Monitoring method of cloud security system

Abstract

The invention, which relates to the technical field of the cloud security system, discloses a monitoring method for a cloud security system comprising a data acquisition and preprocessing system, a threat detection and identification system, a behavior analysis and association analysis system, a risk assessment and early warning system, a response strategy making and execution system, and a monitoring report and log management system. The data acquisition and preprocessing system is used for acquiring network traffic, system logs and user behavior data in real time, and the threat detection and recognition system is used for performing threat detection and recognition on the preprocessed data. The data analysis and machine learning technology extracts significant features related to threats from a large amount of monitoring data, and the features can help a machine learning model better understand and classify potential threats, so that the accuracy and efficiency of threat detection are improved, the system automatically learns and updates threat features, and the threat detection efficiency is improved. And rapid identification and response to novel threats are realized.

Description

Technical Field

[0001] The present invention relates to the technical field of cloud security systems, and in particular to a monitoring method for a cloud security system. Background Art

[0002] Cloud security system is a technology and practice to protect data, applications and infrastructure in cloud computing environment from various threats and attacks. It aims to ensure that cloud service providers and users follow compliance requirements, protect user privacy, and ensure data integrity and availability. Cloud security system is a necessary condition for ensuring the security of cloud platform, which can help users prevent various security threats and ensure the security and stability of cloud computing environment. With the continuous development of cloud computing technology, cloud security system will also be continuously improved and upgraded to meet the increasingly complex and changing security challenges.

[0003] Existing cloud security system monitoring methods often rely on fixed rules and models when dealing with external threats, which may not be effective for new or variant threats. Therefore, it is necessary to propose a new cloud security system monitoring method to solve the problems in the existing technology. Summary of the invention

[0004] The purpose of the present invention is to make up for the deficiencies of the prior art and to provide a monitoring method for a cloud security system, which can automatically isolate infected systems in a timely manner and automatically trigger emergency response plans to prevent the cloud security system from being attacked.

[0005] In order to solve the above technical problems, the present invention provides the following technical solutions: a monitoring method for a cloud security system, characterized by comprising a data acquisition and preprocessing system, a threat detection and identification system, a behavior analysis and correlation analysis system, a risk assessment and early warning system, a response strategy formulation and execution system, and a monitoring report and log management system;

[0006] The data collection and preprocessing system is used to collect network traffic, system logs, and user behavior data of the cloud security system in real time;

[0007] The threat detection and identification system is used to detect and identify threats on the pre-processed data;

[0008] The behavior analysis and correlation analysis system is used to conduct further behavior analysis and correlation analysis on the identified threats;

[0009] The risk assessment and early warning system is used to accurately evaluate the results of threat detection, behavior analysis, and correlation analysis, and to issue early warnings in a timely manner based on the assessment results so that appropriate security control measures can be taken;

[0010] The response strategy formulation and execution system is used to formulate targeted response strategies based on early warning information and risk assessment results;

[0011] The monitoring report and log management system is used to generate regular monitoring reports to summarize the overall security status of the cloud environment, threat events that have occurred, and the effectiveness of response measures.

[0012] Furthermore, the threat detection and identification system includes threat feature extraction, threat model training, real-time threat detection, behavior analysis and correlation analysis, threat intelligence integration, adaptive learning and updating, and response strategy formulation and execution.

[0013] Furthermore, the threat model training includes data collection and preprocessing, feature extraction and selection, algorithm selection and model construction, model training, model evaluation and tuning, model testing and deployment, and continuous monitoring and updating.

[0014] Furthermore, the algorithm selection and model construction are based on the characteristics of the problem and the properties of the data, and a suitable algorithm is selected for model construction, including SVM algorithm, random forest algorithm and deep learning algorithm. The SVM algorithm is a commonly used classification algorithm, which maximizes the interval between different categories by finding a hyperplane. For nonlinear problems, the problem can be mapped to a high-dimensional space by introducing a kernel function (such as RBF kernel, polynomial kernel). The formula used is: decision function: f(x) = sign(w^T*φ(x)+b), where w is the weight vector, φ is the mapping function, b is the bias term, and the objective function (for soft interval SVM): minimize 1 / 2*||w||^2+C*Σξi, where C is the penalty coefficient and ξi is the slack variable.

[0015] Furthermore, the random forest algorithm is an ensemble learning method that constructs multiple decision trees and votes or averages their outputs, each decision tree is trained based on randomly selected features and sample subsets, and the steps are as follows: (1) randomly extracting multiple sample subsets with replacement from the original data set through the bootstrap method; (2) constructing a decision tree for each sample subset, but only considering the randomly selected feature subset when splitting each node; (3) voting or averaging the outputs of all decision trees to obtain the final classification result.

[0016] Furthermore, the deep learning algorithm extracts deep features of data by constructing a multi-layer neural network. The steps are as follows: (1) constructing a multi-layer neural network structure, including an input layer, a hidden layer, and an output layer; (2) using a back propagation algorithm and a gradient descent optimization method to train network parameters; (3) optimizing the performance of the model by continuously adjusting the network structure and parameters.

[0017] Furthermore, the operation process of the data acquisition and preprocessing system mainly includes the following steps: data acquisition, data preprocessing, data storage, data analysis and mining, and data visualization.

[0018] Furthermore, the operation process of the response strategy formulation and execution system mainly includes the following steps: event detection and confirmation, event classification and evaluation, response strategy formulation, response strategy execution, monitoring and evaluation, summary and feedback.

[0019] Furthermore, the operation process of monitoring reports and log management mainly includes the following steps: log collection, log filtering and preprocessing, log storage and indexing, log monitoring and alarming, log analysis and visualization, monitoring report generation, report management and feedback.

[0020] Furthermore, report management and feedback are used to manage the generated monitoring reports, ensure the accuracy and completeness of the reports, distribute the reports to relevant personnel, and improve and optimize them based on the feedback.

[0021] Compared with the existing technology, the monitoring method of the cloud security system has the following beneficial effects:

[0022] 1. The present invention adopts an efficient HOG algorithm for feature extraction, so that data analysis and machine learning technology can extract significant features related to threats from a large amount of monitoring data. These features can help machine learning models better understand and classify potential threats, thereby improving the accuracy and efficiency of threat detection, thereby realizing the system's automatic learning and updating of threat features, and then realizing rapid identification and response to new threats.

[0023] Second, the risk assessment and early warning system of the present invention can conduct risk assessment on the security status of the cloud environment. The assessment may include the severity of the threat, the scope of impact, and the potential loss. Based on the assessment results, the system can generate security early warning information and notify relevant personnel in a timely manner so that they can take appropriate measures to prevent and respond.

[0024] 3. The response strategy formulation and execution system of the present invention can formulate targeted response strategies based on early warning information and risk assessment results. These strategies include isolating infected systems, blocking malicious traffic, and starting emergency backup and recovery programs. By automating the execution of these strategies, rapid response to threats can be achieved, reducing the scope and duration of the impact of security incidents.

[0025] Other advantages, objectives and features of the present invention will be set forth in part in the following description and, in part, will be apparent to those skilled in the art based on an examination of the following or may be taught from the practice of the present invention. BRIEF DESCRIPTION OF THE DRAWINGS

[0026] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the prior art descriptions are briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention, and for ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0027] Figure 1 The present invention is a flow chart of a monitoring method for a cloud security system. DETAILED DESCRIPTION

[0028] The technical solutions in the embodiments of the present invention are described clearly and completely below. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of them. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0029] The present invention provides the following technical solutions: a monitoring method for a cloud security system, including a data acquisition and preprocessing system, a threat detection and identification system, a behavior analysis and correlation analysis system, a risk assessment and early warning system, a response strategy formulation and execution system, and a monitoring report and log management system; the present invention adopts an efficient HOG algorithm to perform feature extraction, so that data analysis and machine learning technology can extract significant features related to threats from a large amount of monitoring data, and these features can help machine learning models better understand and classify potential threats, thereby improving the accuracy and efficiency of threat detection, thereby realizing automatic learning and updating of threat features by the system, and then realizing rapid identification and response to new threats.

[0030] The data collection and preprocessing system is used to collect network traffic, system logs, and user behavior data in real time. These data may include network packets, access records, and operation logs, which provide a basis for subsequent threat detection. The collected data needs to be preprocessed, including data cleaning, formatting, and normalization to eliminate noise, improve data quality, and provide an accurate data source for subsequent analysis and detection;

[0031] The threat detection and identification system is used to detect and identify threats on pre-processed data. By training models or updating rule bases, it can automatically identify abnormal behaviors, malicious traffic, and unauthorized access potential threats. These methods can help the system quickly discover potential attacks or illegal operations.

[0032] The behavior analysis and correlation analysis system is used to conduct further behavior analysis and correlation analysis on the identified threats. Behavior analysis focuses on the details of a single threat, such as the attacker's behavior pattern and attack path. Correlation analysis aims to reveal the correlation between different threats, such as whether multiple threats come from the same attacker and whether they form a complex attack chain. These analyses help to deeply understand the nature of the threat and the motivation behind it;

[0033] The risk assessment and early warning system is used to conduct risk assessment on the security status of the cloud environment based on the results of threat detection, behavior analysis, and correlation analysis. The assessment may include the severity of the threat, the scope of impact, and the potential loss. Based on the assessment results, the system can generate security early warning information and notify relevant personnel in a timely manner so that they can take appropriate measures to prevent and respond;

[0034] The response strategy formulation and execution system is used to formulate targeted response strategies based on early warning information and risk assessment results. These strategies may include isolating infected systems, blocking malicious traffic, and launching emergency backup and recovery programs. By automating the execution of these strategies, rapid response to threats can be achieved, reducing the scope and duration of security incidents.

[0035] The monitoring report and log management system is used to generate regular monitoring reports, summarizing the overall security status of the cloud environment, threat events that have occurred, and the effectiveness of response measures. At the same time, all monitoring data and logs are properly managed for subsequent security audits and event tracing.

[0036] The threat detection and identification system includes threat feature extraction, which extracts threat-related features by analyzing the processed data. These features may include abnormal network traffic patterns and specific system call sequences. The purpose of feature extraction is to convert raw data into a form that can be understood and used by machine learning algorithms; threat model training, which uses sample data of known threats to train machine learning models so that they can identify and classify potential threats; real-time threat detection, which applies the trained model to real-time data streams and monitors activities in the cloud environment in real time. When the model detects an anomaly or potential threat, it triggers an alarm and provides a detailed analysis report; behavior analysis and correlation analysis, which conducts in-depth analysis of detected abnormal behaviors to understand their behavior patterns, attack paths and Purpose: Through correlation analysis, reveal the correlation between different threats and discover possible attack chains or attack groups; threat intelligence integration: combine external threat intelligence with internal monitoring data to improve the accuracy and efficiency of threat detection. Threat intelligence may include known malicious IP addresses, domain names, and file hashes; adaptive learning and updating: as time goes by and data accumulates, the system will continuously learn and update its threat detection model, which enables the system to respond to new threats and variant attacks and maintain its effectiveness; response strategy formulation and execution: according to the results of threat detection and identification, formulate corresponding response strategies, such as isolating infected systems, blocking malicious traffic, and notifying relevant personnel. By automating the execution of these strategies, rapid response and disposal of threats can be achieved.

[0037] The threat detection and identification system includes threat feature extraction, threat model training, real-time threat detection, behavior analysis and correlation analysis, threat intelligence integration, adaptive learning and updating, and response strategy formulation and execution. The specific steps are as follows: First, the collected cloud environment data is deeply mined to extract key features related to threat detection, including but not limited to network traffic features, user behavior features, and system log features. The raw data is then converted into information useful for threat detection. Based on the extracted threat features, a threat detection model is constructed using a machine learning algorithm. The model is trained to automatically identify and distinguish between normal and abnormal behaviors, thereby accurately identifying potential threats. The trained threat detection model is then used to perform online detection of real-time data in the cloud environment. By real-time monitoring of network traffic and key user behavior indicators, abnormal behaviors and potential threats can be discovered in a timely manner. The detected anomalies are then Further behavioral analysis and correlation analysis are carried out on the behaviors. By mining the correlations and patterns between abnormal behaviors, potential attack chains and threat propagation paths are revealed, providing strong support for the subsequent response strategy formulation. After that, threat intelligence from various channels is collected, integrated and analyzed, including security vulnerability information, malware samples, and hacker attack cases. By combining this intelligence with real-time detection data, the accuracy and efficiency of threat detection are improved. Secondly, with the continuous changes in the cloud environment and the continuous emergence of new threats, this system can automatically learn and update the threat detection model, optimize model parameters and algorithms by continuously collecting new data and intelligence, and improve the system's adaptability and anti-attack capabilities. Finally, according to the results of threat detection and behavioral analysis, targeted response strategies can be formulated and corresponding security measures can be implemented. These measures include but are not limited to isolating threats, recording evidence, and notifying relevant personnel to ensure the safe and stable operation of the cloud environment.

[0038] Threat model training includes data collection and preprocessing, feature extraction and selection, algorithm selection and model building, model training, model evaluation and tuning, model testing and deployment, continuous monitoring and updating; when conducting threat model training, first collect data related to threat detection, including network traffic data, system logs, and user behavior data, and then preprocess the collected data, including data cleaning (removing noise and outliers), data annotation (labeling data, such as normal or abnormal), and data formatting for subsequent algorithm processing. Then, extract features related to threat detection from the preprocessed data. These features can be network traffic statistics, user behavior patterns, and system call sequences. Then, according to the algorithm requirements and data characteristics, select the most representative features as the input of the model. Then, according to the characteristics of the problem and the nature of the data, select the appropriate algorithm for model construction, which may include machine learning algorithms (such as SVM algorithms, random forest algorithms, and deep learning algorithms). Build the model structure, set the parameters and configuration of the model, and then use The model is trained with labeled data. During the training process, the model learns how to identify threats based on the input features, and then adjusts the model parameters through iterative optimization algorithms (such as gradient descent) to minimize the prediction error. After that, the trained model is evaluated using the validation set, and the performance indicators of the model (such as accuracy, recall, and F1 value) are calculated. Then, the model is tuned according to the evaluation results, including adjusting model parameters, changing feature selection, and trying different algorithms. The tuned model is tested with the test set to ensure that the model can maintain good performance on unseen data. If the model performance meets the requirements, it is deployed to the monitoring method of the cloud security system for real-time threat detection and identification. After the model is deployed, its performance is continuously monitored, and the model is updated and optimized according to new threat data and business needs. As time goes by and the threat environment changes, the model is retrained regularly to maintain its effectiveness. In short, threat model training is an iterative process that requires continuous adjustment and optimization based on data and performance feedback.

[0039] Algorithm selection and model construction are to select appropriate algorithms for model construction based on the characteristics of the problem and the nature of the data, including SVM algorithm, random forest algorithm and deep learning algorithm. SVM algorithm is a commonly used classification algorithm. It maximizes the interval between different categories by finding a hyperplane. For nonlinear problems, the problem can be mapped to a high-dimensional space by introducing a kernel function (such as RBF kernel, polynomial kernel). The formula used is: decision function: f(x) = sign(w^T*φ(x)+b), where w is the weight vector, φ is the mapping function, b is the bias term, and the objective function (for soft margin SVM): minimize 1 / 2*||w||^2+C*Σξi, where C is the penalty coefficient and ξi is the slack variable.

[0040] The random forest algorithm is an ensemble learning method that constructs multiple decision trees and votes or averages their outputs. Each decision tree is trained based on randomly selected features and sample subsets. The steps are as follows: (1) Multiple sample subsets are randomly extracted from the original data set using the bootstrap method with replacement; (2) A decision tree is constructed for each sample subset, but only the randomly selected feature subset is considered at each node split; (3) The outputs of all decision trees are voted or averaged to obtain the final classification result.

[0041] Deep learning algorithms extract deep features of data by building a multi-layer neural network. The steps are as follows: (1) Building a multi-layer neural network structure, including input layer, hidden layer and output layer, (2) Using back propagation algorithm and gradient descent optimization method to train network parameters, (3) Optimizing the performance of the model by continuously adjusting the network structure and parameters.

[0042] The operation process of the data acquisition and preprocessing system mainly includes the following steps: data acquisition, data preprocessing, data storage, data analysis and mining, and data visualization.

[0043] Data collection includes system log collection (collecting data from system operation logs, Web server access logs, and application logs), Internet data collection (grabbing various useful information from the Internet), and ETL (Extract, Transform, Load) processes (extracting data from the source system, converting the data format, and loading it into the target database or data warehouse).

[0044] The operation process of the response strategy formulation and execution system mainly includes the following steps: event detection and confirmation, event classification and evaluation, response strategy formulation, response strategy execution, monitoring and evaluation, summary and feedback.

[0045] The operation process of monitoring reports and log management mainly includes the following steps: log collection, log filtering and preprocessing, log storage and indexing, log monitoring and alarm, log analysis and visualization, monitoring report generation, report management and feedback.

[0046] Report management and feedback are used to manage the generated monitoring reports to ensure the accuracy and completeness of the reports. At the same time, the reports are distributed to relevant personnel and improved and optimized based on feedback.

[0047] It will be apparent to those skilled in the art that the invention is not limited to the details of the exemplary embodiments described above and that the invention can be implemented in other specific forms without departing from the spirit or essential features of the invention. Therefore, the embodiments should be considered in all respects as exemplary and non-limiting, and the scope of the invention is defined by the appended claims rather than the foregoing description, and it is intended that all variations falling within the meaning and scope of the same elements of the claims be included in the invention. Any reference numeral in a claim should not be considered as limiting the claim to which it relates.

Claims

1. A monitoring method for a cloud security system, characterized in that: The system includes data collection and preprocessing system, threat detection and identification system, behavior analysis and correlation analysis system, risk assessment and early warning system, response strategy formulation and execution system and monitoring report and log management system; The data collection and preprocessing system is used to collect network traffic, system logs, and user behavior data of the cloud security system in real time; The threat detection and identification system is used to detect and identify threats on the pre-processed data; The behavior analysis and correlation analysis system is used to conduct further behavior analysis and correlation analysis on the identified threats; The risk assessment and early warning system is used to accurately evaluate the results of threat detection, behavior analysis, and correlation analysis, and to issue early warnings in a timely manner based on the assessment results so that appropriate security control measures can be taken; The response strategy formulation and execution system is used to formulate targeted response strategies based on early warning information and risk assessment results; The monitoring report and log management system is used to generate regular monitoring reports to summarize the overall security status of the cloud environment, threat events that have occurred, and the effectiveness of response measures.

2. A cloud security system monitoring method according to claim 1, characterized in that: The threat detection and identification system includes threat feature extraction, threat model training, real-time threat detection, behavior analysis and correlation analysis, threat intelligence integration, adaptive learning and updating, and response strategy formulation and execution.

3. A cloud security system monitoring method according to claim 2, characterized in that: The threat model training includes data collection and preprocessing, feature extraction and selection, algorithm selection and model construction, model training, model evaluation and tuning, model testing and deployment, and continuous monitoring and updating.

4. A cloud security system monitoring method according to claim 3, characterized in that: The algorithm selection and model construction are to select a suitable algorithm for model construction according to the characteristics of the problem and the nature of the data, including SVM algorithm, random forest algorithm and deep learning algorithm. The SVM algorithm is a commonly used classification algorithm, which maximizes the interval between different categories by finding a hyperplane. For nonlinear problems, the problem can be mapped to a high-dimensional space by introducing a kernel function (such as RBF kernel, polynomial kernel). The formula used is: decision function: f(x)=sign(w^T*φ(x)+b), where w is the weight vector, φ is the mapping function, b is the bias term, and the objective function (for soft interval SVM): minimize 1 / 2*||w||^2+C*Σξi, where C is the penalty coefficient and ξi is the slack variable.

5. A cloud security system monitoring method according to claim 4, characterized in that: The random forest algorithm is an ensemble learning method that constructs multiple decision trees and votes or averages their outputs. Each decision tree is trained based on randomly selected features and sample subsets. The steps are as follows: (1) randomly extracting multiple sample subsets with replacement from the original data set through the bootstrap method; (2) constructing a decision tree for each sample subset, but only considering the randomly selected feature subset when splitting each node; (3) voting or averaging the outputs of all decision trees to obtain the final classification result.

6. A cloud security system monitoring method according to claim 3, characterized in that: The deep learning algorithm extracts deep features of data by constructing a multi-layer neural network. The steps are as follows: (1) constructing a multi-layer neural network structure, including an input layer, a hidden layer, and an output layer; (2) using a back propagation algorithm and a gradient descent optimization method to train network parameters; (3) optimizing the performance of the model by continuously adjusting the network structure and parameters.

7. The cloud security system monitoring method according to claim 1, characterized in that: The operation process of the data acquisition and preprocessing system mainly includes the following steps: data acquisition, data preprocessing, data storage, data analysis and mining, and data visualization.

8. A cloud security system monitoring method according to claim 1, characterized in that: The operation process of the response strategy formulation and execution system mainly includes the following steps: event detection and confirmation, event classification and evaluation, response strategy formulation, response strategy execution, monitoring and evaluation, summary and feedback.

9. A cloud security system monitoring method according to claim 1, characterized in that: The operation process of monitoring reports and log management mainly includes the following steps: log collection, log filtering and preprocessing, log storage and indexing, log monitoring and alarm, log analysis and visualization, monitoring report generation, report management and feedback.

10. A cloud security system monitoring method according to claim 9, characterized in that: Report management and feedback are used to manage the generated monitoring reports to ensure the accuracy and completeness of the reports. At the same time, the reports are distributed to relevant personnel and improved and optimized based on feedback.

Images