Protection mode management method and device, equipment and storage medium

Abstract

The embodiment of the invention discloses a protection mode management method and device, equipment and a storage medium, and the method comprises the steps: obtaining the operation information of a plurality of to-be-managed applications in a target delivery platform; for each to-be-managed application, determining a target protection mode according to the operation information corresponding to the to-be-managed application; wherein the target protection mode is an unvarnished transmission mode, a monitoring mode or an interception mode; and monitoring consumption resources of a to-be-managed application based on the target protection mode to complete a protection mode management process for the to-be-managed application. According to the technical scheme, the problem that in the prior art, a static or fixed protection mode is mostly adopted in a delivery platform, and dynamic security threats cannot be achieved in time is solved, the corresponding protection mode can be dynamically adjusted according to the operation information of the application, and the information security of the delivery platform is improved.

Description

Technical Field

[0001] Embodiments of the present invention relate to the technical field of delivery platform security management, and in particular, to a protection mode management method, device, equipment and storage medium. Background Art

[0002] With the rapid development of information technology and the widespread popularity of Internet applications, the new generation of delivery platforms, as an important part of the modern logistics system, bears the task of transmitting and processing massive amounts of data. The security and stability of their operating status are directly related to the normal progress of social and economic activities and the vital interests of the majority of users. However, with the increasing complexity of the network environment and the continuous upgrading of hacker attack methods, the static or fixed protection mode adopted by traditional logistics platforms can no longer meet the current security protection needs. These strategies often fail to respond to and effectively deal with emerging security threats in a timely manner, resulting in the platform facing serious risks such as data leakage and service interruption. Summary of the invention

[0003] The embodiments of the present invention provide a protection mode management method, apparatus, device and storage medium, which can dynamically adjust the corresponding protection mode according to the operation information of the application, thereby improving the information security of the delivery platform.

[0004] In a first aspect, an embodiment of the present invention provides a protection mode management method, the method comprising:

[0005] Obtain the operating information of multiple applications to be managed in the target delivery platform; for each application to be managed, determine the target protection mode according to the corresponding operating information of the application to be managed; wherein the target protection mode is a transparent mode, a monitoring mode or an interception mode; based on the target protection mode, monitor the consumed resources of the application to be managed to complete the protection mode management process for the application to be managed.

[0006] In a second aspect, an embodiment of the present invention provides a protection mode management device, the device comprising:

[0007] An operation information acquisition module is used to obtain the operation information of multiple applications to be managed in the target delivery platform; a protection mode determination module is used to determine the target protection mode for each application to be managed according to the operation information corresponding to the application to be managed; wherein the target protection mode is a transparent mode, a monitoring mode or an interception mode; an application security management module is used to monitor the consumed resources of the application to be managed based on the target protection mode to complete the protection mode management process for the application to be managed.

[0008] In a third aspect, an embodiment of the present invention provides a computer device, the computer device comprising:

[0009] one or more processors;

[0010] A memory for storing one or more programs;

[0011] When the one or more programs are executed by the one or more processors, the one or more processors implement the protection mode management method described in any embodiment.

[0012] In a fourth aspect, an embodiment of the present invention provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the protection mode management method described in any embodiment.

[0013] The technical solution provided by the embodiment of the present invention obtains the operating information of multiple applications to be managed in the target delivery platform; for each application to be managed, determines the target protection mode according to the corresponding operating information of the application to be managed; wherein the target protection mode is a transparent mode, a monitoring mode or an interception mode; based on the target protection mode, monitors the consumed resources of the application to be managed to complete the protection mode management process for the application to be managed. The technical solution of the embodiment of the present invention solves the problem that the delivery platform in the prior art mostly adopts static or fixed protection modes and cannot respond to dynamic security threats in a timely manner. The corresponding protection mode can be dynamically adjusted according to the operating information of the application, thereby improving the information security of the delivery platform. BRIEF DESCRIPTION OF THE DRAWINGS

[0014] Figure 1 is a flow chart of a protection mode management method provided by an embodiment of the present invention;

[0015] Figure 2 It is a flow chart of another protection mode management method provided by an embodiment of the present invention;

[0016] Figure 3 This is a workflow diagram for performing protection mode management provided by an embodiment of the present invention;

[0017] Figure 4 It is a structural diagram of a protection mode management device provided by an embodiment of the present invention;

[0018] Figure 5 It is a structural schematic diagram of a computer device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0019] In order to make the purpose, technical solution and advantages of the embodiments of the present invention clearer, the technical solution in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0020] Figure 1 It is a flow chart of a protection mode management method provided by an embodiment of the present invention. The embodiment of the present invention can be applied to the scenario of adjusting the protection mode applied in the delivery platform. The method can be executed by a protection mode management device, and the device can be implemented by software and / or hardware.

[0021] like Figure 1 As shown, the protection mode management method includes the following steps:

[0022] S110. Obtaining operation information of multiple applications to be managed in the target delivery platform.

[0023] Among them, the target delivery platform may be a delivery platform that needs to be managed securely. Specifically, the target delivery platform may be selected manually. Exemplarily, the target delivery platform may be determined by obtaining a selection instruction about the delivery platform. The application to be managed may be an application in the target delivery platform that needs to be managed in protection mode. Exemplarily, all applications in the target delivery platform may be used as applications to be managed, or a certain number of applications may be selected from the target delivery platform as applications to be managed according to the selection instruction. Among them, the managed applications include but are not limited to web applications, app applications, mini-programs and other types.

[0024] Furthermore, the operation information may be information used to indicate the working operation status of the application to be managed. Optionally, the operation information includes at least one of: access address, source IP, access parameter, access path, return status, current CPU load, current disk usage, current application protection mode, and exception hit rule. Exemplarily, the operation information of each application to be managed may be obtained separately.

[0025] S120. For each application to be managed, determine a target protection mode according to operation information corresponding to the application to be managed.

[0026] The target protection mode can be a mode for protecting the data security of the managed application. Specifically, the target protection mode is a transparent transmission mode, a monitoring mode or an interception mode. The transparent transmission mode only forwards traffic, consuming less resources such as CPU and disk; the monitoring mode only monitors the passing traffic; the interception mode intercepts the passing traffic, and can intercept the traffic that does not meet the requirements in a targeted manner through parameter adjustment, regular expressions, etc.

[0027] Furthermore, the operation information corresponding to each application to be managed may be analyzed to determine the risk level corresponding to the operation information, and then the target protection mode corresponding to each application to be managed may be determined based on the risk level.

[0028] S130: Monitoring the consumed resources of the application to be managed based on the target protection mode to complete the protection mode management process for the application to be managed.

[0029] Among them, after determining the target protection mode of the target application, the consumption resources of the managed application can be monitored based on the protection mechanism of the target protection mode. For example, when the target protection mode is the transparent mode, only the traffic of the target application can be forwarded; when the target protection mode is the monitoring mode, the traffic passing through the target application can be monitored; when the target protection mode is the interception mode, only the traffic passing through the target application can be intercepted, and the traffic that does not meet the requirements can be intercepted in a targeted manner through parameter adjustment, regular expressions, etc.

[0030] The technical solution provided by the embodiment of the present invention obtains the operating information of multiple applications to be managed in the target delivery platform; for each application to be managed, determines the target protection mode according to the corresponding operating information of the application to be managed; wherein the target protection mode is a transparent mode, a monitoring mode or an interception mode; based on the target protection mode, monitors the consumed resources of the application to be managed to complete the protection mode management process for the application to be managed. The technical solution of the embodiment of the present invention solves the problem that the delivery platform in the prior art mostly adopts static or fixed protection modes and cannot respond to dynamic security threats in a timely manner. The corresponding protection mode can be dynamically adjusted according to the operating information of the application, thereby improving the information security of the delivery platform.

[0031] Figure 2 It is another protection mode management method flow chart provided by an embodiment of the present invention. The embodiment of the present invention can be applied to the scenario of adjusting the protection mode of applications in the delivery platform. Based on the above embodiment, this embodiment further illustrates how to determine the target protection mode according to the operating information corresponding to the application to be managed. The device can be implemented by software and / or hardware and integrated in a computer device with application development function.

[0032] like Figure 2 As shown, the protection mode management method includes the following steps:

[0033] S210. Obtaining operation information of multiple applications to be managed in the target delivery platform.

[0034] Among them, the target delivery platform may be a delivery platform that needs to be managed securely. Specifically, the target delivery platform may be selected manually. Exemplarily, the target delivery platform may be determined by obtaining a selection instruction about the delivery platform. The application to be managed may be an application in the target delivery platform that needs to be managed in protection mode. Exemplarily, all applications in the target delivery platform may be used as applications to be managed, or a certain number of applications may be selected from the target delivery platform as applications to be managed according to the selection instruction. Among them, the managed applications include but are not limited to web applications, app applications, mini-programs and other types.

[0035] Furthermore, the operation information may be information used to indicate the working operation status of the application to be managed. Optionally, the operation information includes at least one of: access address, source IP, access parameter, access path, return status, current CPU load, current disk usage, current application protection mode, and exception hit rule. Exemplarily, the operation information of each application to be managed may be obtained separately.

[0036] S220: For each application to be managed, input the operation information of the application to be managed into a target operation information monitoring model to obtain a target threat type corresponding to the operation information.

[0037] Among them, the operation information detection model can be a model for detecting the degree of abnormality of data in the operation information. The target threat type can be a type used to represent the degree of danger of abnormal data in the operation information. By inputting the operation information of the application to be managed into the operation information detection model, the model can detect the abnormal data in the operation information and output the corresponding target threat type according to the detection result. Specifically, the target threat type may include: normal type, abnormal type and high-risk type. The order of the danger levels of the three from high to low is: high-risk type, abnormal type and normal type.

[0038] S230. Determine a target protection mode of the application to be managed according to the target threat type.

[0039] Among them, the target protection mode can be a mode for protecting the data security of the application to be managed. Specifically, the target protection mode is a transparent transmission mode, a monitoring mode or an interception mode. Among them, the transparent transmission mode only forwards traffic, consuming less resources such as CPU and disk; the monitoring mode only monitors the passing traffic; the interception mode intercepts the passing traffic, and can intercept the traffic that does not meet the requirements in a targeted manner through parameter adjustment, regular expressions, etc. Furthermore, the target protection mode corresponding to the application to be managed can be determined according to the target danger type of the application to be managed.

[0040] Exemplarily, determining the target protection mode of the application to be managed according to the target threat type includes: when the target threat type is a normal type, determining the target protection mode to be the transparent mode; when the target threat type is an abnormal type, determining the target protection mode to be the monitoring mode; when the target threat type is a high-risk type, determining the target protection mode to be the interception mode.

[0041] Optionally, after determining the target protection mode of the application to be managed according to the target threat type, it also includes: displaying the application to be managed and the target protection mode of the application to be managed on a preset interactive interface; determining a mode confirmation result based on the interactive instructions on the preset interactive interface; and when the mode confirmation result is a non-confirmation result, using the protection mode corresponding to the non-confirmation result as the target protection mode of the application to be managed.

[0042] Among them, the preset interactive interface can be a preset interface for information interaction. By displaying the application to be managed and the target protection mode corresponding to the application to be managed on the preset interactive interface, the user can confirm the target protection mode of the application to be managed through the preset interactive interface. Exemplarily, the user can issue an interactive instruction about the protection mode of the application to be managed by clicking or manually inputting. Further, the device can determine the mode confirmation result according to the interactive instruction. Among them, the mode confirmation result includes a non-confirmation result and a confirmed result. Among them, the mode confirmation result indicates that the user has no objection to the target protection mode corresponding to the application to be managed. Therefore, when the mode confirmation result is a confirmed result, there is no need to adjust the target protection mode of the application to be managed determined above. And when the mode confirmation result is a non-confirmation result, it means that the user has an objection to the target protection mode of the application to be managed. Specifically, when the mode confirmation result is a non-confirmation result, the protection mode corresponding to the non-confirmation result can be used as the target protection mode of the application to be managed.

[0043] Optionally, for each of the applications to be managed, the current running information of the application to be managed is obtained at preset intervals; a new update mode corresponding to the application to be managed is determined based on the current running information; and when the new update mode is inconsistent with the current protection mode of the application to be managed, the current protection mode of the application to be managed is adjusted.

[0044] Among them, the preset period can be a preset period for updating the protection mode of the application to be managed. The current operation information can be information about the operating status of the application to be managed in the current state. The new update mode can be the protection mode corresponding to the current operation information. Exemplarily, the current application information can also be input into the operation information detection model to determine the threat type corresponding to the current operation information, and then determine the corresponding protection mode according to the threat type of the current operation information, and use the determined protection mode as the new update mode.

[0045] Furthermore, the current protection mode may be a protection mode executed by the application to be managed in the current state. Specifically, the new update mode may be compared with the current protection mode. When the new update mode is inconsistent with the current protection mode, the new update mode may be used as the current protection mode of the application to be managed. When the new protection mode is consistent with the current protection mode, there is no need to adjust the current protection mode of the application to be managed. The technical solution of the embodiment of the present invention can update the protection mode of the management application at preset intervals, so that the protection mode of the application to be managed can be adjusted to meet the security protection needs in the current state, thereby improving the data security of the application to be managed.

[0046] Optionally, when a mode update instruction is received, the target application is determined according to the mode update instruction; for each target application, the operating information of the target application is obtained, the next protection mode is determined based on the operating information of the target application, and the current protection mode of the target application is adjusted to the next protection mode.

[0047] Among them, the mode update instruction may be a request instruction for updating the protection mode. Exemplarily, the user may send a mode update instruction to the device as needed, so that the device can update the protection mode of the application corresponding to the instruction based on the mode update instruction. The target application may be an application that needs to update the protection mode. Specifically, multiple applications may be selected from the applications to be managed according to the mode update instruction, and the selected applications may be the target applications. Furthermore, the next protection mode may be the protection mode required to be used in the next stage corresponding to the target application. Exemplarily, the current operation information of the target application may be obtained, and the threat type may be determined based on the current operation information, and then the corresponding protection mode may be determined based on the threat type, and the determined protection mode may be used as the next protection mode. Finally, the current protection mode of the target application may be adjusted to the next protection mode.

[0048] S240: Monitor the consumed resources of the application to be managed based on the target protection mode to complete the protection mode management process for the application to be managed.

[0049] After determining the target protection mode of the target application, the consumed resources of the application to be managed can be monitored based on the protection mechanism of the target protection mode.

[0050] For example, in order to better understand the technical solution provided by the present invention, a specific embodiment is introduced below: Figure 3 FIG. 1 is a flowchart of a protection mode management process provided by an embodiment of the present invention. Figure 3 As shown:

[0051] (1) Real-time monitoring module: responsible for monitoring various operating data of the new generation delivery platform, including its operating status, load conditions, traffic patterns and other real-time information, providing basic data support for security analysis.

[0052] (2) Security Analysis Module: This module uses big data analysis and artificial intelligence algorithms to conduct machine learning and intelligent analysis on real-time monitoring data to identify potential security threats and abnormal behavior patterns.

[0053] (3) Policy decision module: Based on the output results of the security analysis engine, combined with the preset protection mode and the current platform operation status, it automatically makes decisions and generates new protection modes.

[0054] (4) Policy execution module: After confirmation, it is responsible for adjusting the protection mode of the dynamic protection platform, that is, deploying a new protection mode to achieve timely response and effective defense against potential threats.

[0055] As mentioned above Figure 3As shown in the figure, in response to the shortcomings of traditional logistics platforms, the present invention proposes a method for adaptively adjusting the protection mode based on the operating status of a new generation of delivery platforms, which aims to overcome the shortcomings of traditional static or fixed protection modes in dealing with complex network environments by real-time monitoring of the platform's operating status, dynamically analyzing security threats, and automatically adjusting the protection mode. This method not only improves the platform's security protection capabilities, but also achieves efficient resource utilization and optimized cost control.

[0056] In combination with the above technical solutions, the present invention describes the technical effects achieved in terms of dynamic adaptability, precise defense capability, resource optimization and cost control, and cross-platform collaboration capability:

[0057] (1) Improved dynamic adaptability: Traditional protection modes often use static or fixed configurations, which make it difficult to quickly adapt to real-time changes in the operating status of the delivery platform and emerging security threats. The present invention introduces a real-time monitoring and intelligent analysis mechanism. By continuously monitoring the platform's operating data, using big data analysis and artificial intelligence algorithms, it dynamically evaluates the security situation and automatically adjusts the protection mode accordingly. This significantly improves the flexibility and adaptability of the protection mode, ensuring that the platform can quickly respond to emerging security threats, solving the problem that traditional static strategies cannot respond to emerging threats in a timely manner, and reducing the probability of security incidents.

[0058] (2) Enhanced precision defense capabilities: Traditional security defense measures often have high false alarm rates and low false alarm rates when facing complex and changeable network attacks, which affects the defense effect. The present invention uses machine learning and other related algorithms to further mine and intelligently analyze the collected data, thereby improving the accuracy of threat identification, the pertinence of defense, and the intelligence of strategy adjustment, further reducing false alarms and false alarms, achieving accurate identification and effective defense of potential threats, and improving the overall security protection level.

[0059] (3) Resource optimization and cost control: Traditional protection models often lack flexibility in resource allocation, resulting in resource waste or insufficient protection of key systems. The present invention intelligently adjusts the allocation of security resources based on real-time threat assessment and platform operation status to ensure efficient use of resources. By optimizing resource allocation, operating costs are reduced while ensuring the security of key systems and data.

[0060] (4) Enhanced cross-platform collaboration capabilities: Traditional protection models are often limited to a single platform, making it difficult to achieve collaborative protection with other systems. The present invention builds a cross-platform security collaboration framework, which collaboratively manages the protection models of other systems (such as e-commerce platforms, payment systems, etc.) at the application level and incorporates them into a unified protection category, breaking the island effect of traditional protection models, improving the collaboration and consistency of overall security protection, and enhancing the security and stability of the entire delivery ecosystem.

[0061] (5) Process optimization: Automated and efficient process design reduces manual intervention such as identification and processing, and improves the speed and accuracy of protection mode adjustment.

[0062] The technical solution provided by the embodiment of the present invention obtains the operating information of multiple applications to be managed in the target delivery platform; for each application to be managed, the operating information of the application to be managed is input into the target operating information monitoring model to obtain the target threat type corresponding to the operating information; the target protection mode of the application to be managed is determined according to the target threat type; and the consumed resources of the application to be managed are monitored based on the target protection mode to complete the protection mode management process for the application to be managed. The technical solution of the embodiment of the present invention solves the problem that the delivery platform in the prior art mostly adopts static or fixed protection modes and cannot timely respond to dynamic security threats. The corresponding protection mode can be dynamically adjusted according to the operating information of the application, thereby improving the information security of the delivery platform.

[0063] Figure 4 It is a structural diagram of a protection mode management device provided by an embodiment of the present invention. The embodiment of the present invention can be applied to the scenario of adjusting the protection mode of applications in the delivery platform. The device can be implemented by software and / or hardware and integrated into a computer device with application development function.

[0064] like Figure 4 As shown, the protection mode management device includes: an operation information acquisition module 310, a protection mode determination module 320 and an application security management module 330.

[0065] Among them, the operation information acquisition module 310 is used to obtain the operation information of multiple applications to be managed in the target delivery platform; the protection mode determination module 320 is used to determine the target protection mode for each application to be managed according to the operation information corresponding to the application to be managed; wherein the target protection mode is a transparent mode, a monitoring mode or an interception mode; the application security management module 330 is used to monitor the consumed resources of the application to be managed based on the target protection mode to complete the protection mode management process for the application to be managed.

[0066] The technical solution provided by the embodiment of the present invention obtains the operating information of multiple applications to be managed in the target delivery platform; for each application to be managed, determines the target protection mode according to the corresponding operating information of the application to be managed; wherein the target protection mode is a transparent mode, a monitoring mode or an interception mode; based on the target protection mode, monitors the consumed resources of the application to be managed to complete the protection mode management process for the application to be managed. The technical solution of the embodiment of the present invention solves the problem that the delivery platform in the prior art mostly adopts static or fixed protection modes and cannot respond to dynamic security threats in a timely manner. The corresponding protection mode can be dynamically adjusted according to the operating information of the application, thereby improving the information security of the delivery platform.

[0067] In an optional implementation, the protection mode determination module 320 is specifically used to: input the operation information of the application to be managed into the target operation information monitoring model to obtain the target threat type corresponding to the operation information; and determine the target protection mode of the application to be managed according to the target threat type.

[0068] In an optional embodiment, the protection mode determination module 320 includes: a target protection mode determination unit, used to: when the target threat type is a normal type, determine the target protection mode as the transparent transmission mode; when the target threat type is an abnormal type, determine the target protection mode as the monitoring mode; when the target threat type is a high-risk type, determine the target protection mode as the interception mode.

[0069] In an optional embodiment, the protection mode management device also includes: a protection mode confirmation module, which is used to: display the application to be managed and the target protection mode of the application to be managed on a preset interactive interface; determine the mode confirmation result based on the interactive instructions on the preset interactive interface; and when the mode confirmation result is a non-confirmation result, use the protection mode corresponding to the non-confirmation result as the target protection mode of the application to be managed.

[0070] In an optional embodiment, the protection mode management device also includes: a protection mode period adjustment module, which is used to: for each of the applications to be managed, obtain the current operation information of the application to be managed at intervals of a preset period; determine a new update mode corresponding to the application to be managed based on the current operation information; and adjust the current protection mode of the application to be managed when the new update mode is inconsistent with the current protection mode of the application to be managed.

[0071] In an optional embodiment, the protection mode management device also includes: a protection mode update module, which is used to: determine the target application according to the mode update instruction when a mode update instruction is received; for each target application, obtain the running information of the target application, determine the next protection mode based on the running information of the target application, and adjust the current protection mode of the target application to the next protection mode.

[0072] In an optional implementation, the operation information includes: at least one of access address, source IP, access parameters, access path, return status, current CPU load, current disk usage, current application protection mode, and exception hit rules.

[0073] The protection mode management device provided in the embodiment of the present invention can execute the protection mode management method provided in any embodiment of the present invention, and has the corresponding functional modules and beneficial effects of the execution method.

[0074] Figure 5 A schematic diagram of the structure of a computer device provided in an embodiment of the present invention. Figure 5 A block diagram of an exemplary computer device 12 suitable for use in implementing embodiments of the present invention is shown. Figure 5 The computer device 12 shown is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present invention. The computer device 12 can be any terminal device with computing capability and can be configured in the protection mode management device.

[0075] like Figure 5 As shown, the computer device 12 is in the form of a general-purpose computing device. The components of the computer device 12 may include, but are not limited to: one or more processors or processing units 16, a system memory 28, and a bus 18 that connects various system components (including the system memory 28 and the processing unit 16).

[0076] The bus 18 may be one or more of several types of bus structures, including a memory bus or memory controller, a peripheral bus, an accelerated graphics port, a processor or a local bus using any of a variety of bus architectures. For example, these architectures include, but are not limited to, an Industry Standard Architecture (ISA) bus, a Micro Channel Architecture (MAC) bus, an Enhanced ISA bus, a Video Electronics Standards Association (VESA) local bus, and a Peripheral Component Interconnect (PCI) bus.

[0077] The computer device 12 typically includes a variety of computer system readable media. These media can be any available media that can be accessed by the computer device 12, including volatile and non-volatile media, removable and non-removable media.

[0078] The system memory 28 may include computer system readable media in the form of volatile memory, such as random access memory (RAM) 30 and / or cache 32. The computer device 12 may further include other removable / non-removable, volatile / non-volatile computer system storage media. By way of example only, the storage system 34 may be used to read and write non-removable, non-volatile magnetic media ( Figure 5 not shown, usually called a "hard drive"). Although Figure 5 Not shown in the figure, a disk drive for reading and writing to a removable non-volatile disk (e.g., a "floppy disk"), and an optical disk drive for reading and writing to a removable non-volatile optical disk (e.g., a CD-ROM, a DVD-ROM, or other optical media) may be provided. In these cases, each drive may be connected to the bus 18 via one or more data medium interfaces. The system memory 28 may include at least one program product having a set (e.g., at least one) of program modules that are configured to perform the functions of the various embodiments of the present invention.

[0079] A program / utility 40 having a set (at least one) of program modules 42 may be stored, for example, in system memory 28, such program modules 42 including, but not limited to, an operating system, one or more application programs, other program modules, and program data, each of which or some combination may include an implementation of a network environment. Program modules 42 generally perform the functions and / or methods of the embodiments described herein.

[0080] The computer device 12 may also communicate with one or more external devices 14 (e.g., keyboards, pointing devices, displays 24, etc.), one or more devices that enable a user to interact with the computer device 12, and / or any device that enables the computer device 12 to communicate with one or more other computing devices (e.g., network cards, modems, etc.). Such communication may be performed through an input / output (I / O) interface 22. Furthermore, the computer device 12 may also communicate with one or more networks (e.g., local area networks (LANs), wide area networks (WANs), and / or public networks, such as the Internet) through a network adapter 20. Figure 5 As shown, the network adapter 20 communicates with other modules of the computer device 12 via the bus 18. It should be understood that although Figure 5 Not shown, other hardware and / or software modules may be used in conjunction with computer device 12, including but not limited to microcode, device drivers, redundant processing units, external disk drive arrays, RAID systems, tape drives, and data backup storage systems.

[0081] The processing unit 16 executes various functional applications and data processing by running the program stored in the system memory 28, for example, implementing the protection mode management method provided in the embodiment of the present invention, which includes:

[0082] Obtain the operating information of multiple applications to be managed in the target delivery platform; for each application to be managed, determine the target protection mode according to the corresponding operating information of the application to be managed; wherein the target protection mode is a transparent mode, a monitoring mode or an interception mode; based on the target protection mode, monitor the consumed resources of the application to be managed to complete the protection mode management process for the application to be managed.

[0083] This embodiment provides a computer-readable storage medium, on which a computer program is stored. When the program is executed by a processor, the protection mode management method provided in any embodiment of the present invention is implemented, including:

[0084] Obtain the operating information of multiple applications to be managed in the target delivery platform; for each application to be managed, determine the target protection mode according to the corresponding operating information of the application to be managed; wherein the target protection mode is a transparent mode, a monitoring mode or an interception mode; based on the target protection mode, monitor the consumed resources of the application to be managed to complete the protection mode management process for the application to be managed.

[0085] The computer storage medium of the embodiment of the present invention can adopt any combination of one or more computer-readable media. The computer-readable medium can be a computer-readable signal medium or a computer-readable storage medium. The computer-readable storage medium can be, for example, but not limited to: an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples (non-exhaustive list) of computer-readable storage media include: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In this document, a computer-readable storage medium can be any tangible medium containing or storing a program, which can be used by an instruction execution system, device or device or used in combination with it.

[0086] Computer-readable signal media may include data signals propagated in baseband or as part of a carrier wave, which carry computer-readable program code. Such propagated data signals may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. Computer-readable signal media may also be any computer-readable medium other than a computer-readable storage medium, which may send, propagate, or transmit a program for use by or in conjunction with an instruction execution system, apparatus, or device.

[0087] The program code embodied on the computer readable medium may be transmitted using any appropriate medium, including but not limited to wireless, wireline, optical fiber cable, RF, etc., or any suitable combination of the foregoing.

[0088] Computer program code for performing the operations of the present invention may be written in one or more programming languages ​​or combinations thereof, including object-oriented programming languages ​​such as Java, Smalltalk, C++, and conventional procedural programming languages ​​such as "C" or similar programming languages. The program code may be executed entirely on the user's computer, partially on the user's computer, as a separate software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving a remote computer, the remote computer may be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0089] It should be understood by those skilled in the art that the modules or steps of the present invention described above can be implemented by a general-purpose computing device, they can be concentrated on a single computing device, or distributed on a network composed of multiple computing devices, optionally, they can be implemented by a program code executable by a computer device, so that they can be stored in a storage device and executed by the computing device, or they can be made into individual integrated circuit modules, or multiple modules or steps therein can be made into a single integrated circuit module for implementation. Thus, the present invention is not limited to any specific combination of hardware and software.

[0090] Note that the above are only preferred embodiments of the present invention and the technical principles used. Those skilled in the art will understand that the present invention is not limited to the specific embodiments herein, and that various obvious changes, readjustments and substitutions can be made by those skilled in the art without departing from the scope of protection of the present invention. Therefore, although the present invention has been described in more detail through the above embodiments, the present invention is not limited to the above embodiments, and may include more other equivalent embodiments without departing from the concept of the present invention, and the scope of the present invention is determined by the scope of the appended claims.

Claims

1. A protection mode management method, characterized in that: include: Obtaining the operation information of multiple applications to be managed in the target delivery platform; For each application to be managed, determine a target protection mode according to the operation information corresponding to the application to be managed; wherein the target protection mode is a transparent transmission mode, a monitoring mode or an interception mode; The consumed resources of the application to be managed are monitored based on the target protection mode to complete the protection mode management process for the application to be managed.

2. The method according to claim 1, characterized in that The determining the target protection mode according to the operation information corresponding to the application to be managed includes: Inputting the operation information of the application to be managed into a target operation information monitoring model to obtain a target threat type corresponding to the operation information; A target protection mode of the application to be managed is determined according to the target threat type.

3. The method according to claim 2, characterized in that The determining the target protection mode of the application to be managed according to the target threat type includes: When the target threat type is a normal type, determining that the target protection mode is the transparent transmission mode; In a case where the target threat type is an abnormal type, determining that the target protection mode is the monitoring mode; When the target threat type is a high-risk type, the target protection mode is determined to be the interception mode.

4. The method according to claim 2, characterized in that: After determining the target protection mode of the application to be managed according to the target threat type, the method further includes: Displaying the application to be managed and the target protection mode of the application to be managed on a preset interactive interface; Determine a mode confirmation result based on the interactive instruction on the preset interactive interface; When the mode confirmation result is a non-confirmation result, the protection mode corresponding to the non-confirmation result is used as the target protection mode of the application to be managed.

5. The method according to claim 1, characterized in that The method further comprises: For each of the to-be-managed applications, obtaining the current running information of the to-be-managed application at every preset period; Determining a new update mode corresponding to the application to be managed according to the current running information; When the new update mode is inconsistent with the current protection mode of the application to be managed, the current protection mode of the application to be managed is adjusted.

6. The method according to claim 1, characterized in that The method further comprises: In case of receiving a mode update instruction, determining a target application according to the mode update instruction; For each target application, the operation information of the target application is obtained, a next protection mode is determined based on the operation information of the target application, and the current protection mode of the target application is adjusted to the next protection mode.

7. The method according to claim 1, characterized in that The operation information includes: at least one of access address, source IP, access parameters, access path, return status, current CPU load, current disk usage, current application protection mode, and exception hit rules.

8. A protection mode management device, characterized in that: The device comprises: An operation information acquisition module is used to obtain the operation information of multiple applications to be managed in the target delivery platform; A protection mode determination module, used to determine a target protection mode for each application to be managed according to the operation information corresponding to the application to be managed; wherein the target protection mode is a transparent transmission mode, a monitoring mode or an interception mode; The application security management module is used to monitor the consumed resources of the application to be managed based on the target protection mode to complete the protection mode management process for the application to be managed.

9. A computer device, characterized in that: The computer device comprises: one or more processors; A memory for storing one or more programs; When the one or more programs are executed by the one or more processors, the one or more processors implement the protection mode management method as described in any one of claims 1-7.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, the protection mode management method as described in any one of claims 1 to 7 is implemented.

Images