Security protection method based on system log, and security protection apparatus and security protection system

Abstract

Provided in the present disclosure are a security protection method based on a system log, and a security protection apparatus and a security protection system. The method comprises: acquiring a system log of a service system, and generating a service system behavior on the basis of the system log, wherein the system log comprises at least a user account, an IP, a function name and a function run time; using a service behavior model to determine whether the service system behavior is abnormal, wherein the service behavior model is configured to describe a behavior that the service system should have when in normal use; and when the service system behavior is abnormal, generating anomaly information, and taking a corresponding handling measure on the basis of the anomaly information, wherein the handling measure comprises at least blocking the IP which is currently accessing the service system, and decreasing the access speed of the IP. The present disclosure solves the problem in the prior art of it being difficult to detect and handle unknown security vulnerabilities present in a system.

Description

Security protection methods, devices, and systems based on system logs

[0001] This disclosure takes priority from the patent application filed on April 23, 2024, with application number 202410495138.7 and entitled "Security Protection Method, Protection Device and Security Protection System Based on System Logs", the entire contents of which are incorporated herein by reference. Technical Field

[0002] This disclosure relates to the field of system security technology, and more specifically, to a security protection method, protection device, computer-readable storage medium, security protection system, and computer program product based on system logs. Background Technology

[0003] System behavior encompasses all aspects of system operation. If system behavior can be recorded and analyzed in detail, the health of the system can be understood, such as whether the system has been attacked, whether there is congestion, or whether any modules have failed. However, it is difficult to record system behavior comprehensively, truthfully, and accurately. Existing system monitoring methods are mostly based on intrusive third-party monitoring, which carries the risk of introducing unknown hidden dangers into the system. Network security vulnerabilities are on the rise, with "0-day vulnerabilities" and business logic vulnerabilities emerging one after another. The inherent security of a system must be based on the premise that vulnerabilities persist and are difficult to eradicate. During system construction, close attention must be paid to the system's own operational behavior; when abnormal system behavior is detected, timely action should be taken before losses occur or escalate, achieving a dynamic balance of system security.

[0004] Summary of the Invention

[0005] The main purpose of this disclosure is to provide a security protection method, protection device, computer-readable storage medium, security protection system, and computer program product based on system logs, so as to at least solve the problem of inefficient handling of security vulnerabilities in system behavior leading to system anomalies.

[0006] To achieve the above objectives, according to one aspect of this disclosure, a security protection method based on system logs is provided. The method includes: acquiring system logs of a business system and generating business system behaviors based on the system logs. The system logs include at least user accounts, IP addresses, function names, and function runtimes. The function name is the name of the system function when it is invoked within the business system, and the function runtime is the time when the system function starts running. The business system behaviors are configured to describe the invocation order of the system functions, with one business system behavior corresponding to one IP address. The method also includes using a business behavior model to determine whether the business system behaviors are abnormal. The business behavior model is configured to describe the expected behavior of the business system under normal use. If the business system behaviors are abnormal, an exception message is generated, and corresponding handling measures are taken based on the exception message. The handling measures include at least blocking the IP address currently accessing the business system and slowing down the access speed of the IP address.

[0007] Optionally, the system logs of the business system are obtained, and business system behavior is generated based on the system logs, including: recording the function execution time and function name corresponding to the IP level by level to obtain the function timing, one IP corresponds to one function timing; generating the corresponding business system behavior based on the IP, the function timing, and the integrity check value, wherein the integrity check value is a data value obtained by encrypting the IP and the function timing.

[0008] Optionally, before generating the corresponding business system behavior based on the IP, the function timing, and the integrity check value, the method further includes: converting the IP and the function timing into a fixed-length value using a cryptographic algorithm to obtain the integrity check value.

[0009] Optionally, before using the business behavior model to determine whether there is an anomaly in the behavior of the business system, the method further includes: establishing a state sequence with system functions as nodes and the calling order between any two system functions as directed edges, wherein the state sequence is configured to describe the calling relationship of the system functions; calculating the ratio of the first number to the second number to obtain the weight corresponding to the directed edge, wherein the first number is the number of times the second system function is called after the first system function is called, the second number is the number of times the remaining system functions are called after the first system function is called, and the weight represents the probability of calling the second system function after the first system function is called, wherein the first system function is the system function corresponding to the starting node of the directed edge, the second system function is the system function corresponding to the ending node of the directed edge, and the remaining system functions are other system functions besides the first system function; and forming the business behavior model based on the state sequence and the weight corresponding to the directed edge.

[0010] Optionally, using a business behavior model to determine whether the business system behavior is abnormal includes: matching the calling order of the business system behavior with the calling order in the business behavior model; if the matching order of the business system behavior and the calling order in the business behavior model is inconsistent, determining that the business system behavior is abnormal; if the matching order of the business system behavior and the calling order in the business behavior model is consistent, determining that the business system behavior is not abnormal.

[0011] Optionally, determining whether the business system behavior is abnormal using a business behavior model further includes: comparing a target weight with a weight threshold, wherein the target weight is the weight on the directed edge corresponding to the calling order of the business system behavior; determining that the business system behavior is abnormal if the target weight is less than the weight threshold; and determining that the business system behavior is not abnormal if the target weight is greater than or equal to the weight threshold.

[0012] According to another aspect of this disclosure, a security protection device based on system logs is provided. The device includes: a generation unit configured to acquire system logs of a business system and generate business system behavior based on the system logs, wherein the system logs include at least user account, IP address, function name, and function runtime, wherein the function name is the name of the system function when it is invoked within the business system, the function runtime is the time when the system function starts running, and the business system behavior is configured to describe the invocation order of the system functions; a judgment unit configured to use a business behavior model to judge whether there is an anomaly in the business system behavior, wherein the business behavior model is configured to describe the behavior that the business system should have under normal use; and a handling unit configured to generate anomaly information when there is an anomaly in the business system behavior and take corresponding handling measures based on the anomaly information, wherein the handling measures include at least blocking the IP address currently accessing the business system and slowing down the access speed of the IP address.

[0013] According to another aspect of this disclosure, a computer-readable storage medium is provided, the computer-readable storage medium including a stored program, wherein, when the program is executed, it controls the device on which the computer-readable storage medium is located to perform any of the methods described.

[0014] According to another aspect of this disclosure, a security protection system is provided, comprising: one or more processors, a memory, and one or more programs, wherein the one or more programs are stored in the memory and configured to be executed by the one or more processors, the one or more programs including being configured to perform any one of the methods described.

[0015] According to another aspect of this disclosure, a computer program product is provided, including computer instructions that, when executed by a processor, implement any of the methods described.

[0016] Applying the technical solution of this disclosure, in the security protection method based on system logs, firstly, the system logs of the business system are obtained, and business system behavior is generated based on the system logs. The system logs include at least user accounts, IP addresses, function names, and function runtimes. The function name is the name of the system function when it is called within the business system, and the function runtime is the time when the system function starts running. The business system behavior is configured to describe the calling order of the system functions. Then, a business behavior model is used to determine whether there are any anomalies in the business system behavior. The business behavior model is configured to describe the behavior that the business system should exhibit under normal use. Finally, if there are anomalies in the business system behavior, anomaly information is generated, and corresponding handling measures are taken based on the anomaly information. The handling measures include at least blocking the IP address currently accessing the business system and slowing down the access speed of the IP address. This disclosure generates business system behavior by recording logs at key locations in the business system, and then analyzes the generated business system behavior based on the business behavior model. If the business system behavior is determined to be abnormal, the handling function of the business system is triggered, and the corresponding access IP address is handled. This disclosure addresses the problem that unknown security vulnerabilities in existing systems are difficult to detect and handle. Attached Figure Description

[0017] Figure 1 shows a hardware structure block diagram of a mobile terminal that performs a system log-based security protection method according to an embodiment of the present disclosure;

[0018] Figure 2 shows a flowchart of a security protection method based on system logs provided according to an embodiment of the present disclosure;

[0019] Figure 3 shows a structural diagram of a security protection system provided according to an embodiment of the present disclosure;

[0020] Figure 4 illustrates a schematic diagram of a system log recording provided according to an embodiment of the present disclosure;

[0021] Figure 5 shows a schematic diagram of a business behavior generation model provided according to an embodiment of the present disclosure;

[0022] Figure 6 shows a structural block diagram of a system log-based security protection device provided according to an embodiment of the present disclosure.

[0023] The above figures include the following reference numerals:

[0024] 102. Processor; 104. Memory; 106. Transmission device; 108. Input / output device. Detailed Implementation

[0025] It should be noted that, unless otherwise specified, the embodiments and features described in this disclosure can be combined with each other. This disclosure will now be described in detail with reference to the accompanying drawings and embodiments.

[0026] To enable those skilled in the art to better understand the present disclosure, the technical solutions of the present disclosure will be clearly and completely described below with reference to the accompanying drawings of the embodiments. Obviously, the described embodiments are only some embodiments of the present disclosure, and not all embodiments. Based on the embodiments of the present disclosure, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present disclosure.

[0027] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this disclosure are configured to distinguish similar objects and are not necessarily configured to describe a specific order or sequence. It should be understood that such data used can be interchanged where appropriate for the embodiments of this disclosure described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0028] For ease of description, the following explains some of the terms or nouns used in the embodiments of this disclosure:

[0029] System logs record information about hardware, software, and system problems. They also monitor events that occur in the system. Users can use them to check the cause of errors or find traces left by attackers when an attack occurs. System logs include system logs, application logs, and security logs.

[0030] Cryptographic algorithms: A set of operational rules or procedures that describe the cryptographic processing process. Current cryptographic algorithms mainly include stream ciphers, block ciphers, public-key cryptography, and hash functions.

[0031] As described in the background section, system behavior is difficult to record comprehensively, truthfully, and accurately. Most system monitoring methods are based on intrusive third-party monitoring, which poses a risk of introducing unknown hidden dangers to the system. In order to solve the problem that unknown security vulnerabilities in the system are difficult to discover and handle, the embodiments of this disclosure provide a security protection method, protection device, computer-readable storage medium, security protection system, and computer program product based on system logs.

[0032] The technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings in the embodiments of the present invention.

[0033] The methods and embodiments provided in this disclosure can be executed in a mobile terminal, computer terminal, or similar computing device. Taking a mobile terminal as an example, FIG1 is a hardware structure block diagram of a mobile terminal for a security protection method based on system logs according to an embodiment of the present invention. As shown in FIG1, the mobile terminal may include one or more (only one is shown in FIG1) processors 102 (processors 102 may include, but are not limited to, processing devices such as microprocessors MCUs or programmable logic devices FPGAs) and a memory 104 configured to store data. The mobile terminal may also include a transmission device 106 configured for communication functions and an input / output device 108. It will be understood by those skilled in the art that the structure shown in FIG1 is only illustrative and does not limit the structure of the mobile terminal. For example, the mobile terminal may also include more or fewer components than shown in FIG1, or have a different configuration than shown in FIG1.

[0034] The memory 104 can be configured to store computer programs, such as application software programs and modules, like the computer program corresponding to the device information display method in this embodiment of the invention. The processor 102 executes various functional applications and data processing by running the computer programs stored in the memory 104, thereby implementing the above-described method. The memory 104 may include high-speed random access memory and non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory 104 may further include memory remotely located relative to the processor 102, and these remote memories can be connected to the mobile terminal via a network. Examples of the aforementioned networks include, but are not limited to, the Internet, corporate intranets, local area networks, mobile communication networks, and combinations thereof. The transmission device 106 is configured to receive or transmit data via a network. Specific examples of the aforementioned networks may include wireless networks provided by the mobile terminal's communication provider. In one instance, the transmission device 106 includes a network interface controller (NIC), which can be connected to other network devices via a base station to communicate with the Internet. In one example, the transmission device 106 may be a radio frequency (RF) module configured to communicate wirelessly with the Internet.

[0035] This embodiment provides a system log-based security protection method that runs on a mobile terminal, computer terminal, or similar computing device. It should be noted that the steps shown in the flowchart in the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions. Although a logical order is shown in the flowchart, in some cases, the steps shown or described may be executed in a different order than that shown here.

[0036] Figure 2 is a flowchart of a security protection method based on system logs according to an embodiment of the present disclosure. As shown in Figure 2, the method includes the following steps:

[0037] Step S201: Obtain the system log of the business system and generate business system behavior based on the system log. The system log includes at least user account, IP, function name and function run time. The function name is the name of the system function when the system function in the business system is called. The function run time is the time when the system function starts running. The business system behavior is configured to describe the calling order of the system function.

[0038] In some embodiments, the aforementioned business system can be configured as various business systems. For example, if the business system is a financial system, then all related business functions are categorized under this module, including budgeting and expense reimbursement. If the business system is an OA system, then related business functions include document creation, issuance, and document review. As shown in Figure 3, the business system's log recording module records various behaviors of the business system, including but not limited to user login, clicking on function modules, inputting data, querying data, deleting data, and downloading data. It also includes the system's backend systems, including but not limited to database-related operations and interactions with other systems. This is the aforementioned system log. The business system's log recording module transmits the aforementioned system logs to the monitoring system's behavior generation module in real time. After receiving the logs, the monitoring system's behavior generation module converts the logs into business system behaviors. These business system behaviors are bound to IP addresses, user accounts (if any), and other information, and the business system behaviors of different IP addresses are independent of each other.

[0039] Step S202: Use the business behavior model to determine whether there are any abnormalities in the behavior of the above business system. The business behavior model is configured to describe the behavior that the business system should have under normal use.

[0040] In some embodiments, as shown in Figure 3, the business behavior modeling module of the monitoring system generates a business behavior model in advance based on information such as the business logic, system process, and system functions of the business system. The abnormal behavior identification module of the monitoring system receives the business system behavior generated by the behavior generation module and compares it with the business behavior model generated by the business behavior modeling module, and determines whether the business system behavior is abnormal based on the business behavior model.

[0041] Step S203: If there is an abnormality in the behavior of the above-mentioned business system, generate abnormal information and take corresponding measures based on the abnormal information. The measures include at least blocking the IP currently accessing the above-mentioned business system and slowing down the access speed of the above-mentioned IP.

[0042] In some embodiments, when an abnormal behavior of the business system is detected, the abnormal information is sent to the business system's handling module. After receiving the abnormal information sent by the abnormal behavior identification module of the monitoring system, the handling module can take different handling measures according to the abnormal information, including but not limited to blocking the IP currently accessing the business system and slowing down the access speed of the current IP.

[0043] In this embodiment, the security protection method based on system logs firstly acquires the system logs of the business system and generates business system behavior based on these logs. The system logs include at least user accounts, IP addresses, function names, and function runtimes. The function name is the name of the system function when it is invoked within the business system, and the function runtime is the start time of the system function. The business system behavior is configured to describe the invocation order of the system functions. Then, a business behavior model is used to determine if any anomalies exist in the business system behavior. This model is configured to describe the expected behavior of the business system under normal use. Finally, if an anomaly exists in the business system behavior, an anomaly message is generated, and corresponding handling measures are taken based on this message. These measures include at least blocking the IP address currently accessing the business system and slowing down the access speed of that IP address. This disclosure generates business system behavior by recording logs at key locations within the business system. Based on the business behavior model, the generated business system behavior is analyzed. If the business system behavior is determined to be abnormal, the handling function of the business system is triggered, and the corresponding access IP address is handled. This disclosure solves the problem in the prior art where unknown security vulnerabilities are difficult to detect and handle. To enable those skilled in the art to better understand the technical solutions of this disclosure, the implementation process of the security protection method based on system logs of this disclosure will be described in detail below with reference to specific embodiments.

[0044] To improve the reliability of the business system, in one optional implementation, step S201 includes:

[0045] Step S2011: Record the running time and function name of the function corresponding to the above IPs level by level to obtain the function timing sequence. One above IP corresponds to one above function timing sequence.

[0046] Step S2012: Generate the corresponding business system behavior based on the above IP, the above function timing, and the integrity check value. The above integrity check value is a data value obtained by encrypting the above IP and the above function timing. One above integrity check value corresponds to one above IP.

[0047] In the above embodiments, as shown in Figure 4, the system functions include user login and functions that can only be used after login, as well as functions for public users that do not require login; the functions include not only primary functions, but also all sub-functions such as secondary and tertiary functions; the system functions also include non-business functions, such as CRUD operations on the backend database, various virtual machine operations on the cloud platform, and various management operations. The logging function is configured to record logs. By parsing the log data, relevant information such as IP, function name, and function running time is extracted, and the extracted information is recorded according to IP, recording the start time and function name of each function of that IP. The format of the business system behavior is: IP|User|Time1|Function1|Time2|Function2|...|TimeN|FunctionN|Operation|Integrity check value, where if there is no user, it is left blank, Function N represents the current function, Function N-1 represents the function of the previous operation, Time N represents the start time of Function N, the function order is based on the call records in chronological order, and the integrity check value is the hash value or message authentication code (MAC) of all preceding system log contents. One IP corresponds to one business system behavior. It can enable the monitoring, analysis, and optimization of business systems, thereby improving system reliability and security.

[0048] To improve data security, in an optional implementation, prior to step S2012 above, the method further includes:

[0049] Step S301: The above IP and the above functional timing are converted into a fixed-length value using a cryptographic algorithm to obtain the above integrity verification value.

[0050] In the above embodiments, the integrity check value is usually generated using a hash algorithm, but it is not limited to hash algorithms. Using a selected cryptographic algorithm, the above IP and the above functional timing are converted into a hash value of a fixed length to obtain the calculated result, that is, the above integrity check value. This can improve the reliability and security of the data and ensure that the data has not been tampered with or lost.

[0051] In order to detect abnormalities in system operation or potential security threats in a timely manner, in an optional implementation, before step S202 above, the method further includes:

[0052] Step S401: Using system functions as nodes and the above-mentioned calling order between each pair of system functions as directed edges, establish a state sequence. The state sequence is configured to describe the calling relationship of the above-mentioned system functions.

[0053] Step S402: Calculate the ratio of the first number to the second number to obtain the weight corresponding to the directed edge. The first number is the number of times the second system function is called after the first system function is called, and the second number is the number of times the remaining system functions are called after the first system function is called. The weight represents the probability of calling the second system function after the first system function is called. The first system function is the system function corresponding to the starting node of the directed edge, the second system function is the system function corresponding to the ending node of the directed edge, and the remaining system functions are other system functions besides the first system function.

[0054] Step S403: The above business behavior model is formed based on the above state sequence and the weights corresponding to the above directed edges.

[0055] In the above embodiments, based on the system business logic and system function design, a finite state machine describing the call relationships of all system functions is established, using system functions as nodes and the call relationships between functions as directed edges. This is the aforementioned state sequence. Multiple logs from normal system operation record the number of times each node is called and the number of times each directed edge is executed. The weight of a directed edge is equal to the number of times that directed edge is called divided by the total number of times directed edges originate from the node that started that directed edge. As shown in Figure 5, for example, if business function 2 is called 99 times, business function 3 is called 50 times after business function 2, and business function 4 is called 46 times after business function 2, then the probability of calling business function 3 from business function 2 is 50 / (50+46) = 52.1%. Through the above calculation, the call order and probability between system functions can be quantified, which helps to understand the system's operating behavior. By monitoring the magnitude of the call probability and the call order, abnormal situations or potential security threats in system operation can be detected.

[0056] In order to promptly detect and handle abnormal behavior in the business system, in one optional implementation, step S203 includes:

[0057] Step S2031: Match the above-mentioned call order of the above-mentioned business system behavior with the above-mentioned call order in the above-mentioned business behavior model;

[0058] Step S2032: If the above-mentioned business system behavior is inconsistent with the above-mentioned call order of the above-mentioned business behavior model, it is determined that the above-mentioned business system behavior has the above-mentioned abnormality.

[0059] Step S2033: If the above-mentioned business system behavior is consistent with the above-mentioned call order of the above-mentioned business behavior model, it is determined that the above-mentioned business system behavior does not have the above-mentioned abnormality.

[0060] In the above embodiments, the system generates business system behavior that matches the business behavior model. For example, if the function call order in the business behavior model is: function 1-function 3-function 4-function 5-function 7, while the actual business system behavior is: function 1-function 3-function 7, the business system behavior does not match the business behavior model. In this case, the business system behavior is determined to be abnormal.

[0061] In order to promptly detect and handle abnormal behavior in the business system, in an optional implementation, step S203 above further includes:

[0062] Step S2034: Compare the target weight with the weight threshold. The target weight is the weight on the directed edge corresponding to the call order of the business system behavior.

[0063] Step S2035: If the target weight is less than the weight threshold, it is determined that the above-mentioned business system behavior has the above-mentioned abnormality;

[0064] Step S2036: If the target weight is greater than or equal to the weight threshold, it is determined that the above-mentioned business system behavior does not have the above-mentioned abnormality.

[0065] In the above embodiments, for example, in the business behavior model, the probability of function 1 to function 2 is 3%, the probability of function 1 to function 3 is 27%, and the probability of function 1 to function 4 is 70%. Then, when the weight threshold for judging whether it is abnormal is set to 5%, if the actual system call order is from function 1 to function 2, then the system behavior is judged to be abnormal, and the probability of function 1 to function 2 is the above-mentioned target weight.

[0066] It should be noted that the steps shown in the flowchart in the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions, and although a logical order is shown in the flowchart, in some cases the steps shown or described may be executed in a different order than that shown here.

[0067] This disclosure also provides a system log-based security protection device. It should be noted that the system log-based security protection device of this disclosure can be configured to execute the system log-based security protection method provided in this disclosure. This device is configured to implement the above embodiments and preferred embodiments; details already described will not be repeated. As used below, the term "module" can refer to a combination of software and hardware that performs a predetermined function. Although the device described in the following embodiments is preferably implemented in software, hardware implementation, or a combination of software and hardware, is also possible and contemplated.

[0068] The following describes the security protection device based on system logs provided in the embodiments of this disclosure.

[0069] Figure 6 is a structural block diagram of a security protection device based on system logs according to an embodiment of the present disclosure. As shown in Figure 6, the device includes:

[0070] The generation unit 10 is configured to obtain the system logs of the business system and generate business system behavior based on the system logs. The system logs include at least the user account, IP, function name and function run time. The function name is the name of the system function when the system function in the business system is called. The function run time is the time when the system function starts running. The business system behavior is configured to describe the calling order of the system function.

[0071] In some embodiments, the aforementioned business system can be configured as various business systems. For example, if the business system is a financial system, then all related business functions are categorized under this module, including budgeting and expense reimbursement. If the business system is an OA system, then related business functions include document creation, issuance, and document review. As shown in Figure 3, the business system's log recording module records various behaviors of the business system, including but not limited to user login, clicking on function modules, inputting data, querying data, deleting data, and downloading data. It also includes the system's backend systems, including but not limited to database-related operations and interactions with other systems. This is the aforementioned system log. The business system's log recording module transmits the aforementioned system logs to the monitoring system's behavior generation module in real time. After receiving the logs, the monitoring system's behavior generation module converts the logs into business system behaviors. These business system behaviors are bound to IP addresses, user accounts (if any), and other information, and the business system behaviors of different IP addresses are independent of each other.

[0072] The judgment unit 20 is configured to use a business behavior model to judge whether there is an anomaly in the behavior of the above-mentioned business system. The business behavior model is configured to describe the behavior that the above-mentioned business system should have under normal use.

[0073] In some embodiments, as shown in Figure 3, the business behavior modeling module of the monitoring system generates a business behavior model in advance based on information such as the business logic, system process, and system functions of the business system. The abnormal behavior identification module of the monitoring system receives the business system behavior generated by the behavior generation module and compares it with the business behavior model generated by the business behavior modeling module, and determines whether the business system behavior is abnormal based on the business behavior model.

[0074] The processing unit 30 is configured to generate abnormal information when there is an abnormality in the behavior of the aforementioned business system, and to take corresponding processing measures based on the abnormal information. The processing measures include at least blocking the IP currently accessing the aforementioned business system and slowing down the access speed of the aforementioned IP.

[0075] In some embodiments, when an abnormal behavior of the business system is detected, the abnormal information is sent to the business system's handling module. After receiving the abnormal information sent by the abnormal behavior identification module of the monitoring system, the handling module can take different handling measures according to the abnormal information, including but not limited to blocking the IP currently accessing the business system and slowing down the access speed of the current IP.

[0076] In this embodiment, the generation unit is configured to acquire system logs of the business system and generate business system behavior based on the system logs. The system logs include at least user account, IP address, function name, and function runtime. The function name is the name of the system function when it is called within the business system, and the function runtime is the time when the system function starts running. The business system behavior is configured to describe the order in which the system functions are called. The judgment unit is configured to use a business behavior model to determine whether there are any abnormalities in the business system behavior. The business behavior model is configured to describe the behavior that the business system should exhibit under normal use. The handling unit is configured to generate abnormal information when there are abnormalities in the business system behavior and take corresponding handling measures based on the abnormal information. The handling measures include at least blocking the IP address currently accessing the business system and slowing down the access speed of the IP address. This disclosure generates business system behavior by recording logs at key locations in the business system, and then analyzes the generated business system behavior based on the business behavior model. If the business system behavior is determined to be abnormal, the handling function of the business system is triggered, and the corresponding access IP address is handled. This disclosure addresses the problem that unknown security vulnerabilities in existing systems are difficult to detect and handle.

[0077] To improve the reliability of the business system, in one optional implementation, the above-mentioned generation unit includes:

[0078] The recording module records the running time and function name corresponding to the above IPs level by level to obtain the function timing sequence. One above IP corresponds to one above function timing sequence.

[0079] The generation module generates the corresponding business system behavior based on the above IP, the above function timing, and the integrity check value. The above integrity check value is a data value obtained by encrypting the above IP and the above function timing. One above integrity check value corresponds to one above IP.

[0080] In the above embodiments, as shown in Figure 4, the system functions include user login and functions that can only be used after login, as well as functions for public users that do not require login; the functions include not only primary functions, but also all sub-functions such as secondary and tertiary functions; the system functions also include non-business functions, such as CRUD operations on the backend database, various virtual machine operations on the cloud platform, and various management operations. The logging function is configured to record logs. By parsing the log data, relevant information such as IP, function name, and function running time is extracted, and the extracted information is recorded according to IP, recording the start time and function name of each function of that IP. The format of the business system behavior is: IP|User|Time1|Function1|Time2|Function2|...|TimeN|FunctionN|Operation|Integrity check value, where if there is no user, it is left blank, Function N represents the current function, Function N-1 represents the function of the previous operation, Time N represents the start time of Function N, the function order is based on the call records in chronological order, and the integrity check value is the hash value or message authentication code (MAC) of all preceding system log contents. One IP corresponds to one business system behavior. It can enable the monitoring, analysis, and optimization of business systems, thereby improving system reliability and security.

[0081] To enhance data security, in one optional implementation, the device further includes:

[0082] The encryption unit is configured to convert the IP address and the functional timing sequence into a fixed-length value using a cryptographic algorithm before generating the corresponding business system behavior based on the IP address, the functional timing sequence, and the integrity verification value, thereby obtaining the integrity verification value.

[0083] In the above embodiments, the integrity check value is usually generated using a hash algorithm, but it is not limited to hash algorithms. Using a selected cryptographic algorithm, the above IP and the above functional timing are converted into a hash value of a fixed length to obtain the calculated result, that is, the above integrity check value. This can improve the reliability and security of the data and ensure that the data has not been tampered with or lost.

[0084] In order to detect abnormalities in system operation or potential security threats in a timely manner, in one optional implementation, the device further includes:

[0085] The establishment unit is configured to, before using the business behavior model to determine whether there is an anomaly in the behavior of the above-mentioned business system, establish a state sequence with system functions as nodes and the above-mentioned call order between each pair of system functions as directed edges. The state sequence is configured to describe the call relationship of the above-mentioned system functions.

[0086] The calculation unit is configured to calculate the ratio of the first number to the second number to obtain the weight corresponding to the directed edge. The first number is the number of times the second system function is called after the first system function is called, the second number is the number of times the remaining system functions are called after the first system function is called, and the weight represents the probability of calling the second system function after the first system function is called. The first system function is the system function corresponding to the starting node of the directed edge, the second system function is the system function corresponding to the ending node of the directed edge, and the remaining system functions are other system functions besides the first system function.

[0087] The forming unit is configured to form the business behavior model based on the above state sequence and the weights corresponding to the above directed edges.

[0088] In the above embodiments, based on the system business logic and system function design, a finite state machine describing the call relationships of all system functions is established, using system functions as nodes and the call relationships between functions as directed edges. This is the aforementioned state sequence. Multiple logs from normal system operation record the number of times each node is called and the number of times each directed edge is executed. The weight of a directed edge is equal to the number of times that directed edge is called divided by the total number of times directed edges originate from the node that started that directed edge. As shown in Figure 5, for example, if business function 2 is called 99 times, business function 3 is called 50 times after business function 2, and business function 4 is called 46 times after business function 2, then the probability of calling business function 3 from business function 2 is 50 / (50+46) = 52.1%. Through the above calculation, the call order and probability between system functions can be quantified, which helps to understand the system's operating behavior. By monitoring the magnitude of the call probability and the call order, abnormal situations or potential security threats in system operation can be detected.

[0089] In order to promptly detect and handle abnormal behavior in the business system, in one optional implementation, the above-mentioned handling unit includes:

[0090] The matching module matches the above-mentioned call order of the above-mentioned business system behaviors with the above-mentioned call order in the above-mentioned business behavior model;

[0091] The first determination module determines that the above-mentioned business system behavior has the above-mentioned abnormality if the above-mentioned business system behavior is inconsistent with the above-mentioned call order of the above-mentioned business behavior model.

[0092] The second determination module determines that the above-mentioned business system behavior does not have the above-mentioned abnormality if the above-mentioned business system behavior is consistent with the above-mentioned call order of the above-mentioned business behavior model.

[0093] In the above embodiments, the system generates business system behavior that matches the business behavior model. For example, if the function call order in the business behavior model is: function 1-function 3-function 4-function 5-function 7, while the actual business system behavior is: function 1-function 3-function 7, the business system behavior does not match the business behavior model. In this case, the business system behavior is determined to be abnormal.

[0094] In order to promptly detect and handle abnormal behavior in the business system, in one optional implementation, the above-mentioned handling unit further includes:

[0095] The comparison module compares the target weight with the weight threshold. The target weight is the weight on the directed edge corresponding to the call order of the business system behavior.

[0096] The third judgment module determines that the above-mentioned business system behavior has the above-mentioned abnormality when the above-mentioned target weight is less than the above-mentioned weight threshold.

[0097] The fourth determination module determines that the above-mentioned business system behavior does not have the above-mentioned abnormality if the above-mentioned target weight is greater than or equal to the above-mentioned weight threshold.

[0098] In the above embodiments, for example, in the business behavior model, the probability of function 1 to function 2 is 3%, the probability of function 1 to function 3 is 27%, and the probability of function 1 to function 4 is 70%. Then, when the weight threshold for judging whether it is abnormal is set to 5%, if the actual system call order is from function 1 to function 2, then the system behavior is judged to be abnormal, and the probability of function 1 to function 2 is the above-mentioned target weight.

[0099] The aforementioned security protection device based on system logs includes a processor and a memory. The generation unit, judgment unit, and processing unit are all stored as program units in the memory, and the processor executes these program units to achieve the corresponding functions. All of the above modules reside in the same processor; alternatively, the modules may be located in different processors in any combination.

[0100] The processor contains a kernel, which retrieves the corresponding program units from memory. One or more kernels can be configured, and by adjusting kernel parameters, the difficulty in discovering and addressing unknown security vulnerabilities in existing systems can be mitigated.

[0101] The memory may include non-permanent memory in computer-readable media, such as random access memory (RAM) and volatile memory, such as read-only memory (ROM) or flash RAM, and the memory includes at least one memory chip.

[0102] This invention provides a computer-readable storage medium that includes a stored program, wherein the program, when running, controls the device containing the computer-readable storage medium to execute the security protection method based on system logs.

[0103] Specifically, security protection methods based on system logs include:

[0104] Step S201: Obtain the system logs of the business system and generate business system behavior based on the system logs. The system logs include at least the user account, IP, function name, and function run time. The function name is the name of the system function when the system function in the business system is called. The function run time is the time when the system function starts running. The business system behavior is configured to describe the calling order of the system functions.

[0105] Step S202: Use the business behavior model to determine whether there are any abnormalities in the behavior of the above business system. The business behavior model is configured to describe the behavior that the business system should have under normal use.

[0106] Step S203: If there is an abnormality in the behavior of the above-mentioned business system, generate abnormal information and take corresponding measures based on the abnormal information. The measures include at least blocking the IP currently accessing the above-mentioned business system and slowing down the access speed of the above-mentioned IP.

[0107] This invention provides a processor configured to run a program, wherein the program executes the aforementioned security protection method based on system logs.

[0108] Specifically, security protection methods based on system logs include:

[0109] Step S201: Obtain the system log of the business system and generate business system behavior based on the system log. The system log includes at least user account, IP, function name and function run time. The function name is the name of the system function when the system function in the business system is called. The function run time is the time when the system function starts running. The business system behavior is configured to describe the calling order of the system function.

[0110] Step S202: Use the business behavior model to determine whether there are any abnormalities in the behavior of the above business system. The business behavior model is configured to describe the behavior that the business system should have under normal use.

[0111] Step S203: If there is an abnormality in the behavior of the above-mentioned business system, generate abnormal information and take corresponding measures based on the abnormal information. The measures include at least blocking the IP currently accessing the above-mentioned business system and slowing down the access speed of the above-mentioned IP.

[0112] This invention provides a security protection system, which includes a processor, a memory, and a program stored in the memory and executable on the processor. When the processor executes the program, it performs at least the following steps:

[0113] Step S201: Obtain the system log of the business system and generate business system behavior based on the system log. The system log includes at least user account, IP, function name and function run time. The function name is the name of the system function when the system function in the business system is called. The function run time is the time when the system function starts running. The business system behavior is configured to describe the calling order of the system function.

[0114] Step S202: Use the business behavior model to determine whether there are any abnormalities in the behavior of the above business system. The business behavior model is configured to describe the behavior that the business system should have under normal use.

[0115] Step S203: If there is an abnormality in the behavior of the above-mentioned business system, generate abnormal information and take corresponding measures based on the abnormal information. The measures include at least blocking the IP currently accessing the above-mentioned business system and slowing down the access speed of the above-mentioned IP.

[0116] This disclosure also provides a computer program product, which, when executed on a data processing device, is adapted to execute an initialization program having at least the following method steps:

[0117] Step S201: Obtain the system log of the business system and generate business system behavior based on the system log. The system log includes at least user account, IP, function name and function run time. The function name is the name of the system function when the system function in the business system is called. The function run time is the time when the system function starts running. The business system behavior is configured to describe the calling order of the system function.

[0118] Step S202: Use the business behavior model to determine whether there are any abnormalities in the behavior of the above business system. The business behavior model is configured to describe the behavior that the business system should have under normal use.

[0119] Step S203: If there is an abnormality in the behavior of the above-mentioned business system, generate abnormal information and take corresponding measures based on the abnormal information. The measures include at least blocking the IP currently accessing the above-mentioned business system and slowing down the access speed of the above-mentioned IP.

[0120] It is obvious to those skilled in the art that the modules or steps of the present invention described above can be implemented using general-purpose computing devices. They can be centralized on a single computing device or distributed across a network of multiple computing devices. They can be implemented using computer-executable program code, and thus can be stored in a storage device for execution by a computing device. In some cases, the steps shown or described can be performed in a different order than those described herein, or they can be fabricated as separate integrated circuit modules, or multiple modules or steps can be fabricated as a single integrated circuit module. Thus, the present invention is not limited to any particular combination of hardware and software.

[0121] Those skilled in the art will understand that embodiments of this disclosure can be provided as methods, systems, or computer program products. Therefore, this disclosure can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this disclosure can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0122] This disclosure is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this disclosure. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, create means configured to implement the functions specified in one or more flowchart illustrations and / or one or more block diagrams.

[0123] These computer program instructions may also be stored in a computer-readable memory that can direct a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce a product including an instruction device that implements the functions specified in one or more processes in the flowchart and / or one or more boxes in the block diagram.

[0124] These computer program instructions may also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer-implemented process, such that the instructions, which execute on the computer or other programmable apparatus, provide steps configured to implement the functions specified in one or more flowcharts and / or one or more block diagrams.

[0125] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0126] Memory may include non-persistent memory in computer-readable media, such as random access memory (RAM) and non-volatile memory, such as read-only memory (ROM) or flash RAM. Memory is an example of computer-readable media.

[0127] Computer-readable media, including both permanent and non-permanent, removable and non-removable media, can store information using any method or technology. Information can be computer-readable instructions, data structures, modules of programs, or other data. Examples of computer storage media include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, CD-ROM, digital versatile optical disc (DVD) or other optical storage, magnetic tape, magnetic disk storage or other magnetic storage devices, or any other non-transferable medium configured to store information accessible by a computing device. As defined herein, computer-readable media does not include transient computer-readable media, such as modulated data signals and carrier waves.

[0128] It should also be noted that the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such process, method, article, or apparatus. Unless otherwise specified, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes that element.

[0129] As can be seen from the above description, the embodiments of this disclosure achieve the following technical effects:

[0130] 1) The security protection method based on system logs disclosed herein first obtains the system logs of the business system and generates business system behavior based on the system logs. The system logs include at least user accounts, IP addresses, function names, and function runtimes. The function name is the name of the system function when it is called within the business system, and the function runtime is the time when the system function starts running. The business system behavior is configured to describe the calling order of the system functions. Then, a business behavior model is used to determine whether there are any anomalies in the business system behavior. The business behavior model is configured to describe the behavior that the business system should exhibit under normal use. Finally, if there are anomalies in the business system behavior, anomaly information is generated, and corresponding handling measures are taken based on the anomaly information. The handling measures include at least blocking the IP address currently accessing the business system and slowing down the access speed of the IP address. This disclosure generates business system behavior by recording logs at key locations in the business system, and then analyzes the generated business system behavior based on the business behavior model. If the business system behavior is determined to be abnormal, the handling function of the business system is triggered, and the corresponding access IP address is handled. This disclosure solves the problem that unknown security vulnerabilities in existing systems are difficult to detect and handle.

[0131] 2) The security protection device based on system logs disclosed herein includes a generation unit configured to acquire system logs of the business system and generate business system behavior based on the system logs. The system logs include at least user account, IP address, function name, and function runtime. The function name is the name of the system function when it is called within the business system, and the function runtime is the time the system function starts running. The business system behavior is configured to describe the calling order of the system functions. A judgment unit is configured to use a business behavior model to determine whether the business system behavior is abnormal. The business behavior model is configured to describe the behavior that the business system should exhibit under normal use. A handling unit is configured to generate abnormal information when the business system behavior is abnormal and take corresponding handling measures based on the abnormal information. The handling measures include at least blocking the IP address currently accessing the business system and slowing down the access speed of the IP address. This disclosure generates business system behavior by recording logs at key locations in the business system, and then analyzes the generated business system behavior based on the business behavior model. If the business system behavior is determined to be abnormal, the handling function of the business system is triggered, and the corresponding access IP address is handled. This disclosure addresses the problem that unknown security vulnerabilities in existing systems are difficult to detect and handle.

[0132] The above description is merely a preferred embodiment of this disclosure and is not intended to limit this disclosure. Various modifications and variations can be made to this disclosure by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this disclosure should be included within the scope of protection of this disclosure.

Claims

1. A security protection method based on system logs, wherein, The method includes: Obtain the system logs of the business system and generate business system behavior based on the system logs. The system logs include at least the user account, IP, function name, and function run time. The function name is the name of the system function when it is called within the business system. The function run time is the time when the system function starts running. The business system behavior is configured to describe the calling order of the system functions. The business behavior model is used to determine whether there are any anomalies in the behavior of the business system. The business behavior model is configured to describe the behavior that the business system should have under normal use. In the event of abnormal behavior in the business system, anomaly information is generated, and corresponding handling measures are taken based on the anomaly information. The handling measures include at least blocking the IP currently accessing the business system and slowing down the access speed of the IP.

2. The method according to claim 1, wherein, Obtain the system logs of the business system, and generate business system behaviors based on the system logs, including: The running time and function name corresponding to the IP are recorded level by level to obtain the function timing sequence, and one IP corresponds to one function timing sequence; The corresponding business system behavior is generated based on the IP address, the function timing, and the integrity check value. The integrity check value is a data value obtained by encrypting the IP address and the function timing. One integrity check value corresponds to one IP address.

3. The method according to claim 2, wherein, Before generating the corresponding business system behavior based on the IP address, the function timing, and the integrity check value, the method further includes: The IP address and the functional timing sequence are converted into a fixed-length numerical value using a cryptographic algorithm to obtain the integrity verification value.

4. The method according to claim 1, wherein, Before using the business behavior model to determine whether there are any anomalies in the behavior of the business system, the method further includes: Using system functions as nodes and the calling order between any two system functions as directed edges, a state sequence is established, which is configured to describe the calling relationship of the system functions. The weight of the directed edge is obtained by calculating the ratio of the first count to the second count. The first count is the number of times the second system function is called after the first system function is called, and the second count is the number of times the remaining system functions are called after the first system function is called. The weight represents the probability of calling the second system function after the first system function is called. The first system function is the value corresponding to the starting node of the directed edge. The system functions are as follows: the second system function is the system function corresponding to the terminal node of the directed edge; the remaining system functions are other system functions besides the first system function. The business behavior model is formed based on the state sequence and the weights corresponding to the directed edges.

5. The method according to claim 4, wherein, The business behavior model is used to determine whether there are any anomalies in the behavior of the business system, including: Match the invocation order of the business system behavior with the invocation order in the business behavior model; If the business system behavior does not match the call order of the business behavior model, it is determined that the business system behavior has the anomaly. If the business system behavior matches the call order of the business behavior model, it is determined that the business system behavior does not have the anomaly.

6. The method according to claim 4, wherein, Determining whether anomalies exist in the behavior of the business system using a business behavior model also includes: The target weight is compared with the weight threshold, where the target weight is the weight on the directed edge corresponding to the calling order of the business system behavior; If the target weight is less than the weight threshold, it is determined that the business system behavior has the anomaly. If the target weight is greater than or equal to the weight threshold, it is determined that the business system behavior does not have the abnormality.

7. A security protection device based on system behavior, wherein, The device includes: The generation unit is configured to obtain the system logs of the business system and generate business system behaviors based on the system logs. The system logs include at least user account, IP, function name, and function run time. The function name is the name of the system function when it is called within the business system. The function run time is the time when the system function starts running. The business system behaviors are configured to describe the calling order of the system functions. The judgment unit is configured to use a business behavior model to determine whether there is an anomaly in the behavior of the business system. The business behavior model is configured to describe the behavior that the business system should have under normal use. The processing unit is configured to generate exception information when the behavior of the business system is abnormal. The system will take corresponding measures based on the abnormal information. These measures include at least blocking the IP address currently accessing the business system and slowing down the access speed of the IP address.

8. A computer-readable storage medium, wherein, The computer-readable storage medium includes a stored program, wherein, when the program is executed, it controls the device on which the computer-readable storage medium is located to perform the method according to any one of claims 1 to 6.

9. A security protection system, wherein, include: One or more processors, a memory, and one or more programs, wherein the one or more programs are stored in the memory and configured to be executed by the one or more processors, the one or more programs including being configured to perform the method of any one of claims 1 to 6.

10. A computer program product comprising computer instructions, wherein, When executed by a processor, the computer instructions implement the method described in any one of claims 1 to 6.

Images