CN1630245B - Method of network system virus prevention, network system - Google Patents

Abstract

A method for implementing network antivirus in an isolated manner is applicable to a network system. The network system has an isolated management module and connects multiple computer devices. First, the isolation management module will find out the weak devices among all the computer devices connected to the network system, and the weak devices are computer devices with security weaknesses. Then, the isolation management module isolates the found vulnerable devices. Afterwards, when the security weakness is eliminated, the isolation management module will release the isolation state of the weak device and enter the normal operation state.

Description

Antivirus method for network system and its network system

technical field

The invention relates to a network system antivirus method, in particular to a network system antivirus method in an isolated manner.

technical background

Due to the continuous advancement of computer and network technology, the network system has become the information infrastructure of an enterprise or an organization. Internally, the internal network (Intranet) can be used as a communication tool to gradually replace traditional written work. Externally, through the Internet (Internet), information can be collected or interacted with by the outside world. In other words, no matter at present or in the foreseeable future, the usage rate and dependence of enterprises or organizations on network systems will inevitably increase day by day.

The popularization of network system usage and the complexity of network system users will increase the chances of computer devices connected to the network system being infected by computer viruses or malicious codes, some of which will be transmitted to network system users Without detection, it invades the computer device used by the user, and then infects the computer devices of other users connected to the network system. For example, some malicious programs may utilize security holes of programs or systems to intrude into users' computer devices. Security vulnerabilities refer to the infection vulnerabilities of programs built-in or installed on network systems or computer devices, such as Microsoft Internet Information Services (IIS) or database management tools such as SQL Server etc., under some special conditions, control rights will be lost, resulting in malicious program intrusion.

The aforementioned problems are traditionally solved by installing a patch. However, installing a patch program to solve the problem of a computer device being invaded by a computer virus or a malicious program through a security vulnerability has several disadvantages. First, when there are too many security vulnerabilities in the network system, installing correction programs one by one is not only time-consuming and laborious, but also prone to omissions, making it difficult to achieve the goal of complete prevention. Second, the correction program itself is a form of program upgrade, and hastily installed on the user's computer device will often cause software compatibility problems, reducing the user's willingness to install the correction program. Third, the life cycle (cycle time) of various computer viruses and malicious programs is getting shorter and shorter, and the update speed of corrected programs often cannot keep up with the speed of development of computer viruses or malicious programs. That is to say, when the updated version of the modified program has not yet matured, a new version or deformation of the computer virus or malicious program has already been produced, so the modified program often cannot completely solve the problem.

However, the current anti-virus methods for network systems cannot completely solve the problem that the network system is invaded by computer viruses or malicious programs through security weaknesses.

Contents of the invention

In view of this, the purpose of the present invention is just to utilize the computer device that has isolation (segmentation) function in the network system, as hub (switch) or router (router) etc., will link in this network system, may be infected by computer virus or malicious The computer device that the program invades is isolated. When the aforementioned computer devices that may be invaded by computer viruses or malicious programs have ruled out the crisis of being invaded, the isolated state will be released for normal operation.

In order to achieve the above object, the present invention provides a method for implementing network antivirus in an isolated manner, which is suitable for a network system that connects multiple computer devices and has an isolation management module.

First, the isolation management module refers to the vulnerable device list to find out the vulnerable devices in the computer device. The vulnerable device list includes vulnerable devices and security vulnerabilities of each vulnerable device, and the vulnerable device list can be stored in a database or presented in other ways. A security weakness refers to a part of a vulnerable device that has been invaded by a malicious program or a part that may be invaded by a malicious program. For example, when the buffer of Microsoft's network information service is overflowed, the control right will be lost instantly, so that the malicious program can take advantage of it, send the malicious program code into the computer device, and wait for the opportunity to infect other computers through the network system. computer device.

Then, the quarantine management module isolates the found vulnerable device according to the above vulnerable device list. The isolation management module can be placed in a computer device connected to the network system, or can be built as an independent computer device connected to the network system. For example, the isolation management module can be a program module written by computer-executable program codes, placed in a computer device connected to the network system, and utilizes a hub or a router to perform the function of isolating the computer device. Or the isolation management module can be built as a personal computer (personal computer) plus a network card to perform the function of isolating the computer device.

Afterwards, when the security weakness is eliminated, the isolation management module releases the isolation of the vulnerable device according to the vulnerable device list. Elimination of security vulnerabilities can be achieved by installing fixes or virus removal programs. It is worth noting that the isolation management module may only isolate the part with security weaknesses in the vulnerable device. Assuming that according to the list of vulnerable devices, computer device A is a vulnerable device and the connection port 1 (port 1) is its security vulnerability, then the isolation management The module can only isolate the function of the connection port 1 in the computer device A, while keeping other parts in normal operation. After installing the correction program or the virus removal program that can eliminate the security weakness, the isolation management module releases the isolation of the connection port 1 in the computer device A, and restores the normal operation state. In this way, the impact of the isolation on the computer device can be controlled to a minimum range, increasing the user's cooperation.

It can be seen from the above that the method proposed by the present invention has considerable flexibility in implementation, and can isolate computer devices with security weaknesses, or even isolate only the parts with security weaknesses. Moreover, the method proposed by the present invention is to prevent viruses before they invade. Compared with the current network anti-virus methods, which all detect that the network system has been invaded by computer viruses or malicious programs, they only use correction programs to remedy the situation. The present invention can achieve completely prevent the effect. Furthermore, the use of the isolation management module to cooperate with computer devices with isolation functions in the existing network system, such as hubs or routers, achieves the purpose of anti-virus in the network system without increasing the burden on the network system.

In addition, the present invention proposes a storage medium for storing a computer program, the computer program is used for loading into a computer system and causing the computer system to execute the above-mentioned method steps.

Furthermore, the present invention proposes a device for implementing network system antivirus in an isolated manner, which is suitable for a network system that connects multiple computer devices, and includes an isolation management module. As mentioned above, the isolation management module can be placed in a computer device connected to the network system, or built as an independent computer device connected to the network system.

The isolation management module is used for referring to the vulnerable device list, finding out the vulnerable device in the computer device, and isolating the vulnerable device according to the vulnerable device list. The vulnerable device list includes vulnerable devices and the security vulnerabilities of each vulnerable device. The vulnerable device list can be stored in a database, or exist in other forms that can be read by the isolation management module. A security vulnerability is a part of a vulnerable device that has been intruded by a malicious program or may be intruded by a malicious program.

When the security weakness is excluded, the isolation management module will release the isolation of the weak device according to the weak device list. Elimination of security vulnerabilities can be achieved by installing fixes or virus removal programs. Similarly, the isolation management module may only isolate the part with security weaknesses in the vulnerable device. copies function.

Furthermore, the present invention proposes a system for implementing network antivirus in an isolated manner, including a network system and an isolated management module. The network system includes a plurality of computer devices. The isolation management module can be placed in a computer device connected to the network system, or an independent computer device connected to the network system.

The isolation management module is used for referring to the vulnerable device list, finding out the vulnerable devices in the computer device, and isolating the found vulnerable devices according to the vulnerable device list. The vulnerable device list includes vulnerable devices and the security vulnerabilities of each vulnerable device. The vulnerable device list can be stored in a database or exist in a form that can be read by other isolation management modules. A security vulnerability refers to a part of a vulnerable device that has been invaded by a malicious program or may be invaded by a malicious program.

When the security weakness is excluded, the isolation management module will release the isolation of the weak device according to the weak device list. Troubleshooting a security vulnerability means installing a fix or virus cleaner. Likewise, the isolation management module can only isolate some functions of the vulnerable device with security vulnerabilities. Therefore, de-quarantine may refer to restoring some functions of the vulnerable device with security vulnerabilities.

Description of drawings

FIG. 1 is a flowchart showing the implementation of the method disclosed in the present invention.

FIG. 2 is a schematic diagram showing a storage medium disclosed in the present invention.

FIG. 3 is a functional block diagram showing the device disclosed in the present invention.

FIG. 4 is a schematic diagram showing the network system disclosed in the present invention.

Description of reference symbols

20-storage medium; 22-computer program to realize network system anti-virus by means of isolation; 220-find out the program logic of weak device; 222-isolate the program logic of weak device; 30-database; 32-list of vulnerable devices; 34-isolate Management module; 36-computer device; 40-network system; 42-hub; 44-router; 46, 48-computer device; 50-isolation management module.

Detailed ways

Please refer to FIG. 1 . FIG. 1 is a flowchart showing the implementation of the method disclosed in the present invention. A method for realizing network system antivirus in an isolated manner is applicable to a network system which connects multiple computer devices and has an isolation management module.

First, the quarantine management module refers to the vulnerable device list (step S10 ) to find out the vulnerable devices in the computer device (step S12 ). The list of vulnerable devices includes vulnerable devices and the security vulnerabilities of each vulnerable device. The list of vulnerable devices can be stored in a database or presented in a form that can be read by other isolation management modules, such as files (files), tables (tables), List (list) and so on. A security weakness refers to a part of a vulnerable device that has been invaded by a malicious program or a part that may be invaded by a malicious program.

Then, the isolation management module isolates the found vulnerable device according to the above vulnerable device list (step S14). The isolation management module can regularly detect all computer devices in the network system after a certain period of time, such as once every three hours. The isolation management module can also use the computer device to connect to the network system to detect the computer device to be connected, and then isolate it when necessary.

Afterwards, when the security weakness is eliminated, the isolation management module releases the isolation of the vulnerable device according to the vulnerable device list (step S16). Elimination of security vulnerabilities can be achieved by installing fixes or virus removal programs. In step S14, when what the isolation management module isolates is some functions with security weaknesses in the computer device, such as connection ports, etc., then in step S16, releasing the isolation of the vulnerable device is to restore the functions with security weaknesses in the computer device. partial function.

Please refer to FIG. 2 . FIG. 2 is a schematic diagram showing a storage medium disclosed by the present invention. As shown in the figure, a storage medium 20 is used for storing a computer program 22, and the computer program 22 is used for loading into a computer system and causing the above-mentioned computer system to execute the above-mentioned method steps. The computer program 22 mainly includes a program logic 220 for finding vulnerable devices and a program logic 220 for isolating vulnerable devices.

Please refer to FIG. 3 . FIG. 3 is a functional block diagram showing the device disclosed in the present invention. As shown in the figure, an antivirus device for a network system is implemented in an isolated manner, which is suitable for a network system that connects multiple computer devices 36 and includes an isolation management module 34 . The isolation management module 34 can be placed in the computer device 36 connected to the network system, or built as an independent computer device 36 connected to the network system.

The isolation management module 34 is used for referring to the vulnerable device list 32 , finding out the vulnerable devices in the computer device 36 , and isolating the vulnerable devices according to the vulnerable device list 32 . The vulnerable device list 32 includes vulnerable devices and security vulnerabilities of each vulnerable device, and the vulnerable device list can be stored in a database 30 . A security vulnerability may be a portion of a vulnerable device that has been intruded or may be intruded by a malicious program.

When the security weakness is eliminated, the quarantine management module 34 will release the quarantine of the vulnerable device according to the vulnerable device list 32 . Elimination of security vulnerabilities can be achieved by installing fixes or virus removal programs. Likewise, the isolation management module 34 may only isolate some functions with security vulnerabilities in the vulnerable device. Therefore, de-isolation refers to restoring some functions of the vulnerable device with security weaknesses.

Please refer to FIG. 4 , which is a schematic diagram showing a network system disclosed by the present invention. As shown in the figure, a network system for implementing network system antivirus in an isolated manner includes a network system 40 and an isolated management module 50 . The network system 40 includes a plurality of computer devices 42 , 44 , 46 , 48 . The isolation management module 50 can be placed in a computer device connected to the network system, such as the computer devices 46 and 48 , or built as an independent computer device connected to the network system, such as the computer device 50 . The isolation management module 50 is used for referring to the list of vulnerable devices, finding out the vulnerable devices in the computer device, and isolating the found vulnerable devices according to the list of vulnerable devices. The vulnerable device list includes vulnerable devices and security vulnerabilities of each vulnerable device, and the vulnerable device list can be stored in a database. A security vulnerability refers to a part of a vulnerable device that has been invaded by a malicious program or may be invaded by a malicious program.

When the security weakness is eliminated, the quarantine management module 50 will release the quarantine of the vulnerable device according to the list of vulnerable devices. Troubleshooting a security vulnerability means installing a fix or virus cleaner.

For example, please refer to FIG. 4 again. It is assumed that the computer device 48 is a computer device having a security vulnerability, ie a vulnerable device. The isolation management module is built as an independent computer device, namely the computer device 50 .

First, the quarantine management module 50 will refer to the vulnerable device list to find out the vulnerable device 48 in the computer device. Then, the isolation management module 50 isolates the found vulnerable device 48 according to the vulnerable device list. The isolation function is achieved by utilizing existing hubs 42 or routers 44 in the network system.

Afterwards, when the security weakness is eliminated, the quarantine management module 50 releases the quarantine of the vulnerable device 48 according to the vulnerable device list. Elimination of security vulnerabilities can be achieved by installing fixes or virus removal programs. The vulnerable device 48 can resume normal functioning.

To sum up, the present invention uses the isolation management module to cooperate with computer devices with isolation function in the network system to isolate computer devices that may be invaded by computer viruses or malicious programs. The isolation management module can be built in any computer device in the network system or implemented as an independent computer device, without adding additional burden to the network system, and achieves the purpose of the present invention. In particular, the present invention is particularly effective when the number of computer devices connected to the network system is large and the security weaknesses are difficult to predict completely.

Although the present invention has been disclosed above with preferred embodiments, it is not intended to limit the present invention. Anyone skilled in the art can make some changes and modifications without departing from the spirit and scope of the present invention. Therefore, this The scope of protection of the invention shall be defined by the scope of the appended patent application.

Claims (7)

1. realize the method for the network virus prevention with isolation method for one kind, it is applicable to a network system, and above-mentioned network system links at least one computer installation and has one isolates administration module, comprises the following steps:

At least one weakness device in above-mentioned at least one computer installation is found out in the tabulation of above-mentioned isolation management module references one weakness device, the tabulation of above-mentioned weakness device comprises that at least one security vulnerabilities that above-mentioned at least one weakness device and each above-mentioned at least one weakness device are had, wherein above-mentioned at least one security vulnerabilities are meant in above-mentioned at least one weakness device the part that may be invaded by malignant program; And

Above-mentioned isolation administration module is tabulated according to above-mentioned weakness device, to isolate above-mentioned at least one weakness device.

2. the method that realizes the network virus prevention with isolation method as claimed in claim 1, wherein, the step of the above-mentioned at least one weakness device of above-mentioned isolation still comprises when getting rid of above-mentioned at least one security vulnerabilities, above-mentioned isolation administration module is tabulated according to above-mentioned weakness device, removes the isolation of above-mentioned at least one weakness device.

3. the method with the isolation method realization network virus prevention as claimed in claim 2, wherein, the above-mentioned at least one security vulnerabilities of above-mentioned eliminating is meant a revision program or the virus sweep program of installing.

4. the method with the isolation method realization network virus prevention as claimed in claim 1, wherein, above-mentioned isolation administration module is to place above-mentioned at least one computer installation, or for being linked to a computer installation of above-mentioned network system.

5. realize comprising the system of the network virus prevention with isolation method for one kind:

One network system, above-mentioned network system comprises at least one computer installation; And

One isolates administration module, it is coupled to above-mentioned network system, comprise the weakness device tabulation of at least one security vulnerabilities that at least one weakness device and each above-mentioned at least one weakness device are had in order to reference one, find out at least one weakness device in above-mentioned at least one computer installation, and according to above-mentioned weakness device tabulation, isolate above-mentioned at least one weakness device, when getting rid of above-mentioned at least one security vulnerabilities, according to above-mentioned weakness device tabulation, remove the isolation of above-mentioned at least one weakness device, wherein above-mentioned at least one security vulnerabilities is meant in above-mentioned at least one weakness device the part that may be invaded by malignant program.

6. the system with the isolation method realization network virus prevention as claimed in claim 5, wherein, the above-mentioned at least one security vulnerabilities of above-mentioned eliminating is meant a revision program or the virus sweep program of installing.

7. the system with the isolation method realization network virus prevention as claimed in claim 6, wherein, above-mentioned isolation administration module is to place above-mentioned at least one computer installation, or for being linked to a computer installation of above-mentioned network system.