Method and system for monitoring threat behaviors in virtual network

Abstract

The embodiment of the invention provides a method and a system for monitoring threat behaviors in a virtual network. The method comprises: acquiring a tenant normal behavior request, and constructinga credible level calling model based on the normal behavior request; collecting actual behavior requests of the tenants, and if it is monitored that the tenants carry out virtual network management configuration operation, generating an actual call process model through a behavior tracing mode based on the collected actual behavior request information; and matching the actual call process model with the trusted level call model to obtain a behavior matching result, judging whether the actual behavior request is a malicious attack behavior or not according to the matching result, and feeding back the matching result to the tenant. According to the embodiment of the invention, by adopting a behavior tracing and monitoring method for internal security threats and combining behavior matching,on the basis of a credible hierarchical association model, an actual behavior is compared with a credible behavior model, and feedback is realized, so that internal security risk monitoring is realized, and the security of a virtual network in a cloud environment is ensured.

Description

technical field [0001] The invention relates to the technical field of cloud computing security, in particular to a method and system for monitoring threat behaviors inside a virtual network. Background technique [0002] Cloud computing has become one of the current research hotspots in the information field. By introducing a virtual layer between system software and hardware, it shields the dynamics, distribution, and heterogeneity of the hardware platform, and realizes the effective aggregation and reuse of underlying IT resources. , and provide dynamic, scalable large-scale computing and storage services to remote computer users in a simple and transparent manner. [0003] However, because the user's available resources are placed in the cloud service provider, the user has limited management rights to the virtual machine used by the user, including storage, computing, and network. In this scenario, malicious insiders in the cloud service provider Maliciously modifying ...

AI Technical Summary

Problems solved by technology

[0004] Embodiments of the present invention provide a monitoring method and system for virtual network internal threat behaviors, which are used to solve the phenomenon that in the prior art, it is impossible to accurately identify malicious internal threats in the cloud service environment, resulting in damage to virtual network resources.

Images