CN115589317A - Instruction processing method and device, electronic equipment and nonvolatile storage medium - Google Patents

Abstract

The present application discloses an instruction processing method, device, electronic equipment and non-volatile storage medium. Wherein, the method includes: acquiring a network command detected by the target monitoring task, wherein the network command is a network command generated by a network device, and the target monitoring task is at least used to monitor the risk of the login account of the network device; the network command is a risk command In the case of a risky instruction, the network instruction is processed according to the disposal rules corresponding to the risk instruction; in the case of a non-risk instruction, it is judged whether the network instruction is a suspicious risk instruction; Next, determine the judgment rule corresponding to the network instruction, and judge the risk of the network instruction according to the judgment rule. The present application solves the technical problem of low efficiency in the prior art that manually checks the security of network instructions generated by network equipment.

Description

Instruction processing method, device, electronic device, and nonvolatile storage medium

technical field

The present application relates to the technical field of data operation and maintenance, and in particular, relates to an instruction processing method, device, electronic equipment, and non-volatile storage medium.

Background technique

Various operations of MAN network equipment are related to thousands of households surfing the Internet. Therefore, it is necessary to ensure the safe execution of security instructions. Under the premise of continuous expansion of network scale and continuous deepening of command automation work, how to ensure the safe and efficient automatic execution of various commands is particularly important. The prior art generally adopts a manual checking method to check the security of operation instructions of network devices. However, the manual checking method has problems of low efficiency and inflexibility.

For the above problems, no effective solution has been proposed yet.

Contents of the invention

The embodiment of the present application provides a command processing method, device, electronic equipment, and non-volatile storage medium, so as to at least solve the problem of using manual checks on the security of network commands generated by network devices in the prior art, and there is a low-efficiency technology question.

According to an aspect of an embodiment of the present application, a method for processing instructions is provided, including: acquiring network instructions detected by a target monitoring task, wherein the network instructions are network instructions generated by network devices, and the target monitoring task is at least used to monitor the network Risk monitoring is performed on the login account of the device; when the network command is a risk command, the network command is processed according to the disposal rules corresponding to the risk command; when the network command is a non-risk command, it is judged whether the network command is suspicious of risk Instructions; when the judgment result indicates that the network instruction is a suspicious risk instruction, determine a judgment rule corresponding to the network instruction, and perform risk judgment on the network instruction according to the judgment rule.

Optionally, the network instruction is processed according to the disposal rules corresponding to the risk instruction, including: determining the life stage of the risk instruction to which the network instruction belongs; When the stage is the life transition period, send the network instruction to the target object for confirmation; when the life stage is the end of life period, store the network instruction in the area to be confirmed.

Optionally, determining the life stage of the risky instruction to which the network instruction belongs includes: determining that the network instruction is in the initial life stage when the network instruction enters the set area for the first time; the probability that the network instruction in the set area is a risk instruction is lower than When the first threshold is reached, it is determined that the network instruction is in the life transition period; when the duration of the network instruction in the life transition period exceeds the second threshold, it is determined that the network instruction is in the life history period; In the case of a change, it is determined that the network command enters the end of life period; when the network command is in the life transition period and the life history period in the set area, and is hit by an alarm, it is determined that the network command re-enters the initial life period.

Optionally, judging whether the network instruction is a suspicious risk instruction includes: obtaining a regular matching expression in the database; performing regular matching on the network instruction and the regular matching expression; and determining that the network instruction is a suspicious risk instruction if the risk keyword is matched instruction.

Optionally, determining the judgment rule corresponding to the network instruction includes: obtaining path depth information of the network instruction, wherein the path depth information is used to indicate information of the directory path where the network instruction is located; judging according to the path depth information and the risk depth of the instruction Standards, classify network commands to obtain the risk scenario category to which the network command belongs. Among them, the judgment standard of the command risk depth is at least determined by the device type and depth identifier of the network device; Corresponding judgment rules.

Optionally, performing a risk judgment on the network instruction according to the judgment rule includes: when the risk scenario category is the first category, monitoring whether there is an association between the network device corresponding to the network instruction and the network device that generated the alarm; In the case of , it is determined that the network command of the first category is risky; in the case of the risk scenario category of the second category, the network command is sent to the target object, and the judgment result returned by the target object is received, wherein the judgment result is used to indicate Whether there is an association relationship between the network device corresponding to the network instruction and the network device that generated the alarm; if the judgment result indicates that there is an association relationship, determine that the network instruction of the second category is at risk; if the risk scenario category is the third category, According to the corresponding relationship of historical commands, the risk judgment is made on the relationship between the network device corresponding to the network command and the network device that generates the alarm. Correspondence among them; in the case that the risk determination result indicates that there is an association relationship, it is determined that the network instruction of the third category has a risk.

Optionally, after judging the risk of the network instruction according to the judgment rule, the method further includes: storing the network instruction that hits the risk instruction or the risk suspicious instruction in the database, and periodically performing the target object corresponding to the network instruction in the database Error statistics to obtain the error records corresponding to the target object, wherein the error records are determined by at least one of the following: the number of network commands in the early life, the number of network commands in the transition period of life, and the number of network commands in the end of life Quantity; when the value corresponding to the error record exceeds the third threshold, the target object corresponding to the error record is marked as the first type of user, wherein, the first type of user is used to indicate that the target object is a high-risk user; when the first type of user meets In the case of preset conditions, the first type of user is marked as the second type of user, wherein the second type of user is used to indicate that the target object is a non-high-risk user, and the preset condition is that the first type of user is marked as The second type of users.

According to another aspect of the embodiment of the present application, there is also provided an instruction processing device, including: an acquisition module, configured to acquire a network instruction detected by a target monitoring task, wherein the network instruction is a network instruction generated by a network device, and the target The monitoring task is at least used to monitor the risk of the login account of the network device; the processing module is used to process the network command according to the disposal rules corresponding to the risk command when the network command is a risk command; the judgment module is used to When the network instruction is a non-risk instruction, judge whether the network instruction is a suspicious risk instruction; the determination module is used to determine the judgment rule corresponding to the network instruction when the judgment result indicates that the network instruction is a suspicious risk instruction, and according to the judgment The rules make risk judgments on network instructions.

According to yet another aspect of the embodiments of the present application, there is also provided an electronic device, including: a memory for storing program instructions; a processor connected to the memory for executing the program instructions for realizing the following functions: acquiring target monitoring task detection The network instruction received, wherein, the network instruction is the network instruction generated by the network device, and the target monitoring task is at least used to monitor the risk of the login account of the network device; if the network instruction is a risk instruction, according to the corresponding disposal of the risk instruction The rules process the network instruction; if the network instruction is a non-risk instruction, judge whether the network instruction is a suspicious risk instruction; if the judgment result indicates that the network instruction is a suspicious risk instruction, determine the judgment rule corresponding to the network instruction, And according to the judgment rules, the risk judgment of the network instruction is carried out.

According to still another aspect of the embodiments of the present application, there is also provided a non-volatile storage medium, the non-volatile storage medium includes a stored computer program, wherein the device where the non-volatile storage medium is located runs the computer program Execute the processing method of the above command.

In the embodiment of the present application, the network instruction detected by the target monitoring task is obtained, wherein the network instruction is a network instruction generated by the network device, and the target monitoring task is at least used to monitor the risk of the login account of the network device; when the network instruction is In the case of a risky command, process the network command according to the disposal rules corresponding to the risky command; if the network command is a non-risk command, judge whether the network command is a suspicious risk command; if the judgment result indicates that the network command is a suspicious risk command In the case of a network command, determine the judgment rule corresponding to the network command, and judge the risk of the network command according to the judgment rule, so as to achieve the purpose of improving the efficiency of risk identification of the network command, thereby realizing the technical effect of dynamic judgment of the risk command, Furthermore, the prior art solves the technical problem that the security of the network instructions generated by the network equipment is manually checked, and the efficiency is low.

Description of drawings

The drawings described here are used to provide a further understanding of the application and constitute a part of the application. The schematic embodiments and descriptions of the application are used to explain the application and do not constitute an improper limitation to the application. In the attached picture:

Fig. 1 is a hardware structural block diagram of a computer terminal (or electronic device) for implementing a processing method of an instruction according to an embodiment of the present application;

FIG. 2 is a flow chart of an instruction processing method according to an embodiment of the present application;

FIG. 3 is a structural diagram of an instruction processing device according to an embodiment of the present application;

FIG. 4 is a schematic diagram of a judgment flow of a risk instruction according to an embodiment of the present application;

Fig. 5 is a schematic diagram of a marking process of risk personnel according to an embodiment of the present application.

detailed description

In order to enable those skilled in the art to better understand the solution of the present application, the technical solution in the embodiment of the application will be clearly and completely described below in conjunction with the accompanying drawings in the embodiment of the application. Obviously, the described embodiment is only It is an embodiment of a part of the application, but not all of the embodiments. Based on the embodiments in this application, all other embodiments obtained by persons of ordinary skill in the art without creative efforts shall fall within the scope of protection of this application.

It should be noted that the terms "first" and "second" in the description and claims of the present application and the above drawings are used to distinguish similar objects, but not necessarily used to describe a specific sequence or sequence. It is to be understood that the data so used are interchangeable under appropriate circumstances such that the embodiments of the application described herein can be practiced in sequences other than those illustrated or described herein. Furthermore, the terms "comprising" and "having", as well as any variations thereof, are intended to cover a non-exclusive inclusion, for example, a process, method, system, product or device comprising a sequence of steps or elements is not necessarily limited to the expressly listed Those steps or elements may instead include other steps or elements not explicitly listed or inherent to the process, method, product or apparatus.

The embodiment of the instruction processing method provided in the embodiment of the present application may be executed in a mobile terminal, a computer terminal or a similar computing device. FIG. 1 shows a block diagram of a hardware structure of a computer terminal (or electronic device) for implementing a method for processing instructions. As shown in Figure 1, the computer terminal 10 (or electronic device 10) may include one or more (shown by 102a, 102b, ..., 102n in the figure) processors (processors may include but not limited to microprocessors) MCU or a processing device such as a programmable logic device FPGA), a memory 104 for storing data, and a transmission module 106 for communication functions. In addition, it can also include: a display, an input/output interface (I/O interface), a universal serial bus (USB) port (which can be included as one of the ports of the I/O interface), a network interface, a power supply and/or camera. Those of ordinary skill in the art can understand that the structure shown in FIG. 1 is only a schematic diagram, and it does not limit the structure of the above-mentioned electronic device. For example, computer terminal 10 may also include more or fewer components than shown in FIG. 1 , or have a different configuration than that shown in FIG. 1 .

It should be noted that the one or more processors and/or other data processing circuits described above may generally be referred to herein as "data processing circuits". The data processing circuit may be implemented in whole or in part as software, hardware, firmware or other arbitrary combinations. In addition, the data processing circuit can be a single independent processing module, or be fully or partially integrated into any of the other elements in the computer terminal 10 (or electronic equipment). As mentioned in the embodiment of the present application, the data processing circuit is used as a processor control (for example, the selection of the terminal path of the variable resistor connected to the interface).

The memory 104 can be used to store software programs and modules of application software, such as the program instruction/data storage device corresponding to the instruction processing method in the embodiment of the present application, and the processor runs the software programs and modules stored in the memory 104 to execute Various functional applications and data processing are the processing methods for realizing the above-mentioned instructions. The memory 104 may include high-speed random access memory, and may also include non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory 104 may further include a memory that is remotely located relative to the processor, and these remote memories may be connected to the computer terminal 10 through a network. Examples of the aforementioned networks include, but are not limited to, the Internet, intranets, local area networks, mobile communication networks, and combinations thereof.

The transmission module 106 is used to receive or send data via a network. The specific example of the above-mentioned network may include a wireless network provided by the communication provider of the computer terminal 10 . In one example, the transmission device 106 includes a network interface controller (NIC), which can be connected to other network devices through a base station so as to communicate with the Internet. In one example, the transmission device 106 may be a radio frequency (Radio Frequency, RF) module, which is used to communicate with the Internet in a wireless manner.

The display may be, for example, a touchscreen liquid crystal display (LCD), which may enable a user to interact with the user interface of the computer terminal 10 (or electronic device).

It should be noted here that, in some optional embodiments, the computer equipment (or electronic equipment) shown in FIG. 1 may include hardware components (including circuits), software components (including computer code), or a combination of both hardware and software elements. It should be noted that FIG. 1 is only one example of a particular embodiment, and is intended to illustrate the types of components that may be present in the computer device (or electronic device) described above.

Under the above-mentioned operating environment, the embodiment of the present application provides an embodiment of a method for processing instructions. It should be noted that the steps shown in the flowcharts of the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions , and, although a logical order is shown in the flowcharts, in some cases the steps shown or described may be performed in an order different from that shown or described herein.

Fig. 2 is a flow chart of an instruction processing method according to an embodiment of the present application. As shown in Fig. 2, the method includes the following steps:

Step S202, acquiring a network command detected by the target monitoring task, wherein the network command is a network command generated by a network device, and the target monitoring task is at least used for risk monitoring of a login account of the network device.

In this embodiment of the application, the operator logs in his or her own account on the network device to log in the account, takes the account login as a trigger event, collects the operator's account information and the device information for logging into the network device, and stores the device information and account information As a monitoring identifier, a monitoring task corresponding to the monitoring identifier is formed, that is, the above-mentioned target monitoring task, and a network instruction generated by tracking the network device logged in by the operator is triggered, and risk marking is performed on the login account.

Step S204, if the network instruction is a risk instruction, process the network instruction according to the handling rule corresponding to the risk instruction.

In the above steps, the network command detected in real time by the target monitoring task is used to determine whether the network command (hereinafter referred to as the network command) generated by the network device in real time matches the risk command. The risk command is the risk determined by the risk response rules. For the command, if the judgment result is yes, that is, if the network command is a risk command, the network command is processed according to the risk response handling rules corresponding to the risk command.

Step S206, if the network instruction is a non-risk instruction, determine whether the network instruction is a suspicious risk instruction.

In the above step S206, if it is determined that the network instruction does not match the risk instruction, that is, if the network instruction is a non-risk instruction, it is determined whether the network instruction is a suspicious risk instruction, and the network instruction is compared with the pre-established The risk instruction regular matching keyword regular matching formula included in the data model library performs regular matching to determine whether the network instruction is a suspicious risk instruction.

Step S208, if the judgment result indicates that the network instruction is a suspicious risk instruction, determine a judgment rule corresponding to the network instruction, and perform risk judgment on the network instruction according to the judgment rule.

In the above step S208, if it is determined that the network instruction is a risky instruction, the path depth information of the network instruction is obtained, and the path depth information of the network instruction and the pre-established instruction risk depth (the directory path where the instruction is located) are determined. According to the standard, the network instructions are classified, and the risk judgment of the network instructions is carried out according to the judgment rules corresponding to different categories.

In step S204 of the above command processing method, the network command is processed according to the disposal rules corresponding to the risk command, specifically including the following steps: determining the life stage of the risk command to which the network command belongs; when the life stage is the initial life stage , to roll back the network command; if the life stage is the life transition period, send the network command to the target object for confirmation; if the life stage is the end of life period, store the network command in the area to be confirmed.

In the embodiment of the present application, after determining that the acquired network instruction is a risk instruction, risk response and disposal rules are established according to the conditions satisfied by the network instruction. Specifically, it is necessary to determine the life stage of the risky instruction to which the network instruction belongs. The life stage may include but not limited to the initial stage of life, the transitional stage of life, the end of life stage, and the historical stage of life. The network equipment involved in the instruction will automatically fall back the risky network instruction, and the notification method includes but is not limited to the SMS. For a network instruction whose risk is determined to be in the life transition period, the network instruction is sent to a target object for confirmation. The target object may be a maintenance personnel, and the sending method may be, for example, a short message notification. For the network commands whose risk judgment is at the end of life, the relevant network commands are stored in the area to be confirmed. The area to be confirmed is a 24-hour area to be checked and confirmed, which is convenient for experts to carry out manual evaluation later.

In the above steps, determining the life stage of the risky command to which the network command belongs specifically includes the following steps: when the network command enters the set area for the first time, it is determined that the network command is in the early stage of life; the network command in the set area is a risk command When the probability of is lower than the first threshold, it is determined that the network instruction is in the life transition period; when the duration of the network instruction in the life transition period exceeds the second threshold, it is determined that the network instruction is in the life history period; If the preset duration has not changed, it is determined that the network command has entered the end of life period; if the network command is in the life transition period and life history period in the set area, and is hit by the alarm, it is determined that the network command re-enters the initial life period .

In the embodiment of this application, after obtaining the network command, it is necessary to perform risk judgment on the network command. The judgment methods include risk command judgment and risk suspicious command judgment. After the network command enters the risk judgment, the whole process adopts a cycle management method. Specifically, The network command entering the set area for the first time is in the early stage of life, and this set area can also be called the judgment area; after risk judgment, the network command whose risk hit rate in the set area is lower than the first threshold will enter the life During the transition period, the risk hit rate is the probability of judging that the network command is a risk command; for a network command whose life transition period exceeds the second threshold, the network command enters the life history period; if the network command in the life history period lasts for a preset duration If there is no state change in the time, the network command will enter the end of life period; for the network command in the set area that is in the life transition period and life history period, and is activated by the warning hit, the network command will re-enter the early life period . According to the judgment criteria of the above-mentioned different periods, the risk instructions judged by the existing risk response and disposal rules are updated in real time.

In step S206 of the above instruction processing method, it is judged whether the network instruction is a suspicious risk instruction, which specifically includes the following steps: obtaining the regular matching expression in the database; performing regular matching on the network instruction and the regular matching expression; In the case of words, the network instruction is determined as a risky suspicious instruction.

In the embodiment of the present application, if it is determined that the network instruction does not match the risk instruction, that is, if the network instruction is a non-risk instruction, it is determined whether the network instruction is a suspicious risk instruction. Specifically, a risk instruction set is established for each network device in advance, and in the risk instruction set, the commonly used risk instructions are formed into regular matching (using a single character string to describe, matching a string of syntax rules) text , so as to form a risk instruction regular matching data model library (which may be referred to as a database for short). The network command is regularly matched with the keyword regular matching formula contained in the pre-established risk command regular matching data model library, so as to determine whether the network command is a suspicious risk command. When the risk keyword is matched, the network command is characterized as a suspicious risk command; otherwise, the network command is not a suspicious risk command.

In step S208 of the above command processing method, determining the judgment rule corresponding to the network command specifically includes the following steps: obtaining path depth information of the network command, wherein the path depth information is used to indicate the information of the directory path where the network command is located ; According to the path depth information and the judgment standard of the command risk depth, the network command is classified to obtain the risk scenario category to which the network command belongs, wherein the judgment standard of the command risk depth is at least determined by the device type and depth identification of the network device; The risk scenario category to which the command belongs determines the judgment rule corresponding to the network command.

In the embodiment of the present application, in the case of judging that the network instruction is a risky instruction, the path depth information of the network instruction is obtained, and the decision is made based on the path depth information of the network instruction and the pre-established instruction risk depth (directory path where the instruction is located) According to the standard, the network instructions are classified to obtain the risk scenario category to which the network instruction belongs. In the embodiment of this application, three risk scenario categories can be included, which are the first category (real-time judgment risk group), the second category (after-event expert Judgment risk group) and the third category (big data judgment risk group), so as to determine the judgment rule corresponding to the network command according to the risk scenario category to which the network command belongs. It should be noted that the above-mentioned pre-established criterion for judging the depth of command risk can be based on establishing a dynamic query for device resource network management to form a variable-length "device type + depth identifier" device command depth judging rule.

In step S208 of the above command processing method, the risk judgment of the network command is carried out according to the judgment rules, which specifically includes the following steps: in the case that the risk scenario category is the first category, the network device corresponding to the network command is monitored and the alarm is generated. Whether there is an association relationship between network devices; if there is an association relationship, determine that the first category of network instructions is risky; if the risk scenario category is the second category, send the network instruction to the target object, and receive the return from the target object The judgment result, wherein, the judgment result is used to indicate whether there is an association relationship between the network device corresponding to the network instruction and the network device that generated the alarm; if the judgment result indicates that there is an association relationship, it is determined that the network instruction of the second category is at risk; When the risk scenario category is the third category, the risk judgment is made on the relationship between the network device corresponding to the network command and the network device that generated the alarm according to the corresponding relationship of the historical command, where the corresponding relationship of the historical command is the historical network command The corresponding relationship between the corresponding network device and the network device with historical alarms; if the risk determination result indicates that there is an association relationship, it is determined that the third category of network instructions is risky.

In this embodiment of the application, the risk judgment rule of the network command in the real-time judgment risk group corresponding to the first category is real-time judgment, specifically: storing the network command in the setting area (ie, the judgment area), monitoring and network command Whether there is a relationship between the corresponding network device and the network device that generates the real-time alarm. If there is a relationship, it means that a risk instruction is hit, that is, a network instruction belonging to the first category is at risk.

The post-event expert judgment risk judgment rules for network commands in the risk group corresponding to the second category are manually judged by experts, specifically: store the network commands in the setting area (ie, the judgment area), and send the network commands to the target object , the target object can be an expert, etc., and periodically the expert will centrally judge whether there is a relationship between the network device corresponding to the network command in the set area and the network device that generates the real-time alarm, and receive the judgment result returned by the expert. If the judgment result indicates that there is In the case of an association relationship, it means that a risky instruction is hit, that is, the network instructions of the second category are at risk.

The risk judgment rules of the network commands in the big data judgment risk group corresponding to the third category are determined by the K-Means clustering algorithm, specifically: store the network commands in the setting area (i.e. the judgment area), according to various The big data formed by the risk instruction rules uses the K-Means clustering algorithm to record the corresponding relationship of historical commands, and according to the corresponding relationship of historical commands, the network equipment corresponding to the network instruction and the network equipment that generates the alarm are judged for risk correlation. When the result indicates that there is an association relationship, it means that a risky instruction is hit, that is, the network instruction of the third category is at risk.

In the above instruction processing method, after the risk judgment is made on the network instruction according to the judgment rule, the method further includes the following steps: storing the network instruction that hits the risk instruction or the risk suspicious instruction into the database, and checking the corresponding network instruction in the database. The target object performs periodic error statistics to obtain error records corresponding to the target object. The error record is determined by at least one of the following: the number of network commands in the early life, the number of network commands in the transition period of life, and the number of network commands in the life cycle. The number of network instructions in the end period; when the value corresponding to the error record exceeds the third threshold, mark the target object corresponding to the error record as the first type of user, wherein the first type of user is used to indicate that the target object is a high-risk user; When the first type of user meets the preset conditions, the first type of user is marked as the second type of user, where the second type of user is used to indicate that the target object is a non-high-risk user, and the preset condition is that the first type of user continues to Preset periods are marked as a second type of user.

In the embodiment of the present application, after the risk judgment is made on the network command, it is also necessary to mark the personnel risk on the operator, that is, store the network command that hits the risk command or the risk suspicious command into the historical hit database (that is, the above-mentioned database), and The target object (ie, the operator) corresponding to the network command in the historical hit library performs periodic error statistics, for example, on a monthly basis, and calculates the error record corresponding to the target object according to the following weighting formula: the number of network commands in the early stages of life* A + the number of network commands in the life transition period * B + the number of network commands in the end of life period * C + impact events * D, (A, B, C, D are weight values, which can be specified by experience value), forming a target The audit work of the object (ie, the operator), the impact event in the above formula generally refers to the failure event. Those whose error records exceed the third threshold are marked as the first type of users, that is, high-risk users or high-risk personnel; otherwise, they are marked as the second type of users, that is, non-high-risk users or non-high-risk personnel. The operation instructions of high-risk operators marked as the first type of users need to be manually approved in real time, so as to facilitate real-time personnel control. For the audit, the first type of users (that is, high-risk personnel) are marked as the second type of users (that is, non-high-risk personnel) in a continuous preset period (if the statistics are calculated on a monthly basis, the preset period can be set to two months, for example). , the first type of user is marked as the second type of user, that is, the identification of high-risk personnel is changed to a non-high-risk identification.

The embodiment of this application starts from the risk command identification and risk command audit of metropolitan area network equipment, and provides a command processing method, which aims to improve the efficiency and flexibility of risk identification for network commands, and realize the dynamic learning of risk identification , Interactive classification adjustment. This method is based on risk instructions, combined with the combination of instruction depth and equipment type to form automatic risk identification, and then enters the risk response area, combined with expert research and judgment and real-time alarm linkage, forms a risk response life-long management and control process, and realizes efficient research and judgment of risk instructions. And form a dynamic generation of risk orders and an organic exit mechanism to achieve the purpose of precise control. In addition, through the audit and identification of job numbers with high-risk operation orders, a high-risk order judgment will be formed for a future prediction, and an effective intervention process for manual approval will be suggested to provide a benchmark for future predictions of risk audits and minimize risks. become possible.

FIG. 3 is a structural diagram of an instruction processing device according to an embodiment of the present application. As shown in FIG. 3 , the device includes:

The acquisition module 302 is configured to acquire network instructions detected by the target monitoring task, wherein the network instructions are network instructions generated by network devices, and the target monitoring task is at least used for risk monitoring of login accounts of network devices;

A processing module 304, configured to process the network instruction according to the handling rules corresponding to the risk instruction if the network instruction is a risk instruction;

A judging module 306, configured to judge whether the network command is a suspicious risk command when the network command is a non-risk command;

The determining module 308 is configured to determine a judgment rule corresponding to the network instruction when the judgment result indicates that the network instruction is a risky instruction, and perform risk judgment on the network instruction according to the judgment rule.

In the processing module in the above instruction processing device, the network instruction is processed according to the disposal rules corresponding to the risk instruction, specifically including the following process: determining the life stage of the risk instruction to which the network instruction belongs; when the life stage is the initial stage of life , to roll back the network command; if the life stage is the life transition period, send the network command to the target object for confirmation; if the life stage is the end of life period, store the network command in the area to be confirmed.

In the processing module of the above instruction processing device, the life stage of the risk instruction to which the network instruction belongs is determined, specifically including the following process: when the network instruction enters the setting area for the first time, it is determined that the network instruction is in the initial stage of life; When the probability that the network instruction in the network instruction is a risk instruction is lower than the first threshold, it is determined that the network instruction is in the life transition period; when the duration of the network instruction in the life transition period exceeds the second threshold, it is determined that the network instruction is in the life history period; If the network command in the life history period has not changed for the preset duration, it is determined that the network command has entered the end of life period; if the network command in the life transition period and life history period in the set area is hit by the alarm, Determining network directives to re-enter early life.

In the judging module in the above instruction processing device, it is judged whether the network instruction is a suspicious risk instruction, which specifically includes the following process: obtaining the regular matching formula in the database; performing regular matching on the network command and the regular matching formula; In the case of words, the network instruction is determined as a risky suspicious instruction.

In the determination module in the above instruction processing device, determine the judgment rule corresponding to the network instruction, specifically including the following process: obtaining the path depth information of the network instruction, wherein the path depth information is used to represent the information of the directory path where the network instruction is located ; According to the path depth information and the judgment standard of the command risk depth, the network command is classified to obtain the risk scenario category to which the network command belongs, wherein the judgment standard of the command risk depth is at least determined by the device type and depth identification of the network device; The risk scenario category to which the command belongs determines the judgment rule corresponding to the network command.

In the determination module in the above-mentioned command processing device, the risk judgment is performed on the network command according to the judgment rule, specifically including the following process: in the case that the risk scene category is the first category, the network device corresponding to the network command is monitored and the alarm is generated. Whether there is an association relationship between network devices; if there is an association relationship, determine that the first category of network instructions is risky; if the risk scenario category is the second category, send the network instruction to the target object, and receive the return from the target object The judgment result, wherein, the judgment result is used to indicate whether there is an association relationship between the network device corresponding to the network instruction and the network device that generated the alarm; if the judgment result indicates that there is an association relationship, it is determined that the network instruction of the second category is at risk; When the risk scenario category is the third category, the risk judgment is made on the relationship between the network device corresponding to the network command and the network device that generated the alarm according to the corresponding relationship of the historical command, where the corresponding relationship of the historical command is the historical network command The corresponding relationship between the corresponding network device and the network device with historical alarms; if the risk determination result indicates that there is an association relationship, it is determined that the third category of network instructions is risky.

In the above-mentioned instruction processing device, the device also includes a statistics module 310, which is used to store network instructions that hit risk instructions or risk suspicious instructions into the database, and perform periodic According to the comprehensive error statistics, the error records corresponding to the target objects are obtained, and the error records are determined by at least one of the following: the number of network commands in the early stage of life, the number of network commands in the transition period of life, and the number of network commands in the end of life period. The number of instructions; when the value corresponding to the error record exceeds the third threshold, the target object corresponding to the error record is marked as the first type of user, wherein, the first type of user is used to indicate that the target object is a high-risk user; in the first type When the user satisfies the preset condition, the first type of user is marked as the second type of user, wherein the second type of user is used to indicate that the target object is a non-high-risk user, and the preset condition is that the first type of user has been Marked as a second type of user.

It should be noted that the instruction processing device shown in FIG. 3 is used to execute the instruction processing method shown in FIG. 2 , therefore, the relevant explanations in the above instruction processing method are also applicable to the instruction processing device, here No longer.

Fig. 4 is a schematic diagram of a judgment process of a risk instruction according to an embodiment of the present application. As shown in Fig. 4 , the operator logs in his or her own account on the network device, and conducts a personnel audit on the currently logged-in operator to judge Whether it is a marked user (including a high-risk user or a non-high-risk user), and determine whether the network instruction generated by the network device logged in by the operator is a risk instruction. In the case of determining that the network command generated by the network device logged in by the operator is not a risk command, it is necessary to determine whether the network command is a suspicious risk command, that is, to regularly match the network command with the pre-established risk command. The word regular matching formula performs regular matching of risky instructions. When a risky keyword is matched, it indicates that the network instruction is a risky and suspicious instruction; otherwise, it indicates that the network instruction is not a risky and suspicious instruction. If the risk keyword is matched, obtain the path depth information of the network command, classify the path depth of the network command, classify the network command according to the path depth information and the judgment standard of the command risk depth, and obtain the risk scenario to which the network command belongs Category, the risk scenario category includes the first category, the second category, and the third category. Different risk scenarios use different judgment principles. Specifically, the first category uses alarm correlation for risk judgment, and the second category uses experts for risk judgment. , the third category uses big data for risk determination. If the network command satisfies one of the above categories, it can be understood that the network command is a risk command, and enter the risk response link.

When it is determined that the network command generated by the network device logged in by the operator is a risk command, the network command is processed through the risk response and disposal rules corresponding to the risk command. In the risk response, the risk command to which the network command belongs is defined. Life stages, including the initial stage of risk instruction life, the life transition period of risk instruction, the life history period of risk instruction, and the end of life of risk instruction. After determining the life stage of the risk command to which the network command belongs, according to the conditions satisfied by the network command, establish risk response and disposal rules, that is, for the response to the initial life of the risk command, the response to the transition period of the life of the risk command, and the response to the life history of the risk command, according to After judging the risk of the network command and dealing with it by the judgment rule, it is necessary to mark the risk personnel and update the mark of the operator.

In the link of risk response, for each network device, build a risk command regular matching data model library based on device type, use account login as a trigger event, and divide the text echoed by the command into a command part and a path part:

For example: <JX-NC-XJX-BAS-3.MAN.NE40E-X16> is the shallowest directory;

[JX-NC-XJX-BAS-3.MAN.NE40E-X16] is the configuration directory;

[JX-NC-XJX-BAS-3.MAN.NE40E-X16-bgp] is to enter the bgp configuration directory;

[JX-NC-XJX-BAS-3.MAN.NE40E-X16-bgp-CTVPN3001007-JXjianhang] The vpn entered into the bgp configuration directory is the deep directory of CTVPN3001007-JXjianhang.

By analogy, the path part, the command part and the device type are combined to form a configuration command.

In the link of risk treatment, for each combination of instructions in the process of execution, it enters the risk response matching, and if it matches the existing risk response rules, it directly enters the risk treatment. If it does not match the existing risk response rules, then determine whether the network command is a risk-free command.

Risk disposal combines initial response to risk, response to risk transition period, and response to risk history period. The disposal methods are as follows:

For risk commands that do not match the existing risk response rules, first enter the alarm judgment, and whether there is an alarm association in the time-sensitive area for the commands corresponding to this device or other related devices. If there is an alarm connection, it will form a risk command and enter the risk response in the early stage of life, and the response method is as above; if there is no alarm connection, it will enter expert judgment. Experts judge whether the commands corresponding to this device or other related devices have alarm associations in the time-sensitive area. If there is an alarm association, it will form a risk command and enter the risk response at the early stage of life, and the response method is as above; if there is no alarm association, it will enter the big data judgment. Big data judgment uses the K-Means clustering algorithm to record the command correspondence of the historical command combination (composed of the combination deposition before the end of the risk command), and judges whether the command corresponding to this device or other related devices has an alarm association in the time-sensitive area , if it is connected, it will enter the early life of the risk command, and the countermeasures are as above. Among them, the big data records the probability of alarm formation caused by each command combination, and some probability density curves corresponding to each combination.

The big data matching process uses the K-Means clustering algorithm for matching, and the process is as follows:

In the K-Means algorithm, k represents the number of clusters and is parsed into a command path, and means represents the mean value of data objects in the cluster (this mean value is a description of the center of the cluster), with the alarm as the origin and the distance as The standard for similarity measurement between data objects, that is, the smaller the distance between data objects, the higher their similarity, the more likely they are in the same cluster and they may be related.

其中，D表示数据对象间的距离，(x₁，y₁)表示数据1的坐标，(x₂，y₂)表示数据2的坐标。The distance calculation formula is:

Wherein, D represents the distance between data objects, (x ₁ , y ₁ ) represents the coordinates of data 1, and (x ₂ , y ₂ ) represents the coordinates of data 2.

Fig. 5 is a schematic diagram of a marking process of risk personnel according to an embodiment of the present application, which includes the following steps:

S001: Risk personnel login operation. First, the login personnel must be non-risk personnel (ie, non-high-risk users). When entering the stage of path depth classification and matching, carry out risk response identification.

S002: When the risk instruction is matched to the early stage, the person who enters the risk will mark at this time. When the person enters the order again, the personnel identification review must be performed before the instruction can be matched again.

S003: When the transition period of the risk instruction is matched, at this time, the person who enters the risk is marked and enters the personnel inspection identification area. When the person enters the order again and is matched to the initial stage of the risk removal instruction, the number of times is accumulated. Once the threshold is exceeded, it must be passed. Personnel identification audits are required to match instructions again.

S004: When the end of the risk instruction is matched, enter the personnel inspection and identification area for audit history identification. When the person matches a specific rule in the big data verification, the risk personnel marking enters the cumulative counting threshold judgment, and the threshold is exceeded to enter the personnel identification Only after approval can the instruction be entered again. At the same time, the monthly internal audit matching of operators is carried out in parallel. If they are matched, they will be directly defined as risk personnel. This matching method is to carry out monthly weighted statistics for all operators in the historical hit database. Calculate the error rate of operators according to the following weighting formula: the number of hits in the early stage of life * A + the number of hits in the transitional period of life * B + the number of hits in the end of life * C + impact events * D, to form the audit work of personnel risk instruction execution personnel.

Check the table below, for example, when the matching risk rate (or error rate) exceeds 100, it is a match.

S005: When the marking of risk personnel exceeds a certain period of time, it will be automatically eliminated, and the risk personnel will be marked and cleared. When the marked personnel are marked, they must be cleared by management personnel.

The following explains and introduces the supplementary part of the command activation process and the regular expression of the risk command in the historical period of the risk command:

S001: If the command combination in the historical period of the risk command is matched, the command is set to be inactive at this time and enters the 24-hour observation area, which is used for query during equipment failure processing.

S002: When a fault occurs and there is no alarm display, it is probably caused by manual operation. Search and query the commands in the 24-hour observation area, and it will be judged as the relevant command within 24 hours by the device.

S003: When it is found that there is a command that causes a fault to occur, the command will be set and activated, and will be recorded.

S004: When the regular rule cannot be matched and the risk command cannot be formed, the command will also enter the 24-hour observation area, and be activated in real time according to the activation process of the historical period of the risk command. At this time, the activation risk command is supplemented with a regular rule command set.

The embodiment of the present application is triggered by regular matching of risk commands, combined with a combined method of generating command deep classification for risk response, this combination method can be effective in command identification and risk response applications of metropolitan area network equipment. The embodiment of the present application also provides a risk personnel marking process method, which is dynamically generated by the personnel when executing risk instruction matching, and combined with the risk audit cycle to form a static generation. The dynamic and static methods complement each other to form the timely discovery of risk personnel. and identification, reducing the possibility of human error. The risk instruction is identified by the whole life process of the risk instruction, that is, the precipitation and active activation of the risk instruction is formed, the dynamic update of the risk instruction is increased, and a dynamic update process is formed for the regular expression of the risk instruction.

The embodiment of the present application also provides a non-volatile storage medium, the non-volatile storage medium includes a stored computer program, wherein the device where the non-volatile storage medium is located executes the processing method of the following instructions by running the computer program : Obtain the network command detected by the target monitoring task, wherein the network command is a network command generated by the network device, and the target monitoring task is at least used to monitor the risk of the login account of the network device; when the network command is a risk command, according to The disposal rule corresponding to the risk instruction processes the network instruction; if the network instruction is a non-risk instruction, judge whether the network instruction is a suspicious risk instruction; Judgment rules corresponding to the instructions, and make risk judgments on network instructions according to the judgment rules.

The serial numbers of the above embodiments of the present application are for description only, and do not represent the advantages and disadvantages of the embodiments.

In the above-mentioned embodiments of the present application, the descriptions of each embodiment have their own emphases, and for parts not described in detail in a certain embodiment, reference may be made to relevant descriptions of other embodiments.

In the several embodiments provided in this application, it should be understood that the disclosed technical content can be realized in other ways. Wherein, the device embodiments described above are only illustrative. For example, the division of the units may be a logical function division. In actual implementation, there may be other division methods. For example, multiple units or components may be combined or may be Integrate into another system, or some features may be ignored, or not implemented. In another point, the mutual coupling or direct coupling or communication connection shown or discussed may be through some interfaces, and the indirect coupling or communication connection of units or modules may be in electrical or other forms.

The units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or may be distributed to multiple units. Part or all of the units can be selected according to actual needs to achieve the purpose of the solution of this embodiment.

In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, each unit may exist separately physically, or two or more units may be integrated into one unit. The above-mentioned integrated units can be implemented in the form of hardware or in the form of software functional units.

If the integrated unit is realized in the form of a software function unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application is essentially or part of the contribution to the prior art or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium , including several instructions for enabling a computer device (which may be a personal computer, server or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present application. The aforementioned storage media include: U disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), mobile hard disk, magnetic disk or optical disk and other media that can store program codes. .

The above description is only the preferred embodiment of the present application. It should be pointed out that for those of ordinary skill in the art, without departing from the principle of the present application, some improvements and modifications can also be made. These improvements and modifications are also It should be regarded as the protection scope of this application.

Claims (10)

1. A method for processing instructions, comprising:

the method comprises the steps that a network instruction detected by a target monitoring task is obtained, wherein the network instruction is generated by network equipment, and the target monitoring task is at least used for carrying out risk monitoring on a login account of the network equipment;

processing the network instruction according to a handling rule corresponding to the risk instruction under the condition that the network instruction is the risk instruction;

under the condition that the network instruction is a non-risk instruction, judging whether the network instruction is a risk suspicious instruction or not;

and under the condition that the judgment result indicates that the network instruction is the risk suspicious instruction, determining a judgment rule corresponding to the network instruction, and performing risk judgment on the network instruction according to the judgment rule.

2. The method of claim 1, wherein processing the network instructions according to the handling rules corresponding to the risk instructions comprises:

determining the life stage of the risk instruction to which the network instruction belongs;

when the life stage is the initial life stage, carrying out rollback processing on the network instruction;

under the condition that the life stage is a life transition period, the network instruction is sent to a target object for confirmation;

and storing the network instruction into an area to be confirmed under the condition that the life stage is the life end period.

3. The method of claim 2, wherein determining the life stage of the risk instruction to which the network instruction belongs comprises:

when the network command enters a set area for the first time, determining that the network command is in the initial life stage;

when the probability that the network command in the set area is the risk command is lower than a first threshold value, determining that the network command is in the life transition period;

when the duration of the network instruction in the life transition period exceeds a second threshold, determining that the network instruction is in a life history period;

determining that the network instruction enters a life ending period under the condition that the duration of the network instruction in the life history period is not changed for a preset time;

and determining that the network instruction re-enters the initial life stage when the network instruction in the life transition period and the life history period in the set area is hit by an alarm.

4. The method of claim 1, wherein determining whether the network command is a risk suspicious command comprises:

acquiring a regular matching formula in a database;

performing regular matching on the network instruction and the regular matching formula;

and under the condition that a risk keyword is matched, determining that the network instruction is the risk suspicious instruction.

5. The method of claim 1, wherein determining the decision rule corresponding to the network command comprises:

acquiring path depth information of the network instruction, wherein the path depth information is used for representing information of a directory path where the network instruction is located;

classifying the network instructions according to the path depth information and instruction risk depth judgment criteria to obtain a risk scene category to which the network instructions belong, wherein the instruction risk depth judgment criteria are at least determined by the equipment type and the depth identification of the network equipment;

and determining a judgment rule corresponding to the network command according to the risk scene category to which the network command belongs.

6. The method of claim 5, wherein performing risk determination on the network command according to the determination rule comprises:

under the condition that the risk scene type is a first type, monitoring whether the network equipment corresponding to the network instruction and the network equipment generating the alarm have an association relation or not;

determining that the first class of network instructions are at risk if the incidence relation exists;

under the condition that the risk scene type is a second type, sending the network instruction to a target object, and receiving a judgment result returned by the target object, wherein the judgment result is used for indicating whether the network equipment corresponding to the network instruction has an association relation with the network equipment generating the alarm;

determining that the network instructions of the second category are at risk if the determination result indicates that the association relationship exists;

under the condition that the risk scene type is a third type, carrying out risk judgment on the incidence relation between the network equipment corresponding to the network instruction and the network equipment generating the alarm according to the corresponding relation of the historical command, wherein the corresponding relation of the historical command is the corresponding relation between the network equipment corresponding to the historical network instruction and the network equipment generating the historical alarm;

and determining that the network instruction of the third category has risk when the risk judgment result indicates that the incidence relation exists.

7. The method of claim 2, wherein after performing a risk determination on the network command according to the determination rule, the method further comprises:

storing the network instruction hitting the risk instruction or the risk suspicious instruction into a database, and performing periodic fault statistics on a target object corresponding to the network instruction in the database to obtain a fault record corresponding to the target object, wherein the fault record is determined by at least one of the following: the number of network instructions in the early life stage, the number of network instructions in the transitional life stage and the number of network instructions in the end life stage;

when the numerical value corresponding to the fault record exceeds a third threshold value, marking a target object corresponding to the fault record as a first class user, wherein the first class user is used for indicating that the target object is a high-risk user;

and under the condition that the first class of users meet a preset condition, marking the first class of users as second class of users, wherein the second class of users are used for indicating that the target object is a non-high-risk user, and the preset condition is that the first class of users are marked as the second class of users in a continuous preset period.

8. An apparatus for processing instructions, comprising:

the system comprises an acquisition module, a processing module and a processing module, wherein the acquisition module is used for acquiring a network instruction detected by a target monitoring task, the network instruction is generated by network equipment, and the target monitoring task is at least used for carrying out risk monitoring on a login account of the network equipment;

the processing module is used for processing the network instruction according to a handling rule corresponding to the risk instruction under the condition that the network instruction is the risk instruction;

the judging module is used for judging whether the network instruction is a risk suspicious instruction or not under the condition that the network instruction is a non-risk instruction;

and the determining module is used for determining a judgment rule corresponding to the network instruction under the condition that the judgment result indicates that the network instruction is the risk suspicious instruction, and carrying out risk judgment on the network instruction according to the judgment rule.

9. An electronic device, comprising:

a memory for storing program instructions;

a processor, coupled to the memory, for executing program instructions that implement the following functions: acquiring a network instruction detected by a target monitoring task, wherein the network instruction is generated by network equipment, and the target monitoring task is at least used for carrying out risk monitoring on a login account of the network equipment; processing the network instruction according to a handling rule corresponding to the risk instruction under the condition that the network instruction is the risk instruction; under the condition that the network instruction is a non-risk instruction, judging whether the network instruction is a risk suspicious instruction or not; and under the condition that the judgment result indicates that the network instruction is the risk suspicious instruction, determining a judgment rule corresponding to the network instruction, and performing risk judgment on the network instruction according to the judgment rule.

10. A non-volatile storage medium, comprising a stored computer program, wherein a device on which the non-volatile storage medium is located executes a processing method of the instructions of any one of claims 1 to 7 by executing the computer program.

Images