Office terminal network security tracing method and system

Abstract

The invention discloses an office terminal network security traceability method and system, and relates to the technical field of network security, and the method comprises the steps: initiating DNS analysis to carry out malicious network interception; blocking the installation process of the application software by identifying and installing starting features of the application software, and forcibly checking whether a to-be-installed program has a compliant watermark or not; and automatically switching the security control strategy according to the characteristics of the network environment where the operating system runs. According to the invention, malicious domain name resolution can be blocked from the source by supervising DNS resolution and network connection requests in the kernel of the office terminal of the domestic operating system. Compared with the mainstream network security equipment detection and interception technology in the market, the technology has the advantages that the inner end side is closer, the blocking is more effective and timely, the source side can be subjected to source tracing positioning at the first time, and the security protection and source tracing capability of the office terminal of the domestic operating system is improved.

Description

Technical Field

[0001] The present invention relates to the technical field of network security, and in particular to a method and system for tracing network security of an office terminal. Background Art

[0002] Domestic operating system office terminals are in the promotion and application stage, and their network security protection inherits traditional technical means, such as traffic monitoring equipment, IPS, WAF, etc. Network security equipment log analysis and tracing, by analyzing the logs of domestic operating systems and network security equipment to track the source of the attack, but it faces the disadvantages of large log volume, low efficiency of tracing and large analysis workload. Traffic monitoring equipment monitoring and tracing, through network traffic monitoring security equipment to discover network security attack traffic, infer potential attack activities, but the storage space of full traffic equipment is limited, and it is difficult to reach 180 days.

[0003] There are still some deficiencies in the network security management software that is compatible with domestic operating systems. For example, it is not as rich as the Windows operating system in terms of security policy management. When the Windows operating system faces malicious DNS resolution request alerts, some DNS resolution requests cannot be traced back to the process. Domestic operating systems face the same difficulties and business needs, and it is difficult to track the path of the source process program. Summary of the invention

[0004] In view of the above-mentioned problems, the present invention is proposed.

[0005] Therefore, the technical problem solved by the present invention is: how to solve the problem that the large amount of logs leads to low tracing efficiency, large analysis workload, and difficulty in tracing the source process program.

[0006] In order to solve the above technical problems, the present invention provides the following technical solutions: a method for tracing the network security of office terminals, comprising: initiating DNS resolution to intercept malicious networks; blocking the installation process of application software by identifying and installing application software startup features, and forcibly checking whether the program to be installed has a compliance watermark; and automatically switching security management and control strategies according to the characteristics of the network environment in which the operating system is running.

[0007] As a preferred solution of the office terminal network security tracing method described in the present invention, the malicious network interception includes, for a DNS resolution request, first calling the kernel function of the Linux network security module hook to obtain DNS information, and then matching it with the malicious domain name in the custom threat intelligence library, and blocking and intercepting the DNS resolution request when it matches the threat intelligence, and shall not be sent to the network environment through the operating system office terminal network card to complete the external DNS resolution request, and at the same time, forging a DNS response data packet at the operating system kernel layer to pretend to respond to the malicious DNS resolution request, forging a false external IP address to induce the threat program to appear and start the external process, thereby capturing the process information, tracing and locating the path information of the source program of the malicious DNS resolution request, and completing the accurate tracing of the malicious program;

[0008] When no malicious domain name in the custom threat intelligence library is matched, the DNS resolution request is automatically released to the network environment to ensure normal network business access.

[0009] As a preferred solution of the office terminal network security tracing method described in the present invention, the mandatory check whether the to-be-installed program has a compliance watermark includes adding watermark information based on a national secret algorithm to the software installation package that has passed the enterprise security compliance test, and the system automatically uses the national secret SM3 data summary algorithm to extract and add a compliance watermark to the software installation package;

[0010] When the watermark extraction and addition is successful, the software installation package watermark comparison is performed. When the watermark extraction and addition fails, the software installation is prohibited.

[0011] As a preferred solution of the office terminal network security tracing method described in the present invention, the installation package watermark comparison includes: when the office terminal of the operating system installs application software, using the Linux security module index node hook to intercept the installation process, extracting the installation package file information through the interface function, detecting whether the application software installation package has a compliant watermark identification, and comparing it with the watermark information in the software installation package compliant watermark database. If the comparison is successful, the software will be installed; if the comparison is unsuccessful, the installation is prohibited.

[0012] As a preferred solution of the office terminal network security tracing method described in the present invention, the automatic switching security management and control strategy includes presetting the enterprise intranet and extranet characteristics and security policies through a supporting engine. After the strategy takes effect, when the network traffic is immersed, the network environment of the office terminal will be identified in real time. When it is identified as being in the Internet environment, it will automatically switch to the blacklist security policy group; when it is identified as being in the enterprise intranet environment, it will automatically switch to the whitelist security policy group.

[0013] As a preferred solution of the office terminal network security tracing method described in the present invention, the blacklist security policy group protects against network security risks while ensuring that users can still access resources normally online, and the whitelist security policy group blocks all non-whitelist network access requests from appearing in the enterprise network to trigger security alarms, thereby purifying the internal network traffic of the enterprise.

[0014] On the second aspect, another object of the present invention is to provide an office terminal network security tracing system, including: a malicious network interception and tracing module, a software installation package compliance watermark audit module, and an internal and external network environment intelligent identification module; the malicious network interception and tracing module includes a terminal application and a DNS interception engine, and the terminal application sends a network request to the DNS interception engine to perform DNS resolution monitoring interception, threat intelligence matching and tracing; the software installation package compliance watermark audit module includes a command listener and a command executor, the command listener receives the operating system command line, and the command executor is used for compliance watermark verification, mandatory watermark detection and interception, and software installation package watermark comparison; the internal and external network environment intelligent identification module is used to identify network environment characteristics and automatically switch policies.

[0015] As a preferred solution of the office terminal network security tracing system described in the present invention, it also includes a Linux security module, which is used to call a kernel function to obtain DNS information when the malicious network interception and tracing module performs DNS resolution; and when the office terminal of the operating system installs application software, the index node hook of the Linux security module is used to intercept the installation process.

[0016] In a third aspect, a computer device includes a memory and a processor, wherein the memory stores a computer program, and the processor implements the steps of the office terminal network security tracing method as described above when executing the computer program.

[0017] In a fourth aspect, a computer-readable storage medium stores a computer program, which, when executed by a processor, implements the steps of the office terminal network security tracing method as described above.

[0018] Beneficial effects of the present invention: The office terminal network security tracing method and system provided by the present invention can block malicious domain name resolution from the source by supervising the DNS resolution and network connection requests in the kernel of the domestic operating system office terminal. Compared with the mainstream detection and interception technology through network security equipment on the market, this technology is closer to the terminal side, the blocking is more effective and timely, and the source tracing and positioning can be carried out at the source side in the first time, improving the security protection and tracing capabilities of the domestic operating system office terminal.

[0019] It can timely intercept and block potential network threats at the source of the terminal to prevent further spread. By intercepting and processing malicious domain name resolution at the beginning, the blocking response time of security products is significantly shortened, thereby improving the defense effect.

[0020] In response to the different needs of users in multiple network environments, this patent ensures the imperceptible execution of security measures through intelligent identification and policy adjustment, and users do not need to perform additional operations. The system automatically switches security policies to ensure a balance between user experience and network security, and achieves all-round and seamless network security protection.

[0021] Different from the traditional post-installation detection and blocking mechanism, this technical means and system detects and blocks the installation process of malware in advance by launching the compliance check strategy before the software is installed. Combined with the compliance watermark technology generated by the domestic cryptographic algorithm, the system can detect the software before it is downloaded to the disk or loaded into the memory, effectively preventing the intrusion of malware, and greatly improving the pre-emptive and accurate control.

[0022] The system uses a compliant watermark for software installation packages generated by a domestic cryptographic algorithm to ensure the legality and integrity of the application software installation process. Through watermark audit technology, the audit and monitoring capabilities of domestic operating system office terminals for software installation have been further enhanced.

[0023] This patent designs an extensible security policy framework that allows administrators to flexibly configure and update security policy groups based on the specific needs of the enterprise. The framework can seamlessly adapt to future security needs and new threats, ensuring the long-term adaptability and sustainable protection capabilities of the system. BRIEF DESCRIPTION OF THE DRAWINGS

[0024] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other accompanying drawings can be obtained based on these accompanying drawings without paying creative work.

[0025] Figure 1 An overall flow chart of an office terminal network security tracing method provided by an embodiment of the present invention;

[0026] Figure 2 A malicious network interception and tracing flow chart of a method for tracing the security of an office terminal network provided by an embodiment of the present invention;

[0027] Figure 3 A flowchart of intelligent identification of internal and external network environments of an office terminal network security tracing method provided by an embodiment of the present invention;

[0028] Figure 4 A software installation package compliance watermark audit flow chart of a method for tracing the source of network security of an office terminal provided by an embodiment of the present invention;

[0029] Figure 5 A schematic diagram of the structure of an office terminal network security tracing system provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0030] In order to make the above-mentioned purposes, features and advantages of the present invention more obvious and easy to understand, the specific implementation methods of the present invention are described in detail below in conjunction with the drawings of the specification. Obviously, the described embodiments are part of the embodiments of the present invention, but not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary persons in the art without creative work should fall within the scope of protection of the present invention.

[0031] In the following description, many specific details are set forth to facilitate a full understanding of the present invention, but the present invention may also be implemented in other ways different from those described herein, and those skilled in the art may make similar generalizations without violating the connotation of the present invention. Therefore, the present invention is not limited to the specific embodiments disclosed below.

[0032] Example 1

[0033] Reference Figure 1 to Figure 4 , is an embodiment of the present invention, and provides an office terminal network security tracing method, comprising:

[0034] S1: Initiate DNS resolution to intercept malicious networks;

[0035] Furthermore, based on the Linux security module LSM, the access to network communications is controlled at the operating system kernel level, and a custom threat intelligence engine is embedded in the hook framework method and interface of the LSM network security module to intercept and block domain name resolution requests and external IP connection requests sent out by the operating system in real time, and match threat intelligence at millisecond speeds. All network request packets that match threat intelligence are intercepted and blocked, and only those that do not match threat intelligence are released and sent to the network. The intercepted and blocked network request packets are trapped by processes, and the source program path of the network request packet is traced to assist network security personnel in accurately identifying threats.

[0036] It should be noted that the prerequisite is as follows: In domestic operating system office terminals, when various programs initiate network requests through the interfaces provided by the operating system, network data packets will be generated. After the network data packets enter the network protocol stack for processing, the system will call the network card to send the data to the network.

[0037] Office terminal network security tracing method based on domestic operating system and system interception DNS resolution request and tracing process Figure 2 As shown, for DNS resolution requests, first call the kernel functions of LSM Network hooks (Linux network security module hooks), such as connect(), listen(), accept() and other functions to obtain DNS information, and then match with the malicious domain name in the custom threat intelligence library. The DNS resolution request that matches the threat intelligence is blocked and intercepted, and must not be sent to the network environment through the domestic operating system office terminal network card to complete the external DNS resolution request. At the same time, the DNS response data packet is forged in the kernel layer of the domestic operating system to "pretend" to respond to the malicious DNS resolution request, and a false external IP address is forged to induce the threat program to "appear" and start the external process, thereby capturing the process information, tracing the source to locate the path information of the source program of the malicious DNS resolution request, and completing the precise tracing of the malicious program. If the malicious domain name in the custom threat intelligence library is not matched, the DNS resolution request is automatically released to the network environment to ensure the availability of normal network business access.

[0038] The above process can accurately obtain the traceability and positioning path information of malicious programs, which not only facilitates the effective traceability of potential malicious software in domestic operating system office terminals, but also improves the security of the network environment to a certain extent, and prevents possible phishing remote control attacks, APT attacks, and ransomware attacks.

[0039] S2: By identifying and launching the application software installation features, the application software installation process is blocked and the installation program is checked for compliance watermarks.

[0040] Furthermore, compliance watermarks are used in software installation packages to control application software. By identifying and launching application software installation features, the installation process of the application software is blocked, and a mandatory check is made to see whether the program to be installed has a compliance watermark. Application software installation packages that do not identify watermark information will be prohibited from being used by office terminal users of domestic operating systems, thus preventing illegal and unknown application software from entering the corporate network in the first place.

[0041] The network security tracing method and system for office terminals based on domestic operating systems have the ability to intelligently identify internal and external network environments, and can automatically switch preset security policy groups according to the network environment in which the office terminals of the domestic operating system are located. It is suitable for terminal security application scenarios that asynchronously access the enterprise's internal and external networks.

[0042] The process of intelligent identification of internal and external network environments is as follows: Figure 4As shown, the office terminal network security tracing method and system based on the domestic operating system first needs to pre-set the enterprise's internal and external network characteristics and security policies through the supporting engine. After the policy takes effect, it will identify the network environment of the office terminal in real time. If it is identified as being in the Internet environment, it will automatically switch to the blacklist security policy group; if it is identified as being in the enterprise's intranet environment, it will automatically switch to the whitelist security policy group.

[0043] S3: Automatically switch security control policies based on the characteristics of the network environment in which the operating system runs.

[0044] Furthermore, the built-in internal and external network environment identification engine can automatically switch the security control strategy according to the characteristics of the network environment in which the operating system is running. When it is recognized that the network environment of the domestic operating system office terminal is the Internet, it will automatically switch to the domain name and IP blacklist security control strategy, which can protect against network security risks such as phishing while ensuring that users can still access resources normally online; when it is recognized that the network environment of the domestic operating system office terminal is the enterprise intranet, it will automatically switch to the domain name and IP whitelist security control strategy, blocking all non-whitelist network access requests from appearing in the enterprise network and triggering security alarms, thereby purifying the internal network traffic of the enterprise and reducing the overall network security risk of the enterprise.

[0045] It should be noted that software installation packages that have passed the enterprise security compliance test can add watermark information based on the national secret algorithm through the office terminal network security traceability method and system of the domestic operating system. The system will automatically use the national secret SM3 data summary algorithm to add a compliance watermark to the software installation package to prevent users of office terminals of domestic operating systems from abusing third-party application software, thereby causing network security risks such as phishing and Trojan horse implantation.

[0046] The logical structure of this function is as follows Figure 3 As shown, after the technical means and system software are installed, when the office terminal of the domestic operating system installs the application software, LSM inode hooks (Linux Security Module Index Node Hook) is used to intercept the installation process, extract the installation package file information through the interface function, detect whether the application software installation package has a compliance watermark mark, and compare it with the watermark information in the software installation package compliance watermark database. If the comparison is successful, it will be installed; if the comparison is unsuccessful, the installation is prohibited.

[0047] Example 2

[0048] According to an embodiment of the present invention, a heterogeneous cloud resource monitoring data collection and intelligent analysis system is provided, comprising:

[0049] Malicious network interception and tracing module, software installation package compliance watermark audit module, and internal and external network environment intelligent identification module;

[0050] The malicious network interception and tracing module includes terminal applications and DNS interception engines. The terminal application sends network requests to the DNS interception engine to perform DNS resolution monitoring and interception, threat intelligence matching and tracing.

[0051] The software installation package compliance watermark audit module includes a command listener and a command executor. The command listener receives the operating system command line, and the command executor is used to verify the compliance watermark, detect and intercept the mandatory watermark, and compare the software installation package watermark.

[0052] The internal and external network environment intelligent identification module is used to identify network environment characteristics and automatically switch policies;

[0053] It also includes a Linux security module, which is used to call kernel functions to obtain DNS information when the malicious network interception and tracing module performs DNS resolution; and when the office terminal of the operating system installs application software, the index node hook of the Linux security module is used to intercept the installation process.

[0054] Example 3

[0055] An embodiment of the present invention is different from the first two embodiments in that:

[0056] If the functions are implemented in the form of software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art or the part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium, including several instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk, etc., which can store program code.

[0057] The logic and / or steps represented in the flowchart or otherwise described herein, for example, can be considered as an ordered list of executable instructions for implementing logical functions, which can be embodied in any computer-readable medium for use by an instruction execution system, apparatus or device (such as a computer-based system, a system including a processor or other system that can fetch instructions from an instruction execution system, apparatus or device and execute instructions), or used in conjunction with these instruction execution systems, apparatuses or devices. For the purpose of this specification,

[0058] A "computer-readable medium" can be any apparatus that can contain, store, communicate, propagate, or transport the program for use by or in connection with the instruction execution system, apparatus, or device.

[0059] More specific examples of computer-readable media (a non-exhaustive list) include the following: an electrical connection with one or more wires (electronic device), a portable computer disk case (magnetic device), a random access memory (RAM), a read-only memory (ROM), an erasable and programmable read-only memory (EPROM or flash memory), an optical fiber device, and a portable compact disk read-only memory (CDROM). In addition, the computer-readable medium may even be a paper or other suitable medium on which the program is printed, since the program may be obtained electronically, for example, by optically scanning the paper or other medium, followed by editing, deciphering or, if necessary, processing in another suitable manner, and then stored in a computer memory.

[0060] It should be understood that the various parts of the present invention can be implemented by hardware, software, firmware or a combination thereof. In the above-mentioned embodiments, a plurality of steps or methods can be implemented by software or firmware stored in a memory and executed by a suitable instruction execution system. For example, if implemented by hardware, as in another embodiment, it can be implemented by any one of the following technologies known in the art or their combination: a discrete logic circuit having a logic gate circuit for implementing a logic function for a data signal, a dedicated integrated circuit having a suitable combination of logic gate circuits, a programmable gate array (PGA), a field programmable gate array (FPGA), etc.

[0061] Example 4

[0062] An embodiment of the present invention provides an office terminal network security tracing method and a specific implementation example.

[0063] (1) Intelligent identification of internal and external network environments: First, configure corresponding internal or external network policies for different network environments and preset security policy groups. Use internal and external network features to build an intelligent internal and external network identification model that starts deep data packet monitoring. Combined with traffic analysis and behavior recognition technology, it detects in real time whether the network environment of the domestic operating system office terminal is the enterprise intranet or the Internet, and switches to the corresponding security policy group according to the network environment.

[0064] (2) Interception of malicious program network requests: A customizable threat intelligence library is built simultaneously, which mainly includes malicious domain name information and malicious IP information. LSM Network hooks (Linux Network Security Module Hooks) are used to intercept all DNS requests and IP outbound requests initiated by domestic operating systems, and the extracted DNS information and outbound IP information are matched with the intelligence information in the custom threat intelligence library. If the threat intelligence is matched, the resolution request data packet is blocked; if the threat intelligence is not matched, the resolution request data packet is released. Combined with the security policy group in (1), if the blacklist mode is used, the network request of the threat intelligence library that matches the blacklist policy group is recorded as a security alarm; if the whitelist mode is used, the network request that matches the policy parameters of the blacklist policy group is released, and the network request that is not released will be matched with the intelligence information in the threat intelligence library, and only the matching ones will be recorded as security alarms.

[0065] (3) Accurate tracing and positioning of malicious network requests: All network request packets are processed and positioned. For those parasitic on system processes, accurate tracing and positioning technology for malicious network requests is used. While blocking malicious network requests, the DNS response packet is forged at the system kernel layer, and a forged IP address is responded to the original program that requested the malicious domain name or external IP. When the program that initiates DNS resolution in the system receives the DNS response, it will establish a connection with the IP address in the response, and the original process of the malicious program will appear, thus completing the process file path tracing and positioning.

[0066] (4) The above (1), (2), and (3) are aimed at the potential network security threats of the existing office terminals of domestic operating systems. For the possible new malicious domain names and external IP threats of domestic operating system office terminals, this patent proposes a software installation package compliance watermark detection technology for security protection. Applications that have passed the enterprise compliance detection can add software installation package watermarks based on domestic cryptographic algorithms through this patent. By intercepting and checking the watermark information when the domestic operating system office terminal is used to install application software, only those with certified watermark information can be installed, otherwise the installation is prohibited, avoiding the introduction of new network security risk factors on the terminal side.

[0067] The data collected during the implementation are shown in the following table:

[0068]

[0069]

[0070] DNS resolution interception delay: The average interception delay of the traditional solution is 152ms, while the average delay of this patented solution is reduced to 75ms, showing a more efficient interception response speed.

[0071] Traceability accuracy: In 10 tests, the traditional solution had an average of 7.4 successful traceability times, while this patented solution reached 9.8 times, significantly improving the accuracy of traceability.

[0072] Real-time attack defense response time: The average response time of traditional solutions is 200ms, while this patented solution shortens it to 98ms, indicating a faster interception response speed.

[0073] UDP link malicious identification rate: The traditional solution successfully identified 6 times on average out of 20 tests, while this patented solution achieved 17 times, greatly improving the ability to identify malicious behavior on UDP links.

[0074] Dynamic strategy switching time: The traditional solution takes an average of 2 seconds to switch, while this patented solution takes only 0.5 seconds, demonstrating a more sensitive strategy switching effect.

[0075] User operation interference rate: In 20 tests, the traditional solution had an average of 3.8 interferences, while this patented solution reduced the interference to 0.6 times, improving the user experience.

[0076] Whitelist malware interception rate: The traditional solution intercepted an average of 6 times in 10 installation tests, while this patented solution intercepted an average of 9.6 times, which is more effective in preventing malware in advance.

[0077] Compliance watermark detection success rate: In 10 tests, the traditional solution succeeded 7.8 times on average, while this patented solution succeeded 9.8 times, improving the compliance detection accuracy of the installation process.

[0078] Security policy update cycle: The average time for traditional solutions is 3 months, but this patented solution is shortened to 1 month, which is more advantageous in terms of policy update frequency.

[0079] It should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention rather than to limit it. Although the present invention has been described in detail with reference to the preferred embodiments, those skilled in the art should understand that the technical solutions of the present invention may be modified or replaced by equivalents without departing from the spirit and scope of the technical solutions of the present invention, which should all be included in the scope of the claims of the present invention.

Claims

1. A method for tracing the source of network security of an office terminal, characterized in that: include: Initiate DNS resolution to intercept malicious networks; By identifying and applying software installation and startup features, the installation process of the application software is blocked, and a mandatory check is made to see if the program to be installed has a compliant watermark; Automatically switch security management and control strategies based on the characteristics of the network environment in which the operating system runs.

2. The office terminal network security tracing method according to claim 1, characterized in that: The malicious network interception includes, for DNS resolution request, first calling the kernel function of the Linux network security module hook to obtain DNS information, and then matching it with the malicious domain name in the custom threat intelligence library, blocking and intercepting the DNS resolution request when matching the threat intelligence, and not sending it to the network environment through the operating system office terminal network card to complete the external DNS resolution request, and at the same time forging a DNS response data packet at the operating system kernel layer to pretend to respond to the malicious DNS resolution request, forging a false external IP address to induce the threat program to appear and start the external process, thereby capturing the process information, tracing and locating the path information of the source program of the malicious DNS resolution request, and completing the accurate tracing of the malicious program; When no malicious domain name in the custom threat intelligence library is matched, the DNS resolution request is automatically released to the network environment to ensure normal network business access.

3. The office terminal network security tracing method according to claim 2, characterized in that: The mandatory check of whether the installed program has a compliance watermark includes adding watermark information based on the national secret algorithm to the software installation package that has passed the enterprise security compliance test. The system will automatically use the national secret SM3 data summary algorithm to extract and add the compliance watermark to the software installation package; When the watermark extraction and addition is successful, the software installation package watermark comparison is performed. When the watermark extraction and addition fails, the software installation is prohibited.

4. The office terminal network security tracing method according to claim 3, characterized in that: The installation package watermark comparison includes, when the office terminal of the operating system installs the application software, using the Linux security module index node hook to intercept the installation process, extracting the installation package file information through the interface function, detecting whether the application software installation package has a compliant watermark identification, and comparing it with the watermark information in the software installation package compliant watermark database. If the comparison is successful, it will be installed; if the comparison is unsuccessful, the installation is prohibited.

5. The office terminal network security tracing method according to claim 4, characterized in that: The automatic switching security management and control strategy includes presetting the enterprise's internal and external network characteristics and security policies through a supporting engine. After the strategy takes effect, when network traffic is immersed, the network environment of the office terminal will be identified in real time. When it is identified as being in an Internet environment, it will automatically switch to the blacklist security policy group; when it is identified as being in an enterprise intranet environment, it will automatically switch to the whitelist security policy group.

6. The office terminal network security tracing method according to claim 5, characterized in that: The blacklist security policy group protects against network security risks while ensuring that users can still access resources normally online. The whitelist security policy group blocks all non-whitelist network access requests from appearing in the enterprise network to trigger security alarms, thereby purifying the internal network traffic of the enterprise.

7. A system using the office terminal network security tracing method according to any one of claims 1 to 6, characterized in that: include: Malicious network interception and tracing module, software installation package compliance watermark audit module, and internal and external network environment intelligent identification module; The malicious network interception and tracing module includes a terminal application and a DNS interception engine. The terminal application sends a network request to the DNS interception engine to perform DNS resolution monitoring interception, threat intelligence matching and tracing; The software installation package compliance watermark audit module includes a command listener and a command executor. The command listener receives the operating system command line, and the command executor is used for compliance watermark verification, mandatory watermark detection and interception, and software installation package watermark comparison; The internal and external network environment intelligent identification module is used for network environment feature identification and automatic strategy switching.

8. An office terminal network security tracing system according to claim 7, characterized in that: It also includes a Linux security module, which is used to call a kernel function to obtain DNS information when the malicious network interception and tracing module performs DNS resolution; and when the office terminal of the operating system installs application software, the index node hook of the Linux security module is used to intercept the installation process.

9. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the office terminal network security tracing method described in any one of claims 1 to 6 are implemented.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the office terminal network security tracing method described in any one of claims 1 to 6 are implemented.

Images