Bastion host safety protection system based on intelligent risk identification

Abstract

The invention relates to the technical field of fortress machines, in particular to a fortress machine safety protection system based on intelligent risk identification, which comprises a storage module used for calling fortress machine operation logs in real time, a calling module used for storing the fortress machine operation logs, and a protection module used for calling the fortress machine operation logs in the storage module, the called bastion host operation log is forwarded to the detection module; according to the method, the historical operation log of the bastion host is obtained, data cleaning is performed on the historical operation log of the bastion host to obtain the high-value reference log, comprehensive analysis is further performed according to the cleaned historical operation log of the bastion host, digital detection is performed on the abnormal change of the operation state of the bastion host, and finally the trend chart is created according to the monitoring result. According to trend identification of the trend chart, the safety of the current running state of the bastion host is judged, and an effective and relatively accurate predictive fault and risk monitoring protection effect is brought to the bastion host.

Description

Technical Field

[0001] The present invention relates to the technical field of bastion hosts, and in particular to a bastion host security protection system based on intelligent risk identification. Background Art

[0002] A bastion host is a network security device. In a specific network environment, it uses various technical means to monitor and record the operations of operation and maintenance personnel on servers, network equipment, etc. It can prevent intrusion and damage by internal and external network users, and has functions such as identity authentication, permission management, and operation auditing. It can effectively ensure network and data security and is an important part of the enterprise security system.

[0003] The invention patent with application number 202210790944.8 discloses a bastion host access method based on a multi-LAN environment, which is characterized by comprising the following steps: Step S1, setting a proxy gateway and a corresponding IP address for each LAN, setting a unique bastion host for the multi-LAN environment, and all proxy gateways are connected to the bastion host at the same time; Step S2, setting a database under the IP address of each proxy gateway in the bastion host, and partitioning the database, each partition corresponds to a host IP in the current LAN, and the partition stores the association information of the current host IP accessing the user: Step S3, the user accesses the user through the client After logging in to the bastion host system, the bastion host system directly calls the associated information in the database according to the user's login information, generates request data, and the request data at least includes the associated information of the accessing user, the proxy gateway IP and the target host IP, and sends the request data to the corresponding proxy gateway according to the proxy gateway IP: Step S4, the proxy gateway modifies the target IP in the transport layer TCP data packet message to the target host IP, and modifies the source IP to the proxy gateway IP according to the received request data. At this time, the user's client and the target host are directly connected through the connection between the bastion host and the proxy gateway, and the user can access the target host.

[0004] The application aims to solve the problem that "since a bastion host system needs to be deployed in each network, a large number of bastion host systems need to be deployed. First, hardware resources are wasted and hardware costs are increased. Each bastion host system needs to be deployed specifically on a host. Second, management costs are increased. Users need to manage and maintain a large number of bastion host systems at the same time. Especially when the bastion host system needs to be upgraded, each bastion host needs to be upgraded one by one, which takes a lot of time and manpower. Third, the scalability is poor. Every time a bastion host system is added, a bastion host system needs to be deployed again. In addition, if there is a vulnerability in the bastion host system itself, each bastion host needs to be repaired one by one."

[0005] However, currently, most of the daily operational security protection of the bastion host is carried out through real-time detection to determine faults and risk issues. The disadvantage is that the predictability of the operational security of the bastion host is poor, and it is impossible to accurately predict in advance the faults and risk issues that may occur in the bastion host.

[0006] Therefore, a bastion host security protection system based on intelligent risk identification is proposed. Summary of the invention

[0007] In view of the above-mentioned shortcomings of the prior art, the present invention provides a bastion host security protection system based on intelligent risk identification, which solves the technical problems raised in the above-mentioned background technology.

[0008] To achieve the above objectives, the present invention is implemented through the following technical solutions:

[0009] A bastion host security protection system based on intelligent risk identification, comprising:

[0010] A storage module is used to retrieve the bastion host operation log in real time and store the bastion host operation log. A retrieval module is used to retrieve the bastion host operation log in the storage module and forward the retrieved bastion host operation log to the detection module. A detection module is used to obtain the bastion host operation log fed back by the retrieval module and detect the bastion host operation state abnormality characteristic value based on the bastion host operation log. A visualization module is used to continuously receive the bastion host operation state abnormality characteristic value detected in the monitoring module and create a change trend chart of the bastion host operation state abnormality characteristic value based on the bastion host operation state abnormality characteristic value. A determination module is used to traverse the change trend chart and determine whether the bastion host operation is safe based on the change trend chart. A feedback module is used to receive the determination result of whether the bastion host operation is safe in the determination module, and output the determination result when the determination result is yes, and output the determination result together with the change trend chart when the determination result is no.

[0011] When the line representing the abnormal characteristic value of the bastion host's operating status in the change trend graph rises three times in a row, the judgment module determines that the bastion host is operating unsafely, otherwise, it is determined that the bastion host is operating safely. The feedback target of the feedback module is any mobile computer device with a graphic display function held by the system end user.

[0012] Furthermore, the bastion host operation log content retrieved in the storage module includes: user login information, user operation information, system operation status information, security event information, and system configuration change information. When the storage module stores the bastion host operation log, it differentiates the storage based on the bastion host operation log content type, so that each type of bastion host operation log content is stored in the same differentiated storage interval.

[0013] Furthermore, the storage module is internally provided with submodules, including:

[0014] A cleaning unit, used to traverse the bastion host operation logs stored in each storage interval in the storage module, and perform data cleaning on the bastion host operation logs;

[0015] The cleaning unit is provided with data cleaning logic, and the cleaning unit cleans the bastion machine operation log based on the cleaning logic. The cleaning logic is expressed as:

[0016]

[0017] Where: is the i-th log after cleaning; is the mth attribute value of the ith log after cleaning; is the jth attribute value of the ith log after cleaning; n is the total number of logs; a kj is the jth attribute value of the kth log in the original log; ΙΙ(·) is the indicator function;

[0018] Among them, each bastion host operation log is cleaned based on the above formula to output the cleaned bastion host operation log.

[0019] Furthermore, the indicator function ΙΙ(·) obeys, when the formula in the bracket is true, then ΙΙ(·)=1, otherwise, then ΙΙ(·)=0, the formula in the bracket is established, that is, it is judged to be true;

[0020] The outlier is an outlier value, and null is a null value;

[0021]

[0022] Where: μ j is the mean value of the jth attribute; σ j is the standard deviation of the jth attribute;

[0023] Among them, |a ij -μ j >3σ j , then a ij = outlier, otherwise, a kj ≠outlier.

[0024] Furthermore, the calling module is internally provided with submodules, including:

[0025] Logical unit, used to set the number and location of bastion host operation logs retrieved during the module operation phase;

[0026] Among them, when the storage module stores the bastion host operation log, the bastion host operation log is stored in sequence based on time sequence. When the logic unit sets the number and position of the bastion host operation log to be retrieved, it obeys: the bastion host operation log retrieved is always the latest bastion host operation log in the front position, the number of bastion host operation logs retrieved is not less than two groups, and the higher the current usage frequency of the bastion host, the more bastion host operation logs are retrieved, and vice versa, the fewer the number of bastion host operation logs are retrieved.

[0027] Furthermore, the detection module is provided with submodules at the lower level, including:

[0028] A receiving unit, used for receiving the bastion machine operation log forwarded by the calling module to the detection module, distinguishing the bastion machine operation log based on the content type of the bastion machine operation log to obtain the bastion machine operation log set, and sending the bastion machine operation log set to the detection module;

[0029] A recording unit is used to receive the abnormal characteristic value of the bastion host operation state detected by the detection module, mark the abnormal characteristic value of the bastion host operation state by using the corresponding content type of the bastion host operation log set from which the abnormal characteristic value of the bastion host operation state is derived, and record it;

[0030] Among them, the content types of the bastion host operation log are user login information, user operation information, system operation status information, security event information, and system configuration change information. Each set of bastion host operation log sets only contains bastion host operation logs of one content type.

[0031] Furthermore, the abnormal characteristic value of the bastion host operation status is expressed as:

[0032]

[0033] Where: K is the abnormal characteristic value of the bastion host operation status; u is the total content type of the bastion host operation log; k v ω is the abnormal characteristic value of the bastion host operation status represented by the v-type bastion host operation log content; v is the weight;

[0034] Among them, the weight ω v Customized by the system end user and subject to The larger the abnormal characteristic value K of the bastion host operation status is, the higher the bastion host operation risk is.

[0035] Furthermore, the abnormal characteristic value k of the bastion host operation status represented by the v-th type bastion host operation log content v The formula is as follows:

[0036]

[0037] Where: x is the total amount of bastion host operation logs in the v-th type bastion host operation log set; sim(y,y+1) is the similarity between the y-th group of bastion host operation logs and the y+1-th group of bastion host operation logs; a y,i 、b y+1,i is the i-th attribute value in the y-th group of bastion host operation logs and the y+1-th group of bastion host operation logs; max(y i )、min(y i ) is the maximum and minimum attribute values ​​in the running log of the yth group of bastion hosts; max((y+1) i )、min((y+1) i ) are the maximum and minimum attribute values ​​in the y+1th group of bastion host operation logs;

[0038] in, Express Seeking the average.

[0039] Furthermore, when the information corresponding to the i-th attribute value is character information:

[0040]

[0041] Furthermore, the storage module is interactively connected to a cleaning unit via a local area network, the storage module is interactively connected to a retrieval module via a local area network, the retrieval module is interactively connected to a logic unit via a local area network, the retrieval module is interactively connected to a detection module via a local area network, the detection module is interactively connected to a receiving unit and a recording unit at a lower level via a local area network, the receiving unit is interactively connected to the logic unit via a local area network, and the detection module is interactively connected to a visualization module, a determination module and a feedback module via a local area network.

[0042] Compared with the known public technology, the technical solution provided by the present invention has the following beneficial effects:

[0043] The present invention provides a bastion host security protection system based on intelligent risk identification. During operation, the system obtains historical operation logs of the bastion host, performs data cleaning on the historical operation logs of the bastion host to obtain high-value reference logs, further conducts comprehensive analysis based on the cleaned historical operation logs of the bastion host, performs digital detection on abnormalities in the operation status of the bastion host, and finally creates a trend graph based on the monitoring results. According to the trend graph trend identification, the current operation status of the bastion host is judged to be safe, thereby providing the bastion host with effective and relatively accurate predictive fault and risk monitoring and protection effects. BRIEF DESCRIPTION OF THE DRAWINGS

[0044] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the prior art descriptions are briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention, and for ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0045] Figure 1 The figure is a schematic diagram of the structure of a bastion host security protection system based on intelligent risk identification. DETAILED DESCRIPTION

[0046] In order to make the purpose, technical solution and advantages of the embodiments of the present invention clearer, the technical solution in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0047] The present invention will be further described below in conjunction with the embodiments.

[0048] Embodiment 1:

[0049] A bastion host security protection system based on intelligent risk identification in this embodiment, such as Figure 1 As shown, including:

[0050] The storage module is used to retrieve the bastion host operation log in real time and store the bastion host operation log;

[0051] The storage module is internally provided with submodules, including:

[0052] A cleaning unit, used to traverse the bastion host operation logs stored in each storage interval in the storage module, and perform data cleaning on the bastion host operation logs;

[0053] The cleaning unit is equipped with data cleaning logic. The cleaning unit cleans the bastion host operation log based on the cleaning logic. The cleaning logic is expressed as follows:

[0054]

[0055] Where: is the i-th log after cleaning; is the mth attribute value of the ith log after cleaning; is the jth attribute value of the ith log after cleaning; n is the total number of logs; a kj is the jth attribute value of the kth log in the original log; ΙΙ(·) is the indicator function;

[0056] Among them, each bastion host operation log is cleaned based on the above formula to output the cleaned bastion host operation log;

[0057] The indicator function ΙΙ(·) obeys. When the formula in the brackets is true, ΙΙ(·)=1, otherwise, ΙΙ(·)=0. The formula in the brackets is established, which means it is judged to be true;

[0058] outlier is the outlier value, and null is the null value;

[0059]

[0060] Where: μ j is the mean value of the jth attribute; σ j is the standard deviation of the jth attribute;

[0061] Among them, |a ij -μ j >3σ j , then a ij = outlier, otherwise, a kj ≠outlier;

[0062] The retrieval module is used to retrieve the bastion host operation log in the storage module and forward the retrieved bastion host operation log to the detection module;

[0063] The calling module has submodules inside, including:

[0064] Logical unit, used to set the number and location of bastion host operation logs retrieved during the module operation phase;

[0065] Among them, when the storage module stores the bastion host operation log, the bastion host operation log is stored in sequence based on the time sequence. When the logic unit sets the number and position of the bastion host operation log to be retrieved, it complies with the following: the bastion host operation log retrieved is always the latest bastion host operation log in the front position, the number of bastion host operation logs retrieved is not less than two groups, and the higher the current use frequency of the bastion host, the more bastion host operation logs are retrieved, and vice versa, the fewer the number of bastion host operation logs are retrieved;

[0066] The detection module is used to obtain the bastion host operation log fed back by the calling module, and detect the abnormal characteristic value of the bastion host operation status based on the bastion host operation log;

[0067] The detection module is provided with submodules at the lower level, including:

[0068] A receiving unit, used for receiving the bastion machine operation log forwarded by the calling module to the detection module, distinguishing the bastion machine operation log based on the content type of the bastion machine operation log to obtain the bastion machine operation log set, and sending the bastion machine operation log set to the detection module;

[0069] A recording unit is used to receive the abnormal characteristic value of the bastion host operation state detected by the detection module, mark the abnormal characteristic value of the bastion host operation state by using the corresponding content type of the bastion host operation log set from which the abnormal characteristic value of the bastion host operation state is derived, and record it;

[0070] Among them, the content types of the bastion host operation log are user login information, user operation information, system operation status information, security event information, and system configuration change information. Each set of bastion host operation log sets only contains bastion host operation logs of one content type;

[0071] The abnormal characteristic value of the bastion host operation status is expressed as:

[0072]

[0073] Where: K is the abnormal characteristic value of the bastion host operation status; u is the total content type of the bastion host operation log; k v ω is the abnormal characteristic value of the bastion host operation status represented by the v-type bastion host operation log content; v is the weight;

[0074] Among them, the weight ω v Customized by the system end user and subject to The larger the abnormal characteristic value K of the bastion host's operating status, the higher the bastion host's operating risk;

[0075] Abnormal characteristic value k of the bastion host operation status represented by the v-type bastion host operation log content v The formula is as follows:

[0076]

[0077] Where: x is the total amount of bastion host operation logs in the v-th type bastion host operation log set; sim(y,y+1) is the similarity between the y-th group of bastion host operation logs and the y+1-th group of bastion host operation logs; a y,i 、b y+1,i is the i-th attribute value in the y-th group of bastion host operation logs and the y+1-th group of bastion host operation logs; max(y i )、min(y i ) is the maximum and minimum attribute values ​​in the running log of the yth group of bastion hosts; max((y+1) i )、min((y+1) i) are the maximum and minimum attribute values ​​in the y+1th group of bastion host operation logs;

[0078] in, Express ;

[0079] When the information corresponding to the i-th attribute value is character information:

[0080]

[0081] A visualization module is used to continuously receive the abnormal characteristic values ​​of the bastion host operation status detected in the monitoring module, and create a change trend chart of the abnormal characteristic values ​​of the bastion host operation status based on the abnormal characteristic values ​​of the bastion host operation status;

[0082] A determination module is used to traverse the change trend graph and determine whether the bastion host is running safely based on the change trend graph;

[0083] The feedback module is used to receive the judgment result of whether the bastion host is running safely in the judgment module, and output the judgment result when the judgment result is yes, and output the judgment result together with the change trend graph when the judgment result is no;

[0084] When the line representing the abnormal characteristic value of the bastion host's operating status in the change trend graph rises three times in a row, the judgment module determines that the bastion host is operating unsafely, otherwise, it is determined that the bastion host is operating safely. The feedback target of the feedback module is any mobile computer device with a graphic display function held by the system end user;

[0085] The storage module is interactively connected to a cleaning unit through a local area network, the storage module is interactively connected to a retrieval module through a local area network, the retrieval module is interactively connected to a logic unit through a local area network, the retrieval module is interactively connected to a detection module through a local area network, the detection module is interactively connected to a receiving unit and a recording unit through a local area network, the receiving unit is interactively connected to the logic unit through the local area network, and the detection module is interactively connected to a visualization module, a judgment module and a feedback module through the local area network.

[0086] In this embodiment, the storage module runs to retrieve the bastion host operation log in real time and stores the bastion host operation log. The cleaning unit synchronously traverses the bastion host operation logs stored in each partitioned storage interval in the storage module and performs data cleaning on the bastion host operation log. The retrieval module runs in the storage module to retrieve the bastion host operation log and forwards the retrieved bastion host operation log to the detection module. The logic unit synchronously sets the number and position of the bastion host operation log retrieved during the operation phase of the retrieval module. The detection module then obtains the bastion host operation log fed back by the retrieval module and detects the bastion host operation state mutation characteristic value based on the bastion host operation log. The receiving unit synchronously receives the bastion host operation log forwarded by the retrieval module to the detection module, differentiates the bastion host operation log based on the content type of the bastion host operation log to obtain the bastion host operation log set, and sends the bastion host operation log set to the detection module. The recording unit receives the bastion host operation state mutation characteristic value detected by the detection module in real time, and applies the corresponding content type of the bastion host operation log set from which the bastion host operation state mutation characteristic value is derived to mark the bastion host operation state mutation characteristic value and record it.

[0087] Then, the visualization module continuously receives the abnormal characteristic values ​​of the bastion host operation status detected in the monitoring module, and creates a change trend graph of the abnormal characteristic values ​​of the bastion host operation status based on the abnormal characteristic values ​​of the bastion host operation status. The judgment module further traverses the change trend graph, and judges whether the bastion host operation is safe based on the change trend graph. Finally, the feedback module receives the judgment result of whether the bastion host operation is safe in the judgment module. When the judgment result is yes, the judgment result is output, and when the judgment result is no, the judgment result is output synchronously with the change trend graph.

[0088] Based on the operation of the above system, the bastion host has effective predictive fault and security risk monitoring and protection effects, ensuring the long-term and stable operation of the bastion host;

[0089] On the other hand, during the operation of the system, the bastion host operation log is cleaned through a limited data cleaning logic formula to ensure that effective bastion host operation logs with reference value can be screened for subsequent bastion host security detection. In the bastion host security detection, the digital bastion host operation status variation characteristic value is calculated to determine the safety of the bastion host operation status, which effectively improves the readability and convenience of the bastion host operation status security monitoring process.

[0090] Embodiment 2:

[0091] In terms of specific implementation, based on Example 1, this example refers to Figure 1 The following is a further detailed description of a bastion host security protection system based on intelligent risk identification in Example 1:

[0092] The bastion host operation log content retrieved from the storage module includes: user login information, user operation information, system operation status information, security event information, and system configuration change information. When the storage module stores the bastion host operation log, it differentiates the storage based on the bastion host operation log content type, so that each type of bastion host operation log content is stored in the same differentiated storage interval.

[0093] Through the above settings, the specific content type of the bastion host operation log is further limited, and the storage logic of the storage module for the bastion host operation log is limited, providing necessary operation data support for subsequent model operations in the system in Example 1.

[0094] In summary, during operation, the system in the above embodiment obtains the historical operation logs of the bastion host, cleans the historical operation logs of the bastion host to obtain high-value reference logs, further conducts comprehensive analysis based on the cleaned historical operation logs of the bastion host, and digitally detects changes in the operating status of the bastion host. Finally, a trend chart is created based on the monitoring results, and the current operating status of the bastion host is determined to be safe based on the trend chart trend identification, which brings effective and relatively accurate predictive fault and risk monitoring and protection effects to the bastion host.

[0095] The above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit the same. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that the technical solutions described in the aforementioned embodiments may still be modified, or some of the technical features may be replaced by equivalents. Such modifications or replacements will not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A bastion host security protection system based on intelligent risk identification, characterized in that: include: The storage module is used to retrieve the bastion host operation log in real time and store the bastion host operation log; A retrieval module is used to retrieve the bastion host operation log in the storage module and forward the retrieved bastion host operation log to the detection module; The detection module is used to obtain the bastion host operation log fed back by the calling module, and detect the abnormal characteristic value of the bastion host operation status based on the bastion host operation log; A visualization module is used to continuously receive the abnormal characteristic values ​​of the bastion host operation status detected by the detection module, and create a change trend chart of the abnormal characteristic values ​​of the bastion host operation status based on the abnormal characteristic values ​​of the bastion host operation status; A determination module is used to traverse the change trend graph and determine whether the bastion host is running safely based on the change trend graph; The feedback module is used to receive the judgment result of whether the bastion host is running safely in the judgment module, and output the judgment result when the judgment result is yes, and output the judgment result together with the change trend graph when the judgment result is no; Among them, when the line representing the abnormal characteristic value of the bastion host's operating status in the change trend graph rises three times in a row, the judgment module determines that the bastion host is operating unsafely, otherwise, it is determined that the bastion host is operating safely. The feedback target of the feedback module is any mobile computer device with graphic display function held by the system end user.

2. According to the bastion host security protection system based on intelligent risk identification according to claim 1, it is characterized in that: The bastion host operation log content retrieved in the storage module includes: user login information, user operation information, system operation status information, security event information, and system configuration change information. When the storage module stores the bastion host operation log, it differentiates the storage based on the bastion host operation log content type, so that each type of bastion host operation log content is stored in the same differentiated storage interval.

3. According to the bastion host security protection system based on intelligent risk identification according to claim 2, it is characterized in that: The storage module is internally provided with submodules, including: A cleaning unit, used for traversing the bastion host operation logs stored in each storage interval in the storage module, and performing data cleaning on the bastion host operation logs; The cleaning unit is provided with data cleaning logic, and the cleaning unit cleans the bastion machine operation log based on the cleaning logic. The cleaning logic is expressed as: Where: is the i-th log after cleaning; is the mth attribute value of the ith log after cleaning; is the jth attribute value of the ith log after cleaning; n is the total number of logs; a kj is the jth attribute value of the kth log in the original log; ΙΙ(·) is the indicator function; Among them, each bastion host operation log is cleaned based on the above formula to output the cleaned bastion host operation log.

4. According to the bastion host security protection system based on intelligent risk identification according to claim 3, it is characterized in that: The indicator function ΙΙ(·) obeys, when the formula in the bracket is true, then ΙΙ(·)=1, otherwise, then ΙΙ(·)=0, the formula in the bracket is established, that is, it is judged to be true; The outlier is an outlier value, and null is a null value; Where: μ j is the mean value of the jth attribute; σ j is the standard deviation of the jth attribute; Among them, |a ij -μ j >3σ j , then a ij = outlier, otherwise, a kj ≠outlier.

5. According to the bastion host security protection system based on intelligent risk identification according to claim 1, it is characterized in that: The calling module is internally provided with submodules, including: Logical unit, used to set the number and location of bastion host operation logs retrieved during the module operation phase; Among them, when the storage module stores the bastion host operation log, the bastion host operation log is stored in sequence based on time sequence. When the logic unit sets the number and position of the bastion host operation log to be retrieved, it obeys: the bastion host operation log retrieved is always the latest bastion host operation log in the front position, the number of bastion host operation logs retrieved is not less than two groups, and the higher the current usage frequency of the bastion host, the more bastion host operation logs are retrieved, and vice versa, the fewer the number of bastion host operation logs are retrieved.

6. According to the bastion host security protection system based on intelligent risk identification according to claim 1, it is characterized in that: The detection module is provided with submodules at the lower level, including: A receiving unit, used for receiving the bastion machine operation log forwarded by the calling module to the detection module, distinguishing the bastion machine operation log based on the content type of the bastion machine operation log to obtain the bastion machine operation log set, and sending the bastion machine operation log set to the detection module; A recording unit is used to receive the abnormal characteristic value of the bastion host operation state detected by the detection module, mark the abnormal characteristic value of the bastion host operation state by using the corresponding content type of the bastion host operation log set from which the abnormal characteristic value of the bastion host operation state is derived, and record it; Among them, the content types of the bastion host operation log are user login information, user operation information, system operation status information, security event information, and system configuration change information. Each set of bastion host operation log sets only contains bastion host operation logs of one content type.

7. According to claim 6, a bastion host security protection system based on intelligent risk identification is characterized in that: The abnormal characteristic value of the bastion host operation status is expressed as: Where: K is the abnormal characteristic value of the bastion host operation status; u is the total content type of the bastion host operation log; k v ω is the abnormal characteristic value of the bastion host operation status represented by the v-type bastion host operation log content; v is the weight; Among them, the weight ω v Customized by the system end user and subject to The larger the abnormal characteristic value K of the bastion host operation status is, the higher the bastion host operation risk is.

8. According to claim 7, a bastion host security protection system based on intelligent risk identification is characterized in that: The abnormal characteristic value k of the bastion host operation status represented by the v-th type bastion host operation log content v The formula is as follows: Where: x is the total amount of bastion host operation logs in the v-th type bastion host operation log set; sim(y,y+1) is the similarity between the y-th group of bastion host operation logs and the y+1-th group of bastion host operation logs; a y,i , b y+1,i is the i-th attribute value in the y-th group of bastion host operation logs and the y+1-th group of bastion host operation logs; max(y i )、min(y i ) is the maximum and minimum attribute values ​​in the running log of the yth group of bastion hosts; max((y+1) i )、min((y+1) i ) are the maximum and minimum attribute values ​​in the y+1th group of bastion host operation logs; in, Express Seeking average.

9. A bastion host security protection system based on intelligent risk identification according to claim 8, characterized in that: When the information corresponding to the i-th attribute value is character information:

10. According to claim 1, a bastion host security protection system based on intelligent risk identification is characterized in that: The storage module is interactively connected to a cleaning unit via a local area network, the storage module is interactively connected to a retrieval module via a local area network, the retrieval module is interactively connected to a logic unit via a local area network, the retrieval module is interactively connected to a detection module via a local area network, the detection module is interactively connected to a receiving unit and a recording unit at a lower level via a local area network, the receiving unit is interactively connected to the logic unit via a local area network, and the detection module is interactively connected to a visualization module, a determination module and a feedback module via a local area network.

Images