Cloud platform-oriented security detection method and device, terminal equipment and storage medium

Abstract

The invention discloses a security detection method and device for a cloud platform, terminal equipment and a storage medium, and the method can achieve the recognition of a data transmission mode corresponding to a data packet based on the traffic characteristics of the data packet, such as the size of the data packet, a source address, a destination address and peak traffic, and behavior characteristics when the data transmission mode corresponding to the data packet is recognized. According to the embodiment of the invention, abnormal identification is carried out according to the data packet, such as the duration time of the data packet and the protocol type of the data packet, so that deep analysis of data and consideration of multiple data dimensions can be realized based on the flow characteristics and behavior characteristics of more comprehensively reflecting data transmission, and the extracted multi-dimensional characteristics can be automatically learned; and identifying a normal transmission mode and an abnormal transmission mode. According to the cloud platform security detection method and the cloud platform security detection device provided by the invention, the mutually associated features of multiple dimensions are comprehensively considered, so that an attacker is difficult to bypass detection by independently modifying a certain feature, potential security threats of the cloud platform can be found and predicted in time, corresponding security alarms are generated, and the accuracy of cloud platform security detection is improved.

Description

Technical Field

[0001] The present invention relates to the technical field of cloud platform security management, and in particular to a cloud platform-oriented security detection method, device, terminal equipment and storage medium. Background Art

[0002] The cloud platform is a software and service platform built on cloud computing technology, which provides comprehensive data security and management functions, including identity authentication, access control, data encryption, backup and recovery, etc. These functions can help users protect the security and integrity of data and prevent data leakage and illegal access. With the continuous development of digitalization, the technology used by security threats is becoming more and more advanced, and the cloud platform, as the center of data storage and processing, is easy to become a target of attack. It is necessary to conduct security testing on the cloud platform to detect and respond to threats in a timely manner and ensure the stable operation of the cloud platform.

[0003] In the face of complex and ever-changing network attacks and data leakage behaviors, existing technologies mainly rely on single-dimensional monitoring and simple threshold judgment as security detection means, such as detecting the traffic volume or access frequency during data transmission, based on fixed thresholds, and triggering abnormal behavior alarms when these thresholds are detected. However, single-dimensional detection means cannot achieve deeper analysis of data and consideration of more data dimensions, so it is difficult to cope with complex and ever-changing network attack methods; and abnormal behavior judgment based on fixed thresholds is easily circumvented by attackers, so it is difficult to timely discover and predict potential security threats in data transmission. The existing technology lacks analysis and detection means for deep mining and analysis of cloud platform data, making it difficult to timely discover and predict potential security threats to the cloud platform, resulting in low accuracy of cloud platform security detection. Summary of the invention

[0004] The embodiments of the present invention provide a security detection method, apparatus, terminal device and storage medium for a cloud platform, which realizes in-depth analysis of data and consideration of multiple data dimensions based on a more comprehensive reflection of the flow characteristics and behavioral features of data transmission, so as to timely discover and predict potential security threats to the cloud platform, and can effectively solve the problem in the prior art of low accuracy of cloud platform security detection due to the lack of analysis and detection means for deep mining and analysis of cloud platform data.

[0005] An embodiment of the present invention provides a cloud platform-oriented security detection method, including:

[0006] Obtain the data packets corresponding to the data transmission from the cloud platform;

[0007] Input the data packet into a preset transmission mode recognition model, so that the transmission mode recognition model generates a data transmission mode corresponding to the data packet according to the flow characteristics and behavior characteristics of the data packet; wherein the data transmission mode includes: a normal transmission mode or an abnormal transmission mode; the flow characteristics include: a data packet size, a source address, and a destination address; the behavior characteristics include: a duration of the data packet and a protocol type of the data packet;

[0008] When it is determined that the data transmission mode corresponding to the data packet is an abnormal transmission mode, the data packet is marked as a potential security threat, and a security alarm of abnormal transmission behavior is generated;

[0009] The training process of the preset transmission mode recognition model includes:

[0010] Taking several data packet samples and the actual data transmission mode corresponding to each data packet sample as input and the predicted data transmission mode of each data packet sample as output, the transmission mode recognition model to be trained is iteratively trained until the model converges to generate a preset transmission mode recognition model.

[0011] Preferably, the transmission mode recognition model comprises: an input layer, a feature extraction layer and an output layer;

[0012] The transmission mode recognition model generates a data transmission mode corresponding to the data packet according to the traffic characteristics and behavior characteristics of the data packet, including:

[0013] The input layer is used to obtain input data packets;

[0014] The feature extraction layer is used to perform convolution operation on the data packet to generate a plurality of feature graphs containing flow features and a plurality of target feature graphs containing behavior features;

[0015] The output layer is used to calculate the probability distribution value of each target feature map through an activation function, and then generate the data transmission mode corresponding to the data packet based on the probability distribution value of each target feature map.

[0016] Preferably, the feature extraction layer includes: a convolution layer and a pooling layer;

[0017] The feature extraction layer is used to perform convolution operations on data packets to generate a number of target feature graphs containing traffic features and a number of target feature graphs containing behavior features, including:

[0018] The convolution layer is used to capture different local features in the data packet through different convolution kernels, and then generate a number of initial feature maps according to each local feature; wherein the local features include: traffic features and behavior features;

[0019] The pooling layer is used to generate a target feature map corresponding to each initial feature map after performing an average pooling operation on each initial feature map.

[0020] Preferably, the traffic characteristics further include: a peak traffic volume for characterizing the data transmission channel load corresponding to a data packet in a time window; the behavior characteristics further include: a data packet interval for characterizing the transmission time difference between two data packets;

[0021] The convolution layer is used to capture different local features in the data packet through different convolution kernels, and then generate a number of initial feature maps according to each local feature, including:

[0022] The convolution layer is used to generate corresponding initial feature maps according to the data packet size, source address, destination address, peak flow, data packet duration, data packet protocol type and data packet interval captured by different convolution kernels in the data packet.

[0023] Preferably, it also includes:

[0024] Obtaining the source address and destination address of the data packet;

[0025] Matching the source address or the destination address with a preset blacklist address form;

[0026] When it is determined that the source address or the destination address matches successfully, the data packet is intercepted.

[0027] Preferably, it also includes:

[0028] The data packets marked as potential security threats are used as target data packets;

[0029] Matching the protocol type corresponding to the target data packet with a preset abnormal communication protocol table;

[0030] When it is determined that the match is successful, the source address corresponding to the target data packet is added to a preset blacklist address table.

[0031] Preferably, during each iterative training, a data packet sample is input into the transmission mode recognition model, so that the transmission mode recognition model generates a data transmission mode prediction result corresponding to the data packet sample according to the traffic characteristics and behavior characteristics in the data packet sample;

[0032] The data transmission mode prediction results are compared with the actual data transmission mode results, and the network parameters of the transmission mode recognition model are adjusted according to the comparison results.

[0033] Based on the above method embodiments, the present invention provides corresponding device embodiments.

[0034] An embodiment of the present invention provides a security detection device for a cloud platform, comprising: a data packet acquisition module, a data transmission mode generation module, and an abnormal alarm module;

[0035] The data packet acquisition module is used to acquire the data packets corresponding to the cloud platform during data transmission;

[0036] The data transmission mode generation module is used to input the data packet into a preset transmission mode recognition model so that the transmission mode recognition model generates a data transmission mode corresponding to the data packet according to the flow characteristics and behavior characteristics of the data packet; wherein the data transmission mode includes: a normal transmission mode or an abnormal transmission mode; the flow characteristics include: a data packet size, a source address, and a destination address; the behavior characteristics include: a duration of the data packet and a protocol type of the data packet;

[0037] The abnormal alarm module is used to mark the data packet as a potential security threat and generate a security alarm for abnormal transmission behavior when determining that the data transmission mode corresponding to the data packet is an abnormal transmission mode;

[0038] The training process of the preset transmission mode recognition model includes:

[0039] Taking several data packet samples and the actual data transmission mode corresponding to each data packet sample as input and the predicted data transmission mode of each data packet sample as output, the transmission mode recognition model to be trained is iteratively trained until the model converges to generate a preset transmission mode recognition model.

[0040] Based on the above method embodiments, the present invention provides corresponding terminal device embodiments.

[0041] Another embodiment of the present invention provides a terminal device, including a processor, a memory, and a computer program stored in the memory and configured to be executed by the processor, and when the processor executes the computer program, a security detection method for a cloud platform described in the above-mentioned embodiment of the invention is implemented.

[0042] Based on the above method embodiments, the present invention provides corresponding storage medium item embodiments.

[0043] Another embodiment of the present invention provides a storage medium, wherein the computer-readable storage medium includes a stored computer program, wherein when the computer program is running, the device where the computer-readable storage medium is located is controlled to execute a security detection method for a cloud platform as described in the above-mentioned embodiment of the invention.

[0044] The following beneficial effects are achieved by implementing the present invention:

[0045] The embodiments of the present invention provide a security detection method, apparatus, terminal device and storage medium for a cloud platform. The present invention can identify the data transmission mode corresponding to the data packet of the cloud platform during data transmission through a preset transmission mode recognition model, and when it is detected that the data transmission mode corresponding to the data packet is an abnormal transmission mode, the data packet can be marked as a potential security threat, and a security alarm for abnormal transmission behavior can be generated, thereby realizing security detection of data transmission and abnormal alarm. Specifically, when identifying the data transmission mode corresponding to the data packet, the present invention can perform anomaly identification based on the traffic characteristics of the data packet (such as data packet size, source address, destination address and peak traffic) and behavioral characteristics (such as the duration of the data packet and the protocol type of the data packet). Compared with the prior art, the present invention can achieve in-depth data analysis and multi-dimensional considerations based on the traffic characteristics and behavioral characteristics that more comprehensively reflect the data transmission, and can automatically learn the extracted multi-dimensional features to identify normal transmission modes and abnormal transmission modes. Compared with the judgment method based on a fixed threshold, the present invention comprehensively considers the characteristics of multiple dimensions, and these characteristics are interrelated, so it is difficult for an attacker to bypass the detection by modifying a certain feature alone, making it difficult for the detection method of the present invention to be bypassed by an attacker, and can adapt to complex and changeable network environments and attack methods, so that potential security threats to the cloud platform can be discovered and predicted in a timely manner, and corresponding security alerts can be generated, thereby improving the accuracy of cloud platform security detection. BRIEF DESCRIPTION OF THE DRAWINGS

[0046] Figure 1 It is a flowchart of a security detection method for a cloud platform provided by an embodiment of the present invention.

[0047] Figure 2 It is a structural diagram of a security detection device for a cloud platform provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0048] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0049] like Figure 1 FIG. 1 is a flow chart of a cloud platform-oriented security detection method provided by an embodiment of the present invention. The cloud platform-oriented security detection method includes:

[0050] Step S1: Obtain the data packet corresponding to the cloud platform during data transmission;

[0051] Step S2: inputting the data packet into a preset transmission mode recognition model, so that the transmission mode recognition model generates a data transmission mode corresponding to the data packet according to the flow characteristics and behavior characteristics of the data packet; wherein the data transmission mode includes: a normal transmission mode or an abnormal transmission mode; the flow characteristics include: a data packet size, a source address, and a destination address; the behavior characteristics include: a duration of the data packet and a protocol type of the data packet;

[0052] The training process of the preset transmission mode recognition model includes:

[0053] Taking a number of data packet samples and the actual data transmission mode corresponding to each data packet sample as input, taking the predicted data transmission mode of each data packet sample as output, iteratively training the transmission mode recognition model to be trained until the model converges, and generating a preset transmission mode recognition model;

[0054] Step S3: When it is determined that the data transmission mode corresponding to the data packet is an abnormal transmission mode, the data packet is marked as a potential security threat, and a security alarm of abnormal transmission behavior is generated.

[0055] For step S1, in a preferred embodiment, the data transmission on the cloud platform is dynamic and continuous. By capturing the data packets of the data transmission in real time, real-time monitoring of the network activities of the cloud platform can be achieved, so that potential security threats such as network attacks, unauthorized data access, malware propagation or data leakage can be discovered in time.

[0056] Since the data packets in the data transmission process contain rich traffic characteristics and behavior characteristics, such as data packet size, source address, destination address, duration, and protocol type, etc., by obtaining the corresponding data packets of the cloud platform during data transmission and parsing the characteristics, abnormal data transmission patterns can be identified, thereby accurately identifying potential security threats.

[0057] For step S2, when identifying the data transmission mode corresponding to the data packet, the present invention can extract and identify features through a preset transmission mode recognition model, thereby obtaining the data transmission mode corresponding to the input data packet, which is a normal transmission mode or an abnormal transmission mode.

[0058] In a preferred embodiment, the training process of the preset transmission mode recognition model includes:

[0059] Taking several data packet samples and the actual data transmission mode corresponding to each data packet sample as input and the predicted data transmission mode of each data packet sample as output, the transmission mode recognition model to be trained is iteratively trained until the model converges to generate a preset transmission mode recognition model.

[0060] During each iterative training, a data packet sample is input into the transmission mode recognition model, so that the transmission mode recognition model generates a data transmission mode prediction result corresponding to the data packet sample according to the traffic characteristics and behavior characteristics in the data packet sample;

[0061] The data transmission mode prediction results are compared with the actual data transmission mode results, and the network parameters of the transmission mode recognition model are adjusted according to the comparison results.

[0062] It can be understood that in each iteration, the model processes a packet sample and predicts its data transmission pattern based on the traffic characteristics (such as packet size, source address, destination address, peak traffic) and behavioral characteristics (such as duration, protocol type, packet interval).

[0063] By continuously comparing the predicted results with the actual results, the model can gradually adjust its internal parameters (such as weights and biases) to minimize the prediction error until the model converges.

[0064] During the training process, the transmission mode recognition model of the present invention will automatically learn how to extract useful features (such as traffic features and behavior features) from data packets, and identify the relationship between these features and data transmission patterns, thereby accurately identifying data transmission patterns.

[0065] In a preferred embodiment, the preset transmission mode recognition model includes: an input layer, a feature extraction layer and an output layer;

[0066] The transmission mode recognition model generates a data transmission mode corresponding to the data packet according to the traffic characteristics and behavior characteristics of the data packet, specifically including:

[0067] The input layer is used to obtain input data packets;

[0068] The feature extraction layer is used to perform convolution operation on the data packet to generate a plurality of feature graphs containing flow features and a plurality of target feature graphs containing behavior features;

[0069] In a preferred embodiment, the feature extraction layer includes: a convolution layer and a pooling layer;

[0070] The feature extraction layer is used to perform convolution operations on the data packets to generate several target feature graphs containing traffic features and several target feature graphs containing behavior features, specifically:

[0071] The convolution layer is used to capture different local features in the data packet through different convolution kernels, and then generate a number of initial feature maps according to each local feature; wherein the local features include: traffic features and behavior features;

[0072] The pooling layer is used to generate a target feature map corresponding to each initial feature map after performing an average pooling operation on each initial feature map. Schematically, the embodiment of the present invention can reduce the size of the feature map while retaining important information through a pooling layer (such as average pooling or maximum pooling), which not only reduces the amount of calculation of subsequent layers, but also helps prevent model overfitting.

[0073] Finally, the output layer is used to calculate the probability distribution value of each target feature map through an activation function, and then generate the data transmission mode corresponding to the data packet based on the probability distribution value of each target feature map.

[0074] In a preferred embodiment, the traffic characteristics further include: a peak traffic flow for characterizing the data transmission channel load corresponding to a data packet in a time window; the behavior characteristics further include: a data packet interval for characterizing the transmission time difference between two data packets;

[0075] The convolution layer captures different local features in the data packet through different convolution kernels, and then generates a number of initial feature maps according to each local feature, specifically including:

[0076] The convolution layer generates corresponding initial feature maps according to the packet size, source address, destination address, peak traffic, duration of the packet, protocol type of the packet and packet interval captured by different convolution kernels in the packet.

[0077] It is understandable that high peak traffic may indicate network congestion, malicious traffic bursts, or data transmission anomalies. By analyzing peak traffic, these anomalies can be more accurately identified and the corresponding data transmission patterns can be predicted.

[0078] The packet interval reflects the frequency and rhythm of packet transmission. Abnormal packet intervals (such as sudden increases or decreases) may mean that there is some abnormal behavior in the network, such as packet retransmission, delay or jitter. Combined with the analysis of packet intervals, the model can more comprehensively understand the behavioral characteristics of data transmission, thereby improving the prediction accuracy of data transmission patterns.

[0079] In a complex network environment, data packets may be affected by many factors, such as network congestion, equipment failure, protocol differences, etc. In addition to the size of the data packet, the source address and the destination address, the duration of the data packet, and the protocol type of the data packet, the present invention also introduces the analysis of peak traffic and data packet interval, forming a multi-dimensional analysis feature, which can more comprehensively and accurately predict the data transmission mode of the data packet.

[0080] Therefore, the present invention can more comprehensively understand the traffic characteristics and behavioral characteristics of data packets in the network by comprehensively considering multiple dimensions such as data packet size, source address, destination address, duration, protocol type, peak flow and data packet interval, so as to reveal the potential relationship and pattern between data packets, thereby improving the accuracy of prediction. While the analysis of a single dimension may be interfered by noise or outliers, resulting in inaccurate prediction results, the multi-dimensional analysis of the present invention can provide more contextual information, help the model better identify and filter noise, thereby improving the prediction accuracy and robustness of the final data transmission mode.

[0081] In a preferred embodiment, the transmission mode recognition model of the present invention is a multi-layer network model, such as a convolutional neural network; in a multi-layer network, each layer further extracts higher-level abstract features from the features output by the previous layer. In the convolution layer, the initial convolution kernel may only capture simple local features (such as packet size, source address, etc.), but as the number of layers increases, these features will be combined into more complex and abstract feature representations (such as data transmission mode).

[0082] Therefore, the multi-level network of the present invention forms a complex feature representation by combining multiple simple features, which has stronger robustness to slight changes in the input data (such as noise or deformation), thereby being able to more accurately identify the data transmission mode of data packets under different conditions.

[0083] In large-scale network environments such as cloud platforms, since the number and complexity of data packets are very high, and the multi-level network of the present invention can efficiently process a large number of data packets through mechanisms such as parallel processing and feature sharing, the present invention can generate accurate transmission pattern recognition results in real time, thereby quickly and accurately determining whether there are potential security threats.

[0084] Regarding step S3, in a preferred embodiment, when the present invention determines that the data transmission mode corresponding to the data packet is an abnormal transmission mode, a series of specific operations will be performed to mark potential security threats and generate security alarms.

[0085] Specifically, once the present invention determines that a data packet is in an abnormal transmission mode, the data packet will be automatically marked as a potential security threat and added to the threat intelligence library for subsequent analysis and response.

[0086] In an illustrative manner, the present invention can construct security warning information based on the detailed information of the abnormal data packet (such as source address, destination address, timestamp, abnormal characteristics, etc.). It can also determine the level of the warning (such as low risk, medium risk, high risk) according to the degree of abnormality and potential risks, so that the security warning information can be sent to relevant personnel in a timely manner through emails, text messages, system notifications, etc., so that corresponding countermeasures can be taken.

[0087] The present invention can ensure that network administrators can be informed of abnormal situations of the cloud platform in the first place by automatically marking abnormal data packets as potential security threats and generating alarms, so that potential security threats can be quickly responded to and contained, and the impact scope and duration of security incidents can be reduced. The present invention can efficiently identify and respond to potential security threats by automatically identifying and analyzing a large number of data packets and generating corresponding alarm information, which not only improves work efficiency but also reduces the burden of manual operations.

[0088] In a preferred embodiment, the embodiment of the present invention further includes:

[0089] Obtaining the source address and destination address of the data packet;

[0090] Matching the source address or the destination address with a preset blacklist address form;

[0091] When it is determined that the source address or the destination address matches successfully, the data packet is intercepted.

[0092] Illustratively, the blacklist address form contains known sources of security threats or malicious addresses. The embodiment of the present invention can quickly identify and intercept data packets from malicious sources or sent to malicious destinations by matching the source address or destination address of the data packet with the blacklist, thereby effectively preventing potential attacks or data leaks.

[0093] In a preferred embodiment, the embodiment of the present invention further includes:

[0094] The data packets marked as potential security threats are used as target data packets;

[0095] Matching the protocol type corresponding to the target data packet with a preset abnormal communication protocol table;

[0096] When it is determined that the match is successful, the source address corresponding to the target data packet is added to a preset blacklist address table.

[0097] Illustratively, the embodiment of the present invention can more accurately identify those data packets that use specific protocols for malicious communications by matching the protocol type of the target data packet with the abnormal communication protocol form, and can add the source address of the successfully matched target data packet to the blacklist address form, thereby realizing the dynamic update of the blacklist, so that the blacklist address form can automatically adapt to and include new malicious addresses, maintaining its effectiveness and accuracy. Therefore, by timely adding the source addresses of potential threats to the blacklist, the embodiment of the present invention can effectively prevent malicious communications from these addresses, thereby improving the security defense capabilities of the network system of the entire cloud platform and reducing potential security risks.

[0098] In a preferred embodiment, the embodiment of the present invention further includes:

[0099] By setting up a network firewall, the cloud platform data can be protected. The firewall can automatically update rules based on the malicious IP or abnormal traffic identified. For example, malicious IPs can be added to the blacklist for monitoring and interception. Abnormal traffic can be blocked or limited, or some abnormal traffic can be allowed to pass according to needs.

[0100] like Figure 2 As shown, based on the above-mentioned various cloud platform-oriented security detection method embodiments, the present invention provides a corresponding device embodiment;

[0101] An embodiment of the present invention provides a security detection device for a cloud platform, comprising: a data packet acquisition module, a data transmission mode generation module, and an abnormal alarm module;

[0102] The data packet acquisition module is used to acquire the data packets corresponding to the cloud platform during data transmission;

[0103] The data transmission mode generation module is used to input the data packet into a preset transmission mode recognition model so that the transmission mode recognition model generates a data transmission mode corresponding to the data packet according to the flow characteristics and behavior characteristics of the data packet; wherein the data transmission mode includes: a normal transmission mode or an abnormal transmission mode; the flow characteristics include: a data packet size, a source address, and a destination address; the behavior characteristics include: a duration of the data packet and a protocol type of the data packet;

[0104] The abnormal alarm module is used to mark the data packet as a potential security threat and generate a security alarm for abnormal transmission behavior when determining that the data transmission mode corresponding to the data packet is an abnormal transmission mode;

[0105] The training process of the preset transmission mode recognition model includes:

[0106] Taking several data packet samples and the actual data transmission mode corresponding to each data packet sample as input and the predicted data transmission mode of each data packet sample as output, the transmission mode recognition model to be trained is iteratively trained until the model converges to generate a preset transmission mode recognition model.

[0107] It should be noted that the device embodiments described above are merely schematic, wherein the modules described as separate components may or may not be physically separated, and the components displayed as modules may or may not be physical modules, and may be located in one place or distributed on multiple network modules. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this embodiment. In addition, in the accompanying drawings of the device embodiments provided by the present invention, the connection relationship between the modules indicates that there is a communication connection between them, which may be specifically implemented as one or more communication buses or signal lines. Those of ordinary skill in the art can understand and implement it without paying creative labor.

[0108] Those skilled in the art can clearly understand that, for the sake of convenience and brevity, the specific working process of the device described above can refer to the corresponding process in the aforementioned method embodiment, and will not be repeated here.

[0109] Based on the above-mentioned various embodiments of the security detection method for the cloud platform, the present invention provides a corresponding embodiment of the terminal device item.

[0110] An embodiment of the present invention provides a terminal device, including a processor, a memory, and a computer program stored in the memory and configured to be executed by the processor, wherein when the processor executes the computer program, a security detection method for a cloud platform as described in any method embodiment of the present invention is implemented.

[0111] The terminal device may be a computing terminal device such as a desktop computer, a notebook, a palm computer, a cloud server, etc. The terminal device may include, but is not limited to, a processor and a memory.

[0112] The processor may be a central processing unit (CPU), other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The general-purpose processor may be a microprocessor or any conventional processor, etc. The processor is the control center of the terminal device, and various interfaces and lines are used to connect various parts of the entire terminal device.

[0113] The memory can be used to store the computer program, and the processor realizes various functions of the terminal device by running or executing the computer program stored in the memory and calling the data stored in the memory. The memory can mainly include a program storage area and a data storage area, wherein the program storage area can store an operating system, at least one application required for a function, etc.; the data storage area can store data created according to the use of the mobile phone, etc. In addition, the memory can include a high-speed random access memory, and can also include a non-volatile memory, such as a hard disk, a memory, a plug-in hard disk, a smart memory card (Smart Med i aCard, SMC), a secure digital (Secure Digital, SD) card, a flash card (Flash Card), at least one disk storage device, a flash memory device or other volatile solid-state storage device.

[0114] Based on the above-mentioned various embodiments of the security detection method for cloud platforms, the present invention provides corresponding storage medium item embodiments.

[0115] An embodiment of the present invention provides a storage medium, which includes a stored computer program, wherein when the computer program is running, the device where the computer-readable storage medium is located is controlled to execute a security detection method for a cloud platform as described in any method embodiment of the present invention.

[0116] The storage medium is a computer-readable storage medium, and the computer program is stored in the computer-readable storage medium. When the computer program is executed by the processor, the steps of each method embodiment described above can be implemented. Among them, the computer program includes computer program code, and the computer program code can be in source code form, object code form, executable file or some intermediate form, etc. The computer-readable medium may include: any entity or device capable of carrying the computer program code, recording medium, USB flash drive, mobile hard disk, disk, optical disk, computer memory, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), electric carrier signal, telecommunication signal and software distribution medium, etc. It should be noted that the content contained in the computer-readable medium can be appropriately increased or decreased according to the requirements of legislation and patent practice in the jurisdiction. For example, in some jurisdictions, according to legislation and patent practice, computer-readable media do not include electric carrier signals and telecommunication signals.

[0117] The above is a preferred embodiment of the present invention. It should be pointed out that a person skilled in the art can make several improvements and modifications without departing from the principle of the present invention. These improvements and modifications are also considered to be within the scope of protection of the present invention.

Claims

1. A security detection method for a cloud platform, characterized in that: include: Obtain the data packets corresponding to the data transmission from the cloud platform; Input the data packet into a preset transmission mode recognition model, so that the transmission mode recognition model generates a data transmission mode corresponding to the data packet according to the flow characteristics and behavior characteristics of the data packet; wherein the data transmission mode includes: a normal transmission mode or an abnormal transmission mode; the flow characteristics include: a data packet size, a source address, and a destination address; the behavior characteristics include: a duration of the data packet and a protocol type of the data packet; When it is determined that the data transmission mode corresponding to the data packet is an abnormal transmission mode, the data packet is marked as a potential security threat, and a security alarm of abnormal transmission behavior is generated; The training process of the preset transmission mode recognition model includes: Taking several data packet samples and the actual data transmission mode corresponding to each data packet sample as input and the predicted data transmission mode of each data packet sample as output, the transmission mode recognition model to be trained is iteratively trained until the model converges to generate a preset transmission mode recognition model.

2. A cloud platform-oriented security detection method as claimed in claim 1, characterized in that: The transmission mode recognition model comprises: an input layer, a feature extraction layer and an output layer; The transmission mode recognition model generates a data transmission mode corresponding to the data packet according to the traffic characteristics and behavior characteristics of the data packet, including: The input layer is used to obtain input data packets; The feature extraction layer is used to perform convolution operation on the data packet to generate a plurality of feature graphs containing flow features and a plurality of target feature graphs containing behavior features; The output layer is used to calculate the probability distribution value of each target feature map through an activation function, and then generate the data transmission mode corresponding to the data packet based on the probability distribution value of each target feature map.

3. A cloud platform-oriented security detection method as claimed in claim 2, characterized in that: The feature extraction layer includes: a convolution layer and a pooling layer; The feature extraction layer is used to perform convolution operations on data packets to generate a number of target feature graphs containing traffic features and a number of target feature graphs containing behavior features, including: The convolution layer is used to capture different local features in the data packet through different convolution kernels, and then generate a number of initial feature maps according to each local feature; wherein the local features include: traffic features and behavior features; The pooling layer is used to generate a target feature map corresponding to each initial feature map after performing an average pooling operation on each initial feature map.

4. A cloud platform-oriented security detection method as claimed in claim 3, characterized in that: The traffic characteristics also include: a peak traffic flow for characterizing the data transmission channel load corresponding to a data packet in a time window; the behavior characteristics also include: a data packet interval for characterizing the transmission time difference between two data packets; The convolution layer is used to capture different local features in the data packet through different convolution kernels, and then generate a number of initial feature maps according to each local feature, including: The convolution layer is used to generate corresponding initial feature maps according to the data packet size, source address, destination address, peak flow, data packet duration, data packet protocol type and data packet interval captured by different convolution kernels in the data packet.

5. A cloud platform-oriented security detection method as claimed in claim 1, characterized in that: Also includes: Obtaining the source address and destination address of the data packet; Matching the source address or the destination address with a preset blacklist address form; When it is determined that the source address or the destination address matches successfully, the data packet is intercepted.

6. A cloud platform-oriented security detection method as claimed in claim 1, characterized in that: Also includes: The data packets marked as potential security threats are used as target data packets; Matching the protocol type corresponding to the target data packet with a preset abnormal communication protocol table; When it is determined that the match is successful, the source address corresponding to the target data packet is added to a preset blacklist address table.

7. A cloud platform-oriented security detection method as claimed in claim 1, characterized in that: In each iterative training, a data packet sample is input into the transmission mode recognition model, so that the transmission mode recognition model generates a data transmission mode prediction result corresponding to the data packet sample according to the traffic characteristics and behavior characteristics in the data packet sample; The data transmission mode prediction results are compared with the actual data transmission mode results, and the network parameters of the transmission mode recognition model are adjusted according to the comparison results.

8. A security detection device for a cloud platform, characterized in that: include: Data packet acquisition module, data transmission mode generation module and abnormal alarm module; The data packet acquisition module is used to acquire the data packets corresponding to the cloud platform during data transmission; The data transmission mode generation module is used to input the data packet into a preset transmission mode recognition model so that the transmission mode recognition model generates a data transmission mode corresponding to the data packet according to the flow characteristics and behavior characteristics of the data packet; wherein the data transmission mode includes: a normal transmission mode or an abnormal transmission mode; the flow characteristics include: a data packet size, a source address, and a destination address; the behavior characteristics include: a duration of the data packet and a protocol type of the data packet; The abnormal alarm module is used to mark the data packet as a potential security threat and generate a security alarm for abnormal transmission behavior when determining that the data transmission mode corresponding to the data packet is an abnormal transmission mode; The training process of the preset transmission mode recognition model includes: Taking several data packet samples and the actual data transmission mode corresponding to each data packet sample as input and the predicted data transmission mode of each data packet sample as output, the transmission mode recognition model to be trained is iteratively trained until the model converges to generate a preset transmission mode recognition model.

9. A terminal device, characterized in that: It includes a processor, a memory, and a computer program stored in the memory and configured to be executed by the processor, and when the processor executes the computer program, it implements a security detection method for a cloud platform as described in any one of claims 1 to 7.

10. A storage medium, characterized in that: The storage medium includes a stored computer program, wherein when the computer program is running, the device where the storage medium is located is controlled to execute a security detection method for a cloud platform as described in any one of claims 1 to 7.

Images