WO2004051929A1 - Audit platform system for application process based on components - Google Patents

Abstract

The present invention focuses on an audit platform system for trailing and/or monitoring the operation of computer information systems in various fields, which belongs to the field of computer information security technology. The chief components of this system include a data acquisition proxy connected to a control server, a control server operating on the data acquisition proxy which includes probes , a service database, real-time analyzer, an ex-post-data analyzing tool, a auto report tool, an audit policy library, and an audit knowledge management library, and user consoles. The invention characterizes in the analysis process and early-warning by real-time or quasi real-time scanning the trail information which is left by various interior and exterior behavior procedures on each layers of the service system during the operational process of the service system.

Description

 Component-based application process audit platform system Technical field

 The invention is an audit platform system which is directed to and applied to the operation tracking and monitoring of computer information systems in various industries, and in particular relates to real-time scanning processing and auditing of trace information left by various behaviors during the operation of various computer information systems. The platform system belongs to the field of computer information security prevention technology. technical background

 Since the development of security technology related to computer information security, the following typical and effective technical solutions have been formed:

 1. Firewall technology-This is an important security technology developed in recent years. It is characterized by checking network communication at the network entry point, and providing internal and external network communication under the premise of protecting the security of the internal network according to the security rules set by the customer.

 2. Virus protection technology—Virus has always been one of the main problems of information system security. The characteristics of virus protection technology are to prevent the spread of viruses, check and remove viruses, upgrade virus databases, and install on firewalls, proxy servers, and PCs. Java and ActiveX control scanning software. Unauthorized control download and installation are prohibited.

 3. Intrusion detection technology-Intrusion detection system is a new type of network security technology that has appeared in recent years. It can be divided into host-based and network-based. The purpose is to provide real-time intrusion detection and take corresponding protection measures, such as recording evidence for tracking. And recovery, disconnection of network connections, etc., which are characterized by protocol analysis and detection capabilities, complete security, accuracy and integrity, anti-spoofing capabilities, and

1

Replacement page (Article 26) Code efficiency and fast mode update.

 4. Security scanning technology-Another important technology in network security technology is security scanning technology, which also has server-based and network-based distinctions. When it cooperates with firewalls and security monitoring systems, it can greatly improve the network. Security. The server-based scanner mainly scans server-related security vulnerabilities and proposes corresponding solutions; while the network-based security scanner mainly scans and sets servers, routers, bridges, switches, access servers, firewalls, etc. in the network The security vulnerability of the device can be set to simulate attacks to test the defense capabilities of the system.

 Beside this there is:

 5. E-mail system security technology-This technology guarantees the security of e-mail.

 6. Operating system security technology-Many kinds of operating systems are usually run in the information network. The technologies include access control, security policies, data integrity, and auditing technologies.

 The widespread application of computer information systems in various industries has led to a rapid increase in the level of informatization in these industries. At the same time, the use of computer crimes and the security of information systems have become increasingly prominent. According to the applicant's understanding, most transgressive computer crimes in various industries have the following characteristics: Frequent use of job convenience (this is related to the fact that many crime subjects are special subjects); often used fraudulent methods to fabricate facts and hide the truth; most Use aggressive action to commit crimes; misconduct on the job is more common; most of them use large amounts, huge amounts or cause significant losses as the standard for completed crimes. Compared with traditional criminal methods, computer crimes in the above industries have the following characteristics-one is high intelligence, high technology and high capture; the other is the diversity of crime methods; the third is not restricted by time and area; the fourth is concealment Strong sex, long incubation period, low risk, easy to destroy criminal evidence, difficult to obtain evidence and detect, and other characteristics, it has far more serious impact and consequences than other methods of crime.

Although in order to ensure the security of the computer information system, some preventive control measures can be taken, such as: firewall, network isolation, access control technology, etc., encryption technology and identity authentication can also be used in combination. Technology, etc. However, analysis of the security problems facing the application system reveals that there are currently no effective measures to prevent threats based on internal business processes. These threats include: illegal login, illegal operations, unauthorized modification of data, and unauthorized restoration of historical data. , Unauthorized deletion of data, programs, system configuration, illegal modification of software, unauthorized change of software deployment and update of software version, unauthorized deletion of log files, deliberate drilling of business operations, internal co-operation, etc. The widespread use of legitimate business operating system rights.

 Because traditional information security precautions are often based on network communications, operating systems, and transport levels, there are few application-level security precautions for specific business processes. And business information system security is a multi-level and multi-angle system engineering, which needs to consider all aspects related to system security. Various existing solutions are often based on data communication and data storage, and it is difficult to perform information auditing on application behavior processes. At the same time, there is also a lack of flexibility to perform multi-level and multi-angle on key applications in application systems. Supervise the audit platform system. Summary of the Invention

 The purpose of the present invention is to propose a component-based application process audit platform system that uses information technology as a means to apply systems, application processes, and application results to various specific industries on the rationality and process of system security. The legitimacy of the behavior, the authenticity of the resulting data, objective and timely monitoring and auditing in accordance with the requirements of security, standardization, and authenticity of business processing, timely notification of various violations and suspicious events, and submission of various audit reports, thereby Effectively prevent and stop computer business crime.

Studies have shown that any behavior that poses a threat to the security of business information systems will always leave some trace information on all levels of the application system. With the help of these trace information, an appropriate audit strategy can be adopted. Discover in a timely manner what business is or will be implemented in the system Hidden crimes, to avoid the occurrence of crimes and other incidents. Specifically, in the internal business system security issues, the use of business information systems will inevitably leave behind at the system or application layer such as identity, place, time, event operation traces, event occurrence frequency, and operation action timing. Trace information such as information, sudden changes in key data items, and so on. By monitoring and auditing this information, you can discover business information system security problems in a timely manner, and prevent and stop computer business crimes. This is the application process audit method used by the present invention.

 Based on this knowledge, in order to achieve the above objectives, the component-based application process audit platform system of the present invention includes a known computer system, and further includes:

 ^ AGENT: installed in the user business application environment, manages the download of user business audit rule configuration information and component packages, schedules management data probes (Probe), and data collection agents connected to the control server. The data collection agent (AGENT) provides The data probe (Probe) component management scheduling function;

 —— Probe (also known as probe): a data probe installed on the data collection node, based on componentization, collecting data according to the user's configuration, and uploading it to the control server in real time;

 —— Control Server: Installed on an independent system, managed by the internal control department, providing management of rule configuration libraries and component libraries, dynamically calling various types of data analyzers, data miners and other auxiliary component function packages for data analysis and mining A control server including:

 A. A business database storing the audit record data collected by the probe, filtered by the filter, and formatted;

 B. Complete the real-time analyzer for real-time analysis and processing of the collected data according to the analysis strategy defined by the audit rule base, determine the risk level, and trigger the audit event;

C. Post-event data analysis tools that complete the function of further digging and analyzing the collected data and the original database of the application system according to the audit rules; D. An automatic reporting tool that customizes reports and generates information audit reports according to user needs;

 E. Real-time alarm or SNMP interface for connecting with other systems;

 F Define an audit rule base for probe data collection strategies, real-time analyzer filtering, analysis strategies, and how post-mortem data analysis tools work;

 —— User Console: A graphical user console for users to configure rules and view reports and other related information.

 The above user business application environment is a computer business information system of various industries. The data probe includes server probes for monitoring application servers, network probes for monitoring networks, database probes for monitoring databases, monitoring application software, and applications for monitoring business processes. Layer probes, etc.

 The platform uses ORB and complies with the C0RBA specification. It uses faceted description methods to describe application components, and adopts library management and automatic release technology. Based on the domain engineering method, the platform establishes a domain audit component library, and uses reusable software components as assembly blocks to assemble audit data collection, analysis, and reporting functions. On the Agent side, the platform uses network transparent interception to intercept various data packets on the network, and analyzes and processes various log records of system activities. On the Control Server side, information is collected, analyzed, and processed through the application of process audits, and specific activity characteristics implied in the system activity information are identified and extracted, and various existing and potential violations are identified.

When working, the data collection node installed in the existing business application environment downloads user business audit rule configuration information and component packages, starts the data detector, and completes the scheduling and management of the data detector; the data detector is scheduled according to the user's configuration The probe collects data and uploads it to the control server in real time; the control server stores the probe collection from the business database according to the probe data collection strategy, real-time analyzer filtering, analysis strategy, and post-mortem data analysis tool definition defined by the audit rule base. , Filtered and formatted audit log data; real-time analyzer The collected data is analyzed and processed in real time according to the analysis strategy defined by the audit rule base, the risk level is determined and the audit event is triggered; the post-mortem data analysis tool completes the further mining and analysis of the collected data and the original database of the application system according to the audit rules; automatic reporting tools Customize reports and generate information audit reports according to user needs; transmit them to the user console through the real-time alarm / SIP interface for users to configure rules and view reports and other related information, so as to achieve various application systems, application processes, and application results The rationality of safety, the legitimacy of process behavior, and the authenticity of the result data are subject to objective and timely monitoring and auditing. Various violations and suspicious events are reported to the police in time, and various audit reports are submitted.

 It can be seen that the present invention is a security audit platform for specific business process applications, which comprehensively applies component technology, security management and security architecture technology, security audit and intrusion detection and early warning technology, adopts the application process audit method, and provides a A common platform for application of security audit in the field, introducing security audit based on business rules into the security management system, providing auditors with complete in-event and post-event system audit tools, which are provided by componentization, rule configuration, and knowledge base The flexibility and composability provided guarantee conditions for adapting to the wide variety of industry applications; the openness and scalability of the component library, audit rule database, and knowledge management database provided technical support for adapting to the changing development of different industry applications.

 Compared with the above-mentioned various existing computer security protection technologies, the present invention has various internal and external behavior processes in the operation process of the business system through in-process audits at various levels of the information system (application system, database, operating system, network The characteristics of the trace information left behind are real-time and quasi-real-time scanning, analysis, and early warning. Therefore, various violations and suspicious events can be found in time, and then computer crime can be fundamentally prevented and eliminated to ensure the security of the information system. Compared with various post-mortem monitoring systems currently used by commercial banks that fall into the scope of post-mortem audit, it has obvious characteristics and substantial progress.

Compared with intrusion detection systems, the following table reflects the essential differences: Compare the application software system in the application layer of the APA system intrusion detection system, and the data layer in the seven layers of the 0SI protocol. The link layer, the database, the operating system, and the network electronics industry and the upper four layers except the application software concern

 General basic software systems such as non-standard operations, non-orthodox systems, databases, and other operating systems in the business process, and common business behaviors conduct audit data according to business rules and do not care about specific business characteristics and behaviors. Only care about common network behaviors (such as illegal browsing of web management objects, sending E-mail, FTP, shared files, etc.) whether there is a way to implement behaviors that endanger the basic network. Application process analysis. Content filtering, rule matching. Focus on business applications. For the central network, the system is the central user, business auditors, network administrators are not related to the specific business on the basic network, and only manage the bearer network. Domain applications are targeted by componentized and modular basic networks that are suitable for all industries. Object

 Flexibility to adapt to various industries

 Same application Adaptability Componentized platform, secondary development can be single, not secondary development Adjustable audit rules can be described or carried out Cannot respond to the diversity of application systems Evolvability Component adjustment to adapt to changes in demand, with

 Good evolutionary

BRIEF DESCRIPTION OF THE DRAWINGS

 The invention is further described below with reference to the drawings:

 FIG. 1 is a schematic diagram of a system structure according to the first embodiment of the present invention.

 FIG. 2 is a topology diagram of the first embodiment of FIG. 1. FIG.

 FIG. 3 is a schematic diagram of an application environment of a bank deposit and withdrawal service in Embodiment 1. FIG.

 FIG. 4 is a schematic diagram of a bank deposit and withdrawal business decomposition process in Embodiment 1. FIG.

FIG. 5 is a schematic diagram of a topology according to a second embodiment of the present invention. detailed description

Example one

 This embodiment is a component-based application process audit platform system applied to a large-scale financial network system. Its basic structure is shown in the figure, and the following main parts are composed:

 ——Data collection agents installed on existing central server clusters, downloading user business audit rule configuration information and component packages, scheduling and managing data probes, and connecting to control servers; ——located on server networks, branch office servers, On each data collection node including the branch network, component-based data collection is performed based on the configuration of the user and the data detector of the control server is uploaded in real time;

 ——Control Server, which installs an independent operating system and provides management of automatic configuration libraries and component libraries, and dynamically calls various types of data analyzers, data miners and other auxiliary component function packages for data analysis and mining, including:

 A. A business database storing the audit record data collected by the probe, filtered by the filter, and formatted;

 B. Complete the real-time analysis of the collected data according to the analysis strategy defined by the audit rule base, determine the risk level and trigger the audit event;

 C. Post hoc data analysis tools that complete the function of further digging and analyzing the collected data and the original database of the application system according to the audit rules;

 D. An automatic reporting tool that customizes reports and generates information audit reports according to user needs;

 E. Integrated multiple event response interfaces, real-time alarm / SNMP interface that can provide automatic program operation, SIP security event alarm, mobile short message, EMAIL alarm and other methods;

F. Including the management of probe component deployment and automatic component generation tools, users can easily expand the system to meet the complexity and variability of the audit component library of the application system; G. An audit rule library that defines probe data collection strategies, real-time analyzer filtering, analysis strategies, and how post-mortem data analysis tools work;

 H. The audit knowledge management library that applies audit templates, audit business descriptions, audit event risk level definitions, audit event processing results, etc. in the field (industry), so as to adapt to various different businesses through template combination and audit knowledge management database update Field

A visual user console for users to configure rules and view reports and other related information.

 This system can be represented by the topological image of Figure 2. The specific configuration is as follows:

 1. Data collection agent-installed on the central server cluster of the existing large financial network system, the data collection agent (Agent) provides a component-based data collection probe operation management support platform, and the data collection agent (Agent) is installed After that, all data collection probe components and data collection rule configuration information are uniformly configured and deployed in the user console and distributed to the data collection agent

 (Agent). The supported operating systems are UNIX, SCO UNIX, UNIWARE, WIN98 / NT / 2000 / XP, etc. All data collection agents are connected to independent information audit control servers.

 2. Control server "~~ ^ It is installed on an independent server and is the core of the entire system. It completes the filtering, formatting, storage, analysis, and alarm functions of the audit data. The database server that stores the audit data can be subject to data pressure. Use a stand-alone server or merge with the control server.

 3. User Console-a visual graphical user terminal for users to configure rules and view reports and other related information. All management is performed on the user console.

 In the following, a bank deposit and withdrawal service is taken as an example to specifically describe the system working situation of this embodiment. The application environment of the complete bank deposit and withdrawal service in this example is shown in Figure 3, and the business process is broken down as shown in Figure 4. The component-based application process audit platform system of this embodiment passes the following key domain element pairs:

Claims

Safety audit of process behavior:  1. Identity. Generally, the application system decides whether to implement the access requirements proposed by the user. The user identity is one of the core issues of the security policy.  2. Location. A manageable network is established through the identification code of the network device, so that the access location and access right of the access device can be accurately understood and controlled.  3. Time. Operating time is often associated with the rationality of application behavior.  4. Behavioral process characteristics: Frequency of events, sudden changes in key data items, timing information of operation actions, and other business action behavior characteristics.  When the bank deposit and withdrawal business is carried out, the corresponding probe components deployed on the terminal front-end, the central switch network, and the business host are transferred from the audit knowledge management library into the corresponding field, applying the audit rule template, configuring the data collection strategy, and real-time After analyzing the strategy, you can monitor the following business links through APA and audit the suspicious behavior in real time: ''  1. The operator logs in. The legitimacy of the action is related to the identity, location, time, and process behavior characteristics. For example, if someone logs in the savings application system outside the normal working hours of the counter terminal 8: 30-5: 30, and tries to log in 5 times repeatedly. Above, one login name is registered at multiple counter terminals, etc.  2. Enter the withdrawal operation. The legitimacy of the action is related to the identity, location, time, and process behavior characteristics. For example, if someone performs a withdrawal operation at the counter terminal outside 8: 30-5: 30 on working days, the withdrawal amount is greater than 5000. Wait.  3. Connect to the database, such as directly connecting to the background database outside the information center, and repeatedly trying to log in more than 5 times.  4. Deduction of account operations, such as withdrawal amount greater than 5000, accumulated deduction account operation greater than 10,000 in one day, and the interval between withdrawals of the same account in multiple locations is less than 1 minute. Once installed on the terminal front end, central switch network, and business host data collection nodes The corresponding probe component of the above finds the suspicious event, that is, it is uploaded to the control server in real time, and the control server sends the corresponding alarm signal and the required report or other information to the User Console through the real-time alarm / SNMP interface. Related visual graphical information.  It can be seen that the system of this embodiment has the following innovations:  1. Establish an audit system based on the application behavior process for various security risks and business risks in the application system operation process in various fields. Real-time and quasi-real-time scanning and processing of trace information left at various levels of the information system (application system, database, operating system, network) by various internal and external behavior processes during the operation of the business system, and based on the reasonableness of business processing And legitimacy, authenticity, and authenticity audit strategies and methods for real-time analysis and early warning of information.  2. Combine the business processing characteristics of the domain application with security audit rules. Through the customization of visual audit rules, define the data collection strategy of the probe, the filtering of the real-time analyzer, the analysis strategy, and the working method of the post-mortem data analysis tool, drive the probe and analyzer to work; and combine with the host layer and network layer security measures , Can form a complete information security audit system.  3. A component-based information audit platform. The platform incorporates advanced ideas of software framework technology, distributed computing models, and interface standards. It can quickly develop and deploy new probes, analyzers, and other components based on the platform, thereby flexibly expanding system functions and adapting to the complexity of various applications. .  4. Establish a domain application audit knowledge management database. The knowledge management database stores the domain application audit rule template, audit business description, audit event risk level definition, and audit event processing results, etc., so as to continuously accumulate security audit knowledge and realize the reuse of information audit knowledge. '' In short, this embodiment uses the method of application behavior process audit to monitor and audit the application behavior characteristics of the business system, the security, standardization, and authenticity requirements of its business processing, and to monitor various violations and suspicious events. Make an alarm. It can be seen from the above description of this embodiment that, first, the component-based application process audit platform system System is an auditing platform based on application behavior process for domain application systems. Due to the wide variety of application systems, limited openness, and different concerns, it is very difficult to audit information on application systems in the field. The traditional audit trails for computer information systems, the preservation of audit records, and the maintenance of audit logs are mainly concentrated on the network. Layer, system layer, and more for logs. Although the application system itself has more or less implemented some log functions, the comprehensiveness of the log is difficult to guarantee, and there is no corresponding log analysis and early-warning processing means. There are also problems with log storage management and tamper prevention. The component-based application process audit platform system adopts a platform-based approach, and applies behavioral process audit methods to business systems to go beyond simple post-event log audits.  Second, the component-based application process audit platform system combines the business processing characteristics of domain applications with security audit rules. In the real environment, there are a large number of cases in which information systems are used illegally as legitimate users, and it is not effective to audit them based on traditional security audit methods. Combined with the business processing characteristics and business rules of the domain application, these suspicious and abnormal business operations can be identified. However, due to the complexity of business systems, a thorough understanding of the entire field of application and a set of methods to customize audit rules are required. The combination of component-based application process auditing platform system and host layer and network layer security measures can form a complete information security auditing system. In addition, the component-based application process audit platform system is a component-based information audit platform. The component-based application process audit platform system is application-oriented. In order to cope with the complexity and changes of applications, componentization is a natural choice. The component-based application process audit platform system is a distributed system. The platform needs to implement the centralized management, automatic deployment, and rapid development and assembly capabilities of components. The component-based application process audit platform system has greatly improved the security audit due to componentization. At the same time as the degree of productization and scalability, it also brings certain complexity to the system implementation. Example two  This embodiment is a component-based application process auditing platform system applied to an intranet of an enterprise or a government. The structure is shown in FIG. 5. The basic structure is the same as that of the first embodiment, except that: 1. Data is not centrally managed, and applications are also distributed, that is, distributed in various application systems; the corresponding network is also divided into several functional subnets; therefore, a separate network probe needs to be deployed on each subnet, on the application server Deploy corresponding application probes;  2. Applications are mainly e-government, enterprise ERP, office automation, etc. Since the business in the financial field is different from the previous example and the security requirements are different, the audit rules are different.  The specific working conditions of this embodiment may be combined with different auditing rules, and so on according to the embodiment, and are not described in detail.  In addition to the above embodiments, the present invention may have other embodiments. Any technical solution formed by equivalent replacement or equivalent transformation falls within the protection scope claimed by the present invention.