A cloud environment network security situation awareness method and system

Abstract

The present invention discloses a cloud environment network security situation awareness method and system, the method comprising: dividing the cloud environment network security situation characteristics based on a constructed cloud environment entity situation quantitative model based on multi-dimensional characteristics, describing the network security status and trend of various cloud hosts, virtual machines, containers, network devices, and systems in the cloud environment; formulating an abstract hierarchical structure of the index system based on the QoE evaluation index system and combining the analytic hierarchy process to normalize various indicators of different dimensions, different semantics, and different spaces to form a quantitative evaluation basis for the cloud environment security situation; correlating entity behavior data in the cloud environment, extracting the interaction relationship between entity behaviors, performing correlation analysis between different cloud nodes, and integrating different information sources and features; performing abnormal analysis on individuals and groups of entities in the cloud environment, describing the spatial situation of cloud environment entities, and issuing early warnings. The present invention can effectively perceive malicious attacks in the cloud environment.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a cloud environment network security situation awareness method and system. Background Art

[0002] With the popularity and development of cloud services, the means of attacking them have also shown systematic and large-scale characteristics. While taking border defense measures, it is also necessary to continuously monitor the security situation of the cloud environment to assist security personnel in making defense decisions and realize the "man in the loop" defense concept.

[0003] In the field of cyberspace situational awareness technology, there are a large number of research cases at home and abroad, but the following problems still exist:

[0004] 1. Existing research lacks a hierarchical, integrated, and systematic cyberspace situational awareness architecture. Although it has a certain research foundation for top-level modeling methods, the classification of cloud environment security situation elements and the fine-grained definition of situation characteristics are insufficient, resulting in low practicality.

[0005] 2. Although the current situational awareness algorithm can collect a large amount of situational information, it is difficult to align the collection granularity and time period of various situational data, resulting in the inability to detect and collect the multi-dimensional status and information of cyberspace in real time, and it is also difficult to fuse and associate multi-modal situational data.

[0006] 3. Traditional situational awareness methods perform macro-extraction of network or cloud environments, mostly in the form of security events, behavior logs, etc., and rarely consider multi-dimensional, continuous dynamic tracking, collection, and characterization of clouds, networks, and host nodes.

[0007] 4. Existing traffic analysis methods are mostly focused on intrusion attack detection, illegal behavior detection, real-time virus code detection, content restoration auditing, etc., and lack the ability to extract situation information at different levels such as cloud hosts, cloud systems, and cloud virtual networks from traffic. Summary of the invention

[0008] In view of this, the present invention provides a method and system for cloud environment network security situation awareness.

[0009] The present invention discloses a cloud environment network security situation awareness method, which includes:

[0010] Based on the constructed cloud environment entity situation quantitative model based on multi-dimensional features, the network security situation characteristics of the cloud environment are divided to characterize the network security status and trends of various cloud hosts, virtual machines, containers, network devices, and systems in the cloud environment;

[0011] Based on the QoE evaluation index system and combined with the hierarchical analysis method, an abstract hierarchical structure of the index system is formulated to normalize indicators of different dimensions, different semantics, and different spaces, forming a quantitative evaluation basis for the security situation of the cloud environment;

[0012] Correlate the entity behavior data in the cloud environment, extract the interaction relationship between entity behaviors, perform correlation analysis between different cloud nodes, and integrate different information sources and features; perform anomaly analysis on individuals and groups of entities in the cloud environment, characterize the spatial situation of cloud environment entities and issue early warnings.

[0013] Furthermore, the process of constructing the cloud environment entity situation quantitative model based on multi-dimensional features is as follows:

[0014] The cloud environment situation indicators are selected by comprehensively considering the three dimensions of search factors, information sources and usage requirements; the search factors include macro, local, cloud host, cloud service, attack, and vulnerability; the information sources include traffic, alarm, log, test, resource, and event; the usage requirements include management, prediction, and control;

[0015] According to the global situation of the cloud environment and the entity situation of a single cloud node, situation characteristic indicators are established, and corresponding online mining algorithms are designed to obtain indicators of retrieval factors, information sources and usage needs from the traffic to quantify the cloud environment situation; situation characteristic indicators include characteristic indicators of macro traffic within the cloud, characteristic indicators of north-south traffic within the cloud, characteristic indicators of regular behavior of cloud services, characteristic indicators of cloud network topology and characteristic indicators of application access within the cloud.

[0016] Furthermore, the first layer of the abstract hierarchy of the indicator system is the SAI indicator layer, which is used to characterize any characteristic state of the bottom-level cloud node entity; the second layer is the KSI indicator layer, which is aggregated and mapped from the SAI original indicators, and is used to quantitatively describe the overall state of a class of cloud nodes, or the state of any cloud node in any dimension; the third layer is the KQI indicator layer, which is aggregated and mapped from the KSI indicators, and is used to quantitatively describe the situation score of a class of cloud nodes in any dimension; the fourth layer is the QoS indicator layer, which is aggregated and mapped from the KQI indicators, and is used to quantitatively describe the overall situation of the cloud environment.

[0017] Furthermore, the individual and group anomaly analysis of entities in the cloud environment includes:

[0018] In terms of behavioral pattern analysis of entities in the cloud environment, it provides auxiliary identity recognition of cloud nodes and clustering of similar entities; at the same time, through the learning of micro-individual behaviors, it perceives the evolution trend of the group and conducts online perception of the cloud environment security situation at different levels for entities and groups.

[0019] Furthermore, after describing the spatial situation of cloud environment entities and issuing early warnings, the method further includes:

[0020] By de-heterogeneizing and de-flattening the cloud environment security situation data, a knowledge graph of cloud environment entity information and situation data is established, and the entities, attributes, and associations in the situation data are mined to construct a knowledge graph of the cloud environment. Entity behavior profiling and malicious node identification are performed based on the knowledge graph.

[0021] Furthermore, the construction of the knowledge graph of the cloud environment includes:

[0022] Extract the two types of triplets, "entity-relationship-entity" and "entity-attribute-attribute value", from the cloud environment situation data to form the data layer of the cloud environment knowledge graph; the extracted cloud environment entities include equipment, links, resources, terminals, applications, services, and situation characteristics; the extracted relationships include classification relationships, physical connections, routing connections, application access, business dependencies, security dependencies, and feature correlations; the extracted attributes include software and hardware attributes, operating parameters, behavioral characteristics, cloud environment situation characteristics, and security characteristics;

[0023] The resource description framework is used as the data model, that is, the structured entity, attribute, and relationship data format is converted into the triple data of the data model, so as to realize the construction, storage and expression of the ontology library based on entities, attributes, and relationships; on the basis of the ontology library, based on the existing entity relationships, new associations between entities are established through automatic reasoning, and graph-based knowledge reasoning is realized to build a complete knowledge graph.

[0024] Furthermore, the method of extracting attributes includes:

[0025] Transform the entity attribute extraction problem into an entity relationship extraction problem, and use the support vector machine algorithm to extract cloud node attributes; or,

[0026] The attribute extraction algorithm based on rules and heuristic algorithms realizes the continuous expansion and discovery of entity attributes through the ontology knowledge base.

[0027] Furthermore, the entity behavior profiling and malicious node identification based on the knowledge graph includes:

[0028] First, the graph database in the cloud environment situation knowledge graph is transformed into a complex network. The complex network is combined with key feature extraction methods, using the similarity and clustering of its nodes to characterize the network image and detect malicious nodes; the behavioral statistical characteristics of cloud nodes include node out-degree, node in-degree, clustering coefficient and betweenness centrality;

[0029] The behavioral statistical characteristics of cloud nodes are used to characterize the behavioral association relationship between nodes in the knowledge graph, and the behavioral statistical characteristics of the cloud nodes are merged with the traffic-based entity situation characteristics stored in the graph database to finally form a multi-dimensional node behavior portrait feature set.

[0030] Furthermore, the high-dimensional features of nodes in complex networks are used as input to train the machine learning method, and the node multidimensional classifier and malicious node detector are constructed in combination with the node behavior portrait feature set; the nodes and behavior relationships in the relevant data are modeled into a knowledge graph, and the high-dimensional features of nodes in complex networks are used to characterize the nodes and identify malicious nodes; among which, the relevant data include open source data, cloud environment attack simulation data and cloud environment actual operation data; the open source data include the UNSW attack dataset.

[0031] The present invention also discloses a cloud environment network security situation awareness system, which implements the cloud environment network security situation awareness method described above, and includes:

[0032] The situation feature classification module is used to classify the network security situation features of the cloud environment based on the constructed cloud environment entity situation quantitative model based on multi-dimensional features, and to describe the network security status and trends of various cloud hosts, virtual machines, containers, network devices, and systems in the cloud environment;

[0033] The quantitative evaluation module is used to formulate an abstract hierarchical structure of the indicator system based on the QoE evaluation indicator system and the hierarchical analysis method, so as to normalize indicators of different dimensions, different semantics, and different spaces, and form a quantitative evaluation basis for the security situation of the cloud environment;

[0034] The situation awareness module is used to associate entity behavior data in the cloud environment, extract the interaction relationship between entity behaviors, perform correlation analysis between different cloud nodes, and integrate different information sources and features; perform anomaly analysis on individuals and groups of entities in the cloud environment, characterize the spatial situation of cloud environment entities and issue early warnings.

[0035] Due to the adoption of the above technical solution, the present invention has the following advantages:

[0036] 1. In terms of situation awareness, first, by building a quantitative model of cloud environment entity situation based on multi-dimensional features, the network security situation characteristics of the cloud environment are divided into five categories, and the network security status and trends of various cloud hosts, virtual machines, containers, network devices, and systems in the cloud environment are described from multiple dimensions, multiple levels, and multiple angles. Second, a situation feature extraction method based on QoE and hierarchical analysis method is used to form a bottom-up hierarchical structure to normalize indicators of various dimensions, different semantics, and different spaces. It can form a quantitative evaluation basis (situation score) for the three aspects of environmental, dynamic, and holistic aspects of the cloud environment security situation, which can better support the realization of intelligent prediction of cloud environment situation.

[0037] 2. In terms of situational awareness performance, the "online security situation awareness method based on traffic and behavior association mining" adopted by the present invention breaks through the traditional single entity behavior analysis and completes the association of cloud environment entity behavior data through online + offline big data analysis technology. And combined with online anomaly detection, real-time data stream mining and other technologies, anomaly detection of cloud environment entities is realized from both micro and macro perspectives. On the one hand, the abnormal behavior of macro group behavior aggregated from a single entity is analyzed to characterize the security situation of cloud environment entities and issue early warnings. By analyzing entity behavior patterns and combining time series mining and other means, auxiliary identity recognition of entities and clustering of similar entities are provided. On the other hand, through the learning of micro individual behaviors, the macro evolution trend of the group is perceived, and different levels of security situation awareness are performed on single entities and groups. BRIEF DESCRIPTION OF THE DRAWINGS

[0038] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in the embodiments of the present invention. For ordinary technicians in this field, other drawings can also be obtained based on these drawings.

[0039] Figure 1 A schematic diagram of a process for cloud environment network security situation awareness according to an embodiment of the present invention;

[0040] Figure 2 This is an abstract hierarchical structure diagram of cloud environment entity status indicators according to an embodiment of the present invention. DETAILED DESCRIPTION

[0041] The present invention is further described in conjunction with the accompanying drawings and embodiments, and the described embodiments are only a part of the embodiments of the present invention, rather than all the embodiments. All other embodiments obtained by ordinary technicians in this field should fall within the scope of protection of the embodiments of the present invention.

[0042] See also Figure 1 The present invention provides an embodiment of a cloud environment network security situation awareness method, which includes:

[0043] Based on the constructed cloud environment entity situation quantitative model based on multi-dimensional features, the characteristics of cloud environment network security situation are divided, and the network security status and trends of various cloud hosts, virtual machines, containers, network devices, and systems in the cloud environment are described from multiple dimensions, multiple levels, and multiple angles;

[0044] Based on the QoE (quality of experience) evaluation index system and combined with the hierarchical analysis method, an abstract hierarchical structure of the index system is formulated to normalize indicators of different dimensions, different semantics, and different spaces, forming a quantitative evaluation basis for the security situation of the cloud environment;

[0045] Correlate the entity behavior data in the cloud environment, extract the interaction relationship between entity behaviors, perform correlation analysis between different cloud nodes, and integrate different information sources and features; perform anomaly analysis on individuals and groups of entities in the cloud environment, characterize the spatial situation of cloud environment entities and issue early warnings.

[0046] The steps of the hierarchical analysis method in this embodiment are as follows: set indicator weights according to evaluation requirements; construct a comparison matrix to reflect various hierarchical relationships and subordinate relationships through the matrix; and use the extreme difference method or the extreme ratio method to construct a corresponding judgment matrix.

[0047] In one embodiment, the process of constructing the cloud environment entity situation quantification model based on multi-dimensional features is as follows:

[0048] The cloud environment situation indicators are selected by comprehensively considering the three dimensions of search factors, information sources and usage requirements; the search factors include macro, local, cloud host, cloud service, attack, and vulnerability; the information sources include traffic, alarm, log, test, resource, and event; the usage requirements include management, prediction, and control;

[0049] According to the global situation of the cloud environment and the entity situation of a single cloud node, situation characteristic indicators are established, and corresponding online mining algorithms are designed to obtain indicators of retrieval factors, information sources and usage needs from the traffic to quantify the cloud environment situation; situation characteristic indicators include characteristic indicators of macro traffic within the cloud, characteristic indicators of north-south traffic within the cloud, characteristic indicators of regular behavior of cloud services, characteristic indicators of cloud network topology and characteristic indicators of application access within the cloud.

[0050] Specifically, macro traffic characteristic indicators in the cloud: This category of characteristics provides a means to describe the statistical characteristics of the macro or node traffic in the cloud environment. It can be used to discover overall abnormalities such as sudden changes in traffic scale, abnormal increases in access frequency, and abnormal changes in activity.

[0051] Indicators of north-south traffic characteristics within the cloud: Aims to describe the traffic patterns in north-south access activities within the cloud, including traffic scale, traffic composition, application behavior patterns, etc. It can be used to detect large-scale active attacks, coordinated attacks within and outside the cloud, and cloud-paralyzing attack threats.

[0052] Cloud service general behavior characteristic indicators: aim to characterize the general behavior of cloud environment and cloud nodes, and can be used to describe the access status of this cloud service. It can be used to discover active / internal attack threats.

[0053] Cloud network topology characteristic indicators: aim to characterize the topological structure of the cloud environment, mainly focusing on the routing characteristics of the virtual network in the cloud and the north-south path characteristics of the cloud server cluster. They can be used to discover important changes in cloud resources and specific attacks against the cloud management platform.

[0054] In-cloud application access characteristic indicators: Aim to characterize the application behaviors of users and cloud servers. They can be used to detect internal user attacks against cloud services.

[0055] The main characteristics and meanings of the cloud environment entity situation are shown in Table 1.

[0056] Table 1 Main characteristics and meanings of the cloud environment entity status

[0057]

[0058] In one embodiment, an important use of situation feature indicators is evaluation and prediction. Therefore, a bottom-up hierarchical structure must be provided to normalize indicators of different dimensions, different semantics, and different spaces to form a quantifiable evaluation basis (situation score).

[0059] In this embodiment, based on the QoE (Quality of Experience) evaluation index system and combined with the hierarchical analysis method, a conceptual index system abstract hierarchy is formulated, such as Figure 2 As shown in the figure, four levels of situation indicators are defined:

[0060] The first layer is the SAI (Situation Awareness Indicator) indicator layer, which is the most basic original indicator in the security situation and is used to characterize a certain characteristic state of the lowest-level cloud node entity (cloud host, virtual machine, service, application).

[0061] The second layer is the KSI (Key Situation Indicator) indicator layer, which is aggregated and mapped from the original SAI indicators. It is used to quantitatively describe the overall status of a type of cloud node (such as the security threat level of a virtual machine in a cloud host) or the status of a cloud node in a certain dimension (such as the frequency of access to virtual machines in the cloud).

[0062] The third layer is the KQI (Key Quality Indicator) indicator layer, which is aggregated and mapped from the KSI indicators and is used to quantitatively describe the situation score of a certain type of cloud node in a certain dimension (for example, the overall vulnerability situation score of a certain type of cloud service).

[0063] The fourth layer is the QoS (Quality of Situation) indicator layer, which is aggregated and mapped from KQI indicators and is used to quantitatively describe the overall situation of the cloud environment. This is the top-level situation information.

[0064] The aggregation process of the above four layers of indicators is the process of mapping multiple lower-level indicators to one upper-level indicator, which requires a normalization method. The present invention uses a weight ratio modeling method for normalization to achieve automatic layer-by-layer recursion of the indicator system, as well as parallel extraction and aggregation algorithms in a big data environment.

[0065] Therefore, the evaluation and prediction of the cloud environment situation can be carried out at any indicator level, and the evaluation granularity can be drilled down from top to bottom; at the same time, it is also convenient for macro-quantitative display of the overall situation of the cloud environment, mathematical fitting, and application of appropriate prediction algorithms for prediction.

[0066] In one embodiment, an online perception method of security situation based on traffic and behavior association mining completes the construction of the association relationship of cloud entity behavior data through online + offline big data analysis technology, realizes modeling of cloud environment entity behavior based on multi-granularity, extracts the interaction relationship between entity behaviors through association rules, clustering algorithms and logical reasoning, and realizes association analysis between different cloud nodes. On this basis, the key elements of cloud environment entity situation, including key elements such as traffic scale, traffic packet information, traffic trend, number of node service devices, etc. within a certain period of time of cloud nodes such as cloud devices, cloud applications, cloud services, etc., realize the integration between different information sources and situation feature indicators. Combined with online anomaly detection, real-time data stream mining and other technologies, individual and group anomaly analysis of entities in the cloud environment is realized, and the spatial situation of cloud environment entities is portrayed and early warning is carried out.

[0067] In terms of behavior pattern analysis of entities in the cloud environment, auxiliary identity recognition of cloud nodes and clustering of similar entities are provided through time series mining and other means. At the same time, through the learning of micro-individual behaviors, the group evolution trend is perceived, and the cloud environment security situation of entities and groups at different levels is perceived online.

[0068] In one embodiment, the step of constructing a knowledge graph of a cloud environment includes:

[0069] By de-heterogeneizing and de-flattening the cloud environment security situation data, we can build a knowledge graph of cloud environment entity information and situation data, and mine the entities, attributes, and associations in the situation data to build a knowledge graph of the cloud environment and a cloud environment security portrait, which can dynamically present the network security situation of the cloud environment. The construction process is as follows:

[0070] 1) Extraction of cloud environment entities, attributes, and relationships based on situation data

[0071] Based on multi-source heterogeneous situation data, automated means are used to extract two types of triplets, "entity-relationship-entity" and "entity-attribute-attribute value", to form the data layer of the cloud environment knowledge graph.

[0072] (a) Cloud environment entity extraction

[0073] First, entities in the cloud environment are extracted from the cloud environment situation data. The extracted cloud environment entities include devices, links, resources, terminals, applications, services, situation characteristics, etc. The specific methods include:

[0074] Methods based on entity classification and clustering: such as the hierarchical named entity classification system; the named entity list method based on feature modeling; the method of using unsupervised learning algorithms to identify named entities from massive information and then using clustering algorithms to cluster the identified entity objects.

[0075] (b) Entity Relationship Extraction

[0076] The relationships between cloud nodes are extracted from the cloud environment situation data. The extracted relationships include classification relationships, physical connections, routing connections, application access, business dependencies, security dependencies, feature correlation, etc. The method of combining machine learning algorithms with open domains is adopted. When the number of relationships in the target data set is not large and there is a pre-defined entity relationship classification model, the traditional machine learning algorithm is used for relationship extraction. When there is no pre-defined entity relationship model or the number of relationships is too large, the open domain relationship extraction method is used.

[0077] (c) Entity attribute extraction

[0078] The goal of attribute extraction is to collect attribute information of specific entities from different information sources, such as software and hardware attributes, operating parameters, behavioral characteristics, cloud environment status characteristics, security characteristics, etc., to achieve a complete characterization of entity attributes.

[0079] There are two methods to extract attribute features:

[0080] ①Convert the entity attribute extraction problem into the entity relationship extraction problem, and use the support vector machine algorithm to realize cloud node attribute extraction.

[0081] ② Attribute extraction algorithm based on rules and heuristic algorithms, which realizes the continuous expansion and discovery of entity attributes through the ontology knowledge base.

[0082] 2) Cloud environment knowledge graph establishment and knowledge reasoning

[0083] Apply knowledge fusion and modeling methods such as ontology libraries, and use a bottom-up approach based on cloud environment entity, attribute, and relationship basic data to implement and manage the model layer of the knowledge graph.

[0084] In the process of building a knowledge graph, an important source of high-quality knowledge is structured data. In fact, a large number of situation characteristic indicators and operating parameters are structured data. In order to integrate these structured historical data into the knowledge graph, the Resource Description Framework (RDF) is used as the data model, which is to convert the structured data format into RDF triple data. The ontology library based on entities, attributes, and relationships is constructed, stored, and expressed.

[0085] On the basis of ontology construction, it is necessary to start from the existing entity relationship data and establish new associations between entities through automatic reasoning, so as to expand and enrich the knowledge system. Neural network models, Path Ranking and other methods are used to realize graph-based knowledge reasoning and build a complete knowledge graph.

[0086] 3) Attack classification and malicious node identification based on knowledge graph

[0087] Based on the results of situation data collection, graph-based cloud environment spatial modeling and knowledge graph reasoning were formed, and malicious nodes and security threats were further identified based on knowledge graphs and graph computing theory.

[0088] In one embodiment, the constructed situation knowledge graph can characterize the behavioral characteristics of the subject, as well as the behavioral relationships between the subjects. On the basis of constructing the multi-target entity situation knowledge graph, entity behavior profiling and malicious node identification can be further carried out. A malicious node detection method based on a graph database is adopted: first, the graph database in the cloud environment situation knowledge graph is converted into a complex network (CN). The complex network has the characteristics of "tight inside and loose outside", which can well present the hierarchy and importance between network nodes. It can better combine the key feature extraction method and use the similarity and clustering of its nodes to characterize the network portrait and quickly detect malicious nodes; the statistical characteristics of cloud node behavior include node out-degree, node in-degree, clustering coefficient and betweenness centrality, etc.;

[0089] The cloud node behavior statistical characteristics are used to characterize the behavioral association relationship between nodes in the knowledge graph, and the cloud node behavior statistical characteristics are merged with the traffic-based situation feature indicators stored in the graph database (including the cloud macro traffic characteristics, cloud north-south traffic characteristics, cloud service general behavior characteristics, cloud network topology characteristics and cloud application access characteristics mentioned above), finally forming a multi-dimensional node behavior portrait feature set.

[0090] Taking the high-dimensional features of nodes in complex networks as input, we introduce machine learning methods such as neural networks, SVM, decision trees, and random forests for training. Combined with the node behavior portrait feature set, we build a node multidimensional classifier (profiling) and implement malicious node detection. Based on open source data such as the UNSW attack dataset, cloud environment attack simulation data, and actual cloud environment operation data, we model the nodes and behavior relationships in the knowledge graph, and further use the high-dimensional features of complex networks to characterize nodes and identify malicious nodes.

[0091] The present invention also provides an embodiment of a cloud environment network security situation awareness system, which implements the cloud environment network security situation awareness method described in the above embodiment, and includes:

[0092] The situation feature classification module is used to classify the network security situation features of the cloud environment based on the constructed cloud environment entity situation quantitative model based on multi-dimensional features, and to describe the network security status and trends of various cloud hosts, virtual machines, containers, network devices, and systems in the cloud environment from multiple dimensions, multiple levels, and multiple angles;

[0093] The quantitative evaluation module is used to formulate an abstract hierarchical structure of the indicator system based on the QoE evaluation indicator system and the hierarchical analysis method, so as to normalize indicators of different dimensions, different semantics, and different spaces, and form a quantitative evaluation basis for the security situation of the cloud environment;

[0094] The situation awareness module is used to associate entity behavior data in the cloud environment, extract the interaction relationship between entity behaviors, perform correlation analysis between different cloud nodes, and integrate different information sources and features; perform anomaly analysis on individuals and groups of entities in the cloud environment, characterize the spatial situation of cloud environment entities and issue early warnings.

[0095] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention rather than to limit it. Although the present invention has been described in detail with reference to the above embodiments, ordinary technicians in the relevant field should understand that the specific implementation methods of the present invention can still be modified or replaced by equivalents. Any modification or equivalent replacement that does not depart from the spirit and scope of the present invention should be covered within the scope of protection of the claims of the present invention.

Claims

1. A cloud environment network security situation awareness method, characterized in that: include: Based on the constructed cloud environment entity situation quantitative model based on multi-dimensional features, the network security situation characteristics of the cloud environment are divided to characterize the network security status and trends of various cloud hosts, virtual machines, containers, network devices, and systems in the cloud environment; Based on the QoE evaluation index system and combined with the hierarchical analysis method, an abstract hierarchical structure of the index system is formulated to normalize indicators of different dimensions, different semantics, and different spaces, forming a quantitative evaluation basis for the security situation of the cloud environment; Correlate entity behavior data in the cloud environment, extract the interaction between entity behaviors, perform correlation analysis between different cloud nodes, and integrate different information sources and features; Perform anomaly analysis on individual and group entities in the cloud environment, characterize the spatial situation of cloud environment entities and issue early warnings; The construction process of the cloud environment entity situation quantitative model based on multi-dimensional features is as follows: Comprehensively consider the three dimensions of retrieval factors, information sources and usage requirements to select multiple situation characteristic indicators; retrieval factors include macro, local, cloud host, cloud service, attack, vulnerability; information sources include traffic, alarm, log, test, resource, event; usage requirements include management, prediction, control; Aiming at the overall situation of the cloud environment and the physical situation of a single cloud node, multiple situation characteristic indicators are established to obtain retrieval elements, information sources and usage requirements from the traffic to quantify the cloud environment situation; situation characteristic indicators include macro traffic characteristic indicators within the cloud, north-south traffic characteristic indicators within the cloud, cloud service routine behavior characteristic indicators, cloud network topology characteristic indicators and cloud application access characteristic indicators; The first layer of the abstract hierarchy of the indicator system is the SAI indicator layer, which is used to characterize any characteristic state of the cloud node entity at the bottom layer; The second layer is the KSI indicator layer, which is aggregated and mapped from the original SAI indicators and is used to quantitatively describe the overall status of a type of cloud nodes, or the status of any cloud node in any dimension; the third layer is the KQI indicator layer, which is aggregated and mapped from the KSI indicators and is used to quantitatively describe the situation score of a type of cloud nodes in any dimension; the fourth layer is the QoS indicator layer, which is aggregated and mapped from the KQI indicators and is used to quantitatively describe the overall situation of the cloud environment.

2. The cloud environment network security situation awareness method according to claim 1 is characterized in that: Individual and group anomaly analysis of entities within the cloud environment, including: In terms of behavioral pattern analysis of entities in the cloud environment, it provides auxiliary identity recognition of cloud nodes and clustering of similar entities; at the same time, through the learning of micro-individual behaviors, it perceives the evolution trend of the group and conducts online perception of the cloud environment security situation at different levels for entities and groups.

3. The cloud environment network security situation awareness method according to claim 1 is characterized in that: After describing the spatial situation of cloud environment entities and issuing early warning, the following steps are also included: By de-heterogeneizing and de-flattening the cloud environment security situation data, a knowledge graph of cloud environment entity information and situation data is established, and the entities, attributes, and associations in the situation data are mined to construct a knowledge graph of the cloud environment. Entity behavior profiling and malicious node identification are performed based on the knowledge graph.

4. The cloud environment network security situation awareness method according to claim 3 is characterized in that: The knowledge graph of the cloud environment is constructed, including: Extract the "entity-relationship-entity" and "entity-attribute-attribute value" triples from the cloud environment situation data to form the data layer of the cloud environment knowledge graph; the extracted cloud environment entities include equipment, links, resources, terminals, applications, services, and situation characteristics; the extracted relationships include classification relationships, physical connections, routing connections, application access, business dependencies, security dependencies, and feature correlations; the extracted attributes include software and hardware attributes, operating parameters, behavioral characteristics, cloud environment situation characteristics, and security characteristics; The resource description framework is used as the data model, that is, the structured entity, attribute, and relationship data format is converted into the triple data of the data model, so as to realize the construction, storage and expression of the ontology library based on entities, attributes, and relationships; on the basis of the ontology library, based on the existing entity relationships, new associations between entities are established through automatic reasoning, and graph-based knowledge reasoning is realized to construct a knowledge graph.

5. The cloud environment network security situation awareness method according to claim 4 is characterized in that: Methods for extracting attributes include: Transform the entity attribute extraction problem into an entity relationship extraction problem, and use the support vector machine algorithm to extract cloud node attributes; or, The attribute extraction algorithm based on rules and heuristic algorithms realizes the continuous expansion and discovery of entity attributes through the ontology knowledge base.

6. The cloud environment network security situation awareness method according to claim 3 is characterized in that: The entity behavior profiling and malicious node identification based on the knowledge graph includes: First, the graph database in the cloud environment situation knowledge graph is transformed into a complex network. The complex network is combined with key feature extraction methods, using the similarity and clustering of its nodes to characterize the network image and detect malicious nodes; the behavioral statistical characteristics of cloud nodes include node out-degree, node in-degree, clustering coefficient and betweenness centrality; The behavioral statistical characteristics of cloud nodes are used to characterize the behavioral association relationship between nodes in the knowledge graph, and the behavioral statistical characteristics of the cloud nodes are merged with the traffic-based entity situation characteristics stored in the graph database to finally form a multi-dimensional node behavior portrait feature set.

7. The cloud environment network security situation awareness method according to claim 6 is characterized in that: Taking the high-dimensional features of nodes in complex networks as input, training is performed through machine learning methods, and a node multidimensional classifier is constructed in combination with the node behavior portrait feature set. The knowledge graph is expanded and modeled by combining the node and behavior relationships in the relevant data, and the high-dimensional features of nodes in complex networks are used to characterize the nodes, combined with the node multidimensional classifier to identify malicious nodes. Among them, the relevant data include open source data, cloud environment attack simulation data and cloud environment actual operation data; open source data include UNSW attack data set.

8. A cloud environment network security situation awareness system, implementing the cloud environment network security situation awareness method according to any one of claims 1 to 7, characterized in that: include: The situation feature classification module is used to classify the network security situation features of the cloud environment based on the constructed cloud environment entity situation quantitative model based on multi-dimensional features, and to describe the network security status and trends of various cloud hosts, virtual machines, containers, network devices, and systems in the cloud environment; The quantitative evaluation module is used to formulate an abstract hierarchical structure of the indicator system based on the QoE evaluation indicator system and the hierarchical analysis method, so as to normalize indicators of different dimensions, different semantics, and different spaces, and form a quantitative evaluation basis for the security situation of the cloud environment; Situational awareness module, which is used to correlate entity behavior data in the cloud environment, extract the interaction relationship between entity behaviors, perform correlation analysis between different cloud nodes, and integrate different information sources and features; Conduct anomaly analysis on individuals and groups of entities in the cloud environment, characterize the spatial situation of cloud environment entities and issue early warnings.

Images