TWI753829B - Company computer management control immediately system and method thereof - Google Patents

Abstract

A company computer management control immediately system and a method thereof are provided. Management control application is installed and executed in company computer. Processing response of antivirus application is obtained by management control application and update warning information and network warning information are generated by management control application respectively. Processing response of antivirus application, update warning information and network warning information are provided to management control server from management control application. Response value is generated according to processing response, update warning value is generated according to update warning information and network warning value is generated according to network warning information by management control server and risk assessed value is calculated according to response value, update warning value and network warning value. Comprehensive management control of company computer is achieved based on determined risk assessed value. Therefore, the improve efficiency of comprehensive management control of company computer may be achieved.

Description

Enterprise computer real-time management and control system and method thereof

A management and control system and a method thereof, in particular, a real-time management and control system and a method for realizing an enterprise computer by judging a risk assessment value.

The existing management and control of enterprise computers is only passively installed antivirus software in the enterprise computers to avoid the leakage of confidential information of the enterprise due to poisoning of the enterprise computers. Although the existing methods can achieve the management and control of some enterprise computers, the If programs and anti-virus software... are not updated immediately, the security loopholes caused by the operating system, application programs, and anti-virus software... There are missing.

To sum up, it can be seen that there has been a long-standing problem in the prior art that the management and control of enterprise computers through antivirus software still has the problem of lack of security vulnerability management and control. Therefore, it is necessary to propose improved technical means to solve this problem.

In view of the existing problems in the prior art that the management and control of enterprise computers through antivirus software still has the problem of lack of security loophole control, the present invention discloses a real-time management and control system for enterprise computers and a method thereof, wherein:

The enterprise computer real-time management and control system disclosed in the present invention includes: an enterprise computer and a management and control server, a management and control server, a management and control application program and an anti-virus application program installed and executed on the enterprise computer, and the management and control application program further includes: a response receiving module, a response module, network warning information module and computer transmission module; the control server further includes: server receiving module, generating module, risk assessment module and warning information module.

The response receiving module of the management application is used to receive the processing response of the antivirus application from the antivirus application; the response module of the management application is to trigger the operating system when the management application or the application installed on the enterprise computer is executed. Or the online update of the executed application, when the update of the operating system or the executed application is not completed, an update warning message will be generated. Network connection function; the network warning information module of the control application is used to generate network warning messages when the firewall of the enterprise computer blocks a large number of connection activities; and the computer transmission module of the control application is used to transmit Process responses, update alerts, or network alerts.

The server receiving module of the control server is used to send the module from the computer to receive the processing response, update warning message or network warning message; the generating module of the management server is used to generate the response value corresponding to the processing response. The update alert message generates an update alert value, the network alert message generates a network alert value, and the processing response, update alert message and network alert message generate statistical information; the risk assessment module of the management server is used to convert the response value , the update warning value and the network warning value are accumulated to be the risk assessment value; and the warning information module of the control server is used to send the statistical information to the The response module, when the risk assessment value is greater than the threshold value, generates a network prohibition instruction, and transmits the network prohibition instruction to the response module.

The enterprise computer real-time management and control method disclosed by the present invention comprises the following steps:

First, the enterprise computer installs and executes the management application and the antivirus application; then, the management application receives the processing response of the antivirus application from the antivirus application; then, when the management application or the application installed on the enterprise computer is executed, Trigger the online update of the operating system or the executed application. When the update of the operating system or the executed application is not completed, the control application generates an update warning message; then, when the firewall of the enterprise computer blocks a large number of connection behaviors, the control application Generate a network warning message; then, the control application sends a processing response, an update warning message or a network warning message to the control server; then, the control server will process the response to generate a corresponding response value, and generate the update warning value from the update warning message , generate the network warning value from the network warning message, and generate the statistical information from the processing response, update warning message and network warning message; then, the control server accumulates the response value, the update warning value and the network warning value into a risk assessment Then, when the risk assessment value is less than or equal to the threshold value and the statistical information only has an update warning message, the control server sends the statistical information to the control application and displays it; finally, when the risk assessment value is greater than the threshold value, the control server The server generates a network ban command and transmits the network ban command to the control application to disable the network connection function of the enterprise computer.

The system and method disclosed in the present invention are as above, and the difference between the system and the prior art lies in that the enterprise computer installs and executes the management and control application, and the management and control application obtains the processing response of the anti-virus application, and generates an update warning message and a network warning message respectively. The application provides the antivirus application's processing response, generates update alert messages and network alert messages to the control server, and the control server processes the responses to generate response values, update alert messages to update alert values, and generate network alert messages. The network warning value is accumulated as the risk assessment value. Through the judgment of the risk assessment value, the comprehensive management and control of the enterprise computer can be realized.

Through the above technical means, the present invention can achieve the technical effect of improving the comprehensiveness of enterprise computer management and control.

The embodiments of the present invention will be described in detail below with the drawings and examples, so as to fully understand and implement the implementation process of how the present invention applies technical means to solve technical problems and achieve technical effects.

The following first describes the enterprise computer real-time management and control system disclosed in the present invention, and please refer to "Figure 1", which is a system block diagram of the enterprise computer real-time management and control system of the present invention.

The enterprise computer real-time management and control system disclosed in the present invention comprises: an enterprise computer 10 and a management and control server 20, the management and control server 20, the enterprise computer 10 installs and executes a management and control application 11 and an anti-virus application 12, and the management and control application 11 further includes : a response receiving module 111, a response module 112, a network warning information module 113 and a computer transmission module 114; the control server 20 further includes: a server receiving module 21, a generating module 22, and a risk assessment module 23 And the warning information module 24 .

The enterprise computer 10 and the control server 20 are connected through wired or wireless transmission. The wired transmission is, for example, a cable network, an optical fiber network, etc., and the wireless transmission is, for example, Wi-Fi, a mobile communication network, etc. (3G, 4G, 5G, etc.), etc., are only illustrative here, and are not intended to limit the scope of application of the present invention.

The response receiving module 111 of the control application 11 is used for receiving the processing response of the anti-virus application 12 from the anti-virus application 12 , and the anti-virus application 12 provides protection for the enterprise computer 10 , for example, the enterprise computer 10 may respond to the enterprise computer 10 . Virus scanning and detoxification are performed on the files in the enterprise computer 10 to protect the files in the enterprise computer 10; the enterprise computer 10 is connected with external devices (for example, through a USB connection, through a Bluetooth connection, etc.) (not to limit the scope of application of the present invention), the antivirus application 12 prevents the external device from actively installing malicious programs, and scans the files stored in the external device for viruses to confirm that the files stored in the external device are free of viruses Only when the enterprise computer 10 normally uses the external device; when the enterprise computer 10 downloads a file on the Internet, the antivirus application 12 will scan the file for viruses, and only when it is confirmed that the file has no virus, will the enterprise computer 10 be allowed to Download the file; when the enterprise computer 10 browses the web through a browser, the antivirus application 12 will block the browsed webpage from actively installing malicious programs; when the enterprise computer 10 executes the email application, the antivirus application 12 will prevent the received email from virus The enterprise computer 10 can use the e-mail normally only when it is confirmed that the received e-mail is free of viruses; the anti-virus application 12 is further equipped with an Endpoint Detection and Response (EDR) by judging the endpoint detection response. Whether it is abnormal so as to provide protection for the enterprise computer 10, etc., are only illustrative here, and are not intended to limit the scope of application of the present invention.

The anti-virus application 12 will correspondingly generate a processing response according to the above-mentioned protection function. Specifically, if the anti-virus application 12 scans the files in the enterprise computer 10 for viruses and finds that there is a virus, the anti-virus application 12 cannot detect the virus. When performing detoxification, the anti-virus application 12 will generate a processing response of "poisoning cannot be removed"; if the anti-virus application 12 scans the files in the enterprise computer 10 for viruses and finds that there is a virus, but the anti-virus application 12 has completed the detoxification of the virus After a short period of time (for example: 1 minute, 5 minutes, 10 minutes, etc., this is only an example, and does not limit the scope of application of the present invention) again poisoning (whether it is the same virus or a different virus), The anti-virus application 12 will generate a processing response of "persistent poisoning"; if the anti-virus application 12 blocks the external device from actively installing malicious programs, the anti-virus application 12 will generate a processing response of "found malicious programs installed"; 12 When the external device is blocked from actively installing malicious programs, the anti-virus application 12 scans the downloaded files on the Internet and finds a virus, and the anti-virus application 12 will generate a processing response of "found a virus in the downloaded file"; the anti-virus application 12 When judging that the endpoint detection response is abnormal, the antivirus application 12 will generate the processing response as "EDR event", etc., which is only for illustration, and does not limit the application scope of the present invention.

Next, the response module 112 of the management application 11 triggers the online update of the operating system or the executed application when the management application 11 or the application installed on the enterprise computer 10 is executed. When the update is not completed, the response module 112 of the management application 11 will generate an update warning message.

Next, the network warning information module 113 of the control application 11 is used when the firewall of the enterprise computer 10 blocks a large number of connection behaviors, which means that the enterprise computer 10 is attacked by an external network (eg, distributed Denial of service attack (Distributed Denial of Service attack, DDoS attack, hacker intrusion, etc.), the network warning information module 113 of the control application 11 will generate a network warning message.

The response receiving module 111 of the management application 11 receives the processing response of the antivirus application 12 from the antivirus application 12, and/or the response module 112 of the management application 11 generates an update warning message, and/or the management application The network warning information module 113 of 11 generates a network warning message, and the computer transmission module 114 of the control application 11 may send a processing response, an update warning message or a network warning message to the server of the control server 20 individually. The receiving module 21, the computer sending module 114 of the management application 11 may also simultaneously send the processing response and the update warning message, the update warning message and the network warning message, or the processing response and the network warning message to the management server 20. The server receiving module 21 and the computer sending module 114 of the control application 11 may also simultaneously send the processing response, the update warning message and the network warning message to the server receiving module 21 of the control server 20 .

The generation module 22 of the control server 20 can be based on the received processing response, update warning message, network warning message, processing response and update warning message, update warning message and network warning message, processing response and network warning message Or the processing response, the update warning message corresponds to the network warning message, the response value is correspondingly generated from the processing response, the update warning value is generated from the update warning message, the network warning value is generated from the network warning message, and the processing response and the update warning message are generated. And network alert messages generate statistics.

Specifically, if the processing response is “poisoning cannot be cleared”, the generation module 22 of the control server 20 can set the processing response as “poisoning cannot be cleared” corresponding to the generated response value of “1”; if the processing response is “continuous poisoning” ”, the generation module 22 of the control server 20 can set the processing response as “continuous poisoning” and the corresponding generation response value is “2”; the processing response is “EDR event”, the generation module 22 of the control server 20 can The processing response is "EDR event" and the corresponding generation response value is "3"; if the update warning message is "operation system update abnormality", the generation module 22 of the control server 20 can change the update warning message as "operation system update abnormality" The corresponding generation update alert value is "1"; if the network alert message is "distributed denial of service attack", the generation module 22 of the control server 20 can set the network alert message as "distributed denial of service attack" The value corresponding to the generated network alert is "2", which is only for illustration and does not limit the scope of application of the present invention.

The generation module 22 of the control server 20 will process the response correspondingly to generate the response value, generate the update alert value from the update alert message, generate the network alert value from the network alert message, and process the response, update alert message and network alert. After the statistical information is generated from the information, the risk assessment module 23 of the control server 20 can accumulate the response value, the update warning value and the network warning value into a risk assessment value.

Next, the warning information module 24 of the management and control server 20 will send the statistical information to the response module 112 of the management and control application 11 when the risk assessment value is less than or equal to the threshold value and the statistical information only has an update warning When the response module 112 of 11 receives the statistical information from the warning information module 24 of the management server 20, it can display the statistical information, so that the operator of the enterprise computer 10 can perform subsequent processing.

The warning information module 24 of the management and control server 20 generates a network prohibition command when the risk assessment value is greater than the threshold value, so as to transmit the network prohibition command to the response module 112 of the management and control application 11 . When the response module 112 receives a network prohibition command from the warning information module 24 of the management server 20, it prohibits the network connection function of the enterprise computer 10, and transmits statistical information corresponding to the enterprise computer 10 to the administrator The device 30 is displayed, so that the administrator of the administrator device 30 can perform subsequent processing, such as: virus removal, network resetting, operating system reloading, etc. This does not limit the scope of application of the present invention.

The management application 11 further includes an application obtaining module 115 and the management server 20 further includes a comparison database 25 and a comparison module 26. The comparison database 25 of the management server 20 stores a list of permitted applications in advance. The list of permitted applications includes a plurality of application names that are permitted to be used. The application obtaining module 115 of the management application 11 obtains the application names of the plurality of applications installed on the enterprise computer 10 to generate an installation application The list of installed applications includes the names of a plurality of applications installed in the enterprise computer 10, and the list of installed applications can be obtained from the application management related functions provided by the operating system.

After the application acquisition module 115 of the management application 11 obtains the application names of the plurality of applications installed on the enterprise computer 10 to generate the installed application list, the computer transmission module 114 of the management application 11 can transmit the installation applications The program list is sent to the management server 20 , and the server receiving module 21 of the management server 20 can receive the installed application list from the computer transmission module 114 of the management application 11 .

After the server receiving module 21 of the management server 20 receives the installed application list from the computer transmission module 114 of the management application 11, the comparison module 26 of the management server 20 compares the installed application list with the license When there are different application names in the application list, the generation module 22 of the control server 20 can generate corresponding application deletion instructions according to the different application names.

After the generation module 22 of the management server 20 generates corresponding application deletion commands according to the different application names, the alert information module 24 of the management server 20 can send the application deletion command to the response of the management application 11 The module 112, the response module 112 of the control application 11 can uninstall the corresponding application according to the application deletion instruction.

It is worth noting that the list of approved applications can further correspond to the media access control address of the enterprise computer, the login information of the enterprise computer and the name of the application program. When the response module 112 of the control application program 11 executes the installation of the application program, The application acquisition module 115 of the management application 11 is used to acquire the application name of the application being installed.

After the application acquisition module 115 of the control application 11 obtains the application name of the application being installed, the computer transmission module 114 of the control application 11 can transmit the application name of the application being installed, the name of the application being installed, and the name of the enterprise computer. The Media Access Control Address (MAC Address) and the enterprise computer login information are sent to the control server 20 .

The server receiving module 21 of the management server 20 can receive the application name of the application being installed, the media access control address of the enterprise computer, and the enterprise computer login information from the computer transmission module 114 of the management application 11 .

Next, the comparison module 26 of the management server 20 compares the media access control address of the enterprise computer and the login information of the enterprise computer to obtain the application name in the list of permitted applications, and then compares the name of the application being installed. When the application name is different from the application name in the compared list of permitted applications, the generation module 22 of the control server 20 generates a stop installation instruction.

After the generation module 22 of the management server 20 generates the installation stop command, the warning information module 24 of the management server 20 can send the installation stop command to the response module 112 of the management application 11, and the response module of the management application 11 The group 112 can terminate the installation procedure of the application program according to the stop installation instruction.

Next, the operation method of the present invention will be described below, and please refer to "Fig. 2A" and "Fig. 2B" at the same time. "Fig. 2A" and "Fig. 2B" illustrate the real-time management and control method of enterprise computer of the present invention. method flow chart.

The enterprise computer installs and executes the management application and the antivirus application (step 101 ); the management application receives the processing response of the antivirus application from the antivirus application (step 102 ); when the management application or the application installed on the enterprise computer is executed When the update of the operating system or the executed application is triggered, when the update of the operating system or the executed application is not completed, the control application generates an update warning message (step 103); when the firewall of the enterprise computer blocks a large number of connection behaviors , the control application generates a network warning message (step 104 ); the control application transmits a processing response, an update warning message or a network warning message to the control server (step 105 ); the control server generates a response value corresponding to the processing response, Generate the update alert value from the update alert message, generate the network alert value from the network alert message, and generate statistical information from the processing response, the update alert message, and the network alert message (step 106 ); the control server generates the response value, update alert message The value and the network warning value are accumulated to be the risk assessment value (step 107 ); when the risk assessment value is less than or equal to the threshold value and the statistical information only has update warning information, the control server transmits the statistical information to the control application and displays it (step 107 ). 107); when the risk assessment value is greater than the threshold value, the control server generates a network prohibition command, and transmits the network prohibition command to the control application program to prohibit the network connection function of the enterprise computer (step 108).

Please refer to "Fig. 2C". "Fig. 2C" shows a flow chart of additional steps in the real-time enterprise computer management and control method of the present invention. The real-time enterprise computer management and control method of the present invention further includes the following steps:

The management application obtains the application names of multiple applications installed on the enterprise computer to generate a list of installed applications (step 201 ); the management application transmits the list of installed applications to the management server (step 202 ); the management server has a For the database, compare the database to store the list of permitted applications (step 203); when the control server compares the list of installed applications and the list of permitted applications to have different application names, it is based on the different application names. The corresponding application deletion instruction is generated by the name (step 204 ); the management server transmits the application deletion instruction to the management application (step 205 ); and the management application uninstalls the corresponding application according to the application deletion instruction (step 206 ).

Please refer to "Fig. 2D". "Fig. 2D" shows a flow chart of additional steps in the real-time management and control method of enterprise computers of the present invention. The real-time management and control method of enterprise computers of the present invention further includes the following steps:

When the enterprise computer executes the installation of the application, the management application obtains the module to obtain the application name of the application being installed (step 301 ); the management application transmits the application name of the application being installed and the media storage of the enterprise computer. Get the control address and the enterprise computer login information to the control server (step 302 ); the control server has a comparison database, and the comparison database stores a list of permitted applications, and the list of permitted applications corresponds to the media access for storing the enterprise computer Control address, enterprise computer login information and application name (step 303 ); the management server compares the media access control address of the enterprise computer and enterprise computer login information to obtain the application name in the list of permitted applications (step 304 ) ); when the control server verifies that the name of the application being installed is not the same as the name of the application in the list of permitted applications to be compared, a stop installation instruction is generated (step 305 ); the transmission of the control server stops The installation instruction is sent to the management application (step 306 ); and the management application terminates the installation procedure of the application according to the stop installation instruction (step 307 ).

From the above, it can be seen that the difference between the present invention and the prior art is that the enterprise computer installs and executes the control application program, the control application program obtains the processing response of the antivirus application, and generates update warning messages and network warning messages respectively, and controls the application program. Provide the antivirus application's processing response, generate update warning message and network warning message to the control server, the control server will process the response correspondingly to generate response value, update warning message to generate update warning value and network warning message to generate network The warning value is accumulated as the risk assessment value, and through the judgment of the risk assessment value, the comprehensive management and control of the enterprise computer can be realized.

This technical means can solve the existing problem of lack of security loophole control in the management and control of enterprise computers through antivirus software in the prior art, thereby achieving the technical effect of improving the comprehensiveness of enterprise computer management and control.

Although the embodiments disclosed in the present invention are as above, the above-mentioned contents are not used to directly limit the scope of the patent protection of the present invention. Anyone with ordinary knowledge in the technical field to which the present invention pertains can make some changes in the form and details of the implementation without departing from the spirit and scope of the present invention. The scope of patent protection of the present invention shall still be defined by the scope of the appended patent application.

10: Business PCs 11: Control the application 111: Response receiving module 112: Responsive Mods 113: Network warning information module 114: Computer Transmission Module 115: The application gets the module 12: Antivirus apps 20: Control the server 21: Server receiving module 22: Generate Mods 23: Risk Assessment Module 24: Warning information module 25: Compare databases 26: Comparison module Step 101: Install and run the control application and antivirus application on the enterprise computer Step 102: The management application receives the processing response of the anti-virus application from the anti-virus application Step 103: When the control application or the application installed on the enterprise computer is executed, the online update of the operating system or the executed application is triggered. When the update of the operating system or the executed application is not completed, the control application generates an update alert message Step 104: When the firewall of the corporate computer blocks a large number of connections, the control application generates a network alert message Step 105: The control application sends the processing response, update warning message or network warning message to the control server Step 106: The control server generates a response value corresponding to the processing response, generates an update alert value from the update alert message, generates a network alert value from the network alert message, and generates a statistical message from the processing response, the update alert message and the network alert message Step 107: The control server accumulates the response value, the update warning value and the network warning value into a risk assessment value Step 108: When the risk assessment value is less than or equal to the threshold value and the statistical information only has an update warning message, the control server transmits the statistical information to the control application and displays it Step 109: When the risk assessment value is greater than the threshold value, the control server generates a network prohibition command, and transmits the network prohibition command to the control application to prohibit the network connection function of the enterprise computer Step 201: The management application obtains the application names of multiple applications installed on the enterprise computer to generate a list of installed applications Step 202: The management application transmits the list of installed applications to the management server Step 203: The control server has a comparison database, and the comparison database stores a list of permitted applications Step 204: When the control server compares the installed application list and the permitted application list with different application names, generates a corresponding application deletion instruction according to the different application names Step 205: The control server sends the application deletion command to the control application Step 206: The control application uninstalls the corresponding application according to the application deletion instruction Step 301: When the enterprise computer executes the installation of the application, the control application obtains the module to obtain the application name of the application being installed Step 302: The management application transmits the application name of the application being installed, the media access control address of the enterprise computer and the login information of the enterprise computer to the management server Step 303: The control server has a comparison database, the comparison database stores a list of permitted applications, and the list of permitted applications corresponds to the media access control address of the enterprise computer, the login information of the enterprise computer, and the name of the application program Step 304: The management server compares the media access control address of the enterprise computer with the enterprise computer login information to obtain the application name in the list of permitted applications Step 305: When the control server compares the application name of the application being installed and the name of the application in the list of permitted applications to be compared is not the same, generates a stop installation instruction Step 306: The management server sends a stop installation instruction to the management application Step 307: The control application terminates the installation procedure of the application according to the stop installation instruction

FIG. 1 is a system block diagram of an enterprise computer real-time management and control system of the present invention. FIG. 2A and FIG. 2B are method flowcharts of the real-time management and control method of enterprise computer according to the present invention. FIG. 2C and FIG. 2D are flow charts showing additional steps of the real-time management and control method of enterprise computers according to the present invention.

10: Business PCs

11: Control the application

111: Response receiving module

112: Responsive Mods

113: Network warning information module

114: Computer Transmission Module

115: The application gets the module

12: Antivirus apps

20: Control the server

21: Server receiving module

22: Generate Mods

23: Risk Assessment Module

24: Warning information module

25: Compare databases

26: Comparison module

Claims (10)

An enterprise computer real-time management and control system, comprising: An enterprise computer, the enterprise computer installs and executes a control application and an antivirus application, and the control application further includes: a response receiving module for receiving a processing response of the anti-virus application from the anti-virus application; A response module, when the control application or the application installed on the enterprise computer is executed, triggers the online update of the operating system or the executed application, and when the operating system or the executed application is not updated, generating an update warning message, when receiving a statistical message, displaying the statistical message, and when receiving a network prohibition instruction, prohibiting the network connection function of the enterprise computer; a network warning information module for generating a network warning message when the firewall of the enterprise computer blocks a large number of connection activities; and a computer transmission module for transmitting the processing response, the update alert message or the network alert message; and A control server, the control server further includes: a server receiving module for receiving the processing response, the update warning message or the network warning message from the computer sending module; a generating module for generating a response value corresponding to the processing response, generating an update warning value from the update warning message, generating a network warning value from the network warning message, and generating a response value from the processing response , the update warning message and the network warning message generate a statistical message; a risk assessment module for accumulating the response value, the update warning value and the network warning value into the risk assessment value; and a warning information module for sending the statistical information to the response module when the risk assessment value is less than or equal to a threshold value and the statistical information only has the updated warning information, and when the risk When the evaluation value is greater than the threshold value, the network prohibition instruction is generated, and the network prohibition instruction is transmitted to the response module. The real-time management and control system of an enterprise computer according to claim 1, wherein the management and control application further comprises an application obtaining module to obtain the application names of a plurality of applications installed on the enterprise computer to generate an installation application The list of installed applications is sent to the server receiving module through the computer sending module. The enterprise computer real-time management and control system according to claim 2, wherein the management and control server further comprises a comparison database and a comparison module, and the comparison database stores a list of permitted applications. When the server receiving module receives the installed application list from the computer transmission module, the comparison module compares the installed application list and the permitted application list with different application names , the generation module generates a corresponding application deletion instruction according to different application names, the warning information module transmits the application deletion instruction to the response module, and the response module Uninstall the corresponding application using the above application removal instruction. The enterprise computer real-time management and control system according to claim 1, wherein when the response module executes the installation of the application, it obtains the module through an application further included in the management application to obtain the application of the application being installed Program name, the name of the application program that is being installed, the Media Access Control Address (MAC Address) of the enterprise computer, and the login information of an enterprise computer are transmitted to the computer through the computer transmission module. The server receives the module. The enterprise computer real-time management and control system according to claim 4, wherein the management and control server further comprises a comparison database and a comparison module, the comparison database stores a list of permitted applications, and the permitted applications The program list correspondingly stores the media access control address of the enterprise computer, the login information of the enterprise computer and the application program name, and the comparison module compares the media access control address of the enterprise computer and the enterprise computer. Computer login information to obtain the name of the application in the list of permitted applications, and then compare the application name of the application being installed and the name of the application in the list of permitted applications to be different, The generating module generates an installation stop instruction, the warning information module transmits the installation stop instruction to the response module, and the response module terminates the installation procedure of the application program according to the installation stop instruction. The real-time management and control system for an enterprise computer according to claim 1, wherein the warning information module further comprises, when the risk assessment value is greater than the threshold value, sending the statistical information corresponding to the enterprise computer to a The administrator installs and displays it. A real-time management and control method for an enterprise computer, comprising the following steps: An enterprise computer installs and executes a control application and an antivirus application; the management application receives a processing response from the antivirus application from the antivirus application; When the control application or the application installed on the enterprise computer is executed, the online update of the operating system or the executed application is triggered. When the update of the operating system or the executed application is not completed, the control application generating an update alert message; When the firewall of the enterprise computer blocks a large number of connection activities, the control application generates a network warning message; the management application program transmits the processing response, the update warning message or the network warning message to a management server; The control server generates a response value corresponding to the processing response, generates an update warning value from the update warning message, generates a network warning value from the network warning message, and generates the processing response, all generating a statistical message from the update warning message and the network warning message; The control server accumulates the response value, the update warning value and the network warning value as the risk assessment value; When the risk assessment value is less than or equal to a threshold value and the statistical information only has the update warning message, the management and control server transmits the statistical information to the management and control application and displays it; and When the risk assessment value is greater than the threshold value, the control server generates the network prohibition command, and transmits the network prohibition command to the control application to prohibit the network of the enterprise computer Connection function. The real-time management and control method for an enterprise computer according to claim 7, wherein the real-time management and control method for an enterprise computer further comprises the following steps: the management application obtains application names of a plurality of applications installed on the enterprise computer to generate a list of installed applications; the control application transmits the installed application list to the control server; The management server has a comparison database, and the comparison database stores a list of licensed applications; When the control server compares the installed application list and the permitted application list with different application names, generates a corresponding application deletion instruction according to the different application names; the control server transmits the application deletion instruction to the control application; and The control application uninstalls the corresponding application according to the application deletion instruction. The real-time management and control method for an enterprise computer according to claim 7, wherein the real-time management and control method for an enterprise computer further comprises the following steps: When the enterprise computer executes the installation of the application, the management application obtains the module to obtain the application name of the application being installed; The management application transmits the application name of the application being installed, the Media Access Control Address (MAC Address) of the enterprise computer and the login information of an enterprise computer to the management server; The management and control server has a comparison database, the comparison database stores a list of permitted applications, and the list of permitted applications correspondingly stores the media access control address of the enterprise computer, the login of the enterprise computer information and the name of the application; the management server compares the media access control address of the enterprise computer with the login information of the enterprise computer to obtain the application name in the permitted application list; The control server then generates a stop installation instruction when the application name of the application being installed is compared with the application name in the list of permitted applications that is compared; the control server transmits the stop installation instruction to the control application; and The control application terminates the installation procedure of the application according to the installation stop instruction. The real-time management and control method for an enterprise computer according to claim 7, wherein the real-time management and control method for an enterprise computer further comprises that when the risk assessment value is greater than the threshold value, the management and control server records the statistics corresponding to the enterprise computer The steps in which messages are sent to an administrator device and displayed.

Images