Sensitive command security detection method and device, equipment and storage medium
By detecting whether the parameters during script execution contain sensitive commands in the cloud computing environment, the problems of increased security risks and manual audit workload in the existing technology are solved, and the security and efficiency of script execution are improved.
Patent Information
- Application Number
- CN202311258874.2
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2023-09-26
- Publication Date
- 2025-04-01
AI Technical Summary
The prior art cannot effectively detect whether the parameters of script execution contain sensitive commands in the cloud computing environment, resulting in security risks and increasing manual review workload.
By obtaining the script job information to be executed, including job scripts and execution parameters, querying the operation sensitive record table and sensitive command table, determining whether sensitive commands are included in the script content and parameters, and determining whether to execute the script based on the judgment results.
It realizes sensitive command detection of script content and parameters of script jobs, reduces manual audit workload, and improves the security and efficiency of script execution.
Smart Images
Figure CN119740230A_ABST
Abstract
Description
Technical Field
[0001] The present application relates to the field of cloud computing, and in particular to a sensitive command security detection method, device, equipment and storage medium. Background Art
[0002] With the rapid development of cloud computing, the complexity and uncertainty of cloud environments have increased, and cloud security and operation and maintenance management are facing increasing challenges.
[0003] Sensitive command detection is an important part of operator operation and maintenance management for multi-cloud environments. For sensitive command detection, the previous method is to compare the content of the job script with the sensitive commands in the sensitive command set to determine whether the script contains sensitive commands. However, it is impossible to scan the parameters when the script is executed, and this parameter may contain sensitive commands, posing a security risk. Every time the script is executed, a sensitive command is detected and needs to be manually reviewed, which increases the workload of manual review.
[0004] Therefore, it is necessary to design a sensitive command security detection method to enhance the security of script execution and improve execution efficiency. Summary of the invention
[0005] The present application provides a sensitive command security detection method, device, equipment and storage medium to solve the security technical problems of the automated operation platform during script execution.
[0006] In a first aspect, the present application provides a sensitive command security detection method, comprising:
[0007] Acquire script job information to be executed, wherein the script job information includes a job script and job execution parameters;
[0008] According to the identification and version number of the job script, query the operation sensitivity record table to determine whether the script content in the job script contains sensitive commands, the operation sensitivity record table including the identification and version number of the job script having sensitive commands;
[0009] Determining whether the job execution parameters include sensitive commands according to the job execution parameters and a sensitive command table, wherein the sensitive command table includes sensitive commands;
[0010] Based on the result of determining whether sensitive commands are included, it is determined whether to execute the script job information.
[0011] Optionally, in the method as described above, determining whether the job execution parameters contain sensitive commands according to the job execution parameters and the sensitive command table includes:
[0012] According to the sensitive command table, a sensitive dictionary is constructed, wherein the sensitive dictionary includes the sensitive commands in the sensitive command table;
[0013] The job execution parameters are traversed and searched through the sensitive dictionary to obtain sensitive commands existing in the job execution parameters.
[0014] Optionally, in the above method, before obtaining the script job information to be executed, the method further includes:
[0015] Get the script job information that has been written
[0016] Determining whether the job script contains sensitive commands according to the job script in the script job information and the sensitive command table;
[0017] If so, the information of the job script is added to the operation sensitivity record table according to the identifier and version number of the job script and the sensitive command.
[0018] Optionally, in the above method, determining whether to execute the script job information according to the result of determining whether the sensitive command is included includes:
[0019] If a sensitive command is included, obtain the target job script corresponding to the sensitive command;
[0020] According to the identification and version number of the target job script, query the script guarantee table to determine whether the target job script has been reviewed and approved, wherein the script guarantee table includes job scripts that have been reviewed and not reviewed and the corresponding sensitive commands;
[0021] If the target job script has been reviewed and approved, continue to execute the target job script.
[0022] Optionally, in the method as described above, the step of obtaining the target job script corresponding to the sensitive command includes: if the sensitive command is a sensitive command in a job script, directly obtaining the target job script;
[0023] If the sensitive command is a sensitive command in the job execution parameter, the job script associated with the job execution parameter is used as the target job script.
[0024] Optionally, in the method described above, if the operation script is not recorded in the script guarantee table, the information of the operation script is recorded, and a prompt message is sent to the user terminal according to a preset period, so that the user terminal can review the unrecorded operation script;
[0025] If the review pass information fed back by the user terminal is received, the information of the operation script is recorded in the script guarantee table.
[0026] Optionally, in the method described above, if the target job script is not approved, the execution of the target job script is intercepted.
[0027] In a second aspect, the present application provides a sensitive command security detection device, comprising:
[0028] An acquisition module, used to acquire script job information to be executed, wherein the script job information includes a job script and job execution parameters;
[0029] A processing module, configured to query an operation sensitivity record table according to the identifier and version number of the job script to determine whether the script content in the job script contains sensitive commands, wherein the operation sensitivity record table includes the identifier and version number of the job script having sensitive commands;
[0030] The processing module is further used to determine whether the job execution parameters include sensitive commands according to the job execution parameters and a sensitive command table, wherein the sensitive command table includes sensitive commands;
[0031] The execution module is used to determine whether to execute the script job information according to the judgment result of whether the sensitive command is contained.
[0032] In a possible design, the processing module is further specifically used for:
[0033] According to the sensitive command table, a sensitive dictionary is constructed, wherein the sensitive dictionary includes the sensitive commands in the sensitive command table;
[0034] The job execution parameters are traversed and searched through the sensitive dictionary to obtain sensitive commands existing in the job execution parameters.
[0035] In a possible design, the processing module is further specifically used to: before obtaining the script job information to be executed, obtain the script job information that has been written;
[0036] Determining whether the job script contains sensitive commands according to the job script in the script job information and the sensitive command table;
[0037] If so, the information of the job script is added to the operation sensitivity record table according to the identifier and version number of the job script and the sensitive command.
[0038] In a possible design, the execution module is further specifically used for:
[0039] If a sensitive command is included, obtain the target job script corresponding to the sensitive command;
[0040] According to the identification and version number of the target job script, query the script guarantee table to determine whether the target job script has been reviewed and approved, wherein the script guarantee table includes job scripts that have been reviewed and not reviewed and the corresponding sensitive commands;
[0041] If the target job script has been reviewed and approved, continue to execute the target job script.
[0042] In a possible design, the execution module is further specifically used for:
[0043] If the sensitive command is a sensitive command in a job script, directly obtaining the target job script;
[0044] If the sensitive command is a sensitive command in the job execution parameter, the job script associated with the job execution parameter is used as the target job script.
[0045] In a possible design, the execution module is further specifically used for:
[0046] If the operation script is not recorded in the script guarantee table, the information of the operation script is recorded, and prompt information is sent to the user terminal according to a preset period, so that the user terminal can review the unrecorded operation script;
[0047] If the review pass information fed back by the user terminal is received, the information of the operation script is recorded in the script guarantee table.
[0048] In a possible design, the execution module is further specifically used for:
[0049] If the target job script is not approved, the execution of the target job script is intercepted.
[0050] In a third aspect, the present application provides a sensitive command security detection electronic device, comprising: a processor, and a memory communicatively connected to the processor;
[0051] The memory stores computer-executable instructions;
[0052] The processor executes the computer-executable instructions stored in the memory, so that the processor executes the sensitive command security detection method in any possible implementation of any of the above aspects.
[0053] In a fourth aspect, the present application provides a computer-readable storage medium, in which computer execution instructions are stored. When a processor executes the computer execution instructions, a sensitive command security detection method in any possible implementation method in any of the above aspects is implemented.
[0054] The sensitive command security detection method, device, equipment and storage medium provided in the present application obtain script job information to be executed, wherein the script job information includes a job script and job execution parameters; query the operation sensitive record table according to the identification and version number of the job script to determine whether the script content in the job script contains sensitive commands, thereby realizing sensitive command detection of the script content in the job script; determine whether the job execution parameters contain sensitive commands according to the job execution parameters and the sensitive command table, thereby realizing sensitive command detection of the script parameters in the job script; determine whether to execute the script job information according to the judgment result of whether the sensitive command is contained, thereby realizing sensitive command detection of the script content and script parameters of the script job, intercepting jobs containing sensitive commands, and ensuring the security of the system. BRIEF DESCRIPTION OF THE DRAWINGS
[0055] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present application and, together with the description, serve to explain the principles of the present application.
[0056] Figure 1 Sensitive command security detection method process provided in the embodiment of the present application Figure 1 .
[0057] Figure 2 Sensitive command security detection method process provided in the embodiment of the present application Figure 2 .
[0058] Figure 3 Sensitive command security detection method process provided in the embodiment of the present application Figure 3 .
[0059] Figure 4 A schematic diagram of the structure of a sensitive command security detection device provided in an embodiment of the present application.
[0060] Figure 5 Hardware schematic diagram of sensitive command security detection electronic device provided for embodiments of the present application. Through the above-mentioned drawings, clear embodiments of the present application have been shown, which will be described in more detail later. These drawings and textual descriptions are not intended to limit the scope of the concept of the present application in any way, but to illustrate the concept of the present application for those skilled in the art by reference to specific embodiments. DETAILED DESCRIPTION
[0061] Exemplary embodiments will be described in detail herein, examples of which are shown in the accompanying drawings. When the following description refers to the drawings, the same numbers in different drawings represent the same or similar elements unless otherwise indicated. The implementations described in the following exemplary embodiments do not represent all implementations consistent with the present application. Instead, they are merely examples of devices and methods consistent with some aspects of the present application as detailed in the appended claims.
[0062] As the complexity and uncertainty of cloud environments increase, cloud security and operation and maintenance management face more problems. As one of the important components of operator operation and maintenance management for multi-cloud environments, sensitive command detection also faces challenges. Previously, sensitive command detection was done by comparing the content of the job script with the sensitive commands in the sensitive command set to determine whether the script contained sensitive commands. The parameters during script execution could not be scanned, and this parameter might contain sensitive commands, posing a security risk. When executing the script, each time a sensitive command was detected, manual review was required, increasing the workload of manual review.
[0063] A sensitive command security detection method provided by the present application can not only quickly detect whether there are any sensitive commands in the script content, but also add sensitive command security detection of the platform execution job script parameters, thereby improving the efficiency and security of script job execution.
[0064] The technical solution of the present application and how the technical solution of the present application solves the above-mentioned technical problems are described in detail below with specific embodiments. The following specific embodiments can be combined with each other, and the same or similar concepts or processes may not be repeated in some embodiments. The embodiments of the present application will be described below in conjunction with the accompanying drawings.
[0065] Figure 1 The process of the sensitive command security detection method provided in the embodiment of the present application Figure 1 ,like Figure 1 As shown, the method includes:
[0066] S101, obtaining script job information to be executed, wherein the script job information includes a job script and job execution parameters;
[0067] In this embodiment, the script job information to be executed refers to the content of the job stored on the automated job platform, or the content of the job that calls the automated job platform interface. The script job information includes basic information (including job name, job category, label, etc.), job execution parameters and job script. The job script includes script identification, version number, script type, and script content. The script type includes Python script or Shell script. The script execution parameters consist of parameter name, parameter value, and parameter type. Take Python script as an example:
[0068] print(input1+input2)
[0069] rm –rf /
[0070] Input1 and input2 are the names of the job execution parameters. The value of the job execution parameter input1 is rm-rf / and the parameter type is text. The value of the job execution parameter input2 is sftp and the parameter type is text.
[0071] S102: querying an operation sensitivity record table according to the identifier and version number of the job script to determine whether the script content in the job script contains sensitive commands, wherein the operation sensitivity record table includes the identifier and version number of the job script having sensitive commands;
[0072] In this embodiment, the operation sensitive record table is a database table used to record the identifier and version number of the job script containing sensitive commands after the sensitive command security detection, and the operation sensitive record table is queried through the identifier and version number of the job script to check whether the identifier and version number of the job script are in the operation sensitive record table. Among them, sensitive commands refer to instructions for operating privileged resources.
[0073] If the identifier and version number of the job script are found in the operation sensitive record table, it means that there are sensitive commands in the job script, and the sensitive commands corresponding to the identifier and version number can be obtained from the operation sensitive record table. If the identifier and version number of the job script are not found, it means that there are no sensitive commands in the job script.
[0074] In the present application, during the execution of the script job information, the operation sensitivity record table is queried through the identifier and version number to determine whether sensitive commands are included, which simplifies the search process and improves the efficiency of confirming sensitive commands.
[0075] S103, determining whether the job execution parameters include sensitive commands according to the job execution parameters and a sensitive command table, wherein the sensitive command table includes sensitive commands;
[0076] The sensitive command table consists of sensitive commands entered by operation and maintenance personnel on the automated operation platform. When executing the job script, the execution parameters of the script are matched with the sensitive commands in the sensitive command table to determine whether the job execution parameters contain sensitive commands.
[0077] In this embodiment, sensitive commands that match the job execution parameters can be obtained from the sensitive command table through a variety of matching algorithms. This embodiment does not impose any special restrictions on the matching algorithm.
[0078] In a specific example, a sensitive dictionary is constructed according to the sensitive command table, wherein the sensitive dictionary includes the sensitive commands in the sensitive command table;
[0079] A sensitive dictionary is constructed according to the sensitive commands in the sensitive command table, wherein the sensitive dictionary consists of sensitive commands and sensitive keywords.
[0080] Specifically, the sensitive commands in the sensitive command table are constructed into a Trie dictionary, i.e., a sensitive dictionary. The FlashText algorithm can receive an input string or document, where the string or document refers to the job execution parameter, and then traverse the character sequence of the job execution parameter one by one. When the character sequence of the job execution parameter matches a word in the dictionary, the standard keyword corresponding to the matched character sequence is output, i.e., the sensitive command is output.
[0081] For example: {'rm-rf':['rm-rf','rm-rf / ']} is a sensitive dictionary, where rm-rf in the dictionary is a sensitive keyword, and the dictionary value ['rm-rf','rm-rf / '] is a sensitive command. The FlashText algorithm is used to match a parameter in the job execution parameters with the sensitive command in the sensitive dictionary. If the match is successful, the sensitive keyword is found. For example: the value of the execution parameter input1 in the above python type script job is rm-rf / . The FlashText algorithm is used to match the content in the sensitive dictionary value, and the algorithm feedback is that the sensitive keyword rm-rf is found. If the first parameter does not match the sensitive keyword, traverse and search other execution parameters of the job to obtain the sensitive commands in the job execution parameters.
[0082] S104: Determine whether to execute the script job information based on the result of determining whether the script job information contains sensitive commands.
[0083] After the script job to be executed is detected for sensitive commands, if no sensitive commands are included, the script job information is executed. If sensitive information is included, the script job information is not executed temporarily, and it is further determined whether to execute the script job information.
[0084] The sensitive command security detection method provided by the present invention obtains script job information to be executed, and the script job information includes a job script and job execution parameters; queries an operation sensitive record table according to an identifier and a version number of the job script to determine whether the script content in the job script contains sensitive commands, thereby realizing sensitive command detection of the script content in the job script; determines whether the job execution parameters contain sensitive commands according to the job execution parameters and the sensitive command table, thereby realizing sensitive command detection of the script parameters in the job script; determines whether to execute the script job information according to the judgment result of whether the sensitive command is contained, thereby realizing sensitive command detection of the script content and script parameters of the script job, intercepting jobs containing sensitive commands, and ensuring the security of the system.
[0085] Figure 2 The process of the sensitive command security detection method provided in the embodiment of the present application Figure 2 ,like Figure 2 As shown, in this embodiment Figure 1 Based on the above embodiment, a method for pre-acquiring the operation sensitive record table is described in detail. The method includes:
[0086] S201, obtaining the script operation information that has been written;
[0087] When using the automated operation platform, you need to fill in the script operation information and save it. Saving the script operation information will trigger the security detection of sensitive commands. When performing security detection of sensitive commands, you need to obtain the script operation information, which includes the operation script, script identifier, script version, script content and other information.
[0088] S202: Determine whether the job script contains sensitive commands according to the job script in the script job information and the sensitive command table; if so, execute S203; if not, the process ends;
[0089] In the sensitive command security detection, the script content in the job script and the sensitive commands in the sensitive command table are matched through the FlashText algorithm to determine whether the job script content contains sensitive commands. If so, the next step is executed. If not, the system considers that the job script in the script job information does not contain sensitive commands, and this process ends.
[0090] S203: adding information of the job script to the operation sensitivity record table according to the identifier and version number of the job script and the sensitive command.
[0091] In the previous step, it is detected that the job script content contains sensitive commands. It is necessary to obtain the identifier and version number of the current job script, detect the sensitive commands contained in it, and record them in the sensitive record table.
[0092] Taking the above-mentioned Python type job script as an example, when the job is saved, the sensitive command detection of the script will be triggered. The FlashText algorithm detects that rm-rf / is a sensitive command. At this time, the sensitive record table is queried according to the identifier and version number of the job script. There is no record corresponding to the identifier and version number of the job script in the sensitive record table, indicating that the job has no sensitive security detection record. Then, a new record containing the identifier and version number of the job script is added.
[0093] By performing sensitive command detection when saving a script job, detection is achieved before the script job is executed, reducing the pressure of performing sensitive command detection when the script job is executed. At the same time, security issues in the script job are exposed in advance, allowing the script job operator to check and modify the script, and also providing an application basis for special script job applications.
[0094] Figure 3 The process of the sensitive command security detection method provided in the embodiment of the present application Figure 3 ,like Figure 3 As shown, in this embodiment Figure 1 Based on the above embodiment, whether to continue to execute the script job information is described in detail. The method includes:
[0095] S301. If the sensitive command is a sensitive command in a job script, directly obtain the target job script;
[0096] By performing sensitive command security detection on the target job script, if a sensitive command is found, the job script can be directly obtained.
[0097] S302: If the sensitive command is a sensitive command in a job execution parameter, the job script associated with the job execution parameter is used as the target job script.
[0098] In this real-time example, if the sensitive command is a job execution parameter, then the script for executing the execution parameter in the job is obtained, that is, the job script corresponding to the job execution parameter is used as the target job script.
[0099] S303, according to the identifier and version number of the target job script, query the script guarantee table to determine whether the target job script has been reviewed and approved, wherein the script guarantee table includes the job scripts that have been reviewed and not reviewed and the corresponding sensitive commands; if so, execute S304, if not, execute S305;
[0100] In this embodiment, after the script job is detected for sensitive commands, if it is found that the script job contains sensitive commands, the execution of this script job will be blocked. If this script job needs to be executed as a special job, a special job application is required. After the application is submitted, the special job approver will perform the approval operation. After approval, the information of this script job, the detected sensitive commands and the approval status will be recorded in the script guarantee table as a whitelist of sensitive commands for script job execution. When the script job is executed again, the above-mentioned sensitive commands are detected. According to the identification and version number of the target job script, the script guarantee table is queried to check whether the target script identification and version number and the detected sensitive commands have been reviewed and approved.
[0101] S304: If the target job script has been reviewed and approved, continue to execute the target job script.
[0102] If the script guarantee table is queried and it is found that the sensitive commands detected by the target job script in the script job have been reviewed and approved, the target job script will continue to be executed.
[0103] S305: If the target job script is not approved, intercepting the execution of the target job script;
[0104] If the script guarantee table is queried and it is found that the sensitive commands detected by the target job script in the script job have not been reviewed and approved, the target job script will be intercepted.
[0105] When sensitive commands are discovered during security checks on script jobs, special script jobs containing sensitive commands can be executed by querying the script guarantee table, thereby improving job execution efficiency.
[0106] If the operation script is not recorded in the script guarantee table, the information of the operation script is recorded, and prompt information is sent to the user terminal according to a preset period, so that the user terminal can review the unrecorded operation script;
[0107] In this implementation process, when a script job is performing sensitive command security detection and a sensitive command is discovered and an application for a special script job is made, the platform will send a prompt message to the special job approver, reminding the approver to perform the approval operation as soon as possible.
[0108] If the review pass information fed back by the user terminal is received, the information of the operation script is recorded in the script guarantee table.
[0109] When the special job approver has reviewed and approved it, the information of the job script will be recorded in the script guarantee table. When the special script job is executed next time, the system will not be intercepted due to the presence of sensitive commands through the guarantee of the script guarantee.
[0110] By adding special job approval and script guarantees, an execution channel is opened up for the execution of script jobs containing sensitive commands, improving job execution efficiency, system scalability and user experience.
[0111] Figure 4 This is a schematic diagram of the structure of the sensitive command security detection device provided in the embodiment of the present application. Figure 4 As shown, the sensitive command security detection device 40 includes: an acquisition module 401, a processing module 402, and an execution module 403.
[0112] The acquisition module 401 is used to acquire the script job information to be executed, wherein the script job information includes the job script and job execution parameters;
[0113] Processing module 402, for querying an operation sensitivity record table according to the identifier and version number of the job script to determine whether the script content in the job script contains sensitive commands, wherein the operation sensitivity record table includes the identifier and version number of the job script having sensitive commands;
[0114] The processing module 402 is further used to determine whether the job execution parameters include sensitive commands according to the job execution parameters and the sensitive command table, wherein the sensitive command table includes sensitive commands;
[0115] The execution module 403 is used to determine whether to execute the script job information according to the judgment result of whether the sensitive command is included.
[0116] In a possible design, the processing module 402 is further specifically configured to:
[0117] According to the sensitive command table, a sensitive dictionary is constructed, wherein the sensitive dictionary includes the sensitive commands in the sensitive command table;
[0118] The job execution parameters are traversed and searched through the sensitive dictionary to obtain sensitive commands existing in the job execution parameters.
[0119] In a possible design, the processing module 402 is further specifically used to: before obtaining the script job information to be executed, obtain the script job information that has been written;
[0120] Determining whether the job script contains sensitive commands according to the job script in the script job information and the sensitive command table;
[0121] If so, the information of the job script is added to the operation sensitivity record table according to the identifier and version number of the job script and the sensitive command.
[0122] In a possible design, the execution module 403 is further specifically configured to:
[0123] If a sensitive command is included, obtain the target job script corresponding to the sensitive command;
[0124] According to the identification and version number of the target job script, query the script guarantee table to determine whether the target job script has been reviewed and approved, wherein the script guarantee table includes job scripts that have been reviewed and not reviewed and the corresponding sensitive commands;
[0125] If the target job script has been reviewed and approved, continue to execute the target job script.
[0126] In a possible design, the execution module 403 is further specifically configured to:
[0127] If the sensitive command is a sensitive command in a job script, directly obtaining the target job script;
[0128] If the sensitive command is a sensitive command in the job execution parameter, the job script associated with the job execution parameter is used as the target job script.
[0129] In a possible design, the execution module 403 is further specifically configured to:
[0130] If the operation script is not recorded in the script guarantee table, the information of the operation script is recorded, and prompt information is sent to the user terminal according to a preset period, so that the user terminal can review the unrecorded operation script;
[0131] If the review pass information fed back by the user terminal is received, the information of the operation script is recorded in the script guarantee table.
[0132] In a possible design, the execution module 403 is further specifically configured to:
[0133] If the target job script is not approved, the execution of the target job script is intercepted.
[0134] Figure 5 The hardware diagram of the sensitive command security detection electronic device provided in the embodiment of the present application. Figure 5 As shown, the sensitive command security detection device 50 provided in this embodiment includes: at least one processor 501 and a memory 502. The device 50 also includes a communication component 503. The processor 501, the memory 502 and the communication component 503 are connected via a bus 504.
[0135] In a specific implementation process, at least one processor 501 executes the computer execution instructions stored in the memory 502, so that at least one processor 501 executes the above illegal external connection detection device training method.
[0136] The specific implementation process of the processor 501 can be found in the above method embodiment, and its implementation principle and technical effect are similar, so this embodiment will not be repeated here.
[0137] In the above Figure 5 In the illustrated embodiment, it should be understood that the processor may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), etc. A general-purpose processor may be a microprocessor or any conventional processor. The steps of the method disclosed in the invention may be directly implemented as being executed by a hardware processor, or may be executed by a combination of hardware and software modules in the processor.
[0138] The memory may include a high-speed RAM memory, and may also include a non-volatile storage NVM, such as at least one disk storage.
[0139] The bus may be an Industry Standard Architecture (ISA) bus, a Peripheral Component Interconnect (PCI) bus, or an Extended Industry Standard Architecture (EISA) bus, etc. The bus may be divided into an address bus, a data bus, a control bus, etc. For ease of representation, the bus in the drawings of the present application is not limited to only one bus or one type of bus.
[0140] The present application also provides a computer-readable storage medium, in which computer-executable instructions are stored. When a processor executes the computer-executable instructions, the above-mentioned sensitive command security detection method is implemented.
[0141] The computer-readable storage medium mentioned above can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic memory, flash memory, magnetic disk or optical disk. The readable storage medium can be any available medium that can be accessed by a general or special-purpose computer.
[0142] An exemplary readable storage medium is coupled to the processor so that the processor can read information from the readable storage medium and write information to the readable storage medium. Of course, the readable storage medium can also be a component of the processor. The processor and the readable storage medium can be located in an application specific integrated circuit (Application Specific Integrated Circuits, referred to as: ASIC). Of course, the processor and the readable storage medium can also exist in the device 50 as discrete components.
[0143] It should be noted that, for the aforementioned method embodiments, for the sake of simplicity, they are all expressed as a series of action combinations, but those skilled in the art should be aware that the present application is not limited by the described order of actions, because according to the present application, certain steps can be performed in other orders or simultaneously. Secondly, those skilled in the art should also be aware that the embodiments described in the specification are all optional embodiments, and the actions and modules involved are not necessarily required by the present application.
[0144] It should be further noted that, although the various steps in the flowchart are displayed in sequence according to the indication of the arrows, these steps are not necessarily executed in sequence according to the order indicated by the arrows. Unless there is a clear description in this article, there is no strict order restriction on the execution of these steps, and these steps can be executed in other orders. Moreover, at least a part of the steps in the flowchart may include multiple sub-steps or multiple stages, and these sub-steps or stages are not necessarily executed at the same time, but can be executed at different times, and the execution order of these sub-steps or stages is not necessarily to be carried out in sequence, but can be executed in turn or alternately with other steps or at least a part of the sub-steps or stages of other steps.
[0145] It should be understood that the above-mentioned device embodiments are only illustrative, and the device of the present application can also be implemented in other ways. For example, the division of units / modules in the above-mentioned embodiments is only a logical function division, and there may be other division methods in actual implementation. For example, multiple units, modules or components can be combined, or can be integrated into another system, or some features can be ignored or not executed.
[0146] In addition, unless otherwise specified, each functional unit / module in each embodiment of the present application may be integrated into one unit / module, each unit / module may exist physically separately, or two or more units / modules may be integrated together. The above-mentioned integrated unit / module may be implemented in the form of hardware or in the form of a software program module.
[0147] In the above embodiments, the description of each embodiment has its own emphasis. For parts not described in detail in a certain embodiment, please refer to the relevant description of other embodiments. The technical features of the above embodiments can be combined arbitrarily. In order to make the description concise, all possible combinations of the technical features in the above embodiments are not described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.
[0148] Those skilled in the art will readily appreciate other embodiments of the present application after considering the specification and practicing the invention disclosed herein. The present application is intended to cover any modification, use or adaptation of the present application, which follows the general principles of the present application and includes common knowledge or customary techniques in the art that are not disclosed in the present application. The specification and examples are intended to be exemplary only, and the true scope and spirit of the present application are indicated by the following claims.
[0149] It should be understood that the present application is not limited to the precise structures that have been described above and shown in the drawings, and that various modifications and changes may be made without departing from the scope thereof. The scope of the present application is limited only by the appended claims.
Claims
1. A sensitive command security detection method, characterized in that: Acquire script job information to be executed, wherein the script job information includes a job script and job execution parameters; According to the identification and version number of the job script, query the operation sensitivity record table to determine whether the script content in the job script contains sensitive commands, the operation sensitivity record table including the identification and version number of the job script having sensitive commands; Determining whether the job execution parameters include sensitive commands according to the job execution parameters and a sensitive command table, wherein the sensitive command table includes sensitive commands; Based on the result of determining whether sensitive commands are included, it is determined whether to execute the script job information.
2. The method according to claim 1, characterized in that: The determining, according to the job execution parameters and the sensitive command table, whether the job execution parameters contain sensitive commands includes: According to the sensitive command table, a sensitive dictionary is constructed, wherein the sensitive dictionary includes the sensitive commands in the sensitive command table; The job execution parameters are traversed and searched through the sensitive dictionary to obtain sensitive commands existing in the job execution parameters.
3. The method according to claim 1, characterized in that Before obtaining the script job information to be executed, the method further includes: Obtaining the script job information that has been written; Determining whether the job script contains sensitive commands according to the job script in the script job information and the sensitive command table; If so, the information of the job script is added to the operation sensitivity record table according to the identifier and version number of the job script and the sensitive command.
4. The method according to claim 1, characterized in that: The step of determining whether to execute the script job information according to the result of determining whether the script job information contains sensitive commands includes: If a sensitive command is included, obtain the target job script corresponding to the sensitive command; According to the identification and version number of the target job script, query the script guarantee table to determine whether the target job script has been reviewed and approved, wherein the script guarantee table includes job scripts that have been reviewed and not reviewed and the corresponding sensitive commands; If the target job script has been reviewed and approved, continue to execute the target job script.
5. The method according to claim 4, characterized in that The step of obtaining a target job script corresponding to the sensitive command includes: If the sensitive command is a sensitive command in a job script, directly obtaining the target job script; If the sensitive command is a sensitive command in the job execution parameter, the job script associated with the job execution parameter is used as the target job script.
6. The method according to claim 4, characterized in that The method further comprises: If the operation script is not recorded in the script guarantee table, the information of the operation script is recorded, and prompt information is sent to the user terminal according to a preset period, so that the user terminal can review the unrecorded operation script; If the review pass information fed back by the user terminal is received, the information of the operation script is recorded in the script guarantee table.
7. The method according to claim 4, characterized in that The method further comprises: If the target job script is not approved, the execution of the target job script is intercepted.
8. A sensitive command security detection device, characterized in that: include: An acquisition module, used to acquire script job information to be executed, wherein the script job information includes a job script and job execution parameters; A processing module, configured to query an operation sensitivity record table according to the identifier and version number of the job script to determine whether the script content in the job script contains sensitive commands, wherein the operation sensitivity record table includes the identifier and version number of the job script having sensitive commands; The processing module is further used to determine whether the job execution parameters include sensitive commands according to the job execution parameters and a sensitive command table, wherein the sensitive command table includes sensitive commands; The execution module is used to determine whether to execute the script job information according to the judgment result of whether the sensitive command is contained.
9. An electronic device, characterized in that: include: A processor, and a memory communicatively connected to the processor; The memory stores computer-executable instructions; The processor executes the computer-executable instructions stored in the memory to implement the method according to any one of claims 1 to 7.
10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer-executable instructions, which are used to implement the method according to any one of claims 1 to 7 when executed by a processor.