Cloud desktop real-time auditing method based on RDP protocol

Abstract

The invention discloses a cloud desktop real-time auditing method based on an RDP protocol, and aims to solve the problems that an existing offline auditing method cannot perceive and intervene violation operation of a user in real time and excessively depends on human resources. The method comprises the following steps of: firstly, assigning connection parameters of a target host and connecting through an agent; secondly, acquiring a base64 code of a current operation fragment graph of a user from an RDP (Remote Decision Protocol) channel and carrying out user information modeling; then, decoding the base64 code into a picture, judging whether the resolution of the picture needs to be improved or not according to administrator configuration or machine load conditions, and identifying character information in the picture; and finally, matching the user behavior character information with a preset auditing rule, and alarming an administrator if the user behavior character information is hit. According to the method, the characteristic of transmitting the fragment graph through the RDP is utilized, capturing, processing and auditing of user operation behaviors are achieved, the timeliness and flexibility of auditing are improved, manpower dependence is reduced, and the defect of off-line auditing is effectively overcome.

Description

Technical Field

[0001] The present invention belongs to the field of cloud computing, and in particular to a security auditing technology for cloud desktop services. Specifically, the present invention relates to a real-time auditing method for a cloud desktop agent based on the Remote Desktop Protocol (RDP). Background Art

[0002] With the continuous maturity and widespread application of cloud computing technology, cloud desktops, a cloud-based desktop delivery model, have seen explosive growth in demand in recent years, with industry acceptance continuing to climb. Cloud desktops are currently at a critical stage of rapid development. Thanks to this technology, users only need to connect basic peripherals such as a terminal, monitor, mouse, and keyboard to easily log in to a cloud desktop and work remotely. All heavy computing tasks and massive data storage are handled by the cloud desktop server, minimizing the requirements for user devices and access environments, significantly reducing reliance on local device performance.

[0003] This invention addresses the Remote Desktop Protocol (RDP) developed by Microsoft. The RDP protocol is highly integrated and compatible within Windows systems, fully utilizing Windows system resources and functionality. It also supports multi-monitor configuration and resource redirection, allowing users to view the remote desktop using multiple monitors on their local computers and redirect local resources (such as printers and file systems) to the remote computer. Furthermore, the RDP protocol provides efficient data transmission and optimized graphics rendering, enabling fast response and a smooth user experience even in low-bandwidth network environments.

[0004] While cloud desktop technology has brought unprecedented convenience to business operations and employee productivity, conducting accurate and efficient security audits of user behavior during use has become a critical challenge that needs to be addressed. Current audit systems targeting the RDP protocol are mostly limited to offline methods such as video recording and keystroke logging. These methods not only rely heavily on tedious manual auditing but also struggle to detect and intervene in risky user behavior in real time, resulting in significant timeliness issues and potential security risks. Summary of the Invention

[0005] Based on this, the present invention provides a real-time audit method for cloud desktops based on the RDP (Remote Desktop Protocol) protocol. This method focuses on significantly improving the timeliness of security audits of the RDP protocol, enhancing the security monitoring of user behavior, and significantly reducing the dependence on human resources in the audit process, thereby effectively solving the shortcomings of existing offline audit methods in terms of real-time performance and efficiency.

[0006] A cloud desktop real-time audit method based on the RDP protocol, the method comprising the following steps:

[0007] S1. Specify the connection parameters of the target host and connect to the machine through the proxy; the connection parameters include but are not limited to IP address, port number and resolution;

[0008] S2. Obtain the base64 encoding of the RDP operation fragment graph and perform user information modeling.

[0009] S3. Decode the base64 image and convert it into a jpg / png format. Based on the configured parameters, decide whether to increase the image resolution and identify the text in the image.

[0010] S4. Match the converted user behavior text information with the audit rules preset by the administrator. If a match is found, the administrator will be notified via email or phone.

[0011] In the present invention, step S1 includes the following steps:

[0012] S11. The client and the server shake hands and exchange relevant information.

[0013] S12: Establishing the active connection for this session.

[0014] In the present invention, step S2 includes the following steps:

[0015] S21. Obtaining the protocol instruction returned by the server to the client from the active connection of the session;

[0016] S22, determine whether it is a drawing command, if it is a drawing command, go to step S23; if it is not a drawing command, return to step S21;

[0017] S23, obtaining the base64 encoding of the bitmap from the drawing instruction according to the protocol instruction format;

[0018] S24. Assemble the base64 encoding, user ID, source address, target machine address and other data into JSON format.

[0019] Furthermore, in this step, an image transmission virtual channel is parsed from the protocol function data layer of the RDP connection agent, and the user's current operation fragment map is obtained in real time from the channel to perform user information modeling. The fragment map is transmitted in the form of base64 encoding.

[0020] In the present invention, step S3 includes the following steps:

[0021] S31. Extract the base64 encoding of the operation fragment graph from the JSON data;

[0022] S32, decode the base64 encoded data and convert it into a picture in jpg / png format;

[0023] S33. Determine whether to increase the image resolution based on the machine load parameters configured by the administrator. If yes, proceed to step S34; otherwise, proceed to step S35.

[0024] S34, super-resolving the image to improve the resolution of the image;

[0025] S35: Identify text information in the image and use it as a user operation behavior identifier;

[0026] S36. Assemble the user operation behavior identifier and connection related information into JSON format.

[0027] Furthermore, in this step, an image transmission virtual channel is parsed from the protocol function data layer of the RDP connection agent, and the user's current operation fragment map is obtained in real time from the channel to perform user information modeling. The fragment map is transmitted in the form of base64 encoding.

[0028] Furthermore, in this step, the administrator reduces the proxy machine load by lowering the RDP connection resolution during peak hours to ensure connection stability. To ensure the accuracy of the recognition results, the text recognition service will determine whether to call the image super-resolution model to improve the image resolution based on the administrator configuration or the proxy machine load.

[0029] In the present invention, step (4) comprises the following steps:

[0030] S41. Extract the user operation behavior identifier from the JSON data;

[0031] S42: Match according to the audit rules configured by the administrator. If a match is found, proceed to step S43; otherwise, proceed to step S41.

[0032] S43. Alert the administrator via email, phone, etc.

[0033] Furthermore, in this step, the text recognition result of the image is matched with the audit rules. If the audit rules are matched, an alarm will be triggered. The alarm information includes the user ID, source address, target machine address and specific operation behavior ID.

[0034] Furthermore, the configuration of the audit rules in this step will not affect the operation of the online service, but supports dynamic adjustment, and after the adjustment, it can be perceived by the audit service and the rules can be updated immediately.

[0035] The present invention also provides a device for implementing the cloud desktop real-time audit method based on the RDP protocol of the present invention, comprising:

[0036] Collector, used to obtain RDP operation fragmentation graph;

[0037] Encoder, used to obtain the base64 encoding of the RDP operation fragment graph and perform user information modeling;

[0038] The decoder is used to decode the base64 image into jpg / png format, determine whether to increase the image resolution based on the configured parameters, and recognize the text information in the image;

[0039] The comparator is used to match the converted user behavior text information with the audit rules preset by the administrator.

[0040] The technical effect of this invention is that this method leverages the RDP protocol's ability to transmit cloud desktop fragmentation graphs to capture, process, and audit user behavior during cloud desktop operations. By intercepting fragmentation graphs from the bitmap transmission channel and configuring audit rules, administrators can audit user behavior more flexibly, saving manpower while improving the timeliness of security audits and addressing the shortcomings of offline auditing. BRIEF DESCRIPTION OF THE DRAWINGS

[0041] Figure 1 It is a brief flow chart of the method of the present invention;

[0042] Figure 2 yes Figure 1 Sub-flowchart of step S1 in FIG.

[0043] Figure 3 yes Figure 1 Sub-flowchart of step S2;

[0044] Figure 4 yes Figure 1 Sub-flowchart of step S3 in .

[0045] Figure 5 yes Figure 1 Sub-flowchart of step S4 in . DETAILED DESCRIPTION

[0046] In order to make the objectives, technical solutions and advantages of the present invention more clearly understood, the present invention is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not intended to limit the present invention.

[0047] like Figure 1 As shown, an embodiment of the present invention provides a cloud desktop real-time audit method based on the RDP protocol, and the cloud desktop real-time audit method based on the RDP protocol includes the following steps:

[0048] S1. Specify the connection parameters of the target host and connect to the machine through the proxy.

[0049] Alternatively, as Figure 2 As shown, step S1 includes the following sub-steps:

[0050] S11. The client and the server shake hands and exchange relevant information.

[0051] S12: Establishing the active connection for this session.

[0052] Specifically, during the handshake phase, the client and server exchange and negotiate information about supported audio codecs, video codecs, image formats, time zones, and protocol versions. Once the handshake phase is complete, the connection is considered active, and all subsequent channel establishment is based on this connection. Each connection is identified by a unique connection ID.

[0053] S2. Obtain the base64 encoding of the RDP operation fragment graph and perform user information modeling.

[0054] Alternatively, as Figure 3 As shown, step S2 includes the following sub-steps:

[0055] S21. Obtaining the protocol instruction returned by the server to the client from the active connection of the session;

[0056] S22, determine whether it is a drawing command, if it is a drawing command, go to step S23; if it is not a drawing command, return to step S21;

[0057] S23, obtaining the base64 encoding of the bitmap from the drawing instruction according to the protocol instruction format;

[0058] S24. Assemble the base64 encoding, user ID, source address, target machine address and other data into JSON format.

[0059] Specifically, through the communication endpoints between the client and the server, protocol commands such as keyboard, mouse, drawing, audio, and video commands returned by the server to the client are intercepted from the active connection of the session. Based on the type identifier of the command line, img and blob commands used for drawing are filtered out.

[0060] The img command tells the server to allocate a new transport stream and associate the StreamID with the updated image metadata, including the image type, target layer, and target coordinates. The image contents are later sent along the stream with the blob command, without needing to know the full size of the image in advance. The blob command sends blob data along the given stream. This data blob is arbitrary base64-encoded data and is only meaningful to the client or server if the stream ID specified when allocating the stream is still valid.

[0061] The base64 encoding in the blob instruction parameter is parsed according to the specified protocol format, bound to the connection-related information such as user ID, source address, and target machine address, and assembled into JSON format data.

[0062] S3. Decode the base64 image and convert it into a jpg / png format. Based on the configured parameters, decide whether to increase the image resolution and identify the text in the image.

[0063] Alternatively, as Figure 4 As shown, step S3 includes the following sub-steps:

[0064] S31. Extract the base64 encoding of the operation fragment graph from the JSON data;

[0065] S32, decode the base64 encoded data and convert it into a picture in jpg / png format;

[0066] S33. Determine whether to increase the image resolution based on the machine load parameters configured by the administrator. If yes, proceed to step S34; otherwise, proceed to step S35.

[0067] S34, super-resolving the image to improve the resolution of the image;

[0068] S35: Identify text information in the image and use it as a user operation behavior identifier;

[0069] S36. Assemble the user operation behavior identifier and connection related information into JSON format.

[0070] Specifically, the base64 encoding intercepted from the channel is taken out from the JSON data modeled in step S2, and decoded into a picture in jpg or png format according to the specified format. The picture format is specified in the JSON data.

[0071] Furthermore, the quality of the fragmented image intercepted in step S2 will directly affect subsequent operations. High-resolution connections offer better display quality, higher-quality fragmented images, and more accurate recognition. However, this will place a higher load on the machine, potentially causing the client screen to freeze during peak connection times. Therefore, administrators can choose to configure the connection resolution based on the machine's load. During peak connection times, the pressure on the machine can be reduced by appropriately lowering the connection resolution. At this point, the fragmented image needs to be super-resolved to improve its resolution, minimizing the impact on subsequent image recognition accuracy.

[0072] The locally deployed image recognition model is called to identify the text information in the image, which is used as the user's current operation behavior identifier and assembled into a JSON format with the connection-related information in step S2.

[0073] S4. Match the converted user operation behavior identifier with the preset audit rules. If a match is found, the administrator is notified via email, phone, or other means.

[0074] Alternatively, as Figure 5 As shown, step S4 includes the following sub-steps:

[0075] S41. Extract the user operation behavior identifier from the JSON data;

[0076] S42: Match according to the audit rules configured by the administrator. If a match is found, proceed to step S43; otherwise, proceed to step S41.

[0077] S43. Alert the administrator via email, phone, etc.

[0078] Specifically, the user operation behavior identifier is extracted from the data modeled in step S3 and matched with the audit rules dynamically configured by the administrator. If a match is found, an alarm is promptly sent to the administrator. The specific content of the alarm information has been supplemented accordingly in steps S2 and S3.

[0079] This paper proposes a real-time auditing method for cloud desktops based on the RDP protocol. By leveraging the RDP protocol's ability to transmit fragmented images of cloud desktops, this method captures, processes, and audits user behavior during cloud desktop operations. By intercepting fragmented images from the bitmap transmission channel and configuring audit rules, administrators can audit user behavior more flexibly, saving manpower while improving the timeliness of security audits and addressing the shortcomings of offline auditing.

[0080] Based on the above embodiments, the present invention also provides a device for a cloud desktop real-time audit method based on the RDP protocol, which device at least includes:

[0081] Collector, used to obtain RDP operation fragmentation graph;

[0082] Encoder, used to obtain the base64 encoding of the RDP operation fragment graph and perform user information modeling;

[0083] The decoder is used to decode the base64 image into jpg / png format, determine whether to increase the image resolution based on the configured parameters, and recognize the text information in the image;

[0084] The comparator is used to match the converted user behavior text information with the audit rules preset by the administrator.

[0085] The cloud desktop real-time audit method of the present invention is completed by the device.

[0086] The above-described embodiments merely illustrate several implementations of the present invention, and while their descriptions are relatively specific and detailed, they should not be construed as limiting the scope of the present invention. It should be noted that a person skilled in the art would be able to make numerous variations and improvements without departing from the spirit of the present invention, all of which fall within the scope of protection of the present invention. Therefore, the scope of protection of the present invention shall be determined by the appended claims.

Claims

1. A cloud desktop real-time audit method based on the RDP protocol, characterized by: The method is an online audit method, and the specific steps include: (1) Specify the connection parameters of the cloud desktop target host and connect to the machine through the proxy; the connection parameters include but are not limited to IP address, port number and resolution; (2) Obtain the base64 encoding of the operation fragment graph generated by the user during the RDP operation and model the user information based on the context of the connection; (3) Decode the base64 encoding of the fragment image and convert it into a jpg / png format image. Determine whether to increase the image resolution based on the administrator configuration or machine load, and identify the text information in the image. (4) Match the converted user behavior text information with the audit rules preset by the administrator. If a match is found, the administrator will be notified by email or phone.

2. The cloud desktop real-time audit method based on the RDP protocol according to claim 1 is characterized in that: Step (1) includes the following steps: S11. The client and the server shake hands and exchange relevant information. S12: Establishing the active connection for this session.

3. The cloud desktop real-time audit method based on the RDP protocol according to claim 1 is characterized in that: Step (2) includes the following steps: S21. Obtaining the protocol instruction returned by the server to the client from the active connection of the session; S22, determine whether it is a drawing command, if it is a drawing command, go to step S23; if it is not a drawing command, return to step S21; S23, obtaining the base64 encoding of the bitmap from the drawing instruction according to the protocol instruction format; S24. Assemble the base64 encoding, user ID, source address, target machine address and other data into JSON format.

4. The cloud desktop real-time audit method based on the RDP protocol according to claim 1 is characterized in that: Step (3) includes the following steps: S31. Extract the base64 encoding of the operation fragment graph from the JSON data; S32, decode the base64 encoded data and convert it into a picture in jpg / png format; S33. Determine whether to increase the image resolution based on the machine load parameters configured by the administrator. If yes, proceed to step S34; otherwise, proceed to step S35. S34, super-resolving the image to improve the resolution of the image; S35: Identify text information in the image and use it as a user operation behavior identifier; S36. Assemble the user operation behavior identifier and connection related information into JSON format.

5. The cloud desktop real-time audit method based on the RDP protocol according to claim 1 is characterized in that: Step (4) comprises the following steps: S41. Extract the user operation behavior identifier from the JSON data; S42: Match according to the audit rules configured by the administrator. If a match is found, proceed to step S43; otherwise, proceed to step S41. S43. Alert the administrator via email, phone, etc.

6. The cloud desktop real-time audit method based on the RDP protocol according to claim 1 or 3 is characterized in that: The image transmission virtual channel is parsed from the protocol function data layer of the RDP connection agent, and the user's current operation fragment map is obtained in real time from the channel to perform user information modeling. The fragment map is transmitted in the form of base64 encoding.

7. The cloud desktop real-time audit method based on the RDP protocol according to claim 1 or 4 is characterized in that: Decode the base64 encoding of the fragment image and convert it into a jpg / png format image. Then call the locally deployed text recognition service to perceive the user's current behavior.

8. The cloud desktop real-time audit method based on the RDP protocol according to claim 1 or 4 is characterized in that: Administrators can ensure connection stability by lowering the RDP connection resolution during peak hours to reduce the load on the proxy machine. To ensure the accuracy of recognition results, the text recognition service will determine whether to call the image super-resolution model to improve the image resolution based on the administrator configuration or the load of the proxy machine.

9. The cloud desktop real-time audit method based on the RDP protocol according to claim 1 or 5, characterized in that: The text recognition results of the image are matched with the audit rules. If the audit rules are hit, an alarm will be triggered. The alarm information includes user ID, source address, target machine address and specific operation behavior identification.

10. A device for implementing the RDP protocol-based cloud desktop real-time audit method according to any one of claims 1 to 10, comprising: Collector, used to obtain RDP operation fragmentation graph; Encoder, used to obtain the base64 encoding of the RDP operation fragment graph and perform user information modeling; The decoder is used to decode the base64 image into jpg / png format, determine whether to increase the image resolution based on the configured parameters, and recognize the text information in the image; The comparator is used to match the converted user behavior text information with the audit rules preset by the administrator.

Images