Behavior tracing detecting method facing internal threats in IaaS cloud environment

Abstract

The invention discloses a behavior tracing detecting method facing internal threats in an IaaS cloud environment. The method solves the problems in the prior art that in the IaaS cloud environment, cloud service is called maliciously, the source of the internal threats cannot be judged, and unknown threats cannot be handled. The method adopts a detecting idea of behavior tracing to conduct multi-node correlation analysis on the data accessing flow of users in the cloud environment, a normal behavior tree of various legal operations of the users is obtained, behavior tracing matching is conducted on the collected behavior information, and malicious threats are detected by analyzing the integrity of the behavior tree.

Description

technical field [0001] The invention belongs to the technical field of cloud computing security, and in particular relates to a behavior traceability detection method for internal threats under an IaaS cloud environment. This method adopts the detection idea of ​​behavior traceability. In the cloud environment, multi-node correlation analysis is performed on the process of user access to data to obtain the normal behavior tree of various legal operations of the user, and then the behavior traceability is matched with the collected behavior information. Through Integrity analysis of behavior trees detects malicious threats. Background technique [0002] A cloud environment is a resource pool that contains a large number of available virtual computing resources such as hardware, development platforms, and I / O services. It can dynamically create highly virtual resources and provide them to tenants for on-demand billing in the form of services. Existing cloud computing platform...

AI Technical Summary

Problems solved by technology

However, the current security detection methods to deal with internal threats mostly use machine learning and nested virtualization underlying information monitoring technology. Among them, the machine learning method can only collect and classify the characteristics of malicious behaviors that have occurred, and cannot identify unknown threats. The nested virtualization monitoring technology only detects the interface behavior of a single node of the cloud service, and cannot trace the data access behavior of cloud service users across multiple nodes, making it difficult to judge whether the current data access is a legal request issued by the user.

Images