WO2023201583A1

WO2023201583A1 - Network system protection method and apparatus, and computer device and storage medium

Info

Publication number: WO2023201583A1
Application number: PCT/CN2022/087996
Authority: WO
Inventors: 高永吉
Original assignee: 西门子股份公司; 西门子（中国）有限公司
Priority date: 2022-04-20
Filing date: 2022-04-20
Publication date: 2023-10-26

Abstract

The embodiments of the present disclosure provide a network system protection method and apparatus, and a computer device and a storage medium. The method comprises: acquiring object information of target software, wherein the object information comprises: at least one of mutex information of the target software, service information, which is created by the target software after same is input into a network system, and request information, which is sent by the target software after same is input into the network system; and configuring, according to the object information and in the network system, a protection policy for the target software, so as to prevent the target software from running in the network system. The embodiments of the present disclosure can effectively prevent malicious software from adversely affecting a network system, such that the security of the network system is ensured.

Description

Network system protection methods, devices, computer equipment and storage media

Technical field

The present disclosure relates to the field of network system security technology, and in particular to a network system protection method, device, computer equipment and storage medium.

Background technique

With the development of technology, network system security has received more and more attention. Nowadays, network systems are often attacked by malware (such as ransomware, etc.), which poses a challenge to the security of the network system. Once the network system is attacked by malware, it is easy to cause damage to the operation of the devices in the network system. Interference or hindrance. Therefore, how to prevent malware from causing adverse effects on network systems has become an urgent technical problem that needs to be solved.

Contents of the invention

According to the first aspect of the embodiments of the present disclosure, the embodiments of the present disclosure provide a network system protection method, including:

Obtain object information of the target software, where the object information includes: mutex information of the target software, service information created after the target software is input into the network system, and request information issued after the target software is input into the network system. at least one of;

According to the object information, a protection policy for the target software is configured in the network system to prevent the target software from running in the network system.

In an optional embodiment, configuring a protection policy for the target software in the network system according to the object information to prevent the target software from running in the network system includes:

Create a mutex program corresponding to the target software according to the mutex information in the object information;

The mutually exclusive program is input to at least one program execution device of the network system to run, so that the target software is prevented from running in the program execution device through the mutually exclusive program.

In an optional embodiment, the service information includes the service name of the first service created after the target software inputs the network system;

Configuring a protection policy for the target software in the network system according to the object information to prevent the target software from running in the network system includes:

Create the first service in the network system according to the service name to prevent the target software from creating the first service through the created first service.

In an optional embodiment, the request information includes the URL that the target software accesses when it issues the first request after entering the network system, wherein the target software passes the first URL of the network system when it issues the first request. DNS and the first server access the URL;

Configuring a second DNS and a second server in the network system according to the URL to prevent the target software from accessing the URL through the first DNS and the first server of the network system when issuing a first request, The target software is caused to access the URL through the second DNS and the second server of the network system, and exits based on the result of accessing the URL.

In an optional embodiment, configuring a protection policy for the target software in the network system according to the object information, the previously described method further includes:

Enter the object information into the verification system, and configure the protection strategy in the verification system according to the object information;

Enter the target software into a verification system configured with the protection strategy, and determine whether the target software can run normally in the verification system; wherein,

If not, execute: configure a protection policy for the target software in the network system according to the object information.

In an optional embodiment, obtaining the object information of the target software includes:

Enter the target software into a preset sandbox to run, and obtain running data;

According to the running data, the object information of the target software is determined.

In an optional embodiment, determining the object information of the target software based on the running data includes:

The running data is filtered through a preset blacklist to obtain the object information of the target software from the results of the filtering process.

According to the second aspect of the embodiments of the disclosure, the embodiments of the disclosure provide a network system protection device, which includes:

Acquisition module, used to obtain object information of the target software, wherein the object information includes: mutex information of the target software, service information created after the target software is input into the network system, and the target software is input into the network system. At least one of the request messages sent later;

A blocking module configured to configure a protection policy for the target software in the network system according to the object information, so as to prevent the target software from running in the network system.

According to a third aspect of the embodiments of the present disclosure, an embodiment of the present disclosure provides a computer device, which includes: a processor; and a memory storing a program, wherein the program includes computer operation instructions, and the computer operation instructions are executed by the processor. The processor is then caused to execute the aforementioned network system protection method.

According to a fourth aspect of the embodiments of the present disclosure, the embodiments of the present disclosure provide a computer storage medium, wherein the computer storage medium stores computer instructions, and the computer instructions are used to cause the computer to execute the aforementioned network protection method.

The network system protection solution of the embodiment of the present disclosure can obtain the object information of the target software. The object information includes the mutex information of the target software, service information created after the target software is input into the network system, and requests issued by the target software after being input into the network system. At least one of the information, and configure a protection policy for the target software in the network system based on the object information to prevent the target software from running in the network system. Therefore, the embodiment of the present disclosure can protect the target software when the target software is malware. Prevent the operation of malware that enters the network system, thereby reducing the possibility of the network system being attacked by malware, making the operation of devices in the network system less likely to be interfered or hindered by malware, and effectively preventing malware from harming the network system. Cause adverse effects, thereby ensuring the security of the network system.

Description of the drawings

The following drawings are only intended to schematically illustrate and explain the present disclosure and do not limit the scope of the present disclosure.

Figure 1 shows a flow chart of an optional network system protection method according to an embodiment of the present disclosure.

Figure 2 shows an optional sub-flow chart of "obtaining object information of the target software" in step S101 according to an embodiment of the present disclosure.

Figure 3 shows a flow chart of another optional network system protection method according to an embodiment of the present disclosure.

Figure 4 shows a block diagram of an optional network system protection device according to an embodiment of the present disclosure.

Figure 5 shows a schematic structural diagram of an optional computer device according to an embodiment of the present disclosure.

Reference signs:

400. Network system protection device; 401. Acquisition module; 402. Blocking module; 500. Computer equipment; 502. Processor; 504. Communication interface; 506. Memory; 508. Communication bus; 510. Program.

Detailed ways

In order to enable those in the art to better understand the technical solutions in the embodiments of the present disclosure, the technical solutions in the embodiments of the present disclosure will be clearly and completely described below in conjunction with the drawings in the embodiments of the present disclosure. Obviously, the description The embodiments are only part of the embodiments of the present disclosure, rather than all the embodiments. Based on the embodiments of the present disclosure, all other embodiments obtained by those of ordinary skill in the art should fall within the scope of protection of the embodiments of the present disclosure.

With the development of technology, network system security has received more and more attention. Nowadays, network systems are often attacked by malware (such as ransomware, etc.), which poses a challenge to the security of the network system. Once the network system is attacked by malware, it is easy to cause damage to the operation of the devices in the network system. Interference or hindrance. Therefore, how to prevent malware from causing adverse effects on industrial network systems has become an urgent technical problem that needs to be solved.

To this end, according to the first aspect of the embodiment of the present disclosure, with reference to the flowchart in Figure 1, the embodiment of the present disclosure provides a network system protection method, which includes the following steps S101 and S103.

S101: Obtain object information of the target software, where the object information includes at least one of: mutex information of the target software, service information created after the target software is input into the network system, and request information issued by the target software after being input into the network system.

S103: Based on the object information, configure a protection policy for the target software in the network system to prevent the target software from running in the network system.

Through the network system protection method of the embodiment of the present disclosure, the object information of the target software can be obtained. The object information includes the mutex information of the target software, the service information created after the target software is input into the network system, and the service information issued after the target software is input into the network system. Request at least one of the information, and configure a protection policy for the target software in the network system according to the object information to prevent the target software from running in the network system. Therefore, the embodiment of the present disclosure can prevent the target software from running in the network system when the target software is malware. Prevent the operation of malware imported into the network system, thereby reducing the possibility of the network system being attacked by malware, making the operation of devices in the network system less likely to be interfered or hindered by malware, and effectively preventing malware from affecting the network. system, thereby ensuring the security of the network system.

The network system protection method will be described in detail below. It should be understood that this description does not serve as any limitation on the embodiments of the present disclosure.

The network system protection method in the embodiment of the present disclosure can be executed by a computer device capable of data processing. The computer device can include one or more processing units, such as CPU, MCU, PLC, etc. It should be understood that in the embodiment of the present disclosure, No qualifications are placed on this.

In the embodiment of the present disclosure, the network system can be any computer network system, which is not limited here. The network system can include one or more program running devices, and the program running devices can run software programs. When the target software is run in the network system, it may mean that the target software is input to the program running device in the network system to run.

In a preferred embodiment, the network system in the embodiment of the present disclosure can be an OT (Operational Technology) system, and the program running device can be an OT device. The network system protection solution in the embodiment of the present disclosure is applied to The beneficial effects are particularly significant in this specific scenario, which will be explained in detail below.

In the embodiment of the present disclosure, the target software can be any software program, which is not limited in the embodiment of the present disclosure. As mentioned above, the target software may be malware (such as ransomware, etc.). When the malware is input into the network system for normal operation, it will interfere or hinder the normal operation of the network system. For example, when an exemplary malware is input into a network system to run normally, it will encrypt some specific data so that the program running equipment in the network system cannot use these data for processing, thus affecting the normal operation of the program running equipment. Work. Of course this is just one example of malware and does not serve as any limitation on it.

Optionally, the target software may be malware that has been filtered out. Therefore, before the malware is entered into the network system, the object information of the malware (i.e., the target software) is first obtained, and based on the object information, the malicious software is configured in the network system. Software protection strategies can prevent malware from running in the network system after the malware is entered into the network system, thereby effectively protecting the network system.

In the embodiment of the present disclosure, the object information of the target software includes at least one of mutex information of the target software, service information created after the target software is input into the network system, and request information issued after the target software is input into the network system. These object information are The key to the normal operation of the target software.

Specifically, when some target software is running, it usually creates a mutex at the same time to avoid running itself twice. Mutex implements a simple form of mutually exclusive synchronization, which prohibits multiple threads from entering the code protection zone at the same time, that is, only one thread is allowed to enter the code protection zone at any time. So when the mutex is present, the target software will not be able to run again. The mutex information in the embodiment of the present disclosure may be some characteristics of the mutex of the target software, for example, it may be the name of the mutex, the identification of the mutex, etc., which is not limited in the embodiment of the present disclosure. .

Specifically, some target software runs as a created service when it starts running in the input network system. The service information in the object information in the embodiment of the present disclosure may be some characteristics of the service, such as service name, service identification, etc. In this regard There are no limitations in the embodiments of the present disclosure.

Specifically, some target software will first send a request when it starts running in the input network system. The request information in the embodiment of the present disclosure may be some key features of the request, such as the URL visited when the request is issued, The requested identifier, etc. are not limited in this embodiment of the present disclosure.

In the embodiment of the present disclosure, by obtaining the object information, since the object information is the key to the normal operation of the target software, it is convenient to configure a protection policy according to the object information in step S103 to prevent the target software from running in the network system.

The embodiment of the present disclosure does not limit the specific method of obtaining the object information of the target software in step S101. For example, in order to analyze the target software more conveniently, with reference to the flow chart in Figure 2, the method of obtaining the object information of the target software in step S101 is The object information may include the following sub-steps S1011 and S1012.

S1011: Enter the target software into the preset sandbox to run, and obtain the running data.

S1012: Determine the object information of the target software based on the running data.

Sandbox is a technology used to safely run software programs. It is often used to execute untrusted software programs. The sandbox strictly limits the use of system resources by untrusted software programs in accordance with certain security policies. Used to achieve isolation, the impact of untrusted software programs running on the system will be limited within the sandbox and will not affect other parts of the system. Restore the structure of the network system in the sandbox so that the running phenomenon of the target software can be restored when the target software is run in the sandbox.

The running data may include object information of the target software, so the object information of the target software can be obtained from the running data by analyzing and processing the running data.

Therefore, in the embodiment of the present disclosure, by inputting the target software into a preset sandbox and running it, various running data of the target software (for example, the target software is malware) can be obtained safely and completely, so that the target software can be further safely and completely obtained. And completely obtain the object information of the target software based on the running data. This facilitates the subsequent configuration of protection strategies for the network system based on the object information to prevent target software from running in the network system, thereby effectively protecting the network system.

The specific implementation method of "determining the object information of the target software based on the operating data" in S1012 is not limited here. For example, it can be obtained by directly analyzing the running data. For example, if the mutex information in the object information is the mutex name, it can be determined by identifying the field of the mutex name in the running data.

Since other software is often running in the system built inside the sandbox, some other software may also create object information similar to the target software, that is, other software may also have its corresponding mutex information and services when running. Information, request information, etc., the object information of other software is also output from the sandbox as part of the running data. In this regard, in an optional embodiment, step S1012 may specifically include: filtering the running data through a preset blacklist to obtain the object information of the target software from the results of the filtering process.

Specifically, the preset blacklist may be a blacklist of object information, which may record object information corresponding to other software running in the sandbox internal establishment system. In addition, for each type of object information, a corresponding blacklist can be preset.

For example, assuming that the mutex information in the object information is the mutex name, the default blacklist can be a mutex name blacklist, which includes other software other than the target software in the system established inside the sandbox. The corresponding mutex name is used to filter the running data through the mutex name blacklist. The mutex names corresponding to other software except the target software can be filtered out, leaving only the mutex names corresponding to the target software. Mutex name (i.e. object information).

In the same way, taking the service information in the object information as the service name as an example, the default blacklist can be a service name blacklist, which includes those created by other software other than the target software in the system built inside the sandbox. The service name of the service. The running data is filtered through the service name blacklist. The service names corresponding to other software except the target software can be filtered out, leaving only the service names corresponding to the target software (i.e. object information). .

Similarly, if the request information of the object information is the URL accessed when the target software makes a request, for example, the preset blacklist can be a URL blacklist, which includes other files other than the target software in the system established inside the sandbox. The URL accessed when the software makes a request, the running data is filtered through the URL blacklist, and the URLs corresponding to other software except the target software can be filtered out, leaving only the URL corresponding to the target software (i.e. object information) .

Obviously, in this way, the object information of the target software can be accurately determined based on the running data, so as to subsequently configure the protection strategy for the network system based on the object information to prevent the target software from running in the network system, thereby causing damage to the network system. Effective protection.

In step S103, the specific implementation method of configuring a protection policy for the target software in the network system according to the object information is not specifically limited in the embodiment of the present disclosure, as long as the configured protection policy can effectively prevent the target software from running in the network system. That’s it. Illustratively, the embodiment of the present disclosure also provides several optional implementations of step S103, which are described in detail below. It should be understood that they should not be regarded as any limitations on the embodiment of the present disclosure.

In an optional embodiment, taking the obtained object information of the target software including mutex information as an example, step S103 includes: creating a mutex program corresponding to the target software according to the mutex information in the object information; The program is input to run in at least one program execution device of the network system to prevent the target software from running in the program execution device through the mutex program.

Specifically, as mentioned above, when some target software is running, it usually creates a mutex at the same time to avoid running itself twice. In this regard, in the embodiment of the present disclosure, a mutex program can be created based on mutex information. For example, the aforementioned mutex information can be, for example, a mutex name. For example, the mutex information can be passed to the interface program as a parameter, thereby obtaining an interface program containing the mutex information, that is, a mutex program, and inputting the mutex program to at least one program running device of the network system to run. , this mutex program will create a false mutex object in the memory space of the device where the program is running. When the target software is input to the network system (for example, when the target software is input to the device running the program), the target software will detect the false mutex object and identify it as a mutex object created by itself. Therefore, the target software will exit to avoid running twice. In this way, the network system protection method of the embodiment of the present disclosure achieves the purpose of preventing the target software from running normally in the program running device through the mutual exclusion program.

In an optional embodiment, the service information in the object information of the target software includes the service name of the first service created after the target software is entered into the network system; based on this, step S103 includes: according to the service name, in the network system Create a first service to prevent the target software from creating the first service through the created first service.

Specifically, some target software runs as a created service (such as the first service in this optional embodiment) when it starts running in the input network system. Regarding this, in the embodiment of the present disclosure, the first service can be created in the network system according to the service name. For example, the service name can be passed as a parameter to the interface program, thereby obtaining an interface program containing the service name. When the interface program is input to run on at least one program running device of the network system, the interface program will be stored in the memory of the program running device. Generate a false first service object in the space to create the first service. When the target software is input to the network system (for example, when the target software is input to the device running the program), the target software will detect the false first service object and identify it as the first service object generated by itself. object, so the target software will exit to avoid repeatedly creating the first service. In this way, the network system protection method of the embodiment of the present disclosure achieves the purpose of preventing the target software from creating the first service through the created first service, so that the target software cannot run normally in the network system.

In an optional embodiment, the request information in the object information of the target software includes the URL accessed when the target software issues the first request after being entered into the network system, wherein the target software passes the first DNS of the network system when issuing the first request. and the first server access URL; on this basis, step S103 includes: configuring the second DNS and the second server in the network system according to the URL to prevent the target software from passing the first DNS and the first server of the network system when issuing the first request. The first server accesses the URL, causes the target software to access the URL through the second DNS of the network system and the second server, and exits based on the result of accessing the URL.

Specifically, some target software will first send a request (such as the first request in this optional embodiment) when it starts running in the input network system. Specifically, the first request may be a URL request, so the target software sends The first request accesses the URL through the first DNS and the first server and obtains a response. For the target software, when the response result meets certain conditions, the target software will exit the operation (for example, the response result is a response value, then The condition for exiting the run can be that the response value is greater than a response value threshold). Regarding this, in the embodiment of the present disclosure, a second DNS and a second server can be configured in the network system according to the URL. The second DNS is different from the first DNS, and the second server is different from the first server. The second DNS and the second server may be configured to specifically respond to the first request issued by the target software. When the target software is input to the network system (for example, when the target software is input to the program running device), due to the second The existence of DNS and the second server, which after issuing the first request (such as a URL request) no longer accesses the URL through the first DNS and the first server of the network system, but accesses it through the second DNS and the second server of the network system the URL. The result of accessing the URL may be a response value after the first request of the target software is responded to. The response value is greater than the response value threshold corresponding to when the target software exits, so that the target software exits based on the result of accessing the URL. For example, if the corresponding response value threshold when the target software exits running is 200, then the target software accesses the URL through the second DNS and the second server, and the response value can be set to 300. Since the response value 300 > the response value threshold 200, Therefore, the target software will exit after issuing the first request to access the URL through the configured second DNS and second server. In this way, the network system protection method of the embodiment of the present disclosure achieves the purpose of preventing the target software from running normally in the network system through the second DNS and the second server configured according to the URL.

Optionally, both the first server and the second server in the embodiment of the present disclosure may be HTTP servers. This is, of course, not a reasonable limitation on the disclosure.

It can be understood that when the obtained object information of the target software includes multiple of mutex information, service information and request information, the protection strategy corresponding to each of the object information can be configured in the network system. Thereby maximizing the reliability of preventing the target software (for example, the target software is malware) from running, thereby minimizing the possibility of the network system being attacked by malware, making the operation of the devices in the network system less susceptible to malware. Interference or obstruction can effectively prevent malware from causing adverse effects on the network system, thereby ensuring the security of the network system.

In order to improve the reliability of the network system protection method in the embodiment of the present disclosure in preventing target software from running in the network system, in some optional embodiments, refer to another optional method in the embodiment of the present disclosure shown in Figure 3 A step flow chart of a network system protection method. In the network system protection method, step S102 is also included before step S103.

S102: Input the object information into the verification system, and configure the protection strategy in the verification system according to the object information; enter the target software into the verification system configured with the protection strategy, and determine whether the target software can run normally in the verification system; if not, Then step S103 is executed, that is, configuring a protection policy for the target software in the network system according to the object information.

Specifically, the same software operating environment as the network system can be established in the verification system, and the protection strategy can be configured in the verification system, so that the operation of the target software after input to the verification system can accurately display the operation of the target software after input to the configuration and verification. The operating phenomena of network systems with the same protection strategy can be used to verify the reliability of the protection strategy. Specifically, if the target software can run normally in the verification system configured with a protection policy, it means that the protection policy is less reliable. When the protection policy is configured in the network system, it cannot effectively prevent the target software from running in the network system; If the target software cannot run normally in the verification system, it means that the protection strategy is more reliable. When the protection strategy is configured in the network system, it can effectively prevent the target software from running in the network system, so it can be determined whether the target software can When the result of verifying normal operation in the system is negative, configure a protection policy for the target software in the network system based on the object information to prevent the target software from running.

Optionally, if the target software can run normally in a verification system configured with a protection strategy, the target software can be sent to the staff's terminal, and the staff can perform manual analysis. For example, the target software can be manually determined whether object information exists. , if there is a configuration based on the protection strategy for the network system.

As mentioned above, the network system protection method in the embodiment of the present disclosure is applied to an application scenario where the network system is an OT system and the program running device is an OT device (such as various industrial control devices on the production line that can run software programs). , you can get more significant effective effects. The reason is that the OT system is different from other computer network systems. The OT equipment in the OT system generally cannot frequently upgrade and patch its internal software programs, nor can it install dedicated software like the program running equipment in other computer network systems. Anti-malware applications (such as anti-virus software). On the one hand, this is to ensure the stability of OT equipment in industrial sites (such as production lines). Frequent upgrades and patching of internal program software may easily lead to unstable operation of OT equipment; on the other hand, because each of the OT devices in the OT system The software and hardware configurations of OT devices are often different. When a dedicated anti-malware application is installed on an OT device, it is easy to be incompatible, causing the application to not run properly, and it is also easy to cause a blue screen on the OT device. Fault. And because the OT equipment in the OT system plays a decisive role in the normal execution of production tasks on the production line, if it cannot run stably due to internal software upgrades and patches, as well as the installation of dedicated anti-malware software applications, it will have a negative impact on production. The performance of tasks can also have adverse effects.

In any of the network system protection methods in the embodiments of the present disclosure, the object information of the target software is obtained. The object information includes mutex information of the target software, service information created after the target software is input into the network system, and target software. At least one of the request information sent by the software after inputting it into the network system, and configuring a protection policy for the target software in the network system based on the object information to prevent the target software from running in the network system. Therefore, the embodiments of the present disclosure can very stably and effectively prevent the operation of malware input to the OT system when the target software is malware, thereby reducing the possibility of the OT system being attacked by malware and making the OT system more susceptible to malware attacks. The operation of OT equipment is also less likely to be interfered or hindered by malware, which can effectively prevent malware from causing adverse effects on the OT system and ensure the security of the OT system. And on this basis, such a network system protection method is also more lightweight than installing dedicated anti-malware applications (such as anti-virus software) in OT devices, and it occupies a larger amount of memory on the OT device. It is small and does not involve any hooks and drivers, preventing these additional programs from affecting the stable operation of OT equipment; and even if the protection strategy configured in the OT system fails, the failure will not affect each OT of the OT system. The stability of the operation of the equipment itself; and since there is almost no need to consider the software and hardware configuration issues, when each OT equipment can be better adapted to the OT system, it will rarely be incompatible and will not cause the OT equipment to A blue screen or other failure occurs.

It can be seen from this that the network system protection method in the embodiment of the present disclosure can achieve more significant effects when applied to an application scenario where the network system is an OT system and the program running device is an OT device, and can stably and effectively protect the system. Protect according to one application scenario.

Next, an example will be used to provide an overall description of the network system protection method in the embodiment of the present disclosure. In this example, the network system protection method is used to protect OT systems from malware. It should be understood that this does not serve as any limitation on the embodiments of the present disclosure.

In this example, the target software is ransomware (recorded as wannacry example), then enter the wannacry example into the sandbox to run, and obtain the running data of the wannacry example. Then use the preset mutex name blacklist, service name blacklist, and URL blacklist to filter the running data to obtain the object information of the wannacry example, that is, the mutex name of the wannacry example (that is, the mutex information) , service name (i.e., service information), and URL (i.e., request information). Enter the obtained mutex name, service name, and URL into the verification system, configure the protection strategy based on these object information, and create false mutex objects, false first service objects, and configurations in the memory space of the verification system. Fake DNS and HTTP servers so that the wannacry example makes the first request to get a response by accessing the URL through the fake DNS and HTTP servers. If the wannacry example cannot run normally in the verification system, it means that the protection strategy that can be configured based on the object information of the wannacry example has good reliability. When the protection strategy is configured to the OT system, it can effectively prevent the wannacry example from running in the OT system. . Then the mutex name and service name are input into the interface program as different parameters, thereby obtaining an interface program containing the mutex information and service name, and deploying this program to at least one OT device in the OT system to run. This procedure creates a fake mutex object and a fake first service object in the memory of the OT device, and configures a second DNS and a second server (for example, an HTTP server) in the OT system. The second DNS and The second server can be configured specifically to respond to the first request made by the wannacry example. When the wannacry example is input to the OT device, the mutex object wannacry example is detected and will exit running; or the service object wannacry example is detected and the first service is no longer created and exits because the first service has been started; or the first service is sent. When making a request, the corresponding URL is accessed through the second DNS and the second server, instead of accessing the URL through the first DNS and the first server (for example, HTTP server) of the OT system. And the result of accessing the URL through the second DNS and the second server can be the response value after the first request of the wannacry example is responded to. The response value is greater than the corresponding response value threshold when the wannacry example exits the run, so that the wannacry example is accessed Exit running after URL. It can be seen that in this example, the network system protection method in the embodiment of the present disclosure can effectively prevent the operation of malware imported into the OT system (ie, the wannacry example), thereby reducing the possibility of the OT system being attacked by malware. This makes the operation of OT equipment in the OT system less likely to be interfered or hindered by malware, which can effectively prevent malware from causing adverse effects on the OT system, thus ensuring the security of the OT system. It should be understood that this example does not serve as any limitation on the embodiments of the present disclosure.

It can be understood that the above contents are only some exemplary explanations of the network system protection methods in the embodiments of the present disclosure, and are not intended to limit any limitations in the embodiments of the present disclosure.

It can be seen from the above that the network system protection method of the embodiment of the present disclosure can obtain the object information of the target software. The object information includes the mutex information of the target software, service information created after the target software is input into the network system, and the target software. At least one of the request information issued after inputting into the network system, and according to the object information, configure a protection policy for the target software in the network system to prevent the target software from running in the network system. Therefore, the embodiment of the present disclosure can be used when the target software is In the case of malware, the operation of malware input into the network system is prevented, thereby reducing the possibility of the network system being attacked by malware, making the operation of devices in the network system less likely to be interfered or hindered by malware, and can effectively To effectively prevent malware from causing adverse effects on network systems, thereby ensuring the security of network systems.

According to the second aspect of the embodiment of the present disclosure, with reference to the block diagram of Figure 4, a network system protection device 400 is also provided, which includes:

The acquisition module 401 is used to obtain the object information of the target software, where the object information includes: mutex information of the target software, service information created after the target software is input into the network system, and request information issued after the target software is input into the network system. at least one;

The blocking module 402 is configured to configure a protection policy for the target software in the network system based on the object information, so as to prevent the target software from running in the network system.

In an optional embodiment, in the network system protection device 400, the blocking module 402 is specifically used to: create a mutex program corresponding to the target software according to the mutex information in the object information; input the mutex program into the network system running in at least one program running device to prevent the target software from running in the program running device through the mutex program.

In an optional embodiment, in the network system protection device 400, the service information includes the service name of the first service created after the target software is entered into the network system; the blocking module 402 is specifically used to: create a service in the network system based on the service name. first service to prevent the target software from creating the first service through the already created first service.

In an optional embodiment, in the network system protection device 400, the request information includes the URL that the target software accesses when it issues the first request after it is entered into the network system, wherein the target software passes the first request of the network system when it issues the first request. DNS and the first server access URL; the blocking module 402 is specifically used to: configure the second DNS and the second server in the network system according to the URL to prevent the target software from passing the first DNS and the second server of the network system when issuing the first request. The first server accesses the URL, causes the target software to access the URL through the second DNS of the network system and the second server, and exits based on the result of accessing the URL.

In an optional embodiment, in the network system protection device 400, the network system protection device 400 is also used to input object information into the verification system, configure a protection strategy in the verification system according to the object information; input the target software and configure the protection strategy verification system, and determine whether the target software can run normally in the verification system; if not, the blocking module 402 is used to configure a protection policy for the target software in the network system based on the object information.

In an optional embodiment, in the network system protection device 400, the acquisition module 401 is specifically used to: input the target software into a preset sandbox for operation, and obtain the operation data; and determine the object of the target software according to the operation data. information.

In an optional embodiment, in the network system protection device 400, the acquisition module 401 is specifically configured to filter the running data through a preset blacklist to obtain the object information of the target software from the results of the filtering process.

The network system protection device 400 in the embodiment of the present disclosure is based on the same inventive concept as the network system protection method of the first aspect, and its relevant beneficial effects are also the same as those of the corresponding embodiments in the network system protection method of the first aspect. The method is the same, so it can be understood according to the foregoing embodiments of the network system protection method, and will not be described again here.

In the network system protection device 400 in the embodiment of the present disclosure, the acquisition module 401 can obtain the object information of the target software, where the object information includes the mutex information of the target software, service information created after the target software is input into the network system, and the input of the target software. At least one of the request information issued by the network system; the blocking module 402 can configure a protection policy for the target software in the network system based on the object information to prevent the target software from running in the network system. Therefore, the embodiment of the present disclosure can prevent the target software from running in the network system. When the software is malware, the malware input into the network system is prevented from running, thereby reducing the possibility of the network system being attacked by malware and making the operation of the devices in the network system less likely to be interfered or hindered by malware. It can effectively prevent malware from causing adverse effects on the network system, thereby ensuring the security of the network system.

According to a third aspect of the embodiment of the present disclosure, the embodiment of the present disclosure provides a computer device 500, which includes: a processor 502; and a memory 506 storing a program 510, wherein the program 510 includes computer operation instructions, and the computer operation instructions When executed by the processor 502, the processor 502 is caused to execute the aforementioned network system protection method.

The embodiment of the present disclosure does not limit the specific implementation of the computer device 500. As an example, refer to FIG. 5, which is a schematic structural diagram of an optional computer device 500 provided by the embodiment of the present disclosure. The computer device 500 can It includes: processor 502, communication interface 504, memory 506, and communication bus 508. Among them: the processor 502, the communication interface 504, and the memory 506 complete communication through the communication bus 508.

Communication interface 504 is used to communicate with other computer devices or servers.

The processor 502 is configured to execute the program 510. Specifically, it can execute the relevant steps in the aforementioned network system protection method embodiment.

Specifically, program 510 may include program code including computer operating instructions.

The processor 502 may be a central processing unit (CPU), an application specific integrated circuit (ASIC), or one or more integrated circuits configured to implement embodiments of the present application. The one or more processors included in the smart device can be the same type of processor, such as one or more CPUs; or they can be different types of processors, such as one or more CPUs and one or more ASICs.

Memory 506 is used to store programs 510. Memory 506 may include high-speed RAM memory and may also include non-volatile memory, such as at least one disk memory.

The program 510 may be specifically used to cause the processor 502 to perform the aforementioned network system protection method operations.

For the specific implementation of each step in program 510, please refer to the corresponding description in the above embodiment of the network system protection method, and will not be described again here. Those skilled in the art can clearly understand that for the convenience and simplicity of description, the specific working processes of the above-described devices and modules can be referred to the corresponding process descriptions in the foregoing method embodiments, and will not be described again here.

According to a fourth aspect of the embodiments of the present disclosure, the embodiments of the present disclosure provide a computer storage medium, wherein the computer storage medium stores computer instructions, and the computer instructions are used to cause the computer to execute any of the foregoing network system protection methods.

For the network system protection device/computer equipment/computer storage medium embodiment, the relevant content and beneficial effects are basically similar to the network system protection method embodiment provided in the first aspect, so the description here is relatively brief. This can be understood based on the foregoing embodiments of the network system protection method.

It should be understood that various steps described in the method implementations of the present disclosure may be executed in different orders and/or in parallel. Furthermore, method embodiments may include additional steps and/or omit performance of illustrated steps. The scope of the present disclosure is not limited in this regard.

As used herein, the term "include" and its variations are open-ended, ie, "including but not limited to." The term "based on" means "based at least in part on." The term "one embodiment" means "at least one embodiment"; the term "another embodiment" means "at least one additional embodiment"; and the term "some embodiments" means "at least some embodiments". It should be noted that the modifications of "one" and "plurality" mentioned in this disclosure are illustrative and not restrictive. Those skilled in the art will understand that unless the context clearly indicates otherwise, it should be understood as "one or Multiple”.

It should be understood that expressions similar to “first” and “second” used in the embodiments of the present disclosure may modify various components regardless of order and/or importance, but these expressions do not limit the corresponding components. The above expressions are only provided for the purpose of distinguishing one component from another component.

Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the embodiments of the present disclosure, but not to limit them; although the present disclosure has been described in detail with reference to the foregoing embodiments, those of ordinary skill in the art should understand that: The technical solutions described in the foregoing embodiments can still be modified, or some of the technical features can be equivalently replaced; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and spirit of the technical solutions of the embodiments of the present disclosure. scope.

Claims

A network system protection method, including:

Obtain object information of the target software, where the object information includes: mutex information of the target software, service information created after the target software is input into the network system, and request information issued after the target software is input into the network system. at least one of;

According to the object information, a protection policy for the target software is configured in the network system to prevent the target software from running in the network system.
The method according to claim 1, wherein said configuring a protection policy for the target software in the network system according to the object information to prevent the target software from running in the network system includes: :

Create a mutex program corresponding to the target software according to the mutex information in the object information;

The mutually exclusive program is input to at least one program execution device of the network system to run, so that the target software is prevented from running in the program execution device through the mutually exclusive program.
The method according to claim 1, wherein the service information includes the service name of the first service created after the target software inputs the network system;

Configuring a protection policy for the target software in the network system according to the object information to prevent the target software from running in the network system includes:

Create the first service in the network system according to the service name to prevent the target software from creating the first service through the created first service.
The method according to claim 1, wherein the request information includes a URL accessed when the target software issues a first request after inputting into the network system, wherein the target software passes through the network system when issuing the first request. The first DNS and first server to access the URL;

Configuring a protection policy for the target software in the network system according to the object information to prevent the target software from running in the network system includes:

Configuring a second DNS and a second server in the network system according to the URL to prevent the target software from accessing the URL through the first DNS and the first server of the network system when issuing a first request, The target software is caused to access the URL through the second DNS and the second server of the network system, and exits based on the result of accessing the URL.
The method according to claim 1, wherein the protection policy for the target software is configured in the network system according to the object information, and the method further includes:

Enter the object information into the verification system, and configure the protection strategy in the verification system according to the object information;

Enter the target software into a verification system configured with the protection strategy, and determine whether the target software can run normally in the verification system; wherein,

If not, execute: configure a protection policy for the target software in the network system according to the object information.
The method according to any one of claims 1-5, wherein said obtaining the object information of the target software includes:

Enter the target software into a preset sandbox to run, and obtain running data;

According to the running data, the object information of the target software is determined.
The method according to claim 6, wherein determining the object information of the target software according to the running data includes:

The running data is filtered through a preset blacklist to obtain the object information of the target software from the results of the filtering process.
A network system protection device (400), including:

Acquisition module (401), used to obtain object information of the target software, where the object information includes: mutex information of the target software, service information created after the target software is input into the network system, the target software At least one of the request information issued after being entered into the network system;

A blocking module (402), configured to configure a protection policy for the target software in the network system according to the object information, so as to prevent the target software from running in the network system.
A computer device (500) comprising:

processor (502); and

Memory (506) storing a program (510), wherein the program (510) includes computer operating instructions that, when executed by the processor (502), cause the processor (502) to perform the The network system protection method described in claims 1-7.
A computer storage medium, wherein the computer storage medium stores computer instructions, and the computer instructions are used to cause the computer to execute the network system protection method according to any one of claims 1-7.