Automatic baseline configuration checking method for multiple operating systems

Abstract

The invention discloses a multi-operation system automatic baseline configuration checking method, and belongs to the technical field of information security. According to the method, a baseline data standardization module and a baseline checking module are included, configuration collection of a Windows whole-system version, a Linux release version, a domestic Kylin operating system, a Newton / H3C and other network devices is achieved through a multi-protocol dynamic adaptation engine, and heterogeneous configuration is converted into a standardized data structure through the semantic analysis technology; the checking module is internally provided with an intelligent checking engine and a result analysis rating sub-module, precise compliance detection and risk quantitative evaluation of cross-platform configuration are achieved, and automatic generation of one-key rectification and equal-guarantee compliance reports is supported. The method solves the problems of low coverage rate and high false alarm rate of a traditional scheme in a heterogeneous environment, and is particularly suitable for a network security operation and maintenance scene of multi-station cooperation in the energy industry.

Description

Technical Field

[0001] The present invention relates to the field of network security, and in particular to a method for automatically checking baseline configurations of network devices with multiple operating systems. Background Art

[0002] Currently, enterprise IT environments contain a variety of operating systems (such as Windows, Linux, and domestic Kylin) and network devices (such as ZTE and H3C), and their security baseline configurations need to be regularly checked to ensure compliance. Traditional methods rely on manual item-by-item inspections, which are inefficient and prone to errors. Existing automated tools have the following problems: (1) Insufficient multi-platform adaptability, unable to cover all versions of Windows Server and domestic operating systems; (2) Network device configuration verification is separated from host system verification; (3) Corrective measures rely on manual implementation, resulting in low detection efficiency. Summary of the Invention

[0003] The purpose of the present invention is to provide a multi-operating system automated baseline configuration verification system and method. Through the study of the present invention, the gaps in existing products can be filled. The application of the multi-operating system automated baseline configuration verification system and method can enhance the ability of power personnel to independently discover and manage safety hazards.

[0004] The technical solution adopted by the present invention to achieve the above-mentioned purpose is:

[0005] The automated baseline configuration verification method for multiple operating systems includes the following steps:

[0006] 1) The baseline data standardization module captures raw data from different operating systems, standardizes and normalizes it, and generates a baseline configuration data report;

[0007] 2) The baseline verification module verifies and evaluates the baseline configuration data report, obtains a rating report of the configuration data, and performs visualization on it.

[0008] The step 1) comprises the following steps:

[0009] 1.1) The dynamic protocol adaptation engine submodule automatically selects the acquisition protocol for the target device;

[0010] 1.2) The multi-protocol heterogeneous data acquisition submodule captures raw data across platforms through acquisition protocols and converts the collected data into a unified data format;

[0011] 1.3) The semantic parsing and structured conversion submodule uses the semantic parsing engine to perform semantic parsing on the original data and convert it into a structured data format;

[0012] 1.4) The baseline policy mapping and normalization sub-module maps the structured transformed data to predefined baseline policies and normalizes it to generate a standardized baseline configuration data report.

[0013] The step 1.1) includes the following steps:

[0014] 1.1.1) When data of a certain target device needs to be collected, detect the device and identify its IP address, MAC address, operating system type, and open port information.

[0015] 1.1.2) Based on the results of device detection, automatically match the collection protocol from the protocol library according to the response characteristics of the target device.

[0016] 1.1.3) Configure the protocol according to the network environment and device performance.

[0017] The step 1.3) includes the following steps:

[0018] 1.3.1) Identify and parse keywords, phrases, and sentence structures in the original data, and extract the association information between data items.

[0019] 1.3.2) According to the extracted information, define corresponding data items and data structures, and construct structured data that conforms to the set format according to the relationship between data items and the type of data values, and store it in a unified database.

[0020] The step 1.4) includes the following steps:

[0021] 1.4.1) Based on the configuration requirements of the operating system, define a complete baseline policy, and clarify the name, description, expected value, and severity information of each policy item therein.

[0022] 1.4.2) According to the data structure of the structured data, formulate mapping rules, which are used to define how to match each configuration item in the structured data with the policy items in the baseline policy, including the matching of configuration item names, the conversion of data types, and the mapping of value ranges.

[0023] 1.4.3) Traverse each configuration item in the structured data, match it with the policy items in the baseline policy according to the mapping rules, and record the matching results. For configuration items that cannot be directly matched, the user needs to be prompted to perform manual mapping or ignore them.

[0024] 1.4.4) Normalize the matched data to generate a standardized baseline configuration data report that includes the matching results of all configuration items of the target system with the baseline policy and the normalized data values.

[0025] The normalization processing of the matched data includes:

[0026] Data type normalization: Normalize the data types of the configuration data between different operating systems and devices;

[0027] Value range normalization: Normalize the values of the configuration items and convert them into relative values or standard scores;

[0028] Missing value processing: Fill in default values for the missing values of the configuration items that are not configured or cannot be obtained in the target system, ignore the configuration items, or mark them for exception handling.

[0029] Step 2) includes the following steps:

[0030] 2.1) The intelligent verification engine sub-module performs automated baseline configuration verification on the data in the baseline configuration data report through integrated verification scripts and tools for different operating systems and devices;

[0031] 2.2) The verification result analysis sub-module analyzes the verification results;

[0032] 2.3) The verification result rating sub-module scores the device or system to be verified and generates a rating report.

[0033] Step 2.1) includes the following steps:

[0034] 2.1.1) By analyzing the operating system type and hardware configuration of the device, match the characteristics of the target device with the predefined verification script library;

[0035] 2.1.2) Use the verification scripts and tools to verify the compliance of the actual configuration with the expected value in the baseline configuration data report. After the verification is completed, output the verification results to the specified location or database and perform visualization processing.

[0036] Step 2.2) includes the following steps:

[0037] 2.2.1) Convert the difference between the actual configuration value in the baseline configuration data report and the expected value of the baseline policy into a quantifiable risk score:

[0038] Risk score = Policy item weight × Compliance coefficient

[0039] Among them, if the actual configuration value is compliant, the compliance coefficient = 1; otherwise, the compliance coefficient = 0;

[0040] 2.2.2) Compare and verify the verification results with the preset security baseline standards to determine whether the configuration items meet the security requirements;

[0041] 2.2.3) Based on the results of comparison and verification, perform compliance judgment on each configuration item and generate corresponding compliance marks.

[0042] Step 2.3) includes the following steps:

[0043] 2.3.1) According to the importance of the security baseline and the actual business requirements, formulate a rating standard that reflects the weights and priorities of different configuration items in the information system security;

[0044] 2.3.2) According to the rating standard and the results of compliance judgment, calculate the comprehensive rating score for each device or system to be verified, that is, the sum of the risk scores of all configuration items;

[0045] 2.3.3) Integrate the rating scores, compliance marks, and other relevant information including device metadata, time dimension, and rectification suggestions to obtain a rating report.

[0046] The present invention has the following beneficial effects and advantages:

[0047] The multi - operating - system automated baseline configuration verification system and method provided by the present invention have the core advantage of realizing the automated baseline configuration management of heterogeneous operating systems through a unified framework, supporting the intelligent adaptation and dynamic verification of multi - environment security policies, significantly reducing the manual intervention cost and the risk of misoperation. The built - in standardized verification process in the system can identify configuration deviations in real time and generate a traceable report, helping power enterprises quickly locate security hazards and strengthen the active defense ability. At the same time, this solution has flexible scalability and can adapt to the iterative update requirements of different operating systems, providing technical support for building a standardized and systematic security baseline management system in the power industry, thereby comprehensively improving the compliance and risk resistance level of the infrastructure. Brief Description of the Drawings

[0048] Figure 1 It is a schematic diagram of the working process of a multi - operating - system automated baseline configuration verification method proposed by the present invention;

[0049] Figure 2 It is a schematic diagram of the working process of the multi - protocol heterogeneous data acquisition sub - module;

[0050] Figure 3 It is a schematic diagram of the working process of the baseline policy mapping and normalization sub - module. Detailed Embodiment

[0051] The following further elaborates on the present invention in detail with reference to the drawings and embodiments.

[0052] As Figures 1 - 3As shown in the figure, the multi - operating system automated baseline configuration verification method includes: the baseline data standardization module grabs the original data from different operating systems, performs standardization and normalization processing on it, and generates a baseline configuration data report; the baseline verification module verifies and evaluates the baseline configuration data report, obtains a rating report of the configuration data, and visualizes it.

[0053] The baseline data standardization module realizes the grabbing of the original data of Windows, Linux, and Kylin configurations. The data standardization module includes a multi - protocol heterogeneous data acquisition module, a semantic parsing and structured conversion sub - module, and a baseline policy mapping and normalization sub - module.

[0054] The multi - protocol heterogeneous data acquisition sub - module realizes the grabbing of the original data across platforms (such as Windows, Linux, and Kylin operating systems) through a dynamic protocol adaptation engine. The core of this module is that it can automatically select the optimal acquisition protocol according to the response characteristics of the target device (such as the opening status of the SSH port), thereby ensuring the efficiency and accuracy of data acquisition.

[0055] The dynamic protocol adaptation engine is responsible for automatically selecting a suitable communication protocol according to the characteristics of the target device and the network environment. The dynamic protocol adaptation engine maintains a protocol library containing multiple communication protocols, and the protocol library includes but is not limited to SSH, HTTP, HTTPS, FTP, Telnet, etc., as well as proprietary protocols for specific devices or applications.

[0056] When the dynamic protocol adaptation engine needs to collect data from a certain target device, it will first detect and identify the device. The device inspection includes information such as IP address, MAC address, operating system type, and open ports.

[0057] Based on the results of device detection, the dynamic protocol adaptation engine automatically selects the optimal acquisition protocol according to the response characteristics of the target device (such as the opening status of the SSH port). For example, if the target device has an open SSH port and supports the SSH protocol, then the dynamic protocol adaptation engine will select the SSH protocol as the communication method for data acquisition.

[0058] After selecting the appropriate protocol, the dynamic protocol adaptation engine configures and optimizes the protocol according to the network environment and device performance to ensure the efficiency and stability of data acquisition.

[0059] The multi - protocol heterogeneous data acquisition sub - module supports cross - platform data acquisition, including Windows, Linux, and Kylin operating systems, etc.

[0060] The cross-platform data collection identifies the operating system type running on the target device before collecting data, which is completed by checking information such as the device's system files and network protocol stack.

[0061] Based on the recognition result, the cross-platform data collection module will load the collection scripts or tools that match the target operating system. These scripts or tools are optimized for the characteristics and limitations of specific operating systems to ensure the accuracy and efficiency of data collection.

[0062] The cross-platform data collection converts the collected data into a unified data format.

[0063] The semantic parsing and structured transformation sub-module performs semantic parsing on the raw data collected by the multi-protocol heterogeneous data collection sub-module and converts it into a structured data format for subsequent baseline policy mapping and normalization processing;

[0064] Semantic parsing refers to converting natural language text or data in a specific format into a structured semantic representation;

[0065] The semantic parsing module embeds a set of semantic parsing engines, which are built based on technologies such as natural language processing, computational linguistics, and machine learning. These engines can identify and parse keywords, phrases, and sentence structures in the raw data, extract the association information between data items, and build corresponding semantic models;

[0066] The structured transformation module will define corresponding data items and data structures according to the information extracted by the semantic parsing engine. Then, according to the relationships between data items and the types of data values, structured data that conforms to a specific format is constructed. These structured data will be stored in a unified database for subsequent baseline policy mapping and normalization processing.

[0067] The baseline policy mapping and normalization sub-module maps the data after semantic parsing and structured transformation to predefined baseline policies and performs normalization processing on the data to ensure the comparability of configuration data between different operating systems and devices.

[0068] For the baseline policy mapping and normalization sub-module, the first step of baseline policy mapping is to define a complete set of baseline policies;

[0069] The baseline policies are based on industry best practices, security standards, and the security requirements of the power industry and the enterprise itself, covering the configuration requirements of various aspects such as operating systems, network devices, and applications. In the process of defining the policies, it is necessary to clarify information such as the name, description, expected value (or allowable value range), and severity of each policy item;

[0070] After defining the baseline policy, the module needs to formulate mapping rules based on the data structure output by the semantic parsing and structured transformation sub-module. These rules define how each configuration item in the structured data is matched with the policy items in the baseline policy. The mapping rules may involve matching of configuration item names, conversion of data types, mapping of value ranges, etc.;

[0071] The baseline policy mapping module will traverse each configuration item in the structured data, match it with the policy items in the baseline policy according to the mapping rules, and record the matching results. For configuration items that cannot be directly matched, the module may need to prompt the user for manual mapping or ignore them.

[0072] The normalization sub-module includes a data type normalization, a value range normalization, and a missing value handling module; for the data type normalization, the configuration data between different operating systems and devices may use different data types (such as integers, floating-point numbers, strings, boolean values, etc.). To ensure comparability, the module needs to perform normalization processing on these data types. For example, converting date and time data in different formats to a unified date and time format, converting numerical data in different units to the same unit, etc.

[0073] For the value range normalization, for some configuration items, their values may vary within a large range. To facilitate comparison and evaluation, the module may need to perform normalization processing on these values and convert them to relative values or standard scores. For example, for the configuration item of memory usage, the module can convert it to a percentage of the total system memory.

[0074] For the missing value handling, in actual applications, there may be cases where some configuration items are not configured or cannot be obtained in the target system. To not affect the accuracy of the baseline configuration verification, the module needs to handle these missing values. The handling strategies may include filling with default values, ignoring the configuration item, or marking it as an exception, etc.;

[0075] After the baseline policy and the normalization sub-module have undergone baseline policy mapping and normalization processing, the module will generate a standardized baseline configuration data report. This report contains the matching results of all configuration items in the target system with the baseline policy and the normalized data values. The report can be presented in various forms such as text, table, graph, etc., for easy viewing and analysis by the user. At the same time, the module will also store this report in a unified database for subsequent baseline configuration verification, trend analysis, and other tasks;

[0076] The baseline verification module includes an intelligent verification engine sub-module and a verification result analysis and rating sub-module;

[0077] The intelligent verification engine sub-module is responsible for automatically verifying the baseline configuration of devices in a multi-operating system environment according to the standardized baseline data provided by the baseline data standardization module;

[0078] The intelligent verification engine sub-module integrates various verification scripts and tools for different operating systems and devices, such as operating system verification tools, Windows: PowerShell scripts. These scripts and tools have been strictly tested and verified to accurately identify and verify the status of baseline configuration items;

[0079] The intelligent verification engine sub-module adopts advanced algorithms and technologies to achieve intelligent matching of verification scripts and tools. For example, if the target device is: Kylin operating system V10, then a dedicated Kylin configuration verification script is matched. By analyzing factors such as the operating system type and hardware configuration of the device, this module can automatically select the most suitable verification scripts and tools to ensure the accuracy and reliability of verification results;

[0080] The intelligent verification engine sub-module supports parallel processing of multiple verification tasks. By optimizing task scheduling and resource allocation, it realizes an efficient and stable verification process. At the same time, this module also has real-time monitoring and feedback functions, which can promptly detect and handle abnormal or error situations;

[0081] After the verification is completed, the intelligent verification engine sub-module will output the verification results to a specified location or database. At the same time, this module also supports visual display of the verification results, so that operation and maintenance personnel can more intuitively understand the baseline configuration of the device;

[0082] The verification result analysis and rating sub-module is the decision-making center of the baseline verification process, responsible for in-depth analysis, risk quantification, and priority ranking of the original results output by the intelligent verification engine. Its innovation lies in the multi-dimensional risk quantification model and the dynamic scenario adaptation mechanism, breaking through the limitations of traditional solutions that only rely on static ratings and realizing the deep integration of risk assessment and business scenarios.

[0083] The multi-dimensional risk quantification model converts discrete configuration deviations into quantifiable risk scores to support precise decision-making;

[0084] The verification result analysis sub-module includes data parsing, comparison and verification, and compliance determination;

[0085] The data parsing function converts discrete configuration deviations into quantifiable risk scores to support precise decision-making;

[0086] The comparison and verification function compares the parsed verification data with the preset security baseline standards to determine whether the configuration item meets the security requirements. In this step, a large amount of configuration information is used, including password policies, log audit policies, key directory and file permissions, etc.;

[0087] The compliance judgment function makes a compliance judgment on each configuration item based on the results of the comparison and verification and generates corresponding compliance marks. Among them, the compliance judgment is a binary judgment on each configuration item, compliant and non-compliant. Compliant: the actual value completely meets the baseline expectation; non-compliant: the actual value deviates from the baseline. These marks can clearly reflect which configuration items have passed the verification, which have not passed, and the reasons for non-passing.

[0088] The described rating sub-module includes establishing rating criteria, calculating rating scores, and generating rating reports;

[0089] The establishment of the rating criteria formulates a complete set of rating criteria according to the importance of the security baseline and the actual business requirements. This set of criteria should be able to reflect the weights and priorities of different configuration items in the information system security;

[0090] The calculation of the rating score calculates a comprehensive rating score for each device or system to be verified according to the rating criteria and the results of the compliance judgment. This score can intuitively reflect the overall security status of the device or system;

[0091] The generation of the rating report integrates the rating score, compliance marks, and other relevant information into a rating report. Among them, other relevant information includes device metadata: IP address, asset number, and business area to which it belongs; time dimension: first verification time, last rectification time; rectification suggestions: automatically generated repair commands. This report should be able to clearly display the security baseline configuration of the device or system, as well as existing problems and improvement suggestions.

Claims

1. A method for automatically verifying the baseline configuration of multiple operating systems, characterized in that It includes the following steps: 1) The baseline data normalization module grabs the original data from different operating systems, normalizes and standardizes it, and generates a baseline configuration data report; 2) The baseline verification module verifies and evaluates the baseline configuration data report, obtains a rating report of the configuration data, and visualizes it.

2. The multi-operating system automated baseline configuration verification method according to claim 1, wherein The step 1) includes the following steps: 1.1) The dynamic protocol adaptation engine sub-module automatically selects a collection protocol for the target device; 1.2) The multi-protocol heterogeneous data collection sub-module grabs the cross-platform original data through the collection protocol and converts the collected data into a unified data format; 1.3) The semantic parsing and structured conversion sub-module semantically parses the original data through a semantic parsing engine and converts it into a structured data format; 1.4) The baseline policy mapping and normalization sub-module maps the structured converted data to a predefined baseline policy, normalizes it, and generates a standardized baseline configuration data report.

3. The multi-operating system automated baseline configuration verification method according to claim 2, wherein, The step 1.1) includes the following steps: 1.1.1) When it is necessary to collect data of a certain target device, detect the device and identify its IP address, MAC address, operating system type, and open port information; 1.1.2) Based on the results of device detection, automatically match a collection protocol from the protocol library according to the response characteristics of the target device; 1.1.3) Configure the protocol according to the network environment and device performance.

4. The multi-operating system automated baseline configuration verification method according to claim 2, wherein The step 1.3) includes the following steps: 1.3.1) Identify and parse keywords, phrases, and sentence structures in the original data, and extract the association information between data items; 1.3.2) According to the extracted information, define corresponding data items and data structures, and construct structured data that conforms to the set format according to the relationship between data items and the type of data values, and store it in a unified database.

5. The multi-operating system automated baseline configuration verification method according to claim 2, characterized in that, The step 1.4) includes the following steps: 1.4.1) Define a complete baseline policy based on the configuration requirements of the operating system, and clarify the name, description, expected value, and severity information of each policy item in it; 1.4.2) According to the data structure of the structured data, formulate mapping rules, which are used to define how to match each configuration item in the structured data with the policy items in the baseline policy, including the matching of configuration item names, data type conversion, and value range mapping; 1.4.3) Traverse each configuration item in the structured data, match it with the policy items in the baseline policy according to the mapping rules, and record the matching results. For configuration items that cannot be directly matched, the user needs to be prompted to perform manual mapping or ignore them; 1.4.4) Normalize the matched data to generate a standardized baseline configuration data report that includes the matching results of all configuration items of the target system and the baseline policy and the normalized data values.

6. The multi-operating system automated baseline configuration verification method according to claim 5, characterized in that The normalization processing of the matched data includes: Data type normalization: Normalize the data types of the configuration data between different operating systems and devices; Value range normalization: Normalize the values of configuration items and convert them into relative values or standard scores; Missing value handling: Fill in default values for missing values of configuration items that are not configured or cannot be obtained in the target system, ignore the configuration item, or mark it for exception handling.

7. The multi-operating system automated baseline configuration verification method according to claim 1, wherein Step 2) includes the following steps: 2.1) The intelligent verification engine sub-module automatically verifies the baseline configuration data in the baseline configuration data report through integrated verification scripts and tools for different operating systems and devices; 2.2) The verification result analysis sub-module analyzes the verification results; 2.3) The verification result rating sub-module scores the device or system to be verified and generates a rating report.

8. The multi - operating - system automated baseline configuration verification method according to claim 7, wherein, The said step 2.1) includes the following steps: 2.1.1) By analyzing the operating system type and hardware configuration of the device, match the characteristics of the target device with the predefined verification script library; 2.1.2) Use the verification script and tool to verify the compliance of the actual configuration in the baseline configuration data report with the expected value. After the verification is completed, output the verification result to the specified location or database and perform visualization processing.

9. The multi-operating system automated baseline configuration verification method according to claim 7, wherein The said step 2.2) includes the following steps: 2.2.1) Convert the difference between the actual configuration value in the baseline configuration data report and the expected value of the baseline policy into a quantifiable risk score: Risk score = policy item weight × compliance coefficient where, if the actual configuration value is compliant, the compliance coefficient = 1, otherwise, the compliance coefficient = 0; 2.2.2) Compare and verify the verification result with the preset security baseline standard to determine whether the configuration item meets the security requirements; 2.2.3) Based on the result of the comparison and verification, make a compliance judgment for each configuration item and generate the corresponding compliance mark.

10. The multi - operating - system automated baseline configuration verification method according to claim 7, wherein, The said step 2.3) includes the following steps: 2.3.1) According to the importance of the security baseline and the actual business requirements, formulate a rating standard that reflects the weights and priorities of different configuration items in the information system security; 2.3.2) According to the rating standard and the compliance judgment result, calculate the comprehensive rating score for each device or system to be verified, that is, the sum of the risk scores of all configuration items; 2.3.3) Integrate the rating score, compliance mark, and other relevant information including device metadata, time dimension, and rectification suggestions to obtain a rating report.

Images