TW201928747A - Server and monitoring method thereof - Google Patents

Abstract

A server and a monitoring method thereof are provided. The method includes: retrieving predetermined parameters corresponding to attributes of the server, wherein each attributes belongs to a first or a second type attribute; monitoring current parameters of the attributes; determining whether the current parameters are abnormal; if a specific current parameter of the current parameters is abnormal, determining whether it is necessary to provide a warning related to the specific current parameter based on policy sets; if the specific current parameter satisfies one of the policy sets, do not provide the warning, otherwise providing the warning, wherein the warning indicates one of the attributes corresponding to the specific current parameter and indicates the one of the attributes belongs to the first or the second type attribute.

Description

Server and its monitoring method

The invention relates to a server and a monitoring method thereof, and in particular to a server capable of detecting a malicious threat immediately and a monitoring method thereof.

There are many servers in the enterprise that provide various services, such as File Server, Database Server, Mail Server, and Web Server. How to ensure the internal operation of the enterprise server to provide users with stable services and ensure that the server is not threatened by malicious programs is an information security issue and technology that enterprises value.

In view of the increasing complexity of malware attacks and the increasing number of international companies, Mandiant's threat report in 2014 shows that 67% of companies are unable to detect threats themselves and must rely on them. The outside world helps to detect. Moreover, statistics show that when a company is exposed to a potential threat, it takes an average of 229 days to detect it.

Therefore, it will be an extremely important issue for those skilled in the art to discover the malicious threat on the server more immediately.

In view of this, the present invention provides a server and a monitoring method thereof, which use the attribute information of the server as a basis for behavior analysis, and establish an appropriate servo according to setting an appropriate predetermined parameter value and a plurality of elastic criteria. The normal behavioral benchmark of the device. Thereby, the server of the present invention can analyze whether a specific malicious behavior and an abnormal behavior occur, thereby instantly detecting the existence of a malicious threat.

The present invention provides a server monitoring method, which is suitable for a server, comprising: obtaining a plurality of predetermined parameter values corresponding to a plurality of attribute information of the server, wherein each of the attribute information belongs to a first type attribute or a second a class attribute; a plurality of current parameter values for monitoring the attribute information; determining whether the current parameter value is abnormal according to the predetermined parameter value of the attribute information; and when a specific current parameter value of the current parameter value is abnormal, according to the plurality of The flexibility criterion group determines whether an alarm associated with the specific current parameter value is required to be provided, wherein each of the foregoing flexibility criterion groups includes at least one elasticity criterion; and if the specific current parameter value meets one of the foregoing flexibility criteria groups, the provision is not provided The foregoing alarm, and vice versa, providing the foregoing alarm, wherein the foregoing alarm indicates one of the foregoing attribute information corresponding to the specific current parameter value, and the foregoing one of the attribute information indicating the foregoing attribute information is the foregoing first type attribute or the foregoing The second type of attribute.

The invention also proposes a server comprising a storage circuit and a processor. The storage circuit stores a plurality of modules. The processor is connected to the foregoing storage circuit, and accesses the foregoing module to perform the following steps: obtaining a plurality of predetermined parameter values corresponding to the plurality of attribute information of the server, wherein each of the foregoing attribute information belongs to a first type attribute or a second a class attribute; a plurality of current parameter values for monitoring the attribute information; determining whether the current parameter value is abnormal according to the predetermined parameter value of the attribute information; and when a specific current parameter value of the current parameter value is abnormal, according to the plurality of The flexibility criterion group determines whether an alarm associated with the specific current parameter value is required to be provided, wherein each of the foregoing flexibility criterion groups includes at least one elasticity criterion; and if the specific current parameter value meets one of the foregoing flexibility criteria groups, the provision is not provided The foregoing alarm, and vice versa, providing the foregoing alarm, wherein the foregoing alarm indicates one of the foregoing attribute information corresponding to the specific current parameter value, and the foregoing one of the attribute information indicating the foregoing attribute information is the foregoing first type attribute or the foregoing The second type of attribute.

Based on the above, the present invention provides a server and a monitoring method thereof, which can determine whether the current parameter value of each attribute information is abnormal according to a predetermined parameter value of the attribute information, and issue an alarm when the current parameter value does not meet the corresponding elastic criterion. In order to enable relevant personnel to conduct tests on the fly.

The above described features and advantages of the invention will be apparent from the following description.

Please refer to FIG. 1 , which is a schematic diagram of a server according to an embodiment of the invention. In this embodiment, the server 100 includes a storage circuit 110 and a processor 120. The server 100 is, for example, a file server, a database server, a mail server, and a web server in the company, but is not limited thereto. The storage circuit 110 is, for example, a memory, a hard disk, or any other component that can be used to store data, and can be used to record a plurality of code codes or modules.

The processor 120 is coupled to the storage circuit 110. The processor 120 is, for example, a general purpose processor, a special purpose processor, a conventional processor, a digital signal processor, a plurality of microprocessors, one or more microprocessors combined with a digital signal processor core, and controls. , Microcontroller, Application Specific Integrated Circuit (ASIC), Field Programmable Gate Array (FPGA), any other kind of integrated circuit, state machine, based on advanced reduced instructions Advanced RISC Machine (ARM) processors and similar products.

2 is a flow chart of a method for monitoring a server according to an embodiment of the present invention. The following steps are used to describe the steps of the method shown in FIG.

In this embodiment, the relevant personnel of the server 100 may preset corresponding predetermined parameter values for the plurality of attribute information to be monitored, and the attribute information may be divided into a plurality of categories. For example, the foregoing attribute information includes, but is not limited to, an Internet Protocol (IP) address source, a server 100 traffic, an IP address from an IP address source, and an IP address source. At least one of the line frequency, the processor usage rate of the server 100, the memory usage rate of the server 100, the hard disk access speed of the server 100, and the number of operational communication ports of the server 100.

In various embodiments, the IP address source can be used to identify where the user is connected to the server 100 to use the services of the server 100. The IP traffic originating from the IP address is, for example, the traffic generated when the user accesses the server 100. The connection frequency of the IP address source is, for example, the frequency at which the aforementioned user accesses the server 100. The server 100 traffic may be the traffic of all the IPs of the services using the server 100 that are counted by the processor 120 for a certain period of time.

Further, based on attribute information such as the processor usage rate of the server 100, the memory usage rate of the server 100, and the hard disk access speed of the server 100, the person concerned can observe whether or not the server 100 has an abnormally high load condition. In addition, since the server 100 enables different communication ports depending on the purpose of the service, the relevant personnel can monitor the activation and communication of the communication port and the number of communication ports, and detect the abnormal behavior on the server 100 early.

Moreover, in an embodiment, each attribute information of the server 100 can be classified as belonging to the first type attribute or the second type attribute. For example, attribute information related to the network behavior of the server 100 can be classified into a first type of attribute, such as IP address source, server 100 traffic, IP address source IP address, and IP address source. The connection frequency of the ground, etc.

On the other hand, the attribute information related to the operating condition of the server 100 itself can be classified into the second type of attributes, such as the processor usage of the server 100, the memory usage of the server 100, and the server 100. The hard disk access speed and the number of operational communication ports of the server 100, etc., but the present invention is not limited thereto.

For each of the foregoing attribute information, the individual corresponding predetermined parameter values may be presented in conjunction with Tables 1 and 2 below, where "X" represents any value or text that can be set by the relevant personnel according to their needs or experience (for example, a country) ). Table 1 (first class attribute) Table 2 (second class attribute)

The relevant personnel can initially establish a normal behavioral benchmark of the server 100 by the predetermined parameter values set by the above attribute information.

After the relevant person completes the setting of the foregoing preset parameter values, in step S210, the processor 120 acquires a predetermined parameter value corresponding to the attribute information, and monitors the current parameter value of the attribute information in step S220. The foregoing current parameter value is, for example, a numerical value or content presented by each attribute information in response to the operation of the server 100. Taking the attribute information of the IP traffic of the IP address source as an example, the current parameter value monitored by the processor 120 may be the value Y (MB/minute). Taking the attribute information of the "processor usage rate" as an example, the current parameter value monitored by the processor 120 may be the value Z (%). For those of ordinary skill in the art, the possible aspect of the current parameter values of the remaining attribute information should be derived from the above teachings, and therefore will not be described herein.

Thereafter, in step S230, the processor 120 determines whether the current parameter value is abnormal according to the predetermined parameter value of the attribute information. In an embodiment, the processor 120 takes the first current parameter value from the current parameter value, and takes out the first predetermined parameter value from the predetermined parameter value, where the first predetermined parameter value and the first current parameter value correspond to the attribute information. The first attribute information in . Next, the processor 120 may determine whether the first current parameter value exceeds the first predetermined parameter value, and if yes, determine that the first current parameter value is abnormal, and otherwise determine that the first current parameter is not abnormal.

For example, if the attribute information to be observed by the processor 120 is “IP traffic of the IP address source”, the processor 120 may extract the current parameter value of the “IP traffic of the IP address source” (for example, the value Y). (MB/min)). Next, the processor 120 can take out a predetermined parameter value (for example, a value M (MB/minute) of the "IP traffic of the IP address source". Thereafter, the processor 120 can determine whether the value Y (MB/minute) exceeds the value M (MB/min), and if so, the value Y (MB/minute) is abnormal, otherwise the value Y (MB/minute) is not abnormal. .

For another example, if the attribute information to be observed by the processor 120 is "processor usage rate", the processor 120 may take out the current parameter value of the "processor usage rate" (for example, the value P (%)). Next, the processor 120 may take out a predetermined parameter value of the "processor usage rate" (for example, the value Q (%)). Thereafter, the processor 120 may determine whether the value P (%) exceeds the value Q (%), and if so, determine that the value P (%) is abnormal, otherwise the value P (%) is not abnormal. For those of ordinary skill in the art, the manner of determining whether the current parameter value of the remaining attribute information is abnormal may be derived from the above teachings, and thus will not be described herein.

In other embodiments, assuming that the attribute information to be observed by the processor 120 is "IP address source", the processor 120 may extract the current parameter value of the "IP address source" (for example, C (country)). Next, the processor 120 may take out predetermined parameter values of the "IP address source" (for example, D (country), E (country), and F (country)). The processor 120 can then determine whether C (country) matches any of D (country), E (country), and F (country), and if so, determines that C (country) is not abnormal, and otherwise determines that C (country) is abnormal.

If the result of step S230 shows that the current parameter value is not abnormal, the processor 120 may continue to perform step S250 to provide no alarm.

However, even if the aforementioned current parameter values are determined to be abnormal, in different embodiments, since the server 100 may be determined to be abnormal (for example, excessive traffic) under certain allowed special circumstances, The invention further provides a relevant judgment mechanism by the following step S240, thereby deciding whether to present a substantial alarm for each abnormal situation. Specifically, in step S230, if a certain current parameter value (hereinafter referred to as a specific current parameter value) is determined to be abnormal, the processor 120 successively determines, according to the elasticity criterion group, whether to provide a correlation with the specific current parameter according to the step S240. The value of the alarm. Each of the foregoing sets of elastic criteria includes at least one criterion of elasticity. In order to make the content of step S240 easier to understand, another example is hereinafter explained.

Assuming that the existing A server is responsible for providing the service, the B server is responsible for periodically backing up the data of the A server, and the attribute information of the A server and the corresponding predetermined parameter values can be set as shown in Table 3 below. table 3

When the B server requests the A server to connect and receives the data of the A server, the A server will additionally open a communication port and increase the traffic of the A server accordingly. For this case, the set of elasticity criteria (which includes the first elasticity criterion of Table 4 and the second elasticity criterion of Table 5) can be correspondingly designed as follows. Table 4 (first elastic criterion) Table 5 (second elastic criterion)

In this example, when the A server transmits data to the B server, the traffic of the A server (for example, 70 (MB/min)) may exceed the set predetermined parameter value (ie, 60 (MB/min)). And the operation communication will increase from 5 originally set to 6. Therefore, the two behaviors will be determined to be abnormal in step S230, so the processor 120 will proceed to step S240. It can be seen from the elastic criterion group composed of Table 4 and Table 5 that even if the traffic of the A server exceeds 60 (MB/min), as long as the IP traffic of the B server (for example, 48 (MB/min)) is in the first elasticity. Within the set range of the guidelines, the upper limit of the A server traffic is allowed to increase to 100 (MB/min). At the same time, even if the number of operational communication ports of the A server is increased from 5 to 6, it is considered normal to confirm that the IP traffic of the B server is still within the range of the second elastic criterion.

If the specific current parameter values meet the first elastic criterion and the second elastic criterion of the above elastic criterion group, the processor 120 may continue to perform step S250 to provide no relevant alarm.

In other embodiments, the relevant personnel may set a plurality of flexible criteria groups as required, and each of the flexible criteria groups may include one or more elastic criteria. As long as the aforementioned specific current parameter values meet all of the flexibility criteria of one of the sets of flexible criteria, the processor 120 can determine that no corresponding alert is required, but the invention is not limited thereto.

However, if the specific current parameter value does not meet any of the flexible criteria groups, a malicious threat may be present on the server 120, so the processor 120 may proceed to step S260 to provide an alert indicating that the specific current parameter value corresponds to the foregoing. The attribute information, and the attribute information is the first type attribute or the second type attribute.

For example, assume that the attribute information corresponding to a specific current parameter value that does not meet any of the elastic criteria groups is "server traffic", which belongs, for example, to the first type of attribute (ie, attribute information related to the network behavior of the server 100). ). In this case, the alarm provided by the processor 120 may indicate a message such as "server traffic" and "first type attribute", so that the relevant personnel can directly go in the relevant direction (for example, the network behavior of the server 100). Debugging, without taking the time to debug in the direction related to the second type of attributes (ie, attribute information related to the operating conditions of the server 100 itself), thereby improving the accuracy and detection of detecting malicious threats. Wrong efficiency.

In an embodiment, the processor 120 may be separately processed because the predetermined parameter value set by the relevant personnel for each attribute information may be less than the actual operation of the server 100 (for example, the traffic of the server 100 is overestimated). The associated predetermined parameter values are corrected based on the following mechanism to more accurately reflect the actual behavior pattern of the server 120.

Specifically, after selecting certain attribute information, the processor 120 may determine a parameter observation interval based on its predetermined parameter value, and the predetermined parameter value is located in the parameter observation interval. Next, the processor 120 can determine whether the current parameter value of the attribute information is located in the parameter observation interval. If so, the processor 120 can record the current parameter value and correct the predetermined parameter value based on the current parameter value.

For example, if the processor 120 considers "server traffic" and its predetermined parameter value is, for example, "60 (MB/minute)", the processor 120 can determine the parameter based on "60 (MB/minute)". The observation interval (for example, 70% to 120% of 60 (MB/min)). Then, if the observed current parameter value of the "server flow rate" (for example, 50 (MB/min)) is in the parameter observation interval, if it is, the predetermined parameter value can be corrected to 50 (MB/min) to be correct. The ground reflects the working condition of the server 100.

In other embodiments, the processor 120 may also collect a plurality of current parameter values located in the parameter observation interval, and then update the predetermined parameter values. For example, the processor 120 may calculate an average value of the plurality of current parameter values, and then correct the predetermined parameter value to the average value, thereby establishing the behavior mode of the server 100 more objectively.

In summary, the server and the monitoring method thereof can determine whether the current parameter value of each attribute information is abnormal according to a predetermined parameter value of the attribute information, and issue an alarm when the current parameter value does not meet the corresponding elastic criterion. In order to enable relevant personnel to conduct tests on the fly. Moreover, since the foregoing alarm can indicate whether the attribute information of the current parameter value belongs to the first type attribute or the second type attribute, the related personnel can directly debug in the correct direction, thereby improving efficiency. Thereby, the server of the present invention can analyze whether a specific malicious behavior and an abnormal behavior occur, thereby instantly detecting the existence of a malicious threat.

Although the present invention has been disclosed in the above embodiments, it is not intended to limit the present invention, and any one of ordinary skill in the art can make some changes and refinements without departing from the spirit and scope of the present invention. The scope of the invention is defined by the scope of the appended claims.

100‧‧‧Server

110‧‧‧Storage circuit

120‧‧‧ processor

S210~S260‧‧‧Steps

1 is a schematic diagram of a server according to an embodiment of the invention. 2 is a flow chart of a server monitoring method according to an embodiment of the invention.

Claims (12)

A server monitoring method, suitable for a server, comprising: obtaining a plurality of predetermined parameter values corresponding to a plurality of attribute information of the server, wherein each of the attribute information belongs to a first type attribute or a second type attribute; Monitoring a plurality of current parameter values of the attribute information; determining, according to the predetermined parameter values of the attribute information, whether the current parameter values are abnormal; when a specific current parameter value of the current parameter values is abnormal, according to Determining, by the plurality of flex criteria sets, whether an alert associated with the particular current parameter value is required, wherein each of the flex criteria sets includes at least one elasticity criterion; and if the particular current parameter value meets one of the sets of flex criteria, The alarm is not provided, and the alarm is provided, wherein the alarm indicates one of the attribute information corresponding to the specific current parameter value, and the one of the attribute information indicating the attribute information is the first Class attribute or the second class attribute. The method of claim 1, wherein the attribute information includes an Internet Protocol (IP) address source, a server traffic, an IP traffic of the IP address source, a connection frequency of the IP address source, a processor usage rate of the server, a memory usage rate of the server, a hard disk access speed of the server, and a communication communication of the server At least one of the number of 埠. The method of claim 2, wherein the Internet Protocol (IP) address source, the server traffic, the IP traffic of the IP address source, and the IP address source The connection frequency of the ground belongs to the first type of attribute, and the processor usage rate of the server, the memory usage rate of the server, the hard disk access speed of the server, and the server The number of operational communications belongs to this second type of attribute. The method of claim 1, wherein the alarm is not provided when the current parameter values are not abnormal. The method of claim 1, wherein the step of determining whether the current parameter values are abnormal according to the predetermined parameter values of the attribute information comprises: extracting a first current parameter value from the current parameter values. Obtaining a first predetermined parameter value from the predetermined parameter values, wherein the first predetermined parameter value and the first current parameter value correspond to a first attribute information of the attribute information; and determining the first current Whether the parameter value exceeds the first predetermined parameter value, and if yes, determining that the first current parameter value is abnormal, otherwise determining that the first current parameter is not abnormal. The method of claim 5, further comprising: determining a parameter observation interval based on the first predetermined parameter value, wherein the first predetermined parameter value is located in the parameter observation interval; determining whether the first current parameter value is Located in the parameter observation interval; and if so, recording the first current parameter value and correcting the first predetermined parameter value based on the first current parameter value. A server includes: a storage circuit for storing a plurality of modules; and a processor coupled to the storage circuit to access the modules to perform the following steps: obtaining a plurality of attribute information corresponding to the server a predetermined parameter value, wherein each of the attribute information belongs to a first type attribute or a second type attribute; monitoring a plurality of current parameter values of the attribute information; determining the current according to the predetermined parameter values of the attribute information Whether the parameter value is abnormal; when a specific current parameter value of the current parameter values is abnormal, determining whether to provide an alarm associated with the specific current parameter value according to the multiple elastic criterion groups, wherein each of the elastic criterion groups includes At least one flexibility criterion; and if the specific current parameter value meets one of the sets of flexible criteria, the alert is not provided, and the alert is provided, wherein the alert indicates the attributes corresponding to the particular current parameter value One of the information, and the one of the information indicating the attribute information is the first type attribute or the second type attribute. The server of claim 7, wherein the attribute information includes an Internet Protocol (IP) address source, a server traffic, and an IP traffic of the IP address source. a connection frequency of the IP address source, a processor usage rate of the server, a memory usage rate of the server, a hard disk access speed of the server, and an operation of the server At least one of the number of communication ports. The server of claim 8, wherein the Internet Protocol (IP) address source, the server traffic, the IP traffic of the IP address source, and the IP address. The connection frequency of the source belongs to the first type of attribute, and the processor usage rate of the server, the memory usage rate of the server, the hard disk access speed of the server, and the server The number of operational communication ports belongs to this second type of attribute. The server of claim 7, wherein the processor does not provide the alarm when the current parameter values are not abnormal. The server of claim 7, wherein the processor is configured to: extract a first current parameter value from the current parameter values; and extract a first predetermined parameter value from the predetermined parameter values The first predetermined parameter value and the first current parameter value respectively correspond to a first attribute information of the attribute information; and determining whether the first current parameter value exceeds the first predetermined parameter value, and if yes, determining the The first current parameter value is abnormal, otherwise the first current parameter is determined to be not abnormal. The server of claim 11, wherein the processor is further configured to: determine a parameter observation interval based on the first predetermined parameter value, wherein the first predetermined parameter value is located in the parameter observation interval; Whether the first current parameter value is located in the parameter observation interval; and if so, recording the first current parameter value, and correcting the first predetermined parameter value based on the first current parameter value.