Installation software auditing method and system based on domestic server

Abstract

The invention relates to the technical field of information security, and discloses an installation software auditing method and system based on a localized server, and the method comprises the steps: collecting parameter data of a first object; monitoring the first object and acquiring a use state of the first object; and recording the duration of the use state, carrying out data integration, and generating an audit report. According to the method disclosed by the invention, through real-time and periodic monitoring and alarm management of information such as installation, unloading, version change and use duration of the domestic server software, the defects of the prior art in the field of security monitoring of the domestic operating system are effectively made up. Through complete and systematized software state management, full-life-cycle security audit and alarm pushing are realized, and finally, the overall security protection capability of the domestic server is improved.

Description

Technical Field

[0001] The present invention relates to the field of information security technology, and in particular to an installation software audit method and system based on a domestic server. Background Art

[0002] In the current information technology environment, the security of software installed in the operating system directly affects the overall security of the system, especially in the domestic server system, the security audit of the software installed in the operating system is of great significance. However, the existing operating system software audit system has many shortcomings, especially in adapting to the domestic operating system. The traditional audit system is mainly designed around the Windows operating system and lacks in-depth adaptation solutions for other operating systems. Specifically, most of the existing audit systems can only monitor the installation and uninstallation of software, but cannot effectively capture and record deeper operation data, such as changes in software versions, software usage time, and detailed audit information such as software operation status. In addition, the audit tools required for domestic servers also face many challenges in terms of execution efficiency, resource occupation, and compatibility, resulting in the inability to effectively meet the audit needs of many domestic servers. Traditional audit systems usually adopt an audit method with fixed time intervals, and check the software status through static scanning. This mode is prone to time lag in frequent software changes and highly dynamic usage environments. In addition, the lack of a unified data format and information reporting mechanism makes it difficult for the system management platform to quickly determine the details of software installation and changes. Therefore, implementing efficient installation software security monitoring in domestic operating systems has become a key demand in the industry. Summary of the invention

[0003] In view of the above-mentioned problems, the present invention is proposed.

[0004] Therefore, the technical problem solved by the present invention is that the existing operating system installation software audit system is seriously insufficient in adaptability to the domestic operating system.

[0005] To solve the above technical problems, the present invention provides the following technical solutions: a method for auditing installed software based on a domestic server, comprising: collecting parameter data of a first object; monitoring the first object and obtaining the usage status of the first object; recording the duration of the usage status, integrating data and generating an audit report.

[0006] As a preferred solution of the installation software audit method based on a domestic server described in the present invention, before collecting the parameter data of the first object, it also includes identifying the operating system type, and according to the operating system type, collecting the parameter data of the first object through management commands.

[0007] As a preferred solution of the installation software audit method based on a domestic server described in the present invention, after collecting the parameter data of the first object, it also includes establishing an information base based on the parameter data of the first object, regularly executing management commands, collecting the parameter data of the current first object, and updating the information in the information base.

[0008] As a preferred solution of the installation software audit method based on a domestic server described in the present invention, wherein: monitoring the first object and obtaining the usage status of the first object includes recording the start time and end time of the usage status, and determining the duration of the usage status.

[0009] As a preferred solution of the installation software audit method based on a domestic server described in the present invention, the data integration includes integrating the update status of the information library, the usage status of the first object and the duration of the usage status to form unified log information.

[0010] As a preferred solution of the installation software audit method based on domestic servers described in the present invention, wherein: the first object includes but is not limited to the software of the domestic servers; the usage status includes but is not limited to the installation, use and uninstallation of the software.

[0011] As a preferred solution of the installation software audit method based on domestic servers described in the present invention, the data integration and audit report generation include standardizing the monitored information, forming an audit report and reporting it to the management platform, and the management platform publishes alarm information based on the audit report.

[0012] A software installation audit system based on a domestic server using any of the methods described in the present invention, wherein: a data acquisition module regularly acquires parameter data of a first object, establishes an information library and continuously updates it; a monitoring module monitors the first object, obtains the usage status of the first object, and determines the duration of the usage status; an alarm module integrates the obtained information, generates an audit report and uploads it to a management platform, and issues alarm information based on the audit report.

[0013] A computer device comprises: a memory and a processor; the memory stores a computer program, comprising: the steps of implementing any one of the methods of the present invention when the processor executes the computer program.

[0014] A computer-readable storage medium stores a computer program, comprising: when the computer program is executed by a processor, the steps of implementing any one of the methods of the present invention are implemented.

[0015] Beneficial effects of the invention: The method of the invention effectively makes up for the shortcomings of the existing technology in the field of security monitoring of domestic operating systems through real-time and periodic monitoring and alarm management of information such as installation, uninstallation, version changes and usage time of domestic server software. Through complete and systematic software status management, full life cycle security auditing and alarm push are realized, ultimately improving the overall security protection capabilities of domestic servers. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the following briefly introduces the drawings required for describing the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work. Among them:

[0017] Figure 1 An overall flow chart of an installation software audit method based on a domestic server provided by an embodiment of the present invention;

[0018] Figure 2 A schematic diagram of the script content of an installation software audit method based on a domestic server provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0019] In order to make the above-mentioned purposes, features and advantages of the present invention more obvious and easy to understand, the specific implementation methods of the present invention are described in detail below in conjunction with the drawings of the specification. Obviously, the described embodiments are part of the embodiments of the present invention, but not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary persons in the art without creative work should fall within the scope of protection of the present invention.

[0020] Example 1, reference Figure 1 and Figure 2 , as an embodiment of the present invention, provides an installation software audit method based on a domestic server, comprising:

[0021] S1: Collect parameter data of a first object.

[0022] Among them, the first object can be server software, security configuration of network equipment or Internet of Things device, etc.; parameter data can be installation time, software version, ACL rules, NAT configuration, VPN configuration, firmware version, operating status and communication log, etc., which can determine the version, configuration and status of the first object.

[0023] Furthermore, in an embodiment of the present application, before collecting parameter data of the first object, it is necessary to identify the type of operating system, and based on the type of operating system, the collection of parameter data of the first object is achieved through management commands.

[0024] Specifically, the operating system type can be identified based on the manufacturer information of the device or by trying to run a general version query command, and parameter data can be collected according to different operating systems. For example, for Linux or Linux-like devices, commands such as ps, df, cat / proc / meminfo can be executed through an SSH connection to obtain process information, storage status, and memory usage.

[0025] Furthermore, we collect data related to the security of the installed software of domestic servers, including installation time, software version and other information, establish a software basic library, regularly match software information through software indexing, verify software name, software version and other information to determine if the software has been incorrectly changed.

[0026] In another embodiment of the present invention, when the first object is a network device, the operating system can also be identified through the login prompt and version information. According to the operating system type, device-specific commands are used to collect the configuration parameters of the current device. For example, Cisco devices usually run Cisco IOS or NX-OS and support command line interface (CLI) commands such as show running-config, showversion, etc.; use commands such as show version or displayversion to obtain the operating system version, device running time and hardware information; obtain the device log information through commands such as show log or display log to identify potential security incidents or anomalies.

[0027] S2: Monitor the first object and obtain the usage status of the first object.

[0028] The usage status of the first object includes but is not limited to the installation, use and uninstallation of the software. By monitoring commands such as apt, rpm, yum, dpkg, etc., it is determined whether there is any software installation and uninstallation action. The specific determination method is as follows:

[0029] (1) Use the auditd tool to monitor command execution in real time:

[0030] a. Install and start the auditd tool;

[0031] b. Add rules to monitor related commands;

[0032] c. Check the audit log to determine whether there are any installation or assistance program commands executed;

[0033] (2) Periodically execute the script to check the log file and detect installation and uninstallation operations. The script content is as follows: Figure 2 shown.

[0034] Further, through ps -eo pid,etime,cmd|grep<process_name> The command monitors the process and determines the usage time. Specifically, the ps command is executed every second to view the current process information to determine whether the software is in use. If so, the start time is recorded, and the end time is recorded when the monitoring process ends. The software usage time is determined based on the start and end times.

[0035] In another embodiment of the present invention, the monitoring method of the first object is not limited to the form of system commands combined with scripts, but can also utilize the event monitoring mechanism of the operating system (such as Linux's inotify or systemd-based service monitoring) and log analysis tools (such as syslog or journald) to realize the monitoring of software installation, uninstallation and usage status.

[0036] Specifically, use event monitoring tools such as inotify or systemd to configure monitoring of specific directories and files. For example, you can monitor log files of software package management tools such as / var / log / apt / history.log and / var / log / yum.log. For software installation and uninstallation operations, trigger event notifications when corresponding log files change, and automatically capture software installation and uninstallation information.

[0037] Configure log analysis tools such as syslog or journald to filter and analyze the system logs of the operating system. For example, set matching rules for software operation commands executed by tools such as apt and rpm, capture installation and uninstallation log entries, and record related information to automatically determine whether there are installation or uninstallation operations to avoid frequent execution of scripts for log scanning.

[0038] Use tools such as systemd-cgtop or cgroups to monitor the software process status, create a service rule, and set the time record of process start and termination for the target software by configuring the systemd service unit file.

[0039] The system will automatically generate the start and end time of the process, so that the usage time of the software can be automatically calculated. There is no need to execute the ps command every second, but the system process management mechanism will capture and record the start and stop events of the software.

[0040] S3: Record the duration of usage, integrate data and generate audit reports.

[0041] Furthermore, the software name, installation, uninstallation, version change, usage time and other data collected during the data collection phase are normalized to form unified log information, which is saved in the client installation path in json format.

[0042] Specifically, data from auditd, ps commands, and other scripts are integrated together to merge information based on software names or unique identifiers. For example, information such as software installation time, uninstallation time, and usage time are merged into the same record.

[0043] For process information with start time and end time, calculate the total usage time of the software and store the result as an independent field.

[0044] The normalized data is converted into a dictionary structure. The information of each software is represented by fields. The formatted dictionary is converted into JSON format using Python's json library. The generated JSON file is stored in the installation path specified by the client for subsequent audit report generation and management platform reading.

[0045] Furthermore, the management platform extracts the JSON content reported by the client, including the software installation information, uninstallation information, version information, abnormal usage information, etc., to form an alarm record and push it to the administrator. Through the Python function, it integrates the data after regular matching and outputs a report file in HTML format.

[0046] Specifically, anomaly detection rules are preset in the management platform, including but not limited to unauthorized installation or uninstallation operations, version changes (detecting whether there are unauthorized updates), usage time exceeding preset limits (for example, the usage time of a certain software exceeds the standard value), and software that is idle or has not been used for a long time.

[0047] According to the rules, the value of each field is detected to see if there is any abnormality. If an abnormality is found, an alarm record is generated and the generated alarm information is pushed to the administrator through the management platform.

[0048] Clean and format the extracted data, uniformly process the non-standard log information, use regular expressions to extract the required key information, and save the generated HTML content to a file so that the administrator can view the complete audit report in the browser.

[0049] Example 2: The following is an embodiment of the present invention, which provides an installation software audit method based on a domestic server.

[0050] The client software automatically determines the type of operating system and uses rpm-qa or dpkg-L to view the information of installed software, obtain information such as software name and software version, and the installed software list. It also executes the above commands regularly to query the information of current software and compare it with the established software list. If there is a change, the change information is recorded and the software list is updated to the existing data. The specific data is shown in Table 1.

[0051] Table 1 Software installation and operation status monitoring data table

[0052] variable type describe software_name unsigned Software Title version unsigned Software Version version_ch unsigned Version Changes install unsigned Installation Action install_date unsigned Installation time unstall unsigned Uninstall Action uninstall_date unsigned Uninstall time user_time unsigned Protocol Number time unsigned Remaining survival time

[0053] By monitoring the system's rpm, dpkg, yum, apt and other commands through the client driver, it is determined whether the operating system has installed and uninstalled software.

[0054] Check the current process information by executing the ps command every second to determine whether the software is in use. If so, record the start time, wait until the improvement process is finished, and record the end time. Determine the software usage time based on the start time and end time and report it.

[0055] The software name, installation, uninstallation, version change, usage time and other data collected during the data collection phase are normalized to form unified log information, which is saved in the client installation path in JSON format.

[0056] The management platform extracts the JSON content reported by the client, including software installation information, uninstallation information, version information, abnormal usage information, etc., and forms an alarm record to push to the administrator.

[0057] Through the Python function, the data after regular matching is integrated and the report file in HTML format is output.

[0058] Example 3: In an exemplary embodiment, a software installation audit system based on a domestic server is also provided, including a data acquisition module, a monitoring module and an alarm module.

[0059] Among them, the data acquisition module is used to regularly collect various parameter data of the server to establish and continuously update the information database.

[0060] The data collection module includes a software information collection submodule and a version change detection submodule. The software information collection submodule is responsible for collecting information such as the name, version and installation time of the software installed on the server, establishing a software information database, and transmitting the collected data to the version change detection submodule.

[0061] The version change detection submodule detects the addition, deletion or version change of software by comparing the current software information with the software information library information, updates the information library and marks the changes.

[0062] Furthermore, the monitoring module is used to monitor the status changes and operating behaviors of the software in the server in real time and to determine the duration of the software status. The monitoring module includes a command call monitoring submodule and a status continuity detection submodule.

[0063] The command call monitoring submodule monitors the calling of commands such as apt, rpm, yum, and dpkg through the Auditd tool, and passes the installation, uninstallation and other operation logs to the status continuity detection submodule to determine whether there is any abnormal operation behavior.

[0064] The state continuity detection submodule receives data from the command call monitoring submodule and analyzes the state duration of each software.

[0065] Furthermore, the alarm module is used to integrate the information obtained from the data acquisition module and the monitoring module, generate an audit report, and issue an alarm according to the security policy configured by the system. The alarm module includes a data integration submodule, an audit report generation submodule, and an alarm release submodule.

[0066] The data integration submodule receives data from the monitoring module, including information such as installation, uninstallation, version changes, and usage duration, and integrates it into standardized log data, which is further passed to the audit report generation submodule.

[0067] The audit report generation submodule uses Python functions to format the integrated data, generates an audit report in HTML format through regular matching and other technologies, saves the report for administrators to review, and passes the generated report content to the alarm release submodule.

[0068] The alarm release submodule receives and analyzes the contents of the audit report and determines whether to trigger an alarm based on the system's preset security policy.

[0069] If the above functions are implemented in the form of software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art or the part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium, including several instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk and other media that can store program codes.

[0070] The logic and / or steps represented in the flowchart or otherwise described herein, for example, can be considered as an ordered list of executable instructions for implementing logical functions, and can be embodied in any computer-readable medium for use by an instruction execution system, device or apparatus (such as a computer-based system, a system including a processor, or other system that can fetch instructions from an instruction execution system, device or apparatus and execute instructions), or in conjunction with such instruction execution systems, devices or apparatuses. For the purposes of this specification, "computer-readable medium" can be any device that can contain, store, communicate, propagate or transmit a program for use by an instruction execution system, device or apparatus, or in conjunction with such instruction execution systems, devices or apparatuses.

[0071] More specific examples of computer-readable media (a non-exhaustive list) include the following: an electrical connection with one or more wires (electronic device), a portable computer disk case (magnetic device), a random access memory (RAM), a read-only memory (ROM), an erasable and programmable read-only memory (EPROM or flash memory), an optical fiber device, and a portable compact disk read-only memory (CDROM). In addition, the computer-readable medium may even be a paper or other suitable medium on which the program is printed, since the program may be obtained electronically, for example, by optically scanning the paper or other medium, followed by editing, deciphering or, if necessary, processing in another suitable manner, and then stored in a computer memory.

[0072] It should be understood that the various parts of the present invention can be implemented by hardware, software, firmware or a combination thereof. In the above-mentioned embodiments, a plurality of steps or methods can be implemented by software or firmware stored in a memory and executed by a suitable instruction execution system. For example, if implemented by hardware, as in another embodiment, it can be implemented by any one of the following technologies known in the art or their combination: a discrete logic circuit having a logic gate circuit for implementing a logic function for a data signal, a dedicated integrated circuit having a suitable combination of logic gate circuits, a programmable gate array (PGA), a field programmable gate array (FPGA), etc.

[0073] It should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention rather than to limit it. Although the present invention has been described in detail with reference to the preferred embodiments, those skilled in the art should understand that the technical solutions of the present invention may be modified or replaced by equivalents without departing from the spirit and scope of the technical solutions of the present invention, which should all be included in the scope of the claims of the present invention.

Claims

1. A method for auditing installed software based on a domestic server, characterized in that: include: collecting parameter data of the first object; Monitoring the first object and obtaining a usage status of the first object; Record the duration of usage, integrate data and generate audit reports.

2. The method for auditing installed software based on a domestic server as claimed in claim 1, characterized in that: Before collecting the parameter data of the first object, the method further includes: The operating system type is identified, and according to the operating system type, the first object parameter data is collected through a management command.

3. The method for auditing installed software based on a domestic server as claimed in claim 2, characterized in that: After collecting the parameter data of the first object, the method further includes: An information base is established according to the parameter data of the first object, management commands are executed regularly, the parameter data of the current first object is collected, and the information of the information base is updated.

4. The method for auditing installed software based on a domestic server as claimed in claim 3, characterized in that: The monitoring of the first object and obtaining the usage status of the first object includes recording the start time and the end time of the usage status and determining the duration of the usage status.

5. The method for auditing installed software based on a domestic server as claimed in claim 4, characterized in that: The data integration includes integrating the update status of the information base, the usage status of the first object and the duration of the usage status to form unified log information.

6. The method for auditing installed software based on a domestic server as claimed in claim 1, characterized in that: The first object includes but is not limited to the software of the domestic server; The usage status includes but is not limited to the installation, use and uninstallation of the software.

7. The method for auditing installed software based on a domestic server as claimed in claim 6, characterized in that: The data integration and audit report generation includes normalizing the monitored information, forming an audit report and reporting it to a management platform, and the management platform publishes alarm information according to the audit report.

8. An installation software audit system based on a domestic server using any of the methods of claims 1 to 7, characterized in that: include, A data collection module, which regularly collects parameter data of the first object, establishes an information database and continuously updates it; A monitoring module, monitoring the first object, obtaining a usage status of the first object, and determining a duration of the usage status; The alarm module integrates the acquired information, generates an audit report and uploads it to the management platform, and publishes alarm information based on the audit report.

9. A computer device comprising: Memory and processor; The memory stores a computer program, which is characterized in that when the processor executes the computer program, the steps of the installation software audit method based on the domestic server as described in any one of claims 1-7 are implemented.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by the processor, the steps of the installation software audit method based on the domestic server as described in any one of claims 1-7 are implemented.

Images