A method and system for managing operation and maintenance commands based on log feedback

Abstract

This invention discloses a method and system for managing operation and maintenance commands based on log feedback. The method includes integrating real-time log feedback information into the review process of operation and maintenance commands, combining the role identification information of operation and maintenance personnel with event logs, and using a high-risk rule chain matching method for command review. This enables a deeper analysis of the current risk situation and provides a higher security factor. By combining the role identification information of operation and maintenance personnel with event logs, abnormal situations can be detected more effectively, greatly improving the accuracy of risk factor analysis. It can effectively utilize the information from log feedback and includes more historical information in the time dimension, providing a more comprehensive risk assessment capability and a higher risk identification capability.

Description

Technical Field

[0001] This invention relates to the field of industrial control system security, and in particular to a method and system for managing operation and maintenance commands based on log feedback. Background Technology

[0002] In industrial control system security, servers, as core components, play a crucial role in data processing and control commands. However, internal threats pose significant risks to server operation and maintenance. With the acceleration of enterprise digital transformation, ensuring the security and legality of operations and maintenance has become increasingly important. This necessitates the proper management of operational commands and the establishment of a comprehensive risk assessment mechanism to identify and block potentially dangerous commands, ensuring the safe and stable operation of the system. Summary of the Invention

[0003] (a) Technical problems to be solved

[0004] To address the aforementioned technical issues, this invention provides a log-based operation and maintenance command management method and system. By integrating real-time log feedback information into the operation and maintenance command review process, the current risk situation can be analyzed more deeply. Combining the role identification information of operation and maintenance personnel with event logs can more effectively detect abnormal situations. In actual operation and maintenance processes, each operation and maintenance role often has a specific scope of responsibility. If the operation and maintenance personnel's actions exceed the expected scope of their role, it indicates that operational errors or malicious behavior may have occurred.

[0005] By employing a high-risk rule chain matching method for command auditing, this invention effectively utilizes log feedback information and incorporates more historical data over time, resulting in a more comprehensive risk assessment capability. Based on the application of this technology, this invention can accurately identify high-risk situations during operation and maintenance, efficiently and comprehensively conduct risk assessments in actual operation and maintenance processes, and promptly block the execution of high-risk commands, thus safeguarding the stable operation of the system.

[0006] (II) Technical Solution

[0007] To solve the aforementioned technical problems and achieve the invention's objective, the present invention is implemented through the following technical solution:

[0008] A method for managing operation and maintenance commands based on log feedback, characterized by the following steps:

[0009] S1. The management module configures the high-risk rule chain library and corresponding high-risk handling strategies, assigns roles to operation and maintenance personnel, and performs operation and maintenance approval.

[0010] S2. The command receiving module completes the authentication of the operation and maintenance personnel, identifies and receives the operation and maintenance commands, and hands them over to the command review module for processing.

[0011] S3. The command review module performs high-risk rule chain matching. If any high-risk rule chain is matched, the corresponding risk handling strategy is executed.

[0012] S4. The command execution module executes operation and maintenance commands that have passed risk review;

[0013] S5. The log extraction module monitors server information in real time, generates event logs based on changes in server content, and sends them to the log parsing module for parsing.

[0014] S6. The log parsing module parses logs within a specified time period, extracts event IDs, assesses the current operational risk coefficient, and provides real-time feedback to the command review module.

[0015] Furthermore, the high-risk rule chain includes at least two rule judgment nodes, which are arranged in the following order: 1 role judgment node (roleNode), 1 risk coefficient node (riskNode), n event judgment nodes (eventNode), and m command judgment nodes (commandNode), where n and m are non-negative integers; the risk handling strategy corresponding to the high-risk rule chain includes at least one of the following: high-risk command alert, high-risk command blocking, high-risk command reporting and approval, and operation and maintenance personnel permission restriction.

[0016] Furthermore, the judgment logic for the rule-based node is as follows:

[0017] Role determination node: Whether the current operations and maintenance personnel's role is the designated role;

[0018] Risk coefficient node: Whether the current risk coefficient is greater than or equal to the specified threshold;

[0019] Event judgment node: Whether there is an event log matching the specified event ID within a certain period of time;

[0020] Command judgment node: whether a specified command has been executed within a certain period of time or whether the current command is a specified command.

[0021] Furthermore, the identity authentication process in step S2 is as follows:

[0022] S21. Read the key value in the configuration file and verify whether the operation and maintenance program is valid. If reading or verification fails, issue an alarm and terminate the operation and maintenance program.

[0023] S22. Read the authentication file and send it along with the local key value to the proxy server for verification. If reading or verification fails, an alarm will be triggered and the operation and maintenance program will be terminated.

[0024] S23. If the above verification result is successful, the operation and maintenance personnel can log in by entering their operation and maintenance account. If the account login fails, an alarm will be triggered and the operation and maintenance account will be required to be re-entered.

[0025] Furthermore, the high-risk rule chain matching process in step S3 is as follows:

[0026] S31. Obtain all high-risk rule chains matching the current operation and maintenance role in the database and add them to the local database;

[0027] S32. If there is a new operation and maintenance command, match the local high-risk rule chain one by one according to the current risk coefficient, recent events and operation and maintenance commands.

[0028] S33. Sequentially determine whether all rule judgment nodes on the current high-risk rule chain meet the requirements. If so, execute the high-risk handling strategy corresponding to the high-risk rule chain and end the matching.

[0029] S34. If the current high-risk rule chain does not match, continue to match the next high-risk rule chain until the last high-risk rule chain is matched.

[0030] Furthermore, the process of generating event logs in step S5 includes: real-time monitoring of change events of each functional module under test based on the probe program and generating JSON format logs. The functional modules under test include: hardware, system, file, driver, service, software, process, network, user, and session. At the same time, each functional module under test contains a series of predefined events, which are uniquely identified by event IDs.

[0031] The process of sending the logs to the log parsing module for parsing includes: filtering event logs from other operations and maintenance personnel, removing duplicate event logs, and sending the event logs to the log parsing module.

[0032] Furthermore, the method for assessing the current operational risk coefficient in step S6 is as follows:

[0033] S61. Receive event logs from the log extraction module within a certain period of time;

[0034] S62. Perform preprocessing operations on the event logs, and fuse the role identification information of the operation and maintenance personnel with the preprocessed event log information to obtain fused features;

[0035] S63. Use a risk assessment model to assess the risk coefficient of the obtained fusion features.

[0036] Furthermore, the risk assessment model in step S63 adopts one of Convolutional Neural Network, Generative Adversarial Network, or Long Short Term Memory Network.

[0037] This invention also provides a log-based operation and maintenance command management system, which includes:

[0038] The system includes a management module, a command receiving module, a command auditing module, a command execution module, a log extraction module, and a log parsing module. The management module is used to configure the high-risk rule chain library and corresponding risk handling strategies, and to assign roles.

[0039] The command receiving module is used for login verification and receiving operation and maintenance commands;

[0040] The command review module is used to match high-risk rule chains and handle high-risk situations;

[0041] The command execution module is used to execute operation and maintenance commands that have passed risk review;

[0042] The log extraction module is used to obtain event logs of operations and maintenance personnel's actions in real time;

[0043] The log parsing module is used to obtain recent events and assess risks, and then feeds the results back to the command auditing module for judgment.

[0044] Furthermore, to achieve the above objectives, the present invention also provides a computer-readable storage medium storing program instructions for a log-based operation and maintenance command management method. These program instructions can be executed by one or more processors to implement the steps of the log-based operation and maintenance command management method as described above.

[0045] (III) Beneficial Effects

[0046] Compared with the prior art, the beneficial effects of the present invention are as follows:

[0047] 1. By integrating real-time log feedback into the auditing process of operation and maintenance commands, we can analyze the current risk situation more deeply, especially the hidden risks. At the same time, compared with the traditional management method based solely on log auditing, we can block high-risk commands more promptly, prevent problems before they occur, and provide a higher level of security.

[0048] 2. By combining the role identification information of operations and maintenance personnel with event logs, anomalies can be detected more effectively. In actual operations and maintenance, each operation and maintenance role often has a specific scope of responsibilities. If an operations and maintenance personnel's actions exceed the expected scope of their role, it indicates that operational errors or malicious behavior may have occurred. Compared with traditional log auditing methods, this significantly improves the accuracy of risk factor analysis.

[0049] 3. Employing a high-risk rule chain matching method for command review effectively utilizes log feedback information and incorporates more historical data over time, resulting in a more comprehensive risk assessment capability. By combining the operator's role, operational risk coefficient, recent events, and operational commands, the current risk coefficient is determined. When any high-risk rule chain is matched, a pre-configured processing strategy is executed. Unlike traditional methods that rely solely on a single command for matching, this approach offers significantly higher risk identification capabilities. Attached Figure Description

[0050] The accompanying drawings, which are included to provide a further understanding of this application and form part of this application, illustrate exemplary embodiments and are used to explain this application, but do not constitute an undue limitation of this application. In the drawings:

[0051] Figure 1 This is a schematic diagram of a log-based operation and maintenance command management method according to an embodiment of this application;

[0052] Figure 2 This is a schematic diagram of a high-risk rule chain matching process according to an embodiment of this application;

[0053] Figure 3 This is a structural diagram of the operation and maintenance command management system based on log feedback according to an embodiment of this application. Detailed Implementation

[0054] The embodiments of this disclosure will now be described in detail with reference to the accompanying drawings.

[0055] The following specific examples illustrate the implementation of this disclosure. Those skilled in the art can easily understand other advantages and effects of this disclosure from the content disclosed in this specification. Obviously, the described embodiments are only a part of the embodiments of this disclosure, and not all of them. This disclosure can also be implemented or applied through other different specific embodiments, and the details in this specification can also be modified or changed based on different viewpoints and applications without departing from the spirit of this disclosure. It should be noted that, in the absence of conflict, the following embodiments and features in the embodiments can be combined with each other. Based on the embodiments in this disclosure, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this disclosure.

[0056] It should also be noted that the illustrations provided in the following embodiments are only schematic representations of the basic concept of this disclosure. The drawings only show the components related to this disclosure and are not drawn according to the number, shape and size of the components in actual implementation. In actual implementation, the form, quantity and proportion of each component can be arbitrarily changed, and the layout of the components may also be more complex.

[0057] See Figure 1 A log-based operation and maintenance command management method includes the following steps:

[0058] S1. The management module configures the high-risk rule chain library and corresponding high-risk handling strategies, assigns roles to operation and maintenance personnel, and conducts operation and maintenance approval.

[0059] The high-risk rule chain library includes at least one high-risk rule chain, and each high-risk rule chain corresponds to one high-risk handling strategy. Each high-risk rule chain contains at least two rule judgment nodes, in the following order: one role judgment node (roleNode), one risk coefficient node (riskNode), n event judgment nodes (eventNode), and m command judgment nodes (commandNode), where n and m are non-negative integers. The risk handling strategy corresponding to each high-risk rule chain includes at least one of the following: high-risk command alert, high-risk command blocking, high-risk command reporting and approval, and operation and maintenance personnel permission restriction.

[0060] Optionally, the rule-based node judgment logic is as follows:

[0061] Role determination node: Whether the current operations and maintenance personnel's role is the designated role;

[0062] Risk coefficient node: Whether the current risk coefficient is greater than or equal to the specified threshold;

[0063] Event judgment node: Whether there is an event log matching the specified event ID within a certain period of time;

[0064] Command judgment node: whether a specified command has been executed within a certain period of time or whether the current command is a specified command.

[0065] S2. The command receiving module completes the authentication of operation and maintenance personnel, identifies and receives operation and maintenance commands, and hands them over to the command review module for processing.

[0066] Optionally, the identity authentication process is as follows:

[0067] S21. Read the key value in the configuration file config.ini and verify whether the operation and maintenance program is valid. If reading or verification fails, issue an alarm and terminate the operation and maintenance program.

[0068] S22. Read the authentication files KACertificate.crt, KACertificate.sig and KACertificatePub.pem, and send them to the proxy server for verification along with the local key. If reading or verification fails, an alarm will be triggered and the operation and maintenance program will be terminated.

[0069] S23. If the above verification result is successful, the operation and maintenance personnel can log in by entering their operation and maintenance account. If the account login fails, an alarm will be triggered and the operation and maintenance account will be required to be re-entered.

[0070] S3. The command auditing module performs high-risk rule chain matching. If any high-risk rule chain is matched, the corresponding risk handling strategy is executed.

[0071] Optional, such as Figure 2 As shown, the high-risk rule chain matching process is as follows:

[0072] S31. Obtain all high-risk rule chains matching the current operation and maintenance role in the database and add them to the local database;

[0073] S32. If there is a new operation and maintenance command, match the local high-risk rule chain one by one according to the current risk coefficient, recent events and operation and maintenance commands.

[0074] S33. Sequentially determine whether all rule judgment nodes on the current high-risk rule chain meet the requirements. If so, execute the high-risk handling strategy corresponding to the high-risk rule chain and end the matching.

[0075] S34. If the current high-risk rule chain does not match, continue to match the next high-risk rule chain until the last high-risk rule chain is matched.

[0076] S4. The command execution module executes operation and maintenance commands that have passed risk review.

[0077] S5. The log extraction module monitors server information in real time, generates event logs based on changes in server content, and sends them to the log parsing module for parsing.

[0078] The method for generating event logs is based on a probe program that monitors changes in various functional modules under test in real time and generates logs in JSON format. The functional modules under test include: hardware, system, file, driver, service, software, process, network, user, and session. Each functional module under test also contains a series of predefined events, uniquely identified by an event ID. The process of sending the logs to the log parsing module for parsing includes: filtering event logs from other maintenance personnel (if the event does not have a specific user, no filtering is performed), removing duplicate event logs, and sending the event logs to the log parsing module.

[0079] S6. The log parsing module parses logs within a specified time period, extracts event IDs, assesses the current operational risk coefficient, and provides real-time feedback to the command review module.

[0080] Optionally, the method for assessing the current operational risk coefficient includes the following steps:

[0081] S61. Receive event logs from the log extraction module within a certain period of time;

[0082] S62. Perform preprocessing operations on the event logs, and fuse the role identification information of the operation and maintenance personnel with the preprocessed event log information to obtain fused features;

[0083] S63. Use a risk assessment model to assess the risk coefficient of the obtained fusion features;

[0084] Optionally, the risk assessment model may employ one of the following: Convolutional Neural Network, Generative Adversarial Network, or Long Short Term Memory Network.

[0085] In this implementation, by integrating real-time log feedback into the review process of operational commands, a deeper analysis of the current risk situation can be achieved, especially for hidden risks. Compared to traditional management methods based solely on log auditing, this approach can more promptly block high-risk commands, preventing problems before they occur and providing a higher level of security. By combining the role identification information of operational personnel with event logs, anomalies can be detected more effectively. In actual operational processes, each operational role often has a specific scope of responsibility. If an operational personnel's actions exceed the expected scope of their role, it indicates possible operational errors or malicious behavior. Compared to traditional log auditing methods, this significantly improves the accuracy of risk coefficient analysis. Using a high-risk rule chain matching method for command review effectively utilizes log feedback information and includes more historical information over time, providing a more comprehensive risk assessment capability. The current risk coefficient is determined by combining the operational personnel's role, operational risk coefficient, recent events, and operational commands. When any high-risk rule chain is matched, a pre-configured processing strategy is executed. Unlike traditional methods that match only a single command, this method has a higher risk identification capability.

[0086] like Figure 3As shown in the figure, this embodiment of the invention also proposes an operation and maintenance command management system based on log feedback, including: a management module, a command receiving module, a command review module, a command execution module, a log extraction module, and a log parsing module; the management module is used to configure a high-risk rule chain library and corresponding risk handling strategies, and to assign roles; the command receiving module is used for login verification and receiving operation and maintenance commands; the command review module is used to match high-risk rule chains and handle high-risk situations; the command execution module is used to execute operation and maintenance commands that have passed risk review; the log extraction module is used to obtain event logs of operation and maintenance personnel's operations in real time; the log parsing module is used to obtain recently occurring events and assess risks and feed them back to the command review module for judgment.

[0087] Furthermore, this embodiment of the invention also proposes a computer-readable storage medium storing program instructions for a log-based operation and maintenance command management method. These log-based operation and maintenance command management program instructions can be executed by one or more processors to implement the steps of the log-based operation and maintenance command management method as described above.

[0088] The embodiments described above are merely preferred embodiments of the present invention and are not intended to limit the scope of the present invention. Various modifications and improvements made by those skilled in the art to the technical solutions of the present invention without departing from the spirit of the present invention should fall within the protection scope defined by the claims of the present invention.

Claims

1. A method for managing operation and maintenance commands based on log feedback, characterized in that, Includes the following steps: S1. The management module configures the high-risk rule chain library and corresponding high-risk handling strategies, assigns roles to operation and maintenance personnel, and performs operation and maintenance approval. S2. The command receiving module completes the authentication of the operation and maintenance personnel, identifies and receives the operation and maintenance commands, and hands them over to the command review module for processing. S3. The command review module performs high-risk rule chain matching. If any high-risk rule chain is matched, the corresponding risk handling strategy is executed. S4. The command execution module executes operation and maintenance commands that have passed risk review; S5. The log extraction module monitors server information in real time, generates event logs based on changes in server content, and sends them to the log parsing module for parsing. S6. The log parsing module parses logs within a specified time period, extracts event IDs, assesses the current operational risk coefficient, and provides real-time feedback to the command review module.

2. The operation and maintenance command management method based on log feedback according to claim 1, characterized in that, The high-risk rule chain contains at least two rule judgment nodes, which are in the following order: 1 role judgment node (roleNode), 1 risk coefficient node (riskNode), n event judgment nodes (eventNode), and m command judgment nodes (commandNode), where n and m are non-negative integers. The risk handling strategy corresponding to the high-risk rule chain includes at least one of the following: high-risk command alert, high-risk command blocking, high-risk command reporting and approval, and operation and maintenance personnel permission restriction.

3. The operation and maintenance command management method based on log feedback according to claim 2, characterized in that, The judgment logic for the rule-based node is as follows: Role determination node: Whether the current operations and maintenance personnel's role is the designated role; Risk coefficient node: Whether the current risk coefficient is greater than or equal to the specified threshold; Event judgment node: Whether there is an event log matching the specified event ID within a certain period of time; Command judgment node: whether a specified command has been executed within a certain period of time or whether the current command is a specified command.

4. The operation and maintenance command management method based on log feedback according to claim 1, characterized in that, The identity authentication process in step S2 is as follows: S21. Read the key value in the configuration file and verify whether the operation and maintenance program is valid. If reading or verification fails, issue an alarm and terminate the operation and maintenance program. S22. Read the authentication file and send it along with the local key value to the proxy server for verification. If reading or verification fails, an alarm will be triggered and the operation and maintenance program will be terminated. S23. If the above verification result is successful, the operation and maintenance personnel can log in by entering their operation and maintenance account. If the account login fails, an alarm will be triggered and the operation and maintenance account will be required to be re-entered.

5. The operation and maintenance command management method based on log feedback according to claim 1, characterized in that, The high-risk rule chain matching process in step S3 is as follows: S31. Obtain all high-risk rule chains matching the current operation and maintenance role in the database and add them to the local database; S32. If there is a new operation and maintenance command, match the local high-risk rule chain one by one according to the current risk coefficient, recent events and operation and maintenance commands. S33. Sequentially determine whether all rule judgment nodes on the current high-risk rule chain meet the requirements. If so, execute the high-risk handling strategy corresponding to the high-risk rule chain and end the matching. S34. If the current high-risk rule chain does not match, continue to match the next high-risk rule chain until the last high-risk rule chain is matched.

6. The operation and maintenance command management method based on log feedback according to claim 1, characterized in that, The process of generating event logs in step S5 includes: real-time monitoring of change events of each functional module under test based on the probe program and generating JSON format logs. The functional modules under test include: hardware, system, file, driver, service, software, process, network, user, and session. At the same time, each functional module under test contains a series of predefined events, which are uniquely identified by event ID. The process of sending the logs to the log parsing module for parsing includes: filtering event logs from other operations and maintenance personnel, removing duplicate event logs, and sending the event logs to the log parsing module.

7. The operation and maintenance command management method based on log feedback according to claim 1, characterized in that, The method for assessing the current operational risk coefficient in step S6 is as follows: S61. Receive event logs from the log extraction module within a certain period of time; S62. Perform preprocessing operations on the event logs, and fuse the role identification information of the operation and maintenance personnel with the preprocessed event log information to obtain fused features; S63. Use a risk assessment model to assess the risk coefficient of the obtained fusion features.

8. The operation and maintenance command management method based on log feedback according to claim 7, characterized in that, The risk assessment model in step S63 adopts one of Convolutional Neural Network, Generative Adversarial Network, or Long Short Term Memory Network.

9. A system based on the log feedback-based operation and maintenance command management method as described in any one of claims 1-8, comprising: The system includes a management module, a command receiving module, a command auditing module, a command execution module, a log extraction module, and a log parsing module. The management module is used to configure the high-risk rule chain library and corresponding risk handling strategies, and to assign roles; The command receiving module is used for login verification and receiving operation and maintenance commands; The command review module is used to match high-risk rule chains and handle high-risk situations; The command execution module is used to execute operation and maintenance commands that have passed risk review; The log extraction module is used to obtain event logs of operations and maintenance personnel's actions in real time; The log parsing module is used to obtain recent events and assess risks, and then feeds the results back to the command auditing module for judgment.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores program instructions for a log-based operation and maintenance command management method, which can be executed by one or more processors to implement the steps of the log-based operation and maintenance command management method as described in any one of claims 1-8.

Images