Cloud security event real-time detection system and method based on machine learning

Abstract

The invention provides a cloud security event real-time detection method based on machine learning, and provides a log analysis method based on rules and machine learning on the basis of a log analysis method based on rules, so that security events can be discovered according to the corresponding rules, and unknown security events can be detected. The method comprises the following steps of analyzing a cloud log by adopting Spark to achieve real-time analysis effect, convenient extension, improving system analysis efficiency and analysis accuracy through multiple modes, improving log filteringand analysis efficiency by adding information to the head of the log, facilitating log analysis by transforming the log into a unified format, storing different types of information according to different modes to improve storage efficiency, and improving analysis accuracy through a sliding window. Thirdly, the method is suitable for a cloud environment and can detect malicious behaviors of cloudtenants.

Description

technical field [0001] The present invention relates to the field of cross-cloud resource sharing, and more specifically, to a real-time detection method analysis system and method for cloud security events based on machine learning. Background technique [0002] Cloud computing integrates various hardware and software resources in the Internet through technologies such as virtualization and distribution to provide users with effective services. Cloud computing has good prospects for development, but security issues are the main obstacles hindering the development of cloud computing. The characteristics of cloud computing, such as multi-tenant and convenient access, cause cloud computing to face more serious security problems, such as (1). Threats from within the cloud service provider. For example, there are malicious cloud platform administrators who use their own authority to invade the accounts of cloud tenants, resulting in the theft of user privacy. (2). From externa...

AI Technical Summary

Problems solved by technology

[0004] The following problems exist in cloud computing environment log analysis: (1). There are various attack modes in the cloud environment, and the attack methods are easy to hide. For the current common rule-based log analysis system, it is impossible to detect unknown and new attack types

(2). There are many instances in the cloud environment, the generated log data is large, the total category is diverse, and the value density is characterized. How to analyze cloud logs effectively in real time is a challenging task.

Images