Linux operating system risk behavior detection method and device

Abstract

The invention provides a linux operating system risk behavior detection method and device. The problem that an open source tool and a commercial tool of a Linux operating system cannot meet the requirement that timeliness and effectiveness of the Linux operating system during risk behavior detection and risk behavior processing are reduced is effectively solved. The method comprises the following steps: collecting original data of a corresponding dimension generated by the linux operating system, and screening the original data to obtain risk information of the corresponding dimension; extracting a target field in the risk information, so that the target field is matched with a preset standard character string of a corresponding collection dimension to obtain a matching result; calling a preset processing scheme based on the matching result, and generating an execution instruction based on the preset processing scheme; and executing a preset processing scheme of the corresponding acquisition dimension based on the execution instruction to eliminate a risk behavior corresponding to the risk information in the linux operating system.

Description

Technical Field

[0001] The present application relates to the technical field of risk detection, and in particular to a method and device for detecting risky behavior of a Linux operating system. Background Art

[0002] Security risk detection tools for the Linux operating system include open source tools and commercial tools, but each tool has its own characteristics and limitations. For example, among open source tools, Lynis is a lightweight security auditing tool that can perform a comprehensive security scan and assessment of Linux servers. It not only exposes vulnerabilities but also recommends corrective measures. Another example is OpenVAS, an open source vulnerability assessment system that can scan security vulnerabilities on servers. It is designed for enterprises of all sizes and has excellent configurability. Among commercial tools, Nessus is a widely used vulnerability scanner that provides comprehensive vulnerability detection capabilities, but it requires a fee. Another example is Tripwire, a commercial file integrity checking tool that can monitor file changes and malicious activities on servers, which also requires a fee.

[0003] However, open source tools may lack professional technical support and maintenance for the Linux operating system, the speed of updates may be affected by community activity, and some tools may not be intuitive or easy to use. Commercial tools are more expensive and may not fully meet the specific needs of the Linux operating system. They may also have some undisclosed or unfixed vulnerabilities and cannot meet the timeliness and effectiveness requirements of the Linux operating system when detecting and handling risky behaviors. Summary of the invention

[0004] In view of this, the purpose of the present application is to provide a method and device for detecting risky behavior of a Linux operating system, which effectively solves the problem that the open source tools and commercial tools of the Linux operating system cannot meet the timeliness and effectiveness of the Linux operating system in risky behavior detection and risky behavior processing.

[0005] In a first aspect, an embodiment of the present application provides a method for detecting risky behaviors of a Linux operating system, the method comprising:

[0006] Based on multiple collection dimensions, original data of corresponding dimensions generated during the operation of the Linux operating system are collected, and the original data are screened according to risk screening conditions of the corresponding collection dimensions to obtain risk information of the corresponding dimensions; different collection dimensions correspond to different screening conditions;

[0007] Extracting the target field in the risk information by using the preset extraction rule corresponding to the collection dimension, so as to match the target field with the preset standard string corresponding to the collection dimension to obtain a matching result;

[0008] Generate a call instruction based on the matching result, call a preset processing solution corresponding to the acquisition dimension based on the call instruction, and generate an execution instruction based on the preset processing solution;

[0009] Based on the execution instruction, the preset processing scheme of the corresponding collection dimension is executed to eliminate the risk behavior corresponding to the risk information in the Linux operating system.

[0010] In combination with the first aspect, an embodiment of the present application provides a first possible implementation of the first aspect, wherein the extracting the target field in the risk information by using the preset extraction rule corresponding to the collection dimension so that the target field is matched with the preset standard string corresponding to the collection dimension to obtain a matching result includes:

[0011] Determine a plurality of standard fields to be extracted by the preset extraction rule based on the preset standard character string of the corresponding acquisition dimension;

[0012] The risk information is extracted based on the multiple standard fields to obtain a target field of the corresponding collection dimension, so as to match the target field with a preset standard character string of the corresponding collection dimension.

[0013] In combination with the first aspect, an embodiment of the present application provides a second possible implementation of the first aspect, wherein the risk information is extracted based on the multiple standard fields to obtain a target field of the corresponding collection dimension to match the preset standard string of the corresponding collection dimension, including:

[0014] Determining whether the multiple target fields extracted from the risk information match the multiple standard fields in the preset standard character string;

[0015] If so, the matching result is passed, and the corresponding processing method is confirmed by the passed matching result.

[0016] In combination with the first aspect, the embodiment of the present application provides a third possible implementation of the first aspect, wherein original data of corresponding dimensions generated by the Linux operating system during operation are collected based on multiple collection dimensions, and the original data are screened according to the risk screening conditions of the corresponding collection dimensions to obtain risk information of the corresponding dimensions, including:

[0017] Confirming corresponding risk screening conditions based on the collection dimensions corresponding to the original data to determine whether the original data meets the risk screening conditions;

[0018] If so, the risk information of the corresponding dimension is obtained to infer the corresponding risk behavior based on the risk information of the corresponding dimension.

[0019] In combination with the first aspect, an embodiment of the present application provides a fourth possible implementation of the first aspect, wherein the collection dimensions include at least one of the following: network connection rules, user access rules, system files & sensitive information, system service analysis, and historical behavior analysis.

[0020] In combination with the first aspect, the embodiment of the present application provides a fifth possible implementation of the first aspect, wherein the confirming the corresponding risk screening condition based on the collection dimension corresponding to the original data includes:

[0021] Confirm the corresponding collection scope based on the determined collection dimension to obtain the corresponding internal data and external data;

[0022] Corresponding risk screening conditions are confirmed for the internal data and the external data to obtain corresponding risk information.

[0023] In combination with the first aspect, the embodiment of the present application provides a sixth possible implementation of the first aspect, wherein the Linux operating system is connected to an alarm platform;

[0024] Generating a call instruction based on the matching result, calling a preset processing solution corresponding to the acquisition dimension based on the call instruction, and generating an execution instruction based on the preset processing solution, including:

[0025] If the matching result is failure, the risk information and the target field are sent to the alarm platform;

[0026] The risk information and the target field are evaluated to obtain an evaluation result, so as to obtain a risk strategy based on the evaluation result.

[0027] In a second aspect, an embodiment of the present application provides a Linux operating system risk behavior detection device, the device comprising:

[0028] A collection module, used to collect original data of corresponding dimensions generated by the Linux operating system during operation based on multiple collection dimensions, and filter the original data according to the risk screening conditions of the corresponding collection dimensions to obtain risk information of the corresponding dimensions; different collection dimensions correspond to different screening conditions;

[0029] An extraction module, used to extract a target field in the risk information by using a preset extraction rule corresponding to the collection dimension, so as to match the target field with a preset standard string corresponding to the collection dimension to obtain a matching result;

[0030] A generating module, configured to generate a calling instruction based on the matching result, to call a preset processing solution of the corresponding acquisition dimension based on the calling instruction, and to generate an execution instruction based on the preset processing solution;

[0031] An elimination module is used to execute the preset processing solution of the corresponding collection dimension based on the execution instruction to eliminate the risk behavior corresponding to the risk information in the Linux operating system.

[0032] In a third aspect, an embodiment of the present application provides an electronic device, comprising: a processor, a memory and a bus, wherein the memory stores machine-readable instructions executable by the processor, and when the electronic device is running, the processor and the memory communicate via the bus, and when the machine-readable instructions are executed by the processor, any step of a Linux operating system risk behavior detection method is performed.

[0033] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium having a computer program stored thereon, and when the computer program is executed by a processor, the computer program executes any one of the steps of a method for detecting risk behavior of a Linux operating system.

[0034] The embodiment of the present application provides a risk behavior detection method for a Linux operating system. The method first collects raw data of corresponding dimensions generated by the Linux operating system during operation based on multiple collection dimensions, and filters the raw data according to the risk screening conditions of the corresponding collection dimensions to obtain risk information of the corresponding dimensions; different collection dimensions correspond to different screening conditions; secondly, a target field in the risk information is extracted by a preset extraction rule of the corresponding collection dimension, so that the target field is matched with a preset standard string of the corresponding collection dimension to obtain a matching result; then a call instruction is generated based on the matching result, a preset processing scheme of the corresponding collection dimension is called based on the call instruction, and an execution instruction is generated based on the preset processing scheme; finally, the preset processing scheme of the corresponding collection dimension is executed based on the execution instruction to eliminate the risk behavior corresponding to the risk information in the Linux operating system, thereby realizing the ready detection of risk behavior and timely and effective elimination of the existence of risk behavior, effectively solving the problem that the open source tools and commercial tools of the Linux operating system cannot meet the timeliness and effectiveness of the Linux operating system in risk behavior detection and risk behavior processing, improving the timeliness and effectiveness of risk behavior detection and processing, and further ensuring the security of the Linux operating system. BRIEF DESCRIPTION OF THE DRAWINGS

[0035] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings required for use in the embodiments will be briefly introduced below. It should be understood that the following drawings only show certain embodiments of the present application and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying creative work.

[0036] Figure 1 A schematic diagram of the process of the first Linux operating system risk behavior detection method provided in the embodiment of the present application is shown;

[0037] Figure 2 A schematic diagram of a process for obtaining risk behavior provided in an embodiment of the present application is shown;

[0038] Figure 3 A schematic diagram showing the process of the method provided by the present application in actual use;

[0039] Figure 4 A schematic diagram of the structure of a first Linux operating system risk behavior detection device provided in an embodiment of the present application is shown;

[0040] Figure 5 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application is shown. DETAILED DESCRIPTION

[0041] To make the purpose, technical scheme and advantages of the embodiments of the present application clearer, the technical scheme in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. It should be understood that the drawings in the present application only serve the purpose of explanation and description and are not used to limit the scope of protection of the present application. In addition, it should be understood that the schematic drawings are not drawn in real proportion. The flowchart used in this application shows the operations implemented according to some embodiments of the present application. It should be understood that the operations of the flowchart can be implemented out of sequence, and the steps without logical context can be reversed in order or implemented simultaneously. In addition, those skilled in the art can add one or more other operations to the flowchart under the guidance of the content of the present application, or remove one or more operations from the flowchart.

[0042] In addition, the described embodiments are only a part of the embodiments of the present application, rather than all the embodiments. The components of the embodiments of the present application described and shown in the drawings here can be arranged and designed in various configurations. Therefore, the following detailed description of the embodiments of the present application provided in the drawings is not intended to limit the scope of the application claimed for protection, but merely represents the selected embodiments of the present application. Based on the embodiments of the present application, all other embodiments obtained by those skilled in the art without making creative work belong to the scope of protection of the present application.

[0043] It should be noted that the term "comprising" will be used in the embodiments of the present application to indicate the existence of the features declared thereafter, but does not exclude the addition of other features.

[0044] Open source tools in the Linux operating system may lack professional technical support and maintenance for the Linux operating system, the update speed may be affected by the community activity, and some tools may not be intuitive or easy to use. Commercial tools are expensive and may not fully meet the specific needs of the Linux operating system. There may also be some undisclosed or unfixed vulnerabilities, and they cannot meet the timeliness and effectiveness requirements of the Linux operating system when detecting and handling risky behaviors.

[0045] Based on this, the embodiments of the present application provide a method and device for detecting risky behaviors in a Linux operating system, which will be described below through embodiments.

[0046] Example 1

[0047] To facilitate understanding of this embodiment, a Linux operating system risk behavior detection method disclosed in this embodiment is first described in detail. Figure 1 The flowchart of a Linux operating system risk behavior detection method shown in the figure, the present application provides a Linux operating system risk behavior detection method, the method comprising:

[0048] S101, collecting original data of corresponding dimensions generated by the Linux operating system during operation based on multiple collection dimensions, and filtering the original data according to risk screening conditions of the corresponding collection dimensions to obtain risk information of the corresponding dimensions; different collection dimensions correspond to different screening conditions;

[0049] S102, extracting a target field in the risk information by using a preset extraction rule corresponding to the collection dimension, so as to match the target field with a preset standard string corresponding to the collection dimension to obtain a matching result;

[0050] S103, generating a calling instruction based on the matching result, calling a preset processing solution corresponding to the collection dimension based on the calling instruction, and generating an execution instruction based on the preset processing solution;

[0051] S104: Execute the preset processing solution of the corresponding collection dimension based on the execution instruction to eliminate the risk behavior corresponding to the risk information in the Linux operating system.

[0052] The Linux operating system of the present application is installed on intelligent devices such as computers, servers, and hosts that have data analysis and computing capabilities. The Linux operating system is also connected to an alarm platform through a preset interface to implement an alarm when abnormal behavior is detected. That is, the operations performed in the present application are performed by the computers, servers, hosts, etc., and the host is taken as an example here.

[0053] In step S101, when the Linux operating system is running, it is based on multiple dimensions and generates original data at the same time. Then the host needs to collect the original data of the corresponding dimensions generated by the Linux operating system during operation based on multiple collection dimensions at the same time. The collected original data includes attempted connection data, login log data, new file data, process information, and historical behavior data. The specific collection method is also determined according to the collection dimension corresponding to the original data. For example, when collecting system processes and activities, the ps command or the sar command can be used, and corresponding risk screening conditions can be set for the corresponding collection dimensions, that is, different collection dimensions correspond to different screening conditions, so as to obtain the corresponding risk information in a targeted manner. The original data is screened according to the risk screening conditions of the corresponding collection dimensions to obtain the risk information of the corresponding dimensions; if there is risk information, it is determined that the Linux operating system has risky behavior.

[0054] In the specific implementation process of step S101, there is an embodiment: Figure 2 As shown, based on multiple collection dimensions, the original data of the corresponding dimensions generated by the Linux operating system during operation is collected, and the original data is screened according to the risk screening conditions of the corresponding collection dimensions to obtain the risk information of the corresponding dimensions, including:

[0055] S1011. Confirming corresponding risk screening conditions based on the collection dimensions corresponding to the original data to determine whether the original data meets the risk screening conditions;

[0056] S1012: If yes, then obtain the risk information of the corresponding dimension to infer the corresponding risk behavior based on the risk information of the corresponding dimension.

[0057] In steps S1011-S1012, the host determines the corresponding collection dimensions of the original data to be collected from the data corresponding to the risk behavior of the Linux operating system, and after determining the collection dimensions, confirms the corresponding risk screening conditions for the corresponding collection dimensions. For example, for attempted connection data, the corresponding risk screening conditions are whether some ports or all ports of the Linux operating system initiate network connection attempts and count the corresponding attempted connection data. The ports include 22, 445, 3389, and 6379. For the login log data, the corresponding risk screening conditions are whether there are a large number of login failure logs in a short period of time or within a range. For newly added file data, the corresponding risk screening conditions are whether / tmp, all user home directories, and the system self-start service directory contain files with commands such as "*.jsp*", "*.asp*", and "*.php*" that were added on the same day. For process information, the corresponding risk screening conditions are whether the system passes the risk screening. The ps command checks the process information with the keyword bash. Because processes such as rebound shells usually only display bash-i in the ps process information, for historical behavior data, the corresponding risk screening conditions are whether there is new and updated file information in the target file such as / var / spool / cron, and whether there are a large number of information collection commands in the bash_history files corresponding to all users, and the number of times the information collection commands are executed is not less than the preset number. The information collection commands include: whoami (view the current user); ifconfig (obtain network card information); uname-a (view version kernel); cat / etc / passwd (view account information); cat / etc / shadow (view password file information); netstat-anp / netstat-ano (view network connection); ps-aux / ps-ef (view process information); ping xxxx (view whether the network is reachable). If the original data meets the risk screening conditions of the corresponding dimension, the host obtains the risk information of the corresponding dimension, and infers the corresponding risk behavior based on the risk information of the corresponding dimension. This risk behavior will cause security threats and impacts to the Linux operating system.

[0058] In the specific implementation process of steps S1011-S1012, there is an embodiment in which the collection dimension includes at least one of the following: network connection rules, user access rules, system files & sensitive information, system service analysis, and historical behavior analysis.

[0059] In this process, the original data are connection attempt data, login log data, newly added file data, process information, and historical behavior data. The corresponding collection dimensions are network connection rules, user access rules, system files & sensitive information, system service analysis, and historical behavior analysis. Based on the above collection dimensions, corresponding risk screening conditions are set to screen the original data to obtain risk information, that is, the data that meets the risk screening conditions is risk information. Risky behaviors appear in the collection dimensions corresponding to the risk information. For example, in the collection dimension of historical behavior analysis, a large number of information collection commands appear in the bash_history files corresponding to all users in the historical behavior data, and the number of executions of the information collection commands is not less than 5 times, or in the system files & sensitive information In the collection dimension, if there are files with commands such as "*.jsp*", "*.asp*", "*.php*" and so on that are added on the same day in the newly added file data, risk information is obtained and risky behavior occurs. In the collection dimension of network connection rules, if the corresponding attempted connection data meets the corresponding risk screening conditions and risk information is obtained, the host determines that the Linux operating system has abnormal behavior, and the abnormal behavior is generally that the current host is used as a springboard by the attacker to implement port scanning or password cracking and other attacks on the intranet; or in the collection dimension of user access rules, if the corresponding login log data meets the corresponding risk screening conditions and risk information is obtained, the host determines that the Linux operating system has abnormal behavior, and the abnormal behavior is likely to be caused by password cracking.

[0060] In the specific implementation process of step S1011, there is an embodiment in which: the step of confirming the corresponding risk screening condition based on the collection dimension corresponding to the original data includes:

[0061] S10111. Confirm the corresponding collection scope based on the determined collection dimension to obtain corresponding internal data and external data;

[0062] S10112. Confirm corresponding risk screening conditions for the internal data and external data to obtain corresponding risk information.

[0063] In steps S10111-S10112, after confirming the collection dimension of the original data, the host confirms the corresponding collection scope based on the collection dimension, and the collection scope includes the inside of the Linux operating system and the outside of the Linux operating system. Different collection scopes correspond to different risk screening conditions.

[0064] For example, in the collection dimension of network connection rules, the collection scope inside the Linux operating system is that the host has certain ports (commonly used ports such as 22, 445, 3389, 6379, etc.) or all ports that initiate network connection attempts to a large number of hosts in the intranet segment. The collection scope outside the Linux operating system is that the host has established a connection with the external network IP (ESTABLISHED state) or is trying to establish a connection (SYN_SENT state), excluding external network connections for normal services (whitelist mechanism). In this collection dimension, the risk screening conditions corresponding to the Linux operating system inside and outside the Linux operating system are consistent;

[0065] In the collection dimension of user access rules, the collection scope inside the Linux operating system is to analyze the system security login log, cat secure*|grep "Fail" to view the log and match the log information of failed logins, then the corresponding risk screening condition is if there are a large number of failed login logs within a short time range, the collection scope outside the Linux operating system is to analyze the recent login situation of the Linux operating system, and at this time, deduplicate and accumulate the number of logins, then the corresponding risk screening condition is whether there is a large number of login behaviors for an IP in a short time;

[0066] In the collection dimension of system files & sensitive information, / tmp and all user home directories and system auto-start service directories exist in directories corresponding to the collection scope inside the Linux operating system and the collection scope outside the Linux operating system. In this collection dimension, the risk screening conditions corresponding to the Linux operating system inside and outside the Linux operating system are consistent;

[0067] In the collection dimension of historical behavior analysis, the collection scope inside the Linux operating system is / var / spool / cron, so the corresponding risk screening condition is to analyze the new and updated file information under / var / spool / cron on the day. The collection scope outside the Linux operating system is the bash_history file corresponding to all users in the system, so the corresponding risk screening condition is to analyze whether there are a large number of information collection commands in the bash_history file corresponding to all users in the Linux operating system and the number of executions is not less than 5 times a day;

[0068] In the dimension of the system service analysis, there is only one collection scope, so there is no need to obtain internal data and external data.

[0069] In step S102, after the host obtains the risk information, the target field in the risk information is extracted by the preset extraction rules corresponding to the collection dimension, that is, different collection dimensions correspond to different preset extraction rules, and the preset extraction rules are all preset, that is, the fields to be collected by different collection dimensions are different, and the preset standard character string corresponding to each collection dimension is also different, so it is necessary to extract the target field corresponding to the collection dimension, so that the target field is matched with the preset standard character string of the corresponding collection dimension to obtain a matching result, and the matching result includes pass and fail, and different matching results correspond to different processing measures, so as to achieve targeted processing of the risk behavior, eliminate the existence of risk behavior, and ensure the security of the Linux operating system.

[0070] In the specific implementation process of step S102, there is an embodiment in which: extracting the target field in the risk information by using the preset extraction rule corresponding to the collection dimension so that the target field is matched with the preset standard string corresponding to the collection dimension to obtain a matching result includes:

[0071] S1021. Determine a plurality of standard fields to be extracted by the preset extraction rule based on the preset standard character string of the corresponding collection dimension;

[0072] S1022. Extract the risk information based on the multiple standard fields to obtain a target field of the corresponding collection dimension, so as to match the target field with a preset standard character string of the corresponding collection dimension.

[0073] In steps S1021-S1022, after obtaining the risk information, the host determines the multiple standard fields that need to be extracted by the preset extraction rules based on the preset standard character string of the corresponding collection dimension. After determining the multiple standard fields of the corresponding dimension, the risk information is extracted to obtain multiple target fields. The preset extraction rules are used to guide how to extract multiple target fields corresponding to the standard fields from the risk information. The preset extraction rules include regular expressions, string matching algorithms, parsing logic, etc. The standard fields include event type, occurrence time, scope of impact, severity, timestamp, etc. The corresponding target fields are also the target fields of the corresponding standard fields in the risk information, so as to match the preset standard character string of the corresponding collection dimension to obtain a matching result.

[0074] In the specific implementation process of step S1022, there is an embodiment of: extracting the risk information based on the multiple standard fields to obtain the target field of the corresponding collection dimension to match with the preset standard string of the corresponding collection dimension, including:

[0075] S10221. Determine whether the multiple target fields extracted from the risk information match the multiple standard fields in the preset standard character string;

[0076] S10222: If yes, the matching result is passed, and the corresponding processing method is confirmed by the passed matching result.

[0077] In steps S10221-S10222, the host compares the extracted target fields with the preset standard fields one by one, so as to determine whether the multiple target fields extracted from the risk information match the multiple standard fields in the preset standard string. The content of the comparison may include the name, format, value, etc. of the field, and set matching rules, such as full match, partial match, fuzzy match, etc. According to specific needs, the most appropriate matching rule is selected for verification, and the matching results of each field are recorded. If the field matches successfully, it is recorded as "passed"; if the match fails, it is recorded as "failed", and the matching results of all fields are summarized, and the number of "passed" and "failed" fields is counted. According to the set threshold or rule, it is determined whether the overall matching result is passed. For example, you can set that all fields must pass for the overall pass, or allow a certain number of fields to fail. If the overall matching result passes, the risk information is subsequently processed according to the preset processing method. As the business develops and needs change, the preset standard fields may need to be updated and maintained regularly to ensure their accuracy and applicability, and according to actual needs, the matching rules can be flexibly set to adapt to the matching needs in different scenarios.

[0078] In step S103, after obtaining the matching result and the matching result is passed, the host generates a call instruction based on the passed matching result. If there is risk information corresponding to multiple collection dimensions at the same time, the host classifies the risk information corresponding to multiple collection dimensions into risk levels to obtain a processing priority. The call instruction includes the dimension corresponding to the risk information, specific risk information, and a unique identifier of the processing solution, required parameters, execution priority and other information, so as to call the preset processing solution of the corresponding collection dimension from the preset processing solution library based on the call instruction. The preset processing solution includes an automated repair script, a manual review process, a notification mechanism, etc., and generates an execution instruction based on the preset processing solution. The execution instruction includes execution steps, required resources, expected results, etc. When constructing the call instruction, the accuracy and completeness of the construction instruction should be ensured to avoid execution errors. The execution instruction is sent to the Linux operating system.

[0079] In the specific implementation process of step S103, there is an embodiment in which: the Linux operating system is connected to the alarm platform;

[0080] Generating a call instruction based on the matching result, calling a preset processing solution corresponding to the acquisition dimension based on the call instruction, and generating an execution instruction based on the preset processing solution, including:

[0081] S1031. If the matching result is failure, sending the risk information and the target field to the alarm platform;

[0082] S1032: Evaluate the risk information and the target field to obtain an evaluation result, and obtain a risk strategy based on the evaluation result.

[0083] In steps S1031-S1032, after obtaining the matching result and the matching result is a failure, the host sends the risk information and the target field to the alarm platform connected to the host where the Linux operating system is located. The alarm platform evaluates the risk information and the target field to obtain an evaluation result. The evaluation result includes the alarm level, alarm channel and corresponding target processing personnel corresponding to the risk information. The risk information has an IP address corresponding to the host where the Linux operating system is located. Based on the IP address, the corresponding target processing personnel can be obtained. The trained convolutional neural network preset in the alarm platform processes the evaluation result to obtain a risk strategy. The risk strategy is provided for the risk behavior corresponding to the risk information. The alarm platform determines the corresponding push method based on the alarm level in the evaluation result. For example, when the alarm level is low, the risk strategy is notified to the target processing personnel by email. For example, when the alarm level is general, the risk strategy is notified to the target processing personnel by SMS. For example, when the alarm level is serious, the risk strategy is notified to the target processing personnel by an outbound call, so that the target processing personnel can handle the risk behavior as soon as possible according to the risk strategy to eliminate the existence of the risk behavior.

[0084] In step S104, the host executes the preset processing scheme of the corresponding collection dimension based on the execution instruction, and prepares the corresponding execution environment before executing the preset processing scheme, such as allocating necessary system resources for the execution of the preset processing scheme, and performing specific environment configuration for the execution of the preset processing scheme, the system resources such as CPU, memory, disk space, the environment configuration such as specific software version, system parameter settings, so as to eliminate the risk behavior corresponding to the risk information in the Linux operating system, during the execution process, the execution progress and status of the preset processing scheme are tracked in real time through log recording, system monitoring and other means, after the preset processing scheme is executed, the risk information in the Linux operating system is rechecked to confirm whether the risk behavior represented by the risk information has been eliminated, and the comparison result is obtained by comparing the system status before and after the execution of the preset processing scheme to evaluate the effectiveness of the processing scheme based on the comparison result, and based on the comparison result and the actual situation during the processing, the preset processing scheme is optimized and improved as necessary, in order to use it in the next elimination process.

[0085] like Figure 3 As shown, this is a flow chart of the present application in actual use. First, data collection is performed to obtain original data, and the original data includes dimensions such as network connection rules, user access rules, system files & sensitive information, system service analysis, and historical behavior analysis, so as to obtain risk information. The target field in the risk information is matched with the preset standard string. If it matches, the preset processing plan is executed, and the execution result is detected, and the risk information is reviewed. If it is confirmed to be solved, the risk information is restored to normal, that is, the original data. Otherwise, the alarm platform adopts manual intervention for processing. If there is no match, the corresponding risk information output log is collected, and then manual intervention is adopted through the alarm platform for processing, and a review is performed. If it is confirmed to be solved, the risk information is restored to normal, that is, the original data, otherwise manual access is performed again.

[0086] Example 2

[0087] The present application also provides a Linux operating system risk behavior detection device, such as Figure 4 The block diagram of a Linux operating system risk behavior detection device is shown. The function implemented by the Linux operating system risk behavior detection device corresponds to the steps of executing a Linux operating system risk behavior detection method on a terminal device. The device can be understood as a component of a server including a processor, and the device includes:

[0088] The collection module 401 is used to collect the original data of the corresponding dimensions generated by the Linux operating system during operation based on multiple collection dimensions, and filter the original data according to the risk screening conditions of the corresponding collection dimensions to obtain the risk information of the corresponding dimensions; different collection dimensions correspond to different screening conditions;

[0089] An extraction module 402 is used to extract a target field in the risk information by using a preset extraction rule corresponding to the collection dimension, so as to match the target field with a preset standard string corresponding to the collection dimension to obtain a matching result;

[0090] A generating module 403, configured to generate a calling instruction based on the matching result, to call a preset processing solution corresponding to the acquisition dimension based on the calling instruction, and to generate an execution instruction based on the preset processing solution;

[0091] The elimination module 404 is used to execute the preset processing solution of the corresponding collection dimension based on the execution instruction to eliminate the risk behavior corresponding to the risk information in the Linux operating system.

[0092] In a feasible implementation, the extraction module includes:

[0093] A first extraction module, configured to determine a plurality of standard fields to be extracted by the preset extraction rule based on the preset standard character string of the corresponding collection dimension;

[0094] The second extraction module is used to extract the risk information based on the multiple standard fields to obtain the target field of the corresponding collection dimension, so as to match it with the preset standard character string of the corresponding collection dimension.

[0095] In a feasible implementation manner, the extraction module further includes:

[0096] A first judgment module is used to judge whether the multiple target fields extracted from the risk information match the multiple standard fields in the preset standard character string;

[0097] The first confirmation module is used for confirming the corresponding processing method with the passed matching result.

[0098] In a feasible implementation, the acquisition module includes:

[0099] A second judgment module is used to confirm the corresponding risk screening condition based on the collection dimension corresponding to the original data, so as to judge whether the original data meets the risk screening condition;

[0100] The inference module is used to obtain the risk information of the corresponding dimension if so, so as to infer the corresponding risk behavior based on the risk information of the corresponding dimension.

[0101] In a feasible implementation manner, the acquisition module further includes:

[0102] Network connection rules, user access rules, system files & sensitive information, system service analysis, historical behavior analysis.

[0103] In a feasible implementation, creating a module also includes:

[0104] A second confirmation module is used to confirm the corresponding collection scope based on the determined collection dimension to obtain corresponding internal data and external data;

[0105] The third confirmation module is used to confirm the corresponding risk screening conditions for the internal data and the external data to obtain corresponding risk information.

[0106] In a feasible implementation, the generation module includes:

[0107] A sending module, configured to send the risk information and the target field to the alarm platform if the matching result is a failure;

[0108] The evaluation module is used to evaluate the risk information and the target field to obtain an evaluation result, so as to obtain a risk strategy based on the evaluation result.

[0109] Example 3

[0110] The present application also provides an electronic device, such as Figure 5 As shown, it includes: a processor 501, a memory 502 and a bus 503, the memory 502 stores machine-readable instructions executable by the processor 501, when the electronic device is running, the processor 501 and the memory 502 communicate through the bus 503, and when the machine-readable instructions are executed by the processor 501, any step of a Linux operating system risk behavior detection method is executed.

[0111] Example 4

[0112] The present application also provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the steps of any one of the risk behavior detection methods for a Linux operating system are executed.

[0113] Those skilled in the art can clearly understand that, for the convenience and simplicity of description, the specific working process of the system and device described above can refer to the corresponding process in the method embodiment, and will not be repeated in this application. In the several embodiments provided in this application, it should be understood that the disclosed system, device and method can be implemented in other ways. The device embodiments described above are merely schematic. For example, the division of the modules is only a logical function division. There may be other division methods in actual implementation. For example, multiple modules or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some communication interfaces, indirect coupling or communication connection of devices or modules, which can be electrical, mechanical or other forms.

[0114] The modules described as separate components may or may not be physically separated, and the components shown as modules may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0115] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.

[0116] If the functions are implemented in the form of software functional units and sold or used as independent products, they can be stored in a non-volatile computer-readable storage medium that is executable by a processor. Based on this understanding, the technical solution of the present application, or the part that contributes to the prior art or the part of the technical solution, can be embodied in the form of a software product, which is stored in a storage medium and includes several instructions for a computer device (which can be a personal computer, a platform server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: various media that can store program codes, such as USB flash drives, mobile hard drives, ROM, RAM, magnetic disks, or optical disks.

[0117] The above are only specific implementations of the present application, but the protection scope of the present application is not limited thereto. Any technician familiar with the technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

Claims

1. A Linux operating system risk behavior detection method, characterized in that: The method comprises: Based on multiple collection dimensions, original data of corresponding dimensions generated during the operation of the Linux operating system are collected, and the original data are screened according to risk screening conditions of the corresponding collection dimensions to obtain risk information of the corresponding dimensions; different collection dimensions correspond to different screening conditions; Extracting the target field in the risk information by using the preset extraction rule corresponding to the collection dimension, so as to match the target field with the preset standard string corresponding to the collection dimension to obtain a matching result; Generate a call instruction based on the matching result, call a preset processing solution corresponding to the acquisition dimension based on the call instruction, and generate an execution instruction based on the preset processing solution; Based on the execution instruction, the preset processing scheme of the corresponding collection dimension is executed to eliminate the risk behavior corresponding to the risk information in the Linux operating system.

2. The method according to claim 1, characterized in that The extracting the target field in the risk information by using the preset extraction rule corresponding to the collection dimension, so that the target field is matched with the preset standard string corresponding to the collection dimension to obtain a matching result, includes: Determine a plurality of standard fields to be extracted by the preset extraction rule based on the preset standard character string of the corresponding acquisition dimension; The risk information is extracted based on the multiple standard fields to obtain a target field of the corresponding collection dimension, so as to match the target field with a preset standard character string of the corresponding collection dimension.

3. The method according to claim 2, characterized in that Extracting the risk information based on the multiple standard fields to obtain a target field of a corresponding collection dimension to match the preset standard string of the corresponding collection dimension includes: Determining whether the multiple target fields extracted from the risk information match the multiple standard fields in the preset standard character string; If so, the matching result is passed, and the corresponding processing method is confirmed by the passed matching result.

4. The method according to claim 1, characterized in that Based on multiple collection dimensions, original data of corresponding dimensions generated during the operation of the Linux operating system are collected, and the original data are screened according to risk screening conditions of the corresponding collection dimensions to obtain risk information of the corresponding dimensions, including: Confirming corresponding risk screening conditions based on the collection dimensions corresponding to the original data to determine whether the original data meets the risk screening conditions; If so, the risk information of the corresponding dimension is obtained to infer the corresponding risk behavior based on the risk information of the corresponding dimension.

5. The method according to claim 4, characterized in that The collection dimensions include at least one of the following: network connection rules, user access rules, system files & sensitive information, system service analysis, and historical behavior analysis.

6. The method according to claim 4, characterized in that The corresponding risk screening conditions are confirmed based on the collection dimensions corresponding to the original data, including: Confirm the corresponding collection scope based on the determined collection dimension to obtain the corresponding internal data and external data; Corresponding risk screening conditions are confirmed for the internal data and the external data to obtain corresponding risk information.

7. The method according to claim 1, characterized in that The Linux operating system is connected to the alarm platform; Generating a call instruction based on the matching result, calling a preset processing solution corresponding to the acquisition dimension based on the call instruction, and generating an execution instruction based on the preset processing solution, including: If the matching result is failure, the risk information and the target field are sent to the alarm platform; The risk information and the target field are evaluated to obtain an evaluation result, so as to obtain a risk strategy based on the evaluation result.

8. A Linux operating system risk behavior detection device, characterized in that: The device comprises: A collection module, used to collect original data of corresponding dimensions generated by the Linux operating system during operation based on multiple collection dimensions, and filter the original data according to the risk screening conditions of the corresponding collection dimensions to obtain risk information of the corresponding dimensions; different collection dimensions correspond to different screening conditions; An extraction module, used to extract a target field in the risk information by using a preset extraction rule corresponding to the collection dimension, so as to match the target field with a preset standard string corresponding to the collection dimension to obtain a matching result; A generating module, configured to generate a calling instruction based on the matching result, to call a preset processing solution of the corresponding acquisition dimension based on the calling instruction, and to generate an execution instruction based on the preset processing solution; An elimination module is used to execute the preset processing solution of the corresponding collection dimension based on the execution instruction to eliminate the risk behavior corresponding to the risk information in the Linux operating system.

9. An electronic device, characterized in that: include: A processor, a memory and a bus, wherein the memory stores machine-readable instructions executable by the processor, and when the electronic device is running, the processor and the memory communicate via the bus, and when the machine-readable instructions are executed by the processor, the steps of a Linux operating system risk behavior detection method as described in any one of claims 1 to 7 are performed.

10. A computer-readable storage medium, characterized in that: The computer readable storage medium stores a computer program, which, when executed by a processor, executes the steps of a risk behavior detection method for a Linux operating system as described in any one of claims 1 to 7.

Images