A cloud security detection method, device and storage medium

Abstract

The present application discloses a cloud security detection method, device and storage medium, including: determining the type of cloud security scenario that needs to be detected; in the case of hybrid cloud layer detection scenario, according to the pre-set hybrid cloud layer detection rules and the hybrid cloud corresponding software development kit SDK, the detection information returned by the hybrid cloud is obtained to determine the detection result of the hybrid cloud layer; in the case of cloud native layer detection scenario, according to the pre-set cloud native layer detection rules, the cloud native layer detection scenario is detected to determine the cloud native layer detection result; in the case of software layer detection scenario, according to the pre-set software layer detection rules, the software layer detection scenario is detected to determine the software layer detection result. By applying the embodiment of the present application, detection can be performed on any scenario, thereby achieving the purpose of comprehensive and unified detection.

Description

Technical Field

[0001] The present application relates to the field of Internet technology, and in particular to a cloud security detection method, a cloud security detection device, a computer-readable storage medium, and a computer program product. Background Art

[0002] Cloud technology, owing to its large scale, virtualization capabilities, strong reliability, and high scalability, has experienced rapid growth. Simultaneously, cloud security technologies have also advanced in parallel. Existing technologies consider cloud security to be divided into four aspects: cloud, cluster, container, and source code. Clusters and containers are typically detected using detection methods within the cloud-native security layer, but there is no unified approach for cloud and source code detection.

[0003] Therefore, since the existing cloud security technologies mainly focus on cloud native security detection, the level of security detection is relatively single and cannot meet users' needs for comprehensive detection of cloud security at all levels. Summary of the Invention

[0004] In response to the above-mentioned existing technologies, an embodiment of the present invention discloses a cloud security detection method, which can overcome the defect of a single security detection level and achieve the purpose of comprehensive detection of all levels of cloud security.

[0005] In view of this, the method proposed in the embodiment of the present application includes:

[0006] Determine the types of cloud security scenarios that need to be tested;

[0007] When the cloud security scenario type is a hybrid cloud-level detection scenario, the detection information returned by the hybrid cloud is obtained through the software development kit SDK corresponding to the hybrid cloud according to the pre-set hybrid cloud-level detection rules to determine the detection result of the hybrid cloud level;

[0008] When the cloud security scenario type is a cloud native layer detection scenario, the cloud native layer detection scenario is detected according to the pre-set cloud native layer detection rules to determine the cloud native layer detection result;

[0009] When the cloud security scenario type is a software-level detection scenario, the software-level detection scenario is detected according to pre-set software-level detection rules to determine the software-level detection result.

[0010] Furthermore,

[0011] Before the step of determining the cloud security scenario type to be detected, the method further includes:

[0012] The security platform obtains the cloud security scenario type that needs to be detected through the user interface UI;

[0013] The security platform generates a detection task according to the cloud security scenario type that needs to be detected, and issues the detection task using a command line;

[0014] The security task engine receives the detection task issued by the security platform through the interface;

[0015] The user interface UI, the security platform, and the security task engine are independent of the cloud security scenario that needs to be detected.

[0016] Further,

[0017] The step of obtaining detection information returned by the hybrid cloud through a software development kit (SDK) corresponding to the hybrid cloud according to pre-set hybrid cloud layer detection rules to determine the hybrid cloud layer detection result includes:

[0018] The security task engine determines all single clouds included in the hybrid cloud, where the single cloud is a separate cloud;

[0019] The security task engine performs the following steps for each single cloud: performing SDK authentication on the single cloud according to the pre-set cloud account of the single cloud; calling the SDK interface corresponding to the single cloud using the pre-set detection rules corresponding to the single cloud as parameters, where the detection rules corresponding to the single cloud belong to the detection rules of the hybrid cloud layer; receiving the detection information returned by the single cloud as the detection result of the single cloud;

[0020] The security task engine combines the detection information returned by all the single clouds as a detection result at the hybrid cloud level.

[0021] Further,

[0022] The step of detecting the cloud native layer detection scenario according to the pre-set cloud native layer detection rules to determine the cloud native layer detection result includes:

[0023] When the security task engine determines, based on the detection task, that the cloud-native-level detection is host detection, it connects to the host to be detected using the secure shell protocol (SSH), detects the host using pre-set host detection rules, and obtains the host detection result returned by the host through the HTTPS protocol; the host belongs to the host in the detection scenario of the cloud-native-level, and the host detection rule belongs to the detection rule of the cloud-native-level;

[0024] When the security task engine determines that the detection task is K8s detection, it establishes an HTTPS connection with the K8s environment to be detected according to the pre-set K8s address, and after authentication according to the pre-set first token, it uses the obtained vulnerability library to detect the K8s environment, and obtains K8s vulnerability information and K8s configuration audit information. The K8s vulnerability information and K8s configuration audit information serve as the detection result of the K8s detection; the K8s belongs to the K8s in the detection scenario of the cloud native level, the K8s vulnerability information indicates relevant information about whether the K8s environment has vulnerabilities, and the K8s configuration audit information indicates relevant information about whether there are problems with the K8s environment configuration;

[0025] When the security task engine determines that the detection task is K8s deployment detection, it determines the acquired K8s deployment file, detects the K8s deployment file using the vulnerability library, and obtains the detection result of the K8s deployment detection; the K8s deployment file represents relevant information for deployment of the K8s environment;

[0026] When the security task engine determines that the detection task is image detection, it establishes the HTTPS connection with the address of the pre-set image file to obtain the image file, and detects the image file using the vulnerability library to obtain the detection result of the image detection; the image file is the image file in the detection scenario at the cloud native level;

[0027] The security task engine uses the detection results of the host detection, the detection results of the K8S detection, the detection results of the K8S deployment detection and the detection results of the image detection as the detection results of the cloud native level.

[0028] Further,

[0029] The step of detecting the software-level detection scenario according to the pre-set software-level detection rules to determine the software-level detection result includes:

[0030] When the security task engine determines that the detection task is source code detection, it establishes the HTTPS connection with the pre-set source code repository address to obtain the dependent files to be detected in the source code, and uses the vulnerability library to detect the dependent files to obtain the detection results of the source code detection; the dependent files are files that record the dependency relationships contained in the source code;

[0031] When the security task engine determines that the detection task is image detection, it establishes the HTTPS connection with the address of the pre-set image file to obtain the image file, and detects the image file using the vulnerability library to obtain the detection result of the image detection; the image file is the image file in the detection scenario at the cloud native level;

[0032] When the security task engine determines that the detection task is a target file detection, it determines the acquired target file, detects the target file using the vulnerability library, and obtains a detection result of the target file detection; the target file is a file that needs to be detected that is different from the dependent file;

[0033] The security task engine uses the detection results of the source code detection, the detection results of the image detection, and the detection results of the target file detection as the detection results of the software level.

[0034] Furthermore,

[0035] After determining the detection result, the method further includes:

[0036] The security task engine returns the detection results of any combination of the hybrid cloud layer detection results, the cloud native layer detection results, and the software layer detection results to the security task engine, which is then visually displayed by the security task engine through the UI.

[0037] The embodiment of the present invention discloses a cloud security detection device, which can overcome the defect of a single security detection level and achieve the purpose of comprehensive detection of all levels of cloud security.

[0038] A cloud security detection device, comprising: a user interface module, a security platform, and a security task engine, wherein the user interface module, the security platform module, and the security task engine module are independent of the cloud security scenario to be detected; wherein:

[0039] The user interface module is used to determine the type of cloud security scenario that needs to be detected;

[0040] The security platform is used to generate a detection task according to the type of cloud security scenario that needs to be detected, and issue the detection task using a command line;

[0041] The security task engine receives the detection task issued by the security platform through the interface; when the cloud security scenario type is a hybrid cloud-level detection scenario, the detection information returned by the hybrid cloud is obtained according to the pre-set hybrid cloud-level detection rules and the software development tool kit SDK corresponding to the hybrid cloud to determine the detection result of the hybrid cloud level; when the cloud security scenario type is a cloud native-level detection scenario, the cloud native-level detection scenario is detected according to the pre-set cloud native-level detection rules to determine the detection result of the cloud native level; when the cloud security scenario type is a software-level detection scenario, the software-level detection scenario is detected according to the pre-set software-level detection rules to determine the detection result of the software level.

[0042] An embodiment of the present application further discloses a computer-readable storage medium having computer instructions stored thereon. When the instructions are executed by a processor, the steps of any of the above-described cloud security detection methods can be implemented.

[0043] An embodiment of the present application further discloses a computer program product, comprising computer instructions, which, when executed by a processor, implement the cloud security detection method as described in any one of the above.

[0044] To sum up, the embodiment of the present invention discloses a cloud security detection solution, which performs detection on hybrid cloud-level detection scenarios, cloud-native-level detection scenarios, and software-level detection scenarios respectively. It can perform detection on any scenario, thereby achieving the purpose of comprehensive and unified detection. BRIEF DESCRIPTION OF THE DRAWINGS

[0045] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without any creative work.

[0046] Figure 1 This is a flowchart of a first embodiment of the method for implementing cloud security detection in this application.

[0047] Figure 2 This is a flowchart of the second embodiment of the method for implementing cloud security detection in this application.

[0048] Figure 3 This is a flow chart of the method embodiment 3 of the present application, which uses Alibaba Cloud as an example to illustrate a detection method for implementing a hybrid cloud layer.

[0049] Figure 4 This is a flow chart of the detection method for host detection in embodiment 4 of the present application.

[0050] Figure 5 This is a flow chart of the detection method for K8S detection in Example 4 of the method of this application.

[0051] Figure 6 This is a flow chart of the detection method for K8S deployment detection in embodiment 4 of this method.

[0052] Figure 7 This is a flow chart of the detection method for mirror image detection in the fourth embodiment of the present application.

[0053] Figure 8 This is a flow chart of the detection method for source code detection in Example 5 of the present application.

[0054] Figure 9 This is a flow chart of the detection method for target file detection in Example 5 of the method of this application.

[0055] Figure 10 This is a structural diagram of a first embodiment of the device for implementing cloud security detection in the present application.

[0056] Figure 11 Schematic diagram of the internal structure of the security task engine 1003. DETAILED DESCRIPTION

[0057] The following will be combined with the drawings in the embodiments of this application to clearly and completely describe the technical solutions in the embodiments of this application. Obviously, the embodiments described are only part of the embodiments of this application, not all of the embodiments. Based on the embodiments in this application, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of this application.

[0058] The terms "first", "second", "third", "fourth", etc. (if any) in the description and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that the numbers used in this way are interchangeable where appropriate, so that the embodiments of the invention described herein can, for example, be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions. For example, a process, method, system, product or apparatus that includes a series of steps or units is not necessarily limited to those steps or units that are clearly listed, but may include other steps or units that are not clearly listed or that are inherent to these processes, methods, products or apparatus.

[0059] The following specific embodiments are used to describe the technical solution of the present invention in detail. The following specific embodiments can be combined with each other, and the same or similar concepts or processes may not be described in detail in some embodiments.

[0060] The prior art believes that cloud security is divided into four aspects, namely cloud, cluster, container and source code. Among them, clusters and containers are usually detected in the detection methods belonging to the cloud native security level, but the cloud and source code are not uniformly detected. The cloud native mentioned here mainly refers to a distributed cloud based on distributed deployment and unified operation and management, and a cloud technology product system based on technologies such as containers, microservices, and DevOpe. Under the cloud native system, other public third-party cloud systems can also be applied. These third-party cloud systems are referred to as "hybrid clouds" in the embodiments of this application, and the resources involved in the third-party cloud systems are referred to as cloud resources in the embodiments of this application. In other words, the cloud belongs to the hybrid cloud level in the embodiments of this application, the cluster and container belong to the cloud native level, and the source code belongs to the software level.

[0061] The embodiments of the present application divide the objects that need to be detected into three major scenarios: detection scenarios at the hybrid cloud level, detection scenarios at the cloud native level, and detection scenarios at the software level. Among them, the detection scenarios at the hybrid cloud level are detections of cloud resources in various third-party cloud systems, the detection scenarios at the cloud native level are detections of clusters and containers in the cloud system itself, and the detection scenarios at the software level are detections of software in the cloud system itself. In the same detection method of the embodiments of the present application, one or more scenarios that need to be detected can be arbitrarily specified, and detection can be performed separately according to the specified scenarios to achieve the purpose of comprehensive detection of all levels of cloud security.

[0062] Figure 1 This is a flow chart of the first embodiment of the method for implementing cloud security detection in this application. Figure 1 As shown, the method includes:

[0063] Step 101: Determine the type of cloud security scenario that needs to be detected.

[0064] Step 102: When the cloud security scenario type is a hybrid cloud-level detection scenario, the detection information returned by the hybrid cloud is obtained according to the pre-set hybrid cloud-level detection rules and the software development kit (SDK) corresponding to the hybrid cloud to determine the hybrid cloud-level detection results.

[0065] This step is for hybrid cloud-level detection scenarios. In practical applications, to better utilize resource services, cross-cloud resource utilization of third-party cloud systems may occur, which is known as hybrid cloud. A hybrid cloud is not simply a stacking of several single clouds, but rather leverages the technical characteristics of various cloud deployment models to improve user resource utilization across clouds. The single cloud here refers to a separate third-party cloud system, which can be a public cloud or a private cloud, such as Alibaba Cloud, Tencent Cloud, Huawei Cloud, Baidu Cloud, Volcano Engine, QingCloud, UCloud, Qiniu Cloud, Amazon Web Services, Microsoft Azure, Google Cloud, OpenStack, VWare vSphere, and so on.

[0066] The hybrid cloud layer detection rules described in this step can be set in advance according to international and domestic standards, or can be defined by the user who applies the embodiment of the present application. International and domestic standards include: Multi-level security compliance such as the "Cybersecurity Law of the People's Republic of China" and the "Information Security Technology Network Security" version 2.0, or the Internet Security Center (CIS), or cloud best security practices and other rules. For example, the content about network security in the Multi-level Security Compliance includes: ensuring that the business processing capabilities of the main network equipment have redundant space to meet the needs of business peak periods; ensuring that the bandwidth of each part of the network meets the needs of business peak periods; ensuring that routing control is carried out between business terminals and business servers to establish a secure access path, etc. The rules for IAM CIS security checks in CIS include: avoiding the use of root users; ensuring that all Identity and Access Management (IAM) users with console passwords enable multi-factor authentication, etc. The best security practices for cloud servers (ECS) include: whether all ECS instances under the cloud account have lost connection to the virtual network (VPC, Virtual Private Cloud); whether all ECS instances under the cloud account are directly bound to the public IP address; and network type detection for all ECS instances under the cloud account.

[0067] Step 103: When the cloud security scenario type is a cloud native layer detection scenario, the cloud native layer detection scenario is detected according to the pre-set cloud native layer detection rules to determine the cloud native layer detection result.

[0068] This step is performed for cloud-native layer detection scenarios. Cloud-native layer security primarily involves images, containers, and clusters. Native layer detection rules primarily include host detection, Kubernetes detection, deployment detection, and image detection, and may also include user-defined rules. Host detection targets hosts in cloud-native layer detection scenarios. Host detection rules specifically include rules addressing network security risks faced by servers, such as checking operating system password expiration times, high-risk operating system ports, and operating system memory usage. Kubernetes detection targets the Kubernetes environment in cloud-native layer detection scenarios, such as checking for compliance with the security requirements of the Kubernetes container cloud platform. "Kubernetes" here refers to Kubernetes, an open-source framework for managing containerized applications across multiple hosts in a cloud platform, providing a mechanism for application deployment, planning, updating, and maintenance. Deployment detection targets Kubernetes deployment files in cloud-native layer detection scenarios. Image detection targets image files in cloud-native layer detection scenarios. The detection rules for K8s detection, deployment detection, and image detection can all use the vulnerability database (Vulnerability DB) as rules.

[0069] Step 104: When the cloud security scenario type is a software-level detection scenario, the software-level detection scenario is detected according to pre-set software-level detection rules to determine a software-level detection result.

[0070] This step is the execution of the detection scenario at the software level. The security at the software level mainly involves source code detection, image detection, and target file detection. Source code detection is the detection of dependent files that record dependency relationships in the source code, and image detection is the detection of image files in the detection scenario at the cloud native level. Target file detection is the detection of target files specified in the detection scenario at the cloud native level. In the embodiment of the present application, the detection rules for source code detection, image detection, and target file detection can all utilize the Vulnerability Database (Vulnerability DB) rules.

[0071] The above steps 102 to 104 are steps for performing detection on the hybrid cloud layer, the cloud native layer, and the software layer, respectively. By applying the embodiment of the present application, detection can be performed on any scenario, thereby achieving the purpose of comprehensive and unified detection.

[0072] In order to facilitate detection in different scenarios, the second embodiment of the method of the present application sets up a detection platform to implement the above method. In the prior art, detection is usually achieved in an invasive way, such as entering the K8s cluster to install an Agent. Although this method can achieve detection, the invasive method itself also brings security risks. Different from this, the detection platform in the second embodiment of the method of the present application is independent of the cloud security scenario that needs to be detected, that is: the detection platform runs outside the cloud security scenario that needs to be detected, and does not need to be installed in the cloud security scenario that needs to be detected. It adopts a non-invasive detection method.

[0073] In the embodiment of the present application, the detection platform can be divided into three parts: a user interface (UI), a security platform, and a security task engine. The UI is mainly used to interact with the user to determine the scenarios that need to be detected and to visually display the detection results to the user; the security platform is mainly used to generate and issue detection tasks and analyze the returned detection results; the security task engine is mainly used to receive detection tasks and detect the specified detection scenarios according to the detection rules to obtain detection results. Since the security platform is mainly oriented towards UI interaction, it can be generated in JAVA, while the security task engine is mainly oriented towards the underlying logic and can be generated in Python.

[0074] Figure 2 This is a flow chart of the second embodiment of the method for implementing cloud security detection in this application. Figure 2 As shown, the method includes:

[0075] Step 201: The security platform obtains the cloud security scenario type that needs to be detected through the user interface (UI).

[0076] In actual applications, the UI may provide multiple menu options. Users can select the cloud security scenario type to be tested through the UI menu options, namely, one or more of the following three scenarios: hybrid cloud-level detection scenario, cloud native-level detection scenario, and software-level detection scenario. The security platform obtains the cloud security scenario type to be tested based on the user's selection.

[0077] Step 202: The security platform generates a detection task according to the type of cloud security scenario to be detected, and issues the detection task using a command line.

[0078] In this step, regardless of the selected cloud security scenario type or scenarios, you can generate a detection task and issue it using a command-line. In the detection task, you can specify information such as the detection type, address, token, or file name to clearly define the task to be executed. Of course, different detection tasks contain different information, which will be explained in detail in subsequent examples.

[0079] Step 203: The security task engine receives the detection task issued by the security platform through the interface.

[0080] In actual applications, when the security task engine receives a detection task, it can sort the detection tasks and execute them one by one in the sorted order. Alternatively, the security task engine can execute the detection tasks separately in a multi-threaded manner.

[0081] Step 204: The security task engine determines the type of cloud security scenario that needs to be detected.

[0082] Step 205: When the cloud security scenario type is a hybrid cloud-level detection scenario, the security task engine obtains the detection information returned by the hybrid cloud through the SDK corresponding to the hybrid cloud according to the pre-set hybrid cloud-level detection rules to determine the hybrid cloud-level detection results.

[0083] In actual applications, the security task engine in this step obtains the detection information returned by the hybrid cloud through the SDK corresponding to the hybrid cloud according to the pre-set hybrid cloud layer detection rules to determine the hybrid cloud layer detection results. This can be achieved as follows:

[0084] 1) The security task engine determines all single clouds included in the hybrid cloud, where a single cloud is a separate cloud.

[0085] 2) The security task engine executes the following steps for each of the single clouds: SDK authentication is performed on the single cloud according to the cloud account of the single cloud set in advance; the SDK interface corresponding to the single cloud is called with the detection rules corresponding to the single cloud set in advance as parameters, and the detection rules corresponding to the single cloud belong to the detection rules at the hybrid cloud level; the detection information returned by the single cloud is received as the detection result of the single cloud.

[0086] 3) The security task engine combines the detection information returned by all single clouds as the detection results at the hybrid cloud level.

[0087] Among them, the cloud account and SDK (or SDK software package) of each single cloud can be saved in the detection platform in advance. After passing the SDK certification, the SDK interface can be directly called to implement the detection of a single cloud. Because the SDK of a single cloud can be used as an interface for applying the single cloud, it is very convenient to obtain its cloud resources, such as cloud servers (ECS, Elastic Compute Service), load balancers (SLB, Server Load Balancer), object storage (OSS, Object Storage Service), file storage (NAS, Apsara File Storage), and then the single cloud can return the detection results for these cloud resources. Each single cloud can be executed independently according to the above method, and finally obtain the detection results at the hybrid cloud level.

[0088] Step 206: When the cloud security scenario type is a cloud native level detection scenario, the security task engine detects the cloud native level detection scenario according to the pre-set cloud native level detection rules to determine the cloud native level detection result.

[0089] In actual applications, cloud-native detection scenarios can include host detection, K8s detection, K8s deployment detection, image detection, etc. Among them, host detection, K8s detection, and K8s deployment detection are equivalent to the clusters in the above-mentioned cloud-native security, and image detection is equivalent to the container in cloud-native security.

[0090] In this step, the security task engine detects the cloud-native layer detection scenario according to the pre-set cloud-native layer detection rules to determine the cloud-native layer detection results. This can be achieved in the following way:

[0091] 1) When the security task engine determines that the cloud-native-level detection is host detection based on the detection task, it connects to the host to be detected based on the secure shell protocol SSH, detects the host using the pre-set host detection rules, and obtains the host detection results returned by the host through the HTTPS protocol; the host belongs to the host in the cloud-native-level detection scenario, and the host detection rules belong to the cloud-native-level detection rules.

[0092] 2) When the security task engine determines that the detection task is K8s detection, it establishes an HTTPS connection with the K8s environment to be detected according to the pre-set K8s address, and after authentication according to the pre-set first token, it uses the obtained vulnerability library to detect the K8s environment, and obtains K8s vulnerability information and K8s configuration audit information. The K8s vulnerability information and K8s configuration audit information are used as the detection results of K8s detection; K8s belongs to the K8s in the cloud-native level detection scenario. The K8s vulnerability information indicates whether there are vulnerabilities in the K8s environment, and the K8s configuration audit information indicates whether there are problems with the K8s environment configuration.

[0093] 3) When the security task engine determines that the detection task is K8s deployment detection, it determines the obtained K8s deployment file, uses the vulnerability library to detect the K8s deployment file, and obtains the detection result of the K8s deployment detection; the K8s deployment file represents the relevant information for the deployment of the K8s environment.

[0094] 4) When the security task engine determines that the detection task is image detection, it establishes an HTTPS connection with the address of the pre-set image file to obtain the image file, uses the vulnerability library to detect the image file, and obtains the detection result of the image detection; the image file is an image file in the cloud native level detection scenario.

[0095] For host detection, the IP address, port number, login username and password of the host to be detected can be saved in the detection platform in advance. When host detection is required, the above information is used to connect to the host, and the host performs detection and returns the detection results.

[0096] For K8s testing, K8s deployment testing, and image testing, you can save information such as the K8s environment address, first token, K8s deployment files, and image repository address in the testing platform. You can also save the vulnerability database in the testing platform. This information can be used to complete native cloud security testing when it's necessary.

[0097] Step 207: When the cloud security scenario type is a software-level detection scenario, the security task engine detects the software-level detection scenario according to pre-set software-level detection rules to determine the software-level detection result.

[0098] In actual applications, software-level detection scenarios can include source code detection, image detection, and target file detection. In this step, the security task engine detects the software-level detection scenarios according to the pre-set software-level detection rules to determine the software-level detection results. This can be achieved in the following way:

[0099] 1) When the security task engine determines that the detection task is source code detection, it establishes the HTTPS connection with the pre-set source code warehouse address to obtain the dependent files to be detected in the source code, uses the vulnerability library to detect the dependent files, and obtains the detection results of the source code detection; the dependent files represent files that record the dependency relationships contained in the source code.

[0100] 2) When the security task engine determines that the detection task is image detection, it establishes an HTTPS connection with the address of the pre-set image file to obtain the image file, uses the vulnerability library to detect the image file, and obtains the detection result of the image detection; the image file is an image file in the detection scenario at the cloud native level.

[0101] 3) When the security task engine determines that the target file is to be detected according to the detection task, it determines the acquired target file, detects the target file using the vulnerability library, and obtains the detection result of the target file detection; the target file is a file that needs to be detected that is different from the dependent file.

[0102] For source code and image detection, the source code repository and image repository addresses can be stored in the detection platform in advance. For target file detection, the target file can be directly uploaded to the detection platform. Similarly, the vulnerability database (Vulnerability Database) is also stored in the detection platform in advance. When original cloud security testing is required, this information is used to complete the test.

[0103] The above steps 205 to 207 are the same as steps 102 to 104 in the first embodiment of the method, which will be described in detail in subsequent embodiments and will not be repeated here.

[0104] Step 208: The security task engine returns the detection results of any combination of the hybrid cloud layer detection results, the cloud native layer detection results, and the software layer detection results to the security task engine, which is then visualized through the UI.

[0105] In practice, after the security task engine completes a detection task, it generates a detection report or software bill of materials (SBOM) based on the detection results and displays them visually to the user. The SBOM is designed for software-level detection scenarios, while hybrid cloud and cloud-native layer detection results can simply be generated into a visual detection report.

[0106] By applying the solution of the embodiment of the present application, a detection platform independent of the cloud security scenario that needs to be detected can be used to implement detection. Specifically, the scenario that needs to be detected is determined through UI interaction with the user, the detection task is generated through the security platform, and the detection task is executed through the security task engine, thereby achieving comprehensive and unified detection of all levels of cloud security without intrusion. In addition, the embodiment of the present application can also allow the user to choose which one or several types of detection to be determined, and the detection rules can be carried out according to international and domestic standards, or according to a user-defined mode, to achieve a flexible detection effect.

[0107] With respect to the above-mentioned step 205, the third embodiment of the method of the present application proposes a detection method for a detection scenario at the hybrid cloud level. In the third embodiment of the method, it is assumed that an enterprise has applied a variety of third-party cloud systems, including Alibaba Cloud, Tencent Cloud, Baidu Cloud, UCloud, Huawei Cloud, etc. These third-party cloud systems constitute a hybrid cloud in the embodiment of the present application. In order to detect whether there are security issues in the hybrid cloud of the enterprise, the enterprise performs detection on a detection platform on which the solution of the present application is installed. Before the detection, the cloud account and the corresponding SDK software package of each single cloud of the hybrid cloud need to be saved in the detection platform so that the detection platform can use this information when detecting the hybrid cloud.

[0108] As mentioned above, the detection rules at the hybrid cloud level can be based on international and domestic standards, or they can be defined by users applying the embodiments of this application, such as information security compliance, CIS, cloud best security practices, etc. These detection rules can be recorded in YAML format. Taking the detection of Alibaba Cloud EIP resource compliance as an example, its detection rule policy1.yaml can be expressed as follows:

[0109]

[0110] In addition, when calling Alibaba Cloud's SDK, you can use Python or Java to reference Alibaba Cloud's SDK software package. At this point, the administrator determines the hybrid cloud detection scenario through the detection platform UI, and the security platform generates the corresponding detection task and uses the command-line command line to send the following detection task to the security task engine:

[0111] hummer cloud aliyun ak=***sk=***policy1.yaml

[0112] In this file, "cloud" indicates that the cloud security scenario to be tested is a hybrid cloud-level scenario, "ak=***" and "sk=***" indicate Alibaba Cloud accounts, and "policy1.yaml" indicates the compliance detection rules for Alibaba Cloud's EIP resources.

[0113] Figure 3 This is a flow chart of the method embodiment 3 of the present application, which uses Alibaba Cloud as an example to illustrate the detection method for implementing a hybrid cloud layer. Figure 3 As shown, the method includes:

[0114] Step 301: The security task engine performs SDK authentication on Alibaba Cloud based on the pre-set Alibaba Cloud account. In this step, the security task engine performs SDK authentication on Alibaba Cloud based on the ak and sk information in the above detection task.

[0115] Step 302: The security task engine uses the pre-set detection rules corresponding to Alibaba Cloud as parameters to call the interface of the SDK corresponding to Alibaba Cloud.

[0116] The detection rules recorded in the YAML format in the preceding policy1.yaml are the detection rules for Alibaba Cloud EIP resources in this step.

[0117] Step 303: The security task engine receives the detection information returned by Alibaba Cloud as the detection result of Alibaba Cloud.

[0118] Steps 302 and 303 above describe the process by which the security task engine calls the Alibaba Cloud SDK interface and obtains the returned detection information. In practice, the process can be represented as follows:

[0119] …

[0120] request=DescribeEipAddressesRequest()

[0121] request.set_accept_format('json')

[0122] request.set_Filter1Key("bandwidth")

[0123] request.set_Filter1Key("10")

[0124] response=client.do.action_with_exception(request)

[0125] …

[0126] DescribeEipAddressesRequest() is an API in the Alibaba Cloud SDK. "bandwidth" is the bandwidth of the Alibaba Cloud EIP resource, "10" represents the bandwidth value, and "response" represents the information returned by the API. This process detects the bandwidth of the Alibaba Cloud EIP resource and returns information if the bandwidth is less than "10." The security task engine obtains the detection results through the "response."

[0127] The above uses Alibaba Cloud's EIP resource detection as an example to illustrate the detection method for hybrid cloud detection scenarios. In actual applications, detection of other aspects of Alibaba Cloud, as well as detection of Tencent Cloud, Baidu Cloud, UCloud, Huawei Cloud, etc., can be implemented using a method similar to the third embodiment of the present invention, and will not be repeated here.

[0128] Example 3 of the present application utilizes the UI, security platform, and security task engine in the detection platform to detect detection scenarios at the hybrid cloud level. There is no need to invade the interior of the hybrid cloud for detection. Instead, it uses the SDK interface to call, thereby achieving the purpose of non-invasive detection.

[0129] With respect to the above-mentioned step 206, the fourth embodiment of the method of the present application proposes a detection method for a detection scenario at the cloud native level. In the fourth embodiment of the method, it is assumed that an enterprise has built a distributed cloud, which includes several hosts and has deployed resources such as K8s and images. In order to detect the cloud native security, it is necessary to perform host detection, K8s detection, K8s deployment detection, image detection and other aspects. Before the detection, information such as the host address, K8s address and authentication token, K8s deployment file, source code repository address and image repository address are recorded in the detection platform, and the vulnerability database (Vulnerability DB) is also saved in the detection platform in advance to facilitate the use of this information in the detection of cloud native security.

[0130] Assume that the administrator determines to perform cloud-native detection scenarios through the detection platform UI, and the security platform generates detection tasks for host detection, Kubernetes detection, Kubernetes deployment detection, and image detection. The administrator then uses the command-line command line to issue the following detection tasks to the security task engine:

[0131] hummer server 180.184.99.243:22policy.sh;

[0132] hummer k8s https: / / 117.50.189.231:6443token;

[0133] hummer config deploy.yaml;

[0134] hummer repo reg2.hummer.com admin:123456image python:1.0.0;

[0135] The security task engine will use the following methods to execute the above detection tasks one by one.

[0136] Figure 4 This is a flow chart of the detection method for host detection in the fourth embodiment of the method of the present application. In the host detection, the detection task executed by the security task engine is "hummer server 180.184.99.243:22policy.sh". Among them, "server" represents host detection, "180.184.99.243:22" represents the IP address and port of the host, and "policy.sh" represents the host detection rules in shell format. The host IP address, port, and host detection rules described here can all be saved in the detection platform in advance to facilitate the security task engine to obtain them. Assuming that the embodiment of the present application takes the detection of whether the host operating system password has expired as an example, its detection rules can be expressed as follows:

[0137]

[0138]

[0139] Among them, "CurrentPassMaxDays" indicates the current password time of the host, and "PassMaxDays" indicates the pre-set host password expiration time. The values ​​of "CurrentPassMaxDays" and "PassMaxDays" can be obtained from the host.

[0140] like Figure 4 As shown, the method specifically includes:

[0141] Step 401: The security task engine connects to the host to be detected according to the Secure Shell (SSH) protocol.

[0142] The SSH protocol is an encrypted network transmission protocol that provides a secure transmission environment for network services over insecure networks, establishing a connection through a secure tunnel. In this step, because the detection task includes the host's IP address and port number ("180.184.99.243:22"), an SSH connection to the host is established. In actual applications, the host connection process may also require a username and password. These usernames and passwords can also be saved in the detection platform.

[0143] Step 402: The security task engine detects the host using pre-set host detection rules, and obtains the host detection result returned by the host through the HTTPS protocol.

[0144] The host detection rules in this step are the detection rules described in the above "policy.sh", which belong to compliance detection. That is to say, when performing host detection, the host operating system obtains its own "CurrentPassMaxDays" and "PassMaxDays" values, performs detection according to the detection rules described in the above "policy.sh", obtains the detection results, and finally returns the detection results to the security task engine via HTTPS. Applying the embodiment of the present application, the security task engine uses the SSH protocol and HTTPS protocol to establish a connection with the host and transmit detection information, and uses a non-invasive method to safely complete the detection of the host in the cloud native environment.

[0145] Figure 5 This is a flow chart of the detection method for K8s detection in Example 4 of the present invention. In K8s detection, the detection task executed by the security task engine is "hummer k8s https: / / 117.50.189.231:6443token." "k8s" represents K8s detection, "https: / / 117.50.189.231:6443" represents the K8s address, and "token" represents the first token used for authentication. The K8s address and first token described here, as well as the vulnerability database (Vulnerability DB) used subsequently, can all be saved in the detection platform in advance for easy access by the security task engine.

[0146] like Figure 5 As shown, the method specifically includes:

[0147] Step 501: The security task engine establishes an HTTPS connection with the K8s environment to be detected according to the pre-set K8s address, that is, establishes an HTTPS connection with the K8s environment according to the above-mentioned https: / / 117.50.189.231:6443 address.

[0148] Step 502: The security task engine performs authentication based on the first token set in advance, that is, performs authentication based on the value of the above-mentioned "token".

[0149] Step 503: The security task engine uses the obtained vulnerability library to detect the K8s environment, obtains K8s vulnerability information and K8s configuration audit information, and the K8s vulnerability information and K8s configuration audit information are used as the detection results of K8s detection.

[0150] This step tests the K8s environment based on the vulnerability database (Vulnerability DB). The vulnerability database uses unified specifications to collect, publish, name, classify, and grade vulnerabilities, establishing a standardized and comprehensive vulnerability management mechanism. K8s vulnerability information indicates whether there are vulnerabilities in the K8s environment. For example, "CVE-2022-1996" is a type of K8s vulnerability information, where "CVE" represents the vulnerability, "2022" represents the year, and "1996" represents the vulnerability number. In the vulnerability database, the content corresponding to the K8s vulnerability information provides methods for remediating the vulnerability, so the vulnerability can be subsequently remediated based on the content corresponding to the K8s vulnerability information. K8s configuration audit information indicates whether there are problems with the K8s environment configuration, such as whether there are problems with the port number, cache size, etc. For example, "KSV010" is a type of K8s configuration audit information. Based on this information, specific problems with the K8s environment configuration can be identified and corrected.

[0151] Since the security task engine can obtain the vulnerability library, after establishing an HTTPS connection to the K8s environment, the security task engine itself can directly compare the vulnerability library with the K8s environment to achieve the detection purpose, and obtain K8s vulnerability information and K8s configuration audit information, that is, the detection results of K8s detection.

[0152] In this embodiment of the present application, it is assumed that the detected K8s vulnerability information and K8s configuration audit information are recorded in JSON format. Among them, the content corresponding to the K8s vulnerability information is:

[0153] …

[0154] installedVersion:2.16.0 / / indicates the currently installed version number;

[0155] fixedVersion:v2.11.2-0.20200112161605-a7c079c43d51+incompatible / / indicates the version number that needs to be upgraded;

[0156] …

[0157] primaryLink: https: / / avd.aquasec.com / nvd / cve-2022-1996 / / The primary link corresponding to the vulnerability;

[0158] …

[0159] vulnerabilityID:CVE-2022-1996 / / Unique identifier of the vulnerability

[0160] It can be seen that the vulnerability situation and repair measures can be known from the content corresponding to the K8s vulnerability information.

[0161] Assume that the content corresponding to the K8s configuration audit information in the embodiment of this application is:

[0162] …

[0163] category: Kubernetes Security Check / / Configured audit category

[0164] checkID: KSV041 / / Audit ID

[0165] description:The RuntimeDefault / Localhost seccomp profile must be required, or allow specific additional profiles. / / Description of the audit issue

[0166] …

[0167] It can be seen that the content corresponding to the K8s configuration audit information can be used to identify related problems with the K8s environment configuration, thereby improving or correcting them. Applying the embodiment of the present application, the security task engine uses the HTTPS protocol to establish a connection with the K8s environment and transmit detection information, using a non-invasive method to safely complete the detection of the K8s environment in the cloud native environment.

[0168] Figure 6 This is a flow chart of the detection method for K8s deployment detection in Example 4 of this method. In K8s deployment detection, the detection task executed by the security task engine is "hummer config deploy.yaml." "config" represents the K8s deployment detection, and "deploy2.yaml" represents the K8s deployment file, which can be recorded in YAML format. Both the K8s deployment file and vulnerability database described here can be pre-stored on the detection platform for easy access by the security task engine.

[0169] like Figure 6 As shown, the method specifically includes:

[0170] Step 601: The security task engine determines the existing K8s deployment file, namely the "deploy2.yaml" file.

[0171] Step 602: The security task engine uses the vulnerability library to detect the K8s deployment file and obtain the detection result of the K8s deployment detection.

[0172] This step uses Vulnerability DB as the vulnerability database, and checks the Kubernetes deployment file "deploy2.yaml" against it. This check typically begins by checking the file format, file content, and problem data. This allows you to determine the specific issues at the start and end lines of the file, allowing you to subsequently correct them.

[0173] Assume that the detection result of the K8s deployment detection in the embodiment of the present application is expressed in JSON format as follows:

[0174] …

[0175] "Type":"Rbac Security Check" / / Deployment detection type

[0176] "ID":"KSV041" / / Deployment detection ID

[0177] "Title":"Do not allow management of secrets" / / Detection title

[0178] "Description":"Check whether role permits managing secrets" / / Detection description

[0179] "Message":"Role permits management of secret(s)" / / Detection information

[0180] "Namespace":"builtin.kubernetes.KSV041" / / Detect the namespace of the K8s environment

[0181] "Resolution":"Create a role which does not permit to manage secrets if not needed" / / Solution description

[0182] …

[0183] "PrimaryURL":"https: / / avd.aquasec.com / misconfig / ksv041" / / The main link corresponding to the vulnerability

[0184] …

[0185] "StartLine": 52 / / Detection result, the starting line number of the yaml file

[0186] "EndLine": 62 / / Detection result, the end line number of the yaml file

[0187] …

[0188] It can be seen that the security task engine can determine the problems and repair methods in the K8s deployment files from the detection results of the K8s deployment detection. Applying the embodiment of the present application, the security task engine directly obtains the K8s deployment files that need to be detected and safely completes the detection of K8s deployment files in the cloud native environment in a non-invasive manner.

[0189] Figure 7 This is a flow chart of the detection method for image detection in Example 4 of the present invention. During image detection, the security task engine executes the detection task "hummer repo reg2.hummer.com admin:123456imagepython:1.0.0." "repo reg2.hummer.com" represents the image repository address, "admin:123456" represents the image repository username and password, "image" represents image detection, and "python:1.0.0" represents the image file to be detected. The image repository address, username and password, image file, and vulnerability database (Vulnerability Database) used later can all be stored in advance in the detection platform for easy access by the security task engine.

[0190] like Figure 7 The method shown in FIG. 1 specifically includes:

[0191] Step 701: The security task engine establishes an HTTPS connection with the pre-set address of the image file to obtain the image file, that is, establishes an HTTPS connection with the image repository according to the above “repo reg2.hummer.com”.

[0192] In actual applications, when connecting to the image repository, a username and password (i.e. "admin:123456") are required for authentication. After authentication, an HTTPS connection will be successfully established.

[0193] Step 702: The security task engine uses the vulnerability library to detect the image file and obtains the detection result of the image detection.

[0194] The vulnerability database in this step uses Vulnerability DB. The image file "python:1.0.0" is detected based on the vulnerability database and the detection results are obtained.

[0195] Assume that the detection result of the mirror detection in the embodiment of the present application is expressed in JSON format as follows:

[0196] "VulnerabilityID":"CVE-2022-42003" / / Vulnerability unique identifier "PkgName":"com.fasterxml.jackson.core:jackson-databind" / / Detect the package name corresponding to the vulnerability in the image

[0197] "PkgPath":"opt / apps / backend-1.0.jar" / / The package path corresponding to the vulnerability in the detection image;

[0198] "InstalledVersion":"2.13.4" / / Currently installed version

[0199] "FixedVersion":"2.12.7.1,2.13.4.1" / / Upgrade and fix version

[0200] …

[0201] "SeveritySource":"nvd" / / Problem source

[0202] "PrimaryURL":"https: / / avd.aquasec.com / nvd / cve-2022-42003" / / The primary link corresponding to the vulnerability

[0203] …

[0204] It can be seen that the content corresponding to the detection result of the image detection can determine the problems existing in the image file and the method of correction. Applying the embodiment of the present application, the security task engine uses the HTTPS protocol to establish a connection with the image warehouse and transmit the detection information, and uses a non-invasive method to safely complete the detection of the image file in the cloud native environment.

[0205] It can be seen from this that the fourth embodiment of the method of the present application can realize the detection of cloud native level detection scenarios. The detection results of the above-mentioned host detection, the detection results of K8s detection, the detection results of K8s deployment detection and the detection results of image detection are used as the detection results of the cloud native level. There is no need to invade the cloud native environment for detection. In the external detection platform, the SSH protocol, HTTPS protocol or direct upload are used to obtain the information to be detected, and the detection is performed according to the vulnerability library or the host. In actual application, the user can also choose which types of detection scenarios in the cloud native level need to be detected through the UI, that is, any one or more of the above-mentioned host detection, K8s detection, K8s deployment detection and image detection can be selected for detection. In addition, after the security task engine obtains the detection results of the cloud native level, it can also be visualized through the UI for administrators to view.

[0206] Regarding step 207 above, the fifth embodiment of the present invention proposes a detection method for software-level detection scenarios. In the fifth embodiment of the method, an enterprise has built a distributed cloud, and this cloud environment includes various software, such as dependent files in a source code repository, image files in an image repository, and target files saved by one or more users. Regarding dependent files, image files, and target files, the following explanation is provided: Regarding dependent files, developers will save the source code they create in the code repository during software development. The software development process requires certain inherent component information, and the dependency information of this component needs to be recorded. Inherent components are provided by third parties and directly imported into the source code, eliminating the need for developers to redevelop them. Source code typically uses dependency files to store dependency information. Image files are files generated after software compilation and construction are completed. They are a series of specific files formatted into a single file for easy download and use by users. Image files may also contain dependency information related to, for example, the operating system and development language. Regarding target files, in actual applications, users may save other files for use in the cloud environment, such as a configuration file or a specific dependency file. In order to distinguish them from the dependent files recorded in the above-mentioned source code repository and the mirror files recorded in the mirror repository, the embodiments of the present application refer to them as target files.

[0207] Assume that the administrator determines to perform software-level detection scenarios through the detection platform UI, and the security platform generates detection tasks for source code detection, image detection, and target file detection. The administrator then uses the command-line command line to issue the following detection tasks to the security task engine:

[0208] hummer code https: / / github.com / ** / **-test policy3.yaml

[0209] hummer repo reg2.hummer.com admin:123456image python:1.0.0

[0210] hummer-fs-pom.xml policy.yaml

[0211] The security task engine will execute the above detection tasks one by one.

[0212] Figure 8 This is a flow chart of the detection method for source code detection in Example 5 of this application. In source code detection, the detection task executed by the security task engine is "hummer code https: / / github.com / ** / **-test policy3.yaml." Here, "code" represents source code detection, "https: / / github.com / ** / **-test" represents the source code repository address, and "policy3.yaml" represents the detection rules. The source code repository address, detection rules, or vulnerability database (Vulnerability Database) described here can all be stored in the detection platform in advance for easy access by the security task engine.

[0213] like Figure 8 As shown, the method specifically includes:

[0214] Step 801: The security task engine establishes an HTTPS connection with a pre-configured source code repository address to retrieve the dependency files to be tested within the source code. Specifically, the security task engine establishes a connection to the source code repository at the address https: / / github.com / ** / **-test. This example uses the GitHub source code repository as an example, but other repositories are also acceptable. In actual applications, authentication using a second token may also be required when connecting to the source code repository, which will not be discussed further here.

[0215] Step 802: The security task engine uses the detection rules (ie, "policy3.yaml") to detect the dependent files and obtain the detection results of the source code detection.

[0216] The detection rules described here (i.e., "policy3.yaml") can be part of the vulnerability library. This eliminates the need to perform comprehensive detection using the vulnerability library, significantly narrowing the detection scope and improving detection efficiency. In this case, assuming that "policy3.yaml" is recorded in YAML format as follows:

[0217] …

[0218] -template:cves / 2020 / CVE-2020-1747.yaml

[0219] -template:cves / 2020 / CVE-2020-25576.yaml

[0220] -template:cves / 2021 / CVE-2021-25900.yaml

[0221] -template:cves / 2022 / CVE-2022-30034.yaml

[0222] -template:cves / 2019 / CVE-2019-3498.yaml

[0223] …

[0224] After testing, the test results are expressed in JSON format as follows:

[0225] …

[0226] "VulerabilityID":"CVE-2020-1747"

[0227] …

[0228] Therefore, through the detection results of the source code detection above, it can be seen that there is a vulnerability numbered "CVE-2020-1747" in the dependency file of the source code repository, which can be repaired through its corresponding content later.

[0229] Of course, in actual applications, the detection task "hummer code https: / / github.com / ** / **-testpolicy3.yaml" may not include the detection rule "policy3.yaml." In this case, after establishing an HTTPS connection with the source code repository, the security task engine can directly perform a comprehensive comparison of the vulnerability database with the dependent files in the source code to achieve the detection purpose and obtain the source code detection results. Using the embodiment of the present application, the security task engine uses the HTTPS protocol to establish a connection with the source code repository and transmit detection information, thus safely and non-invasively completing the detection of dependent files in the source code.

[0230] The detection method for image detection in Example 5 of this application is the same as the detection method for image detection in Example 4. In other words, the same method is used for image detection in both cloud-native and software-level detection scenarios, and will not be repeated here.

[0231] Figure 9 This is a flow chart of the target file detection method for Example 5 of the present invention. During target file detection, the security task engine performs the detection task "hummer fs pom.xml." "fs" represents the target file to be detected, and "pom.xml" represents the target file to be detected. The target file and the vulnerability database (Vulnerability Database) used subsequently can be stored in the detection platform in advance for easy access by the security task engine.

[0232] like Figure 9 As shown, the method specifically includes:

[0233] Step 901: The security task engine determines the acquired target file, namely the target file to be detected, "pom.xml".

[0234] Step 902: The security task engine detects the target file using the vulnerability library to obtain a detection result of the target file.

[0235] In this step, the security task engine can directly compare the target file with the vulnerability library to achieve the detection purpose and obtain the detection result of the target file.

[0236] In practical applications, the detection task for target file detection can further include detection rules, using which dependent files can be checked. The detection rules described here can be part of a vulnerability library, significantly narrowing the detection scope and improving detection efficiency. In this case, the detection task could be "hummer fs pom.xmlpolity4.yaml." "polity4.yaml" represents the detection rules, recorded in YAML format. This "polity4.yaml" is similar to "polity3.yaml" in the source code detection described above and will not be further described here.

[0237] By applying the method in the fifth embodiment of the method of the present application, it is possible to detect software-level detection scenarios, and use the above-mentioned detection results of source code detection, image detection, and target file detection as software-level detection results. There is no need to invade the cloud native environment for detection. In the external detection platform, the HTTPS protocol or direct upload is used to obtain the information to be detected, and detection is performed according to the vulnerability library or detection rules. In actual applications, users can also choose which types of software-level detection scenarios need to be detected through the UI, that is, they can choose any one or more of source code detection, image detection, and target file detection for detection. After the security task engine obtains the software-level detection results, it can also be visualized through the UI for administrators to view.

[0238] In response to the above-mentioned method for implementing cloud security detection, the present application also discloses a cloud security detection device. Figure 10 This is a schematic diagram of the structure of the first embodiment of the device for implementing cloud security detection in this application. Figure 10 As shown, the device includes: a user interface module 1001, a security platform 1002, and a security task engine 1003. The user interface module 1001, the security platform module 1002, and the security task engine module 1003 are independent of the cloud security scenario that needs to be detected. Among them, since the security platform is mainly oriented towards UI interaction, it can be generated in JAVA language, while the security task engine is mainly oriented towards the underlying logic and can be generated in Python language. Specifically:

[0239] The user interface module 1001 is used to determine the type of cloud security scenario that needs to be detected.

[0240] The security platform 1002 is used to generate a detection task according to the cloud security scenario type that needs to be detected, and issue the detection task using a command line.

[0241] The security task engine 1003 receives the detection task issued by the security platform through the interface interface; when the cloud security scenario type is a hybrid cloud-level detection scenario, the detection information returned by the hybrid cloud is obtained according to the pre-set hybrid cloud-level detection rules and the software development tool kit SDK corresponding to the hybrid cloud to determine the detection result of the hybrid cloud level; when the cloud security scenario type is a cloud native-level detection scenario, the cloud native-level detection scenario is detected according to the pre-set cloud native-level detection rules to determine the detection result of the cloud native level; when the cloud security scenario type is a software-level detection scenario, the software-level detection scenario is detected according to the pre-set software-level detection rules to determine the detection result of the software level.

[0242] That is, the user uses the user interface module 1001 to determine the type of cloud security scenario to be tested. The security platform 1002 obtains the type of cloud security scenario to be tested, generates a test task based on the type of cloud security scenario to be tested, and issues the test task to the security task engine 1003 using a command line. The security task engine 1003 receives the test task issued by the security platform 1002 through an interface. The security task engine 1003 executes the test task according to the following three scenarios: 1) If the cloud security scenario type is a hybrid cloud-level test scenario, the security task engine 1003 obtains the test information returned by the hybrid cloud using the hybrid cloud's corresponding software development kit (SDK) according to pre-set hybrid cloud-level test rules to determine the hybrid cloud-level test results. 2) If the cloud security scenario type is a cloud native-level test scenario, the cloud native-level test scenario is tested according to the pre-set cloud native-level test rules to determine the cloud native-level test results. 3) If the cloud security scenario type is a software-level test scenario, the software-level test scenario is tested according to the pre-set software-level test rules to determine the software-level test results.

[0243] The embodiments of the present application divide the objects that need to be detected into three major scenarios: detection scenarios at the hybrid cloud level, detection scenarios at the cloud native level, and detection scenarios at the software level. Among them, the detection scenarios at the hybrid cloud level are detections of cloud resources in various third-party cloud systems, the detection scenarios at the cloud native level are detections of clusters and containers in the cloud system itself, and the detection scenarios at the software level are detections of software in the cloud system itself. In the same detection method of the embodiments of the present application, one or more scenarios that need to be detected can be arbitrarily specified, and detection can be performed separately according to the specified scenarios to achieve the purpose of comprehensive detection of all levels of cloud security.

[0244] like Figure 11 As shown, the internal structure of the security task engine 1003 may include: a task receiving module 1004, a hybrid cloud-level detection scenario processing module 1005, a cloud-native-level detection scenario processing module 1006, and a software-level detection scenario processing module 1007.

[0245] The task receiving module 1004 is used to receive the detection task issued by the security platform 1002 through the interface.

[0246] The hybrid cloud level detection scenario processing module 1005 is used when the cloud security scenario type is a hybrid cloud level detection scenario. It obtains the detection information returned by the hybrid cloud according to the pre-set hybrid cloud level detection rules and the software development kit SDK corresponding to the hybrid cloud to determine the detection results of the hybrid cloud level.

[0247] The cloud native level detection scenario processing module 1006 is used to detect the cloud native level detection scenario according to the pre-set cloud native level detection rules when the cloud security scenario type is a cloud native level detection scenario to determine the cloud native level detection result.

[0248] The software-level detection scenario processing module 1007 is configured to detect the software-level detection scenario according to pre-set software-level detection rules to determine the software-level detection result.

[0249] In other embodiments, the hybrid cloud layer detection scenario processing module 1005 obtains detection information returned by the hybrid cloud through the SDK corresponding to the hybrid cloud according to pre-set hybrid cloud layer detection rules to determine the hybrid cloud layer detection result. This can be implemented as follows:

[0250] 1) Detection of Hybrid Cloud Level The scene processing module 1005 determines all single clouds included in the hybrid cloud, where a single cloud is a separate cloud.

[0251] 2) The hybrid cloud-level detection scenario processing module 1005 executes the following steps for each of the single clouds: SDK authentication is performed on the single cloud according to the cloud account of the single cloud set in advance; the SDK interface corresponding to the single cloud is called using the detection rules corresponding to the single cloud set in advance as parameters, and the detection rules corresponding to the single cloud belong to the detection rules at the hybrid cloud level; and the detection information returned by the single cloud is received as the detection result of the single cloud.

[0252] 3) Hybrid cloud level detection The scene processing module 1005 combines the detection information returned by all single clouds as the hybrid cloud level detection result.

[0253] The detection of the hybrid cloud layer can also refer to the solution of the third embodiment of the above method, which will not be repeated here. In short, the hybrid cloud layer detection scene processing module 1005 detects the detection scene of the hybrid cloud layer without intruding into the internal part of the hybrid cloud for detection. Instead, it uses the SDK interface to call, thereby achieving the purpose of non-intrusive detection. In addition, after the hybrid cloud layer detection scene processing module 1005 obtains the hybrid cloud layer detection results, it can also be visualized through the UI for easy viewing by the administrator.

[0254] In other embodiments, the cloud-native-level detection scenario processing module 1006 detects the cloud-native-level detection scenario according to pre-set cloud-native-level detection rules to determine the cloud-native-level detection result. This can be achieved as follows:

[0255] 1) When the cloud-native-level detection scenario processing module 1006 determines that the cloud-native-level detection is host detection according to the detection task, it connects to the host to be detected according to the secure shell protocol SSH, detects the host using the pre-set host detection rules, and obtains the host detection results returned by the host through the HTTPS protocol; the host belongs to the host in the cloud-native-level detection scenario, and the host detection rules belong to the cloud-native-level detection rules.

[0256] 2) When the cloud-native-level detection scenario processing module 1006 determines that the detection task is K8s detection, it establishes an HTTPS connection with the K8s environment to be detected according to the pre-set K8s address, and after authentication according to the pre-set first token, it uses the obtained vulnerability library to detect the K8s environment, and obtains K8s vulnerability information and K8s configuration audit information. The K8s vulnerability information and K8s configuration audit information serve as the detection results of K8s detection; K8s belongs to the K8s in the cloud-native-level detection scenario, the K8s vulnerability information indicates whether there are vulnerabilities in the K8s environment, and the K8s configuration audit information indicates whether there are problems with the K8s environment configuration.

[0257] 3) When the cloud-native level detection scenario processing module 1006 determines that the detection task is K8s deployment detection, it determines the obtained K8s deployment file, uses the vulnerability library to detect the K8s deployment file, and obtains the detection result of the K8s deployment detection; the K8s deployment file represents the relevant information for the deployment of the K8s environment.

[0258] 4) When the cloud-native-level detection scenario processing module 1006 determines that the detection task is image detection, it establishes an HTTPS connection with the address of the pre-set image file to obtain the image file, uses the vulnerability library to detect the image file, and obtains the detection result of the image detection; the image file is the image file in the cloud-native-level detection scenario.

[0259] For cloud native level detection, please refer to the fourth embodiment of the above method, which will not be described here. In short, the cloud native level detection scenario processing module 1006 can realize the detection of cloud native level detection scenarios. The cloud native level detection scenario processing module 1006 uses the above-mentioned host detection results, K8s detection results, K8s deployment detection results and image detection results as cloud native level detection results. There is no need to invade the cloud native environment for detection. In the external detection platform, SSH protocol, HTTPS protocol or direct upload are used to obtain the information to be detected, and detection is performed according to the vulnerability library or host. In actual application, the user can also choose which types of cloud native level detection scenarios need to be detected through the UI, that is, any one or more of the above-mentioned host detection, K8s detection, K8s deployment detection and image detection can be selected for detection. In addition, after the cloud native level detection scenario processing module 1006 obtains the cloud native level detection results, it can also be visualized through the UI for administrators to view.

[0260] In other embodiments, the software-level detection scenario processing module 1007 detects the software-level detection scenario according to pre-set software-level detection rules to determine the software-level detection result, which can be implemented as follows:

[0261] 1) When the software-level detection scenario processing module 1007 determines that the detection task is source code detection, it establishes the HTTPS connection with the pre-set source code warehouse address to obtain the dependent files to be detected in the source code, uses the vulnerability library to detect the dependent files, and obtains the detection results of the source code detection; the dependent file represents a file that records the dependency relationship contained in the source code.

[0262] 2) When the software-level detection scenario processing module 1007 determines that the detection task is image detection, it establishes an HTTPS connection with the address of the pre-set image file to obtain the image file, uses the vulnerability library to detect the image file, and obtains the detection result of the image detection; the image file is the image file in the cloud-native level detection scenario.

[0263] 3) When the detection scenario processing module 1007 at the software level determines the target file to be detected according to the detection task, it determines the acquired target file, detects the target file using the vulnerability library, and obtains the detection result of the target file detection; the target file is a file that needs to be detected that is different from the dependent file.

[0264] For software-level detection, please refer to the fifth embodiment of the above method, which will not be described here. In short, the software-level detection scenario processing module 1007 can realize the detection of software-level detection scenarios, and use the detection results of the above-mentioned source code detection, image detection and target file detection as the detection results of the software level, without invading the cloud native environment for detection. In the external detection platform, the HTTPS protocol or direct upload is used to obtain the information to be detected, and the detection is performed according to the vulnerability library or detection rules. In actual applications, users can also choose which types of software-level detection scenarios need to be detected through the UI, that is, they can choose any one or more of source code detection, image detection and target file detection for detection. After the software-level detection scenario processing module 1007 obtains the software-level detection results, it can also be visualized through the UI for easy viewing by administrators.

[0265] In other method embodiments, after obtaining the detection results, the hybrid cloud-level detection scenario processing module 1005, the cloud-native-level detection scenario processing module 1006, and the software-level detection scenario processing module 1007 can also return the detection results to the security platform 1002, and the security platform 1002 will visualize them through the user interface module 1001 for easy viewing by administrators.

[0266] The present application also provides a computer-readable medium that stores instructions that, when executed by a processor, can perform the steps in the cloud security detection method described above. In practical applications, the computer-readable medium can be included in the device / apparatus / system described in the above embodiments, or it can exist independently without being assembled into the device / apparatus / system. The computer-readable storage medium carries one or more programs, and when the one or more programs are executed, the cloud security detection method described in each of the above embodiments can be implemented. According to the embodiments disclosed in the present application, the computer-readable storage medium can be a non-volatile computer-readable storage medium, for example, including but not limited to: a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above, but is not intended to limit the scope of protection of the present application. In the embodiments disclosed in the present application, the computer-readable storage medium can be any tangible medium that contains or stores a program that can be used by or in conjunction with an instruction execution system, apparatus, or device.

[0267] An embodiment of the present application further provides a computer program product, which includes computer instructions. When the computer instructions are executed by a processor, the method described in any of the above embodiments is implemented.

[0268] The flowcharts and block diagrams in the accompanying drawings of the present application show the possible implementation architecture, functions and operations of the systems, methods and computer program products according to the various embodiments disclosed in the present application. In this regard, each box in the flowchart or block diagram can represent a module, program segment, or a part of code, and the above-mentioned module, program segment, or a part of code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in the order of the standards in different figures. For example, the boxes represented by two connections can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram or flowchart, and the combination of the boxes in the block diagram or flowchart, can be implemented by a dedicated hardware-based system that performs the specified function or operation, or can be implemented by a combination of dedicated hardware and computer instructions.

[0269] Those skilled in the art will appreciate that the features described in the various embodiments and / or claims of this disclosure may be combined and / or coupled in various ways, even if such combinations and / or couplings are not explicitly described in this application. In particular, without departing from the spirit and teachings of this application, the features described in the various embodiments and / or claims of this application may be combined and / or coupled in various ways, and all such combinations and / or couplings fall within the scope of this application.

[0270] The principles and implementation methods of the present invention are described herein using specific embodiments. The description of the above embodiments is only used to help understand the method of the present invention and its core ideas, and is not intended to limit this application. For those skilled in the art, changes can be made in the specific implementation methods and application scope based on the ideas, spirit and principles of the present invention. Any modifications, equivalent replacements, improvements, etc. made therein should be included within the scope of protection of this application.

Claims

1. A cloud security detection method, characterized in that: The method includes: The security platform obtains the type of cloud security scenario that needs to be detected through the user interface UI; the security platform generates a detection task based on the type of cloud security scenario that needs to be detected and issues the detection task using a command line; the security task engine receives the detection task issued by the security platform through an interface; the user interface UI, the security platform, and the security task engine are independent of the cloud security scenario that needs to be detected; Determine the types of cloud security scenarios that need to be tested; When the cloud security scenario type is a hybrid cloud-level detection scenario, the detection information returned by the hybrid cloud is obtained through the software development kit SDK corresponding to the hybrid cloud according to the pre-set hybrid cloud-level detection rules to determine the detection result of the hybrid cloud level; When the cloud security scenario type is a cloud native layer detection scenario, the cloud native layer detection scenario is detected according to the pre-set cloud native layer detection rules to determine the cloud native layer detection result; When the cloud security scenario type is a software-level detection scenario, the software-level detection scenario is detected according to pre-set software-level detection rules to determine the software-level detection result.

2. The method according to claim 1, characterized in that The step of obtaining detection information returned by the hybrid cloud through a software development kit (SDK) corresponding to the hybrid cloud according to pre-set hybrid cloud layer detection rules to determine the hybrid cloud layer detection result includes: The security task engine determines all single clouds included in the hybrid cloud, where the single cloud is a separate cloud; The security task engine performs the following steps for each single cloud: performing SDK authentication on the single cloud according to the pre-set cloud account of the single cloud; calling the SDK interface corresponding to the single cloud using the pre-set detection rules corresponding to the single cloud as parameters, where the detection rules corresponding to the single cloud belong to the detection rules of the hybrid cloud layer; receiving the detection information returned by the single cloud as the detection result of the single cloud; The security task engine combines the detection information returned by all the single clouds as a detection result at the hybrid cloud level.

3. The method according to claim 1, characterized in that The step of detecting the cloud native layer detection scenario according to the pre-set cloud native layer detection rules to determine the cloud native layer detection result includes: When the security task engine determines, based on the detection task, that the cloud-native-level detection is host detection, it connects to the host to be detected using the secure shell protocol (SSH), detects the host using pre-set host detection rules, and obtains the host detection result returned by the host through the HTTPS protocol; the host belongs to the host in the detection scenario of the cloud-native-level, and the host detection rule belongs to the detection rule of the cloud-native-level; When the security task engine determines that the detection task is K8s detection, it establishes an HTTPS connection with the K8s environment to be detected according to the pre-set K8s address, and after authentication according to the pre-set first token, it uses the obtained vulnerability library to detect the K8s environment, and obtains K8s vulnerability information and K8s configuration audit information. The K8s vulnerability information and K8s configuration audit information serve as the detection result of the K8s detection; the K8s belongs to the K8s in the detection scenario of the cloud native level, the K8s vulnerability information indicates relevant information about whether the K8s environment has vulnerabilities, and the K8s configuration audit information indicates relevant information about whether there are problems with the K8s environment configuration; When the security task engine determines that the detection task is K8s deployment detection, it determines the acquired K8s deployment file, detects the K8s deployment file using the vulnerability library, and obtains the detection result of the K8s deployment detection; the K8s deployment file represents relevant information for deployment of the K8s environment; When the security task engine determines that the detection task is image detection, it establishes the HTTPS connection with the address of the pre-set image file to obtain the image file, and detects the image file using the vulnerability library to obtain the detection result of the image detection; the image file is the image file in the detection scenario at the cloud native level; The security task engine uses the detection results of the host detection, the detection results of the K8s detection, the detection results of the K8s deployment detection, and the detection results of the image detection as the detection results of the cloud native level.

4. The method according to claim 1, wherein The step of detecting the software-level detection scenario according to the pre-set software-level detection rules to determine the software-level detection result includes: When the security task engine determines that the detection task is source code detection, it establishes an HTTPS connection with a pre-set source code repository address to obtain dependent files to be detected in the source code, detects the dependent files using a vulnerability library, and obtains detection results of the source code detection; the dependent files are files that record the dependency relationships contained in the source code; When the security task engine determines that the detection task is image detection, it establishes the HTTPS connection with the address of the pre-set image file to obtain the image file, and detects the image file using the vulnerability library to obtain the detection result of the image detection; the image file is the image file in the detection scenario at the cloud native level; When the security task engine determines that the detection task is a target file detection, it determines the acquired target file, detects the target file using the vulnerability library, and obtains a detection result of the target file detection; the target file is a file that needs to be detected that is different from the dependent file; The security task engine uses the detection results of the source code detection, the detection results of the image detection, and the detection results of the target file detection as the detection results of the software level.

5. The method according to any one of claims 1 to 4, characterized in that After determining the detection result, the method further includes: The security task engine returns the detection results of any combination of the hybrid cloud layer detection results, the cloud native layer detection results, and the software layer detection results to the security task engine, which is then visually displayed by the security task engine through the UI.

6. A cloud security detection device, characterized in that: The device includes: a user interface module, a security platform, and a security task engine. The user interface module, the security platform module, and the security task engine module are independent of the cloud security scenario to be detected; wherein: The user interface module is used to determine the type of cloud security scenario that needs to be detected; The security platform is used to generate a detection task according to the type of cloud security scenario that needs to be detected, and issue the detection task using a command line; The security task engine receives the detection task issued by the security platform through the interface; when the cloud security scenario type is a hybrid cloud-level detection scenario, the detection information returned by the hybrid cloud is obtained according to the pre-set hybrid cloud-level detection rules and the software development tool kit SDK corresponding to the hybrid cloud to determine the detection result of the hybrid cloud level; when the cloud security scenario type is a cloud native-level detection scenario, the cloud native-level detection scenario is detected according to the pre-set cloud native-level detection rules to determine the detection result of the cloud native level; when the cloud security scenario type is a software-level detection scenario, the software-level detection scenario is detected according to the pre-set software-level detection rules to determine the detection result of the software level.

7. A computer-readable storage medium having computer instructions stored thereon, characterized in that: When the instructions are executed by a processor, the steps of the cloud security detection method according to any one of claims 1 to 5 can be implemented.

8. A computer program product, comprising computer instructions, wherein when executed by a processor, the computer instructions implement the cloud security detection method according to any one of claims 1 to 5.

Images