An independent server remote monitoring and security management integrated control system

Abstract

The application discloses an independent server remote monitoring and security management integrated control system, which comprises a security agent module and a remote management platform. The security agent module is arranged on the independent server and comprises a hardware trust root unit, a multi-source data acquisition unit and a policy execution unit. The hardware trust root unit verifies the integrity of the firmware and the operating system kernel based on the benchmark measurement value during the server starting process. The multi-source data acquisition unit acquires hardware sensor data, system call sequences and network traffic statistical features at a first time interval and sends the data to the remote management platform through an encrypted tunnel. The remote management platform comprises a risk assessment engine and a policy decision engine. The risk assessment engine calculates a comprehensive risk score comprising hardware health, behavior deviation and network threat degree according to the received data. The application realizes active and closed-loop security management of the independent server and effectively prevents firmware attacks and internal threats without relying on external security devices.

Description

Technical Field

[0001] This invention belongs to the field of information security technology, specifically relating to an integrated control system for remote monitoring and security management of independent servers. Background Technology

[0002] Independent servers are often hosted in remote data centers or deployed on edge nodes, and their physical and network environments are difficult to be covered by centralized security facilities.

[0003] Traditional remote monitoring primarily relies on performance metrics reported by agents running within the operating system, focusing on operational status such as processor utilization and memory usage, lacking awareness of underlying firmware integrity, runtime behavior mutations, and abnormal network traffic. Security protection largely depends on independent firewalls or intrusion detection devices, resulting in a disconnect between monitoring and protection and lagging security posture assessments. Some existing solutions achieve out-of-band monitoring using baseboard management controllers, but these solutions lack depth in analyzing operating system-level anomalies and struggle to dynamically adjust fine-grained access control rules. While firmware and kernel integrity are verified during the boot phase, the system enters an undefended operational state after boot, lacking follow-up on persistent threats. These shortcomings make it difficult for standalone servers to achieve full-lifecycle, automated protection against firmware implantation, zero-day exploits, and internal lateral movement without relying on external security devices. Summary of the Invention

[0004] The purpose of this invention is to provide an integrated control system for remote monitoring and security management of independent servers, so as to solve the technical problem that existing servers are difficult to achieve full-cycle, automated protection without relying on external security devices when facing firmware implantation, zero-day vulnerability exploitation and internal lateral movement.

[0005] To achieve the above objectives, the present invention provides the following technical solution:

[0006] An integrated control system for remote monitoring and security management of stand-alone servers, comprising:

[0007] The security agent module is deployed on a standalone server and includes a hardware trust root unit, a multi-source data acquisition unit, and a policy enforcement unit.

[0008] The remote management platform connects to the security agent module via an encrypted communication channel and includes a risk assessment engine and a strategy decision engine.

[0009] The hardware trust root unit is configured to sequentially measure the loaded code of the firmware and operating system kernel during the server startup phase, compare the measurement results with the baseline measurement values ​​pre-stored in the immutable storage area, and if the comparison is inconsistent, send an alarm to the remote management platform through an out-of-band channel independent of the main processor and prevent startup.

[0010] The multi-source data acquisition unit is configured to acquire server hardware sensor data in the first acquisition cycle, acquire operating system-level behavioral data in the second acquisition cycle, acquire network traffic statistical feature data in the third acquisition cycle, and send the acquired data to the remote management platform via an encrypted communication channel.

[0011] The risk assessment engine is configured to calculate a hardware health index based on hardware sensor data, a behavior deviation index based on operating system-level behavioral data, and a network threat index based on network traffic statistical data, and then weight and fuse the three indices to obtain a comprehensive risk score.

[0012] The strategy decision engine is configured to generate an early warning notification when the comprehensive risk score is greater than or equal to the first threshold and less than the second threshold, and to generate an active intervention strategy when the comprehensive risk score is greater than or equal to the second threshold, and send the active intervention strategy to the strategy execution unit.

[0013] The policy enforcement unit is configured to parse and execute received proactive intervention policies. Proactive intervention policies include at least: adjusting the access control list of an independent server, performing downgraded start-up and shutdown of a specified service, and modifying network firewall rules to implement port-level or host-level isolation.

[0014] This solution integrates monitoring and security control by deploying the security agent module on a dedicated server and collaborating with a remote management platform. The hardware trust root unit measures the firmware and operating system kernel before the main processor at each startup. If the measurements are inconsistent, an alarm is triggered via an independent physical path, preventing the operating system's in-band reporting from being bypassed after firmware tampering, thus ensuring the trustworthiness of the server's operating environment from the source. A multi-source data acquisition unit collects hardware physical status, operating system behavior sequences, and network traffic statistics at differentiated intervals, enabling risk assessment to simultaneously cover anomalies at the physical, system, and network layers. The risk assessment engine quantifies these three types of data into a hardware health index, a behavior deviation index, and a network threat index, respectively, before merging them into a comprehensive risk score, avoiding missed or false positives from single indicators in complex attack scenarios. The policy decision engine distinguishes between early warning and proactive intervention based on the threshold range of the comprehensive risk score. The policy execution unit directly performs access control adjustments, service degradation, and port-level or host-level network isolation within the managed server, realizing a closed-loop response from detection to blocking. The entire process does not rely on independent external firewalls or intrusion detection devices, making it particularly suitable for physically distributed independent servers.

[0015] As a further aspect of the present invention, the hardware trust root unit is embedded in the security microcontroller of the server motherboard. The benchmark metric is calculated by a security hash algorithm on the firmware image and the operating system kernel image when the server is first trusted and deployed. The tamper-proof storage area is a one-time programmable memory or a flash memory partition locked by hardware write protection.

[0016] By placing the hardware trust root unit within a secure microcontroller independent of the main processor, the measurement logic is physically isolated from the general computing environment. Even if the main processor is completely controlled, it cannot interfere with the measurement process. The benchmark metric value is generated using a secure hash algorithm and stored in one-time programmable memory or a hardware write-protected flash partition. Once written, it is physically unalterable or can only be modified through a hardware unlock signal. This eliminates the possibility of attackers or malware tampering with the benchmark value to bypass boot verification, giving the integrity verification of the boot chain a hardware-level trust foundation.

[0017] As a preferred embodiment of the present invention, the value range of the first acquisition period is 1 second to 30 seconds, the value range of the second acquisition period is 5 seconds to 120 seconds, and the value range of the third acquisition period is 10 seconds to 300 seconds; the operating system-level behavioral data acquired by the multi-source data acquisition unit includes process creation sequence, privilege elevation event and kernel module loading event, and the acquired network traffic statistical feature data includes the number of new connections per second, asymmetric traffic ratio and target port entropy value.

[0018] Hardware sensor data is collected over a shorter period to promptly capture rapidly changing physical anomalies such as sudden temperature rises and memory errors. Operating system-level behavioral data is collected over a medium period to balance the contextual relationships of events such as process creation sequences and privilege escalation, while avoiding excessive data collection that could overload the system. Network traffic statistics are aggregated over a longer period to smooth out instantaneous fluctuations and highlight surges in new connections, asymmetric traffic changes, and increases in target port entropy caused by attacks. The selected process creation sequences, privilege escalation, and kernel module loading events directly correspond to common attack chain behaviors such as privilege escalation, persistence, and code injection. The number of new connections per second, the asymmetric traffic ratio, and the target port entropy effectively reflect denial-of-service attacks, data outflow, and lateral movement, making the collected data highly representative of attack behaviors and providing high signal-to-noise ratio input for subsequent risk assessment.

[0019] As a preferred embodiment of the present invention, the risk assessment engine calculates the hardware health index by normalizing the acquired CPU temperature, memory error count, storage medium remapping sector number, and power supply voltage deviation, and then weighting and summing them with a first weight vector to obtain the hardware health index; the behavior deviation index is calculated by using a baseline model based on historical normal behavior to calculate anomaly scores on the current operating system-level behavior data, and mapping the anomaly scores to the behavior deviation index; the network threat index is calculated by inputting network traffic statistical feature data into a pre-trained lightweight anomaly detection classifier and outputting the network threat index.

[0020] The hardware health index reflects the trend of slow hardware degradation or sudden failures by simultaneously normalizing and weighting processor temperature, memory errors, storage media deterioration, and power fluctuations, rather than relying solely on a single threshold alarm. The behavior deviation index uses a baseline model to calculate anomaly scores, independent of attack signature databases. It can detect even slight deviations from normal behavior patterns, uncovering unknown or variant malicious behaviors. The network threat index directly processes statistical features through a lightweight anomaly detection classifier, with extremely short inference time, allowing for real-time online operation and ensuring network attack detection is not delayed beyond the moment traffic occurs. All three indices are mapped to comparable dimensionless metrics, providing a unified dimensional basis for subsequent fusion.

[0021] As a further aspect of the present invention, the baseline model is constructed based on the operating system-level behavioral data in the early stage of server deployment using a single-class support vector machine or an isolated forest algorithm. When the comprehensive risk score is lower than the first threshold, the baseline model is incrementally updated using the behavioral data of the current period. The values ​​of each element in the first weight vector are dynamically adjusted according to the nominal reliability value of the hardware sensor, with higher reliability sensors corresponding to greater weights.

[0022] The baseline model, utilizing a single-class support vector machine or isolated forest algorithm, can be trained using only normal behavior data from the initial deployment phase, eliminating the need for pre-collected attack samples and lowering the modeling threshold. When the comprehensive risk score falls below a first threshold, indicating the system is currently in a normal state, the current behavior data is automatically incorporated into the incremental update of the baseline model. This allows the model to adaptively evolve with changes in business load and software version upgrades, continuously maintaining an accurate description of normal behavior and reducing false alarms caused by natural business changes. The weights in the hardware health index are dynamically adjusted based on the reliability of each sensor; sensors with higher reliability contribute more to the health index, preventing abnormal jumps in the overall health index due to occasional disturbances from unreliable sensors.

[0023] As a preferred embodiment of the present invention, the remote management platform also includes a visualization and interaction module, which is used to display the real-time health status, risk score trend and security policy execution record of the managed independent server in the form of a topology diagram, and to receive mandatory security policies manually issued by the administrator; the priority of the mandatory security policy is higher than the active intervention policy automatically generated by the policy decision engine.

[0024] This solution presents health status and risk score trends in the form of a topology diagram, helping administrators quickly grasp the security posture and risk evolution direction of all managed servers without having to check logs for each server individually. The display of security policy execution records provides visibility into the actions taken. Mandatory security policies have higher priority than automated policies, ensuring that manual instructions are not overridden by automated logic when administrators discover misjudgments or need to perform special actions, thus balancing the timeliness of automated responses with the ultimate control of human decision-making.

[0025] As a preferred embodiment of the present invention, the encrypted communication channel is established using a certificate-based bidirectional transport layer security protocol. The security agent module and the remote management platform each hold a unique device certificate issued by a private certificate authority, and bidirectional identity authentication is completed during the communication establishment phase. The heartbeat message interval between the security agent module and the remote management platform is 5 to 60 seconds. If the number of consecutively lost heartbeat messages exceeds the preset loss threshold, the policy execution unit automatically executes the predefined offline protection policy.

[0026] This solution uses a unique device certificate issued by a private certificate authority for two-way authentication, preventing unauthorized management platforms or fake agents from accessing the system and ensuring the confidentiality and integrity of monitoring data and control commands during transmission. A heartbeat mechanism continuously monitors the communication link status, immediately activating an offline protection policy when a preset number of consecutive heartbeats are lost. This allows the server to automatically tighten security measures in abnormal situations where it loses connection with the management platform, preventing attackers from exploiting the communication interruption window for lateral movement or data theft, achieving a protective effect of "protection upon loss of connection."

[0027] As a preferred embodiment of the present invention, the security agent module further includes a security information caching unit. When the encrypted communication channel is interrupted, the multi-source data acquisition unit continues to acquire data and temporarily stores it in the security information caching unit. After the channel is restored, the data is retransmitted to the remote management platform in chronological order. The security information caching unit adopts a cyclic overwrite writing mode, and its storage capacity is at least able to accommodate the full amount of acquired data generated within the maximum allowable interruption duration.

[0028] The security information caching unit continuously stores collected data during network outages, preventing monitoring blind spots caused by temporary communication interruptions. Once the channel is restored, data is retransmitted in chronological order, ensuring the remote management platform receives a continuous monitoring sequence and does not lose any abnormal clues that occurred during offline periods. The cyclic overwrite write mode automatically overwrites the oldest data when storage capacity is limited, ensuring that even in long-term offline scenarios, complete data from the most recent period is preserved, providing a basis for tracing attacks during offline periods.

[0029] As a preferred embodiment of the present invention, when adjusting the access control list of the independent server, the policy execution unit dynamically reduces or freezes the permissions of the currently active session according to the principle of least privilege, and records the policy source, trigger risk score, execution time and operation result in the log auditing subsystem; the records of the log auditing subsystem are stored in a secure storage area that only allows append writing.

[0030] This solution dynamically reduces or freezes active session permissions based on the principle of least privilege. It can immediately shrink the attacker's access capabilities the moment an anomaly is confirmed, preventing them from using existing legitimate sessions to continue lateral movement or steal data. The log auditing subsystem records the policy source, trigger risk score, and execution details, allowing only append-only writes. This ensures that all automated actions have an immutable audit trail, facilitating post-attack path analysis and meeting compliance requirements for the integrity of security operation records.

[0031] As a further preferred embodiment of the present invention, the remote management platform is deployed in a clustered manner. Multiple remote management platform instances synchronize the status and security policies of the managed servers through a distributed consistency protocol. When any instance fails, other instances take over the monitoring and policy distribution of the managed independent servers, thereby achieving high availability of the management platform.

[0032] Multiple management platform instances synchronize their states and policies through a distributed consistency protocol, preventing the management platform itself from becoming a single point of failure. When one instance fails, other instances automatically take over monitoring and policy distribution. The security proxy module does not require manual switching of the management terminal, ensuring that continuous monitoring and protection of independent servers are not interrupted due to partial failures of the management platform, thus meeting the high availability requirements of the management plane in large-scale and critical business scenarios.

[0033] As a further preferred embodiment of the present invention, the default value range of the first threshold is 0.3 to 0.5, and the default value range of the second threshold is 0.6 to 0.8. When the risk assessment engine weights and fuses the hardware health index, behavior deviation index and network threat index, it adopts dynamic weights. The dynamic weights are determined by the current server's business type and security status. For database servers, the weight of the behavior deviation index is increased, and for edge computing servers, the weight of the network threat index is increased.

[0034] The first and second thresholds are designed as configurable ranges, allowing the alert sensitivity and intervention trigger points to adapt to the different business systems' needs for balancing availability and security. The fusion weights are dynamically allocated based on the server's business type; database servers focus more on abnormal deviations in data access behavior, while edge computing servers focus more on network-side threats. This aligns risk assessment results with business risk models, reducing false positives and false negatives caused by generic, fixed weights and improving the targeted nature of protection.

[0035] As a further preferred embodiment of the present invention, the strategy decision engine is further configured to: before generating an active intervention strategy, match the intervention measures to be executed with the preset security strategy conflict detection rules; if a conflict exists, select a non-conflicting alternative measure according to the preset priority order or request manual adjudication from the administrator.

[0036] This solution introduces conflict detection before proactive intervention policies are implemented, preventing multiple security policies from conflicting with each other or blocking necessary management channels when issued simultaneously. For example, simultaneously implementing network isolation and remote management service degradation might prevent administrators from accessing the system. When a conflict is detected, a non-conflicting alternative is selected according to preset priorities, or a decision is requested from the administrator. This ensures that automated responses do not cause unexpected service interruptions or loss of management control due to policy conflicts, making closed-loop security handling both rapid and controllable.

[0037] Compared with the prior art, the present invention has the following beneficial effects:

[0038] The hardware trust root unit operates independently of the main processor and performs measurements before firmware execution. The measurement results are sent via an independent physical path, preventing firmware-level attacks from concealing or blocking alarms, thus ensuring the server startup environment remains in a trusted state. The multi-source data acquisition unit sets differentiated acquisition cycles for hardware, system behavior, and network traffic. This ensures timely capture of changes in physical quantities such as temperature and voltage while also considering the contextual correlation of behavioral sequences and the smoothing of network statistical characteristics, avoiding an imbalance between false negatives and false negatives.

[0039] The risk assessment engine quantifies hardware degradation trends, behavioral pattern shifts, and cyberattack indications into comparable indices and dynamically weights and fuses them. This ensures that anomalies in a single dimension do not directly trigger overreactions, while the superposition of multiple dimensions can be accurately identified. Consequently, it provides reliable risk characterization even in complex scenarios such as slow hardware failure, covert malicious processes, and low-speed network scanning. The behavioral baseline model is trained solely on normal data and can be incrementally updated online, allowing the system to detect unknown anomalies without prior acquisition of attack samples. It also adapts to natural business evolution, reducing false alarms. Hardware sensor weights are dynamically adjusted based on reliability, further suppressing interference from unreliable sensors.

[0040] The policy decision engine differentiates between early warnings and interventions based on tiered thresholds and introduces conflict detection before issuance. This avoids the secondary risk of management channel blockage that may occur when network isolation and service degradation are executed simultaneously, ensuring that automated handling is both fast and controllable. The policy execution unit directly adjusts access control lists, degrades services, or implements port-level isolation on the managed server, without relying on external network devices. This results in a short response path and adheres to the principle of least privilege to freeze abnormal sessions, effectively preventing attackers from using obtained legitimate credentials for lateral expansion.

[0041] The encrypted communication channel employs two-way device certificate authentication and incorporates heartbeat detection and offline protection strategies. This ensures that the server automatically tightens its exposed surface when the communication link is interrupted or hijacked, preventing attackers from exploiting the isolation window to launch intrusions. A secure information caching unit temporarily stores data during offline periods using a cyclical overwrite method, ensuring monitoring continuity after prolonged network outages and providing complete evidence for post-incident traceability.

[0042] The clustered deployment of the management platform, combined with a distributed consistency protocol, eliminates single points of failure. The security agent module can dynamically switch management endpoint addresses, ensuring the entire monitoring and control system continues to operate even if any management node fails, meeting the high availability requirements of large-scale, distributed deployments of independent servers. All these design features collectively achieve an independent server protection solution that does not rely on external security devices, covers the entire process from startup to operation, and possesses continuous awareness and automatic closed-loop handling capabilities. Attached Figure Description

[0043] To more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings used in the embodiments will be briefly introduced below. Obviously, the drawings described below are only examples of embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0044] Figure 1 This is a schematic diagram of the architecture of an embodiment of the present invention. Detailed Implementation

[0045] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the embodiments of the present invention will be further described in detail below with reference to the accompanying drawings and examples. It should be understood that the specific embodiments described herein are only for explaining the present invention and are not intended to limit the present invention.

[0046] See Figure 1This invention discloses an integrated architecture for a remote monitoring and security management control system for independent servers. The system comprises a security agent module deployed on each managed independent server and a remote management platform centrally deployed on the management side. The security agent module and the remote management platform are connected via an encrypted communication channel established using a bidirectional transport layer security protocol based on X.509 certificates. Both the security agent module and the remote management platform hold unique device certificates issued by private certificate authorities, and bidirectional authentication is performed before communication to effectively prevent man-in-the-middle attacks. The heartbeat interval between the two parties can be configured from 5 to 60 seconds; in this embodiment, it is set to 15 seconds. An offline protection policy is triggered when five consecutive heartbeats are lost. The offline protection policy includes: the policy execution unit immediately activates preset strict firewall rules, allowing only encrypted connections from at least one pre-configured management address, closing all external service ports except for the core monitoring agent, and freezing network access permissions for all non-critical system processes until the heartbeat recovers and a policy recovery command is received from the remote management platform.

[0047] The security agent module includes a hardware trust root unit, a multi-source data acquisition unit, a policy enforcement unit, a security information caching unit, and a log auditing subsystem. The hardware trust root unit is embedded in the security microcontroller on the server motherboard, electrically isolated from the main processor, and has independent flash memory and one-time programmable memory. When the server is shipped or initially deployed with trust, the SHA-256 algorithm is used to calculate hash values ​​for the firmware image and operating system kernel image, which are then burned into the one-time programmable memory as a baseline metric. This memory is locked by a hardware fuse after being written, making it tamper-proof. Each time the server powers on, the hardware trust root unit starts before the motherboard firmware is executed. It uses the hardware hash engine in the security microcontroller to recalculate the hash values ​​of the current firmware and operating system kernel, comparing them step-by-step with the baseline metric. If any step fails, an alarm message is sent to the remote management platform through an out-of-band channel of the serial peripheral interface independent of the main processor, and the motherboard reset pin is pulled low to prevent the server from continuing to boot.

[0048] The multi-source data acquisition unit is responsible for periodically collecting three types of data. Hardware sensor data is acquired through the intelligent platform management interface or the motherboard sensor hub, including CPU temperature, correctable and uncorrectable error counts of each memory module, remapped sector counts in the storage medium self-monitoring analysis report, and voltage deviation values ​​on the power management bus. The acquisition period T1 ranges from 1 to 30 seconds; in this embodiment, it is 10 seconds. Operating system-level behavioral data is collected through the kernel audit framework or eBPF probe, including process creation sequences and their parent-child relationships, privilege escalation events, kernel module loading events, and sensitive file access records. The acquisition period T2 ranges from 5 to 120 seconds; in this embodiment, it is 30 seconds. Network traffic statistical characteristic data is obtained by acquiring raw flow records through bypass packet capture or traffic statistics interface, and the number of new connections per second, the asymmetric ratio of inbound and outbound traffic, and the target IP port distribution entropy value are aggregated and calculated locally. The acquisition period T3 ranges from 10 to 300 seconds; in this embodiment, it is 60 seconds. The collected data is compressed and sent to the remote management platform through an encrypted communication channel.

[0049] When the encrypted communication channel is interrupted, the multi-source data acquisition unit continues to acquire data at the original cycle and temporarily stores it in the security information cache unit. The cache unit adopts a cyclic overwrite write mode, and the storage capacity is designed to accommodate at least the full amount of acquired data generated within the maximum allowable interruption duration. The maximum allowable interruption duration is set to 7200 seconds by default to ensure that data is not lost during temporary offline periods, and the data is retransmitted in chronological order after the channel is restored.

[0050] The remote management platform includes a data receiving and preprocessing module, a risk assessment engine, a strategy decision-making engine, a visualization and interaction module, and a platform cluster management module. The data receiving and preprocessing module decodes, denoises, and performs time-series alignment on the data uploaded by the security agent module. The risk assessment engine calculates a comprehensive risk score based on the preprocessed data.

[0051] First, the various indicators of the hardware sensor data are normalized. A safe upper limit for the central processing unit temperature, Tmax (e.g., 95℃), and a rated value, Tnom (e.g., 45℃), are set. The normalized temperature exponent is min(1,max(0,(Tcurrent-Tnom) / (Tmax-Tnom))). Memory error counts are normalized using an exponential mapping method. Let the single-cycle error count be E, and the normalized memory error exponent be 1-exp(-λE), where λ is a coefficient between 0.1 and 1.0. The number of remapped memory sectors is normalized using the ratio to the manufacturer's warning threshold. Voltage deviation is normalized as the ratio of the absolute value of the actual deviation to the allowable deviation range. These normalized exponents are combined into a vector, and multiplied by the first weight vector [wt,we,ws,wv] to obtain the hardware health index H_health, with a value between 0 and 1. The closer to 1, the worse the hardware condition. The first weight vector is dynamically adjusted based on the sensor's nominal reliability value. The higher the reliability, the greater the weight. For example, if the reliability of a temperature sensor is better than that of a power supply voltage sensor, then wt can be set to 0.4 and wv to 0.15.

[0052] Secondly, the behavior deviation index is calculated. During the initial silent learning phase of server deployment (e.g., lasting 24 to 168 hours), a baseline model of normal behavior is built by training operating system-level behavioral data (features such as process creation frequency, privilege escalation frequency, and kernel module loading sequence entropy) using a single-class support vector machine or isolated forest algorithm. During the runtime phase, the behavioral feature vector of the current period is input into the model to calculate anomaly scores such as Mahalanobis distance or the average path length of the isolated forest, and these scores are mapped to a behavior deviation index B_deviation in the range of 0 to 1. When the comprehensive risk score falls below a first threshold (e.g., 0.35), the baseline model is incrementally updated using the behavioral data of the current period to adapt to the slow evolution of business operations.

[0053] Next, the network threat index is calculated. A lightweight, labeled anomaly detection classifier (such as a gradient boosting decision tree model) is pre-trained on the network features. The model input consists of feature vectors such as the number of new connections per second, the asymmetric traffic ratio, and the target port entropy. The output is the network threat index N_threat. This classifier, after model compression, can be directly deployed in the risk assessment engine, with a single inference time of less than 10 milliseconds.

[0054] Finally, the risk assessment engine dynamically weights H_health, B_deviation, and N_threat to obtain a comprehensive risk score R_total = α·H_health + β·B_deviation + γ·N_threat, where α + β + γ = 1. The dynamic weights are determined by the current server's business type and security posture. For database servers, the weight β of the behavior deviation index is increased (e.g., to 0.5), and for edge computing servers, the weight γ of the network threat index is increased (e.g., to 0.5). The first threshold is set to 0.4 by default, and the second threshold is set to 0.7 by default; both can be adjusted through the visual interface.

[0055] The workflow of the policy decision engine is as follows: When R_total < the first threshold, the system maintains silent monitoring. When the first threshold ≤ R_total < the second threshold, an early warning notification is generated and highlighted on the visual interaction module. When R_total ≥ the second threshold, a proactive intervention policy is generated. Before policy generation, the decision engine matches the intervention measures to be executed with a preset security policy conflict detection rule base. For example, it checks whether simultaneously executing network isolation and remote desktop service degradation would cause the administrator to lose contact. If a conflict exists, it selects a non-conflicting alternative measure according to preset priority or requests manual adjudication from the administrator. In this embodiment, the preset priority order is: first, execute access control list adjustments; second, execute service degradation; and finally, execute port-level isolation. The proactive intervention policy is sent to the policy execution unit via an encrypted channel.

[0056] After parsing the policy, the policy execution unit executes specific operations. When adjusting the access control list, it dynamically reduces the permissions of the currently active session based on the principle of least privilege, or directly freezes abnormal accounts; it performs downgraded startup and shutdown on specified services, such as limiting the number of database service connections to 10% of the original value; it modifies host firewall rules to implement temporary port-level blocking of high-risk IP ranges or host-level isolation of all ports except management ports. All operations are recorded by the log auditing subsystem, including the policy source, trigger risk score, execution time, specific instructions, and operation results. The log auditing subsystem's storage area is a protected storage partition that only allows append-only writes to prevent tampering.

[0057] The remote management platform is deployed in a cluster, with multiple platform instances synchronizing the status and security policies of managed servers via the Raft distributed consensus protocol. When any instance fails, other instances automatically take over monitoring the managed servers and issuing policies. The destination address of the heartbeat message is dynamically switched by the security proxy module based on the list of available IPs resolved from the locally configured platform cluster domain name, achieving high availability of the management plane.

[0058] The system in this embodiment achieves continuous, in-depth security monitoring and automated closed-loop handling of independent servers. A hardware root of trust ensures underlying trustworthiness, multi-dimensional data collection and dynamic risk assessment capture comprehensive anomalies in hardware, software, and the network, and automatic policy distribution and conflict detection ensure rapid response without harming management channels, significantly reducing reliance on manual intervention.

[0059] This invention's integrated control system consists of a security agent module deployed on each independent server and a centrally deployed remote management platform, connected via a bidirectional certificate-authenticated encrypted communication channel. The security agent module, embedded in the server's hardware trust root unit, operates independently of the main processor. Upon power-up, it boots before the motherboard firmware, using a hardware hash engine to calculate metrics for the firmware and operating system kernel, comparing them step-by-step with pre-programmed and physically immutable baseline metrics. If a comparison fails, an alarm is sent to the remote management platform via a dedicated out-of-band channel, simultaneously preventing the server from continuing to boot, thus preventing system tampering at the source.

[0060] After the server starts normally, the multi-source data acquisition unit collects hardware sensor data, operating system-level behavioral data, and network traffic statistics at three different intervals. Hardware sensor data includes processor temperature, memory error count, number of remapped sectors on storage media, and power supply voltage deviation; operating system-level behavioral data includes process creation sequences, privilege escalation events, and kernel module loading events; network traffic statistics include the number of new connections per second, the ratio of inbound to outbound traffic asymmetry, and the target port entropy. All data is compressed and transmitted via an encrypted channel.

[0061] After receiving the data, the remote management platform's risk assessment engine calculates the hardware health index, behavioral deviation index, and network threat index. The hardware health index is obtained by normalizing various hardware indicators and dynamically weighting them based on sensor reliability. The behavioral deviation index is obtained by calculating and mapping anomaly scores to current behavioral data using a baseline model trained on normal behavior. The network threat index is obtained through real-time inference of network statistical features using a lightweight anomaly detection classifier. These three indices are then dynamically weighted according to the server's service type and security posture, and integrated into a comprehensive risk score.

[0062] The policy decision engine compares the comprehensive risk score with a configurable first and second threshold: silent monitoring is maintained when the score is below the first threshold; an early warning notification is generated when the score is between the two thresholds; and proactive intervention policies are automatically generated when the score reaches or exceeds the second threshold. Conflict detection is performed before policy generation. If the measures to be implemented conflict with preset rules, alternative measures are selected based on priority, or manual adjudication is requested. After the policy reaches the policy execution unit of the security agent module, operations such as access control list reduction, service degradation, or network port-level isolation are immediately executed. All policy execution actions are recorded in the append-only log auditing subsystem.

[0063] When the encrypted channel is interrupted due to a network failure, the collected data is temporarily stored in a buffer unit that is written in a cyclic overwrite pattern. The data is then retransmitted after the channel is restored to ensure that no monitoring records are lost. If the number of consecutive heartbeat packets lost exceeds a set number, the policy execution unit automatically activates the offline protection policy, tightens the firewall rules, and retains only the necessary management channels until the heartbeat is restored.

[0064] The remote management platform can be deployed in a cluster manner. Instances synchronize their status and policies through a distributed consistency protocol. When any instance fails, other instances automatically take over, ensuring high availability of the management plane.

[0065] The above description illustrates the basic principles of the present invention. The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. The above embodiments and descriptions in the specification are only for illustrating the principles of the present invention. Any modifications, equivalent substitutions and improvements made within the spirit and scope of the present invention without departing from the scope of the present invention should be included within the protection scope of the present invention.

Claims

1. An integrated control system for remote monitoring and security management of stand-alone servers, characterized in that include: The security agent module is deployed on a standalone server and includes a hardware trust root unit, a multi-source data acquisition unit, and a policy enforcement unit. The remote management platform connects to the security agent module via an encrypted communication channel and includes a risk assessment engine and a strategy decision engine. The hardware trust root unit is configured to sequentially measure the loading code of the firmware and operating system kernel during the server startup phase, compare the measurement results with the baseline measurement values ​​pre-stored in the immutable storage area, and if the comparison is inconsistent, send an alarm to the remote management platform through an out-of-band channel independent of the main processor and prevent startup. The multi-source data acquisition unit is configured to acquire server hardware sensor data in a first acquisition cycle, acquire operating system-level behavioral data in a second acquisition cycle, acquire network traffic statistical feature data in a third acquisition cycle, and send the acquired data to the remote management platform via the encrypted communication channel. The risk assessment engine is configured to calculate a hardware health index based on the hardware sensor data, a behavior deviation index based on the operating system-level behavior data, and a network threat index based on the network traffic statistical feature data, and to weight and fuse the three indices to obtain a comprehensive risk score. The strategy decision engine is configured to generate an early warning notification when the comprehensive risk score is greater than or equal to a first threshold and less than a second threshold, generate an active intervention strategy when the comprehensive risk score is greater than or equal to the second threshold, and send the active intervention strategy to the strategy execution unit. The policy execution unit is configured to parse and execute the received proactive intervention policies, which include at least: adjusting the access control list of the independent server, performing downgraded start-up and shutdown of the specified service, and modifying network firewall rules to implement port-level or host-level isolation.

2. The integrated control system for remote monitoring and security management of a stand-alone server according to claim 1, wherein: The hardware trust root unit is embedded in the security microcontroller of the server motherboard. The benchmark metric is calculated by a security hash algorithm on the firmware image and the operating system kernel image when the server is first trusted and deployed. The tamper-proof storage area is a one-time programmable memory or a flash partition locked by hardware write protection.

3. The integrated control system for remote monitoring and security management of a stand-alone server according to claim 1, wherein: The first acquisition period ranges from 1 second to 30 seconds, the second acquisition period ranges from 5 seconds to 120 seconds, and the third acquisition period ranges from 10 seconds to 300 seconds. The operating system-level behavioral data acquired by the multi-source data acquisition unit includes process creation sequences, privilege escalation events, and kernel module loading events. The network traffic statistical feature data acquired includes the number of new connections per second, asymmetric traffic ratio, and target port entropy value.

4. The integrated control system for remote monitoring and security management of a stand-alone server according to claim 1, wherein: The risk assessment engine calculates the hardware health index by normalizing the acquired CPU temperature, memory error count, storage medium remapping sector count, and power supply voltage deviation, and then weighting and summing them with a first weight vector to obtain the hardware health index. The behavior deviation index is calculated as follows: an anomaly score is calculated on the current operating system-level behavior data using a baseline model based on historical normal behavior, and the anomaly score is mapped to the behavior deviation index. The network threat index is calculated by inputting network traffic statistical feature data into a pre-trained lightweight anomaly detection classifier, which then outputs the network threat index.

5. The independent server remote monitoring and security management integrated control system according to claim 4, characterized in that: The baseline model is constructed based on operating system-level behavioral data from the initial deployment of the server using a single-class support vector machine or an isolated forest algorithm. When the comprehensive risk score is lower than the first threshold, the baseline model is incrementally updated using behavioral data from the current period. The values ​​of each element in the first weight vector are dynamically adjusted according to the nominal reliability value of the hardware sensor, with higher reliability sensors corresponding to greater weights.

6. The integrated control system for remote monitoring and security management of a stand-alone server according to claim 1, wherein: The remote management platform also includes a visualization and interaction module, which is used to display the real-time health status, risk score trends and security policy execution records of the managed independent servers in the form of a topology diagram, and to receive mandatory security policies manually issued by the administrator. The mandatory security policy has a higher priority than the proactive intervention policy automatically generated by the policy decision engine.

7. The integrated control system for remote monitoring and security management of stand-alone servers according to claim 1, wherein: The encrypted communication channel is established using a certificate-based bidirectional transport layer security protocol. The security proxy module and the remote management platform each hold a unique device certificate issued by a private certificate authority, and complete bidirectional identity authentication during the communication establishment phase. The heartbeat message interval between the security proxy module and the remote management platform is 5 to 60 seconds. If the number of consecutively lost heartbeat messages exceeds a preset loss threshold, the policy execution unit automatically executes a predefined offline protection policy.

8. The integrated control system for remote monitoring and security management of a stand-alone server according to any one of claims 1 to 7, characterized in that: The security agent module also includes a security information caching unit. When the encrypted communication channel is interrupted, the multi-source data acquisition unit continues to acquire data and temporarily stores it in the security information caching unit. After the channel is restored, the data is retransmitted to the remote management platform in chronological order. The security information cache unit adopts a cyclic overwrite write mode, and its storage capacity is at least able to accommodate the full amount of collected data generated within the maximum allowable interruption duration.

9. The integrated control system for remote monitoring and security management of a stand-alone server according to any one of claims 1 to 7, wherein: When adjusting the access control list of the independent server, the policy execution unit dynamically reduces or freezes the permissions of the currently active session according to the principle of least privilege, and records the policy source, trigger risk score, execution time and operation result in the log auditing subsystem; the records of the log auditing subsystem are stored in a secure storage area that only allows append writing.

10. The integrated control system for remote monitoring and security management of a stand-alone server according to any one of claims 1 to 7, wherein: The remote management platform is deployed in a clustered manner. Multiple remote management platform instances synchronize the status and security policies of the managed servers through a distributed consistency protocol. When any instance fails, other instances take over the monitoring and policy distribution of the managed independent servers, thereby achieving high availability of the management platform.

Images