AI model-based fortress machine bypass event auditing and early warning method

Abstract

The invention discloses an AI model-based fortress machine bypassing event auditing early warning method, belongs to the technical field of network information security, and solves the problem that checking about auditing video monitoring in fortress machine bypassing event auditing needs to be performed more autonomously and early warning needs to be performed. Comprising the following steps: S1, acquiring an audit video stream and a bastion host input signal corresponding to the audit video stream, judging whether an operation instruction exists or not according to the bastion host input signal, if not, acquiring a suspected illegal audit video stream, and if yes, acquiring a suspected security audit video stream; s2, splitting the single suspected security audit video stream and the suspected violation audit video stream into a plurality of audit video frames; according to the AI model bastion host auditing early warning method, the video stream is intelligently analyzed, the efficiency is improved, the storage is saved, the advanced model is adopted, the auditing precision is improved, automatic early warning is achieved, resources are optimized, errors are reduced, the response is quick, and the network security is enhanced.

Description

Technical Field

[0001] The present invention relates to the field of network information security technology, and in particular to an AI model-based bastion host bypass event audit and early warning method. Background Art

[0002] In the daily network operation and maintenance tasks of enterprises, technicians often need to remotely access a variety of devices, such as servers, network devices and application systems, to perform key operation and maintenance activities such as software deployment, policy configuration, function upgrades and troubleshooting. With the acceleration of the enterprise informatization process, the challenges of equipment operation and maintenance in internal networks are increasing. At present, there are some common problems, such as the sharing and abuse of login accounts, excessive expansion of permissions and dangerous operations, and insufficient auditing of operation and maintenance activities. These illegal operation and maintenance behaviors not only lead to disordered operation and maintenance management, but also may cause a series of security risks, including business interruption, data loss and leakage of sensitive information.

[0003] As an integrated operation and maintenance management solution, the bastion host has the ability to solve the above challenges and mitigate operation and maintenance related risks. In the regular operation and maintenance process, operators first need to access the bastion host, which acts as a springboard, allowing them to securely access and maintain remote devices and achieve centralized and secure management of operation and maintenance activities. Through the bastion host, enterprises can achieve centralized management of operation and maintenance accounts, unified identity verification, reasonable allocation of permissions, and comprehensive auditing of all operations to ensure the controllability, efficiency and compliance of the operation and maintenance process.

[0004] Nevertheless, in actual operation, some operation and maintenance personnel may try to bypass the bastion host and directly perform unauthorized operations on the device, such as illegally downloading data, in order to evade supervision. This creates a potential blind spot in operation and maintenance management. To address this problem, the bastion host needs to record the operation and maintenance operations during the audit so that subsequent audits can be conducted based on the recordings.

[0005] However, for a graphical operating interface, the graphical interface operation video file recorded by the bastion host is relatively large. In the prior art, for example, the bastion host audit data processing method, device, electronic device and storage medium with application number CN202311790512.8, its technical points include obtaining an audit monitoring video frame; obtaining a bastion host input signal corresponding to the audit monitoring video frame; judging whether there is an operation instruction in the audit monitoring video frame according to the bastion host input signal; if it is judged that there is no operation instruction in the audit monitoring video frame, performing image recognition on the audit monitoring video frame, and judging whether the audit monitoring video frame is a useless interface based on the image recognition result; if it is judged that the audit monitoring video frame is a useless interface, filtering out the audit monitoring video frame.

[0006] In the above scheme, the audit monitoring video will be saved. Since the graphical interface operation video file recorded by the bastion host is large, it may cause insufficient space on the deployment host of the bastion host and affect the use of the bastion host. Therefore, by deleting the audit monitoring video that is judged to be a useless interface, when the actual audit warning is carried out, the secondary comparison of a large number of useless interfaces in the operation interface monitoring video can be reduced. Then, the auditor can greatly reduce the video browsing volume to improve efficiency, and can also relatively improve the verification accuracy of the audit monitoring video while reducing the browsing volume.

[0007] At present, the audit logs in the domestic bastion hosts are required to be recorded for 180 days to facilitate use in the actual audit process. The actual bastion host audit cycles of each company are different. When the cycle is longer, the final audit content required will become larger, and the audit monitoring video is also an extremely time-consuming part. Even if the above method is used to greatly reduce the audit workload, the audit video monitoring video of the operation interface still takes a long time. Therefore, it is necessary to verify the audit video monitoring in the audit of the bastion host bypass event to operate more autonomously and issue early warnings.

[0008] Therefore, an AI model-based bastion host bypass event audit and early warning method is proposed to solve or alleviate the above problems. Summary of the invention

[0009] The purpose of the present invention is to solve the shortcomings existing in the prior art and to propose an audit and early warning method for bastion host bypass events based on an AI model.

[0010] In order to achieve the above object, the present invention adopts the following technical solutions:

[0011] An AI model-based bastion host bypass event audit and early warning method includes the following steps:

[0012] S1 obtains the audit video stream and the bastion host input signal corresponding to the audit video stream, and determines whether there is an operation instruction based on the bastion host input signal. If not, it obtains the suspected violation audit video stream. If so, it obtains the suspected security audit video stream.

[0013] S2 disassembles a single suspected security audit video stream and a suspected violation audit video stream into several audit video frames, calculates the similarity between each audit video frame and the previous frame using an image comparison model, and classifies the frames into several types of static content or dynamic content based on the similarity threshold, and retains only one frame of content for each type of static content and dynamic content to form a single video stream frame group;

[0014] S3 identifies each video frame in each single video stream frame group through a compliance feature matching model, and outputs the compliance rate of each single video stream frame group;

[0015] S4 determines whether the compliance rate from the suspected security audit video stream meets the first threshold range. If it meets the first threshold range, it is determined to be a compliant single video stream frame group and classified. If it does not meet the first threshold range, it is determined to be a suspected illegal single video stream frame group, classified and issued a warning. It determines whether the compliance rate from the suspected illegal audit video stream meets the second threshold range. If it meets the second threshold range, it is determined to be a suspected illegal single video stream frame group, classified and issued a warning. If it does not meet the second threshold range, it is determined to be a illegal single video stream frame group, classified and issued a warning.

[0016] Preferably, judging whether there is an operation instruction according to the bastion host input signal comprises the following steps:

[0017] Determine whether there are keyboard and mouse input operation signals in the bastion host input signal;

[0018] If it is determined that there are keyboard and mouse input operation signals in the bastion host input signal, it is determined that there are operation instructions.

[0019] Preferably, the static content includes that the similarity between each frame and the previous frame is higher than a similarity threshold, and the dynamic content includes that the similarity between each frame and the previous frame is lower than the similarity threshold.

[0020] Preferably, retaining only one frame of content for each static content and dynamic content comprises the following steps:

[0021] Keep the first frame as the initial static content frame;

[0022] Keep the first appearing dynamic content frame;

[0023] For subsequent frames, retaining a new static content frame only if the static content frame is different from a previously retained static content frame;

[0024] For dynamic content frames, a new dynamic content frame is retained only if the dynamic content frame is different from any previously retained frame.

[0025] Preferably, the image contrast model includes Among them, μ x and μ y are the means of each audit video frame and the previous frame, σ x and σ y is the standard deviation, σ xy is the covariance, c1 and c2 are small constants, usually with values ​​of c1=0.01 and c2=0.03.

[0026] Preferably, the method for establishing the compliance feature matching model comprises the following steps:

[0027] Data collection and preprocessing: collect compliance images of compliance operations of a single bastion host, extract text features from compliance images through the OCR character recognition algorithm, and then convert them into text training sets through the TF-IDF algorithm. Normalize the compliance images to form an image training set.

[0028] Design a convolutional neural network model, add loss functions, and evaluation formulas;

[0029] The text training set and the image training set are input into the convolutional neural network model training to obtain a compliance feature matching model.

[0030] Preferably, the convolutional neural network model includes an input layer, a convolution layer, a pooling layer, a flattening layer, a full output layer, and an output layer.

[0031] Preferably, the loss function includes Where m is the number of categories, y o,c is the encoding of the true label, p o,c is the probability of the cth category predicted by the model, and the evaluation formula includes

[0032] Preferably, the compliance rate=the number of compliant pictures / the number of video frames in a single video stream frame group.

[0033] The present invention has the following beneficial effects:

[0034] The AI ​​model-based bastion host bypass event audit and early warning method proposed in this invention significantly improves audit efficiency and reduces storage space usage by intelligently analyzing audit video streams. This solution uses advanced image comparison and compliance feature matching models to enhance audit accuracy, achieve autonomous early warning, optimize resource allocation, reduce human errors, improve response speed, and strengthen enterprise network security protection. BRIEF DESCRIPTION OF THE DRAWINGS

[0035] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings required for use in the embodiments are briefly introduced below. It should be understood that the following drawings only show certain embodiments of the present invention and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without creative work.

[0036] Figure 1 It is a structural block diagram of the present invention. DETAILED DESCRIPTION

[0037] In order to make the purpose, technical solutions and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Generally, the components of the embodiments of the present invention described and shown in the drawings here can be arranged and designed in various different configurations.

[0038] Therefore, the following detailed description of the embodiments of the present invention provided in the accompanying drawings is not intended to limit the scope of the invention claimed for protection, but merely represents selected embodiments of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0039] It should be noted that similar reference numerals and letters denote similar items in the following drawings, and therefore, once an item is defined in one drawing, further definition and explanation thereof is not required in subsequent drawings.

[0040] In the description of the present invention, it should be understood that the terms "center", "up", "down", "left", "right", "vertical", "horizontal", "inside", "outside" and the like indicate orientations or positional relationships based on the orientations or positional relationships shown in the accompanying drawings, or are the orientations or positional relationships in which the product of the invention is conventionally placed when in use, or are the orientations or positional relationships conventionally understood by those skilled in the art. They are only for the convenience of describing the present invention and simplifying the description, and do not indicate or imply that the device or element referred to must have a specific orientation, be constructed and operated in a specific orientation, and therefore should not be understood as a limitation on the present invention.

[0041] Furthermore, the terms “first”, “second”, “third”, etc. are merely used for distinguishing descriptions and are not to be understood as indicating or implying relative importance.

[0042] In the description of the present invention, it is also necessary to explain that, unless otherwise clearly specified and limited, the terms "set", "install", "connect", and "connect" should be understood in a broad sense, for example, it can be a fixed connection, a detachable connection, or an integral connection; it can be a mechanical connection or an electrical connection; it can be a direct connection, or it can be indirectly connected through an intermediate medium, or it can be the internal communication of two elements. For ordinary technicians in this field, the specific meanings of the above terms in the present invention can be understood according to specific circumstances.

[0043] An AI model-based bastion host bypass event audit and early warning method includes the following steps:

[0044] S1 obtains the audit video stream and the bastion host input signal corresponding to the audit video stream, and determines whether there is an operation instruction based on the bastion host input signal. If not, it obtains the suspected violation audit video stream. If so, it obtains the suspected security audit video stream.

[0045] S2 disassembles a single suspected security audit video stream and a suspected violation audit video stream into several audit video frames, calculates the similarity between each audit video frame and the previous frame using an image comparison model, and classifies the frames into several types of static content or dynamic content based on the similarity threshold, and retains only one frame of content for each type of static content and dynamic content to form a single video stream frame group;

[0046] S3 identifies each video frame in each single video stream frame group through a compliance feature matching model, and outputs the compliance rate of each single video stream frame group;

[0047] S4 determines whether the compliance rate from the suspected security audit video stream meets the first threshold range. If it meets the first threshold range, it is determined to be a compliant single video stream frame group and classified. If it does not meet the first threshold range, it is determined to be a suspected illegal single video stream frame group, classified and issued a warning. It determines whether the compliance rate from the suspected illegal audit video stream meets the second threshold range. If it meets the second threshold range, it is determined to be a suspected illegal single video stream frame group, classified and issued a warning. If it does not meet the second threshold range, it is determined to be a illegal single video stream frame group, classified and issued a warning.

[0048] The present invention effectively distinguishes between suspected safe and suspected illegal operations by acquiring and analyzing the audit video stream and its corresponding bastion host input signal, thereby improving the pertinence and accuracy of the audit. In step S2, the present invention splits and classifies video frames, removes redundancy through image comparison models, and retains only key frames, which greatly optimizes the data processing process and reduces storage requirements. In steps S3 and S4, the present invention can automatically evaluate and identify compliance rates using compliance feature matching models, and achieve real-time early warnings, which not only improves the response speed of the audit, but also reduces errors caused by human factors. In addition, by setting different thresholds, the present invention can flexibly respond to audit requirements of different security levels, ensuring the accuracy of audit results and the efficiency of the audit process.

[0049] Preferably, judging whether there is an operation instruction according to the bastion host input signal includes the following steps:

[0050] Determine whether there are keyboard and mouse input operation signals in the bastion host input signal;

[0051] If it is determined that there are keyboard and mouse input operation signals in the bastion host input signal, it is determined that there are operation instructions.

[0052] The present invention analyzes the input signal of the bastion host, and the actual operation must be performed through the keyboard and mouse, thereby effectively distinguishing the suspected security audit video stream containing operation instructions and the suspected violation audit video stream without operation instructions, thereby improving the efficiency and accuracy of the audit.

[0053] Preferably, the static content includes that the similarity between each frame and the previous frame is higher than a similarity threshold, and the dynamic content includes that the similarity between each frame and the previous frame is lower than the similarity threshold.

[0054] Static content and dynamic content are distinguished by defining a similarity threshold. When the operation interface changes from static to dynamic, there will be an obvious difference in the similarity of the two images. Therefore, such an operation can classify the video frames in the video stream.

[0055] Preferably, only one frame of content is retained for each static content and dynamic content, including the following steps:

[0056] Keep the first frame as the initial static content frame;

[0057] Keep the first appearing dynamic content frame;

[0058] For subsequent frames, retaining a new static content frame only if the static content frame is different from a previously retained static content frame;

[0059] For dynamic content frames, a new dynamic content frame is retained only if the dynamic content frame is different from any previously retained frame.

[0060] Through the above method, only one frame of content can be retained for each static content and dynamic content, thereby reducing the number of video frames in the video stream, significantly reducing the number of video frames required for subsequent recognition, and improving computing efficiency.

[0061] Preferably, the image contrast model includes Among them, μ x and μ y are the means of each audit video frame and the previous frame, σ x and σ y is the standard deviation, σ xy is the covariance, c1 and c2 are small constants, usually with values ​​of c1=0.01 and c2=0.03.

[0062] The image contrast model calculates the mean, standard deviation and covariance between consecutive video frames, introduces small constants to enhance the robustness of the model, and effectively distinguishes static and dynamic content. Since static content has small inter-frame changes, while dynamic content exhibits large inter-frame differences, by setting a similarity threshold, the image contrast model can identify and retain key frames, thereby significantly reducing the amount of data while capturing all important changes in the video.

[0063] Preferably, the method for establishing the compliance feature matching model comprises the following steps:

[0064] Data collection and preprocessing: collect compliance images of compliance operations of a single bastion host, extract text features from compliance images through the OCR character recognition algorithm, and then convert them into text training sets through the TF-IDF algorithm. Normalize the compliance images to form an image training set.

[0065] Design a convolutional neural network model, add loss functions, and evaluation formulas;

[0066] Input the text training set and the image training set into the convolutional neural network model training to obtain a compliance feature matching model;

[0067] The convolutional neural network model includes an input layer, a convolution layer, a pooling layer, a flattening layer, a full output layer, and an output layer.

[0068] A convolutional neural network model is used to identify and classify compliance images. The convolutional neural network model starts with the input layer and receives the original image data. The convolution layer automatically learns the local features in the image through filters. The pooling layer reduces the spatial dimension of the features while increasing the invariance to image displacement. The flattening layer converts the multi-dimensional feature map into a one-dimensional feature vector to provide input for the subsequent fully connected layer. The output layer makes classification decisions, thereby realizing an automated and efficient feature learning process, greatly reducing the need for manual feature engineering and improving recognition accuracy. The convolutional neural network model can capture the image features and text features in the image, enhancing the ability to recognize compliance features.

[0069] Preferably, the loss function includes Where m is the number of categories, y o,c is the encoding of the true label, p o,c is the probability of the cth category predicted by the model, and the evaluation formula includes

[0070] Preferably, compliance rate=number of compliant pictures / number of video frames in a single video stream frame group.

[0071] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. For those skilled in the art, the present invention may have various modifications and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention shall be included in the protection scope of the present invention.

Claims

1. An AI model-based bastion host bypass event audit and early warning method, characterized in that: The following steps are included: S1 obtains the audit video stream and the bastion host input signal corresponding to the audit video stream, and determines whether there is an operation instruction based on the bastion host input signal. If not, it obtains the suspected violation audit video stream. If so, it obtains the suspected security audit video stream. S2 disassembles a single suspected security audit video stream and a suspected violation audit video stream into several audit video frames, calculates the similarity between each audit video frame and the previous frame using an image comparison model, and classifies the frames into several types of static content or dynamic content based on the similarity threshold, and retains only one frame of content for each type of static content and dynamic content to form a single video stream frame group; S3 identifies each video frame in each single video stream frame group through a compliance feature matching model, and outputs the compliance rate of each single video stream frame group; S4 determines whether the compliance rate from the suspected security audit video stream meets the first threshold range. If it meets the first threshold range, it is determined to be a compliant single video stream frame group and classified. If it does not meet the first threshold range, it is determined to be a suspected illegal single video stream frame group, classified and issued a warning. It determines whether the compliance rate from the suspected illegal audit video stream meets the second threshold range. If it meets the second threshold range, it is determined to be a suspected illegal single video stream frame group, classified and issued a warning. If it does not meet the second threshold range, it is determined to be a illegal single video stream frame group, classified and issued a warning.

2. According to the AI ​​model-based bastion host bypass event audit and early warning method according to claim 1, it is characterized in that: The method of judging whether there is an operation instruction according to the input signal of the bastion host comprises the following steps: Determine whether there are keyboard and mouse input operation signals in the bastion host input signal; If it is determined that there are keyboard and mouse input operation signals in the bastion host input signal, it is determined that there are operation instructions.

3. According to the AI ​​model-based bastion host bypass event audit and early warning method of claim 1, it is characterized in that: The static content includes that the similarity between each frame and the previous frame is higher than the similarity threshold, and the dynamic content includes that the similarity between each frame and the previous frame is lower than the similarity threshold.

4. According to the AI ​​model-based bastion host bypass event audit and early warning method of claim 3, it is characterized in that: The method of retaining only one frame of content for each static content and dynamic content comprises the following steps: Keep the first frame as the initial static content frame; Keep the first appearing dynamic content frame; For subsequent frames, retaining a new static content frame only if the static content frame is different from a previously retained static content frame; For dynamic content frames, a new dynamic content frame is retained only if the dynamic content frame is different from any previously retained frame.

5. According to the AI ​​model-based bastion host bypass event audit and early warning method of claim 1, it is characterized in that: The image contrast model includes Among them, μ x and μ y are the means of each audit video frame and the previous frame, σ x and σ y is the standard deviation, σ xy is the covariance, c1 and c2 are small constants, usually with values ​​of c1=0.01 and c2=0.

03.

6. According to the AI ​​model-based bastion host bypass event audit and early warning method of claim 1, it is characterized in that: The method for establishing the compliance feature matching model comprises the following steps: Data collection and preprocessing: collect compliance images of compliance operations of a single bastion host, extract text features from compliance images through the OCR character recognition algorithm, and then convert them into text training sets through the TF-IDF algorithm. Normalize the compliance images to form an image training set. Design a convolutional neural network model, add loss functions, and evaluation formulas; The text training set and the image training set are input into the convolutional neural network model training to obtain the compliance feature matching model.

7. According to the AI ​​model-based bastion server bypass event audit and early warning method of claim 6, it is characterized in that: The convolutional neural network model includes an input layer, a convolution layer, a pooling layer, a flattening layer, a full output layer, and an output layer.

8. According to the AI ​​model-based bastion host bypass event audit and early warning method of claim 6, it is characterized in that: The loss function includes Where m is the number of categories, y o,c is the encoding of the true label, p o,c is the probability of the cth category predicted by the model, and the evaluation formula includes 9. According to the AI ​​model-based bastion host bypass event audit and early warning method of claim 1, it is characterized in that: The compliance rate=the number of compliant pictures / the number of video frames in a single video stream frame group.

Images