A method, device, and bastion host system for detecting operation and maintenance commands.

Abstract

This invention belongs to the field of asset security operation and maintenance technology, and aims to provide a method, device, and bastion host system for detecting operation and maintenance commands. The baseline creation process simultaneously considers command sequence anomalies, time anomalies, and source IP or subnet anomalies, enabling the detection of covert attacks that are difficult to detect using traditional methods. Each server asset independently learns its normal operating habits, adapting to differences in the operating habits of different assets. Baselines are dynamically established during the learning phase, with alerts only issued for operations that significantly deviate from historical behavior. Furthermore, multi-process model reuse is achieved through shared memory; the exit of child processes does not affect model data, saving memory and avoiding repetitive learning. Deletion interfaces at the asset and IP granularity are provided, facilitating operation and maintenance personnel to correct misjudgments or clean up offline assets.

Description

Technical Field

[0001] This invention belongs to the field of asset security operation and maintenance technology, and in particular relates to a method and device for detecting abnormal server operation and maintenance commands, as well as a bastion host system that applies the method for detecting abnormal operation and maintenance commands. Background Technology

[0002] In the field of server security operations and maintenance, real-time monitoring and anomaly detection of user-executed commands are crucial for preventing malicious operations, insider threats, and system misuse. Traditional security monitoring systems typically employ the following two methods: Static rule matching: A predefined list of high-risk commands (such as rm -rf / , dd if= / dev / zero of= / dev / sda) is defined, and an alert is triggered immediately upon their occurrence. This method lacks the ability to identify normal behavior, is prone to generating a large number of false alarms (for example, when operations and maintenance personnel do need to execute high-risk commands in an emergency), and is difficult to detect hidden abnormal operations (such as the low-probability combination of ls followed by rm).

[0003] Simple statistical threshold: This method counts the frequency of a single command and issues an alert if the frequency exceeds a certain threshold. However, this approach ignores the temporal dependencies between commands and does not incorporate contextual information, resulting in a high false negative rate (for example, an attacker might use a previously unseen IP address to execute a low-risk command; although the IP address is abnormal, the command itself is harmless, and traditional methods would not issue an alert).

[0004] Therefore, there is an urgent need for a technical solution that can combine daily server maintenance habits with multi-source information to accurately detect abnormal commands. Summary of the Invention

[0005] To address the problems of false positives or false negatives and the difficulty in effectively identifying abnormal commands in existing technologies, this invention aims to provide a method, apparatus, and bastion host system that integrates the contextual information of operation and maintenance commands into multi-dimensional risks, enables servers to perform independent self-learning and establish behavioral baselines, thereby improving the accuracy of abnormal command detection.

[0006] To achieve the above-mentioned technical objectives, the present invention proposes the following technical solution: Firstly, a method for detecting operation and maintenance instructions, including: Calculate the Markov probability value of the operation and maintenance instruction to be detected, and determine the inherent risk value of the operation and maintenance instruction to be detected based on the Markov probability value; determine the time risk value of the operation and maintenance instruction to be detected based on the historical probability of the time period in which the operation and maintenance instruction to be detected is located; determine the source risk value of the operation and maintenance instruction to be detected based on the source IP and its subnet. Based on the inherent risk value, time risk value, and source risk value, determine the multidimensional risk value of the operation and maintenance instruction to be detected; The multidimensional risk value is compared with the baseline value of the operation and maintenance instructions of the target asset. If the multidimensional risk value of the operation and maintenance instruction to be detected exceeds the baseline value and reaches the preset alarm level, the operation and maintenance instruction to be detected is determined to be abnormal.

[0007] Preferably, the process for determining the baseline value of the operation and maintenance instructions for the target asset specifically includes: Operation and maintenance commands that retrieve a preset number of target assets in chronological order; The sequence of operation and maintenance instructions is recorded using a first-order and a second-order transition counting matrix; each current operation and maintenance instruction and its two preceding historical operation and maintenance instructions are obtained; if a second-order Markov probability exists, the second-order probability value is calculated, otherwise the first-order probability value is calculated; a basic risk value is set for the current operation and maintenance instruction based on the first-order or second-order probability value; the inherent risk weight of the current operation and maintenance instruction is queried, and the product of the basic risk value and the inherent risk weight is used as the inherent risk value of the current operation and maintenance instruction. Record the historical number of operation and maintenance commands for each time period; use the proportion of the number of commands in the current operation and maintenance command's time period to the total number of commands as the historical probability of that time period; set a time risk value for the current operation and maintenance command based on the historical probability of its time period; Create a historical list of source IPs and subnets for maintenance instructions; if the source IP of the current maintenance instruction is not in the historical list, set an IP risk value for the current maintenance instruction; if the subnet of the source IP of the current maintenance instruction is different from the first subnet in the historical list, set a subnet risk value for the current maintenance instruction; the sum of the IP risk value and the subnet risk value is used as the source risk value of the current maintenance instruction. The sum of the inherent risk value, time risk value, and source risk value of the current operation and maintenance instruction is taken as the multidimensional risk value of the current operation and maintenance instruction. Calculate the average of the multidimensional risk values ​​of all operation and maintenance instructions, and use it as the baseline value of the operation and maintenance instructions for the target asset.

[0008] Furthermore, the aforementioned determination of the inherent risk value of the current operation and maintenance instructions includes: A mapping table between preset Markov probability value ranges and basic risk values; a table of preset inherent risk levels for operation and maintenance instructions; and a mapping table between preset inherent risk levels and inherent risk weights for operation and maintenance instructions. Based on the calculated Markov probability value, the basic risk value of the current operation and maintenance instruction is queried, the inherent risk level of the current operation and maintenance instruction is queried, and the inherent risk weight is queried based on the inherent risk level; the basic risk value is negatively correlated with the Markov probability value; the inherent risk level is positively correlated with the potential threat of the operation and maintenance instruction, and the inherent risk weight is positively correlated with the inherent risk level of the operation and maintenance instruction. The product of the basic risk value and the inherent risk weight is used as the inherent risk value of the current operation and maintenance instruction.

[0009] Preferably, the above-mentioned anomaly detection method for operation and maintenance instructions involves determining whether the total number of all operation and maintenance instructions has reached a preset threshold for each operation and maintenance instruction of the target asset. If it has, anomaly detection is performed on the current operation and maintenance instruction; otherwise, the time risk value of all operation and maintenance instructions is set to 0, the operation and maintenance instruction sequence is updated, and the baseline value of the operation and maintenance instructions of the target asset is updated.

[0010] Secondly, a device for detecting operation and maintenance instructions, implementing the aforementioned method for detecting operation and maintenance instructions, specifically includes: The data processing module is used to process the input audit log data, including preprocessing, standardization, field integrity verification, format unification and instruction normalization; word segmentation is used to obtain a parameter list; The baseline model is used to establish a behavioral baseline for each target asset based on the operation and maintenance instruction parameters. This includes determining multidimensional risk values ​​through statistics and calculations based on the inherent risk value, time risk value, and source risk value of the operation and maintenance instructions, and determining the average value of the multidimensional risk values ​​of the operation and maintenance instructions as the baseline value of the operation and maintenance instructions for the target asset. The detection process is used to load the corresponding baseline model based on the target asset, compare the multidimensional risk values ​​of the operation and maintenance instructions to be detected with the behavioral baseline of the target asset, and determine whether the operation and maintenance instructions are abnormal.

[0011] Thirdly, a bastion host system runs a computer program that implements the above-mentioned operation and maintenance instruction detection method, manages and schedules baseline models of multiple target assets, and performs anomaly detection on the operation and maintenance instructions implemented through the system.

[0012] Through the above technical solution, the present invention has at least the following beneficial effects compared with the prior art: Personalized baseline: Each server asset independently learns its normal operating habits and adapts to the differences in operating habits of different assets, avoiding false alarms caused by applying a "one-size-fits-all" approach to all operations; Multi-dimensional risk fusion: The baseline creation process simultaneously considers the sequence anomalies, timing anomalies, and source IP or subnet anomalies of the instructions, which can detect covert attacks that are difficult to detect by traditional methods (for example, an attacker using an unfamiliar IP to execute a low-risk command will trigger an IP risk alarm). Low false alarm rate: During the learning phase, a baseline is dynamically established, and alarms are only triggered for operations that significantly deviate from historical behavior, allowing maintenance personnel to safely execute temporary high-risk commands. Attached Figure Description

[0013] Figure 1 This is a schematic diagram of the overall workflow of an embodiment of the operation and maintenance instruction detection method disclosed in this invention; Figure 2This is a schematic diagram of the parsing and processing flow of an operation and maintenance instruction disclosed in this invention; Figure 3 This is a schematic diagram of the module composition of an embodiment of an operation and maintenance instruction detection device disclosed in this invention. Detailed Implementation

[0014] The present application will now be described in further detail with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are for illustrative purposes only and are not intended to limit the scope of the application. Furthermore, it should be noted that, for ease of description, only the parts relevant to the application are shown in the accompanying drawings.

[0015] It should be noted that the various embodiments of the present invention are described in a progressive manner, and the same or similar parts between the various embodiments can be referred to mutually. Each embodiment focuses on describing the differences from other embodiments. In particular, for the device or system embodiments, since they are basically similar to the method embodiments, the description is relatively simple, and the relevant parts can be referred to the description of the method embodiments.

[0016] The following issues exist in the existing server command monitoring: 1. It applies uniform detection rules to all commands, lacks differentiated processing for individual server behaviors, and cannot adapt to the differences in operating habits of different servers; 2. Relying solely on the risk of the instruction itself or simple frequency statistics, while ignoring contextual information such as instruction sequence, time, and source IP, leads to high false positive and false negative rates; 3. In a multi-process monitoring environment, each process works independently, resulting in wasted resources and an inability to share detection results. Historical data is lost when a process exits.

[0017] like Figure 1 This paper illustrates an embodiment of an anomaly detection method for an operation and maintenance command according to the present invention, which specifically includes the following steps: S11. Establish a baseline model of operation and maintenance instructions for the target asset through self-learning. This model is obtained based on self-learning of a specific amount of historical data of the target asset within a certain period.

[0018] First, the following data tables are pre-defined: a table of operation and maintenance command categories and characteristics (hereinafter referred to as Table 1 for simplicity), a table of inherent risk levels for operation and maintenance command types (hereinafter referred to as Table 2), a mapping table of inherent risk levels and inherent risk weights for pre-defined operation and maintenance commands (hereinafter referred to as Table 3), a mapping table of probability value intervals and basic risk values ​​(hereinafter referred to as Table 4), a mapping table of historical probabilities and time risk values ​​(hereinafter referred to as Table 5), and a historical list of the source IP of the operation and maintenance command and its subnet (hereinafter referred to as Table 6). The specific implementation of the data tables is well-known in this field and will not be elaborated here.

[0019] By parsing the instructions and matching the behavioral features, we can query the current operation and maintenance instruction category ID from Table 1, query its inherent risk level from Table 2 based on the category ID, and query the corresponding inherent risk weight from Table 3 based on the inherent risk level.

[0020] In chronological order, the sequence of operation and maintenance instructions is recorded using a first-order transition counting matrix and a second-order transition counting matrix. Each current operation and maintenance instruction and its two preceding historical operation and maintenance instructions are obtained. If a second-order Markov probability exists, the second-order probability value is calculated; otherwise, the first-order probability value is calculated. The basic risk value of the current operation and maintenance instruction is queried based on the first-order or second-order probability value. The inherent risk weight of the current operation and maintenance instruction is queried, and the product of the basic risk value and the inherent risk weight is taken as the inherent risk value of the current operation and maintenance instruction.

[0021] A first-order transition counting matrix can be implemented in the form of "trans[CMD_MAX][CMD_MAX]", which means storing two adjacent instructions in chronological order as the first instruction sequence. Correspondingly, a second-order transition counting matrix is ​​implemented in the form of "trans2[CMD_MAX][CMD_MAX][CMD_MAX]", which means storing three adjacent instructions as the second instruction sequence and counting the occurrences of each instruction sequence sequentially.

[0022] For each specific instruction, the two preceding historical instructions are retrieved. If these two historical instructions have appeared at least once in the second instruction sequence, the occurrence count of the current instruction combined with the two historical instructions, as well as the occurrence count of the two historical instruction sequences themselves, are retrieved. The proportion of the former to the latter yields the probability value of the current instruction. If these two historical instructions do not exist in the instruction sequence, the first instruction sequence is retrieved, and the probability value of the current instruction is calculated using the above method. Furthermore, the basic risk value of the current instruction is obtained by referring to Table 4 based on the probability value. The product of the basic risk value and the inherent risk level is used as the inherent risk value of the current instruction.

[0023] Record the historical number of operation and maintenance commands for each time period; use the proportion of the number of commands in the current operation and maintenance command's time period to the total number of commands as the historical probability of that time period; based on the historical probability of the time period, look up Table 5 to obtain the time risk value for setting the current operation and maintenance command.

[0024] If the source IP of the current operation and maintenance command is not in Table 6, then an IP risk value is set for the current operation and maintenance command; if the subnet of the source IP of the current operation and maintenance command is different from the first subnet in Table 6, then a subnet risk value is set for the current operation and maintenance command; the sum of the IP risk value and the subnet risk value is used as the source risk value of the current operation and maintenance command.

[0025] The sum of inherent risk value, time risk value, and source risk value is used as the multidimensional risk value of the current operation and maintenance instruction.

[0026] Calculate the average of the multidimensional risk values ​​of all operation and maintenance instructions, and use it as the baseline value for the current target asset.

[0027] S12. Calculate the multidimensional risk value of the instruction to be detected according to the method described in S1.

[0028] Calculate the Markov probability value of the operation and maintenance instruction to be detected, and determine the inherent risk value of the operation and maintenance instruction to be detected based on the Markov probability value. The time risk value of the operation and maintenance instruction to be detected is determined based on the historical probability of the time period in which the instruction is located. Determine the source risk value of the operation and maintenance command to be detected based on its source IP and its subnet. Based on the inherent risk value, time risk value, and source risk value, the multidimensional risk value of the operation and maintenance instruction to be detected is determined.

[0029] S13. Compare the multidimensional risk value with the baseline value of the operation and maintenance instructions of the target asset. If the multidimensional risk value of the operation and maintenance instruction to be detected exceeds the baseline value and reaches the preset alarm level, then the operation and maintenance instruction to be detected is determined to be abnormal.

[0030] For example, three levels can be set: critical alarm, general alarm, and normal alarm, and corresponding alarm indices can be set for each level. When the multidimensional risk value of the instruction to be detected is greater than (baseline value * alarm index), the alarm of the corresponding level will be executed.

[0031] As described above, the anomaly detection method for operation and maintenance commands allows each server asset to independently learn its normal operating habits, adapting to the differences in operating habits among different assets and avoiding false alarms caused by applying a "one-size-fits-all" approach to all operations. The baseline creation process simultaneously considers anomalies in command sequence, time, and source IP or subnet, enabling the detection of covert attacks that are difficult to detect using traditional methods. Low false alarm rate: The baseline is dynamically established during the learning phase, and alarms are only triggered for operations that significantly deviate from historical behavior, allowing operation and maintenance personnel to confidently execute temporary high-risk commands.

[0032] Based on the above embodiments of the operation and maintenance command detection method, Figure 2 This demonstrates a specific parsing and processing flow for operation and maintenance instructions.

[0033] S21. Determine whether there is an available baseline model for the target asset targeted by the current operation and maintenance instruction. If there is, execute the operation and maintenance instruction detection in step S23; otherwise, execute step S22 to establish a baseline model for the target asset.

[0034] It should be noted here that a model library can be set up, and each asset has a corresponding baseline model according to the asset ID. Different target assets correspond to different baseline models, which is conducive to each asset independently learning its normal operation habits, adapting to the differences in operation habits of different assets, and avoiding false alarms caused by "one-size-fits-all" for all operations.

[0035] S22. Establish a baseline model for the asset S221. Instruction parsing It can include: preprocessing, standardization, field integrity verification, unified time format, command normalization (removing parameters, classification, etc.), IP location parsing, etc.; word segmentation to obtain a parameter list; extracting real-time behavior characteristics: client IP (whether it is a new IP, whether it is in a different location), whether it is non-working hours, command category ID, command complexity index, permission level, command sequence context, etc. The capture of operation and maintenance instructions here includes, but is not limited to, real-time packet capture or data mirroring of data traffic through gateway devices and auditing devices. Extract behavior characteristics for each parameter of the instruction and determine the corresponding category through feature matching.

[0036] S222. Preset data table Table 2 definition: The inherent risk level of the instruction category is 0, 1, 2, 3. Table 3 definition: The inherent risk level corresponds to the inherent risk weights of 1.0, 1.5, 2.0, 2.5 respectively. Among them, the inherent risk level is positively correlated with the potential threat of operation and maintenance instructions. For example, high-privilege instructions correspond to high risk levels, and complex instructions correspond to high risk levels, etc.

[0037] Table 4 definition: Markov probability value interval and basic risk value: prob > 0.3 corresponds to "safe (0 points)"; 0.1 < prob ≤ 0.3 corresponds to "suspicious (30 points)"; prob ≤ 0.1 corresponds to "abnormal (60 points)".

[0038] Table 5 definition: Historical probability and time risk value of the time period where the instruction is located: prob > 0.2 corresponds to "risk 0 points"; 0.05 < prob ≤ 0.2 corresponds to "risk 20 points"; prob ≤ 0.05 corresponds to "risk 50 points".

[0039] Definition: If the IP is not in the historical list, the risk is 30 points; if the subnet is different from the historical list subnet, the risk is 100 points.

[0040] S223. Calculate the baseline value S2231. Record the operation and maintenance instruction sequence through the first-order transition count matrix and the second-order transition count matrix. For example, instruction sequences "ls → pwd" and "ifconfig → netstat → ls".

[0041] For the first instruction in the asset baseline self-learning phase, such as "ls", since there are no preceding instructions, 20 points are directly used as the basic risk value.

[0042] For the second instruction, the first-order probability is calculated. For example, if the current instruction is "pwd" and its preceding instruction is "ls", since it does not exist in the historical instruction sequence, its probability is 0, and the base risk value for the current instruction is calculated to be 60 points.

[0043] For subsequent commands, if a second-order probability exists, it is calculated; otherwise, a first-order probability is calculated. For example, if the current command is "ls" with a type ID of "CMD_INFO_COLLECT" (corresponding to risk level 0), its inherent risk level is 0, and its inherent risk weight is 1.0. The two preceding historical commands are "ifconfig→netstat". If the query shows "ifconfig→netstat" appears 15 times in the historical command sequence and "ifconfig→netstat→ls" appears 3 times, then the probability value of the current command is 3 / 15 = 0.2, the base risk value is 20 points, and the inherent risk value of the command is 20 * 1.0 = 20 points. If the query "ifconfig→netstat" has never appeared in the historical command sequence, and further query "netstat" has appeared 10 times in the history, and query "netstat→ls" has appeared 8 times, then the probability value of the current operation and maintenance command is 8 / 10=0.8, the basic risk value is 0 points, and the inherent risk value of the command is 0*1.0=0 points.

[0044] As a preferred implementation, in this step, if the inherent risk level of the instruction is less than 3 (i.e., not the highest risk), only the maintenance instruction sequence is updated, without calculating all risk values, including inherent risk values ​​and subsequent time and source risk values. Alternatively, risk values ​​can be omitted when the risk level is less than 2. This can be configured based on the asset's security requirements, because quantifying the instruction's risk value is not very meaningful for the asset when the inherent risk level of the instruction is low, and would instead consume system resources.

[0045] S2232. Record the historical number of operation and maintenance instructions for each time period; take the proportion of the number of instructions in the time period where the current operation and maintenance instruction is located as the historical probability of that time period; based on the historical probability of the time period, look up Table 5 to obtain the time risk value of the current operation and maintenance instruction.

[0046] For example, if an hour is defined as a time period, then the number of maintenance instructions for an asset per hour is counted. If the current instruction time is 14:19, then the percentage of the number of instructions in the 14-15 time period in history is used as the historical probability. For example, 15 / 75=0.2. Further querying the corresponding time risk value is 20 points.

[0047] As a preferred implementation, when the total number of instructions is less than a preset threshold, all instructions do not increase the time risk. For example, if the threshold is set to 50, then when the number of instructions is less than 50, the time risk value of all instructions is 0.

[0048] S2233. Convert the source IP string of the current command to an integer, query the historical list 6. If the IP is not in the historical list, the IP risk value is 30 points; otherwise, it is 0 points. If the subnet of the IP is different from the subnet of the first IP in the historical list, increase the subnet risk value by 100 points; otherwise, it is 0 points, because a different subnet indicates an abnormal cross-network segment access. The sum of the IP risk value and the subnet risk value is then used as the source risk value of the current operation and maintenance command.

[0049] S2234. The sum of the inherent risk value, time risk value, and source risk value of the operation and maintenance instruction obtained above shall be used as the multidimensional risk value of the instruction.

[0050] S2235. Following the steps above, obtain the multidimensional risk values ​​of all instructions for the asset within a certain period, and calculate the average value as the baseline value of the asset.

[0051] S23. Instruction Anomaly Detection For each instruction to be detected, if the total number of historical instructions is less than 50, a baseline is established according to the asset instruction self-learning process in steps S2231-S2235; otherwise, the multidimensional risk value of the instruction is calculated according to steps S2231-S2234.

[0052] The multidimensional risk value of the instruction is compared with the baseline value of the asset to determine whether it is abnormal. For example, the alarm index is preset to "critical alarm index 2.5" and "general alarm index 1.8". If the multidimensional risk value of the instruction to be detected is greater than the baseline value * 2.5, a critical alarm is output. If the multidimensional risk value of the instruction to be detected is greater than the baseline value * 1.8, a general alarm is output. Otherwise, no alarm is issued.

[0053] As described above, the method for parsing and detecting operation and maintenance commands allows each server asset to independently learn its normal operating habits, adapting to differences in operating habits among different assets and avoiding false alarms caused by applying a "one-size-fits-all" approach to all operations. The baseline creation process simultaneously considers command sequence anomalies, time anomalies, and source IP or subnet anomalies, enabling the detection of covert attacks that are difficult to detect using traditional methods. Low false alarm rate: The baseline is dynamically established during the learning phase, and alarms are only triggered for operations that significantly deviate from historical behavior, allowing operation and maintenance personnel to confidently execute temporary high-risk commands.

[0054] Furthermore, combined with Figure 2 Several specific implementations are proposed to illustrate the detection process when an operation and maintenance command appears for the first time, when the command has inherent risk anomalies, when the command's time period is abnormal, and when the command's source is abnormal.

[0055] First, assume that the target asset IP is 192.168.1.100 and the client IP is 10.0.0.1. The client executes the first command "ls" on the asset.

[0056] The category to which the instruction belongs is obtained by parsing the instruction, and the inherent risk level is further determined to be 0 based on the category.

[0057] The model pointer of the asset is queried, and the corresponding baseline model is obtained from shared memory through the model pointer. If it is not found, a model is created for the asset. The process of determining the baseline model and baseline value is as described above and will not be repeated here.

[0058] Multidimensional risks of computation instructions: Since this is the first instruction, there is no historical instruction sequence. First-order probability is used, and the probability is considered to be 0. The base risk value is 40 points. According to the inherent risk level, the inherent risk weight is found to be 1.0. Therefore, the inherent risk value of the instruction is 40 points. Assuming the current instruction is at 2 PM, since the historical probability of 2 PM is 0 (because the current instruction count is less than 50), the time risk value is 0 points. The client IP has never appeared before, so the IP risk value is increased by 30 points. Also, the historical list is empty, there are no subnets to compare, and the subnet risk value is 0 points. Therefore, the source risk value is 30 points. The total multidimensional risk score is 40 + 0 + 30 = 70 points.

[0059] Update the instruction sequence, update the baseline value to 70 points, and increment the instruction count by 1; output "Learning Phase" without issuing an alarm. Repeat the above process. After a certain number of updates, such as 20 instructions, the baseline value tends to stabilize. The average of the multidimensional risk values ​​of all instructions is then used as the baseline value of the current asset.

[0060] Based on the above embodiments, the learning phase ends and the testing phase begins.

[0061] When the same client IP executes the command "ls" on the same asset again, it is assumed that the baseline value has already been established and is 30 points.

[0062] Calculate the multidimensional risk value of the current instruction to be detected: Since this instruction has appeared multiple times, the Markov probability may increase. The base risk value is 0 points, and multiplied by the weight 1.0, the inherent risk value of the instruction is 0 points. Similarly, if the time period in which the instruction occurred appears multiple times, the time period is considered normal, and the time risk value is determined to be 0 points based on its historical probability. Since it's the same client with the same IP and subnet, the source risk score is 0. Therefore, the multidimensional risk value of the current instruction to be detected is 0 points. Since 0 is less than 30*1.8, the output is "normal".

[0063] Based on the above embodiments, if the same client executes "rm -rf" on the asset at 2 PM, the type of the instruction is "CMD_FILE_DELETE_ROOT", which is a high-privilege instruction with an inherent risk level of 3. If the base risk value determined by the probability value is 60 points, multiplied by a weight of 2.5, then the inherent risk value = 150 points; 2 PM is a commonly used time period for this client, and the time risk score is 0. The risk of originating from the same client is 0 points; Therefore, the total multidimensional risk score is 150 points. Compared with the baseline value, 150 is greater than 30*2.5, so a "critical alarm" is output.

[0064] Based on the above embodiment, if the command "ls" is executed at 2 PM, but the source client IP is 10.0.0.2 (same subnet) from the same network segment that has never appeared before.

[0065] Based on the inherent risk level and weight of the instruction, the inherent risk value is calculated to be 0 points; the historical probability of this period is relatively high, so the time risk value is 0 points; since the IP does not exist in the historical list, the IP risk value is increased by 30 points; since the subnet is the same as 10.0.0.1, the subnet risk value is not increased, so the source risk value is 30 points, and the total multidimensional risk value = 0 + 0 + 3 = 30 points.

[0066] Compared to the baseline value, the output is "normal".

[0067] Based on the above embodiment, if the client IP is 192.168.2.1 (different subnet), execute the command "ls" at 2 PM.

[0068] The inherent risk value and time risk value are the same as in the previous embodiment, both being 0 points.

[0069] If the IP address is new and the subnet is new, then the source risk score is 30 + 100 = 130 points. The multidimensional risk score for this instruction is 130 points.

[0070] Compare 130 with 20*1.8 and 130 with 20*2.5, and output "Critical Alarm".

[0071] As described above, in a specific embodiment of the anomaly detection method for operation and maintenance commands, each server asset independently learns its normal operating habits, adapts to the differences in operating habits of different assets, and avoids false alarms caused by a "one-size-fits-all" approach to all operations; the baseline creation process simultaneously considers the sequence anomalies, time anomalies, and source IP or subnet anomalies of commands, which can detect covert attacks that are difficult to detect by traditional methods; low false alarm rate: the baseline is dynamically established during the learning phase, and alarms are only triggered for operations that significantly deviate from historical behavior, so operation and maintenance personnel can safely execute temporary high-risk commands.

[0072] like Figure 3 As shown, an embodiment of an anomaly detection device for operation and maintenance commands includes: The data processing module is used to process the input audit log data, including preprocessing, standardization, field integrity verification, format unification and instruction normalization; word segmentation is used to obtain a parameter list; The baseline model is used to establish a behavioral baseline for each target asset based on the operation and maintenance instruction parameters. This includes determining multidimensional risk values ​​through statistics and calculations based on the inherent risk value, time risk value, and source risk value of the operation and maintenance instructions, and determining the average value of the multidimensional risk values ​​of the operation and maintenance instructions as the baseline value of the operation and maintenance instructions for the target asset. The detection process is used to load the corresponding baseline model based on the target asset, compare the multidimensional risk values ​​of the operation and maintenance instructions to be detected with the behavioral baseline of the target asset, and determine whether the operation and maintenance instructions are abnormal.

[0073] As a preferred embodiment, the above-described detection device: Obtain the operation and maintenance instructions to be detected for the target asset, load the baseline model of the target asset, and if it does not exist, create a new model for the target asset and enter the baseline self-learning process. The detection process involves: determining the inherent risk value based on the Markov probability value of the operation and maintenance instruction to be detected; determining the time risk value based on the historical probability of the time period in which the operation and maintenance instruction to be detected is located; determining the source risk value based on the source IP and its subnet of the operation and maintenance instruction to be detected; determining the multidimensional risk value of the operation and maintenance instruction to be detected based on the inherent risk value, time risk value, and source risk value; comparing the multidimensional risk value with the baseline value of the operation and maintenance instruction of the target asset; if the multidimensional risk value of the operation and maintenance instruction to be detected exceeds the baseline value and reaches the preset alarm level, then the operation and maintenance instruction to be detected is determined to be abnormal.

[0074] As described above, the embodiment of the operation and maintenance command anomaly detection device independently learns the normal operating habits of each server asset, adapts to the differences in operating habits of different assets, and avoids false alarms caused by a "one-size-fits-all" approach to all operations. The baseline creation process considers the sequence anomalies, time anomalies, and source IP or subnet anomalies of the commands, which can detect covert attacks that are difficult to detect by traditional methods. Low false alarm rate: the baseline is dynamically established during the learning phase, and alarms are only triggered for operations that significantly deviate from historical behavior, so operation and maintenance personnel can safely execute temporary high-risk commands.

[0075] The present invention also provides an embodiment of a bastion host system, which, during system operation, enables the establishment of baselines for each asset, as well as the parsing of operation and maintenance instructions and anomaly detection as described in the above embodiments.

[0076] As a preferred implementation, the bastion host system also includes the following: In shared memory operations, baseline models of multiple assets are maintained through shared memory. When detecting each instruction, an independent detection process is established for each asset. Each detection process reads the baseline model from the shared memory. When a process exits, it is automatically separated from the shared memory, but the data is still retained, and other processes can continue to use it.

[0077] The shared memory is automatically separated, but the data is retained; process B can still continue to use it.

[0078] When an asset is deleted, the operations team calls a function to lock shared memory, iterates through the asset slots, finds a matching item, clears the model data, marks the slot as unused, and reduces the total count. Afterward, other servers can reuse the slot.

[0079] If a legitimate IP is mistakenly added to the blacklist, the operations and maintenance department calls a function to lock shared memory, searches for the IP in the IP history array of the specified asset, deletes it, and moves subsequent elements. The next time the IP appears, it will be treated as a new IP and the risk will be recalculated.

[0080] Algorithm parameter configuration, such as the threshold for the number of instructions during the learning phase, can be adjusted according to the server command frequency and can be modified through configuration; The alarm multiplier WARNING_MULTIPLIER=1.8 and CRITICAL_MULTIPLIER=2.5 can be adjusted to meet different security level requirements; the IP subnet mask is fixed at 24 bits ( / 24) or can be changed to be configurable.

[0081] As described above, the bastion host system achieves multi-process model reuse through shared memory. The exit of child processes does not affect model data, saving memory and avoiding repetitive learning. It provides deletion interfaces at the asset and IP granularity, making it easy for operations and maintenance personnel to correct misjudgments or clean up offline assets.

[0082] Those skilled in the art will understand that all or part of the steps in the methods of the above embodiments can be implemented by a program instructing related hardware. The program can be stored in a computer-readable storage medium, such as ROM / RAM, magnetic disk, optical disk, etc.

[0083] The description of the disclosed embodiments above enables those skilled in the art to make or use the invention. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the invention. Therefore, the invention is not to be limited to the embodiments shown herein, but is to be accorded the widest scope consistent with the principles disclosed herein.

Claims

1. A method for detecting operation and maintenance instructions, characterized in that, include: Calculate the Markov probability value of the operation and maintenance instruction to be detected, and determine the inherent risk value of the operation and maintenance instruction to be detected based on the Markov probability value. The time risk value of the operation and maintenance instruction to be detected is determined based on the historical probability of the time period in which the instruction is located. Determine the source risk value of the operation and maintenance command to be detected based on its source IP and its subnet. Based on the inherent risk value, time risk value, and source risk value, determine the multidimensional risk value of the operation and maintenance instruction to be detected; The multidimensional risk value is compared with the baseline value of the operation and maintenance instructions of the target asset. If the multidimensional risk value of the operation and maintenance instruction to be detected exceeds the baseline value and reaches the preset alarm level, the operation and maintenance instruction to be detected is determined to be abnormal. The baseline values ​​for the operation and maintenance instructions of the target assets include: Operation and maintenance commands that retrieve a preset number of target assets in chronological order; The sequence of operation and maintenance instructions is recorded using a first-order and a second-order transition counting matrix; each current operation and maintenance instruction and its two preceding historical operation and maintenance instructions are obtained; if a second-order Markov probability exists, the second-order probability value is calculated, otherwise the first-order probability value is calculated; a basic risk value is set for the current operation and maintenance instruction based on the first-order or second-order probability value; the inherent risk weight of the current operation and maintenance instruction is queried, and the product of the basic risk value and the inherent risk weight is used as the inherent risk value of the current operation and maintenance instruction. Record the historical number of operation and maintenance commands for each time period; use the proportion of the number of commands in the current operation and maintenance command's time period to the total number of commands as the historical probability of that time period; set a time risk value for the current operation and maintenance command based on the historical probability of its time period; Create a historical list of source IPs and subnets for maintenance instructions; if the source IP of the current maintenance instruction is not in the historical list, set an IP risk value for the current maintenance instruction; if the subnet of the source IP of the current maintenance instruction is different from the first subnet in the historical list, set a subnet risk value for the current maintenance instruction; the sum of the IP risk value and the subnet risk value is used as the source risk value of the current maintenance instruction. The sum of the inherent risk value, time risk value, and source risk value of the current operation and maintenance instruction is taken as the multidimensional risk value of the current operation and maintenance instruction. Calculate the average of the multidimensional risk values ​​of all operation and maintenance instructions, and use it as the baseline value of the operation and maintenance instructions for the target asset.

2. The method for detecting operation and maintenance instructions according to claim 1, characterized in that, Determine the inherent risk value of the current operation and maintenance instructions, including: A mapping table between preset Markov probability value ranges and basic risk values; a table of preset inherent risk levels for operation and maintenance instructions; and a mapping table between preset inherent risk levels and inherent risk weights for operation and maintenance instructions. Based on the calculated Markov probability value, the basic risk value of the current operation and maintenance instruction is queried, the inherent risk level of the current operation and maintenance instruction is queried, and the inherent risk weight is queried based on the inherent risk level; the basic risk value is negatively correlated with the Markov probability value; the inherent risk level is positively correlated with the potential threat of the operation and maintenance instruction, and the inherent risk weight is positively correlated with the inherent risk level of the operation and maintenance instruction. The product of the basic risk value and the inherent risk weight is used as the inherent risk value of the current operation and maintenance instruction.

3. The method for detecting operation and maintenance instructions according to claim 1, characterized in that, Set time risk values ​​for the current operation and maintenance instructions based on the historical probability of the current time period, including: A mapping table between historical probability intervals and time risk values ​​for a preset time period is used to query the time risk value of the current maintenance instruction based on the historical probability of the time period in which the current maintenance instruction is located; the time risk value is negatively correlated with the historical probability.

4. The method for detecting operation and maintenance instructions according to claim 1, characterized in that, Based on the source IP and its subnet, determine the source risk value of the current operation and maintenance instruction, including: determining whether the source IP of the current operation and maintenance instruction is in the historical list; if it is not in the historical list, set the IP risk value for the current operation and maintenance instruction; otherwise, add the source IP to the historical list.

5. The method for detecting operation and maintenance instructions according to any one of claims 1 to 4, characterized in that, For each maintenance instruction of the target asset, determine whether the total number of all maintenance instructions has reached a preset threshold. If it has, perform anomaly detection on the current maintenance instruction; otherwise, set the time risk value of all maintenance instructions to 0, update the maintenance instruction sequence, and update the maintenance instruction baseline value of the target asset.

6. A device for detecting operation and maintenance instructions, implementing the method for detecting operation and maintenance instructions as described in any one of claims 1-5, characterized in that, The device includes: The data processing module is used to process the input audit log data, including preprocessing, standardization, field integrity verification, format unification and instruction normalization; word segmentation is used to obtain a parameter list; The baseline model is used to establish a behavioral baseline for each target asset based on the operation and maintenance instruction parameters. This includes determining multidimensional risk values ​​through statistics and calculations based on the inherent risk value, time risk value, and source risk value of the operation and maintenance instructions, and determining the average value of the multidimensional risk values ​​of the operation and maintenance instructions as the baseline value of the operation and maintenance instructions for the target asset. The detection process is used to load the corresponding baseline model based on the target asset, compare the multidimensional risk values ​​of the operation and maintenance instructions to be detected with the behavioral baseline of the target asset, and determine whether the operation and maintenance instructions are abnormal.

7. The detection device for operation and maintenance instructions according to claim 6, characterized in that, The device implements the process of detecting operation and maintenance commands, including: Obtain the operation and maintenance instructions to be detected for the target asset, load the baseline model of the target asset, and if it does not exist, create a new model for the target asset and enter the baseline self-learning process. The detection process involves: determining the inherent risk value based on the Markov probability value of the operation and maintenance instruction to be detected; determining the time risk value based on the historical probability of the time period in which the operation and maintenance instruction to be detected is located; determining the source risk value based on the source IP and its subnet of the operation and maintenance instruction to be detected; determining the multidimensional risk value of the operation and maintenance instruction to be detected based on the inherent risk value, time risk value, and source risk value; comparing the multidimensional risk value with the baseline value of the operation and maintenance instruction of the target asset; if the multidimensional risk value of the operation and maintenance instruction to be detected exceeds the baseline value and reaches the preset alarm level, then the operation and maintenance instruction to be detected is determined to be abnormal.

8. The detection device for operation and maintenance instructions according to claim 7, characterized in that, The baseline self-learning includes: Obtain a preset number of operation and maintenance commands for the target asset in chronological order; record the operation and maintenance command sequence using a first-order and second-order transition counting matrix; set a basic risk value for the current operation and maintenance command based on the first-order or second-order probability value; query the inherent risk weight of the current operation and maintenance command, and use the product of the basic risk value and the inherent risk weight as the inherent risk value of the current operation and maintenance command. Record the number of maintenance commands for each time period; use the percentage of the number of commands in the current maintenance command's time period as the historical probability of that time period; set a time risk value for the current maintenance command based on the historical probability of that time period; Create a historical list of source IPs and subnets for maintenance instructions; if the source IP of the current maintenance instruction is not in the historical list, set an IP risk value for the current maintenance instruction; if the subnet of the source IP of the current maintenance instruction is different from the subnet of the first source IP in the historical list, set a subnet risk value for the current maintenance instruction; the sum of the IP risk value and the subnet risk value is used as the source risk value of the current maintenance instruction. The sum of the inherent risk value, time risk value, and source risk value of the current operation and maintenance instruction is used as the multidimensional risk value of the current operation and maintenance instruction; the average of the multidimensional risk values ​​of all operation and maintenance instructions is calculated as the baseline value of the operation and maintenance instructions for the target asset.

9. The detection device for operation and maintenance instructions according to claim 8, characterized in that, For each maintenance instruction of the target asset, determine whether the total number of all maintenance instructions has reached a preset threshold. If it has, check the current maintenance instruction; otherwise, set the time risk value of all maintenance instructions to 0, update the maintenance instruction sequence, and update the baseline value of the maintenance instructions of the target asset.

10. A bastion host system, characterized in that, When the system is running, the method for detecting operation and maintenance instructions as described in any one of claims 1-5 is implemented.

Images