Method, device and equipment for cloud platform real-time intrusion detection and medium

Abstract

The invention provides a method, a device, equipment and a medium for real-time intrusion detection of a cloud platform, and the method comprises the steps: capturing all operation activities related to an AWS account, recording the operation activities in a Cloud Trail log file, and storing the operation activities in a set storage bucket; a Lambda trigger of the AWS is configured, and whether a new Cloud Trail log file is stored in the storage bucket or not is monitored; when a new Cloud Trail log file is written in, analyzing the Cloud Trail log file, and if an abnormal behavior exists, entering the next step; otherwise, ending the step; after an abnormal behavior is detected, operation is carried out according to a preset response rule; according to the invention, efficient and real-time intrusion detection of the cloud environment can be realized at low cost, the detection rule and the response strategy can be flexibly adjusted according to specific requirements, and the operability and the practicability are greatly improved.

Description

Technical Field

[0001] The present invention relates to the field of cloud platform intrusion detection technology, and in particular to a method, device, equipment and medium for real-time intrusion detection on a cloud platform. Background Art

[0002] As enterprise data moves to the cloud, the security threats facing cloud environments are increasing, and intrusion detection systems (IDS) have become a core tool for enterprises to defend against network attacks. Intrusion detection systems analyze logs and monitor network traffic to identify and report potential intrusions.

[0003] At present, the intrusion detection systems on the market are mainly divided into two categories: commercial intrusion detection systems and open source intrusion detection systems.

[0004] 1. Commercial Intrusion Detection System: Commercial intrusion detection systems, such as AWS GuardDuty, Palo Alto Networks, and Cisco Secure IPS, provide complete network security solutions with powerful real-time monitoring and analysis capabilities. These systems usually have built-in efficient detection engines and comprehensive rule bases, which can quickly respond to threats and provide customized reports. In addition, commercial systems also provide technical support and regular updates to ensure that corporate security policies are synchronized with the latest threat intelligence.

[0005] However, the main disadvantage of these systems is their high cost. Not only do companies need to pay high licensing fees, but they also have to bear the costs of customized deployment and long-term maintenance. Especially for small and medium-sized enterprises, purchasing and using commercial IDS systems may be too much of a financial burden. In addition, commercial systems are usually designed for traditional local or hybrid network environments. Although they are gradually increasing support for cloud environments, there may still be delays or complex configuration issues in adapting to cloud logs such as AWS CloudTrail.

[0006] 2. Open Source Intrusion Detection System: Open source intrusion detection systems, such as Snort, Suricata, OSSEC, etc., are popular because of their free and flexible nature. Through community-provided rule sets, these systems can be customized to meet the security needs of different network environments. Their flexibility and scalability enable enterprises to adjust system settings according to their own needs.

[0007] However, open source IDS systems also have obvious shortcomings. First, they require enterprises to invest a lot of time and resources in maintenance and tuning, especially in rule writing, log analysis, and false alarm processing. In addition, most open source systems are designed mainly for local environments and lack optimization for cloud native services such as AWS CloudTrail. When processing large-scale cloud logs, performance bottlenecks and false alarm rates are high, which is not suitable for cloud environments that require efficient real-time responses. In addition, enterprises also need to solve system integration problems on their own, such as integration with serverless computing such as AWS Lambda, which increases the complexity of use. Summary of the invention

[0008] The technical problem to be solved by the present invention is to provide a method, device, equipment and medium for real-time intrusion detection on a cloud platform, which can not only realize efficient and real-time intrusion detection on a cloud environment at a low cost, but also flexibly adjust detection rules and response strategies according to specific needs, thereby greatly improving operability and practicality.

[0009] In a first aspect, the present invention provides a method for real-time intrusion detection on a cloud platform, comprising the following steps: Step 1: Enable AWS CloudTrail to capture all AWS account-related operations and record them in a CloudTrail log file and store them in the specified bucket. Step 2: Configure the AWS Lambda trigger to monitor whether there is a new CloudTrail log file stored in the storage bucket. If yes, proceed to step 3; otherwise, continue monitoring. Step 3: When a new CloudTrail log file is written, analyze the CloudTrail log file. If there is abnormal behavior, proceed to step 4; otherwise, end the step; Step 4: After abnormal behavior is detected, take action according to the preset response rules.

[0010] In a second aspect, the present invention provides a device for real-time intrusion detection on a cloud platform, comprising the following modules: The storage module starts AWS CloudTrail, captures all AWS account-related operations, records them in a CloudTrail log file, and stores them in the specified storage bucket; The monitoring module configures the AWS Lambda trigger to monitor whether there is a new CloudTrail log file stored in the storage bucket. If so, it enters the abnormality determination module, otherwise, it continues to monitor; The abnormality determination module analyzes the CloudTrail log file when a new CloudTrail log file is written. If there is abnormal behavior, the abnormality handling module is entered; otherwise, the step ends; The exception handling module detects abnormal behavior and takes action according to the preset response rules.

[0011] In a third aspect, the present invention provides an electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the method described in the first aspect when executing the program.

[0012] In a fourth aspect, the present invention provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the method described in the first aspect.

[0013] One or more technical solutions provided by the present invention have at least the following technical effects or advantages: Low cost: This invention is based on the serverless computing capability of AWS Lambda. Enterprises do not need to purchase or maintain cloud servers, and the pay-per-use model greatly reduces costs. In addition, services such as S3 and CloudTrail are AWS native services, further reducing deployment and operation costs.

[0014] Real-time response: By setting AWS Lambda triggers, the CloudTrail log file changes in S3 are monitored in real time, and custom detection rules are automatically triggered to achieve instant processing of abnormal behaviors. Compared with existing commercial and open source systems, the present invention has stronger real-time performance.

[0015] Flexible processing: The present invention provides a variety of processing methods, such as only issuing an alarm, disabling suspicious accounts, etc. Enterprises can flexibly customize response plans according to their own needs and automatically execute security measures in combination with AWS SDK.

[0016] No need for complex configuration: The present invention makes full use of AWS's native services and can achieve deep integration and real-time monitoring of the AWS environment without complex custom configuration, reducing the burden on enterprises in configuration and maintenance.

[0017] The present invention can not only realize efficient and real-time intrusion detection in cloud environment at low cost, but also can flexibly adjust detection rules and response strategies according to specific needs, which greatly improves operability and practicality.

[0018] The above description is only an overview of the technical solution of the present invention. In order to more clearly understand the technical means of the present invention, it can be implemented according to the contents of the specification. In order to make the above and other purposes, features and advantages of the present invention more obvious and easy to understand, the specific implementation methods of the present invention are listed below. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] The present invention will be further described below in conjunction with embodiments with reference to the accompanying drawings.

[0020] Figure 1 This is a flowchart of the method in Embodiment 1 of the present invention. Figure 2 It is a schematic diagram of the structure of the device in the second embodiment of the present invention. DETAILED DESCRIPTION

[0021] The embodiments of the present application provide a method, apparatus, device and medium for real-time intrusion detection on a cloud platform, utilize AWS's cloud native services, and use customized detection rules to monitor the user's behavior in the cloud environment in real time, and respond promptly when an anomaly is found.

[0022] The technical solution in the embodiment of the present application has the following general idea: 1. Step S100: Configuration and storage of CloudTrail logs First, the user logs in to the AWS Management Console, enters the CloudTrail module, enables CloudTrail logs and configures them to be stored in AWS's S3 object storage in real time. CloudTrail captures all operational activities related to the AWS account, including API calls, resource changes, and user behavior. To ensure the real-time nature of the logs, the logs are stored in S3, and automated storage rules are configured to ensure that log files can be generated in real time to provide data support for subsequent detection.

[0023] 2. Step S101: Configure AWS Lambda trigger In order to achieve real-time monitoring of logs, configure the event notification mechanism in the S3 bucket, set up AWS's Lambda trigger, and listen to the "new file" event in all storage buckets. Whenever a new log file is written to the S3 bucket, the trigger will automatically call AWS's Lambda function to ensure that the new operation log can be processed as soon as possible.

[0024] 3. Step S102: Rule analysis and abnormal behavior detection Multiple custom intrusion detection rules are implemented in AWS Lambda functions. Each time the Lambda function is triggered, it analyzes the newly generated CloudTrail logs and detects the operations in the logs according to the following rules: 3.1 Off-site login detection: Determine whether the IP address from which the user logs in is outside the user's usual login location. If an off-site login is detected, the operation will be marked as a potential anomaly for subsequent processing.

[0025] 3.2 Abnormal module access: Check whether the user has accessed a module that the account has not accessed in the past month, and the stay time in the module exceeds 30 seconds. If this condition is met, the behavior will be recorded as a suspicious operation.

[0026] 3.3 Modify the exposed port of the server security group: Check whether there is any modification operation on the server security group, especially exposing any port to the public network. If such operation is found, it will be automatically determined as abnormal behavior.

[0027] 3.4 Modify the security group of highly sensitive ports: Monitor the modification of security groups involving highly sensitive ports (including port 22, port 3389, port 3306, and port 6379). If such modification is detected, it will be immediately marked as a high-risk anomaly.

[0028] 3.5 Use snapshot to create a database: Detect whether the user has created a new database instance through a snapshot. If so, an alarm will be issued for this operation.

[0029] 3.6 Deleting multiple snapshots: If it is detected that a user has manually deleted more than 3 snapshots, this behavior will be considered abnormal and will trigger an alert.

[0030] 3.7 Accessing multiple modules in a short period of time: If a user accesses more than 8 cloud platform modules in the last 10 minutes, it will be considered as an abnormal access and further analyzed.

[0031] 3.8 Reset server password: Monitor whether there are any server password reset operations, especially when there is no obvious reason, which will trigger an alarm.

[0032] 3.9 Reset database password: Similarly, if a user performs a database password reset operation, it will be marked as an abnormal behavior.

[0033] The core code (pyton) in Lambda is as follows: import json import boto3 import gzip from io import BytesIO from datetime import datetime, timedelta # Initialize the SNS client sns_client = boto3.client('sns') # Initialize the S3 client s3_client = boto3.client('s3') #SNS topic ARN, used for alarm SNS_TOPIC_ARN = 'your-sns-topic-arn' #Store the S3 bucket name and prefix for CloudTrail logs S3_BUCKET_NAME = 'your-cloudtrail-bucket-name' S3_LOG_PREFIX = 'your-cloudtrail-log-prefix / ' #The path prefix of the log file #Lambda Processing Function def lambda_handler(event, context): #Get the S3 log file information of the current login event bucket_name = event['Records'][0]['s3']['bucket']['name'] object_key = event['Records'][0]['s3']['object']['key'] #Get the CloudTrail log data of the current login log current_log_entries = get_cloudtrail_logs_from_s3(bucket_name,object_key) #Get the CloudTrail login log data for the last 10 days past_log_entries = get_past_10_days_logs(S3_BUCKET_NAME, S3_LOG_PREFIX) #Process the current login log and perform remote login detection for entry in current_log_entries: if entry['eventName'] == 'ConsoleLogin': user_arn = entry['userIdentity']['arn'] current_ip = entry['sourceIPAddress'] event_time = entry['eventTime'] #Compare the current IP with the login IP in the past 10 days if is_unusual_login(user_arn, current_ip, past_log_entries): send_alert(f"Remote login detection: User {user_arn} logged in from {current_ip}, suspected abnormal login") #Get CloudTrail log content from S3 def get_cloudtrail_logs_from_s3(bucket_name, object_key): response = s3_client.get_object(Bucket=bucket_name, Key=object_key) log_data = gzip.GzipFile(fileobj=BytesIO(response['Body'].read())).read() return json.loads(log_data)['Records'] #Get CloudTrail logs for the past 10 days def get_past_10_days_logs(bucket_name, prefix): log_entries = [] today = datetime.utcnow() ten_days_ago = today - timedelta(days=10) #Use the S3 client to list log files for the past 10 days result = s3_client.list_objects_v2(Bucket=bucket_name, Prefix=prefix) for item in result.get('Contents', []): log_date_str = item['LastModified'].strftime('%Y-%m-%d') log_date = datetime.strptime(log_date_str, '%Y-%m-%d') #Only process the logs from the last 10 days if log_date >= ten_days_ago: log_entries.extend(get_cloudtrail_logs_from_s3(bucket_name, item['Key'])) return log_entries #Judge whether it is a remote login def is_unusual_login(user_arn, current_ip, past_log_entries): #Extract the user's login IP address for the past 10 days past_ips = set( entry['sourceIPAddress'] for entry in past_log_entries if entry['eventName'] == 'ConsoleLogin' and entry['userIdentity']['arn'] == user_arn) #If the current IP is not in the IP record of the past 10 days, it is considered to be a remote login return current_ip not in past_ips #Send alert to SNS def send_alert(message):sns_client.publish(TopicArn=SNS_TOPIC_ARN,Message=message); 4. Step S105: Exception handling and response When the Lambda function detects abnormal behavior, it takes corresponding measures according to the preset response rules, which mainly include the following two processing methods: Alert only: For abnormal behaviors with lower risks, send alert information through AWS's SNS (Simple Notification Service) to notify relevant persons in charge. Notification methods may include SMS, phone calls, or instant messaging (IM). This solution is suitable for operations that require further manual confirmation.

[0034] Disabling suspicious accounts: For high-risk abnormal operations, such as those involving sensitive port modifications, large-scale snapshot deletions, or password resets, AWS SDK will automatically perform emergency response operations, such as disabling related user accounts, and notifying the security manager of the processing results through SNS. This automated processing method can prevent potential intrusions in the shortest possible time and reduce the exposure time of security vulnerabilities.

[0035] Embodiment 1 like Figure 1 As shown, this embodiment provides a method for real-time intrusion detection on a cloud platform, which is used for real-time intrusion detection on an AWS cloud platform, and includes the following steps: Step 1: Enable AWS CloudTrail to capture all AWS account-related operations and record them in a CloudTrail log file and store them in the specified bucket. Step 2: Configure the AWS Lambda trigger to monitor whether there is a new CloudTrail log file stored in the storage bucket. If yes, proceed to step 3; otherwise, continue monitoring. Step 3: When a new CloudTrail log file is written, analyze the CloudTrail log file. If there is abnormal behavior, proceed to step 4; otherwise, end the step; Step 4: After abnormal behavior is detected, take action according to the preset response rules.

[0036] In this embodiment, preferably, step 1 specifically includes: logging in to the AWS management console and starting CloudTrail, where CloudTrail captures all operation activities related to the AWS account and records them in a CloudTrail log file, where the operation activities related to the AWS account include API calls, resource changes, and user behaviors; configuring storage rules to store the CloudTrail log file in a set storage bucket.

[0037] In this embodiment, preferably, step 3 specifically includes: when a new CloudTrail log file is written, parsing the CloudTrail log file and reading the data therein; Compare the login IP address with the commonly used login IP address. If they are different, it means the login is from another location and the operation will be marked as abnormal behavior. If it is detected that the account has accessed a cloud platform module that it has not accessed in the last N months, and the stay time in the cloud platform module exceeds M seconds, the operation will be marked as abnormal behavior; If a modification operation to a server security group is detected, the operation will be marked as abnormal behavior; If it is detected that the account has created a new database instance through a snapshot, the operation will be marked as abnormal behavior; If it is detected that the account has manually deleted more than P snapshots, the operation will be marked as abnormal behavior; If the account accesses more than R cloud platform modules within Q minutes, the operation will be marked as abnormal behavior; If the monitored account has a server password reset operation, the operation will be marked as abnormal behavior; If the account performs a database password reset operation, the operation will be marked as abnormal behavior; If there is abnormal behavior, go to step 4; otherwise, end the step; N, M, P, Q, and R are all user-defined positive integers.

[0038] In this embodiment, preferably, step 4 is specifically as follows: after abnormal behavior is detected, the abnormal behavior is divided into high-risk behavior and low-risk behavior. If it is a low-risk behavior, an alarm message is sent through AWS's SNS to notify the relevant person in charge; if it is a high-risk behavior, an emergency response operation is performed through AWS's SDK, the account is disabled, and the processing result is notified to the security person in charge through SNS.

[0039] Based on the same inventive concept, the present application also provides a device corresponding to the method in Example 1, see Example 2 for details.

[0040] Embodiment 2

[0041] like Figure 2 As shown, in this embodiment, a device for real-time intrusion detection on a cloud platform is provided, which is used for real-time intrusion detection on an AWS cloud platform and includes the following modules: The storage module starts AWS CloudTrail, captures all AWS account-related operations, records them in a CloudTrail log file, and stores them in the specified storage bucket; The monitoring module configures the AWS Lambda trigger to monitor whether there is a new CloudTrail log file stored in the storage bucket. If so, it enters the abnormality determination module, otherwise, it continues to monitor; The abnormality determination module analyzes the CloudTrail log file when a new CloudTrail log file is written. If there is abnormal behavior, the abnormality handling module is entered; otherwise, the step ends; The exception handling module detects abnormal behavior and takes action according to the preset response rules.

[0042] In this embodiment, preferably, the storage module is specifically: log in to the AWS management console and start CloudTrail, CloudTrail captures all operation activities related to the AWS account and records them in a CloudTrail log file, the operation activities related to the AWS account include API calls, resource changes and user behaviors; configure storage rules to store the CloudTrail log file in a set storage bucket.

[0043] In this embodiment, preferably, the abnormality determination module is specifically: when a new CloudTrail log file is written, the CloudTrail log file is parsed and the data therein is read; Compare the login IP address with the commonly used login IP address. If they are different, it means the login is from another location and the operation will be marked as abnormal behavior. If it is detected that the account has accessed a cloud platform module that it has not accessed in the last N months, and the stay time in the cloud platform module exceeds M seconds, the operation will be marked as abnormal behavior; If a modification operation to a server security group is detected, the operation will be marked as abnormal behavior; If it is detected that the account has created a new database instance through a snapshot, the operation will be marked as abnormal behavior; If it is detected that the account has manually deleted more than P snapshots, the operation will be marked as abnormal behavior; If the account accesses more than R cloud platform modules within Q minutes, the operation will be marked as abnormal behavior; If the monitored account has a server password reset operation, the operation will be marked as abnormal behavior; If the account performs a database password reset operation, the operation will be marked as abnormal behavior; If there is abnormal behavior, enter the exception handling module; otherwise end; N, M, P, Q, and R are all custom positive integers.

[0044] In this embodiment, preferably, the exception handling module is specifically as follows: after detecting abnormal behavior, the abnormal behavior is divided into high-risk behavior and low-risk behavior. If it is a low-risk behavior, an alarm message is sent through AWS's SNS to notify the relevant person in charge; if it is a high-risk behavior, an emergency response operation is performed through AWS's SDK, the account is disabled, and the processing result is notified to the security person in charge through SNS.

[0045] Since the device introduced in the second embodiment of the present invention is a device used to implement the method of the first embodiment of the present invention, those skilled in the art can understand the specific structure and deformation of the device based on the method introduced in the first embodiment of the present invention, so it is not described here in detail. All devices used in the method of the first embodiment of the present invention belong to the scope of protection of the present invention.

[0046] Based on the same inventive concept, the present application provides an electronic device embodiment corresponding to the first embodiment, see the third embodiment for details.

[0047] Embodiment 3

[0048] This embodiment provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, any implementation method in the first embodiment can be implemented.

[0049] Since the electronic device introduced in this embodiment is a device used to implement the method in the first embodiment of the present application, based on the method introduced in the first embodiment of the present application, a person skilled in the art can understand the specific implementation of the electronic device of the present embodiment and its various variations, so how the electronic device implements the method in the embodiment of the present application is not described in detail here. As long as a person skilled in the art implements the device used by the method in the embodiment of the present application, it belongs to the scope of protection of the present application.

[0050] Based on the same inventive concept, the present application provides a storage medium corresponding to the first embodiment, see the fourth embodiment for details.

[0051] Embodiment 4

[0052] This embodiment provides a computer-readable storage medium on which a computer program is stored. When the computer program is executed by a processor, any implementation method in the first embodiment can be implemented.

[0053] The technical solution provided in the embodiments of the present application has at least the following technical effects or advantages: 1. Improvement of real-time detection capabilities: Existing intrusion detection systems usually rely on scheduled tasks or batch processing mechanisms to analyze cloud logs, which leads to a lag in detection and an inability to detect potential threats in a timely manner. The present invention stores logs in real time in AWS's CloudTrail and automatically triggers detection rules through AWS's Lambda, so that detection can be performed at the moment the log is generated. Specifically, the AWS Lambda trigger configured in this embodiment can immediately call the function and perform security analysis when a new log file is generated. This real-time automatic triggering mechanism significantly improves the response speed, ensures that threats can be detected and processed in the first place, and avoids security vulnerabilities caused by delays.

[0054] 2. Accuracy of abnormal behavior detection Existing commercial and open source intrusion detection systems often detect abnormal behavior based on fixed rule sets or common patterns, which can easily lead to high false alarm rates and missed reports. The present invention introduces a detection rule set, and in particular, enhances the flexibility and accuracy of the detection rules by analyzing the historical records of the user's behavior patterns (such as the login IP in the last 10 days). For example, this embodiment will analyze the user's login behavior and determine whether it is a remote login by comparing the current login IP with the login IP in the past 10 days. This analysis based on historical behavior benchmarks effectively reduces false alarms and significantly improves the accuracy of detection, and can more flexibly adapt to complex enterprise security needs.

[0055] 3. Reduce the security management costs of enterprises Traditional commercial intrusion detection systems usually require expensive hardware resources and continuous maintenance costs, especially when dealing with large-scale logs, enterprises need to configure additional servers to process data. The present invention avoids the need for additional hardware resources by using AWS's Lambda serverless architecture. Billing is only based on actual usage, which greatly reduces the operation and maintenance costs of the enterprise. In this embodiment, the Lambda function will be automatically executed according to the amount of triggered logs, without the need to pre-configure server resources, and the enterprise can flexibly expand or reduce resource consumption according to usage. This pay-as-you-go model of the serverless architecture greatly reduces the cost burden of enterprises in intrusion detection.

[0056] 4. Strict monitoring of highly sensitive ports and key operations In the prior art, although many intrusion detection systems can detect attacks at the network layer, they are not sensitive enough to detect some highly sensitive ports (such as 22, 3389, 3306, 6379) and key resource modification operations (such as modifying security groups or resetting passwords), resulting in potential risks not being identified in a timely manner. This embodiment uses custom rules to conduct in-depth monitoring of behaviors involving highly sensitive ports. In step S102, security group modification behaviors related to these ports can be identified, and early warnings or automated processing can be triggered immediately. In addition, key operations (such as server password reset, database password modification, etc.) are also detected in real time and alarms are sent to ensure that important resources of the enterprise are not threatened.

[0057] 5. Avoid complex integration work Intrusion detection systems in the prior art usually need to be integrated with multiple external systems, such as databases, log management systems, etc., which increases the complexity of system integration and maintenance. This embodiment simplifies the deployment and operation and maintenance process by completely based on AWS native services (such as S3, CloudTrail, Lambda, and SNS), without the need for additional integration and configuration. Specifically in steps S100 and S101, AWS's S3 is used for log storage, AWS's Lambda is used for detection, and SNS is used for alarm push. The entire architecture is tightly integrated into the AWS ecosystem. Enterprises only need simple configuration to complete deployment, which greatly reduces integration and maintenance costs.

[0058] 6. High scalability and availability Existing intrusion detection systems usually require a lot of computing resources and bandwidth when processing large-scale log data, which increases the burden on the system. The present invention can dynamically adjust resources according to the amount of logs by utilizing the high scalability of the AWS cloud platform. For example, in this embodiment, log storage uses S3 object storage, which has extremely high storage expansion capabilities; Lambda functions are called on demand to process log data of different sizes, and will not cause performance degradation due to the increase in data volume. Combined with AWS's global infrastructure, the intrusion detection method of this embodiment can ensure high availability worldwide and adapt to the needs of enterprises of different sizes.

[0059] Those skilled in the art will appreciate that embodiments of the present invention may be provided as methods, systems, or computer program products. Therefore, the present invention may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0060] The present invention is described with reference to flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0061] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0062] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 A step that specifies a function in one or more boxes.

[0063] Although the specific implementation modes of the present invention are described above, those skilled in the art should understand that the specific implementation modes described are only illustrative and are not intended to limit the scope of the present invention. Equivalent modifications and changes made by those skilled in the art in accordance with the spirit of the present invention should be included in the scope of protection of the claims of the present invention.

Claims

1. A method for real-time intrusion detection on a cloud platform, characterized in that: The steps include: Step 1: Enable AWS CloudTrail to capture all AWS account-related operations and record them in a CloudTrail log file and store them in the specified bucket. Step 2: Configure the AWS Lambda trigger to monitor whether there is a new CloudTrail log file stored in the storage bucket. If yes, proceed to step 3; otherwise, continue monitoring. Step 3: When a new CloudTrail log file is written, analyze the CloudTrail log file. If there is abnormal behavior, proceed to step 4; otherwise, end the step; Step 4: After abnormal behavior is detected, take action according to the preset response rules.

2. A method for real-time intrusion detection on a cloud platform according to claim 1, characterized in that: The step 1 is specifically as follows: log in to the AWS management console and start CloudTrail, which captures all operations related to the AWS account and records them in a CloudTrail log file. The operations related to the AWS account include API calls, resource changes, and user behaviors; configure storage rules to store the CloudTrail log file in a set storage bucket.

3. A method for real-time intrusion detection on a cloud platform according to claim 1, characterized in that: The step 3 specifically includes: when a new CloudTrail log file is written, parsing the CloudTrail log file and reading the data therein; Compare the login IP address with the commonly used login IP address. If they are different, it means the login is from another location and the operation will be marked as abnormal behavior. If it is detected that the account has accessed a cloud platform module that it has not accessed in the last N months, and the stay time in the cloud platform module exceeds M seconds, the operation will be marked as abnormal behavior; If a modification operation to a server security group is detected, the operation will be marked as abnormal behavior; If it is detected that the account has created a new database instance through a snapshot, the operation will be marked as abnormal behavior; If it is detected that the account has manually deleted more than P snapshots, the operation will be marked as abnormal behavior; If the account accesses more than R cloud platform modules within Q minutes, the operation will be marked as abnormal behavior; If the monitored account has a server password reset operation, the operation will be marked as abnormal behavior; If the account performs a database password reset operation, the operation will be marked as abnormal behavior; If there is abnormal behavior, go to step 4; otherwise, end the step.

4. A method for real-time intrusion detection on a cloud platform according to claim 3, characterized in that: The step 4 is specifically as follows: after abnormal behavior is detected, the abnormal behavior is divided into high-risk behavior and low-risk behavior. If it is a low-risk behavior, an alarm message is sent through AWS's SNS to notify the relevant person in charge; if it is a high-risk behavior, an emergency response operation is performed through AWS's SDK, the account is disabled, and the processing result is notified to the security person in charge through SNS.

5. A device for real-time intrusion detection on a cloud platform, characterized in that: Includes the following modules: The storage module starts AWS CloudTrail, captures all AWS account-related operations, records them in a CloudTrail log file, and stores them in the specified storage bucket; The monitoring module configures the AWS Lambda trigger to monitor whether there is a new CloudTrail log file stored in the storage bucket. If so, it enters the abnormality determination module, otherwise, it continues to monitor; The abnormality determination module analyzes the CloudTrail log file when a new CloudTrail log file is written. If there is abnormal behavior, the abnormality handling module is entered; Otherwise, end the step; The exception handling module detects abnormal behavior and takes action according to the preset response rules.

6. The device for real-time intrusion detection on a cloud platform according to claim 5, characterized in that: The storage module specifically includes: logging into the AWS management console and starting CloudTrail, which captures all AWS account-related operations and records them in a CloudTrail log file. The AWS account-related operations include API calls, resource changes, and user behaviors; configuring storage rules to store CloudTrail log files in a set storage bucket.

7. The device for real-time intrusion detection on a cloud platform according to claim 5, characterized in that: The abnormality determination module specifically includes: when a new CloudTrail log file is written, parsing the CloudTrail log file and reading the data therein; Compare the login IP address with the commonly used login IP address. If they are different, it means the login is from another location and the operation will be marked as abnormal behavior. If it is detected that the account has accessed a cloud platform module that it has not accessed in the last N months, and the stay time in the cloud platform module exceeds M seconds, the operation will be marked as abnormal behavior; If a modification operation to a server security group is detected, the operation will be marked as abnormal behavior; If it is detected that the account has created a new database instance through a snapshot, the operation will be marked as abnormal behavior; If it is detected that the account has manually deleted more than P snapshots, the operation will be marked as abnormal behavior; If the account accesses more than R cloud platform modules within Q minutes, the operation will be marked as abnormal behavior; If the monitored account has a server password reset operation, the operation will be marked as abnormal behavior; If the account performs a database password reset operation, the operation will be marked as abnormal behavior; If there is abnormal behavior, enter the exception handling module; otherwise end.

8. The device for real-time intrusion detection on a cloud platform according to claim 7, characterized in that: The exception handling module is specifically as follows: after detecting abnormal behavior, the abnormal behavior is divided into high-risk behavior and low-risk behavior. If it is a low-risk behavior, an alarm message is sent through AWS's SNS to notify the relevant person in charge; if it is a high-risk behavior, an emergency response operation is performed through AWS's SDK, the account is disabled, and the processing result is notified to the security person in charge through SNS.

9. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the program, the method according to any one of claims 1 to 4 is implemented.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, the method according to any one of claims 1 to 4 is implemented.

Images