CN115695548A - A website real-time monitoring system - Google Patents

Abstract

The invention discloses a real-time monitoring system for a website, which includes a Server end and an Agent end. The Server end includes log storage, configuration center, analysis center, alarm center, and Server-GUI six modules. The Server-GUI module is the main The interface display module can display alarm information and configuration information functions, and can intuitively display alarm information and configuration information to the staff. When the Agent is connected to the server for message transmission, it will obtain the configuration items synchronously, and Perform local real-time scanning, scan whether the content hardware resources exceed the configured threshold, whether there are dark links or malicious keywords in webpage files, etc., and monitor the website in real time. This kind of website real-time monitoring system achieves the purpose of avoiding certain false positives or false positives by directly analyzing the original files through the Server side and the Agent side, etc. Real-time analysis of hardware resources and the purpose of providing performance overload protection.

Description

A website real-time monitoring system

technical field

The invention relates to the technical field of website monitoring, in particular to a website real-time monitoring system.

Background technique

With the development of information technology, the information infrastructure such as the enterprise's website has become particularly important. Among them, the monitoring of the security of the enterprise's internal website is also the top priority. If the website is maliciously tampered with or attacked, it will damage the corporate image. serious loss.

At present, the commonly used website security monitoring method is to use a commercial website security monitoring platform to monitor the dark link and running status of the website through bypass deployment. However, the traditional monitoring method requires the deployment of hardware devices in the management network. It is complicated and difficult to use. Because the working principle is to directly access the target web service for business analysis, it is impossible to monitor the CPU, memory, and disk usage of the server in real time, and the existing detection methods have certain false positives or false positives. The device deployment is complex and requires intrusion into the network environment, making real-time analysis of server hardware resources impossible.

Contents of the invention

The purpose of the present invention is to provide a website real-time monitoring system to solve the problems raised in the background technology against the shortcomings of the prior art.

To achieve the above object, the present invention provides following technical scheme: a kind of website real-time monitoring system, comprises Server end and Agent end, and described Server end comprises log storage, configuration center, analysis center, alarm center, Server-GU I six big modules , the Server-GU I module is the main interface display module, which can display alarm information, configuration information functions, and can intuitively show alarm information and configuration information etc. to the staff, and the Agent end carries out message transmission at the connection service end , the configuration items will be obtained synchronously, and real-time scanning will be performed locally to check whether the hardware resources of the scanning content exceed the configuration threshold, whether there are hidden links or malicious keywords in the webpage files, etc., and the website can be monitored in real time. Identifying hidden links or keywords on webpages is currently identified by directly analyzing the original file, which can directly avoid certain false positives or false negatives, and the monitoring efficiency is higher. At the same time, if the CPU and memory are too high during scanning, the Start the performance overload protection, and after the scan, the Agent will actively contact the message distribution center in the Agent, and send the scan results to the analysis center, and also realize the real-time analysis of all server hardware resources such as CPU and memory .

As a preferred technical solution of the present invention, the log storage includes a log analysis management system, which can uniformly collect, process, store, and query and analyze discrete logs, and can upload logs through the Agent side, and can grasp and sort out logs in real time, and Logs can be managed in real time.

As a preferred technical solution of the present invention, the configuration center can configure the relevant configuration of its website through the configuration center, and the information and data configured by its configuration center can be displayed by the interface display module in the Server-GUI module. Configuration information, while monitoring the website through the configuration information, it can also protect the website.

As a preferred technical solution of the present invention, the analysis center can accept the log files uploaded by the Agent, and analyze the logs, filter and analyze the servers with hidden links or malicious keywords or hardware resources exceeding the threshold, and store the facts in the The log storage center can be displayed on the interface display of the Server-GUI module through the alarm center, which can filter and analyze dark links and malicious keywords on the website or servers whose hardware resources exceed the threshold, and monitor the website in real time.

As a preferred technical solution of the present invention, the alarm center can analyze the log files uploaded by the analysis center to the Agent side, and analyze the logs, filter and analyze the servers with dark links or malicious keywords or hardware resources exceeding the threshold, and Through the analysis of the analysis center, the corresponding analysis situation will be displayed on the interface display module in the Server-GU I module through the alarm center, and the alarm center can report the hidden links and malicious keywords or hardware resources on the website that the analysis center exceeds the threshold The server is filtered and analyzed, and displayed on the interface display module in the Server-GUI module through the alarm center, which can be processed by relevant personnel.

As a preferred technical solution of the present invention, the Server-GU I module is the main interface display module, which can display the function of alarm information and configuration information, and can provide an intuitive display function for relevant personnel, so that relevant personnel can understand the analysis center There are dark links or malicious keywords on the website, or the server whose hardware resources exceed the threshold will be filtered and analyzed for processing.

As a preferred technical solution of the present invention, the Agent can monitor the running state of the website, and upload the monitored running state of the website to the log storage, which can be used by the analysis center to analyze the log of the running state of the website uploaded, It can guarantee the normal operation of the website.

As a preferred technical solution of the present invention, the identification of hidden webpage links or keywords in the Agent side is currently identified by directly analyzing the original file, which can be replaced by active detection or crawler de-identification, but the scheme of active detection or crawler de-identification If there are certain false positives or false negatives in the presence of network fluctuations, anti-crawler mechanisms on the website, and react environments, this situation can be avoided directly by directly analyzing the original files, and false positives or false positives can be avoided by directly analyzing the original files. Underreporting.

As a preferred technical solution of the present invention, if the CPU and memory occupation of the Agent end is too high during scanning, the performance overload protection will be started, and the scanning and identification will continue after the CPU and memory occupation are reduced. After the scan ends, the Agent end will actively Contact the message distribution center on the Agent side and send the scanning results to the analysis center, which can perform real-time analysis of all server hardware resources and provide performance overload protection.

Compared with the prior art, the present invention provides a real-time website monitoring system, which has the following beneficial effects:

1. This kind of website real-time monitoring system, by setting up the server side and the agent side, etc., the identification of dark links or keywords in the webpage in the agent side is currently identified by directly analyzing the original file, which can be replaced by active detection or crawler identification. Realized the purpose of directly avoiding certain false positives or false negatives by directly analyzing the original files;

2. This kind of website real-time monitoring system, by setting the server side and the agent side, etc., if the CPU and memory usage of the agent side is too high during scanning, it will start the performance overload protection, and continue scanning after the CPU and memory usage decrease After the scan is completed, the Agent will actively contact the message distribution center in the Agent and send the scan results to the analysis center, realizing the real-time analysis of all server hardware resources and providing performance overload protection.

Description of drawings

Fig. 1 is a schematic diagram of a system architecture diagram of a website real-time monitoring system;

FIG. 2 is a schematic structural diagram of a server-side display diagram of a website real-time monitoring system.

Detailed ways

The following will clearly and completely describe the technical solutions in the embodiments of the present invention with reference to the accompanying drawings in the embodiments of the present invention. Obviously, the described embodiments are only some, not all, embodiments of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by persons of ordinary skill in the art without making creative efforts belong to the protection scope of the present invention.

Embodiment one:

Please refer to Fig. 1 and Fig. 2, a kind of website real-time monitoring system, comprises Server end and Agent end, and Server end comprises log storage, configuration center, analysis center, alarm center, Server-GU I six modules, Server-GU I module As the main interface display module, it can display alarm information and configuration information functions, and can intuitively display alarm information and configuration information to the staff. When the Agent side connects to the server for message transmission, it will obtain the configuration items synchronously, and Perform local real-time scanning to check whether the hardware resources of the scanning content exceed the configured threshold, whether there are dark links or malicious keywords in the webpage files, etc., and the website can be monitored in real time. The identification of dark links or keywords in the webpage on the Agent side currently uses direct analysis of the original File identification can directly avoid certain false positives or missed negatives, and the monitoring efficiency is higher. At the same time, if the CPU and memory are too high during scanning, the performance overload protection will be activated, and the Agent will The terminal will actively contact the message distribution center in the Agent terminal, and send the scanning results to the analysis center. At the same time, it also realizes real-time analysis of resources for all server hardware such as CPU and memory. Managers can configure related information through Server-GUI Configuration items, including the threshold configuration of the website's CPU usage, memory usage, and disk usage, the Agent will scan and monitor the configuration items in real time. If it is found that the server exceeds the configuration threshold, it will give a real-time alarm. The files in the service directory are analyzed separately, and if hidden links or malicious keywords are found, an alarm will be displayed in real time.

Embodiment two:

Please refer to Figure 1 and Figure 2. Log storage includes a log analysis management system, which can collect, process, store, query and analyze discrete logs in a unified manner, and can upload logs through the Agent side. It can grasp and sort out logs in real time, and can analyze The log is managed in real time, and the configuration center can configure the relevant configuration of its website through the configuration center, and the information and data configured by the configuration center can be displayed through the interface display module in the Server-GU I module, and its configuration information can be displayed through While configuring the information to monitor the website, it can also protect the website. The analysis center can accept the log files uploaded by the Agent, and analyze the logs, and filter the servers with dark links or malicious keywords or hardware resources exceeding the threshold. Analysis, and the facts are stored in the log storage center, which can be displayed on the interface display in the Server-GU I module through the alarm center, and can filter and analyze dark links and malicious keywords on the website or servers whose hardware resources exceed the threshold, and real-time The website is monitored, and the alarm center can analyze the log files uploaded by the analysis center to the Agent side, and filter and analyze the servers with hidden links or malicious keywords or hardware resources exceeding the threshold, and through the analysis of the analysis center, The corresponding analysis situation is displayed on the interface display module in the Server-GU I module through the alarm center, which can be processed by relevant personnel. The Server-GU I module is the main interface display module, which can display alarm information and configuration The function of information can provide relevant personnel with an intuitive display function, so that relevant personnel can filter, analyze and process the servers with dark links or malicious keywords on the website or hardware resources exceeding the threshold for relevant personnel. On the Agent side, etc., the identification of dark links or keywords in the webpage on the Agent side is currently identified by directly analyzing the original file, which can be replaced by active detection or crawler identification, which realizes that the use of direct analysis of the original file can directly avoid certain false positives or omission of purpose.

Embodiment three:

Please refer to Figure 1 and Figure 2, the Agent side can monitor the running status of the website, and upload the monitored running status of the website to the log storage, which can be used by the analysis center to analyze the logs of the running status of the website uploaded, which can ensure For the normal operation of the website, the identification of dark links or keywords on the Agent side is currently performed by directly analyzing the original file for identification, which can be replaced by active detection or crawler identification, but if there are network fluctuations in the active detection or crawler identification scheme , When the website has an anti-crawler mechanism and a react environment, there are certain false positives or false positives. This situation can be directly avoided by directly analyzing the original files. By directly analyzing the original files, false positives or false positives can be avoided. If the CPU and memory usage are too high during scanning, the performance overload protection will be activated, and the scanning and identification will continue after the CPU and memory usage decrease. After the scanning is completed, the Agent will actively contact the message distribution center in the Agent and The results are sent to the analysis center, which can perform real-time analysis of all server hardware resources and provide performance overload protection. By setting the Server side and Agent side, etc., the real-time analysis of all server hardware resources and performance overload protection are realized.

Working principle of the present invention and use flow: at first log can be uploaded to log storage through Agent end, can carry out corresponding configuration to website through configuration center afterwards, the data of its configuration can pass through the interface display module in the Server-GU I module , to display its configuration information, the log files uploaded by the Agent side can be analyzed through the analysis center, and the servers with dark links or malicious keywords or hardware resources exceeding the threshold can be filtered and analyzed, and the facts are stored in the log storage center. The alarm center is displayed on the interface display in the Server-GU I module. Currently, the dark links or keywords in the identified web pages are identified by directly analyzing the original files, which can be replaced by active detection or crawler identification. However, active detection or If the crawler de-identification scheme has network fluctuations, anti-crawler mechanism on the website, and react environment, there will be certain false positives or false positives. This situation can be directly avoided by directly analyzing the original file, and then the identification in the Agent can be realized. Dark links or keywords on webpages are currently identified by directly analyzing the original files, which can be replaced by active detection or crawler identification. Using direct analysis of original files can directly avoid certain false positives or missed negatives. The Agent side scans If the CPU and memory usage are too high, the performance overload protection will be activated, and the scanning and identification will continue after the CPU and memory usage decrease. After the scanning is completed, the Agent will actively contact the message distribution center in the Agent and send the scanning results to The analysis center can realize real-time analysis of all server hardware resources and provide performance overload protection.

Finally, it should be noted that: the above is only a preferred embodiment of the present invention, and is not intended to limit the present invention. Although the present invention has been described in detail with reference to the foregoing embodiments, for those skilled in the art, it still The technical solutions recorded in the foregoing embodiments may be modified, or some technical features thereof may be equivalently replaced. Any modifications, equivalent replacements, improvements, etc. made within the spirit and principles of the present invention shall be included within the protection scope of the present invention.

Claims (9)

1. A website real-time monitoring system, comprising Server end and Agent end, is characterized in that: described Server end comprises log storage, configuration center, analysis center, alarm center, Server-GUI six big modules, and described Server-GUI module It is the main interface display module, displaying alarm information and configuration information functions. When the Agent is connected to the server for message transmission, it will obtain the configuration items synchronously, and perform real-time scanning locally to check whether the hardware resources of the scanning content exceed the configuration threshold , whether there are hidden links or malicious keywords in the webpage file, etc., the identification of hidden links or keywords in the webpage in the Agent is currently identified by directly analyzing the original file, which can directly avoid certain false positives or false negatives, and at the same time, when scanning If the CPU and memory are too high, the performance overload protection will be activated, and after the scan is completed, the Agent will actively contact the message distribution center in the Agent and send the scan results to the analysis center. 2. A kind of website real-time monitoring system according to claim 1, it is characterized in that: described log storage comprises log analysis management system, can carry out unified collection, processing, storage and query analysis to discrete log, and can pass Agent end Perform log upload. 3. A website real-time monitoring system according to claim 1, characterized in that: said configuration center can configure the relevant configuration of its website through the configuration center, and the information and data configured by its configuration center can be configured through the Server - The interface display module in the GUI module displays its configuration information. 4. A kind of website real-time monitoring system according to claim 1, it is characterized in that: described analysis center can accept the log file that Agent end uploads, and log is analyzed, there will be dark link or malicious keyword or hardware resource Servers that exceed the threshold are filtered and analyzed, and the facts are stored in the log storage center, which can be displayed on the interface display in the Server-GUI module through the alarm center. 5. A kind of website real-time monitoring system according to claim 1, it is characterized in that: described alarm center can analyze the log file that analysis center uploads to Agent end, and log is analyzed, there will be dark link or malicious keyword Or the server whose hardware resource exceeds the threshold is filtered and analyzed, and through the analysis of the analysis center, the corresponding analysis situation is displayed on the interface display module in the Server-GUI module through the alarm center. 6. A website real-time monitoring system according to claim 1, characterized in that: said Server-GUI module is a main interface display module capable of displaying alarm information and configuration information. 7. A kind of website real-time monitoring system according to claim 1, it is characterized in that: described Agent end can monitor website operation state, and the website operation state that is monitored is uploaded to log storage, can be used for analysis center to analyze Analyze the logs of the running status of the website uploaded by it. 8. A kind of website real-time monitoring system according to claim 1, it is characterized in that: the identification web page dark link or keyword in the said Agent end adopts the direct analysis original file to identify at present, can go to identify by active detection or crawler Replacement, but if there are network fluctuations in the active detection or crawler de-identification scheme, the website has an anti-crawler mechanism, and a react environment, there will be certain false positives or negative negatives. This situation can be directly avoided by directly analyzing the original file. 9. A kind of website real-time monitoring system according to claim 1, it is characterized in that: if the CPU and memory occupation of the Agent end are too high when scanning, it will start the performance overload protection, and then wait for the CPU and memory occupation to decrease. Continue to scan and identify. After the scan is over, the Agent will actively contact the message distribution center in the Agent and send the scan results to the analysis center.

Images