A bastion terminal monitoring and alarm method based on deep learning
By constructing a neural network model to analyze the screen image of the bastion machine terminal and determine the command risk level, the shortcomings of the existing bastion machine in high-risk command alarms are solved, and automated efficient and safe audit is achieved.
Patent Information
- Application Number
- CN202411867925.6
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-12-18
- Publication Date
- 2025-04-08
AI Technical Summary
The existing fortress machine has shortcomings in high-risk command alarms. It only provides terminal video recording functions, and requires manual viewing and recordings to be checked one by one, which is time-consuming and labor-intensive and easy to miss potential security threats.
The bastion machine terminal monitoring and alarm method is used based on deep learning to build a neural network model, and the terminal screen image is intercepted regularly, preprocessed and sent to the neural network model for analysis, judge the risk level of the command, and generate risk alarm information.
No manual inspection is required, which significantly reduces the work burden of administrators, improves work efficiency, can more effectively identify and respond to high-risk orders, and enhances the security audit capabilities of the fortress.
Smart Images
Figure CN119782101A_ABST
Abstract
Description
Technical Field
[0001] The present invention relates to the field of operation and maintenance technology, and in particular to a bastion terminal monitoring and alarm method based on deep learning. Background Art
[0002] A bastion host, also known as an operation and maintenance security audit system, is a device or software specifically designed to enhance network security and prevent unauthorized access and data leakage. The bastion host provides an additional layer of security protection for the enterprise's IT infrastructure by implementing strict identity authentication, access control, and operation audit mechanisms. The bastion host is usually an important part of the network boundary and is used as a "stepping stone" between the internal and external networks. This means that users need to go through the bastion host before they can further access other resources in the internal network. This method not only prevents external attackers from directly accessing internal resources, but also reduces the risks caused by misoperation or malicious behavior of internal users. In terms of security, the main purpose of the bastion host is to protect the internal IT resources of the enterprise through strict access control, identity authentication, and operation auditing.
[0003] However, even with these measures, the commands entered by users on the bastion host terminal may bring a series of risks. For example, executing commands that elevate their own permissions, modifying configuration files, frequently deleting files, etc. For such risks, the bastion host has an operation audit function, which is also one of the core functions of the bastion host. By real-time monitoring of user operations, abnormal behaviors can be discovered in a timely manner. At the same time, operation logs are regularly analyzed to discover potential security threats. When high-risk commands or abnormal behaviors are detected, an alarm notification will be sent immediately to the administrator. This operation audit function can ensure that all operations have traces to follow, which is convenient for security review and problem tracking. However, some bastion host operating systems (such as Windows) have obvious deficiencies in high-risk command alarms. They only provide terminal recording functions. When high-risk behaviors occur, they can only be checked one by one by manually viewing the recordings. This is not only time-consuming and labor-intensive, but also easy to miss potential security threats. For security alarms, this is obviously not timely and efficient enough. Summary of the invention
[0004] In order to solve the above problems, the present invention provides a bastion host terminal monitoring and alarm method based on deep learning, which can efficiently monitor the bastion host without the time cost of manual inspection, thereby reducing the workload of administrators and improving work efficiency.
[0005] In order to achieve the above object, the technical solution adopted by the present invention is:
[0006] A bastion terminal monitoring and alarm method based on deep learning includes the following steps:
[0007] S1. Build a neural network model and deploy the neural network model on the server of the bastion host;
[0008] S2. Regularly capture the screen content displayed on the terminal screen to obtain a screenshot, format the screenshot, and mark the file name of the screenshot;
[0009] S3. Obtain the screenshot of step S2, and preprocess the screenshot to obtain a screen image;
[0010] S4. Sending the screen image to the neural network model, the neural network model analyzes the screen image, and determining the risk level of the command corresponding to the screen image by obtaining the output result of the neural network model;
[0011] S5. Generate risk warning information based on the risk level, and send the risk warning information to the management end.
[0012] Furthermore, in step S1, constructing a neural network model includes the following steps:
[0013] S1.1 obtains training screenshots of the terminal screen, saves the training screenshots as screenshot files, labels the screenshot files according to low-risk commands and high-risk commands, and divides the labeled screenshot files into a training set, a test set, and a validation set;
[0014] S1.2 extract the key features of the low-risk commands and high-risk commands in the training set through the convolution layer of the training model for classification decision-making; reduce the amount of calculation and the number of parameters through the pooling layer of the training model; convert the images of the training set into feature vectors of fixed length through the fully connected layer of the training model, and map the key features to output categories or predicted values; output the recognition results through the output layer of the training model;
[0015] S1.3 using the test set to optimize the accuracy of the training model and the recall rate of high-risk commands;
[0016] S1.4 uses the validation set to adjust the hyperparameters of the training model, and obtains the neural network model after adjusting the training model by using L1 or L2 regularization.
[0017] Furthermore, in step S1.1, when the user operates the terminal, a first interval time for screenshot is set, and an image of the terminal screen is taken after each time the first interval time elapses and saved as the screenshot file.
[0018] Furthermore, in step S1, a related dependency library is installed on the bastion host, and the neural network model is converted into ONNX format, the neural network model is loaded using the related dependency library, and it is recommended to grant read and write permissions to the saving path of the neural network model.
[0019] Furthermore, in step S2, the terminal is monitored to listen to the keyboard input signal of the terminal, and a second interval time for screenshot is set. When the keyboard input signal is obtained by monitoring, the image of the terminal screen is taken after each second interval time until the preset monitoring time is reached.
[0020] Furthermore, in step S2, the file name of the screenshot includes a timestamp tag and a user identifier.
[0021] Furthermore, in step S3, the screenshot is adjusted to a uniform size, and the pixel value of the screenshot is normalized to between 0 and 1 to obtain the screen image.
[0022] Further, in step S3, the screen image is saved in a screenshot folder;
[0023] In step S4, the neural network model is provided with a data transmission module, and the data transmission module is used for directory monitoring of the screenshot folder to read the newly generated screen image.
[0024] Furthermore, in step S5, when the risk level of the screen image is low risk or high risk, the screen image is called and risk warning information is generated, wherein the risk warning information includes the screen image, command content, execution time, and user identification.
[0025] The beneficial effects of the present invention are:
[0026] A neural network model is constructed with low-risk commands and high-risk commands as key features, and multiple convolutional layers are set in the neural network model to extract key features in the image for classification decisions, so as to more effectively learn the representation of data and perform the task of command recognition; by setting a pooling layer, the calculation amount and number of parameters of the model are reduced, which helps to reduce the training time of the training model and improve the training efficiency. At the same time, the pooling layer can also prevent overfitting and reduce the model's excessive dependence on training data. The fully connected layer can convert the feature map into a feature vector of fixed length, which is responsible for mapping the features extracted by the previous layer to the output category or predicted value. Through the action of the activation function, the fully connected layer can convert the features into probability distributions for different categories, thereby realizing the classification task. The final result is generated via the output layer, so that it can be determined whether the input command belongs to a low-risk command or a high-risk command. At the same time, the present invention uses the keyboard input signal as the monitoring signal, and calls the screenshot when the keyboard is detected to input a command, which can reduce repeated screenshots and ensure recognition efficiency and accuracy. The present invention can solve the shortcomings of the audit function of bastion hosts of different operating systems. Some operating systems only have a recording function, which requires a lot of time and labor costs for operation and maintenance managers to view the recordings and find system failures, high-risk vulnerabilities and risky operations. BRIEF DESCRIPTION OF THE DRAWINGS
[0027] Figure 1 It is a flowchart of a bastion terminal monitoring and alarm method based on deep learning according to a preferred embodiment of the present invention.
[0028] Figure 2 It is a schematic diagram of a screenshot file of a deep learning-based bastion terminal monitoring and alarm method according to a preferred embodiment of the present invention. DETAILED DESCRIPTION
[0029] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.
[0030] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as those commonly understood by those skilled in the art of the present invention. The terms used herein in the specification of the present invention are only for the purpose of describing specific embodiments and are not intended to limit the present invention. The term "and / or" used herein includes any and all combinations of one or more related listed items.
[0031] Please also see Figure 1 and Figure 2 A bastion terminal monitoring and alarm method based on deep learning according to a preferred embodiment of the present invention comprises the following steps:
[0032] S1. Build a neural network model and deploy it on the bastion server.
[0033] In step S1, the steps of constructing a neural network model include:
[0034] S1.1 obtains training screenshots of the terminal screen and saves the training screenshots as screenshot files, labels the screenshot files according to low-risk commands and high-risk commands, and divides the labeled screenshot files into a training set, a test set, and a validation set;
[0035] In step S1.1, when the user operates the terminal, the first interval time of the screenshot is set, and the terminal screen image is taken after each first interval time, and saved as a screenshot file. The first interval time can be 1s, and auxiliary annotation is performed using annotation tools such as LabelImg, LabelMe, etc., so as to improve the annotation efficiency. The annotation schematic diagram is as follows Figure 2 shown.
[0036] S1.2 Extract the key features of low-risk commands and high-risk commands in the training set through the convolutional layer of the training model for classification decisions; reduce the amount of calculation and the number of parameters through the pooling layer of the training model; convert the images of the training set into feature vectors of fixed length through the fully connected layer of the training model, and map the key features to the output category or predicted value; output the recognition results through the output layer of the training model.
[0037] S1.3 uses the test set to optimize the accuracy of the training model and the recall rate of high-risk commands. In this embodiment, the F1 score of the neural network can be calculated to help balance the performance of different categories and ensure that the model has good processing capabilities for all categories.
[0038] S1.4 uses the validation set to adjust the hyperparameters of the training model, and adjusts the training model to obtain a neural network model by using L1 or L2 regularization.
[0039] In this embodiment, the training screenshots use data augmentation technology to increase the amount of data and improve the generalization ability of the model. Data augmentation methods include: rotation, flipping, cropping and scaling, etc. More high-risk command screenshots can also be generated by synthesizing data. The ratio of training set, test set and validation set is 7:2:1.
[0040] The structure of the training model consists of convolutional layers, pooling layers, fully connected layers, and output layers. Multiple convolutional layers are designed to extract key features from the image, which can then be used for classification decisions, thereby more effectively learning data representations and performing complex tasks. Pooling layers are designed to reduce the amount of computation and the number of parameters of the model, which helps to reduce the training time of the model and improve training efficiency. Pooling layers can also prevent overfitting and reduce the model's excessive dependence on training data. The fully connected layer can convert feature maps into fixed-length feature vectors and is responsible for mapping the features extracted by the previous layers to output categories or predicted values. Through the action of activation functions (such as the SoftMax function), the fully connected layer can convert features into probability distributions for different categories, thereby achieving classification tasks. The final result is generated via the output layer.
[0041] In this embodiment, for Windows system:
[0042] Low risk commands:
[0043] dir: List directory contents.
[0044] cd: Change the current directory.
[0045] echo: Displays messages or variable contents.
[0046] ping: Tests network connectivity.
[0047] ipconfig: Display network interface information.
[0048] High-risk commands:
[0049] del or erase: Delete a file or directory. For example, del C:\important_file.txt will permanently delete the specified file.
[0050] format: Formats a disk partition, which will cause all data on the partition to be lost. For example, format D: will format drive D.
[0051] shutdown or restart: shut down or restart the computer. For example, shutdown / s will shut down immediately.
[0052] net user and net localgroup: manage user accounts and groups. Improper use can cause permission issues.
[0053] sc: Service control, which can start, stop or configure services, which may cause system instability.
[0054] For Linux systems:
[0055] Low risk commands:
[0056] ls: List directory contents.
[0057] cd: Change the current working directory.
[0058] echo: Output text or variable value.
[0059] ping: Tests network connectivity.
[0060] ifconfig or ip addr: Display network interface information.
[0061] High-risk commands:
[0062] rm: Delete a file or directory. For example, rm -rf / is a very dangerous command that will try to recursively delete all files in the root directory.
[0063] dd: used to transfer and copy files, but can also be used to erase hard disk data. For example, dd if= / dev / zeroof= / dev / sda will clear the hard disk to zeros.
[0064] chmod and chown: Change file permissions and ownership. Improper use may undermine system security.
[0065] shutdown or reboot: shut down or restart the system.
[0066] apt-get remove or yum erase: Remove software packages. If critical system components are deleted by mistake, the system may not run normally.
[0067] service or systemctl: used to manage system services. Stopping critical services (such as network services) may cause service interruption.
[0068] In step S1, relevant dependent libraries are installed on the bastion host, and the neural network model is converted into ONNX format. The neural network model is loaded using the relevant dependent libraries, and it is recommended to grant read and write permissions to the save path of the neural network model. The relevant dependent libraries include ONNX runtime library, image processing library Pillow, etc.
[0069] S2. Periodically capture the screen content displayed on the terminal screen to obtain a screenshot, format the screenshot, and mark the file name of the screenshot.
[0070] In step S2, the terminal is monitored to listen to the keyboard input signal of the terminal, and a second interval time for screenshot is set. When the keyboard input signal is obtained by monitoring, the image of the terminal screen is taken after each second interval time until the preset monitoring time is reached. In this embodiment, the keyboard input signal is used as the monitoring signal, and the screenshot is called when the keyboard is detected to be inputting a command, which can reduce repeated screenshots and ensure recognition efficiency and accuracy.
[0071] In step S2, the file name of the screenshot includes a timestamp tag and a user ID. In this embodiment, the screenshot file is saved as a PNG format file, and the file name includes a timestamp and a user ID, such as user1_20241001_123456.png, to facilitate information identification of the subsequent transmission module.
[0072] S3. Get the screenshot of step S2, and pre-process the screenshot to obtain a screen image.
[0073] In step S3, the screenshot is adjusted to a uniform size, and the pixel value of the screenshot is normalized to between 0 and 1 to obtain a screen image. In this embodiment, the screenshot is preprocessed, and the image file is read using the Pillow library, the image is adjusted to a uniform size, such as 640×480, and the image pixel value is normalized to between 0 and 1, which can reduce the image recognition error caused by the pixel value.
[0074] In step S3, the screen image is saved in a screenshot folder.
[0075] S4. Send the screen image to the neural network model, which analyzes the screen image and determines the risk level of the command corresponding to the screen image by obtaining the output result of the neural network model.
[0076] In step S4, the neural network model is provided with a data transmission module, and the data transmission module is used for directory monitoring of the screenshot folder to read the newly generated screen image.
[0077] S5. Generate risk warning information based on the risk level and send the risk warning information to the management end.
[0078] In step S5, when the risk level of the screen image is low risk or high risk, the screen image is called and risk warning information is generated, and the risk warning information includes the screen image, command content, execution time, and user ID. In this embodiment, when a low-risk command is detected, the risk warning information can be sent to the administrator end by email, text message, etc., and when a high-risk command is detected, it is sent to the administrator end by voice call.
[0079] This embodiment solves the shortcomings of the audit function of bastion hosts of different operating systems. Some operating systems only have a recording function, which requires a lot of time and labor costs for operation and maintenance managers to view the recordings to find system failures, high-risk vulnerabilities, and risky operations.
Claims
1. A bastion terminal monitoring and alarm method based on deep learning, characterized in that: The steps include: S1. Build a neural network model and deploy the neural network model on the server of the bastion host; S2. Regularly capture the screen content displayed on the terminal screen to obtain a screenshot, format the screenshot, and mark the file name of the screenshot; S3. Obtain the screenshot of step S2, and preprocess the screenshot to obtain a screen image; S4. Sending the screen image to the neural network model, the neural network model analyzes the screen image, and determining the risk level of the command corresponding to the screen image by obtaining the output result of the neural network model; S5. Generate risk warning information based on the risk level, and send the risk warning information to the management end.
2. According to a deep learning-based bastion terminal monitoring and alarm method according to claim 1, it is characterized in that: In step S1, the steps of constructing a neural network model include: S1.1 obtains training screenshots of the terminal screen, saves the training screenshots as screenshot files, labels the screenshot files according to low-risk commands and high-risk commands, and divides the labeled screenshot files into a training set, a test set, and a validation set; S1.2 extract the key features of the low-risk commands and high-risk commands in the training set through the convolution layer of the training model for classification decision-making; reduce the amount of calculation and the number of parameters through the pooling layer of the training model; convert the images of the training set into feature vectors of fixed length through the fully connected layer of the training model, and map the key features to output categories or predicted values; output the recognition results through the output layer of the training model; S1.3 using the test set to optimize the accuracy of the training model and the recall rate of high-risk commands; S1.4 uses the validation set to adjust the hyperparameters of the training model, and obtains the neural network model after adjusting the training model by using L1 or L2 regularization.
3. According to a deep learning-based bastion terminal monitoring and alarm method according to claim 2, it is characterized in that: In step S1.1, when the user operates the terminal, a first interval time for screenshot is set, and an image of the terminal screen is taken after each time the first interval time elapses and saved as the screenshot file.
4. According to a deep learning-based bastion terminal monitoring and alarm method according to claim 1, it is characterized in that: In step S1, the relevant dependency library is installed on the bastion host, and the neural network model is converted into the ONNX format, the neural network model is loaded using the relevant dependency library, and it is recommended to grant read and write permissions to the saving path of the neural network model.
5. According to a deep learning-based bastion terminal monitoring and alarm method according to claim 1, it is characterized in that: In step S2, the terminal is monitored to listen to the keyboard input signal of the terminal, and a second interval time for screenshot is set. When the keyboard input signal is monitored, the image of the terminal screen is taken after each second interval time until the preset monitoring time is reached.
6. According to a deep learning-based bastion terminal monitoring and alarm method according to claim 1, it is characterized in that: In step S2, the file name of the screenshot includes a timestamp tag and a user identifier.
7. According to a deep learning-based bastion terminal monitoring and alarm method according to claim 1, it is characterized in that: In step S3, the screenshot is adjusted to a uniform size, and the pixel value of the screenshot is normalized to between 0 and 1 to obtain the screen image.
8. According to a deep learning-based bastion terminal monitoring and alarm method according to claim 7, it is characterized in that: In step S3, the screen image is saved in a screenshot folder; In step S4, the neural network model is provided with a data transmission module, and the data transmission module is used for directory monitoring of the screenshot folder to read the newly generated screen image.
9. According to a deep learning-based bastion terminal monitoring and alarm method according to claim 8, it is characterized in that: In step S5, when the risk level of the screen image is low risk or high risk, the screen image is called and risk warning information is generated, wherein the risk warning information includes the screen image, command content, execution time, and user identification.