CN115550029A - Method, device, storage medium and electronic equipment for determining remote control abnormality - Google Patents

Abstract

The application provides a method and a device for determining remote control abnormity, a storage medium and electronic equipment, wherein the abnormity determining method comprises the following steps: acquiring a data message transmitted by an intranet asset; under the condition that the data message has security threat, extracting security information corresponding to the data message through a security engine; and determining whether the intranet assets are abnormal in remote control or not based on the safety information and the remote control record table updated in real time. According to the method and the device, whether remote control abnormality exists in the intranet assets is determined through the remote control record table updated in real time and the safety information, abnormal behaviors of the intranet assets under vulnerability control which is not blocked by gateway equipment can be avoided, and the accuracy and the comprehensiveness of abnormality detection are greatly improved.

Description

Method, device, storage medium and electronic equipment for determining remote control abnormality

technical field

The present application relates to the technical field of network asset communication security, and in particular to a determination method, device, storage medium and electronic equipment for remote control abnormalities.

Background technique

In the process of intranet penetration, after the intranet server is attacked by several network vulnerabilities, the gateway device can successfully block the attack and give an alarm, but there will still be security holes in the remote control protocol that are not blocked by the gateway device. , Extranet attackers will use this kind of vulnerability to bypass authentication and directly use the remote control protocol to connect to the intranet server. After the external network attackers capture the internal network server, they will steal the user name, password and other permission information of the internal network system, and then control more internal network assets, so as to transmit external data to the attacker through the internal network assets using the remote control protocol , so that the attacker steals intranet data.

At present, one method is to reduce the password cracking of the remote control protocol through brute force to prevent intranet assets from being compromised, but this method is based on the connection rate and the number of failed logins, but the connection rate and the number of failed logins are empirical values , therefore, the accuracy of this method is low; another way is to attract and deceive attackers through honeypot hosts with built-in high-risk vulnerabilities, and to study and learn the attack purpose and attack methods of attackers, so as to delay or even prevent However, the high-interaction honeypot technology relies on the virtual honeypot host and cannot identify unknown vulnerabilities. Therefore, the accuracy and comprehensiveness of this method are low.

Contents of the invention

In view of this, the purpose of the embodiments of the present application is to provide a method, device, storage medium, and electronic device for determining anomalies in remote control, so as to solve the problem of low accuracy and comprehensiveness of anomalies detection in the prior art.

In the first aspect, the embodiment of the present application provides a method for determining a remote control abnormality, including:

Obtain data packets transmitted by intranet assets;

In the case that the data message has a security threat, extracting security information corresponding to the data message through a security engine;

Based on the security information and the real-time updated remote control record table, it is determined whether there is a remote control abnormality in the intranet assets.

In a possible implementation manner, the determination method also includes:

extracting attribute information of the data packet from the data packet, wherein the attribute information includes at least a source address and a destination address of the data packet and an application protocol corresponding to the data packet;

The data packet is verified based on the attribute information.

In a possible implementation manner, the verifying the data packet based on the attribute information includes:

Determine whether the source address and destination address of the data message belong to the external network address;

If not, then determine whether the application protocol corresponding to the data message belongs to the remote control protocol;

If so, then determine whether the application protocol corresponding to the data message has successfully logged in;

If the login is successful, it is determined that the data packet passes the verification.

In a possible implementation manner, when the verification is passed, the way of updating the remote control record table includes:

Determine whether the source address and destination address of the data message and the application protocol corresponding to the data message exist in the remote control record table;

If it exists, update the remote control record table with the login time of the intranet asset;

If not, update the remote control record table with the source address, the destination address, the application protocol and the login time.

In a possible implementation manner, in the case that the data message has a security threat, extracting the security information corresponding to the data message through a security engine includes:

Detecting the data message through the security engine to determine whether there is a security threat in the data message;

If the data packet has a security threat, the threat source address, threat destination address, and threat level corresponding to the data packet are extracted.

In a possible implementation manner, the determining whether there is a remote control abnormality in the intranet asset based on the security information and the real-time updated remote control record table includes:

Determine whether the threat source address or threat destination address included in the security information exists in the current remote control record table;

If it exists, it is determined that the intranet asset has a remote control exception.

In the second aspect, the embodiment of the present application also provides a remote control abnormality determining device, which includes:

An acquisition module configured to acquire data packets transmitted by intranet assets;

An extraction module configured to extract the security information corresponding to the data message through a security engine when the data message has a security threat;

A determining module, configured to determine whether there is a remote control abnormality in the intranet asset based on the security information and the real-time updated remote control record table.

In a possible implementation manner, the abnormality determining device further includes a verification module configured to:

extracting attribute information of the data packet from the data packet, wherein the attribute information includes at least a source address and a destination address of the data packet and an application protocol corresponding to the data packet;

The data packet is verified based on the attribute information.

In a third aspect, the embodiment of the present application also provides a storage medium, wherein a computer program is stored on the computer-readable storage medium, and when the computer program is run by a processor, the following steps are performed:

Obtain data packets transmitted by intranet assets;

In the case that the data message has a security threat, extracting security information corresponding to the data message through a security engine;

Based on the security information and the real-time updated remote control record table, it is determined whether there is a remote control abnormality in the intranet assets.

In a fourth aspect, the embodiment of the present application further provides an electronic device, which includes: a processor and a memory, the memory stores machine-readable instructions executable by the processor, and when the electronic device is running, the The processor communicates with the memory through a bus, and when the machine-readable instructions are executed by the processor, the following steps are performed:

Obtain data packets transmitted by intranet assets;

In the case that the data message has a security threat, extracting security information corresponding to the data message through a security engine;

Based on the security information and the real-time updated remote control record table, it is determined whether there is a remote control abnormality in the intranet assets.

The embodiment of the present application uses the real-time updated remote control record table and security information to determine whether the intranet assets have remote control exceptions, which can avoid loopholes that are not blocked by the gateway device to control the abnormal behavior of intranet assets, and greatly improve the accuracy of anomaly detection. accuracy and comprehensiveness.

In order to make the above-mentioned purpose, features and advantages of the present application more comprehensible, preferred embodiments will be described in detail below together with the accompanying drawings.

Description of drawings

In order to more clearly illustrate the technical solutions in the present application or the prior art, the following will briefly introduce the drawings that need to be used in the description of the embodiments or the prior art. Obviously, the accompanying drawings in the following description are only the present invention. For some embodiments described in the application, those of ordinary skill in the art can also obtain other drawings based on these drawings without any creative effort.

FIG. 1 shows a flowchart of a method for determining a remote control abnormality provided by the present application;

Fig. 2 shows a flow chart of updating the remote control recording table based on the attribute information of the data message in a method for determining a remote control abnormality provided by the present application;

FIG. 3 shows a flow chart of verifying data packets based on attribute information in a method for determining an abnormality in remote control provided by the present application;

Fig. 4 shows a schematic structural diagram of a remote control abnormality determination device provided by the present application;

Fig. 5 shows a schematic structural diagram of an electronic device provided by the present application.

detailed description

Various aspects and features of the present application are described herein with reference to the accompanying drawings.

It should be understood that various modifications may be made to the embodiments applied for herein. Accordingly, the above description should not be viewed as limiting, but only as exemplifications of embodiments. Those skilled in the art will envision other modifications within the scope and spirit of the application.

The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments of the application and, together with the general description of the application given above and the detailed description of the embodiments given below, serve to explain the embodiments of the application. principle.

These and other characteristics of the present application will become apparent from the following description of preferred forms of embodiment given as non-limiting examples with reference to the accompanying drawings.

It should also be understood that, while the application has been described with reference to a few specific examples, those skilled in the art can certainly implement many other equivalents of the application, which have the features of the claims and are thus located. within the limited scope of protection.

The above and other aspects, features and advantages of the present application will become more apparent in view of the following detailed description when taken in conjunction with the accompanying drawings.

Specific embodiments of the present application are hereinafter described with reference to the accompanying drawings; however, it should be understood that the applied embodiments are merely examples of the present application, which can be implemented in various ways. Well-known and/or repetitive functions and constructions are not described in detail to avoid obscuring the application with unnecessary or redundant detail. Therefore, specific structural and functional details disclosed herein are not intended to be limiting, but merely as a basis for the claims and as a representative basis for teaching one skilled in the art to variously employ the present invention in virtually any suitable detailed structure. Apply.

This specification may use the phrases "in one embodiment," "in another embodiment," "in yet another embodiment," or "in other embodiments," which may refer to the same or one or more of the different embodiments.

In the first aspect, in order to facilitate understanding of the present application, a method for determining a remote control abnormality provided in the present application is first introduced in detail. As shown in FIG. 1 , the anomaly determination method provided in the embodiment of the present application can solve the problem of low accuracy and comprehensiveness of anomaly detection in the prior art according to the method steps shown in FIG. 1 . Wherein, the specific steps include S101-S103.

S101. Obtain a data packet transmitted by an intranet asset.

In a specific implementation, the electronic device can identify the assets in the local area network based on the set timing task, and then obtain the intranet assets belonging to the local area network. Among them, assets refer to valuable information or resources in the local area network, for example, the services opened by the hosts in the local area network, and the basic devices associated with the hosts such as routers and printers.

In the embodiment of the present application, the server or the controller obtains the data message transmitted by each intranet asset in real time. The data message may be a message transmitted between other assets in the local area network to which the intranet asset belongs and the intranet asset, or may be It is the message transmitted between the external network asset and the internal network asset.

S102. In the case that the data message has a security threat, extract the security information corresponding to the data message through the security engine.

In the specific implementation, a security engine is usually installed in the LAN, such as an intrusion prevention system IPS, a web application firewall WAF, etc. During the process of data message transmission, the data message is detected by the security engine to determine whether the data message is There is a security threat. Optionally, the security engine corresponds to pre-set judgment rules, for example, if the external network address transmits a virus to the external network or the internal network, the attack chain is "attack intrusion", and in other cases it is internal network diffusion; for the security engine IPS, the internal network The source address is internal network diffusion, and the external network source address is attack intrusion. For the security engine WAF, the attack chain can also be determined according to other rule names. It is worth noting that for command control security events, the attack chain is command control.

If there is a security threat in the data message, the threat source address, threat destination address and threat level corresponding to the data message are extracted.

S103, based on the security information and the real-time updated remote control record table, determine whether there is a remote control abnormality in the intranet assets.

After obtaining the security information, determine whether the threat source address or the threat destination address included in the security information exists in the current remote control record table, and the current remote control record table is the remote control record table updated in real time; if it exists, It is determined that there is an abnormal remote control of the intranet asset, that is, the event executed by the intranet asset is an attack event; if there is no threat source address or threat destination address in the current remote control record table, it is determined that there is no remote control of the intranet asset abnormal.

Optionally, it may be further determined whether the threat source address or the threat destination address existing in the current remote control record table is an internal network address or an external network address, respectively. As an example, for attack events such as advertising Trojans and backdoor software, if the threat source address is an intranet address and the threat destination address is an intranet address or an extranet address, the risk level of the intranet asset is determined to be high risk, except for the In addition to other circumstances, it is determined that the risk level of the internal network assets is low risk; for the attack event of browsing a malicious uniform resource locator (Uniform Resource Locator, URL), if the threat source address is an internal network address, the threat destination address is an internal network address address or external network address, it is determined that the risk level of the internal network assets is medium risk; except for this case, the risk level of the internal network assets is determined to be low risk, etc.

Of course, it can also be set to determine the risk level of intranet assets when each event is executed within a preset period, and then determine the highest risk level as the final risk level of intranet assets. This embodiment of the application does not specify this limited.

The embodiment of the present application uses the real-time updated remote control record table and security information to determine whether the intranet assets have remote control exceptions, which can avoid loopholes that are not blocked by the gateway device to control the abnormal behavior of intranet assets, and greatly improve the accuracy of anomaly detection. accuracy and comprehensiveness.

In the abnormality determination method provided in the embodiment of the present application, the data message can be verified based on the attribute information with reference to the method flowchart shown in FIG. 2 , and the specific steps include S201-S204.

S201. Determine whether the source address and the destination address of the data message belong to external network addresses.

S202. If not, determine whether the application protocol corresponding to the data message belongs to the remote control protocol.

S203, if yes, determine whether the application protocol corresponding to the data packet is registered successfully.

S204. If the login is successful, it is determined that the data packet passes the verification.

Optionally, when verifying the data message based on the attribute information, determine whether the source address and the destination address of the data message belong to the external network address, wherein, the source address and the destination address belonging to the internal network address can be preset, and then determined Whether the source address and the destination address of the data message exist in the source address and the destination address of the internal network address, if they exist, it is determined that the source address and the destination address of the data message belong to the internal network address, that is, the transmission of the data message is normal, The intranet asset is also in a normal state. At this time, there is no need to record in the remote control record table.

If the source address and destination address of the data message do not exist in the source address and destination address of the internal network address, then determine that the source address or destination address of the data message belongs to the external network address. At this time, further determine the corresponding application of the data message Whether the protocol belongs to a remote control protocol, wherein the remote control protocol includes a command line interface remote management protocol (Secure Shell protocol, SSH), a command line interface remote management protocol Telnet, a remote desktop protocol (Remote Desktop Protocol, RDP), etc.

If the application protocol corresponding to the data message is not a remote control protocol, it means that the data message is transmitted normally and the intranet asset is also in a normal state. At this time, there is no need to record in the remote control record table.

When the application protocol corresponding to the data message belongs to the remote control protocol, it is determined whether the application protocol corresponding to the data message has been successfully logged in. If the login is successful, it is determined that the data message has passed the verification, and at this time, the remote control record table is recorded. Among them, for the SSH protocol, the number of consecutive login failures allowed by ssh2 can be set in advance, such as 5 times. At this time, about 31 ssh messages are generated, and then the login success or failure is determined by the number of ssh messages; for the telnet protocol, if the message If the string contains "Login Failed" or "%Username or password incorrect!", it indicates that the login failed; for the RDP protocol, the login failure can also be determined by the number of RDP packets.

If the verification is passed, the remote control record table is updated based on the attribute information of the data message, so as to obtain the current remote control record table in real time.

Here, considering that there is a message transmission error such as source address and/or destination address error, etc., at this time, there is no need to perform subsequent transmission records, that is, there is no need to update the remote control record table, and only when the data message transmission is normal. Recording of remote control record table. Therefore, after obtaining the data message transmitted by the intranet asset, the attribute information of the data message is extracted from the data message, wherein the attribute information includes at least the source address and destination address of the data message and the application address corresponding to the data message protocol. Further, the data message is verified based on the attribute information, and the remote control record table is updated based on the attribute information of the data message when the data message passes the verification.

Optionally, when the data stream transmitted by the intranet assets passes through devices such as gateways, external network address checks, control protocol checks, control protocol login success checks, etc. can be performed.

As one example, FIG. 3 shows a flow chart of the way of updating the remote control record table when the verification is passed, wherein the specific steps include S301-S303.

S301. Determine whether the source address and destination address of the data message and the application protocol corresponding to the data message exist in the remote control record table.

S302. If it exists, use the login time of the intranet asset to update the remote control record table.

S303. If it does not exist, update the remote control record table by using the source address, destination address, application protocol and login time.

In the specific implementation, after extracting the source address, destination address and application protocol corresponding to the data message, determine whether the source address and destination address of the data message and the application protocol corresponding to the data message exist in the remote control record table, wherein, The remote control record table at least includes historical data packets transmitted each time, their corresponding historical source addresses, historical destination addresses, historical application protocols, historical login times, and the like.

If the source address, destination address, and application protocol corresponding to the data message exist in the remote control record table, the login time of the data message is extracted from the data message. The time when network assets are accessed, or the time when internal network assets access other internal network assets or external network assets, of course, can also be the time of logging in to the application protocol, etc. After that, use the login time of the intranet assets to update the remote control record table.

If the source address, destination address, and application protocol corresponding to the data message do not exist in the remote control record table, then use the source address, destination address, application protocol, and login time to update the remote control record table, that is, the intranet assets, The source address, destination address, application protocol and login time are added to the remote control record table.

Based on the same inventive concept, the second aspect of this application also provides an abnormality determining device corresponding to the abnormality determining method. For the implementation, please refer to the implementation of the method, and the repeated parts will not be repeated.

Fig. 4 shows a schematic diagram of an abnormality determination device provided by an embodiment of the present application, specifically including:

An acquisition module 401 configured to acquire data packets transmitted by intranet assets;

An extracting module 402 configured to extract security information corresponding to the data message through a security engine if the data message has a security threat;

The determination module 403 is configured to determine whether the intranet assets have remote control exceptions based on the security information and the real-time updated remote control record table.

In yet another embodiment, the abnormality determination device further includes a verification module 404, which is configured to:

extracting attribute information of the data packet from the data packet, wherein the attribute information includes at least a source address and a destination address of the data packet and an application protocol corresponding to the data packet;

The data packet is verified based on the attribute information.

In yet another embodiment, the verification module 404 is specifically configured as:

Determine whether the source address and destination address of the data message belong to the external network address;

If not, then determine whether the application protocol corresponding to the data message belongs to the remote control protocol;

If so, then determine whether the application protocol corresponding to the data message has successfully logged in;

If the login is successful, it is determined that the data packet passes the verification.

In yet another embodiment, the abnormality determination device further includes an update module 405 specifically configured to:

Determine whether the source address and destination address of the data message and the application protocol corresponding to the data message exist in the remote control record table;

If it exists, use the login time of the intranet asset to update the remote control record table;

If not, update the remote control record table with the source address, the destination address, the application protocol and the login time.

In yet another embodiment, the extraction module 402 is specifically configured as:

Detecting the data message through the security engine to determine whether there is a security threat in the data message;

If the data packet has a security threat, the threat source address, threat destination address, and threat level corresponding to the data packet are extracted.

In yet another embodiment, the determining module 403 is specifically configured as:

Determine whether the threat source address or threat destination address included in the security information exists in the current remote control record table;

If it exists, it is determined that the intranet asset has a remote control exception.

The embodiment of the present application uses the real-time updated remote control record table and security information to determine whether the intranet assets have remote control exceptions, which can avoid loopholes that are not blocked by the gateway device to control the abnormal behavior of intranet assets, and greatly improve the accuracy of anomaly detection. accuracy and comprehensiveness.

An embodiment of the present application provides a storage medium, which is a computer-readable medium and stores a computer program. When the computer program is executed by a processor, the method provided in any embodiment of the present application is implemented, including the following steps S11 to S13:

S11. Obtain data packets transmitted by intranet assets;

S12. In the case that the data message has a security threat, extract security information corresponding to the data message through a security engine;

S13. Based on the security information and the real-time updated remote control record table, determine whether there is a remote control abnormality in the intranet assets.

When the computer program is executed by the processor to determine the method, the processor specifically executes the following steps: extracting attribute information of the data message from the data message, wherein the attribute information includes at least the source of the data message The address, the destination address, and the application protocol corresponding to the data packet; and verifying the data packet based on the attribute information.

When the computer program is executed by the processor based on the attribute information, when the data message is verified, the processor also performs the following steps: determine whether the source address and the destination address of the data message belong to the external network address; if not , then determine whether the application protocol corresponding to the data message belongs to the remote control protocol; if so, determine whether the application protocol corresponding to the data message has successfully logged in; if the login is successful, then determine that the data message has passed the verification.

When the computer program is executed by the processor and the verification method of the remote control record table is passed, the processor also performs the following steps: determine whether the source address and destination address of the data message and the The application protocol corresponding to the data message; if it exists, use the login time of the intranet asset to update the remote control record table; if it does not exist, use the source address, the destination address, the application protocol and the login time The remote control record table is updated.

When the computer program is executed by the processor and the security information corresponding to the data message is extracted through the security engine when the security threat exists in the data message, the following steps are also performed by the processor: using the security engine to perform the following steps: The data packet is detected to determine whether the data packet has a security threat; if the data packet has a security threat, the threat source address, threat destination address and threat level corresponding to the data packet are extracted.

When the computer program is executed by the processor based on the security information and the remote control record table updated in real time to determine whether there is a remote control abnormality in the intranet assets, the processor also performs the following steps: determine the threat source included in the security information Whether the address or threat destination address exists in the current remote control record table; if it exists, it is determined that the intranet assets have remote control exceptions.

The embodiment of the present application uses the real-time updated remote control record table and security information to determine whether the intranet assets have remote control exceptions, which can avoid loopholes that are not blocked by the gateway device to control the abnormal behavior of intranet assets, and greatly improve the accuracy of anomaly detection. accuracy and comprehensiveness.

The embodiment of the present application also provides an electronic device. The schematic structural diagram of the electronic device can be shown in FIG. A computer program to implement the method provided by any embodiment of the present application. Exemplarily, the computer program steps of the electronic device are as follows S21 to S23:

S21. Obtain data packets transmitted by intranet assets;

S22. In the case that the data message has a security threat, extract security information corresponding to the data message through a security engine;

S23. Based on the security information and the real-time updated remote control record table, determine whether there is a remote control abnormality in the intranet assets.

When the processor executes the determination method stored in the memory, it also executes the following computer program: extracting attribute information of the data message from the data message, wherein the attribute information includes at least the source of the data message The address, the destination address, and the application protocol corresponding to the data packet; and verifying the data packet based on the attribute information.

When the processor executes the verification of the data message based on the attribute information stored in the memory, it also executes the following computer program: determine whether the source address and the destination address of the data message belong to the external network address; if not , then determine whether the application protocol corresponding to the data message belongs to the remote control protocol; if so, determine whether the application protocol corresponding to the data message has successfully logged in; if the login is successful, then determine that the data message has passed the verification.

When the processor executes the update method of the remote control record table stored on the memory when the verification is passed, it also executes the following computer program: determine whether the source address and destination address of the data message and the The application protocol corresponding to the data message; if it exists, use the login time of the intranet asset to update the remote control record table; if it does not exist, use the source address, the destination address, the application protocol and the login time The remote control record table is updated.

When the processor executes the security information corresponding to the data message stored in the memory and extracts the security information corresponding to the data message through the security engine when the data message has a security threat, it also executes the following computer program: The data packet is detected to determine whether the data packet has a security threat; if the data packet has a security threat, the threat source address, threat destination address and threat level corresponding to the data packet are extracted.

When the processor executes the remote control record table stored on the memory based on the security information and the real-time update to determine whether there is a remote control abnormality in the intranet assets, it also executes the following computer program: determine the threat source included in the security information Whether the address or threat destination address exists in the current remote control record table; if it exists, it is determined that the intranet assets have remote control exceptions.

The embodiment of the present application uses the real-time updated remote control record table and security information to determine whether the intranet assets have remote control exceptions, which can avoid loopholes that are not blocked by the gateway device to control the abnormal behavior of intranet assets, and greatly improve the accuracy of anomaly detection. accuracy and comprehensiveness.

Optionally, in this embodiment, the above-mentioned storage medium may include but not limited to: U disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), mobile hard disk, magnetic disk Various media that can store program codes such as discs or optical discs. Optionally, in this embodiment, the processor executes the method steps described in the foregoing embodiments according to the program code stored in the storage medium. Optionally, for specific examples in this embodiment, reference may be made to the examples described in the foregoing embodiments and optional implementation manners, and details are not repeated in this embodiment. Obviously, those skilled in the art should understand that each module or each step of the above-mentioned application can be realized by a general-purpose computing device, and they can be concentrated on a single computing device, or distributed in a network composed of multiple computing devices Alternatively, they may be implemented in program code executable by a computing device so that they may be stored in a storage device to be executed by a computing device, and in some cases in an order different from that shown here The steps shown or described are carried out, or they are separately fabricated into individual integrated circuit modules, or multiple modules or steps among them are fabricated into a single integrated circuit module for implementation. As such, the present application is not limited to any specific combination of hardware and software.

Furthermore, while exemplary embodiments have been described herein, the scope includes any and all implementations having equivalent elements, modifications, omissions, combinations (eg, cross-cutting aspects of various embodiments), adaptations, or changes based on this application example. Elements in the claims are to be interpreted broadly based on the language employed in the claims and are not limited to examples described in this specification or during the practice of the application, which examples are to be construed as non-exclusive. It is therefore intended that the specification and examples be considered as illustrations only, with a true scope and spirit being indicated by the following claims, along with their full scope of equivalents.

The above description is intended to be illustrative rather than restrictive. For example, the above examples (or one or more aspects thereof) may be used in combination with each other. For example, other embodiments may be used by those of ordinary skill in the art upon reading the above description. Additionally, in the above detailed description, various features may be grouped together to simplify the application. This is not to be interpreted as intending that an unclaimed disclosed feature is essential to any claim. Rather, subject matter of the application may lie in less than all features of a particular disclosed embodiment. Thus, the following claims are hereby incorporated into the detailed description as examples or embodiments, where each claim stands on its own as a separate embodiment, and it is contemplated that these embodiments may be combined with each other in various combinations or permutations. The scope of the application should be determined with reference to the appended claims, along with the full scope of equivalents to which such claims are entitled.

Multiple embodiments of the present application have been described in detail above, but the present application is not limited to these specific embodiments. Those skilled in the art can make various variations and modifications on the basis of the concept of the application. These variations and modifications All should fall within the scope of protection claimed by this application.

Claims (10)

1. A method for determining remote control anomalies, comprising:

acquiring a data message transmitted by an intranet asset;

under the condition that the data message has security threat, extracting security information corresponding to the data message through a security engine;

and determining whether the intranet assets are in remote control abnormity or not based on the safety information and a real-time updated remote control record table.

2. The determination method according to claim 1, further comprising:

extracting attribute information of the data message from the data message, wherein the attribute information at least comprises a source address and a destination address of the data message and an application protocol corresponding to the data message;

and verifying the data message based on the attribute information.

3. The method of claim 2, wherein validating the data packet based on the attribute information comprises:

determining whether the source address and the destination address of the data message belong to an external network address;

if not, determining whether the application protocol corresponding to the data message belongs to a remote control protocol;

if yes, determining whether the application protocol corresponding to the data message is successfully logged in;

and if the login is successful, determining that the data message passes the verification.

4. The method for determining according to claim 2, wherein the updating manner of the remote control record table in case of passing the verification comprises:

determining whether a source address and a destination address of the data message and an application protocol corresponding to the data message exist in a remote control record table;

if yes, updating a remote control record table by using the login time of the intranet assets;

and if the address does not exist, updating the remote control record table by using the source address, the destination address, the application protocol and the login time.

5. The method according to claim 1, wherein extracting, by a security engine, security information corresponding to the data packet when the data packet has a security threat comprises:

detecting the data message through the security engine to determine whether the data message has security threat;

and under the condition that the data message has security threat, extracting a threat source address, a threat destination address and a threat level corresponding to the data message.

6. The method for determining according to claim 1, wherein determining whether the intranet asset has a remote control abnormality based on the security information and a remote control record table updated in real time comprises:

determining whether a threat source address or a threat destination address included in the security information exists in a current remote control record table;

and if so, determining that the intranet assets are abnormal in remote control.

7. An apparatus for remotely determining an abnormality, comprising:

the acquisition module is configured to acquire a data message transmitted by the intranet asset;

the extraction module is configured to extract the security information corresponding to the data message through a security engine under the condition that the data message has security threat;

a determining module configured to determine whether a remote control abnormality exists in the intranet asset based on the security information and a real-time updated remote control record table.

8. The determination apparatus of claim 7, further comprising a verification module configured to:

extracting attribute information of the data message from the data message, wherein the attribute information at least comprises a source address and a destination address of the data message and an application protocol corresponding to the data message;

and verifying the data message based on the attribute information.

9. A storage medium, having a computer program stored thereon, the computer program when executed by a processor performing the steps of:

acquiring a data message transmitted by an intranet asset;

under the condition that the data message has security threat, extracting security information corresponding to the data message through a security engine;

and determining whether the intranet assets are in remote control abnormity or not based on the safety information and a real-time updated remote control record table.

10. An electronic device, comprising: a processor and a memory, the memory storing machine-readable instructions executable by the processor, the processor and the memory communicating over a bus when an electronic device is operating, the machine-readable instructions when executed by the processor performing the steps of:

acquiring a data message transmitted by an intranet asset;

under the condition that the data message has security threat, extracting security information corresponding to the data message through a security engine;

and determining whether the intranet asset has remote control abnormity or not based on the safety information and a remote control record table updated in real time.

Images