White list based realization method for active defense of cloud host

Abstract

The invention discloses a white list based realization method for active defense of a cloud host. The method involves a centralized management platform of a server and a client, and the client is mounted on each cloud host needed to be protected. The specific realization process is as follows: all binary files in the protected cloud host are scanned through server software; a cloud security center identifies out trust ratings of the scanned files and adds a graded file list library into a white list library, a black list library and a gray list library separately; and at the client, only trusted application programs in a white list are allowed to run for preventing loading of a dynamic-link library file in a kernel. Compared with the prior art, the white list based realization method for active defense of the cloud host can completely prevent potential unwanted application programs and codes and prevent advanced threats, is free of feature code update, and can consistently enable known good software, prevent known or unknown bad software, correctly manage new software and effectively prevent unknown malicious software and zero-day attacks.

Description

technical field [0001] The invention relates to the technical field of computer security, in particular to a highly practical whitelist-based cloud host active defense implementation method. Background technique [0002] Driven by new-generation IT technologies such as cloud computing and big data, enterprises are developing more efficiently and intelligently, but information security issues are becoming more and more serious. The cloud host composed of physical server farms and virtual computing software is an important component of IaaS. It not only faces traditional attacks such as server firmware, hardware, OS, and applications, but also faces virtual VMM tampering, GuestOS image tampering, host tenant attacks, etc. New type of threat. [0003] Passive protection measures based on blocking and killing are hard to guard against in the face of the new information security situation. Traditional network security, terminal security, and border security solutions can no long...

AI Technical Summary

Problems solved by technology

[0003] Passive protection measures based on blocking and killing are hard to guard against in the face of the new information security situation. Traditional network security, terminal security, and border security solutions can no longer meet the security needs of cloud data centers.

Traditional blacklist defense software can only identify known malware and attacks. For the mixed threats of current viruses, worms, intrusions and other threats, the whitelist-based cloud host intrusion prevention system will undoubtedly provide more critical resources. active defense

Images