CN112711772B - Audit system, method and storage medium for function execution in service - Google Patents

Abstract

The application discloses an audit system, method and storage medium for function execution in service, the system comprises: an operation audit SDK, an operation audit background center, a cache and a database; the operation audit background center is respectively in communication connection with the operation audit SDK, the cache and the database, and the operation audit SDK comprises an operation interceptor, an operation analyzer, an information transmitter and an exception handler; the operation interceptor, the operation analyzer, the information transmitter and the exception handler are sequentially in communication connection. Therefore, by adopting the embodiment of the application, the functions in service can be effectively protected, and the data loss caused by malicious triggering of the functions is further prevented, so that the safety of the data is improved.

Description

An audit system, method and storage medium for function execution in a service

Technical Field

The present invention relates to the field of computer software technology, and in particular to an audit system, method and storage medium for executing functions in a service.

Background technique

In systems involving sensitive data, for security reasons, it is necessary to record the operations that have occurred in the system, detect abnormal behaviors, and protect the data security in the system. For example, in the medical field, most patient-related data is sensitive data or private data. Any operations such as viewing and modifying data need to be strictly recorded and audited. In abnormal situations (cross-location operations, high-frequency operations), operations are blocked and relevant information is provided to administrators.

In the existing audit scheme, a common way to add operation audit is to directly embed relevant functions in the business system of the system. This embedding method can accurately record and audit operations and ensure data security, but it will introduce a certain degree of code coupling. When the number of systems and projects that require related operations increases, each project needs to encode and maintain related functions, which has high maintenance costs. Another way is to separate the operation audit function from each project and use a set of general audit modules applicable to multiple projects. It solves the problem of code coupling and can use the same system for auditing in multiple projects, reducing maintenance costs. However, when different projects have different requirements for the operation audit method in different scenarios, its general audit rules cannot guarantee that the corresponding processing can be carried out normally for different requirements, nor can it guarantee the accuracy of the required information in each specific scenario.

Summary of the invention

The embodiments of the present application provide an audit system, method and storage medium for the execution of functions in a service. In order to have a basic understanding of some aspects of the disclosed embodiments, a simple summary is given below. This summary is not a general review, nor is it intended to identify key/important components or describe the scope of protection of these embodiments. Its only purpose is to present some concepts in a simple form as a preface to the detailed description that follows.

In a first aspect, an embodiment of the present application provides an audit system for executing a function in a service, the system comprising:

Operation audit SDK, operation audit backend center, cache and database; among them,

The operation audit backend center is connected to the operation audit SDK, cache and database respectively.

Optionally, the operation audit SDK includes an operation interceptor, an operation parser, an information sender, and an exception handler;

The operation interceptor, the operation parser, the information sender and the exception handler are connected in communication in sequence.

Optionally, the exception handler is in communication with the operation interceptor.

Optionally, the operation audit backend center includes an information receiver, a record storage, an anomaly detector, and a display for information display; wherein,

The information receiver is communicatively connected with the information transmitter, the anomaly detector and the record storage device respectively;

The anomaly detector is communicatively connected to the cache;

The record storage, database and information display platform are communicatively connected in sequence.

Optional, operation audit SDK, used to access the service that needs to be audited, intercept the triggering operation of the service to generate interception information, and parse the interception information according to the audit rules in the preset custom configuration file and send it to the operation audit backend center;

The operation audit backend center is used to perform anomaly detection on the intercepted information sent by the operation audit SDK, generate detection results, and save and feed back the detection results to the operation audit SDK;

Cache, used to save interception information;

Database, used to store warning information.

In a second aspect, an embodiment of the present application provides an audit method for executing a function in a service, which is applied to an operation interceptor, and the method includes:

When it is monitored that a specified function in the audited service is triggered and executed, interception information is generated after intercepting the triggered specified function; wherein the interception information at least includes the method parameters and return values in the triggered specified function;

Send the intercept information to the action resolver.

In a third aspect, an embodiment of the present application provides an audit method for executing a function in a service, which is applied to an operation parser, and the method includes:

Receive interception information sent by the operation interceptor to the operation parser;

Get the audit rules contained in the pre-configured profile;

Analyze and integrate interception information based on audit rules to generate operation records;

Sending the operation record to the information sender, and sending the operation record to the information receiver based on the information sender;

sending the operation record to the record storage based on the information receiver;

The operation information is sent to the database for storage based on the record storage.

In a fourth aspect, an embodiment of the present application provides an audit method for executing a function in a service, which is applied to an anomaly detector, and the method includes:

receiving the operation record based on the information receiver;

Get historical operation records;

Compare and test the operation records with historical operation records to generate test results;

When the detection result shows an abnormal operation, abnormal information is generated and sent to the abnormality handler.

In a fifth aspect, an embodiment of the present application provides an audit method for executing a function in a service, which is applied to an exception handler, and the method includes:

When the exception information sent from the exception detector is received, the exception handling is performed according to the exception handling settings provided by the specified configuration file corresponding to the triggered specified function.

In a sixth aspect, an embodiment of the present application provides a computer storage medium, which stores a plurality of instructions, and the instructions are suitable for being loaded by a processor and executing the above-mentioned method steps.

The technical solution provided by the embodiments of the present application may have the following beneficial effects:

In the audit system provided in the embodiment of the present application, the operation interceptor will intercept the functional operation triggered by the user, generate interception information, and send the interception information to the operation parser. The operation parser will parse and integrate the captured information according to the audit rule instance configured in the configuration file, generate an operation record, and then store the generated detailed and complete operation record in the database through the record storage according to the rule instance or send it to the anomaly detector. After receiving the operation record, the anomaly detector compares it with the stored historical operation record to detect whether it is an abnormal operation or functional freezing. If it is determined to be an abnormal operation, the information is sent to the exception handler, and the specified early warning feedback is performed according to the audit rule instance, and returned to the specific project through the operation interceptor. Because the present application adds the operation audit function to multiple projects in a non-code invasive manner, and provides a method of configuring specific audit rules according to specific requirements, it reduces the coupling degree of the operation audit code in the system while ensuring that each project can define specific audit rules as needed, further ensuring the accuracy of the audit.

It is to be understood that the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the invention.

BRIEF DESCRIPTION OF THE DRAWINGS

The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the invention and, together with the description, serve to explain the principles of the invention.

FIG1 shows a schematic diagram of the overall structure of the operation audit system of the present invention;

2 is a schematic diagram of an audit system when a function is executed in a service provided in an embodiment of the present application;

3 is a schematic diagram of an audit method for executing a function in a service provided by an embodiment of the present application;

4 is a schematic diagram of a method for auditing the execution of a function in another service provided by an embodiment of the present application;

5 is a schematic diagram of a method for auditing the execution of a function in another service provided by an embodiment of the present application;

6 is a schematic diagram of another method for auditing a function during execution of a service provided by an embodiment of the present application;

FIG. 7 is a schematic diagram of the deployment of an audit system during the execution of a function in a service provided in an embodiment of the present application.

Detailed ways

The following description and the drawings sufficiently illustrate specific embodiments of the invention to enable those skilled in the art to practice them.

It should be clear that the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

When the following description refers to the drawings, unless otherwise indicated, the same numbers in different drawings represent the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with the present invention. Instead, they are only examples of systems and methods consistent with some aspects of the present invention as detailed in the attached claims.

In the description of the present invention, it should be understood that the terms "first", "second", etc. are only used for descriptive purposes and cannot be understood as indicating or implying relative importance. For those of ordinary skill in the art, the specific meanings of the above terms in the present invention can be understood according to specific circumstances. In addition, in the description of the present invention, unless otherwise specified, "plurality" refers to two or more. "And/or" describes the association relationship of associated objects, indicating that three relationships may exist. For example, A and/or B can represent: A exists alone, A and B exist at the same time, and B exists alone. The character "/" generally indicates that the previously associated objects are in an "or" relationship.

Please refer to Figure 1, which shows a schematic diagram of the overall structure of the operation audit system of the present invention. When a specified functional operation is executed in the audited service, the operation interceptor will intercept the operation and send the interception information to the operation parser. The operation parser will parse and integrate the captured information according to the audit rule instance configured in the configuration file, and store the generated detailed and complete operation records in the database through the record storage according to the rule instance or send them to the anomaly detector. After receiving the operation record, the anomaly detector stores the historical operation record in the cache for comparison to detect whether it is an abnormal operation or function freeze. If it is determined to be an abnormal operation, the information will be sent to the exception handler, and the specified early warning feedback will be performed according to the audit rule instance, and returned to the specific project through the operation interceptor.

Please refer to Figure 2, which is a schematic diagram of an audit system when a function is executed in a service provided in an embodiment of the present application. The system includes: an operation audit SDK, an operation audit backend center, a cache, and a database; wherein the operation audit backend center is respectively communicated with the operation audit SDK, the cache, and the database.

Specifically, the operation audit SDK includes an operation interceptor, an operation parser, an information transmitter, and an exception handler; wherein the operation interceptor, the operation parser, the information transmitter, and the exception handler are communicatively connected in sequence.

Furthermore, the exception handler is in communication connection with the operation interceptor.

Specifically, the operation audit backend center includes an information receiver, a record storage, an anomaly detector and a display for information display; wherein the information receiver is respectively communicated with the information transmitter, the anomaly detector and the record storage; the anomaly detector is communicated with the cache; the record storage, the database and the information display platform are communicated with each other in sequence.

Specifically, the operation audit SDK is used to access the services that need to be audited, intercept the triggering operations of the services to generate interception information, and parse the interception information according to the audit rules in the preset custom configuration file and send it to the operation audit backend center; the operation audit backend center is used to perform anomaly detection on the interception information sent by the operation audit SDK to generate detection results, and save the detection results and feed them back to the operation audit SDK; the cache is used to save the interception information; the database is used to save the warning information.

In the audit system provided in the embodiment of the present application, the operation interceptor will intercept the functional operation triggered by the user, generate interception information, and send the interception information to the operation parser. The operation parser will parse and integrate the captured information according to the audit rule instance configured in the configuration file, generate an operation record, and then store the generated detailed and complete operation record in the database through the record storage according to the rule instance or send it to the anomaly detector. After receiving the operation record, the anomaly detector compares it with the stored historical operation record to detect whether it is an abnormal operation or functional freezing. If it is determined to be an abnormal operation, the information is sent to the exception handler, and the specified early warning feedback is performed according to the audit rule instance, and returned to the specific project through the operation interceptor. Because the present application adds the operation audit function to multiple projects in a non-code invasive manner, and provides a method of configuring specific audit rules according to specific requirements, it reduces the coupling degree of the operation audit code in the system while ensuring that each project can define specific audit rules as needed, further ensuring the accuracy of the audit.

The following will introduce in detail the audit method for the execution of functions in the service provided by the embodiment of the present application in conjunction with Figures 3 to 7. The method can be implemented by relying on a computer program and can be run on an audit device for the execution of functions in the service based on the von Neumann system. The computer program can be integrated into an application or run as an independent tool application.

Please refer to Figure 3, which is a flowchart of an audit method for executing a function in a service provided in an embodiment of the present application, which is applied to an operation interceptor. As shown in Figure 3, the method of the embodiment of the present application may include the following steps:

S101, when it is monitored that a designated function in the audited service is triggered and executed, intercept the triggered designated function and generate interception information; wherein the interception information at least includes method parameters and return values in the triggered designated function;

S102, sending the interception information to the operation parser.

In one possible implementation, after a user triggers a function in a service, it is detected and intercepted by an operation interceptor, which intercepts the audit-marked operation part in the executing program, obtains the parameters, return values and other relevant information in the executed method, and sends them to the operation parser.

In the audit system provided in the embodiment of the present application, the operation interceptor will intercept the functional operation triggered by the user, generate interception information, and send the interception information to the operation parser. The operation parser will parse and integrate the captured information according to the audit rule instance configured in the configuration file, generate an operation record, and then store the generated detailed and complete operation record in the database through the record storage according to the rule instance or send it to the anomaly detector. After receiving the operation record, the anomaly detector compares it with the stored historical operation record to detect whether it is an abnormal operation or functional freezing. If it is determined to be an abnormal operation, the information is sent to the exception handler, and the specified early warning feedback is performed according to the audit rule instance, and returned to the specific project through the operation interceptor. Because the present application adds the operation audit function to multiple projects in a non-code invasive manner, and provides a method of configuring specific audit rules according to specific requirements, it reduces the coupling degree of the operation audit code in the system while ensuring that each project can define specific audit rules as needed, further ensuring the accuracy of the audit.

Please refer to Figure 4, which is a flowchart of an audit method for executing a function in a service provided in an embodiment of the present application, and is applied to an operation parser. As shown in Figure 4, the method of the embodiment of the present application may include the following steps:

S201, receiving interception information sent by the operation interceptor to the operation parser;

S202, obtaining audit rules contained in a pre-configured configuration file;

S203, analyzing and integrating the interception information based on the audit rules to generate an operation record;

S204, sending the operation record to the information transmitter, and sending the operation record to the information receiver based on the information transmitter;

S205, sending the operation record to the record storage based on the information receiver;

S206: Send the operation information to a database for storage based on the record storage.

In one possible implementation, the audit rules specified in the audit configuration information of the project are read according to the mapping name received by the operation interceptor, and the intercepted information is parsed and integrated according to the rules, and the valid information specified in the intercepted information is extracted, and the information is integrated with the operation label and other information in the audit rules to generate a detailed and complete operation record, and anomaly detection or record storage is performed according to the audit type of the operation record.

Specifically, when a specified operation is executed in the audited service, the operation interceptor will intercept the operation and send the interception information to the operation parser. The operation parser will parse and integrate the captured information according to the audit rule instance configured in the configuration file, and store the generated detailed and complete operation record in the database through the record storage according to the rule instance or send it to the anomaly detector. After receiving the operation record, the anomaly detector will compare it with the stored historical operation record to detect whether it is an abnormal operation or function freezing. If it is determined to be an abnormal operation, the information will be sent to the exception handler, and the specified early warning feedback will be performed according to the audit rule instance, and returned to the specific project through the operation interceptor.

In the audit system provided in the embodiment of the present application, the operation interceptor will intercept the functional operation triggered by the user, generate interception information, and send the interception information to the operation parser. The operation parser will parse and integrate the captured information according to the audit rule instance configured in the configuration file, generate an operation record, and then store the generated detailed and complete operation record in the database through the record storage according to the rule instance or send it to the anomaly detector. After receiving the operation record, the anomaly detector compares it with the stored historical operation record to detect whether it is an abnormal operation or functional freezing. If it is determined to be an abnormal operation, the information is sent to the exception handler, and the specified early warning feedback is performed according to the audit rule instance, and returned to the specific project through the operation interceptor. Because the present application adds the operation audit function to multiple projects in a non-code invasive manner, and provides a method of configuring specific audit rules according to specific requirements, it reduces the coupling degree of the operation audit code in the system while ensuring that each project can define specific audit rules as needed, further ensuring the accuracy of the audit.

Please refer to Figure 5, which is a flowchart of an audit method for executing a function in a service provided in an embodiment of the present application, which is applied to an anomaly detector. As shown in Figure 5, the method of the embodiment of the present application may include the following steps:

S301, receiving an operation record based on an information receiver;

S302, obtaining historical operation records;

S303, performing a comparison test on the operation record and the historical operation record to generate a test result;

S304, when the detection result shows an abnormal operation, abnormal information is generated and sent to the abnormality handler.

In one possible implementation, the anomaly detector compares the operation records that need to be detected for anomalies with the historical operation records stored in the memory to determine whether the operation is an overclocking operation, an illegal operation of logging in from a different location, a malicious and frequent crawling operation, etc. If an anomaly is detected, the information is sent to the anomaly handler. The normal operation is parsed, and the main part and the timestamp are intercepted and stored in the memory according to the rules parsed from the original configuration information in the operation. The anomaly detector extracts a portion of the operation cache records stored in the memory for detection at regular intervals, and clears the expired data of the operation record that has exceeded the longest unit time specified in the operation audit, so that there will not be too much expired data in the cache operation record.

When the exception handler receives an exception notification from the exception detector, it performs specified exception processing according to the exception handling settings provided by the specified configuration file in the operation record, such as: printing log information, returning custom exception information, sending notification emails to administrators, sending user message notifications, etc.

In the audit system provided in the embodiment of the present application, the operation interceptor will intercept the functional operation triggered by the user, generate interception information, and send the interception information to the operation parser. The operation parser will parse and integrate the captured information according to the audit rule instance configured in the configuration file, generate an operation record, and then store the generated detailed and complete operation record in the database through the record storage according to the rule instance or send it to the anomaly detector. After receiving the operation record, the anomaly detector compares it with the stored historical operation record to detect whether it is an abnormal operation or functional freezing. If it is determined to be an abnormal operation, the information is sent to the exception handler, and the specified early warning feedback is performed according to the audit rule instance, and returned to the specific project through the operation interceptor. Because the present application adds the operation audit function to multiple projects in a non-code invasive manner, and provides a method of configuring specific audit rules according to specific requirements, it reduces the coupling degree of the operation audit code in the system while ensuring that each project can define specific audit rules as needed, further ensuring the accuracy of the audit.

Please refer to Figure 6, which is a flowchart of an audit method for executing a function in a service provided in an embodiment of the present application, which is applied to an exception handler. As shown in Figure 6, the method of the embodiment of the present application may include the following steps:

S401, when receiving exception information sent from an exception detector, performing exception handling on the exception handling settings provided by the specified configuration file corresponding to the triggered specified function.

In one possible implementation, when an exception notification is received from an exception detector, specified exception handling is performed according to the exception handling settings provided by the specified configuration file in the operation record, for example: printing log information, returning custom exception information, sending a notification email to an administrator, sending a user message notification, etc.

Furthermore, it also includes a record storage device, which organizes the received operation records and abnormal detection results into operation warning information and stores it in a database, so that the administrator can quickly lock various abnormalities, illegal operations or detect potential problems.

For example, as shown in Figure 7, the operation audit backend center includes information receivers, anomaly detectors, record storage, and information display. It is mainly used to receive information sent by the operation audit SDK, perform anomaly detection, record storage, and finally return the results.

The operation audit SDK includes an operation interceptor, an operation parser, an information sender, and an exception handler. It is used to access projects that require operation audits, intercept information, parse the information according to the operation audit requirements in the custom configuration file, and send it to the operation audit backend center. Finally, the information returned by the operation audit backend center is fed back to the project.

It should be noted that this solution can deploy the operation audit SDK on each platform. SDK is a software development kit.

In the audit system provided in the embodiment of the present application, the operation interceptor will intercept the functional operation triggered by the user, generate interception information, and send the interception information to the operation parser. The operation parser will parse and integrate the captured information according to the audit rule instance configured in the configuration file, generate an operation record, and then store the generated detailed and complete operation record in the database through the record storage according to the rule instance or send it to the anomaly detector. After receiving the operation record, the anomaly detector compares it with the stored historical operation record to detect whether it is an abnormal operation or functional freezing. If it is determined to be an abnormal operation, the information is sent to the exception handler, and the specified early warning feedback is performed according to the audit rule instance, and returned to the specific project through the operation interceptor. Because the present application adds the operation audit function to multiple projects in a non-code invasive manner, and provides a method of configuring specific audit rules according to specific requirements, it reduces the coupling degree of the operation audit code in the system while ensuring that each project can define specific audit rules as needed, further ensuring the accuracy of the audit.

The present invention also provides a computer-readable medium on which program instructions are stored. When the program instructions are executed by a processor, an audit method for the execution of functions in the services provided by the above-mentioned various method embodiments is implemented.

Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiments can be implemented by instructing the relevant hardware through a computer program, and the program can be stored in a computer-readable storage medium. When the program is executed, it can include the processes of the embodiments of the above-mentioned methods. The storage medium can be a disk, an optical disk, a read-only storage memory, or a random access memory, etc.

The above disclosure is only the preferred embodiment of the present application, which certainly cannot be used to limit the scope of rights of the present application. Therefore, equivalent changes made according to the claims of the present application are still within the scope covered by the present application.

Claims (9)

1. An audit system for the execution of a function in a service, characterized in that the system comprises: Operation audit SDK, operation audit backend center, cache and database; among them, The operation audit backend center is respectively connected to the operation audit SDK, the cache and the database; wherein, The operation audit SDK is used to access the service that needs to be audited, intercept the trigger operation of the service to generate interception information, and parse the interception information according to the audit rules in the preset custom configuration file and send it to the operation audit backend center; The operation audit backend center is used to perform anomaly detection on the intercepted information sent by the operation audit SDK to generate a detection result, and save the detection result and feed it back to the operation audit SDK; The cache is used to store the interception information; The database is used to store early warning information. 2. The audit system for executing a function in a service according to claim 1, characterized in that: The operation audit SDK includes an operation interceptor, an operation parser, an information sender and an exception handler; wherein, The operation interceptor, operation parser, information transmitter and exception handler are sequentially connected in communication. 3. The audit system for executing a function in a service according to claim 2, characterized in that: The exception handler is communicatively connected with the operation interceptor. 4. The audit system for executing a function in a service according to claim 3, characterized in that: The operation audit background center includes an information receiver, a record storage, an anomaly detector and a display for information display; wherein, The information receiver is communicatively connected to the information transmitter, the anomaly detector and the record storage device respectively; The anomaly detector is communicatively connected to the cache; The record storage, the database and the display for displaying information are communicatively connected in sequence. 5. An audit method for the execution of a function in a service implemented by the system according to any one of claims 1 to 4, characterized in that it is applied to an operation interceptor, and the method comprises: When it is monitored that a specified function in the audited service is triggered and executed, interception information is generated after intercepting the triggered specified function; wherein the interception information at least includes method parameters and return values in the triggered specified function; The interception information is sent to the operation parser. 6. An audit method for the execution of a function in a service implemented by the system of claim 4, characterized in that it is applied to an operation parser, and the method comprises: Receiving interception information sent by the operation interceptor to the operation parser; Get the audit rules contained in the pre-configured profile; Parsing and integrating the interception information based on the audit rules to generate an operation record; Sending the operation record to the information transmitter, and sending the operation record to the information receiver based on the information transmitter; sending the operation record to a record storage based on the information receiver; The operation record is sent to a database for storage based on the record storage. 7. An audit method for the execution of a function in a service implemented by the system of claim 4, characterized in that the method is applied to an anomaly detector, the method comprising: receiving an operation record based on the information receiver; Get historical operation records; Compare and test the operation record with the historical operation record to generate a test result; When the detection result shows an abnormal operation, abnormal information is generated and sent to an abnormality processor. 8. An audit method for executing a function in a service implemented by the system of claim 4, characterized in that the method is applied to an exception handler, and comprises: When the exception information sent from the exception detector is received, the exception handling is performed on the exception handling settings provided by the specified configuration file corresponding to the triggered specified function. 9. A computer storage medium, characterized in that the computer storage medium stores a plurality of instructions, wherein the instructions are suitable for being loaded by a processor and executing the method according to any one of claims 5 to 8.