System and method for controlling and executing anomaly commands in multi-network environment

A system for controlling and executing an anomaly command in a multi-network environment, comprising:

• a plurality of networks each including a subnet, the subnet including a bastion worker and a plurality of instances connected with the bastion worker;
• and
• a user network including a bastion host for a user to access bastion workers of the plurality of networks,
• wherein the bastion host includes a bastion Equipment Account Management System (EAMS) configured to transmit a request to connect to a target instance among the plurality of instances and includes anomaly command patterns for determining whether a command input by the user is an anomaly command;
• and a bastion manager configured to search for and find a bastion worker connected with the target instance in response to the request to connect to the target instance from the bastion EAMS, and access the found bastion worker, wherein the accessed bastion worker is configured to determine whether the command input by the user to the target instance is the anomaly command, and notify the user, through the bastion manager, of a procedure for approving an execution of the anomaly command, based on a level of the anomaly command being one of levels, which are classified in advance by the anomaly command patterns, and
• wherein the procedure varies depending on the level of the anomaly command.

A non-transitory computer-readable recording medium storing computer program, the computer program being executable by at least one processor to perform:

• accessing, through a bastion host, one of a plurality of bastion workers, located in subnets of multiple networks and connecting to a target instance that is connected with the accessed bastion worker;
• extracting a command, which is input by a user to the target instance through the accessed bastion worker;
• comparing the extracted command with anomaly command patterns stored in the bastion host, and determining whether the extracted command is an anomaly command based on a result of the comparing;
• based on the extracted command being determined to be an anomaly command, determining whether the execution of the anomaly command is permitted in the target instance;
• based on the execution of the anomaly command not being permitted, notifying the user through the bastion host that the execution of the anomaly command is blocked;
• and
• notifying the user of a procedure for approving the execution of the anomaly command based on a level of the anomaly command being one of levels, which are classified in advance based on the anomaly command patterns, and either executing or blocking the command input by the user, wherein the procedure is determined differently depending on the level of the anomaly command.