WO2011131019A1

WO2011131019A1 - Operation record tracing system and method based on the cloud computing

Info

Publication number: WO2011131019A1
Application number: PCT/CN2011/000249
Authority: WO
Inventors: 潘燕辉; 周勇兵
Original assignee: Pan Yanhui; Zhou Yongbing
Priority date: 2010-04-23
Filing date: 2011-02-17
Publication date: 2011-10-27
Also published as: CN101808102B; CN101808102A

Abstract

An operation record tracing system cooperated with users is disclosed in the present invention. The system includes at least one server and several client terminals. Each client terminal networks with one server at least, obtains the operation record and process information of at least one process running in this client terminal, calculates hash value of each process respectively, and uploads the hash value and corresponding operation record and process information into the server. The server classifies and stores the corresponding operation record and process information based on the hash value, and generates the report information which includes the operation records with the same process traced by other client terminals and is downloaded into the client terminals. Once any client terminal takes a sinister operation in the network, the process document can be detected by all other users in the network. Those users will use the relevant software vigilantly, in order to avoid becoming an attacked computer or being utilized by others unlawfully.

Description

Cloud computing-based operation record tracking system and method. Technical field

The present invention relates to the field of information security, and in particular, to a cloud computing-based multi-user collaborative operation record tracking system and method. Background technique

Nowadays, with the improvement of the degree of informatization and the continuous introduction of various applicability technologies, it is more convenient for users to carry out various activities related to digital information, and it is undeniable that users are more closely related to informationization and digitization. . Incidentally, however, digital information crimes such as attacks (especially via the Internet) of personal computers, servers, or other computerized devices occur frequently. Obviously, the underground digital economy has become increasingly industrialized and scaled, and its corresponding criminal behavior has become more and more concealed. The means of attack by malware has been greatly developed. In the form of multi-module, multi-component attacks from previous single files, even more malware has strong camouflage capabilities.

With the development of technology, some viruses and Trojans have strengthened server-side policy control. In the past, as long as it was a virus and a Trojan attack, it would continue to attack according to certain rules, such as an immediate attack, a fixed time period (Black Friday virus) and so on. But now it is often through the server to control the time and scale of the virus and Trojan attack, such as controlling part of the IP segment, or part of the time, and these rules of attack are controlled by the server of the virus and Trojan, and can be adjusted at any time. Even some commercial formal software uses server rules to perform some singular operations, such as using a user's computer to click on an advertisement in the background, or secretly collecting user information that is not related to itself. This strategy of flexible control of seizure rules has led to a significant reduction in the chances of finding Trojans and viruses. Especially when doing some non-destructive behavior, all anti-virus software or protection software cannot be predicted. For example, operating a user's computer to access a URL, clicking on an ad, etc. These will not be prompted by the protection software. It is difficult to find even if it is controlled as a broiler. Therefore, the prior art has drawbacks and needs improvement. SUMMARY OF THE INVENTION The technical problem to be solved by the present invention is to provide a multi-user collaborative operation record tracking system and method based on cloud computing in view of the deficiencies of the prior art.

The technical solution of the present invention is as follows: A multi-purpose collaborative operation record tracking system, comprising: at least one server end and a plurality of clients; each of the clients is connected to at least one of the server end networks;

The client is configured to obtain operation records and process information of at least one process that it runs, calculate a hash value of each process, and upload each of the hash values and corresponding operation records and process information to the The server side; the process information includes at least one of client information of the process, a file name of the process, a version number of the process, a company name of the process, and a process file size; the server is configured to use the hash according to the hash The value categorizes the corresponding operation record and the process information, and generates report information to be downloaded to each of the clients, where the report information includes an operation record tracked by the process on other clients. ,

The operation record tracking system, wherein the client includes a tracking module, a hash value calculation module, and an upload module;

The tracking module is configured to obtain operation records and process information of at least one of the processes; the hash value calculation module is configured to calculate a hash value of each of the processes; and the uploading module is configured to: The hash value and its corresponding operation record and process information are uploaded to the server;

The server includes a classification storage module and a sharing module, and the classification storage module is configured to store the corresponding operation record and the process information to the server according to the hash value of each process; The sharing module is configured to download, according to the operation record and the process information i of each process stored in the server, into the report information, and download the report information to each of the clients. The operation record tracking system, wherein the client further includes a report module, and the report module is configured to report according to the report information.

The operation record tracking system, wherein the client further includes a consultation comment module, wherein the consultation comment module is connected with the tracking module, and is used for determining an instruction to start tracking, and then starting the tracking module to open # track. ,

The operation record tracking system, wherein the sharing module includes an operation record search unit, a percentage calculation unit, a report information generation unit, and a download unit; the operation record search unit is configured to search for the classification storage module a process of the same hash value, generating a search result according to the operation record and the process information; the percentage calculation unit is configured to generate an operation record percentage according to the search result; the report information generating unit is configured to use the operation record according to the operation record The percentage and the search result generate the report information; the download unit is configured to download the report information to each of the clients.

A multi-user coordinated operation record tracking method, which is applicable to any of the above-described operation record tracking systems, comprising the following steps:

A1: a tracking step, configured to obtain an operation record and process information of a process running by the client, where the process information includes at least a client information of the process, a file name of the process, a version number of the process, and One of the company name and process size of the process;

A2: a hash value calculation step, configured to calculate a hash value of each process of the client;

A3: an uploading step, configured to upload each of the hash values and their corresponding operation records and process information to the server;

A4: 'Classification storage step, configured to classify and store the corresponding operation record and the process information according to the hash value;

A5: a sharing step, configured to generate report information according to the operation record and the process information, and download the report information to each of the clients.

The method, wherein, after the step A5, the reporting step is further performed: reporting according to the report information. The method, wherein the step A1 further includes a step of asking for a chapter: for inquiring whether to execute the step A1 to query the client, and if the affirmative answer of the guest is obtained, the step A1 is started.

The method, wherein the operation record includes at least one of a file operation record, a network connection record, and an operation record to the registry.

The method, wherein the step A5 performs the following steps:

A51: an operation record searching step for finding a process having the same hash value, and generating a search score according to the operation record and the process information;

A52: a percentage calculation step, configured to generate an operation record percentage according to the search result; A53: a report information generation step, configured to generate report information according to the operation record percentage and the search result;

A54: a downloading step for downloading the report information to each of the clients for sharing. The large-scale cloud tracking technology provided by the present invention utilizes a large user group to share process tracking information of each client. This tracking sister will track the other files accessed by the process files of each client user, the network connections made, and even the changes to the registry. Then record it to the server and share it with each client user, especially focusing on the non-Rudu operation records. When the process file is the same file, the user of this file will view the behavior of the file tracked by all other users who have the same file. The behavior of this file will be sorted according to the same proportion of behavior, and can be seen at the same time. Users with similar behaviors account for the proportion of users who own this file. Even if there are system files that use various rules for scams, they can't escape the common monitoring of all users, so that any process file will be hacked by a client on the network. All other users have found that they will be vigilant when using the software to avoid becoming broilers or being illegally exploited by others. DRAWINGS

Figure 1 is a schematic view showing the overall structure of the system of the present invention; 2 is a schematic structural view of a system of the present invention;

FIG. 3 is a schematic structural diagram of the sharing module in FIG. 2. detailed description

The invention will now be described in detail with reference to the drawings and specific embodiments.

Example 1

FIG. 1 is a schematic diagram showing the overall structure of an operation record tracking system for multi-user collaboration, including: at least one server end and a plurality of clients, and a plurality of server ends can be set up according to requirements, and each client and at least one server end are connected through a network. The system can include one or more servers, and clients can connect to one or more servers.

The client is configured to track an operation record of at least one process run by the client and process information of the process running on the client, for example, the operation record may be a file accessed by the process, and which websites are accessed, the process The message may include, but is not limited to, the information of the user to which the process belongs, the company to which the process belongs, and the like, and may track the operation records of multiple processes as needed; then calculate the hash value of the process, and the server receives the response from The above-mentioned hash value and process information of a large number of clients are stored on the server side according to different hash values, and the report information generated by the server is downloaded to each client for sharing, according to the report information. The client can view the operation record of the file tracked by all the users who have the same process file on the client. The operation record of this file can be sorted according to the same proportion of the behavior, and the similar behavior can be seen. User information, the process belongs to Company and other information, and the proportion of the operation records to all users who own this process, so that the client can monitor the operation records tracked by the process on other clients, so that even if a certain software utilizes server rules on any computer The terminal performs some ulterior operations, such as using the user's computer to click on the advertisement in the background, or secretly collecting user information unrelated to the user, it will be monitored by all other users in the network, and the user will use the software. Be wary, you can even choose to uninstall the software. For example, the client can set the operation record and process information of only one or several processes, that is, set the number of acquisition processes; or set one or more processes, that is, select the processes to be acquired.

For example, a certain program A^.SXE, accessing the information in the user's computer without uploading the user's permission and uploading it to the urea server Q to which the process file AgC. EXE belongs, while guiding the user to open in the background. An ad page for fraudulent clicks, Server Q controls ABC. EXE randomly selects a subset of users from a large group of users to collect information and click on ads; User A has ABC.EXE installed, but ABC.EXE is not yet in User A. The act of collecting user information has been performed on the computer, and only the behavior of clicking the advertisement has been performed. At this time, the user A uses the operation record tracking system provided by the present invention to record the behavior of the ABC.XE background guiding user to click the advertisement to the server, and share it with other users who have the ABC.EXE, and the information shared by other users. , also learned the behavior of ABC. EXE collecting user information, so all the violations performed by the file ABC. EXE will be mastered by the users in the network, and saved as i, according to which the user can choose to uninstall Procedures to prevent further damage from further harm.

As shown in FIG. 2, a specific structural diagram of the above system is illustrated. For example, the client may include a tracking module 11, a hash value calculation module '12, and an uploading module 13;

The tracking module 11 is configured to obtain an operation record of at least one process run by the client and process information running in the process, for example, obtaining a network connection accessed by the process, or modifying the local file, or registering The modification of the table, and the related information of the process file, such as the file name, the company, and the like, are recorded; the hash value calculation module 12 is configured to calculate the hash value of the process, and the calculation method of the hash value belongs to Commonly, it is not described here; the uploading module 13 is configured to upload the process information and the hash value of the operation record/process to the server; the server side may include the classification storage module 21 and the sharing module 22; the classification storage module 21 And storing the operation record and the process information to the service axe end according to the hash value of the foregoing process, for example, using different hash values to build an index or a directory, and storing the operation record and the process information on the server; the sharing module 22, According to the operation record of the process file stored on the server side and Process information generation report letter, }艮Special letter, download to each client or each client for sharing, for example, the root message can be used to package the process file tracked by other users who have the same process file. Recording, or it may also include sorting according to the percentage of the operation record of an operation behavior, and the user may also see the user information of the similar behavior from the report information, such as the user's IP address, the country region, and the like. The client dock further includes a report module 14 for reporting the information to the user, for example, reporting the operation record of the file tracked by other users having the same file, and obtaining the percentage of the record according to the behavior. Sorting and so on.

Example

On the basis of Embodiment 1, in order to improve the human-computer interaction function, the client further includes a consultation comment module 10, and the consultation comment module 10 is connected with the tracking module 11 for tracking whether the cookie block 11 starts to track the client user. Opinion, if the client's affirmation is answered, the tracking module 11 immediately starts tracking. For example, before starting to track the process B.EXE, the user is asked whether to start tracking the process. If the user selects a positive answer, the tracking module 11 Start tracking for process B. EXE, which avoids unnecessary tracking and logging of some regular processes.

Embodiment 3, on the basis of Embodiment 1, in order to further supplement the function of the system, the sharing module may further include an operation record searching unit 221, a percentage calculating unit 222, a report information generating unit 223, and a downloading unit 224; The searching unit 221 is configured to search the classification storage module 21 for the operation record of the process having the same hash value and the information of the process, and generate a search result, for example, using the hash value as the search condition, and searching in the classification storage module 21. Searching for an operation record of the process with the same hash value, and the number of users recorded, the user information, generating a search result; the percentage calculation unit 222, configured to generate an operation record percentage according to the above search result; the report information generating unit 223 is configured to The operation record percentage and the search result generate report information; the download unit 224 is configured to download the report information to the corresponding client for sharing.

It should be noted that the percentage of operation records used in the above description is defined in the present invention. For the operation record of a process stored on the server side, the number of clients that have implemented an operation behavior is proportional to the number of all the clients that have the process. For example, the percentage of the operation records of the process A accessing the XX website can be This calculation: On the server side, 5 million clients with process A are tracked. Among them, process A of 2 million users has visited the XX website, and the percentage of operation records of visiting XX website is 200/500=40%, ^ According to the percentage, it can be seen which behaviors are common operations and which behaviors are individual operations. The user can make selections based on the above judgments, for example, uninstalling some processes that are often performed individually.

Example 4

The embodiment continues to provide a multi-user coordinated operation record tracking method, which is applied to any of the above embodiments, and includes the following steps:

A1: a tracking step, which is used to obtain operation records and process information of at least one process run by the client, and may obtain operation record process information of multiple processes as needed, and the number of processes is not limited; the process information includes at least the process of each process. The information of the client, the file name of the process, the version number of the process, the company name of the process, and the process file size; the process information may also include all the above information;

A2: a hash value calculation step for calculating a hash value of each process in the client; respectively calculating a hash value of each process;

A3: an uploading step, configured to upload each hash value and its corresponding operation record and process information to the server; for example, upload the hash value of each process and its corresponding operation record and process information one by one to The server side;

A4: a classification storage step, configured to classify the operation record and the process information corresponding to each hash value according to the hash value; for example, a storage item includes: a hash value, an operation record corresponding to the hash value, The process information corresponding to the hash value;

A5: a sharing step of downloading report information to each of the clients according to the operation record and process information generated as described above.

In another example, after the step A5 above, the reporting step can also be performed, according to the report information. Reporting, for example, alerting the client; for example, popping up a prompt window on the client; providing the user with a valuable report for the user to make a decision.

Example 5

Applying to the above embodiments, step A4 may specifically perform the following steps:

A51: an operation record searching step, which is used to find an operation record of a process having the same hash value and process information of the process, and generate a search result; A52: a percentage calculation step for generating an operation record percentage according to the search result; A53: report The information generating step is configured to generate report information according to the operation record percentage and the process information of the process; A54: a downloading step, configured to download the report information to the corresponding client for sharing. For example, the client is further configured to monitor, according to the report information, an operation record or the like traced by another process by another process.

Example 6

In the above embodiments, before step A1, the step of consulting is further included, and the step of consulting is used to consult the client user for starting the step A1. If an affirmative answer is obtained from the client, step A1 is started, for example, starting tracking. Before the process B. EXE, the user is asked whether to start tracking the process. If the user chooses to answer affirmatively, the tracking module 11 starts tracking the process B. EXE, so as to avoid unnecessary tracking and recording of some regular processes. .

Example 7

The operation record may be applied to: the file operation record, the network connection record, and the operation record of the registry; wherein the process information may include the client information of the process, the file name of the process, and the version of the process. The number, the company name of the process, the process file size, or a combination or all of them.

It is to be understood that those skilled in the art can make modifications and changes in the above-described description, and all such modifications and changes are intended to fall within the scope of the appended claims.

Claims

Rights request

A multi-user coordinated operation record tracking system, comprising: at least one server end and a plurality of clients; each of the clients is connected to at least one of the server end networks;

The client is used to obtain the operation record and process information of at least one process that it runs, and respectively calculate the hash value of each process, and upload the hash value and its corresponding operation record and process information to the location. The server side; the process information includes at least one of the client information of the input, the file name of the process, the version number of the process, the company name of the process, and the process file size;

The server end is configured to classify and store the corresponding operation record and the process information according to the hash value, and generate report information to be sent to each of the clients, where the report information includes that the process is The record of operations tracked by other clients.

2. The operation record tracking system according to claim 1, wherein the client comprises a tracking module, a hash value calculation module, and an uploading module;

The server includes a classification storage module and a sharing module, and the classification storage module is configured to store the corresponding operation record and the process information to the server according to the hash value of each process; The sharing module is configured to generate the information according to the operation record and the process information of each process stored in the server, and download the information to each client. '

The operation record tracking system according to claim 1 or 2, wherein the client further comprises a report module, wherein the report module is configured to report according to the report information.

4. The recording and tracking system according to claim 2, wherein the client further includes a query module, and the query module is connected to the tracking module to determine the instruction to start tracking. , then start the tracking module to start tracking.

5. The operation record tracking system according to claim 2, wherein the sharing module comprises an operation record search unit, a percentage calculation unit, a report information generation unit, and a lower cutting unit; And searching for a process having the same hash value in the classification storage module, and generating a search result according to the operation record and the process information; the percentage calculation unit, the percentage of the operation result generated by the search result for the root 4t The report information generating unit is configured to generate the report information according to the operation record percentage and the search result; and the downloading unit is configured to download the “3” message information to each of the clients.

A multi-user coordinated operation record tracking method, which is applied to any of the operation record tracking systems according to any one of claims 1 to 5, characterized in that it comprises the following steps:

A1: a tracking step, configured to obtain operation records and process information of at least one process run by the client; the process information includes at least a client information, a process partner name, and a process version number of the process One of the company name of the process and the size of the process file;

A2: a hash value calculation step, configured to calculate a hash value of each process of the guest terminal;

A3: an uploading step, configured to upload each of the hash values and their corresponding operation records and process information to the server end;

A4: a classification storage step, configured to classify the corresponding operation record and the process information according to the hash value;

A5: a sharing step, configured to generate, according to the operation record and the process information, report information to each of the clients.

The method according to claim 6, wherein after the step A5, the step of performing the report is further performed: reporting according to the report information.

The method according to claim 6, wherein the step A1 further comprises a step of asking for comments: for inquiring whether to execute the step A1 to query the client, if To the affirmative answer of the client, the step A1 is started.

The method according to claim 6, wherein the operation record includes at least one of an operation record recorded by the device, a network connection record, and an operation record to the registry.

10. The method of claim 6 fans claim, wherein said step A ⁵ carries out the following steps:

A51: Operation 3⁄4彔 luxury search, used to find the process with the same hash value, according to its 槔# to release the information, generate the search result;

A52: a percentage calculation step, configured to generate an operation record ratio according to the search result;

A53 report information generating step, configured to generate obituary information according to the operation record percentage and the search result;

^: A54: a downloading step for downloading the reported information to each of the clients for sharing.