Cloud computing data security processing system

Abstract

The invention discloses a cloud computing data security processing system, relates to the technical field of data security processing, and solves the technical problem that computing nodes are improperly processed due to the fact that the influence of attacks on other nodes is not considered in the prior art. According to the method, the node data and the historical attack data of each node in cloud computing are collected, and the historical attack data are divided according to the attack effect in the historical attack data, so that the successful attack data and the defense attack data are obtained; combining the attack type coefficient, the successful attack coefficient and the defense attack coefficient to respectively calculate an attack coefficient and a defense coefficient of the attack to the node; obtaining a node coefficient in combination with the attack coefficient and the defense coefficient, obtaining a node influence of the adjacent nodes according to the node data of the adjacent nodes, and comparing the node influence with the node coefficient of the adjacent nodes to obtain a defense state of the adjacent nodes; and controlling the connection state between the node and the adjacent node according to the defense state of the adjacent node, and performing security processing.

Description

Technical Field

[0001] The present invention belongs to the field of data security processing, and in particular to a cloud computing data security processing system. Background Art

[0002] Cloud computing is one of the main ways for enterprises and organizations to store, process and manage data. Cloud computing provides elasticity, scalability and cost-effectiveness, allowing enterprises to use computing resources more efficiently; however, cloud computing contains a large amount of data, and its data security has become a very important issue that needs to be taken seriously.

[0003] The invention patent with application number CN2022103903654 discloses a cloud computing data security processing system, which obtains data processing information to be calculated through a first acquisition unit, obtains cloud computing processing nodes according to the data processing information to be calculated, performs node operation feature analysis through the cloud computing processing nodes to obtain computing node features, performs risk assessment on the nodes according to the computing node features to determine computing node risk information, and obtains node security processing information based on the node risk information; when the invention performs risk assessment on the computing nodes, the computing nodes will be connected to each other. If a node is attacked, the impact of the attack may affect other nodes, thereby causing other nodes to be affected by the attack, and the node itself has a certain resistance ability. If the overall connection is disconnected to avoid affecting other nodes, it will also affect the normal operation of some nodes that can resist the attack.

[0004] The present invention provides a cloud computing data security processing system to solve the above technical problems. Summary of the invention

[0005] The present invention aims to solve at least one of the technical problems existing in the prior art; to this end, the present invention proposes a cloud computing data security processing system to solve the technical problem that the prior art does not take into account the impact of attacks on other nodes, resulting in improper processing of computing nodes.

[0006] To achieve the above-mentioned object, a first aspect of the present invention provides a cloud computing data security processing system, comprising: a data collection module, a security detection module and an exception processing module;

[0007] Data collection module: used to collect node data and historical attack data of each cloud computing node;

[0008] Security detection module: used to detect the node coefficient of each node based on historical attack data;

[0009] Exception handling module: used to obtain the defense status of adjacent nodes based on the node coefficient and node data of each node, and control the connection status between the node and the adjacent nodes according to the defense status.

[0010] Preferably, the detecting the node coefficient of each node according to the historical attack data includes:

[0011] Extracting historical attack data of each node; the historical attack data includes the attack type, attack intensity and attack effect suffered by each node in the historical records; the attack effect includes successful attack and defensive attack;

[0012] The historical attack data is divided into successful attack data and defensive attack data according to the attack effect; the attack coefficient and the defense coefficient are obtained according to the successful attack data and the defensive attack data, and the node coefficient is obtained by combining the attack coefficient and the defense coefficient of the node.

[0013] Preferably, obtaining the attack coefficient and the defense coefficient according to the successful attack data and the defense attack data includes:

[0014] Extract successful attack data and defense attack data;

[0015] Set different attack type coefficients for different attack types; assign weight coefficients to attack frequency and duration respectively, and obtain the attack intensity coefficient by weighted sum of attack frequency and duration; count the attack probability of successful attack and the defense probability of defensive attack in historical attack records, and use the attack probability as the successful attack coefficient and the defense probability as the defensive attack coefficient;

[0016] The product of the attack type coefficient, the success attack coefficient and the attack strength coefficient is used as the attack coefficient of the attack success node; the product of the attack type coefficient, the defense attack coefficient and the attack strength coefficient is used as the defense coefficient of the defense attack node.

[0017] Preferably, the setting of different attack type coefficients for different attack types includes:

[0018] Extract the attack frequency, attack duration, bandwidth consumption and packet rate caused by the attack from historical attack records;

[0019] By the formula GJF = ST PL +logSL×XD to calculate the attack type coefficient GJF; where ST represents the duration of the attack, PL represents the attack frequency, XD represents the bandwidth consumption caused by the attack, and SL represents the packet rate of the node after the attack.

[0020] Preferably, the node coefficient is obtained by combining the attack coefficient and the defense coefficient of the node, including:

[0021] Extract the attack coefficient and defense coefficient of each node;

[0022] Count the number of successful attacks and defense attacks of each node, and mark the average value of the attack coefficient as the standard success coefficient, and the average value of the defense coefficient as the standard defense coefficient;

[0023] The node coefficient JDXi of node number i is calculated by the formula JDXi = (GSi×BGJi+FSi×BFYi) / (GSi+FSi); wherein GSi represents the number of successful attacks on node number i, FSi represents the number of defensive attacks on node number i, BSJi represents the standard success coefficient of node number i, and BFYi represents the standard defense coefficient of node number i.

[0024] Preferably, the obtaining of the defense status of the adjacent nodes based on the node coefficient and node data of each node includes:

[0025] Extracting node coefficients and node data of each node; the node data includes node position and node sensitivity;

[0026] The node and the adjacent nodes are combined into a node group according to the node position. When the node is successfully attacked, the formula YXC = LXk MG ×GJik×α calculates the node influence YXC of the adjacent nodes in the node group; where MG represents the node sensitivity of the adjacent nodes, 2>MG>1; α is the balance coefficient, which is set according to the distance between the two nodes in the node group; 0<α<1;

[0027] Determine whether the node influence is greater than the node coefficient of the adjacent node j; if yes, mark the defense state of the adjacent node as a probabilistic attack state; if no, mark the defense state of the adjacent node as a complete defense state.

[0028] Preferably, controlling the connection status between the node and the adjacent node according to the defense status includes:

[0029] S1: Real-time monitoring of the node status of cloud computing nodes; the node status includes an attacked state and a normal state;

[0030] S2: Determine whether the node status of the cloud computing node is under attack; if yes, jump to S3; if no, continue monitoring;

[0031] S3: Determine whether the defense state of the adjacent node is a probabilistic attack state; if yes, cut off the connection between the adjacent node and the attacked node; if no, there is no need to cut off the connection and directly process the attacked node.

[0032] Compared with the prior art, the present invention has the following beneficial effects:

[0033] 1. The present invention collects node data and historical attack data of each node in cloud computing, divides the historical attack data according to the attack effects in the historical attack data, obtains successful attack data and defensive attack data, and respectively calculates the attack coefficient and defense coefficient of the attack on the node in combination with the preset attack type coefficient, successful attack coefficient and defensive attack coefficient, so as to accurately obtain the node state after the node is attacked by attacks of different types and strengths, and more accurately understand the node's resistance to attacks; the node coefficient is obtained by combining the attack coefficient and the defense coefficient, the node influence of the adjacent node is obtained according to the node data of the adjacent node, the node influence is compared with the node coefficient of the adjacent node, the defense state of the adjacent node is obtained, and the connection state between the node and the adjacent node is controlled according to the defense state of the adjacent node, which can effectively avoid the spread of malicious attacks, improve the control efficiency of attacks, and improve the overall security of the system.

[0034] 2. The present invention forms a node group with nodes and adjacent nodes, sets a balance coefficient according to the distance between the two nodes, calculates the node influence in combination with the node data of the adjacent nodes, and compares the node influence with the node coefficient to obtain the defense status of the adjacent nodes. It can effectively predict the resistance effect of the adjacent nodes to the impact of attacks, and effectively process the security system according to the defense status, which can effectively control the impact range of the attack and reduce the workload. BRIEF DESCRIPTION OF THE DRAWINGS

[0035] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0036] Figure 1 The following is a flowchart of an embodiment of the present invention.

[0037] Figure 2 It is a system composition diagram of the present invention.

[0038] Figure 3 The figure is a complete flow chart of controlling the connection status within a node group in one embodiment of the present invention. DETAILED DESCRIPTION

[0039] The technical solution of the present invention will be clearly and completely described below in conjunction with the embodiments. Obviously, the described embodiments are only part of the embodiments of the present invention, rather than all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0040] See also Figure 1-Figure 3 , the first aspect of the present invention provides a cloud computing data security processing system, including: a data collection module, a security detection module and an exception processing module;

[0041] Data collection module: used to collect node data and historical attack data of each cloud computing node.

[0042] Exemplarily, an automated script is used to automatically scan the node data of each cloud computing node, and the historical attack records that each node has suffered are extracted from the log management system; the node data of each cloud computing node and the historical attack records are stored together in a database.

[0043] Security detection module: used to detect the node coefficient of each node based on historical attack data.

[0044] Exemplarily, extract the historical attack data of node A. Node A suffered 3 attacks in total, of which 1 attack was successful and 2 were defensive attacks. The historical attack data of 1 successful attack is marked as successful attack data, and the historical attack data of 2 defensive attacks is marked as defensive attack data. In this embodiment, the attack frequency of successful attacks is 5 times per minute, the duration is 1 second each time, the bandwidth consumption is 80%, and the data packet rate is 500 packets per second. By the formula GJF=ST PL +logSL×XD to calculate the attack type coefficient GJF=7.16; in this embodiment, the weight coefficient assigned to the attack frequency is 0.4, and the weight coefficient assigned to the duration is 0.6. The attack intensity coefficient of the successful attack obtained by weighted summation is 2.6; the attack rate of the successful attack in the historical attack record is changed to 33%, and the defense probability of the defensive attack is 67%, then the successful attack coefficient is 0.33, and the defensive attack coefficient is 0.67; this embodiment includes distributed denial of service (DDoS) attacks, SQL injection attacks and cross-site scripting (XSS) attacks, the type number of the distributed denial of service attack is 1, the type number of the SQL injection attack is 2, and the type number of the cross-site script is 3, and the corresponding attack type coefficients are calculated respectively, the attack type coefficient of the distributed denial of service attack is 7.16, the attack type coefficient of the SQL injection attack is 5.43, and the attack type coefficient of the cross-site scripting attack is 4.27.

[0045] In this embodiment, the attack intensity coefficient of the distributed denial of service attack is 2.6, the attack intensity coefficient of the SQL injection attack is 2.2, and the attack intensity coefficient of the cross-site scripting attack is 1.8; the attack coefficient CGX11 of the distributed denial of service attack on the node numbered is calculated by the formula CGXik=GJik×CGJ×LXk, which is 6.14; the defense coefficient WGX12 of the SQL injection attack on the node attack is calculated by the formula WGXik=GJik×WGJ×Xk, which is 8.00, and the defense coefficient WGX13 of the cross-site scripting attack is 5.15.

[0046] In this embodiment, the number of successful attacks of node A is 1, the number of defensive attacks is 2, the standard success coefficient is 6.14, and the standard defense coefficient is 6.6; the node coefficient JDX1≈6.4 of node A is calculated by the formula JDXi=(GSi×BGJi+FSi×BFYi) / (GSi+FSi).

[0047] It should be noted that the node coefficient can, to a certain extent, represent the node's ability to resist attacks. When facing attacks of different types and intensities, the node has different defense capabilities. Differentiating and analyzing the attack data of successful attacks and the attack data of successful defenses, and setting the attack coefficient and defense coefficient separately, can better evaluate the node's defense capability.

[0048] Exception handling module: used to obtain the defense status of adjacent nodes based on the node coefficient and node data of each node, and control the connection status between the node and the adjacent nodes according to the defense status.

[0049] Exemplarily, connected nodes are combined into a node group according to the node positions. A node can have multiple node groups. When a node is attacked, the adjacent nodes in the node group are the objects to be affected first; when a node in a node group is successfully attacked, another node in the node group is marked as an adjacent node; in this embodiment, node A and node B form a node group, node A is successfully attacked by a distributed denial of service attack, and the node sensitivity of node B is 1.2. After the node is attacked, it will affect the adjacent nodes, and different nodes have different node sensitivities to attacks. A large node sensitivity indicates that the node has a large reaction to the attack, and a small node sensitivity indicates that the node has a small reaction to the attack; in this embodiment, the balance coefficient α is set to 0.2, and the balance coefficient is set according to the distance between the two nodes. The farther the distance, the smaller the impact.

[0050] By the formula YXC = LXk MG×GJik×α calculates the node influence YXC=4.9 of the adjacent node B in the node group; compares the node influence with the node coefficient. In this embodiment, the node coefficient of node B is 5.4. It is determined whether the node influence is greater than the node coefficient of the adjacent node. If the node influence is less than the node coefficient of the adjacent node, the defense status of the adjacent node is marked as a fully defended status, indicating that the adjacent node B can defend against the attack after node A is attacked.

[0051] In another embodiment, the node influence is smaller than the node coefficient of the adjacent node, and the defense state of the adjacent node is marked as a probabilistic attack state, indicating that the defense of the adjacent node may be affected by the impact of the attack on node A, and thus be attacked successfully. In this case, the connection between the adjacent node B and node A is cut off, data transmission is stopped, and node A is maintained.

[0052] There is a certain resistance within the node, and the impact of a node being attacked may affect other adjacent nodes. If the adjacent nodes can resist the impact of the attack, there is no need to process the connection between the nodes, which reduces the workload of the staff and improves work efficiency.

[0053] Part of the data in the above formula is calculated by removing the dimension and taking its numerical value. The formula is a formula closest to the actual situation obtained by software simulation of a large amount of collected data; the preset parameters and preset thresholds in the formula are set by technical personnel in this field according to actual conditions or obtained through simulation of a large amount of data.

[0054] Working principle of the present invention:

[0055] The present invention collects node data and historical attack data of each cloud computing node, divides the historical attack data into successful attack data and defensive attack data according to the attack effects in the historical attack data; calculates the attack coefficient and the defense coefficient according to the successful attack data and the defensive attack data, and obtains the node coefficient by combining the attack coefficient and the defense coefficient; combines the node and the adjacent node into a node group, calculates the node impact of the adjacent node under the node attack, obtains the defense state of the adjacent node according to the comparison result of the node impact and the adjacent node coefficient, controls the connection state between the node and the adjacent node based on the defense state, and processes the attack.

[0056] The above embodiments are only used to illustrate the technical method of the present invention rather than to limit it. Although the present invention has been described in detail with reference to the preferred embodiments, those skilled in the art should understand that the technical method of the present invention may be modified or replaced by equivalents without departing from the spirit and scope of the technical method of the present invention.

Claims

1. A cloud computing data security processing system, characterized in that: include: Data collection module, security detection module and exception handling module; Data collection module: used to collect node data and historical attack data of each cloud computing node; Security detection module: used to detect the node coefficient of each node based on historical attack data; Exception handling module: used to obtain the defense status of adjacent nodes based on the node coefficient and node data of each node, and control the connection status between the node and the adjacent nodes according to the defense status.

2. A cloud computing data security processing system according to claim 1, characterized in that: The node coefficient of each node is detected according to the historical attack data, including: Extracting historical attack data of each node; the historical attack data includes the attack type, attack intensity and attack effect suffered by each node in the historical records; the attack effect includes successful attack and defensive attack; The historical attack data is divided into successful attack data and defensive attack data according to the attack effect; the attack coefficient and the defense coefficient are obtained according to the successful attack data and the defensive attack data, and the node coefficient is obtained by combining the attack coefficient and the defense coefficient of the node.

3. A cloud computing data security processing system according to claim 2, characterized in that: The attack coefficient and the defense coefficient are obtained according to the successful attack data and the defense attack data, including: Extract successful attack data and defense attack data; Set different attack type coefficients for different attack types; assign weight coefficients to attack frequency and duration respectively, and obtain the attack intensity coefficient by weighted sum of attack frequency and duration; count the attack probability of successful attack and the defense probability of defensive attack in historical attack records, and use the attack probability as the successful attack coefficient and the defense probability as the defensive attack coefficient; The product of the attack type coefficient, the success attack coefficient and the attack strength coefficient is used as the attack coefficient of the attack success node; the product of the attack type coefficient, the defense attack coefficient and the attack strength coefficient is used as the defense coefficient of the defense attack node.

4. A cloud computing data security processing system according to claim 3, characterized in that: The method of setting different attack type coefficients for different attack types includes: Extract the attack frequency, attack duration, bandwidth consumption and packet rate caused by the attack from historical attack records; By the formula GJF = ST PL +logSL×XD to calculate the attack type coefficient GJF; where ST represents the duration of the attack, PL represents the attack frequency, XD represents the bandwidth consumption caused by the attack, and SL represents the packet rate of the node after the attack.

5. A cloud computing data security processing system according to claim 2, characterized in that: The node coefficient is obtained by combining the attack coefficient and the defense coefficient of the node, including: Extract the attack coefficient and defense coefficient of each node; Count the number of successful attacks and defense attacks of each node, and mark the average value of the attack coefficient as the standard success coefficient, and the average value of the defense coefficient as the standard defense coefficient; The node coefficient JDXi of node number i is calculated by the formula JDXi = (GSi×BGJi+FSi×BFYi) / (GSi+FSi); wherein GSi represents the number of successful attacks on node number i, FSi represents the number of defensive attacks on node number i, BSJi represents the standard success coefficient of node number i, and BFYi represents the standard defense coefficient of node number i.

6. A cloud computing data security processing system according to claim 1, characterized in that: The method of obtaining the defense status of adjacent nodes based on the node coefficient and node data of each node includes: Extracting node coefficients and node data of each node; the node data includes node position and node sensitivity; The node and the adjacent nodes are combined into a node group according to the node position. When the node is successfully attacked, the formula YXC = LXk MG ×GJik×α calculates the node influence YXC of the adjacent nodes in the node group; where MG represents the node sensitivity of the adjacent nodes, 2>MG>1; α is the balance coefficient, which is set according to the distance between the two nodes in the node group; 0<α<1; Determine whether the node influence is greater than the node coefficient of the adjacent node; if yes, mark the defense state of the adjacent node as a probabilistic attack state; if no, mark the defense state of the adjacent node as a complete defense state.

7. A cloud computing data security processing system according to claim 1, characterized in that: The controlling the connection state between the node and the adjacent node according to the defense state includes: S1: Real-time monitoring of the node status of cloud computing nodes; the node status includes an attacked state and a normal state; S2: Determine whether the node status of the cloud computing node is under attack; if yes, jump to S3; if no, continue monitoring; S3: Determine whether the defense state of the adjacent node is a probabilistic attack state; if yes, cut off the connection between the adjacent node and the attacked node; if no, there is no need to cut off the connection and directly process the attacked node.

Images