Instruction processing method based on command identification and related device

Abstract

The invention discloses an instruction processing method based on command recognition and a related device, and relates to the technical field of computers.The method comprises the steps that agent program information is determined based on capture parameter information, and command line information is captured based on the agent program information; creating a content container, and performing operation instruction analysis and keyword analysis on the command line information in the content container to obtain a plurality of pieces of operation instruction information and target keywords corresponding to the command line information; command identification is carried out based on the operation instruction information and the target keyword, and a plurality of pieces of initial command information are obtained; performing command score analysis on the plurality of pieces of initial command information to obtain a target command score of each piece of initial command information, determining target command information based on the target command score, determining an instruction execution mode based on the target command information, and performing instruction processing and instruction recording based on the instruction execution mode. According to the invention, high-reliability identification and recording of command line operation data can be realized.

Description

Technical Field

[0001] This invention relates to the field of computer technology, and in particular to an instruction processing method and related apparatus based on command recognition. Background Technology

[0002] With the advancement of technology, the emergence of numerous applications has facilitated people's daily work and life. The backend services of each application typically correspond to one or more servers, and the server operating systems primarily use command-line interfaces for business operations and deployment. Therefore, command-line instruction processing is virtually irreplaceable. Command recognition is a crucial step in command-line instruction processing. Currently, command-line interpreters are commonly used for command recognition, but this method relies heavily on manually set rules. If these rules are incomplete, the recognized command information will have significant deviations, failing to achieve reliable instruction processing and recording of operational behaviors. Furthermore, the impact of keywords on command recognition is rarely considered. Analyzing command-line information for keywords can not only improve the accuracy of command recognition but also its efficiency. Therefore, incorporating keyword analysis is a key consideration in command recognition. Summary of the Invention

[0003] The purpose of this invention is to overcome the shortcomings of the prior art. This invention provides an instruction processing method and related apparatus based on command recognition, which realizes highly reliable recognition and recording of command line operation data.

[0004] To address the aforementioned technical problems, this invention provides an instruction processing method based on command recognition, the method comprising:

[0005] The agent program information is determined based on the captured parameter information, and command line information is captured based on the agent program information;

[0006] Create a content container, and perform operation instruction parsing and keyword analysis on the command line information in the content container to obtain several operation instruction information and target keywords corresponding to the command line information;

[0007] Command recognition is performed based on operation instruction information and target keywords to obtain several initial command information;

[0008] Command score analysis is performed on several initial command information to obtain the target command score for each initial command information. The target command information is determined based on the target command score, and the instruction execution method is determined based on the target command information. Instruction processing and instruction recording are performed based on the instruction execution method.

[0009] Optionally, determining the agent information based on the captured parameter information and capturing command-line information based on the agent information includes:

[0010] The agent type and agent trigger information are determined based on the captured parameter information, and agent information is determined based on the agent type and agent trigger information;

[0011] Obtain the agent program configuration file, and trigger the agent program to capture command line information based on the agent program configuration file and agent program information.

[0012] Optionally, the step of creating a content container involves parsing the command-line information and analyzing keywords within the content container to obtain several operation instruction information and target keywords corresponding to the command-line information, including:

[0013] An enclave container is constructed based on the software extended protection instruction set, and the enclave container is verified to obtain the verification results. The content container is then determined based on the verification results.

[0014] The command line information is parsed for execution object and execution effect in the content container to obtain execution object information and execution effect information, and several operation instruction information corresponding to the command line information is determined based on the execution object information and execution effect information.

[0015] The command line information is analyzed using index value lookup within the content container to obtain several target keywords.

[0016] Optionally, the verification of the enclave container to obtain the verification result includes:

[0017] Perform performance metrics on the enclave container and obtain the performance metrics results;

[0018] Extracting preset public keys and digital signatures from digital certificates based on enclave containers;

[0019] Based on the performance measurement results, the preset public key, and the digital signature, the enclave container is subjected to hash and integrity analysis to obtain the target hash and integrity analysis data. The enclave container is then verified based on the target hash and integrity analysis data to obtain the verification result.

[0020] Optionally, the step of performing hash and integrity analysis on the enclave container based on the performance metric results, the preset public key, and the digital signature to obtain the target hash and integrity analysis data includes:

[0021] The target hash value is obtained by performing hash calculation on the performance metric results based on the Black-3 algorithm.

[0022] The digital signature is decrypted based on a preset public key to obtain the target decryption value, and integrity analysis data is determined based on the target decryption value.

[0023] Optionally, the step of using index values ​​to query and perform keyword analysis on the command line information in the content container to obtain several target keywords, including:

[0024] Determine the initial keyword for the command-line information within the content container, determine the string information for the initial keyword, and determine the index value for each string information.

[0025] Based on the index value, keyword matching is performed in the keyword table to obtain several target keywords. The keyword table contains the correspondence between each target keyword and the index value.

[0026] Optionally, the step of identifying commands based on operation instruction information and target keywords to obtain several initial command information includes:

[0027] The operation instruction information and target keywords are input into the command recognition model for command recognition to obtain several initial command information. The command recognition model is a converged model obtained by inputting the sample dataset into a deep convolutional neural network for training.

[0028] Optionally, the step of performing command score analysis on several initial command information to obtain the target command score for each initial command information, determining the target command information based on the target command score, and determining the instruction execution method based on the target command information includes:

[0029] Each initial command message is scored using command words to obtain command word score information;

[0030] Perform instruction coverage scoring on each initial command information to obtain instruction coverage score information;

[0031] Based on the instruction word scoring information and instruction coverage scoring information, calculate the target command score for each initial command information, and take the initial command information with the highest target command score as the target command information.

[0032] Perform an execution object risk analysis on the target command information to obtain execution object risk data;

[0033] Based on the risk data of the execution object, the execution mode is analyzed to obtain the instruction execution mode, which includes permission and interception.

[0034] In addition, the present invention also provides an instruction processing device based on command recognition, the device comprising:

[0035] Command line capture module: used to determine agent program information based on capture parameter information, and capture command line information based on the agent program information;

[0036] Command Keyword Analysis Module: Used to create a content container, in which the command line information is parsed and analyzed for operation instructions and keywords to obtain several operation instruction information and target keywords corresponding to the command line information;

[0037] Command recognition module: used to recognize commands based on operation instruction information and target keywords, and obtain several initial command information;

[0038] Instruction processing and recording module: used to perform command score analysis on several initial command information, obtain the target command score of each initial command information, determine the target command information based on the target command score, determine the instruction execution method based on the target command information, and perform instruction processing and instruction recording based on the instruction execution method.

[0039] In addition, the present invention also provides an electronic device, the electronic device including a processor and a memory, characterized in that the memory is used to store instructions, and the processor is used to call the instructions in the memory, causing the electronic device to execute the instruction processing method based on command recognition as described in any one of claims 1 to 8.

[0040] In this embodiment of the invention, agent program information is determined based on captured parameter information, and command line information is captured based on the agent program information. This effectively captures command line information and avoids omissions in instruction processing. A content container is created, and operation instructions and keywords are parsed and analyzed within the content container to obtain several operation instruction information and target keywords corresponding to the command line information. Command recognition is performed based on the operation instruction information and target keywords. Command score analysis is performed on several initial command information to determine the target command information. This avoids excessive reliance on manually set rules and improves both the accuracy and processing efficiency of command recognition. The instruction execution method is determined based on the target command information, and instruction processing and recording are performed based on the instruction execution method, achieving highly reliable recognition and recording of command line operation data. Attached Figure Description

[0041] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0042] Figure 1This is a flowchart illustrating the command processing method based on command recognition in an embodiment of the present invention.

[0043] Figure 2 This is a flowchart illustrating an instruction processing method based on command recognition according to another embodiment of the present invention.

[0044] Figure 3 This is a schematic diagram of the structural composition of the instruction processing device based on command recognition in an embodiment of the present invention;

[0045] Figure 4 This is a schematic diagram of the structural composition of the electronic device in an embodiment of the present invention. Detailed Implementation

[0046] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0047] Example 1

[0048] Please see Figure 1 , Figure 1 This is a flowchart illustrating an instruction processing method based on command recognition according to an embodiment of the present invention. The method includes:

[0049] S11: Determine the agent program information based on the captured parameter information, and capture command line information based on the agent program information;

[0050] In a specific implementation of the present invention, the step of determining agent program information based on capture parameter information and capturing command line information based on the agent program information includes: determining agent program type and agent program triggering information based on capture parameter information, and determining agent program information based on the agent program type and agent program triggering information; obtaining agent program configuration file, and triggering the agent program to capture command line information based on the agent program configuration file and agent program information.

[0051] Specifically, the agent program type and trigger information are determined based on the captured parameter information. The captured parameter information includes captured rule information, captured task information, and captured data storage information. The agent program type includes resident processes and non-resident processes. The agent program trigger information includes program tool and configuration triggers. When command line input is detected, the corresponding captured parameter information is matched according to the operating system of the received command line information. The corresponding agent program type and penalty information are then matched based on the captured parameter information. Agent program information is determined based on the agent program type and trigger information; that is, agent program information is composed of the agent program type and trigger information. The agent program configuration file is obtained, and can be set using the agent program trigger information. The agent program is triggered to capture command line information based on the configuration file and agent program information. The configuration file and agent program information are input into the task executor, which triggers the agent program to capture command line information. The task executor can use an automation tool based on the Python language. The agent program is software that processes data between servers. It captures and processes data by creating a proxy between servers. Setting up an agent program can improve privacy protection and prevent data leakage.

[0052] S12: Create a content container, and perform operation instruction parsing and keyword analysis on the command line information in the content container to obtain several operation instruction information and target keywords corresponding to the command line information;

[0053] In the specific implementation of this invention, the creation of a content container, and the parsing of operation instructions and keyword analysis of command line information within the content container to obtain several operation instruction information and target keywords corresponding to the command line information, includes: constructing an enclave container based on the software extended protection instruction set, verifying the enclave container, obtaining verification results, and determining the content container based on the verification results; parsing the execution object and execution effect of the command line information within the content container to obtain execution object information and execution effect information, and determining several operation instruction information corresponding to the command line information based on the execution object information and execution effect information; and performing keyword analysis of the command line information using index value lookup within the content container to obtain several target keywords.

[0054] Furthermore, the verification of the enclave container to obtain verification results includes: performing performance measurement on the enclave container to obtain performance measurement results; extracting a preset public key and digital signature based on the digital certificate of the enclave container; performing hash and integrity analysis on the enclave container based on the performance measurement results, the preset public key, and the digital signature to obtain target hash and integrity analysis data, and verifying the enclave container based on the target hash and integrity analysis data to obtain verification results.

[0055] Furthermore, the step of performing hash and integrity analysis on the enclave container based on the performance measurement results, the preset public key, and the digital signature to obtain the target hash value and integrity analysis data includes: performing hash calculation on the performance measurement results based on the Black-3 algorithm to obtain the target hash value; performing signature verification decryption on the digital signature based on the preset public key to obtain the target decryption value, and determining the integrity analysis data based on the target decryption value.

[0056] Furthermore, the step of using index values ​​to query and analyze command line information in the content container to obtain several target keywords includes: determining the initial keywords of the command line information in the content container, determining the string information of the initial keywords, and determining the index value of each string information; performing keyword matching in a keyword table based on the index values ​​to obtain several target keywords, wherein the keyword table contains the correspondence between each target keyword and the index value.

[0057] Specifically, an enclave container is built based on the Software Guard Extensions (SGX) instruction set. The SGX instruction set is an extension of Intel's Ginnix, designed to provide a secure and trusted execution environment for user space. This instruction set enables isolated program execution, protecting the confidentiality and integrity of critical code and data. An enclave container runs in a protected area, providing more reliable security for data processing within it. Performance metrics are then performed on the enclave container, analyzing the performance of various components added during its construction, such as storage capacity and computing power. Performance is measured according to preset performance measurement rules, analyzing these parameters, and sorting the data according to a preset format to form a data sequence. This data sequence is then signed to obtain the performance measurement result. A preset public key and digital signature are extracted from the enclave container's digital certificate. The digital certificate provided during enclave container creation contains the application's public key and digital signature. The digital signature consists of the signature formed from the data sequence of the measurement results. The Blake3 algorithm is used to perform hash calculations on performance metrics results. The Blake3 algorithm is an efficient, secure, and adaptable hash algorithm that can produce hash values ​​or hash values ​​faster and more accurately than other algorithms. The message digest obtained by calculating the message digest of the signature formed by the data sequence using the Blake3 algorithm is the target hash value. The signature verification decryption is performed based on a preset public key. This involves decrypting the digital signature using the preset public key to obtain the hash value, i.e., obtaining the target decryption value. The signature verification decryption refers to decrypting the digital signature using the public key to obtain the decrypted hash value. Integrity analysis data is then determined based on the target decryption value, which is used as the integrity coefficient. The enclave container is then verified based on the target hash value and the integrity coefficient. The target hash value and the integrity coefficient are compared to obtain the verification result. The content container is determined based on the verification result. If the target hash value and the integrity coefficient are consistent, the integrity verification is passed, and the enclave container is used as the content container. If the target hash value and the integrity coefficient are inconsistent, the integrity verification fails, and the user is prompted to recreate the content container.The command-line information is parsed for both execution object and execution effect within the content container. This content container provides strong security protection for data processing. The command-line information, including operation instructions and their execution parameters, is loaded into the content container. Execution object information (e.g., rg / data) and execution effect information (e.g., the operation instruction, deletion) are obtained. Since there is at least one matching operation instruction in the command-line information, there may be multiple execution object and execution effect information. Based on these, several operation instruction information corresponding to the command-line information are determined; that is, the operation instruction information is composed of the execution object information and the execution effect information. The initial keyword of the command-line information is determined within the content container. The correspondence between command lines and keywords is stored in a tree structure in the information database. Therefore, the initial keyword of the command-line information is determined through the information database, along with its string information. The index value of each string information is determined; different strings correspond to different index values, which can be matched in the index mapping database. Based on the index value, keyword matching is performed in the keyword table to obtain several target keywords. The keyword table contains the correspondence between each target keyword and the index value. Since there may be errors in the initial keyword, such as the initial keyword being "delet", the correct keyword corresponding to the initial keyword, such as "delete", is matched in the keyword table according to the index value of the string. This correct keyword is the target keyword.

[0058] S13: Based on the operation instruction information and target keywords, perform command recognition to obtain several initial command information;

[0059] In the specific implementation of this invention, the step of performing command recognition based on operation instruction information and target keywords to obtain several initial command information includes: inputting operation instruction information and target keywords into a command recognition model to perform command recognition and obtain several initial command information. The command recognition model is a convergent model obtained by inputting a sample dataset into a deep convolutional neural network for training.

[0060] Specifically, the operation instruction information and target keywords are input into the command recognition model for command recognition to obtain several initial command information. The command recognition model is a converged model obtained by inputting the sample dataset into a deep convolutional neural network for training. Command recognition is based on the analysis of command matching degree between the operation instruction information and target keywords, and the n command information with the highest matching degree are used as the initial command information.

[0061] S14: Perform command score analysis on several initial command information to obtain the target command score of each initial command information, determine the target command information based on the target command score, determine the instruction execution method based on the target command information, and perform instruction processing and instruction recording based on the instruction execution method.

[0062] In a specific implementation of this invention, the step of performing command score analysis on several initial command information to obtain the target command score for each initial command information, determining the target command information based on the target command score, and determining the instruction execution method based on the target command information includes: performing instruction word scoring on each initial command information to obtain instruction word scoring information; performing instruction coverage scoring on each initial command information to obtain instruction coverage scoring information; calculating the target command score for each initial command information based on the instruction word scoring information and the instruction coverage scoring information, and taking the initial command information with the highest target command score as the target command information; performing execution object risk analysis on the target command information to obtain execution object risk data; and performing execution method analysis based on the execution object risk data to obtain the instruction execution method, wherein the instruction execution method includes permission and interception.

[0063] Specifically, each initial command message is scored using instruction words. A matching degree model is used to analyze the matching degree between the instruction words and command line information of each initial command message. The resulting matching degree is used as the instruction word score for each initial command message, thus obtaining the instruction word score information. Next, each initial command message is scored for instruction coverage. This involves analyzing the completeness of the instructions in each initial command message. An initial command message with the presence of required instruction words or keywords scores higher, while one lacking essential instruction words or keywords scores lower. For example, `display datetime` lacks the time keyword, resulting in a lower score. The obtained score is the instruction coverage score information. Based on the instruction word score information and the instruction coverage score information, the target command score for each initial command message is calculated. The weighted average of the instruction word score information and the instruction coverage score information is used to calculate the target command score. The initial command message with the highest target command score is selected as the target command information, thus ensuring that the selected command information is more complete and accurate. The target command information is subjected to execution object hazard analysis. The target command information is input into a hazard analysis model to evaluate the hazard level of the execution object. The resulting hazard level is the execution object hazard data. For example, if the hazard analysis model determines that the execution object of the target command information is the root directory, it is assessed as a command information with a high hazard level. Based on the execution object hazard data, execution mode analysis is performed to obtain the instruction execution mode, which includes permission and interception. Instruction processing and recording are performed based on the instruction execution mode. Specifically, high-hazard target command information is intercepted, disallowing it from processing related operating system instructions. If the target command information is not high-hazard, instruction processing is permitted, and the operational behavior of the instruction processing is recorded, achieving highly reliable recording of command line operation behavior.

[0064] In this embodiment of the invention, agent program information is determined based on captured parameter information, and command line information is captured based on the agent program information. This effectively captures command line information and avoids omissions in instruction processing. A content container is created, and operation instructions and keywords are parsed and analyzed within the content container to obtain several operation instruction information and target keywords corresponding to the command line information. Command recognition is performed based on the operation instruction information and target keywords. Command score analysis is performed on several initial command information to determine the target command information. This avoids excessive reliance on manually set rules and improves both the accuracy and processing efficiency of command recognition. The instruction execution method is determined based on the target command information, and instruction processing and recording are performed based on the instruction execution method, achieving highly reliable recognition and recording of command line operation data.

[0065] Example 2

[0066] Please see Figure 2 , Figure 2 This is a flowchart illustrating an instruction processing method based on command recognition according to another embodiment of the present invention, the method comprising:

[0067] S201: Determine the agent program information based on the captured parameter information, and capture command line information based on the agent program information;

[0068] S202: Construct an enclave container based on the software extended protection instruction set, verify the enclave container, obtain the verification result, and determine the content container based on the verification result;

[0069] S203: In the content container, the command line information is parsed for execution object and execution effect to obtain execution object information and execution effect information, and several operation instruction information corresponding to the command line information is determined based on the execution object information and execution effect information;

[0070] S204: In the content container, use the index value query to perform keyword analysis on the command line information to obtain several target keywords;

[0071] S205: Based on operation instruction information and target keywords, perform command recognition to obtain several initial command information;

[0072] S206: Perform command score analysis on several initial command information to obtain the target command score for each initial command information, determine the target command information based on the target command score, determine the instruction execution method based on the target command information, and perform instruction processing and instruction recording based on the instruction execution method.

[0073] In this embodiment of the invention, agent program information is determined based on captured parameter information, and command line information is captured based on the agent program information. This effectively captures command line information and avoids omissions in instruction processing. A content container is created, and operation instructions and keywords are parsed and analyzed within the content container to obtain several operation instruction information and target keywords corresponding to the command line information. Command recognition is performed based on the operation instruction information and target keywords. Command score analysis is performed on several initial command information to determine the target command information. This avoids excessive reliance on manually set rules and improves both the accuracy and processing efficiency of command recognition. The instruction execution method is determined based on the target command information, and instruction processing and recording are performed based on the instruction execution method, achieving highly reliable recognition and recording of command line operation data.

[0074] Example 3

[0075] Please see Figure 3 , Figure 3 This is a schematic diagram of the structural composition of an instruction processing device based on command recognition according to an embodiment of the present invention. The device includes:

[0076] Command line capture module 31: used to determine agent program information based on capture parameter information, and capture command line information based on the agent program information;

[0077] In a specific implementation of the present invention, the step of determining agent program information based on capture parameter information and capturing command line information based on the agent program information includes: determining agent program type and agent program triggering information based on capture parameter information, and determining agent program information based on the agent program type and agent program triggering information; obtaining agent program configuration file, and triggering the agent program to capture command line information based on the agent program configuration file and agent program information.

[0078] Specifically, the agent program type and trigger information are determined based on the captured parameter information. The captured parameter information includes captured rule information, captured task information, and captured data storage information. The agent program type includes resident processes and non-resident processes. The agent program trigger information includes program tool and configuration triggers. When command line input is detected, the corresponding captured parameter information is matched according to the operating system of the received command line information. The corresponding agent program type and penalty information are then matched based on the captured parameter information. Agent program information is determined based on the agent program type and trigger information; that is, agent program information is composed of the agent program type and trigger information. The agent program configuration file is obtained, and can be set using the agent program trigger information. The agent program is triggered to capture command line information based on the configuration file and agent program information. The configuration file and agent program information are input into the task executor, which triggers the agent program to capture command line information. The task executor can use an automation tool based on the Python language. The agent program is software that processes data between servers. It captures and processes data by creating a proxy between servers. Setting up an agent program can improve privacy protection and prevent data leakage.

[0079] Instruction Keyword Analysis Module 32: Used to create a content container, in which the command line information is parsed and analyzed for operation instructions and keywords to obtain several operation instruction information and target keywords corresponding to the command line information;

[0080] In the specific implementation of this invention, the creation of a content container, and the parsing of operation instructions and keyword analysis of command line information within the content container to obtain several operation instruction information and target keywords corresponding to the command line information, includes: constructing an enclave container based on the software extended protection instruction set, verifying the enclave container, obtaining verification results, and determining the content container based on the verification results; parsing the execution object and execution effect of the command line information within the content container to obtain execution object information and execution effect information, and determining several operation instruction information corresponding to the command line information based on the execution object information and execution effect information; and performing keyword analysis of the command line information using index value lookup within the content container to obtain several target keywords.

[0081] Furthermore, the verification of the enclave container to obtain verification results includes: performing performance measurement on the enclave container to obtain performance measurement results; extracting a preset public key and digital signature based on the digital certificate of the enclave container; performing hash and integrity analysis on the enclave container based on the performance measurement results, the preset public key, and the digital signature to obtain target hash and integrity analysis data, and verifying the enclave container based on the target hash and integrity analysis data to obtain verification results.

[0082] Furthermore, the step of performing hash and integrity analysis on the enclave container based on the performance measurement results, the preset public key, and the digital signature to obtain the target hash value and integrity analysis data includes: performing hash calculation on the performance measurement results based on the Black-3 algorithm to obtain the target hash value; performing signature verification decryption on the digital signature based on the preset public key to obtain the target decryption value, and determining the integrity analysis data based on the target decryption value.

[0083] Furthermore, the step of using index values ​​to query and analyze command line information in the content container to obtain several target keywords includes: determining the initial keywords of the command line information in the content container, determining the string information of the initial keywords, and determining the index value of each string information; performing keyword matching in a keyword table based on the index values ​​to obtain several target keywords, wherein the keyword table contains the correspondence between each target keyword and the index value.

[0084] Specifically, an enclave container is built based on the Software Guard Extensions (SGX) instruction set. The SGX instruction set is an extension of Intel's Ginnix, designed to provide a secure and trusted execution environment for user space. This instruction set enables isolated program execution, protecting the confidentiality and integrity of critical code and data. An enclave container runs in a protected area, providing more reliable security for data processing within it. Performance metrics are then performed on the enclave container, analyzing the performance of various components added during its construction, such as storage capacity and computing power. Performance is measured according to preset performance measurement rules, analyzing these parameters, and sorting the data according to a preset format to form a data sequence. This data sequence is then signed to obtain the performance measurement result. A preset public key and digital signature are extracted from the enclave container's digital certificate. The digital certificate provided during enclave container creation contains the application's public key and digital signature. The digital signature consists of the signature formed from the data sequence of the measurement results. The Blake3 algorithm is used to perform hash calculations on performance metrics results. The Blake3 algorithm is an efficient, secure, and adaptable hash algorithm that can produce hash values ​​or hash values ​​faster and more accurately than other algorithms. The message digest obtained by calculating the message digest of the signature formed by the data sequence using the Blake3 algorithm is the target hash value. The signature verification decryption is performed based on a preset public key. This involves decrypting the digital signature using the preset public key to obtain the hash value, i.e., obtaining the target decryption value. The signature verification decryption refers to decrypting the digital signature using the public key to obtain the decrypted hash value. Integrity analysis data is then determined based on the target decryption value, which is used as the integrity coefficient. The enclave container is then verified based on the target hash value and the integrity coefficient. The target hash value and the integrity coefficient are compared to obtain the verification result. The content container is determined based on the verification result. If the target hash value and the integrity coefficient are consistent, the integrity verification is passed, and the enclave container is used as the content container. If the target hash value and the integrity coefficient are inconsistent, the integrity verification fails, and the user is prompted to recreate the content container.The command-line information is parsed for both execution object and execution effect within the content container. This content container provides strong security protection for data processing. The command-line information, including operation instructions and their execution parameters, is loaded into the content container. Execution object information (e.g., rg / data) and execution effect information (e.g., the operation instruction, deletion) are obtained. Since there is at least one matching operation instruction in the command-line information, there may be multiple execution object and execution effect information. Based on these, several operation instruction information corresponding to the command-line information are determined; that is, the operation instruction information is composed of the execution object information and the execution effect information. The initial keyword of the command-line information is determined within the content container. The correspondence between command lines and keywords is stored in a tree structure in the information database. Therefore, the initial keyword of the command-line information is determined through the information database, along with its string information. The index value of each string information is determined; different strings correspond to different index values, which can be matched in the index mapping database. Based on the index value, keyword matching is performed in the keyword table to obtain several target keywords. The keyword table contains the correspondence between each target keyword and the index value. Since there may be errors in the initial keyword, such as the initial keyword being "delet", the correct keyword corresponding to the initial keyword, such as "delete", is matched in the keyword table according to the index value of the string. This correct keyword is the target keyword.

[0085] Command recognition module 33: used to recognize commands based on operation instruction information and target keywords, and obtain several initial command information;

[0086] In the specific implementation of this invention, the step of performing command recognition based on operation instruction information and target keywords to obtain several initial command information includes: inputting operation instruction information and target keywords into a command recognition model to perform command recognition and obtain several initial command information. The command recognition model is a convergent model obtained by inputting a sample dataset into a deep convolutional neural network for training.

[0087] Specifically, the operation instruction information and target keywords are input into the command recognition model for command recognition to obtain several initial command information. The command recognition model is a converged model obtained by inputting the sample dataset into a deep convolutional neural network for training. Command recognition is based on the analysis of command matching degree between the operation instruction information and target keywords, and the n command information with the highest matching degree are used as the initial command information.

[0088] Instruction processing and recording module 34: used to perform command score analysis on several initial command information, obtain the target command score of each initial command information, determine the target command information based on the target command score, determine the instruction execution mode based on the target command information, and perform instruction processing and instruction recording based on the instruction execution mode.

[0089] In a specific implementation of this invention, the step of performing command score analysis on several initial command information to obtain the target command score for each initial command information, determining the target command information based on the target command score, and determining the instruction execution method based on the target command information includes: performing instruction word scoring on each initial command information to obtain instruction word scoring information; performing instruction coverage scoring on each initial command information to obtain instruction coverage scoring information; calculating the target command score for each initial command information based on the instruction word scoring information and the instruction coverage scoring information, and taking the initial command information with the highest target command score as the target command information; performing execution object risk analysis on the target command information to obtain execution object risk data; and performing execution method analysis based on the execution object risk data to obtain the instruction execution method, wherein the instruction execution method includes permission and interception.

[0090] Specifically, each initial command message is scored using instruction words. A matching degree model is used to analyze the matching degree between the instruction words and command line information of each initial command message. The resulting matching degree is used as the instruction word score for each initial command message, thus obtaining the instruction word score information. Next, each initial command message is scored for instruction coverage. This involves analyzing the completeness of the instructions in each initial command message. An initial command message with the presence of required instruction words or keywords scores higher, while one lacking essential instruction words or keywords scores lower. For example, `display datetime` lacks the time keyword, resulting in a lower score. The obtained score is the instruction coverage score information. Based on the instruction word score information and the instruction coverage score information, the target command score for each initial command message is calculated. The weighted average of the instruction word score information and the instruction coverage score information is used to calculate the target command score. The initial command message with the highest target command score is selected as the target command information, thus ensuring that the selected command information is more complete and accurate. The target command information is subjected to execution object hazard analysis. The target command information is input into a hazard analysis model to evaluate the hazard level of the execution object. The resulting hazard level is the execution object hazard data. For example, if the hazard analysis model determines that the execution object of the target command information is the root directory, it is assessed as a command information with a high hazard level. Based on the execution object hazard data, execution mode analysis is performed to obtain the instruction execution mode, which includes permission and interception. Instruction processing and recording are performed based on the instruction execution mode. Specifically, high-hazard target command information is intercepted, disallowing it from processing related operating system instructions. If the target command information is not high-hazard, instruction processing is permitted, and the operational behavior of the instruction processing is recorded, achieving highly reliable recording of command line operation behavior.

[0091] In this embodiment of the invention, agent program information is determined based on captured parameter information, and command line information is captured based on the agent program information. This effectively captures command line information and avoids omissions in instruction processing. A content container is created, and operation instructions and keywords are parsed and analyzed within the content container to obtain several operation instruction information and target keywords corresponding to the command line information. Command recognition is performed based on the operation instruction information and target keywords. Command score analysis is performed on several initial command information to determine the target command information. This avoids excessive reliance on manually set rules and improves both the accuracy and processing efficiency of command recognition. The instruction execution method is determined based on the target command information, and instruction processing and recording are performed based on the instruction execution method, achieving highly reliable recognition and recording of command line operation data.

[0092] Example 4

[0093] Please see Figure 4 , Figure 4 This is a schematic diagram of the structural composition of the electronic device in an embodiment of the present invention.

[0094] This invention also provides an electronic device, such as... Figure 4 As shown, the electronic device includes a memory 41, a processor 43, and a computer program 42 stored in the memory 41 and executable on the processor 43. Those skilled in the art will understand that... Figure 3 The illustrated electronic device does not constitute a limitation on all devices and may include more or fewer components than illustrated, or combine certain components. Memory 41 can be used to store computer program 42 and various functional modules. Processor 43 runs the computer program 42 stored in memory 41, thereby performing various functional applications and data processing of the device. Memory can be internal memory or external memory, or both. Internal memory may include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM), flash memory, or random access memory. External memory may include hard disks, floppy disks, ZIP disks, USB flash drives, magnetic tapes, etc. Processor 43 may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The general-purpose processor can be a microprocessor, a single-chip microcomputer, or a processor 43, or any conventional processor, etc. The processors and memories disclosed in this invention include, but are not limited to, these types of processors and memories. The processors and memories disclosed in this invention are merely examples and not intended to be limiting.

[0095] As one embodiment, the electronic device includes: one or more processors 43, a memory 41, and one or more computer programs 42, wherein the one or more computer programs 42 are stored in the memory 41 and configured to be executed by the one or more processors 43, and the one or more computer programs 42 are configured to execute the instruction processing method based on command recognition in any of the above embodiments. For specific implementation details, please refer to the above embodiments, which will not be repeated here.

[0096] In this embodiment of the invention, agent program information is determined based on captured parameter information, and command line information is captured based on the agent program information. This effectively captures command line information and avoids omissions in instruction processing. A content container is created, and operation instructions and keywords are parsed and analyzed within the content container to obtain several operation instruction information and target keywords corresponding to the command line information. Command recognition is performed based on the operation instruction information and target keywords. Command score analysis is performed on several initial command information to determine the target command information. This avoids excessive reliance on manually set rules and improves both the accuracy and processing efficiency of command recognition. The instruction execution method is determined based on the target command information, and instruction processing and recording are performed based on the instruction execution method, achieving highly reliable recognition and recording of command line operation data.

[0097] Those skilled in the art will understand that all or part of the steps in the various methods of the above embodiments can be implemented by a program instructing related hardware. The program can be stored in a computer-readable storage medium, which may include: read-only memory (ROM), random access memory (RAM), disk or optical disk, etc.

[0098] Furthermore, the above description provides a detailed introduction to the instruction processing method and related apparatus based on command recognition provided by the embodiments of the present invention. Specific examples have been used to illustrate the principles and implementation methods of the present invention. The description of the above embodiments is only for the purpose of helping to understand the method and core ideas of the present invention. At the same time, for those skilled in the art, there will be changes in the specific implementation methods and application scope based on the ideas of the present invention. Therefore, the content of this specification should not be construed as a limitation of the present invention.

Claims

1. A command recognition based instruction processing method, characterized by, The method includes: The agent program information is determined based on the captured parameter information, and command line information is captured based on the agent program information; Create a content container, and perform operation instruction parsing and keyword analysis on the command line information in the content container to obtain several operation instruction information and target keywords corresponding to the command line information; Command recognition is performed based on operation instruction information and target keywords to obtain several initial command information; Command score analysis is performed on several initial command information to obtain the target command score for each initial command information. The target command information is determined based on the target command score, and the instruction execution method is determined based on the target command information. Instruction processing and instruction recording are performed based on the instruction execution method.

2. The command identification based instruction processing method according to claim 1, characterized in that, The process of determining agent program information based on captured parameter information and capturing command line information based on the agent program information includes: The agent type and agent trigger information are determined based on the captured parameter information, and agent information is determined based on the agent type and agent trigger information; Obtain the agent program configuration file, and trigger the agent program to capture command line information based on the agent program configuration file and agent program information.

3. The instruction processing method based on command recognition according to claim 1, characterized in that, The creation of a content container involves parsing and analyzing command-line information within the container to obtain several operation instruction messages and target keywords corresponding to the command-line information, including: An enclave container is constructed based on the software extended protection instruction set, and the enclave container is verified to obtain the verification results. The content container is then determined based on the verification results. The command line information is parsed for execution object and execution effect in the content container to obtain execution object information and execution effect information, and several operation instruction information corresponding to the command line information is determined based on the execution object information and execution effect information. The command line information is analyzed using index value lookup within the content container to obtain several target keywords.

4. The instruction processing method based on command recognition according to claim 3, characterized in that, The verification of the enclave container, and the obtaining of the verification result, includes: Perform performance metrics on the enclave container and obtain the performance metrics results; Extracting preset public keys and digital signatures from digital certificates based on enclave containers; Based on the performance measurement results, the preset public key, and the digital signature, the enclave container is subjected to hash and integrity analysis to obtain the target hash and integrity analysis data. The enclave container is then verified based on the target hash and integrity analysis data to obtain the verification result.

5. The instruction processing method based on command recognition according to claim 4, characterized in that, The process of performing hash and integrity analysis on the enclave container based on the performance metric results, the preset public key, and the digital signature to obtain the target hash and integrity analysis data includes: The target hash value is obtained by performing hash calculation on the performance metric results based on the Black-3 algorithm. The digital signature is decrypted based on a preset public key to obtain the target decryption value, and integrity analysis data is determined based on the target decryption value.

6. The instruction processing method based on command recognition according to claim 3, characterized in that, The command-line information is analyzed using index values ​​within the content container to obtain several target keywords, including: Determine the initial keyword for the command-line information within the content container, determine the string information for the initial keyword, and determine the index value for each string information. Based on the index value, keyword matching is performed in the keyword table to obtain several target keywords. The keyword table contains the correspondence between each target keyword and the index value.

7. The instruction processing method based on command recognition according to claim 1, characterized in that, The command recognition based on operation instruction information and target keywords yields several initial command information entries, including: The operation instruction information and target keywords are input into the command recognition model for command recognition to obtain several initial command information. The command recognition model is a converged model obtained by inputting the sample dataset into a deep convolutional neural network for training.

8. The instruction processing method based on command recognition according to claim 1, characterized in that, The step of performing command score analysis on several initial command information to obtain the target command score for each initial command information, determining the target command information based on the target command score, and determining the instruction execution method based on the target command information includes: Each initial command message is scored using command words to obtain command word score information; Perform instruction coverage scoring on each initial command information to obtain instruction coverage score information; Based on the instruction word scoring information and instruction coverage scoring information, calculate the target command score for each initial command information, and take the initial command information with the highest target command score as the target command information. Perform an execution object risk analysis on the target command information to obtain execution object risk data; Based on the risk data of the execution object, the execution mode is analyzed to obtain the instruction execution mode, which includes permission and interception.

9. An instruction processing device based on command recognition, characterized in that, The device includes: Command line capture module: used to determine agent program information based on capture parameter information, and capture command line information based on the agent program information; Command Keyword Analysis Module: Used to create a content container, in which the command line information is parsed and analyzed for operation instructions and keywords to obtain several operation instruction information and target keywords corresponding to the command line information; Command recognition module: used to recognize commands based on operation instruction information and target keywords, and obtain several initial command information; Instruction processing and recording module: used to perform command score analysis on several initial command information, obtain the target command score of each initial command information, determine the target command information based on the target command score, determine the instruction execution method based on the target command information, and perform instruction processing and instruction recording based on the instruction execution method.

10. An electronic device, the electronic device comprising a processor and a memory, characterized in that, The memory is used to store instructions, and the processor is used to call the instructions in the memory, causing the electronic device to execute the instruction processing method based on command recognition as described in any one of claims 1 to 8.

Images