Event auditing method and device in cloud environment

Abstract

Embodiments of the invention provide an event auditing method and apparatus in a cloud environment. The method comprises the steps of obtaining a to-be-audited event in the cloud environment; according to candidate key event information, whether the event to be audited is a future key event or not is judged, and the candidate key event information comprises multiple candidate key events and the incidence relation between the candidate key events; when the to-be-audited event is a future key event, judging whether the to-be-audited event is a dangerous event or not according to event parameter information of the to-be-audited event and preset event parameter information; and when it is determined that the event to be audited is a dangerous event, executing a first safety measure corresponding to the dangerous event.

Description

Technical Field

[0001] The present application relates to the field of data security technology, and in particular to an event auditing method and device in a cloud environment. Background Art

[0002] With the advancement of network technology and the increasing demand for computing resources, cloud computing and its service applications have received widespread attention in recent years. In cloud computing, users can use powerful computing resources and obtain sufficient storage space in terms of cost efficiency and less manual management. Therefore, users are willing to outsource data to cloud servers to reduce maintenance costs and enhance accessibility and availability, but this may lead to various security issues. In order to defend against security threats in cloud environments and build the trust of cloud users, security audits can be used to verify security policies. However, traditional audit methods in cloud security are retroactive and can only detect violations after the fact, which cannot guarantee the security of the cloud environment; moreover, a lot of manual work is required, which reduces the efficiency of security audits. Summary of the invention

[0003] In view of the above problems, the embodiments of the present application provide an event audit method and device in a cloud environment that overcome the above problems or at least partially solve the above problems.

[0004] In a first aspect, an embodiment of the present application provides an event audit method in a cloud environment, the method comprising:

[0005] Get events to be audited in the cloud environment;

[0006] Determine whether the audit event is a future key event based on candidate key event information, wherein the candidate key event information includes: multiple candidate key events and associations between the candidate key events;

[0007] In the case where the event to be audited is a future critical event, judging whether the event to be audited is a dangerous event according to the event parameter information of the event to be audited and the preset event parameter information;

[0008] In the case where the event to be audited is determined to be a dangerous event, a first safety measure corresponding to the dangerous event is executed.

[0009] Optionally, judging whether the event to be audited is a future key event according to the candidate key event information includes:

[0010] Determining whether the event to be audited is included in a plurality of candidate key events of the candidate key event information;

[0011] In the case where the event to be audited is included in the multiple candidate key events, obtaining a key event set, wherein the key event set includes multiple key events;

[0012] According to the association relationship between the candidate key events and the key event set, it is determined whether the event to be audited is a future key event.

[0013] Optionally, judging whether the event to be audited is a future key event according to the association relationship between the candidate key events and the key event set includes:

[0014] According to the association relationship between the candidate key events, determine the target key event to which the event to be audited is transformed after the current time from the key event set;

[0015] Calculate the target transition probability of the audit event to the target key event according to the transition probability between two candidate key events with an associated relationship in the candidate key event information;

[0016] When the target transition probability is greater than the preset transition probability, determining that the event to be audited is a future key event;

[0017] When the target transition probability is less than or equal to the preset transition probability, the event to be audited is determined to be a non-future critical event.

[0018] Optionally, when the event to be audited is a future critical event, judging whether the event to be audited is a dangerous event according to event parameter information of the event to be audited and preset event parameter information includes:

[0019] In the case where the event to be audited is a future key event, obtaining event parameter information and preset event parameter information of the event to be audited, wherein the preset event parameter information includes event parameter information of each key event in the key event set;

[0020] In a case where the preset event parameter information includes the event parameter information of the event to be audited, determining that the event to be audited is a dangerous event;

[0021] When the preset event parameter information does not include the event parameter information of the event to be audited, it is determined that the event to be audited is a security event.

[0022] Optionally, the multiple candidate key events include at least two of the following:

[0023] The first incident of a security policy violation;

[0024] a second event having a contextual association relationship with the first event;

[0025] a third event having a strong dependent association relationship with the first event;

[0026] a fourth event having a time-dependent association relationship with the first event;

[0027] A fifth event having an environment association relationship with the first event.

[0028] In a second aspect, an embodiment of the present application further provides an event auditing device in a cloud environment, the device comprising:

[0029] An acquisition module is used to acquire events to be audited in the cloud environment;

[0030] A first judgment module is used to judge whether the event to be audited is a future key event based on candidate key event information, wherein the candidate key event information includes: a plurality of candidate key events and associations between the candidate key events;

[0031] A second judgment module is used to judge whether the event to be audited is a dangerous event according to the event parameter information of the event to be audited and the preset event parameter information when the event to be audited is a future key event;

[0032] The execution module is used to execute the first safety measure corresponding to the dangerous event when the event to be audited is determined to be a dangerous event.

[0033] Optionally, the first determination module is specifically configured to:

[0034] Determining whether the event to be audited is included in a plurality of candidate key events of the candidate key event information;

[0035] In the case where the event to be audited is included in the multiple candidate key events, obtaining a key event set, wherein the key event set includes multiple key events;

[0036] According to the association relationship between the candidate key events and the key event set, it is determined whether the event to be audited is a future key event.

[0037] Optionally, when the first judgment module judges whether the event to be audited is a future key event according to the association relationship between the candidate key events and the key event set, it is specifically used to:

[0038] According to the association relationship between the candidate key events, determine the target key event to which the event to be audited is transformed after the current time from the key event set;

[0039] Calculate the target transition probability of the audit event to the target key event according to the transition probability between two candidate key events with an associated relationship in the candidate key event information;

[0040] When the target transition probability is greater than the preset transition probability, determining that the event to be audited is a future key event;

[0041] When the target transition probability is less than or equal to the preset transition probability, the event to be audited is determined to be a non-future critical event.

[0042] Optionally, the second judgment module specifically includes:

[0043] In the case where the event to be audited is a future key event, obtaining event parameter information and preset event parameter information of the event to be audited, wherein the preset event parameter information includes event parameter information of each key event in the key event set;

[0044] In a case where the preset event parameter information includes the event parameter information of the event to be audited, determining that the event to be audited is a dangerous event;

[0045] When the preset event parameter information does not include the event parameter information of the event to be audited, it is determined that the event to be audited is a security event.

[0046] Optionally, the multiple candidate key events include at least two of the following:

[0047] The first incident of a security policy violation;

[0048] a second event having a contextual association relationship with the first event;

[0049] a third event having a strong dependent association relationship with the first event;

[0050] a fourth event having a time-dependent association relationship with the first event;

[0051] A fifth event having an environment association relationship with the first event.

[0052] In a third aspect, an embodiment of the present application further provides an electronic device, including a memory, a transceiver, and a processor:

[0053] A memory for storing a computer program; a transceiver for sending and receiving data under the control of a processor; and a processor for reading the computer program in the memory and executing the method as described in the first aspect above.

[0054] In a fourth aspect, an embodiment of the present application further provides a processor-readable storage medium, wherein the processor-readable storage medium stores a computer program, and the computer program is used to enable the processor to execute the method described in the first aspect above.

[0055] In the above-mentioned embodiment of the present application, firstly, an event to be audited in a cloud environment is intercepted, and then, based on a plurality of candidate key events and the correlation between the candidate key events, it is determined whether the event to be audited is a future key event. If the event to be audited is a future key event, it is determined whether the event to be audited is a dangerous event based on the event parameter information of the event to be audited and the preset event parameter information. If the event to be audited is determined to be a dangerous event, the first security measure corresponding to the dangerous event is executed, that is, the event to be audited in the cloud environment is actively audited to improve the efficiency of security auditing; then, by determining whether the event to be audited is a future key event, if it is a future key event, it is further determined whether it is a dangerous event, so that corresponding security measures can be taken before the event occurs, which can effectively prevent the occurrence of violation events, reduce potential security risks, and improve the security of the cloud environment; and firstly determining whether it is a future key event, and then further determining whether it is a dangerous event on the basis of the future key event, which can improve the accuracy of security auditing and further ensure the security of the cloud environment. BRIEF DESCRIPTION OF THE DRAWINGS

[0056] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings required for use in the description of the embodiments of the present application will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative labor.

[0057] Figure 1 A flowchart of an event audit method in a cloud environment provided in an embodiment of the present application;

[0058] Figure 2 A specific flow chart of the event audit method in a cloud environment provided by an embodiment of the present application;

[0059] Figure 3 A structural block diagram of an event audit device in a cloud environment provided by an embodiment of the present application;

[0060] Figure 4 A structural block diagram of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0061] The following will be combined with the drawings in the embodiments of the present application to clearly describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, rather than all the embodiments. All other embodiments obtained by ordinary technicians in this field based on the embodiments in the present application belong to the scope of protection of this application.

[0062] The terms "first", "second", etc. in the specification and claims of the present application are used to distinguish similar objects, and are not used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable under appropriate circumstances, so that the embodiments of the present application can be implemented in an order other than those illustrated or described here, and the objects distinguished by "first", "second", etc. are generally of one type, and the number of objects is not limited. For example, the first object can be one or more. In addition, "and / or" in the specification and claims represents at least one of the connected objects, and the character " / " generally indicates that the objects associated with each other are in an "or" relationship.

[0063] The event audit method in the cloud environment provided by the embodiment of the present application is described in detail below with reference to the accompanying drawings through specific embodiments and their application scenarios.

[0064] Specifically, the present application embodiment provides an event audit method in a cloud environment, such as Figure 1 As shown, the method can be applied to the audit system, and specifically may include the following steps:

[0065] Step 101: Obtain events to be audited in the cloud environment.

[0066] Specifically, first, the audit system intercepts the audit events running in the cloud environment in real time, and performs real-time security audits on the intercepted audit events, which can improve security and reduce potential security risks.

[0067] A cloud environment refers to an ecosystem that provides computing resources and services through the Internet, including storage, processing power, networking, and software, enabling users to access and use resources on demand without having to purchase and maintain physical hardware and infrastructure.

[0068] Auditing refers to the process of protecting data and auditing systems by reviewing, monitoring, and evaluating security controls in cloud environments, identifying security gaps, ensuring compliance, and improving overall security.

[0069] Step 102: judging whether the event to be audited is a future key event based on the candidate key event information, wherein the candidate key event information includes: a plurality of candidate key events and associations between the candidate key events.

[0070] Specifically, the candidate key event information includes but is not limited to multiple candidate key events and the association between multiple candidate key events. Through multiple candidate key events and the association between multiple candidate key events, it is judged whether the above-mentioned event to be audited is a future key event. In other words, through multiple candidate key events and the association between multiple candidate key events, it is predicted whether the above-mentioned event to be audited will become a key event in the future.

[0071] Among them, correlation refers to the relationship and influence between different events in the cloud environment. These relationships help the audit system understand that the occurrence of a certain event may lead to the occurrence of other events, thereby making effective predictions and management during the security audit and verification process.

[0072] Step 103, when the event to be audited is a future critical event, determine whether the event to be audited is a dangerous event based on the event parameter information of the event to be audited and preset event parameter information.

[0073] Specifically, if the event to be audited is not a future critical event, the task corresponding to the event to be audited is executed. If the event to be audited is a future critical event, the event parameter information and the preset event parameter information of the event to be audited are obtained, and the event to be audited is judged to be a dangerous event or a safety event through the event parameter information and the preset event parameter information of the event to be audited.

[0074] Step 104: When it is determined that the event to be audited is a dangerous event, a first safety measure corresponding to the dangerous event is executed.

[0075] Specifically, if the audit event is determined to be a dangerous event, the first security measure corresponding to the dangerous event is executed, that is, a compulsory measure is adopted to prohibit the execution of the task corresponding to the audit event. If the audit event is determined to be a safe event, the second security measure corresponding to the safe event is executed, that is, the task corresponding to the audit event is executed.

[0076] In the above-mentioned embodiment of the present application, firstly, the event to be audited in the cloud environment is intercepted and obtained, and then, based on multiple candidate key events and the correlation relationship between the candidate key events, it is determined whether the event to be audited is a future key event. If the event to be audited is a future key event, it is determined whether the event to be audited is a dangerous event based on the event parameter information of the event to be audited and the preset event parameter information. If the event to be audited is determined to be a dangerous event, the first security measure corresponding to the dangerous event is executed, that is, the event to be audited in the cloud environment is actively audited to improve the efficiency of security audit; then, by determining whether the event to be audited is a future key event, if it is a future key event, it is further determined whether it is a dangerous event, so that corresponding security measures can be taken before the event occurs, which can effectively prevent the occurrence of violation events, reduce potential security risks, and improve the security of the cloud environment; and first determine whether it is a future key event, and then further determine whether it is a dangerous event based on the future key event, which can improve the accuracy of security audit and further ensure the security of the cloud environment.

[0077] As an optional specific embodiment, the multiple candidate key events include but are not limited to at least two of the following five types:

[0078] The first type: the first incident of violation of security policy.

[0079] Specifically, the audit system collects cloud configuration data (such as status data and event log data) from different cloud services (such as cloud computing and cloud storage), and then converts the configuration data into the format of an offline audit tool. The offline audit tool determines events that violate security policies based on the configuration data, and treats events that violate security policies as first events, with one or more first events.

[0080] For example, the first event may be an operation such as updating a port or deleting a virtual machine.

[0081] It should be noted that security policy refers to a collection of specifications and control measures designed to ensure the security, compliance and reliability of the cloud computing environment, including security requirements, operating guidelines and audit standards for cloud service providers and cloud users.

[0082] Offline audit tools refer to audit tools applied to OpenStack, which convert the collected configuration data into the format corresponding to the tool and verify the configuration data of the current cloud service, so as to detect violations caused by events. OpenStack refers to the open source cloud computing management platform project, which is a combination of a series of software open source projects.

[0083] The second type: a second event that has a contextual association relationship with the first event.

[0084] Specifically, the data of the context event related to the first event is the second event having a contextual association relationship with the first event, and the number of the second events is one or more.

[0085] For example, the first event is an update port event, and the context data of the create port event will affect the subsequent update port event, that is, the create port event is the second event.

[0086] The third type: a third event that has a strong dependent relationship with the first event.

[0087] Specifically, an event that is sure to occur after the first event occurs is a third event with a strong dependency relationship, and the number of the third events is one or more.

[0088] For example, the create network event depends on the create subnet event, and the create network event and the create subnet event have a strong dependent association relationship.

[0089] The fourth type: a fourth event that has a time-dependent association relationship with the first event.

[0090] Specifically, an event that occurs within a period of time before the first event or after the first event is a fourth event that has a time dependency relationship with the first event, and the number of the fourth events is one or more.

[0091] For example, if the average time interval between the creation of a network event (ie, the first event) and the creation of a subnetwork event (ie, the fourth event) is 5 minutes, then within 5 minutes after the creation of the network event, the creation of a subnetwork event will be predicted as the forthcoming fourth event.

[0092] The fifth type: a fifth event that has an environmental association relationship with the first event.

[0093] Specifically, under a specific environment, the first event will cause an event to occur in the future to be the fifth event, and the number of the fifth events is one or more.

[0094] For example, in a specific environment, a security group is always created after a virtual machine creation event, so the creation of a security group is a predictable fifth event.

[0095] The above-mentioned multiple candidate key events can more effectively identify dangerous events and improve the accuracy of proactive safety audits.

[0096] As an optional specific embodiment, the step 102 determines whether the event to be audited is a future key event based on the candidate key event information, and specifically includes steps 1021 to 1023:

[0097] Step 1021, determining whether the multiple candidate key events of the candidate key event information include the event to be audited.

[0098] Specifically, since the candidate key event information includes multiple candidate key events, by traversing multiple candidate key events, it is determined whether the multiple candidate key events include a candidate key event that is the same event as the event to be audited, in other words, it is determined whether the event to be audited is one of the multiple candidate key events. If the multiple candidate key events include the event to be audited, step 1022 is executed; if the multiple candidate key events do not include the event to be audited, the task corresponding to the event to be audited is executed.

[0099] Step 1022: when the event to be audited is included in the multiple candidate key events, a key event set is obtained, wherein the key event set includes multiple key events.

[0100] Specifically, if the multiple candidate key events include the event to be audited, a preset key event set is obtained, and the key event set includes multiple key events.

[0101] The following is an explanation of the process of determining the key event set:

[0102] First, find the cloud services related to security policy violations and collect the configuration data of the cloud services. The audit system identifies the event type through the configuration data and filters out five types of events that are not candidate key events to obtain multiple candidate key events in the candidate key event information.

[0103] The application programming interface (API) document of the cloud platform is obtained, and multiple candidate key events are filtered through the API document, and the candidate key events that do not belong to the API document are filtered out, and the retained candidate key events form a key event set.

[0104] Step 1023: Determine whether the event to be audited is a future key event based on the association relationship between the candidate key events and the key event set.

[0105] Specifically, since the candidate key event information also includes the association relationship between the candidate key events, the association relationship between the candidate key events and the key event set are used to determine whether the above-mentioned event to be audited is a future key event. In other words, the association relationship between the candidate key events and the key event set are used to predict whether the above-mentioned event to be audited will become a key event in the future.

[0106] The above-mentioned embodiment, by predicting future key events, can take security measures before the events occur, implement active security audits, and effectively prevent security violations from occurring.

[0107] Furthermore, the step 1023 determines whether the event to be audited is a future key event according to the association relationship between the candidate key events and the key event set, and specifically includes:

[0108] According to the association relationship between the candidate key events, determine the target key event to which the event to be audited is transformed after the current time from the key event set;

[0109] Calculate the target transition probability of the audit event to the target key event according to the transition probability between two candidate key events with an associated relationship in the candidate key event information;

[0110] When the target transition probability is greater than the preset transition probability, determining that the event to be audited is a future key event;

[0111] When the target transition probability is less than or equal to the preset transition probability, the event to be audited is determined to be a non-future critical event.

[0112] Specifically, through the association relationship between candidate key events, we can know which event the audit event will transform into in the future (i.e. after the current time), and then through the key event set, we can know which event is the key event among the events that the audit event will transform into in the future, thereby determining the target key event that the audit event will transform into in the future.

[0113] The candidate key event information also includes the transition probability between two candidate key events having an associated relationship. Based on the transition probability between the two candidate key events, the target transition probability of the audit event transforming into the target key event can be calculated.

[0114] For example: the event to be audited is event A, and the target key event is event C. According to the association between candidate key events, event A directly transforms into event C. Then, the transition probability from event A to event C in the candidate key event information is obtained, and the transition probability from event A to event C is used as the target transition probability.

[0115] For another example: the event to be audited is event A, and the target key event is event C. According to the correlation between the candidate key events, event A first transforms into event B, and then transforms into event C from event B. Then, the transition probability from event A to event B in the candidate key event information is obtained, and the transition probability from event B to event C is obtained. The transition probability from event A to event B is added to the transition probability from event B to event C, and the average is calculated. The average is the target transition probability.

[0116] After obtaining the target transition probability, compare the target transition probability with the preset transition probability. If the target transition probability is greater than the preset transition probability, the event to be audited is determined to be a future key event. Otherwise, if the target transition probability is less than or equal to the preset transition probability, the event to be audited is determined to be a non-future key event.

[0117] The following is an explanation of the process of determining the transition probability between two candidate key events:

[0118] Get the configuration data of different cloud services. The event log data in the configuration data records the operation process and transformation process of events in the cloud environment, thereby obtaining the frequency and average time interval of the transformation between two events in a cycle. For example, in a cycle, event A transforms into event B once, and the time interval from the transformation to the next transformation is the average time interval. Store the frequency and average time interval of the transformation between the two events, and then send the frequency and average time interval of the transformation between the two events to the time series predictor through the Bayesian network. The time series predictor processes the frequency and average time interval and outputs the transformation probability of the two events. The transformation probability is used to indicate the closeness of the relationship between the two events. The larger the transformation probability, the higher the closeness.

[0119] As an optional specific embodiment, in the case where the event to be audited is a future critical event, step 103 determines whether the event to be audited is a dangerous event based on the event parameter information of the event to be audited and the preset event parameter information, specifically including:

[0120] In the case where the event to be audited is a future key event, obtaining event parameter information and preset event parameter information of the event to be audited, wherein the preset event parameter information includes event parameter information of each key event in the key event set;

[0121] In a case where the preset event parameter information includes the event parameter information of the event to be audited, determining that the event to be audited is a dangerous event;

[0122] When the preset event parameter information does not include the event parameter information of the event to be audited, it is determined that the event to be audited is a security event.

[0123] Specifically, if the event to be audited is a future critical event, the event parameter information (such as event identification number) of the event to be audited and the preset event parameter information are obtained, and the preset event parameter information includes the event parameter information corresponding to each critical event in the critical event set. If the preset event parameter information includes the event parameter information of the event to be audited, the event to be audited is determined to be a dangerous event. On the contrary, if the preset event parameter information does not include the event parameter information of the event to be audited, the event to be audited is determined to be a safe event.

[0124] In addition, the audit system may also include a user interface module, which provides a real-time monitoring interface to display the audit events recently initiated by the user and the corresponding security measures taken by the audit system to help users understand the operating status of the audit system and the security audit results of each event.

[0125] The above scheme is described below through a specific embodiment:

[0126] like Figure 2 As shown, in step 201, the events to be audited in the cloud environment are obtained.

[0127] Step 202 , determining whether the multiple candidate key events of the candidate key event information include the event to be audited; if so, executing step 203 , if not, executing step 209 .

[0128] Step 203: According to the association relationship between the candidate key events, determine the target key event to which the audit event is transformed after the current time from the key event set.

[0129] Step 204 , calculating the target transition probability of the audit event transforming into the target key event according to the transition probability between two candidate key events having an associated relationship in the candidate key event information.

[0130] Step 205 , determining whether the target transition probability is greater than a preset transition probability, if so, executing step 206 , if not, executing step 209 .

[0131] Step 206: Acquire event parameter information of the event to be audited and preset event parameter information.

[0132] Step 207 , determining whether the preset event parameter information includes the event parameter information of the event to be audited, if yes, executing step 208 , if no, executing step 209 .

[0133] Step 208: Execute the first safety measure corresponding to the dangerous event.

[0134] Step 209: Execute the second security measure corresponding to the security event.

[0135] In summary, in the above embodiments of the present application, the audit system intercepts the events to be audited running in the cloud environment in real time to conduct security audits, which can improve security and reduce potential security risks; and, through a variety of candidate key events, it can more effectively identify dangerous events and improve the accuracy of active security audits; by predicting future key events, security measures can be taken before the event occurs, to achieve active security audits and effectively prevent security violations; and, first determine whether it is a future key event, and then further determine whether it is a dangerous event based on the future key events, which can further improve the accuracy of security audits and further ensure the security of the cloud environment. Moreover, the above scheme can be integrated into different cloud management platforms, and can also be ported to other cloud platforms, with good scalability, which enhances the versatility and applicability of the audit system.

[0136] The above introduces the event audit method in the cloud environment provided by the embodiment of the present application. The following will introduce the event audit device in the cloud environment provided by the embodiment of the present application in conjunction with the accompanying drawings.

[0137] like Figure 3 As shown, the embodiment of the present application further provides an event auditing device 300 in a cloud environment, the device comprising:

[0138] The acquisition module 301 is used to acquire events to be audited in the cloud environment;

[0139] A first judgment module 302 is used to judge whether the audit event is a future key event based on candidate key event information, wherein the candidate key event information includes: multiple candidate key events and associations between the candidate key events;

[0140] The second judgment module 303 is used to judge whether the event to be audited is a dangerous event according to the event parameter information of the event to be audited and the preset event parameter information when the event to be audited is a future key event;

[0141] The execution module 304 is used to execute the first safety measure corresponding to the dangerous event when the event to be audited is determined to be a dangerous event.

[0142] In the above-mentioned embodiment of the present application, firstly, the event to be audited in the cloud environment is intercepted and obtained, and then, based on multiple candidate key events and the correlation relationship between the candidate key events, it is determined whether the event to be audited is a future key event. If the event to be audited is a future key event, it is determined whether the event to be audited is a dangerous event based on the event parameter information of the event to be audited and the preset event parameter information. If the event to be audited is determined to be a dangerous event, the first security measure corresponding to the dangerous event is executed, that is, the event to be audited in the cloud environment is actively audited to improve the efficiency of security audit; then, by determining whether the event to be audited is a future key event, if it is a future key event, it is further determined whether it is a dangerous event, so that corresponding security measures can be taken before the event occurs, which can effectively prevent the occurrence of violation events, reduce potential security risks, and improve the security of the cloud environment; and first determine whether it is a future key event, and then further determine whether it is a dangerous event based on the future key event, which can improve the accuracy of security audit and further ensure the security of the cloud environment.

[0143] Optionally, the first determining module 302 is specifically configured to:

[0144] Determining whether the event to be audited is included in a plurality of candidate key events of the candidate key event information;

[0145] In the case where the event to be audited is included in the multiple candidate key events, obtaining a key event set, wherein the key event set includes multiple key events;

[0146] According to the association relationship between the candidate key events and the key event set, it is determined whether the event to be audited is a future key event.

[0147] Optionally, when the first judging module 302 judges whether the event to be audited is a future key event according to the association relationship between the candidate key events and the key event set, it is specifically used to:

[0148] According to the association relationship between the candidate key events, determine the target key event to which the event to be audited is transformed after the current time from the key event set;

[0149] Calculate the target transition probability of the audit event to the target key event according to the transition probability between two candidate key events with an associated relationship in the candidate key event information;

[0150] When the target transition probability is greater than the preset transition probability, determining that the event to be audited is a future key event;

[0151] When the target transition probability is less than or equal to the preset transition probability, the event to be audited is determined to be a non-future critical event.

[0152] Optionally, the second determining module 303 specifically includes:

[0153] In the case where the event to be audited is a future key event, obtaining event parameter information and preset event parameter information of the event to be audited, wherein the preset event parameter information includes event parameter information of each key event in the key event set;

[0154] In a case where the preset event parameter information includes the event parameter information of the event to be audited, determining that the event to be audited is a dangerous event;

[0155] When the preset event parameter information does not include the event parameter information of the event to be audited, it is determined that the event to be audited is a security event.

[0156] Optionally, the multiple candidate key events include at least two of the following:

[0157] The first incident of a security policy violation;

[0158] a second event having a contextual association relationship with the first event;

[0159] a third event having a strong dependent association relationship with the first event;

[0160] a fourth event having a time-dependent association relationship with the first event;

[0161] A fifth event having an environment association relationship with the first event.

[0162] In addition, if Figure 3 As shown, the event audit device in the cloud environment may also include a user interface module 305, which provides a real-time monitoring interface to display the audit events recently initiated by the user and the corresponding security measures taken by the audit system, so as to help the user understand the operating status of the audit system and the security audit results of each event.

[0163] It should be noted here that the event auditing device in the above-mentioned cloud environment provided in the embodiment of the present application can implement all the method steps implemented in the event auditing method embodiment in the above-mentioned cloud environment, and can achieve the same technical effect. The parts and beneficial effects of this embodiment that are the same as the method embodiment will not be described in detail here.

[0164] In summary, in the above embodiments of the present application, the audit system intercepts the events to be audited running in the cloud environment in real time to conduct security audits, which can improve security and reduce potential security risks; and, through a variety of candidate key events, it can more effectively identify dangerous events and improve the accuracy of active security audits; by predicting future key events, security measures can be taken before the event occurs, to achieve active security audits and effectively prevent security violations; and, first determine whether it is a future key event, and then further determine whether it is a dangerous event based on the future key events, which can further improve the accuracy of security audits and further ensure the security of the cloud environment. Moreover, the above scheme can be integrated into different cloud management platforms, and can also be ported to other cloud platforms, with good scalability, which enhances the versatility and applicability of the audit system.

[0165] It should be noted that the division of units in the embodiments of the present application is schematic and is only a logical function division. There may be other division methods in actual implementation. In addition, each functional unit in each embodiment of the present application may be integrated into a processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0166] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a processor-readable storage medium. Based on this understanding, the technical solution of the present application is essentially or the part that contributes to the prior art or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions to enable a computer device (which can be a personal computer, server, or network device, etc.) or a processor (processor) to perform all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (Read-Only Memory, ROM), random access memory (Random Access Memory, RAM), disk or optical disk and other media that can store program codes.

[0167] like Figure 4As shown, an embodiment of the present application further provides an electronic device, including a memory 420, a transceiver 410, and a processor 400:

[0168] Memory 420, used for storing computer programs;

[0169] A transceiver 410, configured to transmit and receive data under the control of the processor;

[0170] The processor 400 is configured to read the computer program in the memory and execute the following steps:

[0171] Get events to be audited in the cloud environment;

[0172] Determine whether the audit event is a future key event based on candidate key event information, wherein the candidate key event information includes: multiple candidate key events and associations between the candidate key events;

[0173] In the case where the event to be audited is a future critical event, judging whether the event to be audited is a dangerous event according to the event parameter information of the event to be audited and the preset event parameter information;

[0174] In the case where the event to be audited is determined to be a dangerous event, a first safety measure corresponding to the dangerous event is executed.

[0175] In the above-mentioned embodiment of the present application, firstly, the event to be audited in the cloud environment is intercepted and obtained, and then, based on multiple candidate key events and the correlation relationship between the candidate key events, it is determined whether the event to be audited is a future key event. If the event to be audited is a future key event, it is determined whether the event to be audited is a dangerous event based on the event parameter information of the event to be audited and the preset event parameter information. If the event to be audited is determined to be a dangerous event, the first security measure corresponding to the dangerous event is executed, that is, the event to be audited in the cloud environment is actively audited to improve the efficiency of security audit; then, by determining whether the event to be audited is a future key event, if it is a future key event, it is further determined whether it is a dangerous event, so that corresponding security measures can be taken before the event occurs, which can effectively prevent the occurrence of violation events, reduce potential security risks, and improve the security of the cloud environment; and first determine whether it is a future key event, and then further determine whether it is a dangerous event based on the future key event, which can improve the accuracy of security audit and further ensure the security of the cloud environment.

[0176] Optionally, when the processor 400 determines whether the event to be audited is a future key event according to the candidate key event information, it is specifically configured to:

[0177] Determining whether the event to be audited is included in a plurality of candidate key events of the candidate key event information;

[0178] In the case where the event to be audited is included in the multiple candidate key events, obtaining a key event set, wherein the key event set includes multiple key events;

[0179] According to the association relationship between the candidate key events and the key event set, it is determined whether the event to be audited is a future key event.

[0180] Optionally, when the processor 400 determines whether the event to be audited is a future key event according to the association relationship between the candidate key events and the key event set, it is specifically configured to:

[0181] According to the association relationship between the candidate key events, determine the target key event to which the event to be audited is transformed after the current time from the key event set;

[0182] Calculate the target transition probability of the audit event to the target key event according to the transition probability between two candidate key events with an associated relationship in the candidate key event information;

[0183] When the target transition probability is greater than the preset transition probability, determining that the event to be audited is a future key event;

[0184] When the target transition probability is less than or equal to the preset transition probability, the event to be audited is determined to be a non-future critical event.

[0185] Optionally, when the event to be audited is a future critical event, the processor 400 determines whether the event to be audited is a dangerous event according to the event parameter information of the event to be audited and preset event parameter information, specifically for:

[0186] In the case where the event to be audited is a future key event, obtaining event parameter information and preset event parameter information of the event to be audited, wherein the preset event parameter information includes event parameter information of each key event in the key event set;

[0187] In a case where the preset event parameter information includes the event parameter information of the event to be audited, determining that the event to be audited is a dangerous event;

[0188] When the preset event parameter information does not include the event parameter information of the event to be audited, it is determined that the event to be audited is a security event.

[0189] Optionally, the multiple candidate key events include at least two of the following:

[0190] The first incident of a security policy violation;

[0191] a second event having a contextual association relationship with the first event;

[0192] a third event having a strong dependent association relationship with the first event;

[0193] a fourth event having a time-dependent association relationship with the first event;

[0194] A fifth event having an environment association relationship with the first event.

[0195] Among them, Figure 4 In the embodiment, the bus architecture may include any number of interconnected buses and bridges, specifically linking together various circuits of one or more processors represented by processor 400 and memory represented by memory 420. The bus architecture may also link together various other circuits such as peripherals, voltage regulators, and power management circuits, which are well known in the art and are therefore not further described herein. The bus interface provides an interface. The transceiver 410 may be a plurality of components, namely, a transmitter and a receiver, providing a unit for communicating with various other devices on a transmission medium, which transmission medium may include a wireless channel, a wired channel, an optical cable, and the like. The processor 400 is responsible for managing the bus architecture and general processing, and the memory 420 may store data used by the processor 400 when performing operations.

[0196] The processor 400 may be a central processing unit (CPU), an application specific integrated circuit (ASIC), a field programmable gate array (FPGA) or a complex programmable logic device (CPLD). The processor may also adopt a multi-core architecture.

[0197] In summary, in the above embodiments of the present application, the audit system intercepts the events to be audited running in the cloud environment in real time to conduct security audits, which can improve security and reduce potential security risks; and, through a variety of candidate key events, it can more effectively identify dangerous events and improve the accuracy of active security audits; by predicting future key events, security measures can be taken before the event occurs, to achieve active security audits and effectively prevent security violations; and, first determine whether it is a future key event, and then further determine whether it is a dangerous event based on the future key events, which can further improve the accuracy of security audits and further ensure the security of the cloud environment. Moreover, the above scheme can be integrated into different cloud management platforms, and can also be ported to other cloud platforms, with good scalability, which enhances the versatility and applicability of the audit system.

[0198] The processor calls the computer program stored in the memory to execute the event audit method in the cloud environment provided by the embodiment of the present application according to the obtained executable instructions. The processor and the memory can also be arranged physically separately.

[0199] It should be noted here that the above-mentioned electronic device provided in the embodiment of the present application can implement all the method steps implemented in the event audit method embodiment under the above-mentioned cloud environment, and can achieve the same technical effect. The parts and beneficial effects of this embodiment that are the same as the method embodiment will not be described in detail here.

[0200] An embodiment of the present application further provides a processor-readable storage medium, wherein the processor-readable storage medium stores a computer program, and the computer program is used to enable the processor to execute the event auditing method in the above-mentioned cloud environment.

[0201] The processor-readable storage medium can be any available medium or data storage device that can be accessed by the processor, including but not limited to magnetic storage (such as floppy disks, hard disks, magnetic tapes, magneto-optical disks (MO), etc.), optical storage (such as CD, DVD, BD, HVD, etc.), and semiconductor storage (such as ROM, EPROM, EEPROM, non-volatile memory (NANDFLASH), solid-state drive (SSD)), etc.

[0202] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage and optical storage, etc.) that contain computer-usable program code.

[0203] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer executable instructions. These computer executable instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0204] These processor executable instructions may also be stored in a processor readable memory that can direct a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the processor readable memory produce an article of manufacture including an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0205] These processor-executable instructions may also be loaded onto a computer or other programmable data processing device so that a series of operational steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for executing on the computer or other programmable device to implement the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0206] Obviously, those skilled in the art can make various changes and modifications to the present application without departing from the spirit and scope of the present application. Thus, if these modifications and variations of the present application fall within the scope of the claims of the present application and their equivalents, the present application is also intended to include these modifications and variations.

Claims

1. An event audit method in a cloud environment, characterized in that: The method comprises: Get events to be audited in the cloud environment; Determining whether the event to be audited is a future key event based on candidate key event information, wherein the candidate key event information includes: multiple candidate key events and associations between the candidate key events; In the case where the event to be audited is a future critical event, judging whether the event to be audited is a dangerous event according to the event parameter information of the event to be audited and the preset event parameter information; In the case where the event to be audited is determined to be a dangerous event, a first safety measure corresponding to the dangerous event is executed.

2. The method according to claim 1, characterized in that The step of judging whether the event to be audited is a future key event based on the candidate key event information includes: Determining whether the event to be audited is included in a plurality of candidate key events of the candidate key event information; In the case where the event to be audited is included in the multiple candidate key events, obtaining a key event set, wherein the key event set includes multiple key events; According to the association relationship between the candidate key events and the key event set, it is determined whether the event to be audited is a future key event.

3. The method according to claim 2, characterized in that The step of judging whether the event to be audited is a future key event based on the association relationship between the candidate key events and the key event set includes: According to the association relationship between the candidate key events, determine the target key event to which the event to be audited is transformed after the current time from the key event set; Calculate the target transition probability of the audit event to the target key event according to the transition probability between two candidate key events with an associated relationship in the candidate key event information; When the target transition probability is greater than the preset transition probability, determining that the event to be audited is a future key event; When the target transition probability is less than or equal to the preset transition probability, the event to be audited is determined to be a non-future critical event.

4. The method according to claim 2, characterized in that: In the case where the event to be audited is a future critical event, judging whether the event to be audited is a dangerous event according to the event parameter information of the event to be audited and the preset event parameter information includes: In the case where the event to be audited is a future key event, obtaining event parameter information and preset event parameter information of the event to be audited, wherein the preset event parameter information includes event parameter information of each key event in the key event set; In a case where the preset event parameter information includes the event parameter information of the event to be audited, determining that the event to be audited is a dangerous event; When the preset event parameter information does not include the event parameter information of the event to be audited, it is determined that the event to be audited is a security event.

5. The method according to claim 2, characterized in that: The multiple candidate key events include at least two of the following: The first incident of a security policy violation; a second event having a contextual association relationship with the first event; a third event having a strong dependent association relationship with the first event; a fourth event having a time-dependent association relationship with the first event; A fifth event having an environment association relationship with the first event.

6. An event auditing device in a cloud environment, characterized in that: The device comprises: An acquisition module is used to acquire events to be audited in the cloud environment; A first judgment module is used to judge whether the event to be audited is a future key event based on candidate key event information, wherein the candidate key event information includes: a plurality of candidate key events and associations between the candidate key events; A second judgment module is used to judge whether the event to be audited is a dangerous event according to the event parameter information of the event to be audited and the preset event parameter information when the event to be audited is a future key event; The execution module is used to execute the first safety measure corresponding to the dangerous event when the event to be audited is determined to be a dangerous event.

7. The device according to claim 6, characterized in that The first judgment module is specifically used to: Determining whether the event to be audited is included in a plurality of candidate key events of the candidate key event information; In the case where the event to be audited is included in the multiple candidate key events, obtaining a key event set, wherein the key event set includes multiple key events; According to the association relationship between the candidate key events and the key event set, it is determined whether the event to be audited is a future key event.

8. The device according to claim 7, characterized in that When the first judgment module judges whether the event to be audited is a future key event according to the association relationship between the candidate key events and the key event set, it is specifically used to: According to the association relationship between the candidate key events, determine the target key event to which the event to be audited is transformed after the current time from the key event set; Calculate the target transition probability of the audit event to the target key event according to the transition probability between two candidate key events with an associated relationship in the candidate key event information; When the target transition probability is greater than the preset transition probability, determining that the event to be audited is a future key event; When the target transition probability is less than or equal to the preset transition probability, the event to be audited is determined to be a non-future critical event.

9. The device according to claim 7, characterized in that The second judgment module specifically includes: In the case where the event to be audited is a future key event, obtaining event parameter information and preset event parameter information of the event to be audited, wherein the preset event parameter information includes event parameter information of each key event in the key event set; In a case where the preset event parameter information includes the event parameter information of the event to be audited, determining that the event to be audited is a dangerous event; When the preset event parameter information does not include the event parameter information of the event to be audited, it is determined that the event to be audited is a security event.

10. The device according to claim 7, characterized in that The multiple candidate key events include at least two of the following: The first incident of a security policy violation; a second event having a contextual association relationship with the first event; a third event having a strong dependent association relationship with the first event; a fourth event having a time-dependent association relationship with the first event; A fifth event having an environment association relationship with the first event.

11. An electronic device, characterized in that: Including memory, transceiver, processor: Memory for storing computer programs; a transceiver, for transmitting and receiving data under the control of the processor; A processor is used to read the computer program in the memory and execute the event audit method in a cloud environment as described in any one of claims 1 to 5.

12. A processor-readable storage medium, characterized in that: The processor-readable storage medium stores a computer program, and the computer program is used to enable the processor to execute the event audit method in a cloud environment as described in any one of claims 1 to 5.

Images