Cloud platform east-west traffic security monitoring method and device, electronic equipment and storage medium

Abstract

The application discloses a cloud platform east-west traffic security monitoring method and device, electronic equipment and storage medium, to solve the problem that only network layer data packets in the cloud platform east-west traffic are monitored for security, and it is difficult to investigate the security threat events of blocked non-network layer data packets. The proxy center receives the associated attack behavior reported by the cloud platform node and the corresponding target associated cloud platform node information; generates an associated attack detection rule based on the associated attack behavior; distributes the associated attack detection rule to the target associated cloud platform node, so that the target associated cloud platform node performs attack event association analysis on the associated data packets flowing through itself based on the associated attack detection rule; receives the respective attack event association analysis results reported by the target associated cloud platform node; obtains the target attack chain information corresponding to the associated attack event according to the respective attack event association analysis results of the target associated cloud platform node; and uploads the target attack chain information to the security management center.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of network security, and particularly relates to a cloud platform east-west traffic security monitoring method and device, electronic equipment and a storage medium. BACKGROUND

[0002] With the development and popularization of cloud, container and other technologies, the proportion of east-west traffic in the total traffic of a cloud platform data center gradually increases, and security monitoring of the east-west traffic is the basis for ensuring enterprise data security. In related technologies, a micro-isolation technology based on Iptables and Netfilter is usually used to monitor and control the security of the east-west traffic of the cloud platform by installing an Agent on the nodes of the cloud platform, and an access connection relationship is generated to monitor the security of the east-west traffic.

[0003] However, the micro-isolation technology based on Iptables and Netfilter only analyzes and processes network layer data packets, and the nodes of the cloud platform only block non-standard data packets (i.e. non-network layer data packets such as application layer data packets) and directly discard the received non-standard data packets, which makes it difficult to investigate blocked security threat events and affects the comprehensiveness of the security monitoring of the east-west traffic of the cloud platform. SUMMARY

[0004] To solve the problem that the existing cloud platform east-west traffic security monitoring method only monitors the security of network layer data packets and it is difficult to investigate security threat events of blocked non-network layer data packets, the present application provides a cloud platform east-west traffic security monitoring method, device, electronic equipment and storage medium.

[0005] In a first aspect, the present application provides a cloud platform east-west traffic security monitoring method implemented on the side of a cloud platform node, applied to a cloud platform security monitoring system, the cloud platform security monitoring system comprising a security management center, an Agent center and a cloud platform node, and the method comprising:

[0006] The cloud platform node acquires a non-network layer data packet blocked by a kernel layer fast data path XDP of the cloud platform node;

[0007] The five-tuple information of the blocked non-network layer data packet is extracted, attack behavior correlation analysis is performed on the blocked non-network layer data packet based on a preset attack detection rule and the five-tuple information, and a correlated attack behavior and corresponding target correlated cloud platform node information are identified;

[0008] The associated attack behavior and the corresponding target associated cloud platform node information are reported to the proxy center, so that the proxy center generates corresponding associated attack detection rules based on the associated attack behavior, and sends the associated attack detection rules to the target associated cloud platform node, so that the target associated cloud platform node performs attack event association analysis on the associated data packets flowing through itself based on the associated attack detection rules, and reports the corresponding attack event association analysis results to the proxy center, so that the proxy center obtains the target attack chain information corresponding to the associated attack event according to the corresponding attack event association analysis results of the target associated cloud platform node, and uploads the target attack chain information to the security management center.

[0009] In one embodiment, the cloud platform node is provided with an agent; the cloud platform node obtains a non-network layer data packet blocked by its kernel layer fast data path XDP, specifically including:

[0010] The cloud platform node receives the blocking packet monitoring program sent by the agent center through the agent, and the blocking packet monitoring program is issued by the security management center;

[0011] Loading the blocking packet monitoring program from the agent via the kernel layer XDP;

[0012] The non-network layer data packet blocked by the kernel layer XDP is obtained through the blocking packet monitoring program.

[0013] In one embodiment, extracting the five-tuple information of the blocked non-network layer data packet, performing attack behavior correlation analysis on the blocked non-network layer data packet based on preset attack detection rules and the five-tuple information, identifying the associated attack behavior and the corresponding target associated cloud platform node information, specifically including:

[0014] receiving, through the agent, a blocking packet tracing rule execution program sent by the agent center, wherein the blocking packet tracing rule execution program is issued by the security management center;

[0015] Loading the blocking packet tracing rule execution program from the agent via the kernel layer XDP;

[0016] The five-tuple information of the blocked non-network layer data packet is extracted by the blocking packet tracking rule execution program. Based on the preset attack detection rules and the five-tuple information, the blocked non-network layer data packet is subjected to attack behavior correlation analysis to identify the associated attack behavior and the corresponding target associated cloud platform node information.

[0017] In a second aspect, the embodiments of the present application provide a cloud platform east-west traffic security monitoring device implemented on a cloud platform node side, applied to a cloud platform security monitoring system, the cloud platform security monitoring system comprising a security management center, a proxy center and a cloud platform node, and the device comprising:

[0018] an acquisition unit configured to acquire non-network layer data packets blocked by an XDP of a kernel layer of the cloud platform node;

[0019] an analysis unit configured to extract five-tuple information of the blocked non-network layer data packets, perform attack behavior correlation analysis on the blocked non-network layer data packets based on a preset attack detection rule and the five-tuple information, identify correlated attack behaviors and corresponding target correlated cloud platform node information, and report the correlated attack behaviors and the corresponding target correlated cloud platform node information to the proxy center.

[0020] a reporting unit configured to report the correlated attack behaviors and the corresponding target correlated cloud platform node information to the proxy center, so that the proxy center generates corresponding attack detection rules based on the correlated attack behaviors, and issues the attack detection rules to the target correlated cloud platform node, so that the target correlated cloud platform node performs attack event correlation analysis on correlated data packets flowing through the target correlated cloud platform node based on the attack detection rules, and reports respective attack event correlation analysis results to the proxy center, so that the proxy center obtains target attack chain information corresponding to correlated attack events according to the respective attack event correlation analysis results of the target correlated cloud platform node, and uploads the target attack chain information to the security management center.

[0021] In an embodiment, the cloud platform node is provided with a proxy.

[0022] The acquisition unit is specifically configured to receive a blocked packet monitoring program sent by the proxy center through the proxy, the blocked packet monitoring program being issued by the security management center; load the blocked packet monitoring program from the proxy through the XDP of the kernel layer; and acquire non-network layer data packets blocked by the XDP of the kernel layer through the blocked packet monitoring program.

[0023] In an embodiment, the analysis unit is specifically configured to receive a blocked packet tracking rule execution program sent by the proxy center through the proxy, the blocked packet tracking rule execution program being issued by the security management center; load the blocked packet tracking rule execution program from the proxy through the XDP of the kernel layer; extract five-tuple information of the blocked non-network layer data packets through the blocked packet tracking rule execution program, perform attack behavior correlation analysis on the blocked non-network layer data packets based on a preset attack detection rule and the five-tuple information, and identify correlated attack behaviors and corresponding target correlated cloud platform node information.

[0024] In a third aspect, an embodiment of the present application provides a cloud platform east-west traffic security monitoring method implemented by an agent center, which is applied to a cloud platform security monitoring system. The cloud platform security monitoring system includes a security management center, an agent center, and a cloud platform node. The method includes:

[0025] The proxy center receives the associated attack behavior and the corresponding target-associated cloud platform node information reported by the cloud platform node, wherein the associated attack behavior and the corresponding target-associated cloud platform node information are obtained by the cloud platform node from a non-network layer data packet blocked by its kernel layer fast data path XDP, extracting the five-tuple information of the blocked non-network layer data packet, and performing attack behavior association analysis on the blocked non-network layer data packet based on a preset attack detection rule and the five-tuple information.

[0026] generating corresponding associated attack detection rules based on the associated attack behavior;

[0027] Sending the associated attack detection rule to the target associated cloud platform node, so that the target associated cloud platform node performs attack event association analysis on the associated data packets flowing through itself based on the associated attack detection rule;

[0028] Receive the attack event correlation analysis results corresponding to each of the target-related cloud platform nodes;

[0029] Obtain target attack chain information corresponding to the associated attack event based on the attack event association analysis results corresponding to each target associated cloud platform node;

[0030] Upload the target attack chain information to the security management center.

[0031] In one embodiment, the cloud platform node is provided with an agent; before receiving the associated attack behavior and the corresponding target associated cloud platform node information reported by the cloud platform node, the agent center further includes:

[0032] receiving a blocking packet monitoring program and a blocking packet tracking rule execution program issued by the security management center;

[0033] The blocking packet monitoring program and the blocking packet tracing rule execution program are sent to the agent of the cloud platform node, so that the kernel layer XDP loads the blocking packet monitoring program and the blocking packet tracing rule execution program from the agent.

[0034] In one embodiment, the non-network layer data packet blocked by the cloud platform node kernel layer XDP is obtained through the blocking packet monitoring program loaded by the cloud platform node kernel layer XDP; the associated attack behavior and the corresponding target associated cloud platform node information are extracted by the blocking packet tracking rule execution program loaded by the cloud platform node kernel layer XDP, and the blocked non-network layer data packet is identified after performing attack behavior association analysis based on the preset attack detection rules and the five-tuple information.

[0035] In a fourth aspect, an embodiment of the present application provides a cloud platform east-west traffic security monitoring device implemented on the proxy center side, which is applied to a cloud platform security monitoring system. The cloud platform security monitoring system includes a security management center, a proxy center, and a cloud platform node. The device includes:

[0036] A first receiving unit is configured to receive associated attack behaviors and corresponding target associated cloud platform node information reported by the cloud platform node, wherein the associated attack behaviors and corresponding target associated cloud platform node information are identified by the cloud platform node obtaining a non-network layer data packet blocked by its kernel layer fast data path XDP, extracting quintuple information of the blocked non-network layer data packet, and performing attack behavior association analysis on the blocked non-network layer data packet based on a preset attack detection rule and the quintuple information;

[0037] A generating unit, configured to generate corresponding associated attack detection rules based on the associated attack behavior;

[0038] a sending unit, configured to send the associated attack detection rule to the target associated cloud platform node, so that the target associated cloud platform node performs attack event association analysis on the associated data packets flowing through the target associated cloud platform node based on the associated attack detection rule;

[0039] A second receiving unit is configured to receive the attack event correlation analysis results corresponding to each target associated cloud platform node reported;

[0040] An obtaining unit, configured to obtain target attack chain information corresponding to the associated attack event based on the attack event association analysis results corresponding to each of the target associated cloud platform nodes;

[0041] An uploading unit is used to upload the target attack chain information to the security management center.

[0042] In one embodiment, the cloud platform node is provided with an agent; further comprising:

[0043] A third receiving unit is configured to receive a blocking packet monitoring program and a blocking packet tracking rule execution program issued by the security management center before the first receiving unit receives the associated attack behavior and the corresponding target associated cloud platform node information reported by the cloud platform node;

[0044] The sending unit is used to send the blocking packet monitoring program and the blocking packet tracing rule execution program to the agent of the cloud platform node, so that the kernel layer XDP loads the blocking packet monitoring program and the blocking packet tracing rule execution program from the agent.

[0045] In one embodiment, the non-network layer data packet blocked by the cloud platform node kernel layer XDP is obtained through the blocking packet monitoring program loaded by the cloud platform node kernel layer XDP; the associated attack behavior and the corresponding target associated cloud platform node information are extracted by the blocking packet tracking rule execution program loaded by the cloud platform node kernel layer XDP, and the blocked non-network layer data packet is identified after performing attack behavior association analysis based on the preset attack detection rules and the five-tuple information.

[0046] In the fifth aspect, an embodiment of the present application provides an electronic device, including a memory, a processor, and a computer program stored on the memory and runnable on the processor. When the processor executes the program, the cloud platform east-west traffic security monitoring method described in the present application is implemented.

[0047] In a sixth aspect, an embodiment of the present application provides a computer-readable storage medium on which a computer program is stored. When the program is executed by a processor, the steps in the cloud platform east-west traffic security monitoring method described in the present application are implemented.

[0048] The beneficial effects of this application are as follows:

[0049] The cloud platform east-west traffic security monitoring method and device provided by the embodiment of the present application, the electronic device and the storage medium are applied to a cloud platform security monitoring system, the cloud platform security monitoring system comprises a security management center, an agent center (Agent Center) and a cloud platform node, the cloud platform node obtains non-network layer data packets blocked by a kernel layer XDP (eXpress Data Path, fast data path) of the cloud platform node, extracts five-tuple information of the blocked non-network layer data packets, performs attack behavior correlation analysis on the blocked non-network layer data packets based on a preset attack detection rule and the five-tuple information, identifies a correlated attack behavior and corresponding target correlated cloud platform node information, and reports the correlated attack behavior and the corresponding target correlated cloud platform node information to the agent center, so that the agent center generates a corresponding attack detection rule based on the correlated attack behavior, and distributes the attack detection rule to the target correlated cloud platform node, so that the target correlated cloud platform node performs attack event correlation analysis on the correlated data packets flowing through the target correlated cloud platform node based on the attack detection rule, and reports a respective attack event correlation analysis result to the agent center, so that the agent center obtains target attack chain information corresponding to a correlated attack event according to the respective analysis results of the target correlated cloud platform node, and uploads the target attack chain information to the security management center. In the embodiment of the present application, the cloud platform node obtains non-network layer data packets blocked by the kernel layer XDP, performs attack behavior correlation analysis on the non-network layer data packets blocked by the east-west traffic of the cloud platform nodes based on a preset attack detection rule and five-tuple information extracted from the blocked non-network layer data packets, thereby identifying a correlated attack behavior between the non-network layer data packets blocked by the east-west traffic of the cloud platform nodes and corresponding target correlated cloud platform node information, and reporting the identified correlated attack behavior and the corresponding target correlated cloud platform node information to the agent center. The agent center generates a corresponding attack detection rule based on the correlated attack behavior, and distributes the attack detection rule to the target correlated cloud platform node. Each target correlated cloud platform node performs attack event correlation analysis on the correlated data packets flowing through the target correlated cloud platform node based on the attack detection rule distributed by the agent center, obtains an analysis result, and then the agent center obtains target attack chain information corresponding to a correlated attack event according to the analysis result reported by each target correlated cloud platform node, and uploads the target attack chain information to the security management center. The security management center performs monitoring and processing, thereby realizing security monitoring of the non-network layer data packets blocked by the east-west traffic of the cloud platform, filling the current short board of cloud platform east-west traffic security monitoring, and enhancing cloud platform east-west traffic security monitoring. At the same time, the security monitoring and correlation analysis of the blocked non-network layer data packets based on the kernel occupy a low cloud platform resource overhead, thereby realizing efficient and comprehensive cloud platform east-west traffic security monitoring.

[0050] Other features and advantages of the present application will be described in the following description, and in part will become apparent from the description, or will be understood by practicing the present application. The purposes and other advantages of the present application can be realized and obtained by the structures particularly pointed out in the written description, claims, and drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0051] The drawings described herein are used to provide a further understanding of the present application and constitute a part of the present application. The illustrative embodiments of the present application and their descriptions are used to explain the present application and do not constitute an improper limitation on the present application. In the drawings:

[0052] Figure 1 Schematic diagram of an application scenario of the cloud platform east-west traffic security monitoring method provided in an embodiment of the present application;

[0053] Figure 2 A spatial connection diagram of any cloud platform node, security management center, or proxy center provided in the embodiments of this application;

[0054] Figure 3 A schematic diagram of the implementation process of the cloud platform east-west traffic security monitoring method provided in the embodiment of the present application;

[0055] Figure 4 A schematic diagram of the implementation process of the cloud platform east-west traffic security monitoring method implemented on the cloud platform node side provided in an embodiment of the present application;

[0056] Figure 5 A schematic diagram of the structure of a cloud platform east-west traffic security monitoring device implemented on the cloud platform node side according to an embodiment of the present application;

[0057] Figure 6 A schematic diagram of the implementation process of the cloud platform east-west traffic security monitoring method implemented by the proxy center side provided in an embodiment of the present application;

[0058] Figure 7 A schematic diagram of the structure of a cloud platform east-west traffic security monitoring device implemented on the proxy center side according to an embodiment of the present application;

[0059] Figure 8 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0060] In order to solve the problem that the existing cloud platform east-west traffic security monitoring method only monitors the network layer data packets, but it is difficult to detect security threat incidents of blocked non-network layer data packets, the embodiments of the present application provide a cloud platform east-west traffic security monitoring method, device, electronic device and storage medium.

[0061] The preferred embodiments of the present application are described below in conjunction with the drawings in the specification. It should be understood that the preferred embodiments described herein are only used to illustrate and explain the present application and are not used to limit the present application. In addition, the embodiments and features in the embodiments of the present application can be combined with each other if there is no conflict.

[0062] In this article, it is necessary to understand that the technical terms involved in this application are:

[0063] eBPF (Extending the Berkeley Packet Filter): This allows developers to install faster and more customized packet processing functions, load balancing processes, application analysis scripts, and network monitoring practices. eBPF provides a mechanism to run a small program in response to various kernel and application events.

[0064] 2. XDP: Provides a kernel-mode, high-performance, programmable network packet processing framework. XDP directly handles RX (Receive) packets on the NIC, rapidly processing them by running eBPF instructions in the kernel and seamlessly integrating with the kernel protocol stack. XDP is not a kernel bypass, but rather adds a fast data path between the NIC and the kernel protocol stack. Leveraging eBPF technology, XDP inherits its excellent features of programmability, real-time implementation, and security.

[0065] 3. East-West Traffic: This refers to traffic between different servers or data centers, i.e., server-server traffic. East-West traffic on a cloud platform refers to traffic between different nodes within the cloud platform.

[0066] First reference Figure 1 , which is a schematic diagram of an application scenario of the cloud platform east-west traffic security monitoring method provided by the embodiment of the present application, such as Figure 1The cloud platform east-west traffic security monitoring system shown may include a security management center 101, an agent center 102 and a cloud platform node 103. The cloud platform node 103 may include, but is not limited to: a server running a virtual machine, a node device running a container, and the cloud platform node 103 is provided with an agent. Among them, in the server device running a virtual machine, a Linux operating system is installed on the virtual machine, and an agent is provided on the virtual machine. The node device running the container includes at least two Pods, each Pod runs at least one business container, a Linux operating system is installed on the business container, and an agent is provided on the business container. XDP is included in the Linux kernel protocol stack of the Linux operating system of the server running the virtual machine and the node device running the container. In an embodiment of the present application, a blocking packet monitoring program and a blocking packet tracking rule execution program are loaded at the XDP of the Linux kernel protocol stack. The blocking packet monitoring program and the blocking packet tracking rule execution program are sent from the security management center to the agent center, and sent from the agent center 102 to the agent of each cloud platform node 103. The Linux kernel layer XDP loads the blocking packet monitoring program and the blocking packet tracking rule execution program issued by the security management center 101 from the agent. The cloud platform node 103 obtains the non-network layer data packet blocked by the Linux kernel layer XDP through the blocking packet monitoring program, extracts the five-tuple information of the blocked non-network layer data packet through the blocking packet tracking rule, and performs attack behavior correlation analysis on the blocked non-network layer data packet based on the preset attack detection rules and the five-tuple information, identifies the associated attack behavior and the corresponding target associated cloud platform node information, and associates the associated attack behavior and the corresponding target The target associated cloud platform node information is reported to the proxy center 102. The proxy center 102 generates corresponding associated attack detection rules based on the associated attack behavior, and sends the associated attack detection rules to the target associated cloud platform node 103. The target associated cloud platform node 103 performs attack event correlation analysis on the associated data packets flowing through itself based on the associated attack detection rules, and reports the corresponding attack event correlation analysis results to the proxy center 102. The proxy center 102 obtains the target attack chain information corresponding to the associated attack event based on the corresponding analysis results of the target associated cloud platform node, and uploads the target attack chain information to the security management center 101 for monitoring and processing by the security management center 101, thereby realizing the security monitoring of non-network layer data packets that block the east-west traffic of the cloud platform, filling the current shortcomings of the east-west traffic security monitoring of the cloud platform, and enhancing the east-west traffic security monitoring of the cloud platform. At the same time, the kernel-based security monitoring and correlation analysis of blocked non-network layer data packets occupies a low cloud platform resource overhead, thereby realizing efficient and comprehensive cloud platform east-west traffic security monitoring. For any cloud platform node, its spatial connection diagram with the security management center and the proxy center is as follows: Figure 2As shown in the figure, the security management center and the proxy center are set in the user space, and the proxy and XDP are set in the Linux kernel Network Stack (network protocol stack). The Network Stack includes Sockets, TC Ingress (Traffic Controll Ingress), and TCEgress (Traffic Controll Egress). Based on the eBPF extension function provided by the Linux kernel, the proxy and the proxy center interact with data through Maps (redirection function). The proxy center reports the target attack chain information corresponding to the associated attack event to the security management center.

[0067] Based on the above application scenarios, the following Figures 3 to 7 The exemplary embodiments of the present application are described in more detail. It should be noted that the above application scenarios are only shown to facilitate understanding of the spirit and principles of the present application, and the implementation of the present application is not limited in any way. On the contrary, the implementation of the present application can be applied to any applicable scenario.

[0068] like Figure 3 As shown, it is a schematic diagram of the implementation process of the cloud platform east-west traffic security monitoring method provided by an embodiment of the present application. The cloud platform east-west traffic security monitoring method can be applied to the above-mentioned cloud platform security monitoring system. The cloud platform security monitoring system includes a security management center, an agent center, and a cloud platform node. The cloud platform east-west traffic security monitoring method may include the following steps:

[0069] S21. The security management center sends the blocking packet monitoring program and the blocking packet tracking rule execution program to the agent center.

[0070] During specific implementation, the blocking packet monitoring program is used to obtain non-network layer data packets blocked by the Linux kernel layer XDP of the cloud platform node, and the blocking packet tracking rule execution program is used to perform attack behavior correlation analysis on the non-network layer data packets blocked by the Linux kernel layer XDP.

[0071] S22. The agent center sends a blocking packet monitoring program and a blocking packet tracking rule execution program to the agent in the cloud platform node.

[0072] During specific implementation, the proxy center sends the blocking packet monitoring program and blocking packet tracking rule execution program issued by the security management center to the proxy in the cloud platform node.

[0073] S23. The cloud platform node loads the blocking packet monitoring program and the blocking packet tracking rule execution program from the agent through the kernel layer XDP.

[0074] During specific implementation, the cloud platform node receives the blocking packet monitoring program and the blocking packet tracking rule execution program sent by the agent center through the agent (i.e., agent 1), and then loads the blocking packet monitoring program and the blocking packet tracking rule execution program from the agent (i.e., agent 1) through the Linux kernel layer XDP (i.e., XDP1).

[0075] S24. The cloud platform node obtains the non-network layer data packets blocked by its kernel layer XDP through a blocking packet monitoring program.

[0076] During specific implementation, after the Linux kernel layer XDP (XDP1) of the cloud platform node loads the blocking packet monitoring program, the blocked non-network layer data packet is obtained through the blocking packet monitoring program.

[0077] S25. The cloud platform node extracts the five-tuple information of the blocked non-network layer data packet through the blocking packet tracking rule execution program, and performs attack behavior correlation analysis on the blocked non-network layer data packet based on the preset attack detection rules and the five-tuple information, and identifies the associated attack behavior and the corresponding target-associated cloud platform node information.

[0078] During specific implementation, the Linux kernel layer XDP (XDP1) of the cloud platform node extracts the five-tuple information of the blocked non-network layer data packet through the blocking packet tracking rule execution program, wherein the five-tuple information includes: source IP (Internet Protocol) address information, destination IP address information, source port information, destination port information and transmission protocol information. It can also extract access service information and other information of the blocked non-network layer data packet, and identify whether it carries attack characteristics based on preset attack detection rules, such as injection attack, whether it attempts to gain unauthorized access, etc. If it is determined that there are attack characteristics and attack intentions, the associated blocking packet in the blocked non-network layer data packet is identified based on the five-tuple information, routing information, etc., and the associated attack behavior and the corresponding target-associated cloud platform node information are determined for preliminary attack path analysis. The associated blocking packet is a blocked non-network layer data packet containing the same five-tuple information and having the same attack behavior, and the target-associated cloud platform node is also the cloud platform node through which the associated blocking packet flows (i.e., target-associated cloud platform nodes 2 to N).

[0079] S26. The kernel layer XDP of the cloud platform node sends the associated attack behavior and the corresponding target associated cloud platform node information to the agent.

[0080] During specific implementation, the Linux kernel layer XDP (XDP1) of the cloud platform node sends the identified associated attack behavior and the corresponding target associated cloud platform node information to the agent (agent 1) in the cloud platform node.

[0081] S27. The agent in the cloud platform node reports the associated attack behavior and the corresponding target associated cloud platform node information to the agent center.

[0082] S28. The agent center generates corresponding associated attack detection rules based on the associated attack behavior, and sends the associated attack detection rules to the agent in the target associated cloud platform node.

[0083] During specific implementation, the proxy center generates data packet tracking rules for associated users and assets based on the initially identified associated attack behaviors and the acquired associated user and asset information (i.e., target associated cloud platform node information), namely, associated attack detection rules, which are sent to the corresponding users and assets to track the data packets of the associated users and assets, and analyze the potential attack features in the data packets received and forwarded by these target associated cloud platform nodes. The associated attack detection rules can be set according to actual needs, and the embodiments of the present application do not limit this.

[0084] S29. The agent in the target associated cloud platform node sends the associated attack detection rule issued by the agent center to the kernel layer XDP in the target associated cloud platform node.

[0085] In specific implementation, the agent (i.e., agent 2~N) in each target-associated cloud platform node (i.e., target-associated cloud platform node 2~N) sends the associated attack detection rules issued by the agent center to the kernel layer XDP (i.e., XDP2~N) in each target-associated cloud platform node.

[0086] S210. The target associated cloud platform node performs attack event association analysis on the associated data packets flowing through itself based on the associated attack detection rules through its kernel layer XDP.

[0087] During specific implementation, after the Linux kernel layer XDP of the target associated cloud platform node receives the associated attack detection rules issued by the proxy center sent by the proxy of the target associated cloud platform node, it performs attack event correlation analysis on the associated data packets flowing through itself based on the associated attack detection rules to identify associated attack behaviors and obtain attack event correlation analysis results, wherein the associated data packets flowing through itself include network layer data packets that have the same five-tuple information as the non-network layer data packets blocked by XDP and have the same or similar attack behaviors.

[0088] S211. The target-associated cloud platform nodes send their corresponding attack event association analysis results to their respective agents.

[0089] During specific implementation, the kernel layer XDP (XDP2-N) of each target-related cloud platform node sends the corresponding attack event correlation analysis results to the agent (agent 2-N) of each target-related cloud platform node.

[0090] S212. The agents of the target-related cloud platform nodes report the corresponding attack event correlation analysis results to the agent center.

[0091] During specific implementation, the agents (agents 2 to N) of each target-related cloud platform node report their corresponding attack event correlation analysis results to the agent center.

[0092] S213. The proxy center obtains target attack chain information corresponding to the associated attack event based on the attack event association analysis results corresponding to each target-associated cloud platform node.

[0093] During the specific implementation, the proxy center conducts statistical tracing of the attack event correlation analysis results corresponding to each target-related cloud platform node to obtain a complete attack chain, namely: the target attack chain.

[0094] S214. The agent center uploads the target attack chain information to the security management center.

[0095] During specific implementation, the proxy center will upload the obtained complete attack chain information to the security management center, which will record and process it. For example, the analysis results can be displayed to the operation and maintenance personnel through a display interface, and the operation and maintenance personnel can be notified to proceed to the next step by feeding back the complete attack chain information to the client, etc. The embodiments of this application are not limited to this.

[0096] The embodiment of the present application provides a cloud platform east-west traffic security monitoring method, where a cloud platform node obtains a non-network layer data packet blocked by its kernel layer XDP, extracts the five-tuple information of the blocked non-network layer data packet, performs attack behavior correlation analysis on the blocked non-network layer data packet based on preset attack detection rules and the five-tuple information, identifies the correlated attack behavior and the corresponding target-related cloud platform node information, reports the correlated attack behavior and the corresponding target-related cloud platform node information to an agent center, so that the agent center generates corresponding correlated attack detection rules based on the correlated attack behavior, and sends the correlated attack detection rules to the target-related cloud platform node, so that the target-related cloud platform node performs attack event correlation analysis on the correlated data packet flowing through itself based on the correlated attack detection rules, and reports the corresponding attack event correlation analysis results to the agent center, so that the agent center obtains the target attack chain information corresponding to the correlated attack event based on the corresponding analysis results of the target-related cloud platform node, and uploads the target attack chain information to the security management center. In the embodiment of the present application, the cloud platform node obtains the non-network layer data packet blocked by its kernel layer XDP, and based on the preset attack detection rules and the five-tuple information extracted from the blocked non-network layer data packet, performs attack behavior correlation analysis on the non-network layer data packet blocked by the east-west traffic between the cloud platform nodes, thereby identifying the associated attack behavior between the non-network layer data packets blocked by the east-west traffic between the cloud platform nodes, and the corresponding target-associated cloud platform node information, and reports the identified associated attack behavior and the corresponding target-associated cloud platform node information to the proxy center, which generates the corresponding associated attack detection rules based on the associated attack behavior, and the proxy center The core sends the associated attack detection rules to the target-associated cloud platform nodes. Each target-associated cloud platform node performs attack event correlation analysis on the associated data packets flowing through itself based on the associated attack detection rules sent by the proxy center, and obtains the analysis results. Then, the proxy center obtains the target attack chain information corresponding to the associated attack event based on the analysis results reported by each target-associated cloud platform node, and uploads it to the security management center for monitoring and processing. This achieves security monitoring of non-network layer data packets that block east-west traffic on the cloud platform, fills the current shortcomings in east-west traffic security monitoring on the cloud platform, and enhances east-west traffic security monitoring on the cloud platform. At the same time, the kernel-based security monitoring and correlation analysis of blocked non-network layer data packets occupies a low cloud platform resource overhead, thereby achieving efficient and comprehensive east-west traffic security monitoring on the cloud platform.

[0097] Based on the same inventive concept, an embodiment of the present application also provides a cloud platform east-west traffic security monitoring method implemented on the cloud platform node side. Since the principle of solving the problem by the cloud platform east-west traffic security monitoring method implemented on the cloud platform node side is similar to that of the cloud platform east-west traffic security monitoring method, the implementation of the cloud platform east-west traffic security monitoring method implemented on the cloud platform node side can refer to the implementation of the cloud platform east-west traffic security monitoring method, and the repeated parts will not be repeated.

[0098] like Figure 4 As shown, it is a schematic diagram of the implementation process of the cloud platform east-west traffic security monitoring method implemented on the cloud platform node side provided by an embodiment of the present application. The method is applied to the cloud platform security monitoring system, which includes a security management center, an agent center and a cloud platform node. The method may include the following steps:

[0099] S31. The cloud platform node obtains the non-network layer data packet blocked by its kernel layer XDP.

[0100] S32. Extract the five-tuple information of the blocked non-network layer data packet, perform attack behavior correlation analysis on the blocked non-network layer data packet based on the preset attack detection rules and the five-tuple information, and identify the associated attack behavior and the corresponding target associated cloud platform node information.

[0101] S33. Report the associated attack behavior and the corresponding target associated cloud platform node information to the proxy center, so that the proxy center generates the corresponding associated attack detection rules based on the associated attack behavior, and sends the associated attack detection rules to the target associated cloud platform node, so that the target associated cloud platform node performs attack event association analysis on the associated data packets flowing through itself based on the associated attack detection rules, and reports the corresponding attack event association analysis results to the proxy center, so that the proxy center obtains the target attack chain information corresponding to the associated attack event according to the corresponding attack event association analysis results of the target associated cloud platform node, and uploads the target attack chain information to the security management center.

[0102] In one embodiment, the cloud platform node is provided with an agent; the cloud platform node obtains a non-network layer data packet blocked by its kernel layer fast data path XDP, specifically including:

[0103] The cloud platform node receives the blocking packet monitoring program sent by the agent center through the agent, and the blocking packet monitoring program is issued by the security management center;

[0104] Loading the blocking packet monitoring program from the agent via the kernel layer XDP;

[0105] The non-network layer data packet blocked by the kernel layer XDP is obtained through the blocking packet monitoring program.

[0106] In one embodiment, extracting the five-tuple information of the blocked non-network layer data packet, performing attack behavior correlation analysis on the blocked non-network layer data packet based on preset attack detection rules and the five-tuple information, identifying the associated attack behavior and the corresponding target associated cloud platform node information, specifically including:

[0107] receiving, through the agent, a blocking packet tracing rule execution program sent by the agent center, wherein the blocking packet tracing rule execution program is issued by the security management center;

[0108] Loading the blocking packet tracing rule execution program from the agent via the kernel layer XDP;

[0109] The five-tuple information of the blocked non-network layer data packet is extracted by the blocking packet tracking rule execution program. Based on the preset attack detection rules and the five-tuple information, the blocked non-network layer data packet is subjected to attack behavior correlation analysis to identify the associated attack behavior and the corresponding target associated cloud platform node information.

[0110] Based on the same inventive concept, an embodiment of the present application also provides a cloud platform east-west traffic security monitoring device implemented on the cloud platform node side. Since the principle of solving the problem by the cloud platform east-west traffic security monitoring device implemented on the cloud platform node side is similar to the above-mentioned cloud platform east-west traffic security monitoring method, the implementation of the cloud platform east-west traffic security monitoring device implemented on the cloud platform node side can refer to the implementation of the above-mentioned cloud platform east-west traffic security monitoring method, and the repeated parts will not be repeated.

[0111] like Figure 5 As shown, it is a structural diagram of a cloud platform east-west traffic security monitoring device implemented on the cloud platform node side provided by an embodiment of the present application. The device is applied to a cloud platform security monitoring system. The cloud platform security monitoring system includes a security management center, an agent center, and a cloud platform node. The device may include:

[0112] An acquisition unit 41 is configured to acquire non-network layer data packets blocked by the fast data path XDP at the kernel layer of the cloud platform node;

[0113] An analysis unit 42 is configured to extract the five-tuple information of the blocked non-network layer data packet, perform attack behavior correlation analysis on the blocked non-network layer data packet based on a preset attack detection rule and the five-tuple information, and identify associated attack behaviors and corresponding target associated cloud platform node information;

[0114] The reporting unit 43 is used to report the associated attack behavior and the corresponding target associated cloud platform node information to the proxy center, so that the proxy center generates corresponding associated attack detection rules based on the associated attack behavior, and sends the associated attack detection rules to the target associated cloud platform node, so that the target associated cloud platform node performs attack event association analysis on the associated data packets flowing through itself based on the associated attack detection rules, and reports the corresponding attack event association analysis results to the proxy center, so that the proxy center obtains the target attack chain information corresponding to the associated attack event according to the corresponding attack event association analysis results of the target associated cloud platform node, and uploads the target attack chain information to the security management center.

[0115] In one embodiment, the cloud platform node is provided with an agent;

[0116] The acquisition unit 41 is specifically used to receive the blocking packet monitoring program sent by the agent center through the agent, and the blocking packet monitoring program is issued by the security management center; load the blocking packet monitoring program from the agent through the kernel layer XDP; and obtain the non-network layer data packets blocked by the kernel layer XDP through the blocking packet monitoring program.

[0117] In one embodiment, the analysis unit 42 is specifically used to receive the blocking packet tracking rule execution program sent by the agent center through the agent, and the blocking packet tracking rule execution program is issued by the security management center; load the blocking packet tracking rule execution program from the agent through the kernel layer XDP; extract the five-tuple information of the blocked non-network layer data packet through the blocking packet tracking rule execution program, and perform attack behavior correlation analysis on the blocked non-network layer data packet based on preset attack detection rules and the five-tuple information, and identify the associated attack behavior and the corresponding target associated cloud platform node information.

[0118] Based on the same inventive concept, an embodiment of the present application also provides a cloud platform east-west traffic security monitoring method implemented on the proxy center side. Since the principle of solving the problem by the cloud platform east-west traffic security monitoring method implemented on the proxy center side is similar to that of the cloud platform east-west traffic security monitoring method, the implementation of the cloud platform east-west traffic security monitoring method implemented on the proxy center side can refer to the implementation of the cloud platform east-west traffic security monitoring method, and the repeated parts will not be repeated.

[0119] like Figure 6As shown, it is the implementation process schematic diagram of the east-west traffic security monitoring method of the cloud platform implemented by the proxy center provided by the embodiment of the application, the method is applied to a cloud platform security monitoring system, the cloud platform security monitoring system comprises a security management center, a proxy center and a cloud platform node, and the method can comprise the following steps:

[0120] S51, the proxy center receives the associated attack behavior and the corresponding target associated cloud platform node information reported by the cloud platform node.

[0121] The associated attack behavior and the corresponding target associated cloud platform node information are the non-network layer data packets blocked by the XDP of the kernel layer of the cloud platform node, the quintuple information of the blocked non-network layer data packets is extracted, and the associated attack behavior is identified by performing attack behavior association analysis on the blocked non-network layer data packets based on the preset attack detection rule and the quintuple information.

[0122] S52, the corresponding associated attack detection rule is generated based on the associated attack behavior.

[0123] S53, the associated attack detection rule is sent to the target associated cloud platform node, so that the target associated cloud platform node performs attack event association analysis on the associated data packets flowing through itself based on the associated attack detection rule.

[0124] S54, the respective corresponding attack event association analysis results reported by the target associated cloud platform node are received.

[0125] S55, the target attack chain information corresponding to the associated attack events is obtained according to the respective corresponding attack event association analysis results of the target associated cloud platform node.

[0126] S56, the target attack chain information is uploaded to the security management center.

[0127] In an implementation mode, the cloud platform node is provided with a proxy; before receiving the associated attack behavior and the corresponding target associated cloud platform node information reported by the cloud platform node, the proxy center further comprises:

[0128] receiving the blocking packet monitoring program and the blocking packet tracking rule execution program sent by the security management center;

[0129] sending the blocking packet monitoring program and the blocking packet tracking rule execution program to the proxy of the cloud platform node, so that the XDP of the kernel layer loads the blocking packet monitoring program and the blocking packet tracking rule execution program from the proxy.

[0130] In one embodiment, the non-network layer data packet blocked by the cloud platform node kernel layer XDP is obtained through the blocking packet monitoring program loaded by the cloud platform node kernel layer XDP; the associated attack behavior and the corresponding target associated cloud platform node information are extracted by the blocking packet tracking rule execution program loaded by the cloud platform node kernel layer XDP, and the blocked non-network layer data packet is identified after performing attack behavior association analysis based on the preset attack detection rules and the five-tuple information.

[0131] Based on the same inventive concept, an embodiment of the present application also provides a cloud platform east-west traffic security monitoring device implemented on the proxy center side. Since the principle of solving the problem by the cloud platform east-west traffic security monitoring device implemented on the proxy center side is similar to the above-mentioned cloud platform east-west traffic security monitoring method, the implementation of the cloud platform east-west traffic security monitoring device implemented on the proxy center side can refer to the implementation of the above-mentioned cloud platform east-west traffic security monitoring method, and the repeated parts will not be repeated.

[0132] like Figure 7 As shown, it is a structural diagram of a cloud platform east-west traffic security monitoring device implemented on the proxy center side provided by an embodiment of the present application. The device is applied to a cloud platform security monitoring system. The cloud platform security monitoring system includes a security management center, a proxy center, and a cloud platform node. The device may include:

[0133] A first receiving unit 61 is configured to receive associated attack behaviors and corresponding target associated cloud platform node information reported by the cloud platform node, wherein the associated attack behaviors and corresponding target associated cloud platform node information are identified by the cloud platform node obtaining a non-network layer data packet blocked by its kernel layer fast data path XDP, extracting quintuple information of the blocked non-network layer data packet, and performing attack behavior association analysis on the blocked non-network layer data packet based on a preset attack detection rule and the quintuple information;

[0134] A generating unit 62, configured to generate corresponding associated attack detection rules based on the associated attack behavior;

[0135] a sending unit 63 configured to send the associated attack detection rule to the target associated cloud platform node, so that the target associated cloud platform node performs attack event association analysis on the associated data packets flowing through the target associated cloud platform node based on the associated attack detection rule;

[0136] The second receiving unit 64 is configured to receive the attack event correlation analysis results corresponding to the target associated cloud platform nodes;

[0137] An obtaining unit 65 is configured to obtain target attack chain information corresponding to the associated attack event based on the attack event association analysis results corresponding to the target associated cloud platform nodes;

[0138] The uploading unit 66 is configured to upload the target attack chain information to the security management center.

[0139] In one embodiment, the cloud platform node is provided with an agent; further comprising:

[0140] A third receiving unit is configured to receive a blocking packet monitoring program and a blocking packet tracking rule execution program issued by the security management center before the first receiving unit receives the associated attack behavior and the corresponding target associated cloud platform node information reported by the cloud platform node;

[0141] The sending unit is used to send the blocking packet monitoring program and the blocking packet tracing rule execution program to the agent of the cloud platform node, so that the kernel layer XDP loads the blocking packet monitoring program and the blocking packet tracing rule execution program from the agent.

[0142] In one embodiment, the non-network layer data packet blocked by the cloud platform node kernel layer XDP is obtained through the blocking packet monitoring program loaded by the cloud platform node kernel layer XDP; the associated attack behavior and the corresponding target associated cloud platform node information are extracted by the blocking packet tracking rule execution program loaded by the cloud platform node kernel layer XDP, and the blocked non-network layer data packet is identified after performing attack behavior association analysis based on the preset attack detection rules and the five-tuple information.

[0143] Based on the same technical concept, the embodiment of the present application further provides an electronic device 700, referring to Figure 8 As shown, electronic device 700 is used to implement the cloud platform east-west traffic security monitoring method described in the above method embodiments. Electronic device 700 of this embodiment may include: memory 701, processor 702, and a computer program stored in the memory and executable on the processor, such as a cloud platform east-west traffic security monitoring program. When the processor executes the computer program, the steps of each of the above cloud platform east-west traffic security monitoring method embodiments are implemented.

[0144] The specific connection medium between the memory 701 and the processor 702 is not limited in the embodiment of the present application. Figure 8 In the embodiment, the memory 701 and the processor 702 are connected via a bus 703. The bus 703 is connected to the processor 702 via a bus 703. Figure 8The bus 703 can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Figure 8 Only one thick line is used in the diagram, but this does not mean that there is only one bus or one type of bus.

[0145] Memory 701 may be a volatile memory, such as random-access memory (RAM); a non-volatile memory, such as read-only memory, flash memory, a hard disk drive (HDD), or a solid-state drive (SSD); or any other medium capable of carrying or storing desired program code in the form of instructions or data structures and accessible by a computer, but is not limited thereto. Memory 701 may be a combination of the above memories.

[0146] Processor 702 is used to implement the cloud platform east-west traffic security monitoring method provided in the embodiment of the present application.

[0147] An embodiment of the present application also provides a computer-readable storage medium that stores computer-executable instructions required to execute the above-mentioned processor, which includes a program required to execute the above-mentioned processor.

[0148] In some possible implementations, various aspects of the cloud platform east-west traffic security monitoring method provided in the present application can also be implemented in the form of a program product, which includes program code. When the program product is run on an electronic device, the program code is used to enable the electronic device to execute the steps of the cloud platform east-west traffic security monitoring method according to various exemplary embodiments of the present application described above in this specification.

[0149] Those skilled in the art will appreciate that the embodiments of the present application can be provided as methods, devices, or computer program products. Therefore, the present application can adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application can adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to magnetic disk storage, CD-ROM, optical storage, etc.) that contain computer-usable program code.

[0150] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (apparatus), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the steps in the process. Figure 1 a process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0151] These computer program instructions may also be stored in a computer readable memory that can direct a computer or other programmable data processing device to work in a specific manner, so that the instructions stored in the computer readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 a process or multiple processes and / or boxes Figure 1 The function specified in one or more boxes.

[0152] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operational steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing the instructions executed on the computer or other programmable device for implementing the process. Figure 1 a process or multiple processes and / or boxes Figure 1 The steps for the function specified in one or more boxes.

[0153] Although the preferred embodiments of the present application have been described, those skilled in the art may make additional changes and modifications to these embodiments once they have learned the basic creative concept. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications that fall within the scope of the present application.

[0154] Obviously, those skilled in the art may make various changes and modifications to this application without departing from the spirit and scope of this application. Thus, if these modifications and variations of this application fall within the scope of the claims of this application and their equivalents, this application is intended to include these modifications and variations.

Claims

1. A cloud platform east-west traffic security monitoring method, characterized in that: Applied to a cloud platform security monitoring system, the cloud platform security monitoring system includes a security management center, an agent center, and a cloud platform node. The method includes: The cloud platform node obtains non-network layer data packets blocked by its kernel layer fast data path XDP; Extracting the five-tuple information of the blocked non-network layer data packet, performing attack behavior correlation analysis on the blocked non-network layer data packet based on preset attack detection rules and the five-tuple information, and identifying the associated attack behavior and the corresponding target associated cloud platform node information; The associated attack behavior and the corresponding target associated cloud platform node information are reported to the proxy center, so that the proxy center generates corresponding associated attack detection rules based on the associated attack behavior, and sends the associated attack detection rules to the target associated cloud platform node, so that the target associated cloud platform node performs attack event association analysis on the associated data packets flowing through itself based on the associated attack detection rules, and reports the corresponding attack event association analysis results to the proxy center, so that the proxy center obtains the target attack chain information corresponding to the associated attack event according to the corresponding attack event association analysis results of the target associated cloud platform node, and uploads the target attack chain information to the security management center.

2. The method according to claim 1, wherein The cloud platform node is provided with an agent; the cloud platform node obtains the non-network layer data packet blocked by its kernel layer fast data path XDP, specifically including: The cloud platform node receives the blocking packet monitoring program sent by the agent center through the agent, and the blocking packet monitoring program is issued by the security management center; Loading the blocking packet monitoring program from the agent via the kernel layer XDP; The non-network layer data packet blocked by the kernel layer XDP is obtained through the blocking packet monitoring program.

3. The method according to claim 2, wherein Extract the five-tuple information of the blocked non-network layer data packet, perform attack behavior correlation analysis on the blocked non-network layer data packet based on the preset attack detection rules and the five-tuple information, identify the associated attack behavior and the corresponding target associated cloud platform node information, specifically including: receiving, through the agent, a blocking packet tracing rule execution program sent by the agent center, wherein the blocking packet tracing rule execution program is issued by the security management center; Loading the blocking packet tracing rule execution program from the agent via the kernel layer XDP; The five-tuple information of the blocked non-network layer data packet is extracted by the blocking packet tracking rule execution program. Based on the preset attack detection rules and the five-tuple information, the blocked non-network layer data packet is subjected to attack behavior correlation analysis to identify the associated attack behavior and the corresponding target associated cloud platform node information.

4. A cloud platform east-west traffic security monitoring method, characterized in that: Applied to a cloud platform security monitoring system, the cloud platform security monitoring system includes a security management center, an agent center, and a cloud platform node. The method includes: The proxy center receives the associated attack behavior and the corresponding target-associated cloud platform node information reported by the cloud platform node, wherein the associated attack behavior and the corresponding target-associated cloud platform node information are obtained by the cloud platform node from a non-network layer data packet blocked by its kernel layer fast data path XDP, extracting the five-tuple information of the blocked non-network layer data packet, and performing attack behavior association analysis on the blocked non-network layer data packet based on a preset attack detection rule and the five-tuple information. generating corresponding associated attack detection rules based on the associated attack behavior; Sending the associated attack detection rule to the target associated cloud platform node, so that the target associated cloud platform node performs attack event association analysis on the associated data packets flowing through itself based on the associated attack detection rule; Receive the attack event correlation analysis results corresponding to each of the target-related cloud platform nodes; Obtain target attack chain information corresponding to the associated attack event based on the attack event association analysis results corresponding to each target associated cloud platform node; Upload the target attack chain information to the security management center.

5. The method according to claim 4, wherein The cloud platform node is provided with an agent; before the agent center receives the associated attack behavior and the corresponding target associated cloud platform node information reported by the cloud platform node, it also includes: receiving a blocking packet monitoring program and a blocking packet tracking rule execution program issued by the security management center; The blocking packet monitoring program and the blocking packet tracing rule execution program are sent to the agent of the cloud platform node, so that the kernel layer XDP loads the blocking packet monitoring program and the blocking packet tracing rule execution program from the agent.

6. The method according to claim 5, wherein The non-network layer data packets blocked by the cloud platform node kernel layer XDP are obtained through the blocking packet monitoring program loaded by the cloud platform node kernel layer XDP; the associated attack behaviors and the corresponding target associated cloud platform node information are obtained by extracting the five-tuple information of the blocked non-network layer data packets through the blocking packet tracking rule execution program loaded by the cloud platform node kernel layer XDP, and identifying the blocked non-network layer data packets after performing attack behavior association analysis based on the preset attack detection rules and the five-tuple information.

7. A cloud platform east-west traffic security monitoring device, characterized in that: Applied to a cloud platform security monitoring system, the cloud platform security monitoring system includes a security management center, an agent center, and a cloud platform node. The device includes: An acquisition unit is used to acquire non-network layer data packets blocked by the fast data path XDP at the kernel layer of the cloud platform node; an analyzing unit, configured to extract the five-tuple information of the blocked non-network layer data packet, perform attack behavior correlation analysis on the blocked non-network layer data packet based on a preset attack detection rule and the five-tuple information, and identify the associated attack behavior and the corresponding target associated cloud platform node information; A reporting unit is used to report the associated attack behavior and the corresponding target associated cloud platform node information to the proxy center, so that the proxy center generates corresponding associated attack detection rules based on the associated attack behavior, and sends the associated attack detection rules to the target associated cloud platform node, so that the target associated cloud platform node performs attack event association analysis on the associated data packets flowing through itself based on the associated attack detection rules, and reports the corresponding attack event association analysis results to the proxy center, so that the proxy center obtains the target attack chain information corresponding to the associated attack event according to the corresponding attack event association analysis results of the target associated cloud platform node, and uploads the target attack chain information to the security management center.

8. The device according to claim 7, wherein The cloud platform node is provided with an agent; The acquisition unit is specifically used to receive the blocking packet monitoring program sent by the agent center through the agent, and the blocking packet monitoring program is issued by the security management center; load the blocking packet monitoring program from the agent through the kernel layer XDP; and obtain the non-network layer data packets blocked by the kernel layer XDP through the blocking packet monitoring program.

9. The device according to claim 8, wherein The analysis unit is specifically used to receive the blocking packet tracking rule execution program sent by the agent center through the agent, and the blocking packet tracking rule execution program is issued by the security management center; load the blocking packet tracking rule execution program from the agent through the kernel layer XDP; extract the five-tuple information of the blocked non-network layer data packet through the blocking packet tracking rule execution program, and perform attack behavior correlation analysis on the blocked non-network layer data packet based on preset attack detection rules and the five-tuple information, and identify the associated attack behavior and the corresponding target associated cloud platform node information.

10. A cloud platform east-west traffic security monitoring device, characterized in that: Applied to a cloud platform security monitoring system, the cloud platform security monitoring system includes a security management center, an agent center, and a cloud platform node. The device includes: A first receiving unit is configured to receive associated attack behaviors and corresponding target associated cloud platform node information reported by the cloud platform node, wherein the associated attack behaviors and corresponding target associated cloud platform node information are identified by the cloud platform node obtaining a non-network layer data packet blocked by its kernel layer fast data path XDP, extracting quintuple information of the blocked non-network layer data packet, and performing attack behavior association analysis on the blocked non-network layer data packet based on a preset attack detection rule and the quintuple information; A generating unit, configured to generate corresponding associated attack detection rules based on the associated attack behavior; a sending unit, configured to send the associated attack detection rule to the target associated cloud platform node, so that the target associated cloud platform node performs attack event association analysis on the associated data packets flowing through the target associated cloud platform node based on the associated attack detection rule; A second receiving unit is configured to receive the attack event correlation analysis results corresponding to each target associated cloud platform node reported; An obtaining unit, configured to obtain target attack chain information corresponding to the associated attack event based on the attack event association analysis results corresponding to each of the target associated cloud platform nodes; An uploading unit is used to upload the target attack chain information to the security management center.

11. The device according to claim 10, wherein The cloud platform node is provided with an agent; and further comprises: A third receiving unit is configured to receive a blocking packet monitoring program and a blocking packet tracking rule execution program issued by the security management center before the first receiving unit receives the associated attack behavior and the corresponding target associated cloud platform node information reported by the cloud platform node; The sending unit is used to send the blocking packet monitoring program and the blocking packet tracing rule execution program to the agent of the cloud platform node, so that the kernel layer XDP loads the blocking packet monitoring program and the blocking packet tracing rule execution program from the agent.

12. The device according to claim 11, wherein The non-network layer data packets blocked by the cloud platform node kernel layer XDP are obtained through the blocking packet monitoring program loaded by the cloud platform node kernel layer XDP; the associated attack behaviors and the corresponding target associated cloud platform node information are obtained by extracting the five-tuple information of the blocked non-network layer data packets through the blocking packet tracking rule execution program loaded by the cloud platform node kernel layer XDP, and identifying the blocked non-network layer data packets after performing attack behavior association analysis based on the preset attack detection rules and the five-tuple information.

13. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: When the processor executes the program, the cloud platform east-west traffic security monitoring method according to any one of claims 1 to 6 is implemented.

14. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, the steps of the cloud platform east-west traffic security monitoring method as described in any one of claims 1 to 6 are implemented.

Images