System command information auditing method and device, equipment and medium

Abstract

The invention relates to the technical field of network security auditing, and discloses a system command information auditing method, device and equipment and a medium, and the method comprises the following steps: when a user logs in an operating system through terminal equipment, starting a script file under a specific configuration directory in the system; specific environment variables are set through the script file to obtain login information and command line operation information of a user, and the login information and the command line operation information are stored in a record file; when the acquisition program monitors that the record information in the record file is changed, newly added record information in the record file is uploaded to the cloud platform; according to the method and the system, the specific environment variables are set through the self-starting script file to collect the login information and the command line operation information of the user, and the login information and the command line operation information are uploaded to the cloud platform for auditing, so that the user can be automatically audited, and the user experience is improved. The to-be-audited information can be recorded efficiently and comprehensively, and the network security audit effect is ensured.

Description

Technical Field

[0001] The present invention relates to the technical field of network security auditing, and in particular to a system command information auditing method, device, computer equipment and storage medium. Background Art

[0002] In the daily network operation and maintenance process, it is necessary to obtain, record, store, analyze and use security-related activity information to establish "post-event" security measures, provide clues and evidence for security incident analysis, and make it easier to trace and troubleshoot problems. The log records generated by the audit can also be used as evidence. Therefore, when auditing network security, the operation records of different users on the system are an important basic material.

[0003] Currently, when obtaining command line record information in the operating system, it is usually based on the system Bash history function to view the default recorded historical commands or to use a customized Bash program to record the operation command, so as to facilitate the audit of the operation information. When recording the operation command in the above manner, it is easy to face the problem that the operation record is easy to be maliciously cleaned or the cost of custom program development is high, which makes it difficult to conduct a comprehensive network security audit of the operation record, affecting the audit effect. Summary of the invention

[0004] In view of this, the present invention provides a system command information audit method, apparatus, computer equipment and storage medium to solve the problem that it is difficult to conduct a comprehensive network security audit of operation records, which affects the audit effect.

[0005] In a first aspect, the present invention provides a system command information audit method, the method comprising:

[0006] When the user logs in to the target operating system through the terminal device, the script file in the specific configuration directory in the target operating system is started;

[0007] Setting environment variables through the script file to obtain the user's login information and command line operation information, and storing them in a record file, wherein the record information in the record file is monitored by a collection program deployed on the server;

[0008] When the acquisition program detects that the record information in the record file has changed, the newly added record information in the record file is uploaded to the cloud platform;

[0009] The sensitive operation information in the recorded information is determined through the pre-configured scheduled audit tasks and preset audit rules in the cloud platform, and an automated audit is performed.

[0010] The method provided in this aspect obtains the user's login information and subsequent command line operation information by setting specific environment variables using a script file in a specific directory when the user logs in to the target operating system, and stores the collected information in a record file. At the same time, the record file is monitored in real time through a collection program. When the information in the record file changes, the new information is uploaded to the cloud platform in a timely manner, so that the cloud platform can perform regular audits on the uploaded information. Non-intrusive record information collection can be achieved under simple and economical conditions, while ensuring the comprehensiveness of the record information, thereby ensuring the effectiveness of network security audits.

[0011] In an optional implementation, when the acquisition program detects that the record information in the record file has changed, uploading the newly added record information in the record file to the cloud platform includes:

[0012] When the record information in the record file changes, determining the newly added record information in the record file through the acquisition program;

[0013] Detecting the content format of the newly added record information to determine whether the newly added record information involves sensitive information;

[0014] If involved, the sensitive information is replaced, the new record information in the record file is updated, and the new record information after the information replacement is uploaded to the cloud platform.

[0015] This implementation manner performs a confidentiality check on the newly added record information when the record information in the record file changes. When the newly added record information contains confidential information, the confidential information therein is replaced in a timely manner, and the corresponding new information in the record file is updated based on the replaced new information, and uploaded to the cloud, thereby effectively ensuring the security of the confidential information.

[0016] In an optional implementation manner, determining the newly added record information in the record file by the acquisition program includes:

[0017] Determining a monitoring position of the current acquisition program relative to the record file;

[0018] When the record information in the record file changes, the record information located after the monitoring position is determined as the newly added record information.

[0019] In this implementation manner, the newly added record information is determined by collecting the monitoring position of the program relative to the record file, which can effectively ensure the accuracy of the newly added record information and avoid repeated uploading of the newly added record information or uploading of erroneous information.

[0020] In an optional implementation, after uploading the newly added record information in the record file to the cloud platform, the method further includes:

[0021] Determine whether the newly added record information is uploaded successfully;

[0022] If the upload is successful, the monitoring position of the acquisition program relative to the record file is updated to the end of the newly added record information;

[0023] If the upload fails, the monitoring position of the acquisition program relative to the record file remains unchanged.

[0024] In this embodiment, after uploading information, it is determined whether to update the monitoring position of the acquisition program relative to the record file based on whether the upload is successful. When the upload fails, the monitoring position is not changed to ensure that the information that failed to be uploaded last time can be uploaded together when uploading the next layer of information, thereby avoiding omissions in uploading record information.

[0025] In an optional implementation, setting specific environment variables through the script file to obtain the user's login information and command line operation information includes:

[0026] Set the PROMPT_COMMAND environment variable through the script file to obtain the user's login information and command line operation information.

[0027] In this implementation, the PROMPT_COMMAND environment variable is set through a script file, so that the acquisition of login information and command operation information can be realized simply and quickly, thereby ensuring the economy and speed of information collection.

[0028] In an optional embodiment, the method further includes:

[0029] The acquisition program provides a daemon service for the PROMPT_COMMAND environment variable and the script file, so as to repair the PROMPT_COMMAND environment variable or the script file when the configuration information is abnormal.

[0030] In this implementation, by protecting the script file and the PROMPT_COMMAND environment variable, the stability of information collection can be ensured, and omission of collected information due to modification of the file or environment variable can be avoided.

[0031] In an optional implementation, before uploading the newly added record information in the record file to the cloud platform, the method further includes:

[0032] Determine whether the current network environment is a pure intranet environment;

[0033] If yes, the newly added record information is uploaded to the cloud platform through the proxy network.

[0034] This implementation method ensures the stability of information uploading by uploading information through a proxy network when the network environment is a pure intranet environment.

[0035] In a second aspect, the present invention provides a system command information auditing device, the device comprising:

[0036] The script startup module is used to start the script file in a specific configuration directory in the target operating system when the user logs in to the target operating system through the terminal device;

[0037] An information recording module, used to set specific environment variables through the script file to obtain the user's login information and command line operation information, and store them in a record file, and the record information in the record file is monitored by the collection program deployed on the server;

[0038] An information uploading module, used for uploading the newly added record information in the record file to the cloud platform when the acquisition program detects that the record information in the record file has changed;

[0039] The cloud audit module is used to determine the sensitive operation information in the recorded information through the pre-configured scheduled audit tasks and preset audit rules in the cloud platform, and perform automated auditing.

[0040] In a third aspect, the present invention provides a computer device comprising: a memory and a processor, the memory and the processor being communicatively connected to each other, the memory storing computer instructions, and the processor executing the system command information audit method of the first aspect or any corresponding embodiment thereof by executing the computer instructions.

[0041] In a fourth aspect, the present invention provides a computer-readable storage medium having computer instructions stored thereon, the computer instructions being used to enable a computer to execute the system command information auditing method of the first aspect or any corresponding embodiment thereof. BRIEF DESCRIPTION OF THE DRAWINGS

[0042] In order to more clearly illustrate the specific implementation methods of the present invention or the technical solutions in the prior art, the drawings required for use in the specific implementation methods or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are some implementation methods of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0043] Figure 1 is a flow chart of a system command information audit method according to an embodiment of the present invention;

[0044] Figure 2 is a flow chart of another system command information audit method according to an embodiment of the present invention;

[0045] Figure 3 is an example diagram of an operation command information recording process according to an embodiment of the present invention;

[0046] Figure 4 is an example diagram of a collection procedure workflow according to an embodiment of the present invention;

[0047] Figure 5 is an example diagram of a sensitive information replacement process according to an embodiment of the present invention;

[0048] Figure 6 is a structural block diagram of a system command information auditing device according to an embodiment of the present invention;

[0049] Figure 7 It is a schematic diagram of the hardware structure of a computer device according to an embodiment of the present invention. DETAILED DESCRIPTION

[0050] In order to make the purpose, technical solution and advantages of the embodiments of the present invention clearer, the technical solution in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative work are within the scope of protection of the present invention.

[0051] In the daily network operation and maintenance process, it is necessary to obtain, record, store, analyze and use security-related activity information to establish "post-event" security measures, provide clues and evidence for security incident analysis, and make it easier to trace and troubleshoot problems. The log records generated by the audit can also be used as evidence. Therefore, when auditing network security, the operation records of different users on the system are an important basic material.

[0052] Currently, when obtaining command line record information in the operating system, it is usually based on the system Bash history function to view the default recorded historical commands or to use a customized Bash program to record the operation command, so as to facilitate the audit of the operation information. When recording the operation command in the above manner, it is easy to face the problem that the operation record is easy to be maliciously cleaned or the cost of custom program development is high, which makes it difficult to conduct a comprehensive network security audit of the operation record, affecting the audit effect.

[0053] To this end, an embodiment of the present invention provides a system command information auditing method. When a user logs into a target operating system, a script file set in a specific directory is used to obtain the user's login information and subsequent command line operation information, and the collected information is stored in a record file. At the same time, the record file is monitored in real time through a collection program. When the information in the record file changes, the new information is uploaded to the cloud platform in time, so that the cloud platform can perform regular audits on the uploaded information. The collection of record information can be achieved under simple and economical conditions, while ensuring the comprehensiveness of the record information, thereby ensuring the effectiveness of network security audits.

[0054] According to an embodiment of the present invention, a system command information audit method embodiment is provided. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and although a logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0055] In this embodiment, a system command information audit method is provided, which can be used for the above-mentioned network security audit. Figure 1 is a flow chart of a system command information audit method according to an embodiment of the present invention. Figure 1 As shown, the process includes the following steps:

[0056] Step S101, when a user logs in to a target operating system through a terminal device, a script file in a specific configuration directory in the target operating system is started.

[0057] For the operating system, there will be a configuration directory inside it. When the system starts, a series of files in the configuration directory will be automatically started. For example, in the Linux system, when the system starts, a series of files in the / etc / profile.d directory will be automatically started to ensure the operation of the system. Therefore, in order to obtain relevant login information and command operation information later, the developer will place a pre-configured script file for obtaining relevant information in this directory. Suppose the script file is collect.sh. When the user logs in to the system through a terminal device, after the system starts, a series of files in the / etc / profile.d directory will be automatically started, including collect.sh placed in this directory in advance.

[0058] Step S102, setting specific environment variables through the script file to obtain the user's login information and command line operation information, and store them in a record file. The record information in the record file is monitored by the collection program deployed on the server.

[0059] After the script file is started, it can execute the internal preset program to set certain environment variables in the system, and then automatically obtain the relevant login information of the currently logged-in user, such as the current user account, command execution account, source IP, terminal number and other operator-related information. At the same time, it will also collect a series of command line operation information executed by subsequent users, and record the collected command line operation information in a record file under a preset path. Each record information stored in the record file contains specific command operation information and corresponding login information to determine who executed the corresponding command operation in what way. The record file will be monitored by a pre-written collection program to upload the new information to the cloud for storage when the information in the record file changes.

[0060] For example, for a Linux system, a user usually executes a series of operation commands through Bash, and the specific descriptions of these operation commands are collected by the environment variables set by the above script file and saved one by one in a record file.

[0061] Step S103, when the acquisition program detects that the record information in the record file has changed, the newly added record information in the record file is uploaded to the cloud platform.

[0062] As mentioned above, the collection program will monitor the information in the record file. When it detects that the information in the record file has changed, it means that new record information has appeared in the current record file. At this time, the collection program can determine which specific information is the new record information and upload the new record information to the cloud platform for storage.

[0063] In one example, for a Linux system, there is a history file for recording command line operation information. However, compared with the record file in the embodiment of the present invention, the content described by each record information in the history file is relatively simple, and it can be easily modified or cleared by a malicious login user. Therefore, in the embodiment of the present invention, the record file has already recorded the relevant operation information and uploaded it to the cloud. The acquisition program can regularly clean up the information in the history file to avoid the security risks of the information recorded therein after the system is maliciously invaded.

[0064] Step S104, determining sensitive operation information in the recorded information through the scheduled audit tasks and preset audit rules pre-configured in the cloud platform, and performing automated auditing.

[0065] For the cloud platform, all uploaded operation records are stored inside. For each operation record, it records which users have accessed or operated which files or internal components, as well as the specific recording time, terminal identification number, IP information, etc. Audit tasks that need to be performed regularly can be pre-configured inside the cloud platform, and the operation information involving sensitive files or sensitive components in these operation information is defined as sensitive operation information, where sensitive files or sensitive components can be defined according to actual conditions. According to specific audit tasks, the relevant login information of the operating user of sensitive operation information is automatically audited to ensure the network security of the target operating system. For example, audit whether the operating user corresponding to the sensitive operation information is an internal staff or a person with corresponding authority, so that when sensitive information is accessed or executed by external users or unauthorized users, it can be discovered in time and handled accordingly.

[0066] In an example, the operation record information in the corresponding server may also be audited manually, and the specific audit method may be set according to the actual situation and is not limited here.

[0067] The system command information auditing method provided in this embodiment obtains the user's login information and subsequent command line operation information by using a script file set in a specific directory when the user logs in to the target operating system, and stores the collected information in a record file. At the same time, the record file is monitored in real time through a collection program. When the information in the record file changes, the new information is uploaded to the cloud platform in time, so that the cloud platform can perform regular audits on the uploaded information. The collection of record information can be achieved under simple and economical conditions, while ensuring the comprehensiveness of the record information, thereby ensuring the effectiveness of network security audits.

[0068] According to an embodiment of the present invention, another system command information audit method embodiment is provided, which can be used for the above-mentioned network security audit. Figure 2 FIG. 4 is a flowchart of another system command information audit method according to an embodiment of the present invention. Figure 2 As shown, the process includes the following steps:

[0069] Step S201: When a user logs in to a target operating system through a terminal device, a script file in a specific configuration directory in the target operating system is started. Figure 1 Step S101 of the illustrated embodiment will not be described in detail here.

[0070] Step S202, setting specific environment variables through the script file to obtain the user's login information and command line operation information, and store them in a record file. The record information in the record file is monitored by the collection program deployed on the server.

[0071] Specifically, in step S202, specific environment variables are set through a script file to obtain the user's login information and command line operation information, including:

[0072] Set the PROMPT_COMMAND environment variable through the script file to obtain the user's login information and command line operation information.

[0073] The script file mentioned above is used to automatically execute the script after the user logs into the system Bash terminal to export the environment variable PROMPT_COMMAND. The terminal operation commands are recorded in real time to the corresponding file on the system server through Bash's built-in environment variable PROMPT_COMMAND.

[0074] For example, the specific information of the script file may be as follows:

[0075] PROMPT_COMMAND='if[-z"${CTHS_FLAG}"];

[0076] then export CTHS_FLAG=1;

[0077] else history 1|{read

[0078] The above-mentioned specific script program can be used to obtain user login information and subsequent specific command line operation information.

[0079] Furthermore, the method also includes: providing a daemon service for the PROMPT_COMMAND environment variable and the script file through a collection program, so as to repair the PROMPT_COMMAND environment variable or the script file when the configuration information is abnormal.

[0080] It can be understood that for the collection program deployed in the system server, it can protect the PROMPT_COMMAND environment variable and script files used for operation information collection, so as to repair the specific configuration information inside when a malicious logged-in user modifies the content or when its own configuration information becomes abnormal due to abnormal operation, thereby ensuring that the operation record information can be stably stored in the record file to avoid omission of operation information.

[0081] Step S203, when the acquisition program detects that the record information in the record file has changed, the newly added record information in the record file is uploaded to the cloud platform.

[0082] Specifically, in step S203, when the acquisition program detects that the record information in the record file has changed, the newly added record information in the record file is uploaded to the cloud platform, including:

[0083] Step S203-1: when the record information in the record file changes, the newly added record information in the record file is determined through the collection program.

[0084] In the process of the acquisition program monitoring the record file, when the record information in the record file changes, it will be determined which record information in the record file is the newly added record information after the current change.

[0085] Specifically, in step S203-1, the newly added record information in the record file is determined by the acquisition program, including:

[0086] Determine the monitoring position of the current acquisition program relative to the record file;

[0087] When the record information in the record file changes, the record information located after the monitoring position is determined as the newly added record information.

[0088] It can be understood that the configuration information of the acquisition program itself will contain its specific monitoring position relative to the record file. For example, if there are 10 records in the record file, its current monitoring position is the end of the 10th information. When new records appear in the record file, the information after the monitoring position can be determined as the new records, so as to upload the new records later.

[0089] Furthermore, after the subsequent upload is completed, its own monitoring position will be updated. Taking the above example, assuming that the newly added record information is the 11th record information, after uploading it, the monitoring position will be updated to the end of the 11th record information to facilitate the determination of the next newly added information.

[0090] Step S203-2: Detect the content format of the newly added record information to determine whether the newly added record information involves sensitive information.

[0091] After the newly added record information is determined, the content format of the newly added record information will be detected. During the detection process, it will be determined whether the newly added record information involves sensitive information, such as mysql command passwords and other password-carrying commands.

[0092] Furthermore, during the content format detection process, it will be determined whether the specific format of the newly added record information is correct, such as whether it contains the relevant login information of the operating user, the specific recording time, etc. If there is any missing information, it will be supplemented based on the current actual situation to ensure the integrity of the information uploaded to the cloud.

[0093] In one example, the collection program will also determine whether there is duplication within the newly added record information. For example, due to special reasons such as abnormal system operation, the script file may write a record information repeatedly into the record file. Therefore, the collection program needs to remove duplicate information in the newly added record information when performing format monitoring to ensure the efficiency of subsequent cloud audits of the record information.

[0094] Step S203-3: if involved, replace the sensitive information, update the newly added record information in the record file, and upload the newly added record information after the information replacement to the cloud platform.

[0095] After determining whether sensitive information is involved in the previous step, if the newly added record information does involve sensitive information, the sensitive information is replaced, such as replacing the password with special symbols. At the same time, the corresponding newly added record information in the record file is replaced with the format after the sensitive information is replaced, and the newly added record information after the information replacement is uploaded to the cloud platform to avoid the leakage of sensitive information.

[0096] In another case, if the newly added record information does not involve sensitive record information, it is only necessary to check the format, determine whether there is any missing information and complete it before uploading it to the cloud.

[0097] Furthermore, after uploading the newly added record information in the record file to the cloud platform, the method further includes:

[0098] Determine whether the newly added record information is uploaded successfully;

[0099] If the upload is successful, the monitoring position of the acquisition program relative to the record file is updated to the end of the newly added record information;

[0100] If the upload fails, the monitoring position of the acquisition program relative to the record file remains unchanged.

[0101] It can be understood that, relative to the specific content in step S203-1, when determining the newly added record information, it is mainly determined based on the monitoring position of the acquisition program relative to the record file. Therefore, after uploading the information, if the upload is successful, the monitoring position is directly moved to the end of the newly added record information, so that when the newly added record content appears later, the latest added record information can be determined. If the upload fails, the current monitoring position needs to be maintained unchanged, so that the record information that failed to be uploaded can be uploaded to the cloud together when the information is uploaded next time.

[0102] For example, suppose there are 10 records in the current record file, and the current monitoring position is the end of the 10th record. When the 11th record is added, the 11th record is determined as the newly added record and uploaded to the cloud. The reply message from the cloud can be used to determine whether the upload is successful. When the upload is successful, the monitoring position is updated to the end of the 11th record to determine the subsequent newly added record. When the upload fails, the monitoring position remains unchanged, that is, it remains at the end of the 10th record. When the record is added on the next side, that is, when the 12th record is added, the 11th is also counted as the newly added record and uploaded to the cloud together with the 12th record to avoid missing information.

[0103] Furthermore, in step S203, before uploading the newly added record information in the record file to the cloud platform, the method further includes:

[0104] Determine whether the current network environment is a pure intranet environment;

[0105] If yes, the newly added record information is uploaded to the cloud platform through the proxy network.

[0106] It can be understood that for the target operating system, when it is in a pure intranet environment, when uploading record information, it is necessary to upload the newly added record information through the proxy network to avoid information leakage. In some cases, when the network environment is a public network, the information can be uploaded directly through the public network.

[0107] Step S204, determine the sensitive operation information in the record information through the scheduled audit tasks and preset audit rules pre-configured in the cloud platform, and perform automated audit. Figure 1 Step S204 of the illustrated embodiment will not be described in detail here.

[0108] The system command information auditing method provided by the embodiment of the present invention sets environment variables by using a script file in a specific directory when the user logs in to the target operating system, thereby obtaining the user's login information and subsequent command line operation information, and storing the collected information in a record file. At the same time, the record file is monitored in real time through a collection program. When the information in the record file changes, the new information is uploaded to the cloud platform in time, so that the cloud platform performs regular audits on the uploaded information. The collection of record information can be achieved under simple and economical conditions, while ensuring the comprehensiveness of the record information, thereby ensuring the network security audit effect.

[0109] In order to facilitate understanding of the above method embodiment, an example diagram of an operation command information recording process is provided according to an embodiment of the present invention. Figure 3 shown.

[0110] Before executing this process, you first need to write the PROMPT_COMMAND environment variable value setting script collect.sh and place the script file in the / etc / profile.d directory. The script will be automatically executed when the user logs in to the terminal. When the script file is running, it will obtain relevant current user account, command execution account, source IP, terminal number and other operation command information. At the same time, set the local file path / var / log / collectcmd.log where the command records need to be saved to store the relevant information collected by the script file.

[0111] For example, the script content can be:

[0112] PROMPT_COMMAND='if[-z"${CTHS_FLAG}"];

[0113] then export CTHS_FLAG=1;

[0114] else history 1|{read

[0115] By exporting the environment variable PROMPT_COMMAND, ensure that the sub-terminal can also record the relevant operation commands in the required format. Place the configuration file in the / etc / profile.d directory.

[0116] In addition, you need to deploy the collection program to the system server and set the systemd daemon service and the self-starting service mode. The collection program will periodically guard the configuration file / etc / profile.d / collect.sh in the first step to ensure the normal operation of the collection configuration. And regularly clean up the default saved file content in history to prevent sensitive information from being saved in history and reduce security risks after being invaded. Guard the terminal PROMPT_COMMAND variable to prevent it from being modified and causing the command to be unable to be recorded normally.

[0117] for Figure 3 The flowchart shown can be understood as follows: when a user logs in to the system shell terminal and executes a series of command line operation information, the environment variable PROMPT_COMMAND will record the command information entered by the user to the local file, namely / var / log / collectcmd.log.

[0118] When the collection program monitors changes in the content of the record file, it collects the corresponding commands and obtains the latest operation content in real time. The collection program filters and completes sensitive information, that is, the content format of the collected operation content is detected, and sensitive information (such as mysql command passwords and other commands with passwords) is replaced, such as replacing sensitive information, such as specific passwords, with ****, and updating the records of replaced sensitive information to the local record file to avoid information leakage. Furthermore, it can be determined whether it is consistent with the previous record content and discarded to avoid repeated reporting.

[0119] Determine whether it is a pure intranet environment to decide whether a proxy network is needed. When in a pure intranet environment, the information is uploaded through the cloud API interface through the proxy program. The cloud platform automatically audits related sensitive operations according to the set rules through scheduled tasks, and can also manually audit the corresponding servers.

[0120] For the collection procedure in the above method embodiment, the specific workflow in the information collection process can be referred to Figure 4 , is an example diagram of a collection program workflow according to an embodiment of the present invention.

[0121] As shown in the figure, during the working process of the collection program, it will first monitor in real time whether the record file is updated. When the record file is updated, the collection location is determined according to the current configuration of the collection program, and then the operation record content is collected. After collecting the current newly added operation record content, the sensitive information in it will be replaced and supplemented. If sensitive information exists, the record file will be updated and the replaced operation content will be uploaded to the cloud API, and it will be recorded whether the report is successful. If the report is successful, the configuration file of the collection program, that is, the specific collection location, will be updated to avoid subsequent repeated reporting of the same information. If the report fails due to network fluctuations, system abnormalities, etc., the failure will be recorded in the configuration file so that when reporting later, the operation record content can be obtained from the collection location corresponding to the failure of this report.

[0122] On the other hand, the collection program will periodically check the script file, i.e. / etc / profile.d / collect.sh. If the MD5 value does not match, it is considered that the script file is abnormal and the configuration file in the script file collect.sh is directly updated. In addition, the collection program will regularly clean up local records in the system history file to avoid being invaded by attackers and causing sensitive information leakage. Furthermore, the collection program will check its own configuration to see if there are any records of failed reports. If so, it will re-report the operation content information. When the configuration information is normal, it will wait for the next scheduled task to perform a new round of checks.

[0123] The sensitive information replacement in the above method embodiment can be understood by referring to 5. Figure 5 The figure is an example diagram of a sensitive information replacement process according to an embodiment of the present invention.

[0124] First, the acquisition program monitors the record file in real time based on the inotify mechanism. When the record file changes are monitored, the record position, that is, the current acquisition position, is determined to obtain a new operation record content. After the operation record is collected, it will be determined whether it contains sensitive information, such as access passwords or other password commands for certain files. When sensitive information exists, the sensitive information content in the operation record is processed, that is, the content corresponding to the sensitive information is replaced by special characters. At the same time, the processed operation record is updated back to the original record file, and the operation record information is supplemented and formatted, such as the user name, terminal device IP and other format information corresponding to the current operation record information. When there is no sensitive information, the information supplementation and formatting are directly performed.

[0125] In the above method embodiment, by adding a specific shell script in / etc / profile.d, the script export environment variable PROMPT_COMMAND is automatically executed after the user logs into the system Bash terminal; the assembled operation command is automatically appended to a specific local file through the built-in environment variable PROMPT_COMMAND value; the corresponding background program on the machine reads the content of the local file in real time, replaces the sensitive information and reports it to the background cloud big data system for storage, and the long-term storage and audit of machine operation records are realized through cloud big data. A non-intrusive operation command audit method can be implemented, which is based on the Linux system's own mechanism and Bash's built-in environment variables, is compatible with all Linux systems, has strong versatility, and is used to quickly build server operation command audit capabilities to meet security compliance and security audit requirements. At the same time, it avoids the storage of sensitive information in the local history, reducing the security risk after the server is invaded. The implementation principle is based on the system's own mechanism, does not need to be compatible with different Linux distributions, and is simple to deploy.

[0126] When the acquisition program detects changes in the content of the local record file, it will monitor and obtain the latest operation content. Records containing sensitive information will be replaced. The sensitive operation command records saved locally can be cleaned up in real time. The acquisition program also configures records for failed reports. The acquisition program will continue to report from the failed location next time to ensure that all operation commands are reported to the cloud. On the cloud platform, the relevant sensitive operation behaviors can be automatically audited and alarmed based on the set rules through scheduled tasks, and the corresponding servers can also be manually audited. Abnormal batch behaviors can be used based on big data for security intrusion detection.

[0127] In addition, the history recording switch is guarded by the acquisition program, the terminal PROMPT_COMMAND environment variable value is guarded, and the history local history is cleaned up regularly to ensure that the server operation commands can be fully recorded. At the same time, it also reduces the further expansion of the impact based on the history commands after the server is invaded. The method of recording operation commands based on the / etc / profile.d login execution script mechanism and the PROMPT_COMMAND environment variable is implemented based on the system mechanism principle, without the need for compatibility with different Linux distributions, and simple deployment.

[0128] In the present embodiment, a system command information audit device is also provided, which is used to implement the above-mentioned embodiment and preferred implementation mode, and the descriptions that have been made are not repeated here. As used below, the term "module" can implement a combination of software and / or hardware of a predetermined function. Although the device described in the following embodiments is preferably implemented in software, the implementation of hardware, or a combination of software and hardware is also possible and conceivable.

[0129] This embodiment provides a system command information audit device, such as Figure 6 As shown, including:

[0130] The script starting module 401 is used to start the script file in a specific configuration directory in the target operating system when the user logs in to the target operating system through the terminal device.

[0131] The information recording module 402 is used to set specific environment variables through a script file to obtain the user's login information and command line operation information, and store them in a record file. The record information in the record file is monitored by a collection program deployed on the server.

[0132] The information uploading module 403 is used to upload the newly added record information in the record file to the cloud platform when the acquisition program detects that the record information in the record file has changed.

[0133] The cloud audit module 404 is used to determine the sensitive operation information in the recorded information through the scheduled audit tasks and preset audit rules pre-configured in the cloud platform, and perform automated auditing.

[0134] In some optional implementations, when the acquisition program detects that the record information in the record file has changed, the information uploading module 403, when uploading the newly added record information in the record file to the cloud platform, includes:

[0135] When the record information in the record file changes, the newly added record information in the record file is determined through the collection program;

[0136] Detect the content format of the newly added record information to determine whether the newly added record information involves sensitive information;

[0137] If involved, the sensitive information will be replaced, the new record information in the record file will be updated, and the new record information after the information replacement will be uploaded to the cloud platform.

[0138] In some optional implementations, the information uploading module 403, when determining the newly added record information in the record file through the acquisition program, includes:

[0139] Determine the monitoring position of the current acquisition program relative to the record file;

[0140] When the record information in the record file changes, the record information located after the monitoring position is determined as the newly added record information.

[0141] In some optional implementations, after uploading the newly added record information in the record file to the cloud platform, the information uploading module 403 is further used to:

[0142] Determine whether the newly added record information is uploaded successfully;

[0143] If the upload is successful, the monitoring position of the acquisition program relative to the record file is updated to the end of the newly added record information;

[0144] If the upload fails, the monitoring position of the acquisition program relative to the record file remains unchanged.

[0145] In some optional implementations, the information recording module 402, when setting specific environment variables through a script file to obtain the user's login information and command line operation information, includes:

[0146] Set the PROMPT_COMMAND environment variable through the script file to obtain the user's login information and command line operation information.

[0147] In some optional implementations, the information upload module 403 is further used to provide a daemon service for the PROMPT_COMMAND environment variable and the script file through a collection program, so as to repair the configuration information of the PROMPT_COMMAND environment variable or the script file when it is abnormal.

[0148] In some optional implementations, the information uploading module 403, before uploading the newly added record information in the record file to the cloud platform, is further used to:

[0149] Determine whether the current network environment is a pure intranet environment;

[0150] If yes, the newly added record information is uploaded to the cloud platform through the proxy network.

[0151] The further functional description of each of the above modules and units is the same as that of the above corresponding embodiments and will not be repeated here.

[0152] The system command information auditing device in this embodiment is presented in the form of a functional unit, where the unit refers to an ASIC (Application Specific Integrated Circuit) circuit, a processor and memory that executes one or more software or fixed programs, and / or other devices that can provide the above functions.

[0153] The embodiment of the present invention also provides a computer device having the above Figure 6 The system command information auditing device shown.

[0154] See also Figure 7 , Figure 7 is a schematic diagram of the structure of a computer device provided by an optional embodiment of the present invention, such as Figure 7As shown, the computer device includes: one or more processors 10, a memory 20, and interfaces for connecting various components, including high-speed interfaces and low-speed interfaces. Various components are connected to each other using different buses for communication, and can be installed on a common mainboard or installed in other ways as needed. The processor can process the instructions executed in the computer device, including instructions stored in or on the memory to display the graphical information of the GUI on an external input / output device (such as, a display device coupled to the interface). In some optional embodiments, if necessary, multiple processors and / or multiple buses can be used together with multiple memories and multiple memories. Similarly, multiple computer devices can be connected, and each device provides some necessary operations (for example, as a server array, a group of blade servers, or a multi-processor system). Figure 7 A processor 10 is taken as an example.

[0155] The processor 10 may be a central processing unit, a network processor or a combination thereof. The processor 10 may further include a hardware chip. The hardware chip may be a dedicated integrated circuit, a programmable logic device or a combination thereof. The programmable logic device may be a complex programmable logic device, a field programmable gate array, a general purpose array logic or any combination thereof.

[0156] The memory 20 stores instructions executable by at least one processor 10, so that at least one processor 10 executes the method shown in the above embodiment.

[0157] The memory 20 may include a program storage area and a data storage area, wherein the program storage area may store an operating system, an application required for at least one function; the data storage area may store data created according to the use of the computer device, etc. In addition, the memory 20 may include a high-speed random access memory, and may also include a non-transient memory, such as at least one disk storage device, a flash memory device, or other non-transient solid-state storage device. In some optional embodiments, the memory 20 may optionally include a memory remotely arranged relative to the processor 10, and these remote memories may be connected to the computer device via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0158] The memory 20 may include a volatile memory, such as a random access memory; the memory may also include a non-volatile memory, such as a flash memory, a hard disk or a solid state drive; the memory 20 may also include a combination of the above types of memory.

[0159] The computer device also includes an input device 30 and an output device 40. The processor 10, the memory 20, the input device 30 and the output device 40 may be connected via a bus or other means. Figure 7 The example of connecting through bus is taken in the following.

[0160] The input device 30 can receive input digital or character information, and generate key signal input related to the user settings and function control of the computer device, such as a touch screen, a keypad, a mouse, a track pad, a touch pad, an indicator bar, one or more mouse buttons, a trackball, a joystick, etc. The output device 40 may include a display device, an auxiliary lighting device (e.g., an LED) and a tactile feedback device (e.g., a vibration motor), etc. The above-mentioned display device includes but is not limited to a liquid crystal display, a light emitting diode, a display and a plasma display. In some optional embodiments, the display device can be a touch screen.

[0161] The embodiment of the present invention also provides a computer-readable storage medium. The method according to the embodiment of the present invention can be implemented in hardware, firmware, or can be implemented as a computer code that can be recorded in a storage medium, or can be implemented as a computer code that is originally stored in a remote storage medium or a non-temporary machine-readable storage medium and will be stored in a local storage medium through a network download, so that the method described herein can be stored in such software processing on a storage medium using a general-purpose computer, a dedicated processor, or programmable or dedicated hardware. Among them, the storage medium can be a magnetic disk, an optical disk, a read-only storage memory, a random access memory, a flash memory, a hard disk or a solid-state hard disk, etc.; further, the storage medium can also include a combination of the above types of memories. It can be understood that a computer, a processor, a microprocessor controller, or programmable hardware includes a storage component that can store or receive software or computer code. When the software or computer code is accessed and executed by a computer, a processor, or hardware, the method shown in the above embodiment is implemented.

[0162] Although the embodiments of the present invention have been described in conjunction with the accompanying drawings, those skilled in the art may make various modifications and variations without departing from the spirit and scope of the present invention, and such modifications and variations are all within the scope defined by the appended claims.

Claims

1. A system command information audit method, characterized in that: The method comprises: When the user logs in to the target operating system through the terminal device, the script file in the specific configuration directory in the target operating system is started; Setting specific environment variables through the script file to obtain the user's login information and command line operation information, and storing them in a record file, wherein the record information in the record file is monitored by a collection program deployed on the server; When the acquisition program detects that the record information in the record file has changed, the newly added record information in the record file is uploaded to the cloud platform; The sensitive operation information in the recorded information is determined through the pre-configured scheduled audit tasks and preset audit rules in the cloud platform, and an automated audit is performed.

2. The method according to claim 1, characterized in that When the acquisition program detects that the record information in the record file has changed, uploading the newly added record information in the record file to the cloud platform includes: When the record information in the record file changes, determining the newly added record information in the record file through the acquisition program; Detecting the content format of the newly added record information to determine whether the newly added record information involves sensitive information; If involved, the sensitive information is replaced, the new record information in the record file is updated, and the new record information after the information replacement is uploaded to the cloud platform.

3. The method according to claim 2, characterized in that The determining the newly added record information in the record file through the acquisition program includes: Determining a monitoring position of the current acquisition program relative to the record file; When the record information in the record file changes, the record information located after the monitoring position is determined as the newly added record information.

4. The method according to claim 3, characterized in that After uploading the newly added record information in the record file to the cloud platform, the method further includes: Determine whether the newly added record information is uploaded successfully; If the upload is successful, the monitoring position of the acquisition program relative to the record file is updated to the end of the newly added record information; If the upload fails, the monitoring position of the acquisition program relative to the record file remains unchanged.

5. The method according to claim 1, characterized in that The specific environment variables are set through the script file to obtain the user's login information and command line operation information, including: Set the PROMPT_COMMAND environment variable through the script file to obtain the user's login information and command line operation information.

6. The method according to claim 5, characterized in that The method further comprises: The acquisition program provides a daemon service for the PROMPT_COMMAND environment variable and the script file, so as to repair the PROMPT_COMMAND environment variable or the script file when the configuration information is abnormal.

7. The method according to claim 1, characterized in that Before uploading the newly added record information in the record file to the cloud platform, the method further includes: Determine whether the current network environment is a pure intranet environment; If yes, the newly added record information is uploaded to the cloud platform through the proxy network.

8. A system command information audit device, characterized in that: The device comprises: The script startup module is used to start the script file in a specific configuration directory in the target operating system when the user logs in to the target operating system through the terminal device; An information recording module, used to set specific environment variables through the script file to obtain the user's login information and command line operation information, and store them in a record file, and the record information in the record file is monitored by the collection program deployed on the server; An information uploading module, used for uploading the newly added record information in the record file to the cloud platform when the acquisition program detects that the record information in the record file has changed; The cloud audit module is used to determine the sensitive operation information in the recorded information through the pre-configured scheduled audit tasks and preset audit rules in the cloud platform, and perform automated auditing.

9. A computer device, characterized in that: include: A memory and a processor, wherein the memory and the processor are communicatively connected to each other, the memory stores computer instructions, and the processor executes the system command information audit method according to any one of claims 1 to 7 by executing the computer instructions.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a computer to execute the system command information auditing method according to any one of claims 1 to 7.

Images