A cloud environment traffic visualization monitoring method and device

Abstract

The application discloses a flow visualization monitoring method in a cloud environment, and the method comprises the following steps: obtaining full flow in the cloud environment and time stamps of the flow by mirroring all virtual instance flows in the cloud environment; removing the full flow; classifying the removed full flow according to classification rules; determining the topological relationship of each classified flow by using a visualization algorithm on the five-tuple information and the time stamps of the classified full flow; storing the five-tuple information, the time stamps, the topological relationship of the classified full flow and the corresponding visualization parameters of each classification in a pre-set storage structure; and visualizing the classified full flow according to the topological relationship of each classified flow and the corresponding visualization parameters of each classified flow. The application also discloses a flow visualization monitoring device in a cloud environment. The application can realize the visualization monitoring of the flow in the cloud environment.

Description

Technical Field

[0001] This invention relates to the field of security in the mobile communications industry, and more specifically, to mobile communication network traffic monitoring technology. Background Technology

[0002] Cloud technology is now used in various environments. Unlike traditional physical networks, virtualized instances transmit data through virtual networks. In this case, data transmission between virtual instances may be completed locally. Traditional protection methods are basically ineffective in the cloud environment. Therefore, how to monitor and control traffic in the cloud is an important part of cloud security.

[0003] Traditional physical networks are layered with clearly defined security domains, and network traffic is relatively homogeneous. However, with the advancement of attack techniques and the increasing organization and militarization of attackers, more and more attacks originate from within the system. Attackers use social engineering and other methods to implant malicious code into the system to launch further attacks. Traditional security devices generate traffic information into logs for administrators to process, which wastes a significant amount of time on path analysis and traffic routing, severely slowing down threat handling efficiency.

[0004] Therefore, a visual traffic monitoring technology is needed that can clearly display network traffic, enabling administrators to have a more intuitive understanding of the traffic situation within the network. Summary of the Invention

[0005] This invention provides a method for visual monitoring of traffic in a cloud environment, the method comprising:

[0006] The full traffic within the cloud environment, along with its timestamps, is obtained by mirroring the traffic of all virtual instances within the cloud environment.

[0007] The entire traffic is deduplicated, and the deduplicated entire traffic is classified according to classification rules;

[0008] The categorized full traffic quintuple information and timestamps are used to determine the topological relationship of each category of traffic through a visualization algorithm, and the categorized full traffic quintuple information, timestamps, topological relationships and corresponding visualization parameters of each category are stored in a pre-set storage structure;

[0009] Based on the topological relationships of each traffic category and the corresponding visualization parameters of each traffic category, the classified full traffic is visualized.

[0010] The specific classification rules are as follows:

[0011] Based on traffic type, the total traffic is divided into business traffic, management traffic, and abnormal traffic;

[0012] The abnormal traffic was further categorized based on the type of threat.

[0013] Preferably, the method further includes:

[0014] Obtain the abnormal traffic information that needs to be processed from the storage structure;

[0015] Based on the type of abnormal traffic information, corresponding firewall blocking, traffic monitoring, and honeypot inducement are performed on the abnormal traffic information.

[0016] Furthermore, the step of determining the topological relationship of each category of traffic by using a visualization algorithm to obtain the full traffic 5-tuple information and timestamps of each category in the storage structure specifically involves:

[0017] Based on the source IP address, source port, destination IP address, destination port, and transport layer protocol of the full traffic 5-tuple information for each category, and combined with the timestamp of each category of traffic, the topology of each category of traffic is determined.

[0018] Further:

[0019] The pre-configured storage structure includes five-tuple information, timestamps, topology relationships, visualization parameters, and callable interfaces for each category of the full traffic.

[0020] The visualization parameters include the appearance parameters and business parameters presented for each category.

[0021] This invention also discloses a cloud environment traffic visualization monitoring device, the device comprising:

[0022] The traffic acquisition module is used to acquire the total traffic in the cloud environment by mirroring the traffic of all virtual instances in the cloud environment;

[0023] The data management module is used to deduplicate the full traffic acquired by the traffic acquisition module and classify the deduplicated full traffic according to classification rules.

[0024] The visualization algorithm module is used to determine the topological relationship of each category of traffic by using the full traffic five-tuple information and timestamps classified by the data management module through a visualization algorithm.

[0025] The data storage module is used to store the topological relationships of each category of traffic determined by the visualization module, and the full traffic five-tuple information, timestamps, topological relationships, and corresponding visualization parameters of each category after classification by the data management module in a pre-set storage structure.

[0026] The visualization module is used to visualize the classified full traffic based on the topological relationship of each category of traffic and the corresponding visualization parameters of each category of traffic.

[0027] Specifically, the data management module further includes:

[0028] The data deduplication module is used to deduplicatize the full traffic acquired by the traffic acquisition module;

[0029] The data classification module is used to classify the full traffic deduplicated by the data deduplication module according to classification rules;

[0030] The specific classification rules are as follows:

[0031] Based on traffic type, the total traffic is divided into business traffic, management traffic, and abnormal traffic;

[0032] The abnormal traffic was further categorized based on the type of threat.

[0033] Preferably, the device further comprises:

[0034] Abnormal traffic processing module: used to obtain abnormal traffic information that needs to be processed from the data storage module, redirect the abnormal traffic information according to the type of abnormal traffic information, and process the redirected traffic by the security resource pool, including firewall blocking, traffic monitoring and honeypot induction;

[0035] The abnormal traffic processing module is deployed in an independent security resource pool, and abnormal traffic is processed locally through the security resource pool.

[0036] Further:

[0037] The visualization algorithm module determines the topology of each traffic category based on the source IP address, source port, destination IP address, destination port, and transport layer protocol of the full traffic quintuple information for each category, combined with the timestamp of each category's traffic.

[0038] Further:

[0039] The pre-configured storage structure includes five-tuple information, timestamps, topology relationships, visualization parameters, and callable interfaces for each category of the full traffic.

[0040] The visualization parameters include the appearance parameters and business parameters presented for each category.

[0041] As can be seen from the above technical solutions, the cloud environment traffic visualization monitoring method and device disclosed in this invention provides centralized monitoring and processing of cloud traffic. Since it does not require deploying a virtual firewall on the business host, but only an Agent for traffic mirroring, it does not affect the performance of the business host; using a separate security resource pool to process traffic fully utilizes the host's computing resources while enabling the use of complex security functions; the traffic visualization module processes the collected traffic and presents it to the user graphically. Attached Figure Description

[0042] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0043] Figure 1 A flowchart illustrating a visual monitoring method in a cloud environment provided by an embodiment of the present invention;

[0044] Figure 2 This is a flowchart of the method provided in Embodiment 2 of the present invention;

[0045] Figure 3 This is a structural diagram of a cloud-based visualization monitoring device provided in Embodiment 3 of the present invention;

[0046] Figure 4 This is a detailed structural diagram of the device provided in Embodiment 4 of the present invention. Detailed Implementation

[0047] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0048] Please see Figure 1 The present invention provides an embodiment one, such as... Figure 1 As shown, the present invention provides a detailed method for visual monitoring of traffic in a cloud environment, comprising the following steps:

[0049] Step S1: Obtain the total traffic in the cloud environment and the timestamp of the traffic by mirroring the traffic of all virtual instances in the cloud environment.

[0050] Step S2: Deduplicate the full traffic and classify the deduplicated full traffic according to the classification rules.

[0051] Based on traffic type, the total traffic is divided into business traffic, management traffic, and abnormal traffic;

[0052] The abnormal traffic was further categorized based on the type of threat.

[0053] Step S3: The categorized full traffic quintuple information and timestamps are used to determine the topological relationship of each category of traffic through a visualization algorithm, and the categorized full traffic quintuple information, timestamps, topological relationships and corresponding visualization parameters of each category are stored in a pre-set storage structure.

[0054] Step S4: Based on the topological relationship of each category of traffic and the corresponding visualization parameters of each category of traffic, visualize the classified full traffic.

[0055] To further process abnormal traffic in traffic classification, this application preferably also includes:

[0056] Step S5: Obtain the abnormal traffic information that needs to be processed from the storage structure.

[0057] Step S6: Based on the type of abnormal traffic information, perform corresponding firewall blocking, traffic monitoring, and honeypot inducement on the abnormal traffic information.

[0058] This application mirrors traffic from virtual instances without impacting the performance of the business host. It categorizes traffic into different types: business traffic, management traffic, and abnormal traffic. Based on timestamps and 5-tuple information, it determines the traffic topology and visualizes this topology. Through a series of visualization operations, it helps administrators monitor network conditions at all times, achieving the goal of visualized monitoring of cloud traffic.

[0059] For a second embodiment of the present invention, please refer to the appendix. Figure 2 This section details how to perform visual monitoring of traffic within a cloud environment.

[0060] Step S21: Obtain the total traffic in the cloud environment and the timestamp of the traffic by mirroring the traffic of all virtual instances in the cloud environment.

[0061] The method for obtaining traffic mirroring is as follows:

[0062] a. Add a virtual network adapter to the host machine and keep it in the UP state.

[0063] A dummy network interface card (NIC) is a virtual NIC that remains in an UP state regardless of network connection, functioning the same as a local NIC. Using a dummy NIC as the destination NIC for mirrored traffic allows it to continuously receive mirrored traffic.

[0064] b. Add the virtual network adapter to the bridge.

[0065] In an OpenStack environment, all virtual instances are connected to the br-int bridge. By mirroring traffic on the br-int bridge, you can capture the traffic of all virtual instances on the host machine.

[0066] c. Configure the switch to mirror the traffic of all ports on the bridge to the ports connected to the added virtual network interface card.

[0067] d. Perform packet capture on the virtual network card.

[0068] Enable the tcpdump program on the host machine environment to capture packets from dummy network cards.

[0069] e. Save the captured data packets directly as a pacp file.

[0070] Mirroring technology copies traffic and sends it to a specified port without affecting the network. This step is primarily for capturing full traffic. Using traffic redirection techniques would put pressure on the underlying network and create potential points of failure. Therefore, the significance of full traffic mirroring is that mirroring all virtual instances ensures sufficient data sources for analysis. Mirroring at OVS is performed because a large portion of traffic in the virtual environment bypasses the core switch, communicating through underlying switches and even host memory. Therefore, mirroring traffic at the core switch would be a significant bottleneck. Since all virtual instances are connected to OVS, only by performing traffic mirroring at OVS can full traffic capture be guaranteed.

[0071] The generated PCAP file is uploaded to the data management module (which can be a big data platform) via a Hadoop client and interacts with it via the TCP / IP protocol.

[0072] Step S22: Deduplicate the full traffic and classify the deduplicated full traffic into business traffic, management traffic, and abnormal traffic according to the classification rules.

[0073] For the traffic information data that is mainly processed, which is characterized by large data volume and simple format, Hadoop is the preferred choice as the processing engine.

[0074] Deduplication refers to removing duplicate data packets.

[0075] Classification refers to dividing the deduplicated data packets into three categories:

[0076] Business traffic: This is user-defined traffic. The system provides users with a business traffic definition function, and the system will classify the defined business traffic content.

[0077] Management traffic: Telnet, SSH, HTTP, and HTTPS traffic. The system will compare the above types of traffic with the 4A access logs and bastion host logs. Only access traffic that can be found by 4A is considered normal management traffic. Traffic that cannot be found by 4A is classified as abnormal traffic.

[0078] Abnormal traffic: Traffic after removing business traffic and management traffic.

[0079] The steps for processing the full traffic information are as follows:

[0080] (1) Deduplicate the traffic content in the received PCAP file and merge the deduplicated traffic information into a new PCAP file (deduplicated.pacp).

[0081] (2) Perform secondary processing on the deduplicated PCAP files and classify the traffic information in the PCAP files according to the classification rules.

[0082] (3) Business traffic and management traffic will directly store the classified traffic 5-tuple information into the storage structure, without saving the binary code stream information of business traffic and management traffic.

[0083] (4) The binary bitstream information of abnormal traffic will generate a new PCAP file (abnormal.pacp).

[0084] Step S23: Reclassify the abnormal traffic according to the threat type.

[0085] The abnormal traffic is further classified using a combination of sandbox software analysis and IDS feature analysis. Sandbox analysis categorizes the abnormal traffic into several types, including scanners, backdoors, Trojans, worms, and normal programs. IDS feature analysis analyzes network traffic based on its characteristics and generates results, including attack type, source address, destination address, and threat level.

[0086] After analyzing the traffic using sandbox software combined with IDS (Internet Data Center) signature analysis, the traffic was categorized into several main types: scanners, backdoors, Trojans, worms, and DDoS attacks. The remaining abnormal logins and accesses refer to login and access behaviors outside of management and business traffic, respectively. These two types of behaviors are potential threats and require continuous monitoring.

[0087] Abnormal traffic will ultimately be categorized into seven subtypes: scanners, backdoors, Trojans, worms, DDoS attacks, abnormal logins, and abnormal access. Due to the high traffic volume in the cloud environment, physical servers are used to provide services and load balancing is enabled to distribute the load and improve processing efficiency, ensuring performance and reliability.

[0088] Step S24: Based on the source IP address, source port, destination IP address, destination port and transport layer protocol of the full traffic 5-tuple information of each category, and combined with the timestamp of each category of traffic, determine the topology of each category of traffic.

[0089] Step S25: Store the classified full traffic quintuple information, timestamp, topology relationship, and corresponding visualization parameters of each classification in a pre-set storage structure.

[0090] The pre-configured storage structure includes five-tuple information, timestamps, topology relationships, visualization parameters, and callable interfaces for each category of the full traffic.

[0091] The visualization parameters include the appearance parameters and business parameters presented for each category.

[0092] The storage structure for traffic classification mainly includes:

[0093] Business traffic: Traffic type, system name, traffic path

[0094] Traffic management: Traffic type, user, management path

[0095] Abnormal traffic: protocol, threat type, name, threat path, severity, impact.

[0096] The five-tuple information stored in the storage structure mainly includes: source IP address, source port, destination IP address, destination port, and transport layer protocol.

[0097] The appearance parameters saved in the storage structure are mainly used to display the visual appearance, such as the style of the displayed nodes, the width and color of the connections, the font color and size, and other natural attributes.

[0098] The storage structure stores business parameters that are related to the business, such as the layer attributes of each link, the two endpoints, grouping, and location information.

[0099] The topology stored in the storage structure is obtained by combining the traffic's five-tuple information with timestamps through a topology algorithm. The topology is determined based on information such as the source node IP and destination node IP. It mainly includes information related to the topology relationship, such as the nodes, parent nodes, network type, group, and service.

[0100] Step S26: Based on the topological relationship of each category of traffic and the corresponding visualization parameters of each category of traffic, visualize the classified full traffic.

[0101] After the traffic information is visualized, it can be displayed on the front-end page, and users can view the traffic directly.

[0102] Step S27: Obtain the abnormal traffic information that needs to be processed from the storage structure.

[0103] Step S28: Based on the type of the abnormal traffic information, redirect the abnormal traffic information to the security resource pool for processing, including firewall blocking, traffic monitoring, and honeypot induction.

[0104] Abnormal traffic information is diverted and processed by the abnormal traffic information processing module. To ensure the independence of abnormal traffic processing, it is usually deployed in a separate resource pool, which is called the security resource pool. Therefore, the security resource pool is a logical concept, referring to a group of servers used to deploy abnormal traffic processing.

[0105] Users can directly view abnormal traffic displayed on the front end and decide how to handle it. There are three handling methods: blocking, monitoring, and honeypotting. The specific method used depends on the execution script definition. When a user clicks to handle traffic, traffic can be redirected to the appropriate processing module for processing. There are three main methods for redirecting traffic:

[0106] By using the API interface of the operation and management platform, the cloud management platform can be used to drive traffic.

[0107] Traffic is manually generated through work order systems, emails, messages, or other means.

[0108] Traffic can be redirected through other systems.

[0109] The handling of abnormal traffic mainly includes blocking (firewall blocking), monitoring, and honeypot handling.

[0110] Firewall blocking: Blocks attack traffic, providing only Layer 3-4 network packet blocking, i.e., matching traffic using a 5-tuple (source address, source port, destination address, destination port, protocol). Matched traffic will be dropped by the firewall module and logged.

[0111] Monitoring and Processing: Traffic can be monitored, including management traffic such as Telnet and SSH, as well as HTTP and HTTPS traffic. For Telnet and HTTP traffic, data packets are directly cached in the corresponding processing module, then disassembled and analyzed to interpret the commands. For SSH and HTTPS traffic, the processing module masquerades as the target IP address. All SSH and HTTPS traffic from the terminal to the destination is terminated by the processing module before being forwarded to the destination address. Simultaneously, to read the operation information in SSH and HTTPS traffic, a certificate is generated to replace the destination system certificate and sent to the terminal. The terminal uses this certificate for encryption, thus enabling the monitoring of operation commands.

[0112] Honeypot processing: It disguises itself as the target system, replacing the attacked target system. When an attack is launched, the attack traffic will be diverted to the honeypot. The honeypot will simulate the response of the real target system, making the attacker believe that the attack has been successful. The honeypot will record information such as attack methods and attack payloads for use by the threat analysis module.

[0113] The three preferred processing modes can be learned by AI to improve the efficiency of threat identification.

[0114] The preferred approach is to use an NFV architecture for threat handling, which can enable or disable security features as needed, and scale security capabilities up or down based on load.

[0115] In summary, this invention provides a clear and comprehensive visualization of all traffic. Running all security capabilities on independent resource pools ensures efficient utilization of computing resources. The lightweight program running on the business host reduces resource consumption. This truly achieves visualized monitoring of traffic within the cloud environment.

[0116] This invention also discloses a cloud environment traffic visualization monitoring device, and Embodiment 3 is given below, in conjunction with the appendix. Figure 3 The structure of the device is described in detail:

[0117] Traffic acquisition module 1 is used to acquire the total traffic in the cloud environment by mirroring the traffic of all virtual instances in the cloud environment.

[0118] Data management module 2 is used to deduplicate the full traffic acquired by the traffic acquisition module and classify the deduplicated full traffic according to classification rules.

[0119] The visualization algorithm module 3 is used to determine the topological relationship of each category of traffic by using the visualization algorithm to analyze the full traffic quintuple information and timestamps classified by the data management module.

[0120] The data storage module 4 is used to store the topological relationships of each category of traffic determined by the visualization module, the full traffic five-tuple information, timestamps, topological relationships, and corresponding visualization parameters of each category after classification by the data management module in a pre-set storage structure.

[0121] The visualization module 5 is used to visualize the classified full traffic based on the topological relationship of each category of traffic and the corresponding visualization parameters of each category of traffic.

[0122] To better illustrate the structure and working principle of each module, Embodiment 4 of this application is given below, in conjunction with the appendix. Figure 4 Detailed explanation:

[0123] Traffic acquisition module 1 is used to acquire the total traffic in the cloud environment by mirroring the traffic of all virtual instances in the cloud environment.

[0124] Data Management Module 2 further includes:

[0125] The data deduplication module 21 is used to deduplicatize the full traffic acquired by the traffic acquisition module;

[0126] Data classification module 22 is used to classify the full traffic deduplicated by the data deduplication module according to classification rules;

[0127] The specific classification rules are as follows:

[0128] Based on traffic type, the total traffic is divided into business traffic, management traffic, and abnormal traffic;

[0129] The abnormal traffic was further categorized based on the type of threat.

[0130] The visualization algorithm module 3 is used to determine the topological relationship of each category of traffic by using the visualization algorithm to analyze the full traffic quintuple information and timestamps classified by the data management module.

[0131] The visualization algorithm module determines the topology of each traffic category based on the source IP address, source port, destination IP address, destination port, and transport layer protocol of the full traffic quintuple information for each category, combined with the timestamp of each category's traffic.

[0132] The data storage module 4 is used to store the topological relationships of each category of traffic determined by the visualization module, the full traffic five-tuple information, timestamps, topological relationships, and corresponding visualization parameters of each category after classification by the data management module in a pre-set storage structure.

[0133] The pre-configured storage structure includes five-tuple information for each category of the full traffic, timestamps, topology relationships, visualization parameters, and callable interfaces.

[0134] The visualization parameters include the appearance parameters and business parameters presented for each category.

[0135] The visualization module 5 is used to visualize the classified full traffic based on the topological relationship of each category of traffic and the corresponding visualization parameters of each category of traffic.

[0136] The abnormal traffic processing module 6 is used to obtain abnormal traffic information that needs to be processed from the data storage module, redirect the abnormal traffic information according to the type of the abnormal traffic information, and process the redirected traffic by the security resource pool, including firewall blocking, traffic monitoring and honeypot induction.

[0137] The abnormal traffic processing module is deployed in an independent security resource pool, and abnormal traffic is processed locally through the security resource pool.

[0138] Abnormal traffic information is diverted and processed by the abnormal traffic information processing module. To ensure the independence of abnormal traffic processing, it is usually deployed in a separate resource pool, which is called the security resource pool. Therefore, the security resource pool is a logical concept, referring to a group of servers used to deploy abnormal traffic processing.

[0139] Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the corresponding processes in the above-described device embodiments can be referred to the specific working process of the aforementioned method, and will not be repeated here.

[0140] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on its differences from other embodiments. Similar or identical parts between embodiments can be referred to interchangeably. For the apparatus disclosed in the embodiments, since they correspond to the methods disclosed in the embodiments, the description is relatively simple; relevant parts can be referred to the method section.

[0141] The steps of the methods or algorithms described in conjunction with the embodiments disclosed herein can be implemented directly by hardware, a software unit executed by a processor, or a combination of both. The software unit can be located in random access memory (RAM), main memory, read-only memory (ROM), electrically programmable ROM, electrically erasable programmable ROM, registers, hard disk, removable disk, CD-ROM, or any other form of storage medium known in the art.

[0142] The terms "first," "second," "third," "fourth," etc. (if present) in the specification, claims, and accompanying drawings are used to distinguish similar parts and are not necessarily used to describe a specific order or sequence. It should be understood that such use of data can be interchanged where appropriate so that the embodiments of this application described herein can be implemented in sequences other than those illustrated herein.

[0143] The above description of the disclosed embodiments enables those skilled in the art to make or use the invention. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the invention. Therefore, the invention is not to be limited to the embodiments shown herein, but is to be accorded the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A method for visual monitoring of traffic in a cloud environment, characterized in that, The method includes: The full traffic in the cloud environment is obtained by mirroring the traffic of all virtual instances in the cloud environment. This includes mirroring the traffic of all ports on the virtual bridge br-int on the host machine of the OpenStack environment to a pre-added dummy type virtual network interface, and capturing packets on the virtual network interface to generate a PCAP file. And the timestamp of the traffic; among them, the dummy type virtual network card will always be in a working UP state; The entire traffic is deduplicated, and the deduplicated entire traffic is classified according to classification rules; The categorized full traffic quintuple information and timestamps are used to determine the topological relationship of each category of traffic through a visualization algorithm, and the categorized full traffic quintuple information, timestamps, topological relationships and corresponding visualization parameters of each category are stored in a pre-set storage structure; Based on the topological relationship of each category of traffic and the corresponding visualization parameters of each category of traffic, the classified full traffic is visualized. The specific classification rules are as follows: Based on traffic type, the total traffic is divided into business traffic, management traffic, and abnormal traffic; The abnormal traffic was further categorized based on the threat type; Obtain the abnormal traffic information that needs to be processed from the storage structure; Based on the type of abnormal traffic information, corresponding firewall blocking, traffic monitoring, and honeypot inducement are performed on the abnormal traffic information; wherein... Firewall blocking includes: blocking attack traffic, providing Layer 3-4 network packet blocking, which involves matching traffic by source address, source port, destination address, destination port, and protocol; the matched traffic is sent to the firewall module for dropping, and logs are generated. The monitoring process includes: monitoring traffic, including management traffic such as Telnet and SSH, as well as HTTP and HTTPS traffic; for Telnet and HTTP traffic, the corresponding processing module directly caches the data packets, then performs packet disassembly and analysis to interpret the operation commands; for SSH and HTTPS traffic, the corresponding processing module masquerades as the target IP address, and all SSH and HTTPS traffic from the terminal to the target is sent to the corresponding processing module for termination, and then forwarded to the target address. Simultaneously, to read the operation information in SSH and HTTPS, a certificate is generated to replace the target system certificate and sent to the terminal. The terminal uses this certificate for encryption, thereby enabling the monitoring of operation commands. Honeypot processing includes: disguising itself as the target system, replacing the attacked target system. When an attack is launched, the attack traffic will be diverted to the honeypot, which will simulate the response of the real target system, making the attacker believe that the attack has been successful; the honeypot will record information such as attack methods and attack payloads for use by the threat analysis module.

2. The method according to claim 1, characterized in that, The specific steps of determining the topological relationship of traffic for each category by using a visualization algorithm to obtain the full traffic 5-tuple information and timestamps for each category in the storage structure are as follows: Based on the source IP address, source port, destination IP address, destination port, and transport layer protocol of the full traffic 5-tuple information for each category, and combined with the timestamp of each category of traffic, the topology of each category of traffic is determined.

3. The method according to claim 2, characterized in that: The pre-configured storage structure includes five-tuple information, timestamps, topology relationships, visualization parameters, and callable interfaces for each category of the full traffic. The visualization parameters include the appearance parameters and business parameters presented for each category.

4. A cloud environment traffic visualization monitoring device, characterized in that, The device includes: The traffic acquisition module is used to acquire the full traffic in the cloud environment by mirroring the traffic of all virtual instances in the cloud environment. This includes mirroring the traffic of all ports on the virtual bridge br-int on the host machine of the OpenStack environment to a pre-added dummy type virtual network interface, and capturing packets on the virtual network interface to generate a PCAP file. The dummy type virtual network interface will always be in a working UP state. The data management module is used to deduplicate the full traffic acquired by the traffic acquisition module and classify the deduplicated full traffic according to classification rules. The visualization algorithm module is used to determine the topological relationship of each category of traffic by using the full traffic five-tuple information and timestamps classified by the data management module through a visualization algorithm. The data storage module is used to store the topological relationships of each category of traffic determined by the visualization module, and the full traffic five-tuple information, timestamps, topological relationships, and corresponding visualization parameters of each category after classification by the data management module in a pre-set storage structure. The visualization module is used to visualize the classified full traffic based on the topological relationship of each category of traffic and the corresponding visualization parameters of each category of traffic. The data management module further includes: The data deduplication module is used to deduplicatize the full traffic acquired by the traffic acquisition module; The data classification module is used to classify the full traffic deduplicated by the data deduplication module according to classification rules; The specific classification rules are as follows: Based on traffic type, the total traffic is divided into business traffic, management traffic, and abnormal traffic; The abnormal traffic was further categorized based on the threat type; An abnormal traffic processing module is used to obtain abnormal traffic information that needs to be processed from the data storage module, redirect the abnormal traffic information according to its type, and have the redirected traffic processed by the security resource pool, including firewall blocking, traffic monitoring, and honeypot induction. The abnormal traffic processing module is deployed in a separate security resource pool, and performs abnormal traffic processing locally through the security resource pool; wherein... Firewall blocking includes: blocking attack traffic, providing Layer 3-4 network packet blocking, which involves matching traffic by source address, source port, destination address, destination port, and protocol; the matched traffic is sent to the firewall module for dropping, and logs are generated. The monitoring process includes: monitoring traffic, including management traffic such as Telnet and SSH, as well as HTTP and HTTPS traffic; for Telnet and HTTP traffic, the corresponding processing module directly caches the data packets, then performs packet disassembly and analysis to interpret the operation commands; for SSH and HTTPS traffic, the corresponding processing module masquerades as the target IP address, and all SSH and HTTPS traffic from the terminal to the target is sent to the corresponding processing module for termination, and then forwarded to the target address. Simultaneously, to read the operation information in SSH and HTTPS, a certificate is generated to replace the target system certificate and sent to the terminal. The terminal uses this certificate for encryption, thereby enabling the monitoring of operation commands. Honeypot processing includes: disguising itself as the target system, replacing the attacked target system. When an attack is launched, the attack traffic will be diverted to the honeypot, which will simulate the response of the real target system, making the attacker believe that the attack has been successful; the honeypot will record information such as attack methods and attack payloads for use by the threat analysis module.

5. The apparatus according to claim 4, characterized in that: The visualization algorithm module determines the topology of each traffic category based on the source IP address, source port, destination IP address, destination port, and transport layer protocol of the full traffic quintuple information for each category, combined with the timestamp of each category's traffic.

6. The apparatus according to claim 5, characterized in that: The pre-configured storage structure includes five-tuple information, timestamps, topology relationships, visualization parameters, and callable interfaces for each category of the full traffic. The visualization parameters include the appearance parameters and business parameters presented for each category.

Images