Risk management system and method based on multi-source data perception

Abstract

The invention discloses a risk management system and method based on multi-source data perception, and relates to the technical field of cloud computing security, and the method comprises the steps: collecting historical multi-source data of a cloud host; constructing a cloud host risk portrait based on historical multi-source data of the cloud host; the method comprises the following steps: dividing a cloud host network into a plurality of security domains according to service functions and security requirements, and configuring a basic access control strategy; sensing the resource use condition of the cloud host in real time, and identifying the current service state of the cloud host in combination with the service log; and matching a preset security policy according to the current service state of the cloud host and the risk portrait of the cloud host, and dynamically adjusting a network segmentation policy and an access control policy in a security domain based on a micro-isolation technology. According to the method, a micro-isolation technology is used, a network segmentation strategy and an access control strategy in a security domain are dynamically adjusted according to the real-time service state and the risk portrait of the cloud host, and the security and the stability of the cloud host in different service scenes are improved.

Description

Technical Field

[0001] The present invention relates to the field of cloud computing security technology, and in particular to a risk management system and method based on multi-source data perception. Background Art

[0002] In the cloud computing environment, cloud hosts, as key infrastructure for carrying various businesses, face complex and ever-changing security threats. With the widespread application of cloud computing technology, the amount of data on cloud hosts continues to increase, the types of business are becoming more and more diverse, and the difficulty of security management is also increasing.

[0003] Traditional cloud host security management methods often rely on a single data source or simple rule settings. For example, only regular vulnerability scanning to discover security vulnerabilities is difficult to respond to the ever-changing network attack methods and abnormal user behaviors in real time. At the same time, the security domain division and access control policies of cloud hosts are usually statically configured and cannot be dynamically adjusted according to the real-time business status and risk status of the cloud host.

[0004] Traditional methods cannot reasonably allocate security resources during peak and off-peak periods, which may lead to attacks during peak periods due to insufficient security protection, or waste of security resources during off-peak periods. In addition, the management of security policies lacks an effective update mechanism and refined classification management, making it difficult to adapt to new security threats and changes in business needs. Summary of the invention

[0005] The purpose of the present invention is to provide a risk management system and method based on multi-source data perception to solve the problems raised in the prior art.

[0006] To achieve the above object, the present invention provides the following technical solution: a risk management method based on multi-source data perception, the method comprising: Collect historical multi-source data of cloud hosts; the historical multi-source data includes historical vulnerability scan records of cloud hosts, intrusion detection logs, security incident reports, network traffic data and user behavior logs; Building a cloud host risk profile based on the cloud host historical multi-source data, wherein the host risk profile includes security vulnerability information, network attack trends, and user behavior anomalies; Divide the cloud host network into multiple security domains according to business functions and security requirements, and configure basic access control policies; the basic access control policies include configuring initial firewall rules, intrusion detection policies, and access control lists; Real-time perception of cloud host resource usage, and combined with business logs, identification of the current business status of the cloud host; According to the current business status of the cloud host and the risk profile of the cloud host, the preset security policy is matched, and the network segmentation policy and the access control policy within the security domain are dynamically adjusted based on the micro-isolation technology.

[0007] According to the above scheme, the vulnerability scanning record includes recording the type, severity and repair status of the vulnerability found on the cloud host; The intrusion detection log includes recording the network attack behavior information suffered by the cloud host, and the network attack behavior information includes the attack type, attack source, attack frequency and attack target; The security incident report includes recording the security incident information that occurred on the cloud host, and the security incident information includes the event type, impact scope and disposal results; The network traffic data includes recording the network traffic information of the cloud host, and the network traffic information includes traffic size, protocol type, source IP address and destination IP address; The user behavior log includes a record of the user's operation behavior on the cloud host, and the operation behavior includes login time, operation commands and access resources.

[0008] According to the above scheme, the construction of cloud host risk profile includes: Preprocessing the cloud host historical multi-source data, the preprocessing includes data cleaning, data standardization and data association; the data cleaning includes processing missing values, removing duplicate values ​​and correcting abnormal values; the data standardization, for numerical fields, uses a standardization method to convert the data into a unified scale; for categorical fields, it converts them into numerical data; the data association, analyzes the association relationship between different data sources in the cloud host historical multi-source data, and uses an association query statement or a data processing tool to perform data association according to the determined association relationship; Perform feature extraction based on the preprocessed historical multi-source data of the cloud host; Based on the feature extraction, risk indicators are defined, wherein the risk indicators include vulnerability risk indicators, attack risk indicators, event risk indicators, traffic risk indicators, and user behavior risk indicators; The vulnerability risk index assigns a risk score to each vulnerability based on the vulnerability type, severity and repair status, and screens out vulnerabilities with risk scores higher than the threshold to form a list of high-risk vulnerabilities; the attack risk index assigns a risk score to each attack event based on the attack type, attack source, attack frequency and attack target, and analyzes the time series data of the attack event to determine whether the attack trend is rising, falling or stable, and at the same time counts the IP address and geographical location of the attack source to analyze the distribution of the attack source; the event risk index assigns a risk score to each security event based on the type, impact range and disposal result of the security event, and counts the frequency of occurrence of different types of security events, and analyzes the high-incidence types and time periods; the traffic risk index determines whether the traffic is abnormal based on the size of the network traffic, protocol type, source IP address and destination IP address, and analyzes the time series data of the network traffic to determine whether the traffic trend is rising, falling or stable; the user behavior risk index determines whether the user behavior is abnormal based on the user's login time, operation command and access resource, identifies abnormal patterns, and screens out users with behavior risk scores higher than the threshold to form a list of high-risk users; A risk scoring model is constructed using a machine learning algorithm, with the extracted features as input and the risk indicators as output, and the risk scoring model is trained using the historical multi-source data; the parameters of the machine learning algorithm are tuned using a cross-validation method, and the optimal parameter combination is selected to improve the performance of the risk scoring model; Based on the risk indicator scores of the risk scoring model, a cloud host risk profile is generated.

[0009] According to the above scheme, the security vulnerability information quantitatively evaluates the security vulnerabilities and potential risks existing on the cloud host; the security vulnerability information includes vulnerability risk scores, a list of high-risk vulnerabilities, and the proportion of unrepaired vulnerabilities; The network attack situation analyzes the trend of network attacks suffered by the cloud host and identifies potential attack threats; the network attack situation includes attack risk scoring, attack trend analysis and attack source distribution; The user behavior anomaly identifies abnormal patterns in user operation behavior, and the abnormal patterns include abnormal login, sensitive file access and suspicious command execution; the user behavior anomaly includes behavior risk score, abnormal behavior pattern and high-risk user list.

[0010] According to the above scheme, the firewall rules control the network traffic between different security domains; the intrusion detection strategy detects and defends against network attacks against security domains; and the access control list controls the user's access rights to resources within the security domain.

[0011] According to the above scheme, the business status includes business peak period, business off-peak period and maintenance period; during the business peak period, the cloud host resource utilization rate is high and the business access volume is large; during the business off-peak period, the cloud host resource utilization rate is low and the business access volume is small; during the maintenance period, the cloud host is in maintenance status and performs system upgrades and vulnerability repair operations.

[0012] According to the above solution, matching the preset security policy according to the current business status of the cloud host and the risk profile of the cloud host includes: The preset security policy is stored in a security policy library; The security policy library is classified according to different business states and cloud host risk profiles; the different business states include business peak period, business off-peak period and maintenance period; the different cloud host risk profiles include vulnerability risk, attack risk and abnormal user behavior; The security policy includes policy name, applicable scenarios, policy rules, execution conditions, execution actions and priority; the policy name uniquely identifies the name of the policy; the applicable scenarios are the business status and risk profiles to which the security policy applies; the policy rules are used to design specific access control rules, firewall rules and intrusion detection rules; the execution conditions define the conditions under which the security policy is triggered; the execution actions clarify the specific actions executed by the security policy; the priority is used to assign priorities to security policies and is used to determine the execution order when multiple policies conflict; Building an initial security policy library based on the historical multi-source data of the cloud host; Verify the effectiveness and feasibility of security policies through simulation tests and actual applications; verification indicators include security risk mitigation effects, business traffic impact, and resource utilization; optimize policy rules and execution conditions based on verification results; The verified security policies are included in the security policy library and assigned unique policy names and version numbers; the version number records the creation time, modification time and modification content of the security policy; the security policy library retains historical versions for tracing back to previous versions; According to the current business status of the cloud host and the risk profile of the cloud host, the security policy is matched based on the security policy library; when multiple security policies are matched at the same time, the execution order is determined according to the priority of the security policies; Based on the comprehensive analysis results of business status and risk profile, security policies are dynamically adjusted to ensure the security and controllability of network traffic.

[0013] According to the above scheme, the security policy library is updated according to the business status and cloud host risk profile; the updated security policy library includes adding new policies, modifying policies and deleting policies; the new policies are used to design new security policies for new security threats and business needs; the modified policies are used to optimize the rules and execution conditions of existing security policies based on feedback from actual applications; the deleted policies are used to delete security policies that are no longer applicable; During the security policy execution process, auditing and management are performed; the auditing includes monitoring whether the security policy is triggered and executed as expected, whether the security policy mitigates security risks, and whether the security policy affects business traffic; the management includes strict control of access to the security policy library, and only authorized personnel can view and modify security policies.

[0014] According to the above solution, the network segmentation strategy and access control strategy within the security domain are dynamically adjusted based on the micro-isolation technology, including: Through micro-isolation technology, the cloud host network is divided into multiple fine-grained security domains, and the resources in each security domain are isolated from each other; Real-time monitoring of cloud host security event reports, network traffic data, and user behavior logs; Analyze the effectiveness of the current network segmentation strategy based on the cloud host risk profile and business status; Generate new network segmentation strategies based on the real-time risk profile and business status of the cloud host, and dynamically adjust the access control policies between security domains using micro-isolation technology; The micro-isolation technology monitors traffic across security domains in real time, identifies and blocks abnormal traffic, and ensures that resource access within each security domain complies with preset security policies; Dynamically adjust security domain division and access control policies according to changes in business needs and security risks to ensure secure and controllable network traffic; When an attack is detected, the security domain division is dynamically adjusted to isolate the attacked resources into independent security domains; when business needs change, the access control policy is dynamically adjusted to ensure smooth traffic for new businesses.

[0015] A risk management system based on multi-source data perception, the system comprising: a data management module, a risk profiling module, a security domain management module, a security policy management module and a visualization module; The data management module includes a data acquisition module and a data preprocessing module; the data acquisition module is used to collect historical multi-source data of the cloud host, the historical multi-source data of the cloud host includes vulnerability scanning records, intrusion detection logs, security incident reports, network traffic data and user behavior logs, and collects resource usage and business logs of the cloud host in real time; the data preprocessing module cleans, standardizes and associates the collected multi-source data; The risk profile module includes a risk scoring module and a risk profile building module; the risk scoring module, based on the data management module, uses a machine learning algorithm to build a risk scoring model; the risk profile building module, based on the risk scoring module, generates a cloud host risk profile and updates the cloud host risk profile in real time, wherein the cloud host risk profile includes security vulnerability information, network attack trends and user behavior anomalies; The security domain management module includes a security domain division module and an access control module; the security domain division module uses micro-isolation technology to achieve fine-grained security domain division, identifies and blocks abnormal traffic by real-time monitoring of traffic across security domains, and dynamically optimizes the division of security domains according to changes in business needs and security risks; the access control module dynamically adjusts the access control policy based on the security domain division module, and monitors resource usage and traffic changes within the security domain in real time to ensure the security of resource access; The security policy management module includes a security policy library and a security policy matching module; the security policy library is used to store and manage preset security policies, complete the classification, version control and update of security policies; the security policy matching module matches applicable security policies based on the security policy library according to the business status and risk profile; The visualization module includes a data visualization module, an alarm module and a report generation module; the data visualization module is used to provide a visualized cloud host risk profile, business status and security policy execution effect; the alarm module generates an alarm in real time and notifies the user when a high-risk event is detected; the report generation module generates a risk management report.

[0016] Compared with the prior art, the present invention has the following beneficial effects: 1. The present invention utilizes comprehensive analysis and processing of multi-source data to improve the accuracy and reliability of risk assessment; 2. The present invention uses micro-isolation technology to dynamically adjust the network segmentation strategy and access control strategy within the security domain according to the real-time business status and risk profile of the cloud host, thereby improving the security and stability of the cloud host in different business scenarios; 3. The present invention builds a security policy library to quickly respond to changes in security threats and business needs, thereby improving the execution efficiency and adaptability of security policies. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] Figure 1 A flowchart of the steps of a risk management method based on multi-source data perception according to the present invention; Figure 2 This is a schematic diagram of the structure of a risk management system based on multi-source data perception according to the present invention. DETAILED DESCRIPTION

[0018] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0019] Example: Figure 1-Figure 2 As shown, the present invention provides a technical solution, a risk management method based on multi-source data perception, the method comprising: S1. Collect historical multi-source data of cloud hosts; the historical multi-source data includes historical vulnerability scan records of cloud hosts, intrusion detection logs, security incident reports, network traffic data and user behavior logs; Specifically, the vulnerability scanning record includes recording the type, severity and repair status of the vulnerabilities found on the cloud host; the intrusion detection log includes recording the network attack behavior information suffered by the cloud host, and the network attack behavior information includes the attack type, attack source, attack frequency and attack target; the security incident report includes recording the security incidents occurring in the cloud host, and the security incidents include the event type, impact scope and disposal results; the network traffic data includes recording the network traffic information of the cloud host, and the network traffic information includes the traffic size, protocol type, source IP address and destination IP address; the user behavior log includes recording the user's operation behavior on the cloud host, and the operation behavior includes login time, operation commands and access resources.

[0020] S2. Building a cloud host risk profile based on the cloud host historical multi-source data, wherein the host risk profile includes security vulnerability information, network attack trends, and user behavior anomalies; Specifically, the cloud host historical multi-source data is preprocessed, and the preprocessing includes data cleaning, data standardization and data association; the data cleaning includes processing missing values, removing duplicate values ​​and correcting abnormal values, for example: filling missing values ​​with average values, deleting duplicate logs, and correcting negative values ​​such as traffic data; the data standardization, for numerical fields, uses a standardized method to convert the data into a unified scale, for example: Z-score standardization is used for numerical fields, and One-Hot encoding is used for categorical fields; for categorical fields, it is converted into numerical data; the data association, analyzes the association relationship between different data sources in the cloud host historical multi-source data, and uses an association query statement or data processing tool to perform data association according to the determined association relationship; for example: the association between vulnerability scanning records and security incident reports; this is only an example for illustration and is not limited; Further, based on the pre-processed historical multi-source data of the cloud host, feature extraction is performed; for example: extracting features from vulnerability scanning records: vulnerability type, severity, and repair status; extracting features from intrusion detection logs: attack type, attack source, attack frequency, and attack target; extracting features from security incident reports: event type, impact scope, and disposal results; extracting features from network traffic data: traffic size, protocol type, source IP address, and destination IP address; extracting features from user behavior logs: login time, operation commands, and access resources; Further, based on the feature extraction, risk indicators are defined, and the risk indicators include vulnerability risk indicators, attack risk indicators, event risk indicators, traffic risk indicators, and user behavior risk indicators; the vulnerability risk indicators assign a risk score to each vulnerability based on the vulnerability type, severity, and repair status, and screen out vulnerabilities with risk scores higher than a threshold to form a high-risk vulnerability list; the attack risk indicators assign a risk score to each attack event based on the attack type, attack source, attack frequency, and attack target, and analyze the time series data of the attack event to determine whether the attack trend is rising, falling, or stable, and at the same time count the IP address and geographic location of the attack source to analyze the attack source. The distribution of sources; the event risk index, based on the type, impact scope and disposal results of the security event, assigns a risk score to each security event, and counts the frequency of occurrence of different types of security events, and analyzes the high-incidence types and time periods; the traffic risk index, based on the size of network traffic, protocol type, source IP address and destination IP address, determines whether the traffic is abnormal, and analyzes the time series data of network traffic to determine whether the traffic trend is rising, falling or stable; the user behavior risk index, based on the user's login time, operation command and access resources, determines whether the user behavior is abnormal, identifies abnormal patterns, and screens out users with behavior risk scores higher than the threshold to form a high-risk user list; Further, a risk scoring model is constructed using a machine learning algorithm, the extracted features are used as input, the risk indicators are used as output, and the risk scoring model is trained using the historical multi-source data; the parameters of the machine learning algorithm are tuned using a cross-validation method, the optimal parameter combination is selected, and the performance of the risk scoring model is improved; Furthermore, based on the risk indicator scoring of the risk scoring model, a cloud host risk portrait is generated, and the host risk portrait includes security vulnerability information, network attack trends and user behavior anomalies; for example: based on attack data, an attack risk indicator is defined, a risk score of 90 / 100 is assigned, and the attack trend is analyzed: the attack frequency increases, and a risk portrait is generated, showing that the current network attack trend is high risk; the security vulnerability information quantitatively evaluates the security vulnerabilities and potential risks existing on the cloud host; the security vulnerability information includes a vulnerability risk score, a list of high-risk vulnerabilities and the proportion of unfixed vulnerabilities; the network attack trend analyzes the network attack trend suffered by the cloud host and identifies potential attack threats; the network attack trend includes an attack risk score, an attack trend analysis and an attack source distribution; the user behavior anomaly identifies abnormal patterns in user operation behavior, and the abnormal patterns include abnormal login, sensitive file access and suspicious command execution; the user behavior anomaly includes a behavioral risk score, an abnormal behavior pattern and a high-risk user list.

[0021] S3. Divide the cloud host network into multiple security domains according to business functions and security requirements, and configure basic access control policies; the basic access control policies include configuring initial firewall rules, intrusion detection policies, and access control lists; Specifically, for example: the cloud host network is divided into x security domains, x is a positive integer, where security domain A contains critical business resources, such as database servers, and security domain B contains non-critical business resources, such as test servers; the firewall rules control the network traffic between different security domains; the intrusion detection strategy detects and defends against network attacks against security domains; the access control list controls the user's access rights to resources within the security domain.

[0022] S4, real-time perception of cloud host resource usage, and combined with business logs, identification of the current business status of the cloud host; Specifically, the business status includes business peak period, business off-peak period and maintenance period; during the business peak period, the cloud host resource utilization rate is high and the business access volume is large; during the business off-peak period, the cloud host resource utilization rate is low and the business access volume is small; during the maintenance period, the cloud host is in maintenance status and performs system upgrades and vulnerability repair operations.

[0023] S5. Matching a preset security policy according to the current business status of the cloud host and the risk profile of the cloud host; Specifically, the preset security policies are stored in a security policy library; the security policy library is classified according to different business states and cloud host risk profiles; the different business states include business peak period, business off-peak period and maintenance period; the classification according to different cloud host risk profiles includes vulnerability risk, attack risk and user behavior abnormality; the security policy includes policy name, applicable scenario, policy rules, execution conditions, execution actions and priority; the policy name uniquely identifies the name of the policy; the applicable scenario refers to the business state and risk profile to which the security policy applies; the policy rules design specific access control rules, firewall rules and intrusion detection rules; the execution conditions define the conditions for triggering the security policy; the execution action clarifies the specific actions for executing the security policy; the priority assigns priority to the security policy, which is used to determine the execution order when multiple policies conflict; Further, based on the historical multi-source data of the cloud host, an initial security policy library is constructed; for example: business peak period strategy: strengthen intrusion detection and limit non-critical business traffic; business off-peak period strategy: perform vulnerability scanning and repair, and optimize security strategy; maintenance period strategy: limit external access and perform security reinforcement; this is only an example for illustration and is not restrictive; Furthermore, the effectiveness and feasibility of the security strategy are verified through simulation tests and actual applications; the verification indicators include security risk mitigation effect, business traffic impact and resource utilization; for example: security risk mitigation effect: attack interception rate: 95%, vulnerability repair rate: 90%; business traffic impact: delay less than 100ms, throughput greater than 1Gbps; resource utilization: CPU utilization less than 80%, memory utilization less than 70%; according to the verification results, the rules and execution conditions of the strategy are optimized; the security strategy that has passed the verification is included in the security policy library and assigned a unique policy name and version number; the version number records the creation time, modification time and modification content of the security policy; the security policy library retains historical versions for tracing back to previous versions; Further, according to the current business status of the cloud host and the risk profile of the cloud host, the security policy is matched based on the security policy library. For example, if the current business status is at the peak of business and the risk profile of the cloud host is a high attack risk, the applicable security policy is to strengthen intrusion detection and limit non-critical business traffic. When multiple security policies are matched at the same time, the execution order is determined according to the priority of the security policies, for example, the attack defense policy is executed first. Furthermore, based on the comprehensive analysis results of business status and risk profile, security policies are dynamically adjusted to ensure the security and controllability of network traffic; Furthermore, the security policy library is updated according to the business status and cloud host risk profile; for example: during business peak periods, the cloud host risk profile shows the existence of high-risk vulnerabilities, and the security policy is updated to prioritize the repair of high-risk vulnerabilities, restrict access rights to affected resources, strengthen intrusion detection and access control, ensure smooth traffic for critical businesses, restrict non-critical business traffic, and reduce potential attack surfaces; the updated security policy library includes adding new policies, modifying policies, and deleting policies; the new policies are designed to target new security threats and business needs; the modified policies are optimized based on feedback from actual applications. The deleted policies delete policies that are no longer applicable; during the execution of security policies, auditing and management are performed; the audit includes monitoring whether the security policies are triggered and executed as expected, whether the security policies mitigate security risks, and whether the security policies have an impact on business traffic; the management includes strict control over access to the security policy library, and only authorized personnel can view and modify security policies.

[0024] S6. Dynamically adjust network segmentation strategies and access control strategies within security domains based on micro-isolation technology; Specifically, through micro-isolation technology, the cloud host network is divided into multiple fine-grained security domains, and the resources in each security domain are isolated from each other; the cloud host's security event report, network traffic data and user behavior logs are monitored in real time; the effectiveness of the current network segmentation strategy is analyzed in combination with the cloud host's risk profile and business status; a new network segmentation strategy is generated based on the cloud host's real-time risk profile and business status, and the access control strategy between security domains is dynamically adjusted using micro-isolation technology; the micro-isolation technology monitors the traffic across security domains in real time, identifies and blocks abnormal traffic, and ensures that resource access in each security domain complies with the preset security policy; according to changes in business needs and security risks, the division of security domains and access control strategies are dynamically adjusted to ensure that network traffic is safe and controllable; Furthermore, when an attack is detected, the division of security domains is dynamically adjusted to isolate the attacked resources into independent security domains, for example, isolating the attacked Web server into security domain C; when business needs change, the access control policy is dynamically adjusted to ensure smooth traffic for new businesses, for example, allocating higher bandwidth priority to new businesses.

[0025] The present invention provides another technical solution. When a cloud host detects a high-frequency DDoS attack during a business peak, the specific processing process is as follows: According to the real-time intrusion detection log and network traffic data, it was found that the attack type was a DDoS attack, the attack source was 192.168.1.x, where x was a positive integer, the attack frequency was 100 times per minute, the attack target was the Web server, the traffic size increased from the normal 100Mbps to 1Gbps, the protocol type was UDP protocol, and the destination IP address was 192.168.1.y, where y was a positive integer; the intrusion detection log and network traffic data were cleaned, standardized, and associated; Extract features from intrusion detection logs: attack type is DDoS attack, attack source is 192.168.1.x, attack frequency is 100 times per minute, and attack target is Web server; Extract features from network traffic data: traffic size is 1 Gbps, protocol type is UDP, source IP address is 192.168.1.x, and destination IP address is 192.168.1.y; Attack risk indicators: Based on the attack type, attack source, attack frequency and attack target, the attack event is assigned a risk score of 90 / 100; analyzing the time series data of the attack event, it is found that the attack frequency is on an upward trend, such as from 50 times per minute to 100 times per minute; Traffic risk indicators: Determine traffic anomalies based on traffic size, protocol type, source IP address, and destination IP address; analyze network traffic time series data and find that traffic trends are on the rise; Based on the results of the risk scoring model, a cloud host risk profile is generated, and the cloud host risk profile shows that the current network attack situation is high risk.

[0026] Considering that the current business status is at its peak and the cloud host risk profile is high attack risk, the following security policies are matched from the security policy library: Strengthen intrusion detection: Improve the sensitivity of the intrusion detection system and add detection rules for DDoS attacks; Limit non-critical business traffic: Limit the bandwidth of non-critical businesses to ensure smooth traffic for critical businesses.

[0027] If two security policies are matched at the same time, the enhanced intrusion detection policy is executed first according to the priority, and a new DDoS attack detection rule is added to monitor the traffic from 192.168.1.x in real time. Firewall rules are configured to block all traffic from 192.168.1.x. Then, the traffic of non-critical services is restricted. The traffic control policy is configured in the network equipment to limit the bandwidth of non-critical services to 100Mbps, ensuring that the bandwidth of critical services has the highest priority. This is just an example and is not a limitation. Through micro-isolation technology, the attacked Web server (192.168.1.y) is isolated to an independent security domain (security domain C) to ensure that the attack does not spread to other resources. Strict access control policies are configured in security domain C to allow only authorized users to access. Dynamically adjust access control policies based on changes in business needs to ensure smooth traffic for new businesses; add new rules to the firewall to allow traffic from new businesses to pass through while limiting traffic from other non-critical businesses; Monitor the effectiveness of security policy execution, confirm that the attack traffic from 192.168.1.x is successfully blocked, and the delay of key business is less than 100ms; generate a risk management report, record the attack event and processing results, the report includes: Attack type: DDoS attack; Attack source: 192.168.1.x; Processing measures: block attack traffic, limit non-critical business traffic and isolate attacked resources; Processing results: The attack was successfully intercepted, and the delay of key business was less than 100ms.

[0028] The present invention provides another technical solution, a risk management system based on multi-source data perception, the system comprising: a data management module, a risk profiling module, a security domain management module, a security policy management module and a visualization module; The data management module includes a data acquisition module and a data preprocessing module; the data acquisition module is used to collect historical multi-source data of the cloud host, the historical multi-source data of the cloud host includes vulnerability scanning records, intrusion detection logs, security incident reports, network traffic data and user behavior logs, and collects resource usage and business logs of the cloud host in real time; the data preprocessing module cleans, standardizes and associates the collected multi-source data; The risk profile module includes a risk scoring module and a risk profile building module; the risk scoring module, based on the data management module, uses a machine learning algorithm to build a risk scoring model; the risk profile building module, based on the risk scoring module, generates a cloud host risk profile and updates the cloud host risk profile in real time, wherein the cloud host risk profile includes security vulnerability information, network attack trends and user behavior anomalies; The security domain management module includes a security domain division module and an access control module; the security domain division module uses micro-isolation technology to achieve fine-grained security domain division, identifies and blocks abnormal traffic by real-time monitoring of traffic across security domains, and dynamically optimizes the division of security domains according to changes in business needs and security risks; the access control module dynamically adjusts the access control policy based on the security domain division module, and monitors resource usage and traffic changes within the security domain in real time to ensure the security of resource access; The security policy management module includes a security policy library and a security policy matching module; the security policy library is used to store and manage preset security policies, complete the classification, version control and update of security policies; the security policy matching module matches applicable security policies based on the security policy library according to the business status and risk profile; The visualization module includes a data visualization module, an alarm module and a report generation module; the data visualization module is used to provide a visualized cloud host risk profile, business status and security policy execution effect; the alarm module generates an alarm in real time and notifies the user when a high-risk event is detected; the report generation module regularly generates risk management reports.

[0029] It will be apparent to those skilled in the art that the invention is not limited to the details of the exemplary embodiments described above and that the invention can be implemented in other specific forms without departing from the spirit or essential features of the invention. Therefore, the embodiments should be considered exemplary and non-limiting in all respects, and the scope of the invention is defined by the appended claims rather than the foregoing description, and it is intended that all variations falling within the meaning and scope of the equivalent elements of the claims be included in the invention. Any reference numeral in a claim should not be considered as limiting the claim to which it relates.

Claims

1. A risk management method based on multi-source data perception, characterized by: The method includes: Collect historical multi-source data of cloud hosts; the historical multi-source data includes historical vulnerability scan records of cloud hosts, intrusion detection logs, security incident reports, network traffic data and user behavior logs; Building a cloud host risk profile based on the cloud host historical multi-source data, wherein the host risk profile includes security vulnerability information, network attack trends, and user behavior anomalies; Divide the cloud host network into multiple security domains according to business functions and security requirements, and configure basic access control policies; the access control policies include firewall rules, intrusion detection policies and access control lists; Real-time perception of cloud host resource usage, and combined with business logs, identification of the current business status of the cloud host; According to the current business status of the cloud host and the risk profile of the cloud host, the preset security policy is matched, and the network segmentation policy and the access control policy within the security domain are dynamically adjusted based on the micro-isolation technology.

2. The risk management method based on multi-source data perception according to claim 1 is characterized by: The vulnerability scanning record includes recording the type, severity and repair status of the vulnerabilities found on the cloud host; The intrusion detection log includes recording the network attack behavior information suffered by the cloud host, and the network attack behavior information includes the attack type, attack source, attack frequency and attack target; The security incident report includes recording the security incident information that occurred on the cloud host, and the security incident information includes the event type, impact scope and disposal results; The network traffic data includes recording the network traffic information of the cloud host, and the network traffic information includes traffic size, protocol type, source IP address and destination IP address; The user behavior log includes a record of the user's operation behavior on the cloud host, and the operation behavior includes login time, operation commands and access resources.

3. The risk management method based on multi-source data perception according to claim 1 is characterized in that: The cloud host risk profile construction includes: Preprocessing the cloud host historical multi-source data, wherein the preprocessing includes data cleaning, data standardization and data association; Perform feature extraction based on the preprocessed historical multi-source data of the cloud host; Based on the feature extraction, risk indicators are defined, wherein the risk indicators include vulnerability risk indicators, attack risk indicators, event risk indicators, traffic risk indicators, and user behavior risk indicators; constructing a risk scoring model using a machine learning algorithm, taking the extracted features as input and the risk indicators as output, and training the risk scoring model using the historical multi-source data; Based on the results of the trained risk scoring model, a cloud host risk profile is generated.

4. The risk management method based on multi-source data perception according to claim 1 is characterized in that: The security vulnerability information quantitatively evaluates the security vulnerabilities and potential risks existing on the cloud host; the security vulnerability information includes vulnerability risk scores, a list of high-risk vulnerabilities, and the proportion of unrepaired vulnerabilities; The network attack situation analyzes the trend of network attacks suffered by the cloud host and identifies potential attack threats; the network attack situation includes attack risk scoring, attack trend analysis and attack source distribution; The user behavior anomaly identifies abnormal patterns in user operation behavior, and the abnormal patterns include abnormal login, sensitive file access and suspicious command execution; the user behavior anomaly includes behavior risk score, abnormal behavior pattern and high-risk user list.

5. The risk management method based on multi-source data perception according to claim 1 is characterized by: The firewall rules control network traffic between different security domains; The intrusion detection strategy detects and defends against network attacks against the security domain; The access control list controls the user's access rights to resources within the security domain.

6. The risk management method based on multi-source data perception according to claim 1 is characterized by: The business status includes a business peak period, a business off-peak period and a maintenance period.

7. The risk management method based on multi-source data perception according to claim 1 is characterized by: The matching of the preset security policy according to the current business status of the cloud host and the risk profile of the cloud host includes: The preset security policy is stored in a security policy library; The security policy library is classified according to different business states and cloud host risk profiles; the different business states include business peak period, business off-peak period and maintenance period; the different cloud host risk profiles include vulnerability risk, attack risk and abnormal user behavior; The security policy includes policy name, applicable scenarios, policy rules, execution conditions, execution actions and priority; Building an initial security policy library based on the historical multi-source data of the cloud host; Verify the effectiveness and feasibility of security policies through simulation tests and actual applications; add the verified security policies to the security policy library and assign unique policy names and version numbers; the version number records the creation time, modification time and modification content of the security policies; According to the current business status of the cloud host and the risk profile of the cloud host, security policies are matched based on the security policy library; when multiple security policies are matched at the same time, the execution order is determined according to the priority of the security policies.

8. The risk management method based on multi-source data perception according to claim 7 is characterized by: The security policy library is updated according to the business status and cloud host risk profile; the updated security policy library includes adding new policies, modifying policies and deleting policies; the new policies are designed to target new security threats and business needs; the modified policies are optimized according to feedback from actual applications, and the policy rules and execution conditions of existing security policies are optimized; the deleted policies are deleted to delete security policies that are no longer applicable.

9. The risk management method based on multi-source data perception according to claim 1 is characterized by: The method of dynamically adjusting the network segmentation strategy and the access control strategy within the security domain based on the micro-isolation technology includes: Through micro-isolation technology, the cloud host network is divided into multiple fine-grained security domains, and the resources in each security domain are isolated from each other; Real-time monitoring of cloud host security event reports, network traffic data, and user behavior logs; Analyze the effectiveness of the current network segmentation strategy based on the cloud host risk profile and business status; Generate new network segmentation strategies based on the real-time risk profile and business status of the cloud host, and dynamically adjust the access control policies between security domains using micro-isolation technology; By real-time monitoring of traffic across security domains, abnormal traffic can be identified and blocked to ensure that resource access within each security domain complies with the preset security policy. Dynamically adjust security domain division and access control policies according to changes in business needs and security risks to ensure secure and controllable network traffic; When an attack is detected, the security domain division is dynamically adjusted to isolate the attacked resources into independent security domains; when business needs change, the access control policy is dynamically adjusted.

10. A risk management system based on multi-source data perception, applied to a risk management method based on multi-source data perception as claimed in any one of claims 1 to 9, characterized in that: The system includes: data management module, risk profiling module, security domain management module, security policy management module and visualization module; The data management module includes a data acquisition module and a data preprocessing module; the data acquisition module is used to collect historical multi-source data of the cloud host, the historical multi-source data of the cloud host includes vulnerability scanning records, intrusion detection logs, security incident reports, network traffic data and user behavior logs, and collects resource usage and business logs of the cloud host in real time; the data preprocessing module cleans, standardizes and associates the collected multi-source data; The risk profile module includes a risk scoring module and a risk profile building module; the risk scoring module, based on the data management module, uses a machine learning algorithm to build a risk scoring model; the risk profile building module, based on the risk scoring module, generates a cloud host risk profile and updates the cloud host risk profile in real time, wherein the cloud host risk profile includes security vulnerability information, network attack trends and user behavior anomalies; The security domain management module includes a security domain division module and an access control module; the security domain division module uses micro-isolation technology to achieve fine-grained security domain division, identifies and blocks abnormal traffic by real-time monitoring of traffic across security domains, and dynamically optimizes the division of security domains according to changes in business needs and security risks; the access control module dynamically adjusts the access control policy based on the security domain division module, and monitors resource usage and traffic changes within the security domain in real time to ensure the security of resource access; The security policy management module includes a security policy library and a security policy matching module; the security policy library is used to store and manage preset security policies, complete the classification, version control and update of security policies; the security policy matching module matches applicable security policies based on the security policy library according to the business status and risk profile; The visualization module includes a data visualization module, an alarm module and a report generation module; the data visualization module is used to provide a visualized cloud host risk profile, business status and security policy execution effect; the alarm module generates an alarm in real time and notifies the user when a high-risk event is detected; the report generation module generates a risk management report.

Images