A cross-platform cloud resource anomaly detection method and device

Abstract

The embodiment of the present application discloses a cross-platform cloud resource anomaly detection method and device, including: periodically collecting cloud resource data of each cloud platform, formatting the cloud resource data to obtain unified format data; importing the unified format data into a pre-established data lake for data integration to obtain integrated resources; performing security vulnerability detection on the integrated resources through a trained machine learning model to obtain security vulnerability detection results, performing compliance inspection on the integrated resources through compliance inspection rules to obtain compliance inspection results; when there are security vulnerabilities in the security vulnerability detection results and / or non-compliant resources in the compliance inspection results, determining that the integrated resources are abnormal. The data of each cloud platform can be integrated, and the comprehensive detection and management of cross-cloud platform resources is realized, which improves the efficiency of security and compliance inspection of cross-cloud platform resources.

Description

Technical Field

[0001] Embodiments of the present application relate to the field of computer technology, and more particularly to a cross-platform cloud resource anomaly detection method and device. Background Art

[0002] A cloud platform is a software and hardware service platform built on cloud computing technology. It provides a reliable, flexible and scalable way to build, deploy and manage applications and services. It usually includes computing, storage, networking, database, security, analysis and other related services. These services can be accessed and managed through the Internet, and users can choose and configure them according to their needs. During the game development process, each cloud platform can provide the computing, storage, network and other resources required for the game, and can dynamically adjust the scale of resources according to the game operation needs, collect and analyze game operation data, and provide support for operational decisions and security protection measures required for operations.

[0003] In related technologies, game companies usually widely adopt multiple service providers such as Alibaba Cloud, Tencent Cloud, Google Cloud and AWS to support game development and publishing activities. Although these cloud platforms can provide flexible and scalable resources, the data formats or types of different cloud platforms are different. Therefore, the security vulnerability detection tools and compliance checking tools provided by cloud service providers can only perform security detection on their own cloud resources, and cannot cover the needs across cloud platforms. It is not conducive to the comprehensive detection of security vulnerabilities and compliance risks of cloud resources across platforms, and affects the detection efficiency. Summary of the invention

[0004] The embodiments of the present application provide a cross-platform cloud resource anomaly detection method and device, which solves the problem that when performing security inspections on cloud resources in various cloud platforms, security vulnerability detection tools and compliance checking tools cannot cover the needs of cross-cloud platforms, which is not conducive to comprehensive detection of security vulnerabilities and compliance risks of cloud resources across cloud platforms, and affects the detection efficiency. The method can integrate the data of various cloud platforms, realize comprehensive detection and management of cross-cloud platform resources, and improve the efficiency of security and compliance inspection of cross-cloud platform resources.

[0005] In a first aspect, an embodiment of the present application provides a cross-platform cloud resource anomaly detection method, including:

[0006] Periodically collect cloud resource data from each cloud platform, and format the cloud resource data to obtain data in a unified format;

[0007] Importing the unified format data into a pre-established data lake for data integration to obtain integrated resources;

[0008] Perform security vulnerability detection on the integrated resources through the trained machine learning model to obtain security vulnerability detection results, and perform compliance inspection on the integrated resources through compliance inspection rules to obtain compliance inspection results;

[0009] In the case where there is a security vulnerability in the security vulnerability detection result and / or there is a non-compliant resource in the compliance inspection result, it is determined that the integrated resource is abnormal.

[0010] Optionally, formatting the cloud resource data to obtain unified format data includes:

[0011] Formatting the cloud resource data according to a preset universal format to obtain universal resource data;

[0012] Performing format parsing on the general resource data to obtain field identifiers and field contents corresponding to the field identifiers, and filtering field contents with the same field identifier to obtain a collection of field contents;

[0013] The standard data format corresponding to the field identifier is queried in the security database, and the field content collection is formatted according to the standard data format to obtain unified format data.

[0014] Optionally, the step of importing the unified format data into a pre-established data lake for data integration to obtain integrated resources includes:

[0015] Importing the unified format data into a pre-established data lake, and determining the collection time of each field content in each field content collection in the data lake;

[0016] Determine the number of the field contents collected within a preset time according to the collection time, and when the number of the field contents collected exceeds an operation threshold, perform data integration on the field contents to obtain first integrated data;

[0017] It is identified whether sensitive information exists in the first integrated data according to a preset sensitive condition, and if the sensitive information exists, data integration is performed on the identified sensitive information to obtain second integrated data.

[0018] Optionally, the trained machine learning model performs security vulnerability detection on the integrated resources to obtain security vulnerability detection results, including:

[0019] The security verification data in the second integrated data is retrieved through the trained machine learning model, and the data complexity of the security verification data is calculated, the data complexity is compared with the security threshold, and it is determined whether there is a security vulnerability in the second integrated data based on the comparison result.

[0020] Optionally, performing compliance inspection on the integrated resource according to the compliance inspection rule to obtain a compliance inspection result includes:

[0021] Identify the operation sequence list of the second integrated data, match the operation sequence list with the compliance operation list in the compliance verification rule, and determine whether there are non-compliant resources in the second integrated data based on the matching result, wherein the operation sequence list is obtained based on the execution order of each sensitive data in the second integrated data.

[0022] Optionally, before performing compliance inspection on the integrated resource according to the compliance inspection rule, the method further includes:

[0023] Checking whether there is a rule update notification on the regulatory announcement page, and if there is the rule update notification, updating the compliance inspection rules stored in the security database to obtain updated compliance inspection rules;

[0024] Accordingly, the compliance inspection of the integrated resource by using the compliance inspection rule includes:

[0025] Compliance checks are performed on resource configurations and operation logs in the integrated resources according to the update compliance check rules.

[0026] Optionally, after determining that the integrated resource is abnormal, the method further includes:

[0027] Determine the type of security vulnerability in the security vulnerability detection result. If the type of security vulnerability is sensitive data, query the historical repair strategy data for the repair strategy associated with the sensitive data, generate a repair suggestion report according to the sensitive data and the repair strategy, and send the repair suggestion report to the client;

[0028] In the case that the type of the security vulnerability is non-sensitive data, the repair strategy associated with the security vulnerability is queried in the historical repair strategy data, and automatic repair is performed using the repair strategy.

[0029] In a second aspect, an embodiment of the present application provides a cross-platform cloud resource anomaly detection device, including:

[0030] Resource data collection module, used to periodically collect cloud resource data of each cloud platform;

[0031] A formatting module, used for formatting the cloud resource data to obtain data in a unified format;

[0032] A data integration module, used for importing the unified format data into a pre-established data lake for data integration to obtain integrated resources;

[0033] A resource detection module, used to perform security vulnerability detection on the integrated resources through the trained machine learning model to obtain security vulnerability detection results, and to perform compliance inspection on the integrated resources through compliance inspection rules to obtain compliance inspection results;

[0034] The abnormal resource determination module is used to determine that the integrated resource is abnormal when there is a security vulnerability in the security vulnerability detection result and / or there is a non-compliant resource in the compliance inspection result.

[0035] In a third aspect, an embodiment of the present application provides a cross-platform cloud resource anomaly detection device, the device comprising: one or more processors; a storage device configured to store one or more programs, when the one or more programs are executed by the one or more processors, the one or more processors implement the cross-platform cloud resource anomaly detection method described in the first aspect.

[0036] In a fourth aspect, an embodiment of the present application provides a storage medium comprising computer executable instructions, which, when executed by a computer processor, are used to execute the cross-platform cloud resource anomaly detection method as described in the first aspect.

[0037] The embodiment of the present application periodically collects cloud resource data from each cloud platform, formats the cloud resource data to obtain unified format data, imports the unified format data into a pre-established data lake for data integration to obtain integrated resources, performs security vulnerability detection on the integrated resources through the trained machine learning model to obtain security vulnerability detection results, performs compliance inspection on the integrated resources through compliance inspection rules to obtain compliance inspection results, and determines that the integrated resources are abnormal when there are security vulnerabilities in the security vulnerability detection results and / or non-compliant resources in the compliance inspection results. Among them, by formatting the collected cloud resource data in different formats, it is convenient to manage and analyze a large amount of cloud resource data, and by integrating the unified format data, the vulnerability detection tool and the compliance inspection tool can analyze and detect the data of multiple different cloud platforms at the same time, avoiding the use of different detection tools for different sources and different types of data for separate detection, and improving the efficiency of security and compliance inspection of cross-cloud platform resources. According to the machine learning model and compliance inspection rules, the integrated resources are detected for abnormality, which can avoid the problems of inaccurate manual analysis and low detection efficiency, and provide the accuracy and detection efficiency of abnormality detection. BRIEF DESCRIPTION OF THE DRAWINGS

[0038] Figure 1 It is a flow chart of a cross-platform cloud resource anomaly detection method provided by an embodiment of the present application;

[0039] Figure 2 is a flow chart of a formatting processing method provided by an embodiment of the present application;

[0040] Figure 3 is a flow chart of a data integration method provided in an embodiment of the present application;

[0041] Figure 4 It is a structural diagram of a cross-platform cloud resource anomaly detection device provided in an embodiment of the present application;

[0042] Figure 5 It is a structural diagram of a cross-platform cloud resource anomaly detection device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0043] In order to make the purpose, technical scheme and advantages of the present application clearer, the specific embodiments of the present application are further described in detail below in conjunction with the accompanying drawings. It is understood that the specific embodiments described herein are only used to explain the present application, rather than to limit the present application. It should also be noted that, for the convenience of description, only part of the present application is shown in the accompanying drawings, but not all of the content. Before discussing the exemplary embodiments in more detail, it should be mentioned that some exemplary embodiments are described as processes or methods depicted as flow charts. Although the flow chart describes each operation (or step) as a sequential process, many of the operations therein can be implemented in parallel, concurrently or simultaneously. In addition, the order of the operations can be rearranged. The process can be terminated when its operation is completed, but it can also have additional steps not included in the accompanying drawings. The process can correspond to a method, a function, a procedure, a subroutine, a subprogram, etc.

[0044] The following will be combined with the drawings in the embodiments of the present application to clearly describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, rather than all the embodiments. All other embodiments obtained by ordinary technicians in this field based on the embodiments in the present application belong to the scope of protection of this application.

[0045] The terms "first", "second", etc. in the specification and claims of the present application are used to distinguish similar objects, and are not used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable under appropriate circumstances, so that the embodiments of the present application can be implemented in an order other than those illustrated or described here, and the objects distinguished by "first", "second", etc. are generally of one type, and the number of objects is not limited. For example, the first object can be one or more. In addition, "and / or" in the specification and claims represents at least one of the connected objects, and the character " / " generally indicates that the objects associated with each other are in an "or" relationship.

[0046] The cross-platform cloud resource anomaly detection method and device provided by the embodiment of the present application are described in detail below with reference to the accompanying drawings through specific embodiments and their application scenarios.

[0047] The use scenario of the embodiment of the present application can be that a game development company collects and integrates the cloud resource data of each cloud platform monitored, and uniformly manages the integrated cloud resource data, such as performing security vulnerability detection and compliance inspection on the integrated cloud resource data, so as to avoid obtaining the security of game development data or maintenance data. Based on the above use scenario, it can be understood that the executor of this solution can be a unified management platform for cloud resource data.

[0048] Figure 1 is a flow chart of a cross-platform cloud resource anomaly detection method provided by an embodiment of the present application, such as Figure 1 As shown, including:

[0049] Step S101: periodically collect cloud resource data from each cloud platform, and format the cloud resource data to obtain data in a unified format.

[0050] In one embodiment, a cloud platform refers to a service based on hardware resources and software resources, which can provide computing, network and storage capabilities. Cloud platforms can be divided into three categories: storage-type cloud platforms mainly for data storage, computing-type cloud platforms mainly for data processing, and comprehensive cloud computing platforms that take into account both computing and data storage processing. Cloud resource data refers to data stored on a cloud platform that can be accessed and shared from any location. It has the characteristics of high scalability, high reliability, high availability and elastic billing, and is widely used in data backup and recovery, data sharing and collaboration, data analysis and mining, and application development and deployment. The cloud resource data in the cloud platform can provide support for game development and publishing activities. Formatting can refer to the unified processing of data in different formats, so that data in different formats are converted into the same format. In one embodiment, a data collection cycle is pre-set, and cloud resource data provided by each cloud platform is automatically collected in each data collection cycle, wherein the cloud resource data can be configuration parameters and operation logs, etc. Since the data formats of cloud resource data in different cloud platforms may be different, it is not convenient for the unified management platform to subsequently manage and analyze cloud resource data, so the collected cloud resource data is formatted to obtain unified format data.

[0051] Step S102: import the unified format data into a pre-established data lake for data integration to obtain integrated resources.

[0052] Among them, a data lake is a repository or system that stores data in its original format. It stores data as is without the need to structure the data in advance. The data lake can store data of various types and formats, including structured data, semi-structured data, and unstructured data, such as tables in relational databases, CSV, and logs. It supports multiple processing methods and manages the entire life cycle of data, while interacting and integrating with various external data sources to support enterprise-level application requirements. Data integration can refer to integrating all collected data into the same storage space, such as a database, storage table, etc. Data integration can also be to classify the collected data according to certain conditions, and integrate data of the same type into the same storage environment. Exemplarily, the data in a unified format is functionally parsed, and data with the same function is integrated into the same storage table.

[0053] In one embodiment, all the unified format data obtained after formatting is imported into the data lake through the ETL (Extract, Transform, Load) tool for data integration. For example, all configuration parameters in the unified format data are integrated into the same storage area, and all operation logs in the unified format data are integrated into the same storage area, and finally the integrated resources are obtained.

[0054] Step S103: Perform security vulnerability detection on the integrated resources through the trained machine learning model to obtain security vulnerability detection results, and perform compliance inspection on the integrated resources through compliance inspection rules to obtain compliance inspection results.

[0055] Among them, security vulnerability detection can be to detect whether there are abnormal patterns or potential security vulnerabilities in the integrated resources. Exemplarily, the integrated resources are scanned by a pre-trained machine learning model to identify sensitive data in the integrated resources and detect whether the sensitive data is encrypted. If encryption is not performed, it can be determined that there are security vulnerabilities in the integrated resources. Compliance inspection rules are compliance inspection standards obtained from regulatory agencies using API interfaces. Compliance inspection is used to detect whether there are illegal operations in cloud resource data. Compliance inspection can include sensitive data encryption inspection, data storage geographic location inspection, access control and authentication inspection, log and monitoring inspection, data backup and disaster recovery inspection, network security setting inspection, and compliance document and policy inspection. Exemplarily, it is checked whether specific data is stored in a specified geographic location. If it is not stored in the specified geographic location, it is determined that non-compliant resources exist in the integrated resource. It is detected whether the integrated third-party payment system or social network interface follows security best practices. If it is detected that security best practices are not followed, it is determined that non-compliant resources exist in the integrated resource. It is also checked and evaluated whether the adequacy of the backup strategy and the effectiveness of the recovery process. If the backup strategy is inadequate or the recovery process fails, it is determined that non-compliant resources exist in the integrated resource.

[0056] Step S104: When there is a security vulnerability in the security vulnerability detection result and / or there is a non-compliant resource in the compliance inspection result, it is determined that the integrated resource is abnormal.

[0057] Among them, the security vulnerability detection results may include security vulnerability data, and the type of security vulnerability data. The compliance check results may also include non-compliant data and the type of the non-compliant data. In one embodiment, if there is any security vulnerability in the security vulnerability detection results or any non-compliant resource in the compliance check results, it can be directly determined that the integrated resource is abnormal, and an alarm can be issued based on the abnormal situation of the integrated resource. In another embodiment, when the number of security vulnerabilities in the security vulnerability detection results and the number of non-compliant resources in the compliance check results are small, the detected security vulnerabilities or non-compliant resources are marked, and the integrated resource data is continuously monitored. When the monitoring reaches a preset time threshold, an alarm is issued for the abnormal situation of the integrated resource.

[0058] In the embodiment of the present application, cloud resource data of each cloud platform is periodically collected, and the cloud resource data is formatted to obtain unified format data; the unified format data is imported into a pre-established data lake for data integration to obtain integrated resources; security vulnerability detection is performed on the integrated resources through the trained machine learning model to obtain security vulnerability detection results, and compliance inspection is performed on the integrated resources through compliance inspection rules to obtain compliance inspection results; when there are security vulnerabilities in the security vulnerability detection results and / or non-compliant resources in the compliance inspection results, the integrated resource is determined to be abnormal. Among them, by formatting the collected cloud resource data in different formats, it is convenient to manage and analyze a large amount of cloud resource data, and by integrating the unified format data, the vulnerability detection tool and the compliance inspection tool can analyze and detect the data of multiple different cloud platforms at the same time, avoiding the use of different detection tools for different sources and different types of data for separate detection, and improving the efficiency of security and compliance inspection of cross-cloud platform resources. According to the machine learning model and compliance inspection rules, the integrated resources are detected for abnormality, which can avoid the problems of inaccurate manual analysis and low detection efficiency, and provide the accuracy and detection efficiency of abnormality detection.

[0059] In one embodiment, before performing compliance inspection on the integrated resource according to the compliance inspection rule, the method further includes:

[0060] Checking whether there is a rule update notification on the regulatory announcement page, and if there is the rule update notification, updating the compliance inspection rules stored in the security database to obtain updated compliance inspection rules;

[0061] Accordingly, the compliance inspection of the integrated resource by using the compliance inspection rule includes:

[0062] Compliance checks are performed on resource configurations and operation logs in the integrated resources according to the update compliance check rules.

[0063] Exemplarily, before conducting a compliance check on the integrated resources, query the current version of the regulations on the regulatory announcement page of the regulatory issuing agency, and determine whether the compliance check rules stored in the security database are the latest version of the check rules based on the current version of the regulations. If it is not the latest version of the check rules, perform a compliance check rule update operation to update the compliance check rules in the security database to the latest version. Perform compliance checks on the resource configuration and operation logs in the integrated resources based on the latest version of the compliance check rules. Optionally, check for potential security issues and violations in the resource configuration based on the latest version of the compliance check rules, such as publicly accessible storage buckets, unencrypted data transmission, etc. Check whether the configuration and management of verification log records meet the requirements based on the latest version of the compliance check rules.

[0064] As described above, by updating the compliance inspection rules before performing the compliance inspection, and performing the compliance inspection on the integrated resources based on the updated compliance inspection rules, the accuracy of the compliance inspection can be ensured.

[0065] Optionally, after determining that the integrated resource is abnormal, the method further includes:

[0066] Determine the type of security vulnerability in the security vulnerability detection result. If the type of security vulnerability is sensitive data, query the historical repair strategy data for the repair strategy associated with the sensitive data, generate a repair suggestion report according to the sensitive data and the repair strategy, and send the repair suggestion report to the client;

[0067] In the case that the type of the security vulnerability is non-sensitive data, the repair strategy associated with the security vulnerability is queried in the historical repair strategy data, and automatic repair is performed using the repair strategy.

[0068] Among them, the types of security vulnerabilities may include sensitive data vulnerabilities, network security vulnerabilities, configuration information vulnerabilities, and access operation vulnerabilities, etc. The historical repair strategy may be the historical repair data monitored by the operation and maintenance personnel when performing repair operations based on different vulnerabilities, wherein the historical repair data can indicate the repair method of the security vulnerability. The repair suggestion report may include specific security vulnerabilities and non-compliance data, as well as the repair suggestions corresponding to each security vulnerability and non-compliance data, and the causes of the security vulnerabilities and non-compliance data, etc. In one embodiment, after determining that the integrated resource is abnormal, the security vulnerability data in the security vulnerability detection result is determined to be sensitive data according to the sensitive information judgment rule. In the case that the security vulnerability data is sensitive data, the historical repair strategy corresponding to the sensitive data is queried in the historical repair strategy data, and the historical repair strategy and the sensitive data are combined to generate a repair suggestion report, and the repair suggestion report is sent to the client, so that the operation and maintenance personnel can repair the security vulnerability according to the repair suggestion received by the client. Exemplarily, if the number of digits of the detected security vulnerability data is 6-10 and contains numbers, letters and symbols, then according to the sensitive information judgment rules, it can be judged that the security vulnerability data may be a payment password or a game login password, etc., and the security vulnerability data is sensitive data, and the historical repair strategy corresponding to the password is queried in the historical repair strategy data. In order to ensure the security of sensitive data, the historical repair strategy and the password are combined to generate a repair suggestion report, which is sent to the operation and maintenance personnel, and the operation and maintenance personnel perform vulnerability repair on the password data, such as encryption or desensitization. In another embodiment, in order to improve the efficiency of repairing security vulnerabilities, when it is determined that the security vulnerability is non-sensitive data, the repair strategy associated with the security vulnerability is queried in the historical repair strategy data, and the repair is automatically performed by automatically executing the repair strategy.

[0069] In the above, by judging whether the security vulnerability in the security vulnerability detection result is sensitive information, if the security vulnerability is sensitive information, the corresponding historical repair strategy is found, so that the operation and maintenance personnel can repair the security vulnerability of sensitive information according to the historical repair strategy; if the security vulnerability is non-sensitive information, the corresponding historical repair strategy is found, and the security vulnerability of non-sensitive data is repaired by automatically executing the historical repair strategy, which can ensure the security of sensitive data and the efficiency of repairing security vulnerabilities of non-sensitive data.

[0070] Figure 2 is a flow chart of a formatting processing method provided in an embodiment of the present application, such as Figure 2 As shown, including:

[0071] Step S201: format the cloud resource data according to a preset universal format to obtain universal resource data.

[0072] The preset common format is any data format determined in advance, or it may be a data format randomly selected from the data formats of various cloud resources. Common resource data is resource data in a preset common format. In one embodiment, since the cloud resource data is data collected from multiple different cloud platforms, the data formats of various cloud resources are different, so the collected resource data is formatted according to the preset common format to obtain cloud resource data in the same format, i.e., common resource data.

[0073] Step S202: parse the format of the general resource data to obtain field identifiers and field contents corresponding to the field identifiers, and filter the field contents with the same field identifiers to obtain a collection of field contents.

[0074] Format parsing can be used to identify fields in the data and the specific contents corresponding to different fields. Field identifiers can be field names or IDs representing different fields, such as "payment password". Field content represents the specific contents in each field, and the field content can be represented by a string or the like. Exemplarily, the field identifier is "payment password" and the corresponding field content is "123456abc..." In one embodiment, after obtaining a universal resource, format parsing is performed through the universal resource to identify each field identifier in the universal resource and the field content corresponding to each field identifier, and a format parsing result of the universal resource is obtained. The same field identifier is searched in the format parsing result, and the field content corresponding to each field identifier is further determined, and the same field content is filtered out to obtain a collection of field contents.

[0075] Step S203: query the standard data format corresponding to the field identifier in the security database, format the field content collection according to the standard data format, and obtain unified format data.

[0076] The security database is used to store field contents in a standard format. The standard data format corresponding to the field identifier can be queried in the security database through the field identifier, so that the field content associated with the field identifier is converted into a format according to the queried standard data format to obtain the field content in the standard data format. The formatting process is to format and comb the word content associated with the same field identifier. The unified format data refers to the field content format associated with the same field identifier being the same. Exemplarily, the field identifiers are "game login password" and "game account", then the standard data format corresponding to the "game login password" queried in the security data is MD5 encrypted format, and the standard data format corresponding to the "game account" queried is octal format, then all field contents in the "game login password" field content collection are converted into MD5 encrypted format, and all field contents in the "game account" field content collection are converted into octal format. After the field contents in all content collections are converted, unified format data is obtained.

[0077] In the above, the cloud resource data is formatted according to a preset general format to obtain general resource data; the general resource data is formatted to obtain field identifiers and field contents corresponding to the field identifiers, and the field contents with the same field identifiers are screened to obtain a collection of field contents; the standard data format corresponding to the field identifiers is queried in the security database, and the field content collection is formatted according to the standard data format to obtain data in a unified format. By converting the field contents with the same field identifiers into the corresponding standard data formats, the same analysis method can be used for the field contents with the same field identifiers during subsequent data analysis, thereby improving data analysis efficiency.

[0078] Figure 3 is a flow chart of a data integration method provided in an embodiment of the present application, such as Figure 3 As shown, including:

[0079] Step S301: periodically collect cloud resource data from each cloud platform, and format the cloud resource data to obtain data in a unified format.

[0080] Step S302: import the unified format data into a pre-established data lake, and determine the collection time of each field content in the collection of each field content in the data lake.

[0081] In one embodiment, since the collection time of each cloud resource data is synchronously obtained when collecting cloud resource data of each cloud platform, after the unified format data is imported into a pre-established data lake, the collection time of each field content in the collection of each field content stored in the data lake is determined.

[0082] Step S303: determining the collection quantity of the field content within a preset time according to the collection time, and when the collection quantity exceeds an operation threshold, integrating the field content to obtain first integrated data.

[0083] In one embodiment, since the same cloud resource data may appear multiple times on multiple cloud platforms in a short period of time, there may be security vulnerabilities or non-compliant data in the cloud resource data. Therefore, a time period may be pre-set, such as 10 minutes. According to the collection time of the content of each field in the content collection, the earliest collection time is used as a benchmark to determine the number of collections of the same field content within 10 minutes of the collection time interval. If the collection number exceeds the operation threshold, it can be predicted that there may be security vulnerabilities or non-compliant data in the field content. Therefore, the same field content of 10 minutes is integrated to obtain the first integrated data. Therefore, the first integrated data is the integrated data that may contain security vulnerabilities or non-compliant resources.

[0084] Step S304: Identify whether there is sensitive information in the first integrated data according to a preset sensitive condition. If there is sensitive information, perform data integration on the identified sensitive information to obtain second integrated data.

[0085] The second integrated data is a collection of sensitive data that may contain security vulnerabilities or non-compliant resources. In one embodiment, sensitive information is identified for the first integrated data that may contain security vulnerabilities or non-compliant resources according to a preset sensitive condition. If sensitive information is identified in the first integrated data, the identified sensitive information data is integrated to obtain the second integrated data.

[0086] Step S305: perform security vulnerability detection on the integrated resources through the trained machine learning model to obtain security vulnerability detection results, and perform compliance inspection on the integrated resources through compliance inspection rules to obtain compliance inspection results.

[0087] Step S306: When there is a security vulnerability in the security vulnerability detection result and / or there is a non-compliant resource in the compliance check result, determine that the integrated resource is abnormal.

[0088] In the above, by importing unified format data into a pre-established data lake, the collection time of each field content in the collection of each field content in the data lake is determined; the collection quantity of field content within the preset time is determined according to the collection time, and when the collection quantity exceeds the operation threshold, the field content is integrated to obtain the first integrated data; according to the preset sensitive conditions, it is identified whether there is sensitive information in the first integrated data, and when there is sensitive information, the identified sensitive information is integrated to obtain the second integrated data. The data that may have security vulnerabilities or non-compliant resources can be predicted and screened through the pre-set integration conditions, and the data that may have security vulnerabilities or non-compliant resources can be further screened based on the preset sensitive conditions, which can narrow the data scope of vulnerability detection and non-compliance inspection, thereby improving the efficiency of cloud resource anomaly detection.

[0089] In one embodiment, the trained machine learning model performs security vulnerability detection on the integrated resource to obtain security vulnerability detection results, including:

[0090] The security verification data in the second integrated data is retrieved through the trained machine learning model, and the data complexity of the security verification data is calculated, the data complexity is compared with the security threshold, and it is determined whether there is a security vulnerability in the second integrated data based on the comparison result.

[0091] Among them, security verification data can be passwords, verification codes, and secret keys in sensitive information. Data complexity can be measured by the length of the password, the number of character types in the password, the timeliness of the verification code, and the encryption level of the secret key. The longer the password is and the more character types it contains, the higher the data complexity is. The shorter the timeliness of the verification code is, the higher the data complexity is. The more encryption levels of the secret key are, the higher the data complexity is. Correspondingly, different security verification data have different security thresholds, such as the security threshold of a password is a length threshold of 10, and the security threshold of a verification code is a timeliness of 1 minute.

[0092] In one embodiment, the security verification data is retrieved from the second integrated data through the trained machine learning model, and the complexity is calculated according to the types of different types of security verification data retrieved, and the complexity calculation result is compared with the corresponding security threshold, and it is determined whether there is a security vulnerability in the second integrated data according to the comparison result. Exemplarily, if the retrieved security verification data is a verification code, and the timeliness of the verification code is calculated, the timeliness of the verification code is compared with the security timeliness. If the timeliness of the verification code is greater than the security timeliness, it is considered that there is a security vulnerability in the second integrated data. On the contrary, if the timeliness of the verification code is less than or equal to the security timeliness, it is considered that there is no security vulnerability in the second integrated data.

[0093] In the above, the security verification data in the second integrated data is retrieved through the trained machine learning model, and the data complexity of the security verification data is calculated, and the data complexity is compared with the security threshold, and whether there is a security vulnerability in the second integrated data is determined according to the comparison result. The second integrated data is tested for security vulnerabilities based on the security verification data, which avoids being easily attacked by criminals when the data complexity of the security verification data is low, and can accurately identify potential security risks in the second integrated data.

[0094] In one embodiment, the compliance check is performed on the integrated resource according to the compliance check rule to obtain the compliance check result, including:

[0095] Identify the operation sequence list of the second integrated data, match the operation sequence list with the compliance operation list in the compliance verification rule, and determine whether there are non-compliant resources in the second integrated data based on the matching result, wherein the operation sequence list is obtained based on the execution order of each sensitive data in the second integrated data.

[0096] Among them, the compliance operation sequence linked list is used to represent the execution mode and execution order of each data node. Optionally, the compliance operation sequence linked list is obtained based on the execution order of each sensitive data in the second integrated data. The compliance verification rules only contain compliance operations of the data, and an operation sequence linked list that records the compliance operations. In one embodiment, after obtaining the second integrated data, the operation sequence linked list of each sensitive data in the second integrated data is identified, and the operation sequence linked list of each identified sensitive data is matched with the compliance operation linked list in the compliance verification rules. If the matching results are consistent, it can be determined that there are no non-compliant resources in the second integrated data. If the operation sequence linked list of any data in the matching result does not match the compliance operation linked list, it is considered that there are non-compliant resources in the second integrated data.

[0097] As described above, by identifying the operation sequence list of the second integrated data, matching the operation sequence list with the violation operation list in the compliance check rule, and determining whether there are non-compliant resources in the second integrated data based on the matching result, the second integrated data can be detected for non-compliant resources by identifying the operation sequence list of the data, and the integrity of the detected data can be ensured, thereby improving the accuracy of the compliance check.

[0098] Figure 4 is a schematic diagram of the structure of a cross-platform cloud resource anomaly detection device provided in an embodiment of the present application, such as Figure 4 As shown, including:

[0099] The resource data collection module 41 is used to periodically collect cloud resource data of each cloud platform;

[0100] A formatting module 42, used for formatting the cloud resource data to obtain data in a unified format;

[0101] A data integration module 43, used for importing the unified format data into a pre-established data lake for data integration to obtain integrated resources;

[0102] A resource detection module 44 is used to perform security vulnerability detection on the integrated resources through the trained machine learning model to obtain security vulnerability detection results, and to perform compliance inspection on the integrated resources through compliance inspection rules to obtain compliance inspection results;

[0103] The abnormal resource determination module 45 is used to determine that the integrated resource is abnormal when there is a security vulnerability in the security vulnerability detection result and / or there is a non-compliant resource in the compliance inspection result.

[0104] The embodiment of the present application periodically collects cloud resource data from each cloud platform, formats the cloud resource data to obtain unified format data, imports the unified format data into a pre-established data lake for data integration to obtain integrated resources, performs security vulnerability detection on the integrated resources through the trained machine learning model to obtain security vulnerability detection results, performs compliance inspection on the integrated resources through compliance inspection rules to obtain compliance inspection results, and determines that the integrated resources are abnormal when there are security vulnerabilities in the security vulnerability detection results and / or non-compliant resources in the compliance inspection results. Among them, by formatting the collected cloud resource data in different formats, it is convenient to manage and analyze a large amount of cloud resource data, and by integrating the unified format data, the vulnerability detection tool and the compliance inspection tool can analyze and detect the data of multiple different cloud platforms at the same time, avoiding the use of different detection tools for different sources and different types of data for separate detection, and improving the efficiency of security and compliance inspection of cross-cloud platform resources. According to the machine learning model and compliance inspection rules, the integrated resources are detected for abnormality, which can avoid the problems of inaccurate manual analysis and low detection efficiency, and provide the accuracy and detection efficiency of abnormality detection.

[0105] In a possible embodiment, the formatting module 42 is specifically used for:

[0106] Formatting the cloud resource data according to a preset universal format to obtain universal resource data;

[0107] Performing format parsing on the general resource data to obtain field identifiers and field contents corresponding to the field identifiers, and filtering field contents with the same field identifier to obtain a collection of field contents;

[0108] The standard data format corresponding to the field identifier is queried in the security database, and the field content collection is formatted according to the standard data format to obtain unified format data.

[0109] In a possible embodiment, the data integration module 43 is specifically used for:

[0110] Importing the unified format data into a pre-established data lake, and determining the collection time of each field content in each field content collection in the data lake;

[0111] Determine the number of the field contents collected within a preset time according to the collection time, and when the number of the field contents collected exceeds an operation threshold, perform data integration on the field contents to obtain first integrated data;

[0112] It is identified whether sensitive information exists in the first integrated data according to a preset sensitive condition, and if the sensitive information exists, data integration is performed on the identified sensitive information to obtain second integrated data.

[0113] In a possible embodiment, the resource detection module 44 is specifically used to:

[0114] Retrieving the security verification data in the second integrated data through the trained machine learning model, calculating the data complexity of the security verification data, comparing the data complexity with the security threshold, and determining whether there is a security vulnerability in the second integrated data according to the comparison result

[0115] In a possible embodiment, the resource detection module 44 is specifically used to:

[0116] Identify the operation sequence list of the second integrated data, match the operation sequence list with the compliance operation list in the compliance verification rule, and determine whether there are non-compliant resources in the second integrated data based on the matching result, wherein the operation sequence list is obtained based on the execution order of each sensitive data in the second integrated data.

[0117] In a possible embodiment, the cloud resource anomaly detection device further includes an update module, and the update module is used to:

[0118] Checking whether there is a rule update notification on the regulatory announcement page, and if there is the rule update notification, updating the compliance inspection rules stored in the security database to obtain updated compliance inspection rules;

[0119] The resource detection module 44 is specifically used for:

[0120] Compliance checks are performed on resource configurations and operation logs in the integrated resources according to the update compliance check rules.

[0121] In a possible embodiment, the cloud resource anomaly detection device further includes a repair suggestion report generation module and an automatic repair module, and the repair suggestion report generation module is used to:

[0122] Determine the type of security vulnerability in the security vulnerability detection result. If the type of security vulnerability is sensitive data, query the historical repair strategy data for a repair strategy associated with the sensitive data, generate a repair suggestion report according to the sensitive data and the repair strategy, and send the first repair suggestion report to the client;

[0123] The auto-repair module is used to:

[0124] In the case that the type of the security vulnerability is non-sensitive data, the repair strategy associated with the security vulnerability is queried in the historical repair strategy data, and automatic repair is performed using the repair strategy.

[0125] The embodiment of the present application also provides a cross-platform cloud resource anomaly detection device, and the cross-platform cloud resource anomaly detection device can integrate a cross-platform cloud resource anomaly detection device provided by the embodiment of the present application. Figure 5 Schematic diagram of a cross-platform cloud resource anomaly detection device provided in an embodiment of the present application. Figure 5 The cross-platform cloud resource anomaly detection device includes: an input device 53, an output device 54, a memory 52 and one or more processors 51; the memory 52 is used to store one or more programs; when one or more programs are executed by one or more processors 51, the one or more processors 51 implement the cross-platform cloud resource anomaly detection method provided by the above embodiment. The input device 53, the output device 54, the memory 52 and the processor 51 can be connected via a bus or other means. Figure 5 The example of connecting through bus is taken in the following.

[0126] The memory 52, as a computing device readable storage medium, can be used to store software programs, computer executable programs and modules, such as program instructions / modules corresponding to the cross-platform cloud resource anomaly detection method provided in any embodiment of the present application. The memory 52 may mainly include a program storage area and a data storage area, wherein the program storage area may store an operating system, an application required for at least one function; the data storage area may store data created according to the use of the device, etc. In addition, the memory 52 may include a high-speed random access memory, and may also include a non-volatile memory, such as at least one disk storage device, a flash memory device, or other non-volatile solid-state storage device. In some instances, the memory 52 may further include a memory remotely arranged relative to the processor 51, and these remote memories may be connected to the device via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0127] The input device 53 may be used to receive input digital or character information and generate key signal input related to user settings and function control of the device. The output device 54 may include a display device such as a display screen.

[0128] The processor 51 executes various functional applications and data processing of the device by running the software programs, instructions and modules stored in the memory 52, that is, implements the above-mentioned cross-platform cloud resource anomaly detection method.

[0129] The cross-platform cloud resource anomaly detection apparatus, device and storage medium provided above can be used to execute the cross-platform cloud resource anomaly detection method provided in any of the above embodiments, and have corresponding functions and beneficial effects.

[0130] The present application also provides a storage medium storing computer executable instructions. When the computer executable instructions are executed by a computer processor, the computer executable instructions are used to perform the cross-platform cloud resource anomaly detection method provided in the above embodiment. The cross-platform cloud resource anomaly detection method includes:

[0131] Periodically collect cloud resource data from each cloud platform, and format the cloud resource data to obtain data in a unified format;

[0132] Importing the unified format data into a pre-established data lake for data integration to obtain integrated resources;

[0133] Perform security vulnerability detection on the integrated resources through the trained machine learning model to obtain security vulnerability detection results, and perform compliance inspection on the integrated resources through compliance inspection rules to obtain compliance inspection results;

[0134] In the case where there is a security vulnerability in the security vulnerability detection result and / or there is a non-compliant resource in the compliance inspection result, it is determined that the integrated resource is abnormal.

[0135] Storage medium - any of various types of memory devices or storage devices. The term "storage medium" is intended to include: installation media, such as CD-ROM, floppy disk or tape device; computer system memory or random access memory, such as DRAM, DDR RAM, SRAM, EDO RAM, Rambus RAM, etc.; non-volatile memory, such as flash memory, magnetic media (such as hard disk or optical storage); registers or other similar types of memory elements, etc. Storage media may also include other types of memory or combinations thereof. In addition, the storage medium may be located in the first computer system in which the program is executed, or may be located in a different second computer system, which is connected to the first computer system via a network (such as the Internet). The second computer system can provide program instructions to the first computer for execution. The term "storage medium" may include two or more storage media that may reside in different locations (for example, in different computer systems connected by a network). The storage medium may store program instructions (for example, embodied as a computer program) that can be executed by one or more processors.

[0136] Of course, the storage medium containing computer executable instructions provided in an embodiment of the present application is not limited to the cross-platform cloud resource anomaly detection method as described above, and can also execute related operations in the cross-platform cloud resource anomaly detection method provided in any embodiment of the present application.

[0137] The cross-platform cloud resource anomaly detection apparatus, device and storage medium provided in the above embodiments can execute the cross-platform cloud resource anomaly detection method provided in any embodiment of the present application. For technical details not described in detail in the above embodiments, please refer to the cross-platform cloud resource anomaly detection method provided in any embodiment of the present application.

[0138] The above are only preferred embodiments of the present application and the technical principles used. The present application is not limited to the specific embodiments described herein, and various obvious changes, readjustments and substitutions that can be made by those skilled in the art will not deviate from the scope of protection of the present application. Therefore, although the present application is described in more detail through the above embodiments, the present application is not limited to the above embodiments, and may include more other equivalent embodiments without departing from the concept of the present application, and the scope of the present application is determined by the scope of the claims.

Claims

1. A cross-platform cloud resource anomaly detection method, characterized in that: include: Periodically collect cloud resource data of each cloud platform, and format the cloud resource data to obtain data in a unified format, including: formatting the cloud resource data according to a preset general format to obtain general resource data, format parsing the general resource data to obtain field identifiers and field contents corresponding to the field identifiers, and screening field contents with the same field identifiers to obtain a collection of field contents, querying a security database for a standard data format corresponding to the field identifier, and formatting the collection of field contents according to the standard data format to obtain data in a unified format; Importing the unified format data into a pre-established data lake for data integration to obtain integrated resources, including: importing the unified format data into a pre-established data lake, determining the collection time of each field content in each field content collection in the data lake, determining the collection quantity of the field content within a preset time according to the collection time, and when the collection quantity exceeds an operation threshold, performing data integration on the field content to obtain first integrated data, identifying whether there is sensitive information in the first integrated data according to a preset sensitive condition, and when the sensitive information exists, performing data integration on the identified sensitive information to obtain second integrated data; Perform security vulnerability detection on the integrated resources through the trained machine learning model to obtain security vulnerability detection results, and perform compliance inspection on the integrated resources through compliance inspection rules to obtain compliance inspection results; In the case where there is a security vulnerability in the security vulnerability detection result and / or there is a non-compliant resource in the compliance inspection result, it is determined that the integrated resource is abnormal.

2. The cloud resource anomaly detection method according to claim 1, characterized in that: The trained machine learning model performs security vulnerability detection on the integrated resources to obtain security vulnerability detection results, including: The security verification data in the second integrated data is retrieved through the trained machine learning model, and the data complexity of the security verification data is calculated, the data complexity is compared with the security threshold, and it is determined whether there is a security vulnerability in the second integrated data based on the comparison result.

3. The cloud resource anomaly detection method according to claim 1, characterized in that: The step of performing compliance inspection on the integrated resource according to the compliance inspection rule to obtain a compliance inspection result includes: Identify the operation sequence list of the second integrated data, match the operation sequence list with the compliance operation list in the compliance verification rule, and determine whether there are non-compliant resources in the second integrated data based on the matching result, wherein the operation sequence list is obtained based on the execution order of each sensitive data in the second integrated data.

4. The cloud resource anomaly detection method according to claim 1, characterized in that: Before the compliance inspection of the integrated resource is performed according to the compliance inspection rule, the method further includes: Checking whether there is a rule update notification on the regulatory announcement page, and if there is the rule update notification, updating the compliance inspection rules stored in the security database to obtain updated compliance inspection rules; Accordingly, the compliance inspection of the integrated resource by using the compliance inspection rule includes: Compliance checks are performed on resource configurations and operation logs in the integrated resources according to the update compliance check rules.

5. The cross-platform cloud resource anomaly detection method according to claim 1, characterized in that: After determining that the integrated resource is abnormal, the method further includes: Determine the type of security vulnerability in the security vulnerability detection result. If the type of security vulnerability is sensitive data, query the historical repair strategy data for the repair strategy associated with the sensitive data, generate a repair suggestion report according to the sensitive data and the repair strategy, and send the repair suggestion report to the client; In the case that the type of the security vulnerability is non-sensitive data, the repair strategy associated with the security vulnerability is queried in the historical repair strategy data, and automatic repair is performed using the repair strategy.

6. A cross-platform cloud resource anomaly detection device, characterized in that: include: Resource data collection module, used to periodically collect cloud resource data of each cloud platform; a formatting module, used for formatting the cloud resource data to obtain data in a unified format, wherein the formatting module is specifically used for formatting the cloud resource data according to a preset universal format to obtain universal resource data, formatting the universal resource data to obtain a field identifier and a field content corresponding to the field identifier, and screening the field content of the same field identifier to obtain a collection of field contents, querying a security database for a standard data format corresponding to the field identifier, and formatting the collection of field contents according to the standard data format to obtain data in a unified format; A data integration module, used for importing the unified format data into a pre-established data lake for data integration to obtain integrated resources. The data integration module is specifically used for importing the unified format data into a pre-established data lake, determining the collection time of each field content in the collection of each field content in the data lake, determining the collection quantity of the field content within a preset time according to the collection time, and when the collection quantity exceeds an operation threshold, performing data integration on the field content to obtain first integrated data, and identifying whether there is sensitive information in the first integrated data according to a preset sensitive condition, and when the sensitive information exists, performing data integration on the identified sensitive information to obtain second integrated data; A resource detection module, used to perform security vulnerability detection on the integrated resources through the trained machine learning model to obtain security vulnerability detection results, and to perform compliance inspection on the integrated resources through compliance inspection rules to obtain compliance inspection results; The abnormal resource determination module is used to determine that the integrated resource is abnormal when there is a security vulnerability in the security vulnerability detection result and / or there is a non-compliant resource in the compliance inspection result.

7. A cross-platform cloud resource anomaly detection device, the device comprising: one or more processors; A storage device for storing one or more programs. When the one or more programs are executed by the one or more processors, the one or more processors implement the cross-platform cloud resource anomaly detection method as described in any one of claims 1-5.

8. A storage medium storing computer executable instructions, wherein the computer executable instructions, when executed by a computer processor, are used to execute the cross-platform cloud resource anomaly detection method according to any one of claims 1 to 5.

Images