Cloud-based unified threat monitoring system and monitoring platform device

Abstract

A unified cloud-based threat monitoring system includes a controlled cloud device, a threat event forwarding module, and a monitoring platform device. The controlled cloud device includes a cybersecurity threat detection module, used to generate security messages in response to detected security threat events. The threat event forwarding module is used to intercept and forward security messages. The monitoring platform device includes an alarm receiving module, a tenant database, an alarm analysis module, and a notification status module. The alarm receiving module receives security messages. The tenant database stores multiple tenant master files. The alarm analysis module looks up the corresponding tenant master file based on the tenant identifier and performs security actions according to security handling policies and alarm content. The notification status module, when performing security actions, selectively sends a work order creation request or records the security actions in the tenant database.

Claims

1. A unified cloud-based threat monitoring system, comprising: a controlled cloud device providing multiple independent tenant environments, each tenant environment including a security threat detection module for generating a security message in response to the detection of a security threat event; a threat event forwarding module coupled to each security threat detection module for intercepting and forwarding the security message, the security message including a tenant identifier and an alarm content; and a monitoring platform device including: a tenant database for storing multiple tenant master files, each tenant master file having a security handling policy; and an alarm receiving... The system includes: a receiving module, coupled to the controlled cloud device, for receiving the forwarded security message; an alarm analysis module, coupled to the tenant database and the alarm receiving module, for retrieving the corresponding tenant master file from the tenant database based on the tenant identifier in the security message, and performing a security action based on the security handling policy of the corresponding tenant master file and the alarm content in the security message; and a notification status module, coupled to the tenant database and the alarm analysis module, for selectively sending a work order creation request or recording the security action in the tenant database when performing the security action.

2. The cloud-based unified threat monitoring system as described in request item 1, wherein, The notification status module obtains a security score and a security threshold for the security action based on the security processing strategy; in response to the security score reaching the security threshold, the notification status module sends the work order creation request; in response to the security score not reaching the security threshold, the notification status module records the security action in the tenant database.

3. The cloud-based unified threat monitoring system as described in request item 2, wherein, The notification status module is used to obtain a work order number based on the work order creation request and to bind the work order number of the safety action to the alarm content.

4. The cloud-based unified threat monitoring system as described in request item 3, wherein, If the work order number is not obtained in response to the work order creation request, the notification status module performs an exponential backoff retry.

5. The cloud-based unified threat monitoring system as described in request item 4, wherein, The alarm analysis module is used to formalize the safety action to identify at least one event feature, and to obtain the safety score of the safety action based on the at least one event feature.

6. The cloud-based unified threat monitoring system as described in request item 2, wherein, The alert content includes geolocation information, and the alert analysis module uses this geolocation information and the security handling strategy to obtain the security score for the security action.

7. The cloud-based unified threat monitoring system as described in claim 1 further includes an authorization monitoring module for monitoring the authorization validity of the controlled cloud device.

8. The cloud-based unified threat monitoring system as described in request item 7, wherein, When the authorization monitoring module detects an abnormality in the authorization validity of the controlled cloud device, it deletes the tenant master file of the controlled cloud device.

9. The cloud-based unified threat monitoring system as described in request item 1, wherein, The monitoring platform device further includes a security detection configuration module, which scans the activation status of the security threat detection module in each tenant environment, so as to enable the security threat detection module in the tenant environment where it is not enabled, and not to re-enable the security threat detection module in the tenant environment where it is already enabled.

10. A monitoring platform device, comprising: a tenant database for storing multiple tenant master files, each tenant master file having a security handling policy; an alarm receiving module for receiving a forwarded security message; an alarm analysis module coupled to the tenant database and the alarm receiving module for retrieving the corresponding tenant master file from the tenant database based on a tenant identification code of the security message, and generating a security action using the security handling policy of the corresponding tenant master file and an alarm content of the security message; and a notification status module coupled to the tenant database and the alarm analysis module for selectively sending a work order creation request or recording the security action in the tenant database when the security action is performed.

11. The monitoring platform device as described in claim 10, wherein, The notification status module obtains a security score and a security threshold for the security action based on the security processing strategy; in response to the security score reaching the security threshold, the notification status module sends the work order creation request; in response to the security score not reaching the security threshold, the notification status module records the security action in the tenant database.

12. The monitoring platform device as described in claim 11, wherein, The notification status module is used to obtain a work order number based on the work order creation request and to bind the work order number of the safety action to the alarm content.

13. The monitoring platform device as described in claim 12, wherein, If the work order number is not obtained in response to the work order creation request, the notification status module performs an exponential backoff retry.

14. The monitoring platform device as described in claim 13, wherein, The alarm analysis module is used to formalize the safety action to identify at least one event feature, and to obtain the safety score of the safety action based on the at least one event feature.

15. The monitoring platform device as described in claim 11, wherein, The alert content includes geolocation information, and the alert analysis module uses this geolocation information and the security handling strategy to obtain the security score for the security action.

16. The monitoring platform device as described in claim 10 further includes an authorization monitoring module for monitoring the validity of an authorization.

17. The monitoring platform device as described in claim 16, wherein, The authorization monitoring module detected an abnormality in the authorization validity and deleted the tenant's master file.

18. The monitoring platform device as described in claim 10 further includes a security detection configuration module for scanning the activation status of a security threat detection module in multiple tenant environments, so as to enable the security threat detection module in the tenant environment where it is not enabled, and not to re-enable the security threat detection module in the tenant environment where it is already enabled.

Images