A real-time detection system and method for cloud security incidents based on machine learning

Abstract

The present invention provides a real-time detection method for cloud security events based on machine learning. Based on the rule-based log analysis method, a log analysis method based on rules and machine learning is proposed, which can not only discover security events according to corresponding rules, but also Unknown security events can be detected. Second, use Spark to analyze cloud logs to achieve the effect of real-time analysis, and facilitate expansion, and improve system analysis efficiency and analysis accuracy in various ways, and improve log filtering and analysis efficiency by adding information to the log header. Parsing the log into a unified format facilitates log analysis, stores different types of information in different ways to improve storage efficiency, and improves the accuracy of analysis through sliding windows. Third, it is suitable for cloud environments and can detect malicious behaviors of cloud tenants.

Description

technical field [0001] The present invention relates to the field of cross-cloud resource sharing, and more specifically, to a real-time detection method analysis system and method for cloud security events based on machine learning. Background technique [0002] Cloud computing integrates various hardware and software resources in the Internet through technologies such as virtualization and distribution to provide users with effective services. Cloud computing has good prospects for development, but security issues are the main obstacles hindering the development of cloud computing. The characteristics of cloud computing, such as multi-tenant and convenient access, cause cloud computing to face more serious security problems, such as (1). Threats from within the cloud service provider. For example, there are malicious cloud platform administrators who use their own authority to invade the accounts of cloud tenants, resulting in the theft of user privacy. (2). From externa...

AI Technical Summary

Problems solved by technology

[0004] The following problems exist in cloud computing environment log analysis: (1). There are various attack modes in the cloud environment, and the attack methods are easy to hide. For the current common rule-based log analysis system, it is impossible to detect unknown and new attack types

(2). There are many instances in the cloud environment, the generated log data is large, the total category is diverse, and the value density is characterized. How to analyze cloud logs effectively in real time is a challenging task.

Images