and a file type detection method, and the sensitive information includes SQL statements, operating system scripts, and executable codes;

[0007] The rule engine module is used to determine whether there is risk data in the sensitive information according to a preset risk review method, and if so, send the risk data and corresponding target file information to the trigger warning module;

[0008] The trigger warning module pre-configures several notification interfaces and sets different priorities for each notification interface;

[0009] After receiving the risk data and the corresponding target file information sent by the rule engine module, generating warning information according to the risk data and the corresponding target file information;

[0010] The priority of the notification interface is determined by the risk data, and after the target notification interface is determined according to the priority, the warning information is sent through the target notification interface, and after receiving the review decision of the warning information, it is determined whether to execute the target file according to the review decision.

[0011] Optionally, after sending the warning information through the target notification interface, the trigger warning module is further used to:

[0012] Detecting in real time whether a review decision for the warning information is received within a preset time period, and if not received, sending the warning information to a second target notification interface having a lower priority than the target notification interface;

[0013] The step of detecting again whether a review decision for the warning information is received within a preset time period is performed. If not received, the warning information is sent to a third target notification interface with a lower priority than the second target notification interface until a review decision for the warning information is received.

[0014] Optionally, after sending the warning information through the target notification interface, the trigger warning module is further used to:

[0015] Regularly detect whether a review decision for the warning information is received and record the number of detections, and repeat the step of performing regular detection if no review decision is received, until the number of detections reaches a threshold, and send the warning information to a second target notification interface with a lower priority than the target notification interface;

[0016] Perform the scheduled detection again to see whether a review decision for the warning information is received and record the number of detections, and repeat the steps of performing the scheduled detection if no review decision is received. When the number of detections reaches a threshold, send the warning information to a third target notification interface whose priority is lower than that of the second target notification interface, and stop sending the warning information until a review decision for the warning information is received.

[0017] Optionally, determining whether risk data exists in the sensitive information according to a preset risk review method includes:

[0018] Input the sensitive information into a simulation environment for execution, and determine whether the sensitive information contains risk data based on the execution result; or,

[0019] The sensitive information is input into a pre-trained machine model, and the machine model is used to determine whether the sensitive information contains risk data, and the machine model is updated and optimized based on the sensitive information.

[0020] Optionally, the system further includes a log recording module and an audit tracking module;

[0021] The logging module is used to record the execution status of the sensitive information and the operation log of the system;

[0022] The audit tracking module is used to track and audit all rule changes and warning events.

[0023] A second aspect of the present application provides a review decision method based on high-risk system operation, the method comprising:

[0024] When receiving a target file to be executed, determining sensitive information in the target file through a preset information extraction method, wherein the information extraction method includes a regular expression matching method, a keyword matching method, and a file type detection method, and the sensitive information includes SQL statements, operating system scripts, and executable codes;

[0025] Determine whether there is risk data in the sensitive information, and if so, generate warning information based on the risk data and corresponding target file information;

[0026] The priorities of several pre-configured notification interfaces are determined by the risk data, and after the target notification interface is determined according to the priority, the warning information is sent through the target notification interface, and after receiving the review decision of the warning information, it is determined whether to execute the target file according to the review decision.

[0027] Optionally, after sending the warning information through the target notification interface, the method further includes:

[0028] Detecting in real time whether a review decision for the warning information is received within a preset time period, and if not received, sending the warning information to a second target notification interface having a lower priority than the target notification interface;

[0029] The step of detecting again whether a review decision for the warning information is received within a preset time period is performed. If not received, the warning information is sent to a third target notification interface with a lower priority than the second target notification interface until a review decision for the warning information is received.

[0030] Optionally, after sending the warning information through the target notification interface, the method further includes:

[0031] Regularly detect whether a review decision for the warning information is received and record the number of detections, and repeat the step of performing regular detection if no review decision is received, until the number of detections reaches a threshold, and send the warning information to a second target notification interface with a lower priority than the target notification interface;

[0032] Perform the scheduled detection again to see whether a review decision for the warning information is received and record the number of detections, and repeat the steps of performing the scheduled detection if no review decision is received. When the number of detections reaches a threshold, send the warning information to a third target notification interface whose priority is lower than that of the second target notification interface, and stop sending the warning information until a review decision for the warning information is received.

[0033] Optionally, determining whether risk data exists in the sensitive information according to a preset risk review method includes:

[0034] Input the sensitive information into a simulation environment for execution, and determine whether the sensitive information contains risk data based on the execution result; or,

[0035] The sensitive information is input into a pre-trained machine model, and the machine model is used to determine whether the sensitive information contains risk data, and the machine model is updated and optimized based on the sensitive information.

[0036] Optionally, the method further includes:

[0037] Record the execution status and operation logs of the sensitive information;

[0038] Track and audit all rule changes and alert events.

[0039] In the embodiment provided by the present application, after the system receives the target file to be executed, the sensitive information in the target file is first extracted. Then, a preset risk review method is used to determine whether the sensitive information contains risk data that may cause danger to the system. When determined, the corresponding early warning information is generated and sent to relevant personnel through multiple preset notification interfaces, and whether to execute the target file is determined based on the review decision of the relevant personnel. This solves the problem that low-level engineers mistakenly submit high-risk operation codes, causing databases and application systems to face risks. The security and reliability of high-risk system operations are improved, providing strong technical support for related industries. BRIEF DESCRIPTION OF THE DRAWINGS

[0040] Figure 1 A system module diagram provided for an embodiment of the present application;

[0041] Figure 2 A flow chart of the method provided in the embodiment of the present application;

[0042] Figure 3 A schematic diagram of the internal structure of a computer device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0043] Exemplary embodiments will be described in detail herein, examples of which are shown in the accompanying drawings. When the following description refers to the drawings, the same numbers in different drawings represent the same or similar elements unless otherwise indicated. The implementations described in the following exemplary embodiments do not represent all implementations consistent with the present application. Instead, they are merely examples of devices and methods consistent with some aspects of the present application as detailed in the appended claims.

[0044] The terms used in this application are for the purpose of describing specific embodiments only and are not intended to limit this application. The singular forms of "a", "said" and "the" used in this application and the appended claims are also intended to include plural forms unless the context clearly indicates other meanings. It should also be understood that the term "and / or" used herein refers to and includes any or all possible combinations of one or more associated listed items.

[0045] It should be understood that although the terms first, second, third, etc. may be used in the present application to describe various information, these information should not be limited to these terms. These terms are only used to distinguish the same type of information from each other. For example, without departing from the scope of the present application, the first information may also be referred to as the second information, and similarly, the second information may also be referred to as the first information. Depending on the context, the word "if" as used herein may be interpreted as "at the time of" or "when" or "in response to determining".

[0046] The present application provides a review decision system and method based on high-risk system operations to improve the safety and reliability of high-risk system operations and reduce human errors.

[0047] like Figure 1 As shown, it is a module diagram of a review decision system based on high-risk system operation provided by the present application, and the system includes: a file reading module, a rule engine module and a trigger warning module.

[0048] The functions of each module are described below:

[0049] 1. File reading module. This module is used to determine the sensitive information in the target file through a preset information extraction method when receiving the target file to be executed, and send the sensitive information and the corresponding target file information to the rule engine module.

[0050] In this module, SQL statements, operating system scripts, and some other executable codes in the target file can be extracted through regular expression matching, keyword matching, file type detection, and other methods.

[0051] Exemplarily, the file type detection method can determine the type of content that a file may contain based on the file extension or MIME type. For example, a .sql file may contain SQL statements. A .sh file usually contains shell scripts. Files such as .py, .js, and .java may contain code in programming languages ​​such as Python, JavaScript, and Java. The keyword matching rule can pre-define different keywords for each type of code, and then search in the file content based on the keywords. For example, an SQL statement may start with SELECT, INSERT, UPDATE, DELETE, etc. A shell script may start with #! / bin / bash or #! / bin / sh. A Python script may contain keywords such as def, class, and import.

[0052] This module can automatically read and parse the SQL statements or operating system scripts to be executed from the target file.

[0053] 2. Rule engine module. This module is used to determine whether there is risk data in the sensitive information according to a preset risk review method. If it is determined that there is no risk data in the sensitive information, it can be determined that the target file to be executed will not cause harm to the system, and the target file is directly executed. If it is determined that there is risk data in the sensitive information, the risk data and the corresponding target file information are sent to the trigger warning module.

[0054] In this module, multiple methods can be used to determine whether there is risky data in sensitive information. For example, a test environment with exactly the same configuration is built for the system that needs to execute the target file, and the sensitive information is input into the simulation environment for execution, and then the simulation environment is tested to see if it is damaged. If it is not damaged, it is determined that there is no risky data in the sensitive information.

[0055] The target file may also be sent to different environments such as a virtual machine or a security sandbox for execution to determine whether the target file will cause damage to the above environment. If it is not damaged, it is determined that there is no risky data in the sensitive information.

[0056] Alternatively, historical risk data that has an impact on the system may be collected first, and after training the machine model with the historical risk data, a machine model that can identify risk data may be generated. After sensitive information is input into the machine model, an indication of whether risk data exists in the sensitive information may be output.

[0057] 3. Triggering the early warning module: This module is used to generate early warning information according to the risk data and the corresponding target file information after receiving the risk data and the corresponding target file information sent by the rule engine module.

[0058] The priority of the notification interface is determined by the risk data, and after the target notification interface is determined according to the priority, the warning information is sent through the target notification interface, and after receiving the review decision of the warning information, it is determined whether to execute the target file according to the review decision.

[0059] In this module, you need to pre-configure several notification interfaces, such as email, SMS, and mobile notification interfaces, and set different priorities for each notification interface. For example, the priority of the email notification interface is 1, the priority of the SMS notification interface is 2, and the priority of the mobile notification interface is 3. The larger the number, the higher the priority. When it is determined that there is risk data, different priorities can be set for it according to the risk data. For example, when it is determined that the risk data may cause greater damage to the system, or the impact of the risk data on the system increases over time, the priority of the warning information corresponding to the risk data can be set higher.

[0060] In another embodiment, after the triggering warning module sends the warning information through the target notification interface, it can also detect in real time within a preset time period whether a review decision for the warning information is received. If not, the warning information is sent to a second target notification interface with a lower priority than the target notification interface.

[0061] The step of detecting again whether feedback information regarding the warning information is received within a preset time period is performed. If not received, the warning information is sent to a third target notification interface having a lower priority than the second target notification interface until feedback information regarding the warning information is received.

[0062] In this embodiment, the triggering warning module realizes real-time monitoring of the review decision, thereby improving the efficiency of the review.

[0063] In another embodiment, after the triggering warning module sends the warning information through the target notification interface, it can also periodically detect whether feedback information for the warning information is received and record the number of detections, and repeat the step of performing the periodic detection when no feedback information is received, until the number of detections reaches a threshold, the warning information is sent to a second target notification interface with a lower priority than the target notification interface;

[0064] Perform the timed detection again to see whether feedback information is received for the warning information and record the number of detections. If no feedback information is received, repeat the step of performing the timed detection. When the number of detections reaches a threshold, send the warning information to a third target notification interface whose priority is lower than that of the second target notification interface, and stop sending the warning information until feedback information is received for the warning information.

[0065] In this embodiment, the trigger warning module realizes the timed monitoring of the review decision, thereby improving the efficiency of the review while reducing the impact on system performance.

[0066] So far, completed Figure 1 Functional description of each module in .

[0067] In an embodiment of the present application, after the system receives the target file that needs to be executed, it first extracts the sensitive information in the target file. Then, a preset risk review method is used to determine whether the sensitive information contains risk data that may cause danger to the system. When determined, a corresponding early warning message is generated and sent to relevant personnel through multiple preset notification interfaces, and whether to execute the target file is determined based on the review decision of the relevant personnel. This solves the problem of low-level engineers mistakenly submitting high-risk operation codes, causing databases and application systems to face risks. The security and reliability of high-risk system operations are improved, providing strong technical support for related industries.

[0068] In another embodiment, the system further comprises a logging module and an audit trail module;

[0069] The logging module is used to record the execution status of the sensitive information and the operation log of the system;

[0070] The audit trail module is used to track and audit all rule changes and alert events.

[0071] The logging module and the audit trail module can significantly improve the reliability, security, and compliance of the system, while providing valuable information resources for system administrators and security analysts.

[0072] like Figure 2 As shown, the present application also provides a review decision method based on high-risk system operation, the method comprising:

[0073] Step S201, when a target file to be executed is received, sensitive information in the target file is determined by a preset information extraction method.

[0074] The information extraction method includes a regular expression matching method, a keyword matching method, and a file type detection method, and the sensitive information includes SQL statements, operating system scripts, and executable codes.

[0075] Step S202, determining whether there is risk data in the sensitive information, and if so, generating warning information based on the risk data and corresponding target file information.

[0076] Step S203, determining the priorities of several pre-configured notification interfaces through the risk data, and after determining the target notification interface according to the priority, sending the warning information through the target notification interface, and after receiving the review decision of the warning information, determining whether to execute the target file according to the review decision.

[0077] In another embodiment, after sending the warning information through the target notification interface, the method further includes:

[0078] Detecting in real time whether a review decision for the warning information is received within a preset time period, and if not received, sending the warning information to a second target notification interface having a lower priority than the target notification interface;

[0079] The step of detecting again whether a review decision for the warning information is received within a preset time period is performed. If not received, the warning information is sent to a third target notification interface with a lower priority than the second target notification interface until a review decision for the warning information is received.

[0080] In another embodiment, after sending the warning information through the target notification interface, the method further includes:

[0081] Regularly detect whether a review decision for the warning information is received and record the number of detections, and repeat the step of performing regular detection if no review decision is received, until the number of detections reaches a threshold, and send the warning information to a second target notification interface with a lower priority than the target notification interface;

[0082] Perform the scheduled detection again to see whether a review decision for the warning information is received and record the number of detections, and repeat the steps of performing the scheduled detection if no review decision is received. When the number of detections reaches a threshold, send the warning information to a third target notification interface whose priority is lower than that of the second target notification interface, and stop sending the warning information until a review decision for the warning information is received.

[0083] In another embodiment, determining whether risk data exists in the sensitive information according to a preset risk review method includes:

[0084] Input the sensitive information into a simulation environment for execution, and determine whether the sensitive information contains risk data based on the execution result; or,

[0085] The sensitive information is input into a pre-trained machine model, and the machine model is used to determine whether the sensitive information contains risk data, and the machine model is updated and optimized based on the sensitive information.

[0086] In another embodiment, the method further comprises:

[0087] Record the execution status and operation logs of the sensitive information;

[0088] Track and audit all rule changes and alert events.

[0089] The above-mentioned embodiments of the present invention provide a review decision system based on high-risk system operations, and based on the system, provide a review decision method based on high-risk system operations. Through the above-mentioned system and method, the safety and reliability of high-risk system operations are improved and human errors are reduced.

[0090] This embodiment also discloses a computer device, such as Figure 3 As shown, the computer device includes a processor and a memory, wherein the memory stores at least one instruction, and the at least one instruction is loaded and executed by the processor to implement any of the above-mentioned review decision methods based on high-risk system operations.

[0091] In addition, in the above-mentioned example implementation of the review decision system based on high-risk system operation, the logical division of each program module is only an example. In actual application, the above-mentioned functions can be assigned to different program modules as needed, for example, for the configuration requirements of the corresponding hardware or the convenience of software implementation. That is, the internal structure of the review decision system based on high-risk system operation is divided into different program modules to complete all or part of the functions described above.

[0092] The above description is only a preferred embodiment of the present application and is not intended to limit the present application. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present application shall be included in the scope of protection of the present application.

Claims

1. A review decision system based on high-risk system operations, characterized in that: The system includes a file reading module, a rule engine module and a trigger warning module; The file reading module is used to determine the sensitive information in the target file by a preset information extraction method when receiving the target file to be executed, and send the sensitive information and the corresponding target file information to the rule engine module, wherein the information extraction method includes a regular expression matching method, a keyword matching method, and a file type detection method, and the sensitive information includes SQL statements, operating system scripts, and executable codes; The rule engine module is used to determine whether there is risk data in the sensitive information according to a preset risk review method, and if so, send the risk data and corresponding target file information to the trigger warning module; The trigger warning module pre-configures several notification interfaces and sets different priorities for each notification interface; After receiving the risk data and the corresponding target file information sent by the rule engine module, generating warning information according to the risk data and the corresponding target file information; The priority of the notification interface is determined by the risk data, and after the target notification interface is determined according to the priority, the warning information is sent through the target notification interface, and after receiving the review decision of the warning information, it is determined whether to execute the target file according to the review decision.

2. The system according to claim 1, characterized in that After the trigger warning module sends the warning information through the target notification interface, it is also used to: Detecting in real time whether a review decision for the warning information is received within a preset time period, and if not received, sending the warning information to a second target notification interface having a lower priority than the target notification interface; The step of detecting again whether a review decision for the warning information is received within a preset time period is performed. If not received, the warning information is sent to a third target notification interface with a lower priority than the second target notification interface until a review decision for the warning information is received.

3. The system according to claim 1, characterized in that After the trigger warning module sends the warning information through the target notification interface, it is also used to: Regularly detect whether a review decision for the warning information is received and record the number of detections, and repeat the step of performing regular detection if no review decision is received, until the number of detections reaches a threshold, and send the warning information to a second target notification interface with a lower priority than the target notification interface; Perform the scheduled detection again to see whether a review decision for the warning information is received and record the number of detections, and repeat the steps of performing the scheduled detection if no review decision is received. When the number of detections reaches a threshold, send the warning information to a third target notification interface whose priority is lower than that of the second target notification interface, and stop sending the warning information until a review decision for the warning information is received.

4. The system according to claim 1, characterized in that Determining whether there is risk data in the sensitive information according to a preset risk review method includes: Input the sensitive information into a simulation environment for execution, and determine whether the sensitive information contains risk data based on the execution result; or, The sensitive information is input into a pre-trained machine model, and the machine model is used to determine whether the sensitive information contains risk data, and the machine model is updated and optimized based on the sensitive information.

5. The system according to claim 1, characterized in that The system also includes a logging module and an audit trail module; The logging module is used to record the execution status of the sensitive information and the operation log of the system; The audit tracking module is used to track and audit all rule changes and warning events.

6. A review decision method based on high-risk system operation, characterized in that: The method comprises: When receiving a target file to be executed, determining sensitive information in the target file through a preset information extraction method, wherein the information extraction method includes a regular expression matching method, a keyword matching method, and a file type detection method, and the sensitive information includes SQL statements, operating system scripts, and executable codes; Determine whether there is risk data in the sensitive information, and if so, generate warning information based on the risk data and corresponding target file information; The priorities of several pre-configured notification interfaces are determined by the risk data, and after the target notification interface is determined according to the priority, the warning information is sent through the target notification interface, and after receiving the review decision of the warning information, it is determined whether to execute the target file according to the review decision.

7. The method according to claim 6, characterized in that After sending the warning information through the target notification interface, the method further includes: Detecting in real time whether a review decision for the warning information is received within a preset time period, and if not received, sending the warning information to a second target notification interface having a lower priority than the target notification interface; The step of detecting again whether a review decision for the warning information is received within a preset time period is performed. If not received, the warning information is sent to a third target notification interface with a lower priority than the second target notification interface until a review decision for the warning information is received.

8. The method according to claim 6, characterized in that After sending the warning information through the target notification interface, the method further includes: Regularly detect whether a review decision for the warning information is received and record the number of detections, and repeat the step of performing regular detection if no review decision is received, until the number of detections reaches a threshold, and send the warning information to a second target notification interface with a lower priority than the target notification interface; Perform the scheduled detection again to see whether a review decision for the warning information is received and record the number of detections, and repeat the steps of performing the scheduled detection if no review decision is received. When the number of detections reaches a threshold, send the warning information to a third target notification interface whose priority is lower than that of the second target notification interface, and stop sending the warning information until a review decision for the warning information is received.

9. The method according to claim 6, characterized in that Determining whether there is risk data in the sensitive information according to a preset risk review method includes: Input the sensitive information into a simulation environment for execution, and determine whether the sensitive information contains risk data based on the execution result; or, The sensitive information is input into a pre-trained machine model, and the machine model is used to determine whether the sensitive information contains risk data, and the machine model is updated and optimized based on the sensitive information.

10. The method according to claim 6, characterized in that The method further comprises: Record the execution status and operation logs of the sensitive information; Track and audit all rule changes and alert events.

Images