Private attribute security management method and system for cloud assets, and storage medium

Abstract

The invention provides a security management method and system for the proprietary attribute of cloud assets and a storage medium, and the method comprises the steps: detecting a cloud asset host surviving in a target IP segment, and capturing the cloud asset feature data of the cloud asset host; detecting and verifying the captured cloud asset feature data by using a pre-constructed cloud asset special attribute feature library; wherein the cloud asset proprietary attribute feature library comprises cloud asset feature data used for detection and verification; and performing risk matching on the cloud asset feature data passing the detection verification in a network security vulnerability library, and outputting the cloud asset host corresponding to the cloud asset feature data passing the risk matching. According to the method, the cloud asset characteristic data of the captured cloud asset host under the target IP segment can be detected and verified by using the pre-constructed cloud asset proprietary attribute characteristic library.

Description

Technical Field

[0001] The present invention relates to the technical field of cloud asset proprietary attribute identification, and in particular to a cloud asset proprietary attribute security management method, system and storage medium. Background Art

[0002] With the rapid development of cloud computing, cloud service providers are faced with massive cloud asset management and configuration issues. Cloud assets include virtual machines, storage, networks, databases and other resources. The configuration and scheduling of these resources have a crucial impact on the performance and efficiency of cloud services.

[0003] However, existing cloud asset management methods usually only focus on the quantity and status of resources, while ignoring the proprietary attributes of resources. The proprietary attributes of cloud assets include but are not limited to information such as vendors, models, versions, security certifications, ports, services, and risks. These proprietary attributes are of great significance for optimal resource configuration, security management, and performance improvement.

[0004] However, how to effectively aggregate and manage the proprietary attributes of cloud assets and to securely manage the proprietary attributes of cloud assets is a problem that needs to be solved urgently. Summary of the invention

[0005] In view of this, embodiments of the present invention provide a method, system and storage medium for secure management of proprietary attributes of cloud assets to eliminate or improve one or more defects existing in the prior art.

[0006] One aspect of the present invention provides a method for securely managing the proprietary attributes of cloud assets, the method comprising the following steps: detecting cloud asset hosts surviving under a target IP segment, and capturing cloud asset feature data of the cloud asset hosts; using a pre-built cloud asset proprietary attribute feature library to detect and verify the captured cloud asset feature data; wherein the cloud asset proprietary attribute feature library contains cloud asset feature data for detection and verification; performing risk matching on the cloud asset feature data that has passed the detection and verification in a network security vulnerability library, and outputting the cloud asset hosts corresponding to the cloud asset feature data that has passed the risk matching.

[0007] In some embodiments of the present invention, the method also includes the step of pre-building a cloud asset-specific attribute feature library, which step includes: dividing the information contained in the cloud asset feature data into different categories; pre-setting keywords for detection and verification in cloud asset feature data of different categories, thereby building a cloud asset-specific attribute feature library; wherein the keywords are used to identify the cloud asset feature data.

[0008] In some embodiments of the present invention, the method further includes: for cloud asset feature data that fails detection and verification, generating a failure report that includes a category of the cloud asset feature data and a matched keyword.

[0009] In some embodiments of the present invention, the cloud asset feature data includes proprietary cloud attribute fingerprint information, the categories of the proprietary cloud attribute fingerprint information include network server type, application server type, operating system type, network application firewall information, IP information, domain name information, port information, content distribution network information, front-end technology information, development language and vulnerability information, and the cloud assets include one or more of virtual machines, storage, networks, web pages and databases.

[0010] In some embodiments of the present invention, the steps of capturing the cloud asset feature data of the cloud asset host and using a pre-built cloud asset-specific attribute feature library to detect and verify the captured cloud asset feature data include: capturing static files contained in the cloud asset host and reading their md5 checksums, comparing and matching the read md5 checksums with the md5 checksums of special files contained in the cloud asset-specific attribute feature library, and judging whether the detection and verification is passed based on the comparison and matching; or when the type of the cloud asset host is network, capturing the header information returned by the response of the cloud asset host, comparing the captured header information with the md5 checksum of the cloud asset host, and determining whether the detection and verification is passed based on the comparison and matching; or when the type of the cloud asset host is network, capturing the header information returned by the response of the cloud asset host, comparing the captured header information with the md5 checksum of the cloud asset host, and determining whether the detection and verification is passed based on the comparison and matching; The cloud asset characteristic data can be detected and verified by matching the header information keywords contained in the asset-specific attribute feature library; or the uniform resource locator of the web page can be read, and the keyword of the web page address specified by the uniform resource locator can be captured, and the keywords can be matched with the keywords contained in the cloud asset-specific attribute feature library to realize the detection and verification of the cloud asset characteristic data; or the development language of the cloud asset host can be read, and the keywords can be captured by network scanning or web crawling, and the captured keywords can be matched with the keywords contained in the cloud asset-specific attribute feature library to realize the detection and verification of the cloud asset characteristic data.

[0011] In some embodiments of the present invention, the network security vulnerability library includes multiple types of preset security vulnerability problem features, security configuration problem features, weak password problem features, unnecessary open account problem features, unnecessary open service problem features and unnecessary open port problem features.

[0012] In some embodiments of the present invention, for the cloud asset host corresponding to the cloud asset characteristic data that has not passed the risk matching, the method also includes: generating risk information including multiple items of security vulnerability issues, security configuration issues, weak passwords, unnecessarily open accounts, unnecessarily open services, and unnecessarily open ports, and outputting the cloud asset characteristic data and the risk information.

[0013] Corresponding to the above method, the present invention also provides a proprietary attribute management system for cloud assets, including a processor, a memory, and a computer program / instructions stored in the memory, wherein the processor is used to execute the computer program / instructions, and when the computer program / instructions are executed, the system implements the steps of the method described in any one of the above embodiments.

[0014] Corresponding to the above method, the present invention also provides a computer-readable storage medium on which a computer program / instruction is stored. When the computer program / instruction is executed by a processor, the steps of the method described in any one of the above embodiments are implemented.

[0015] Corresponding to the above method, the present invention also provides a computer program product, including a computer program / instruction, which implements the steps of the method described in any one of the above embodiments when executed by a processor.

[0016] The cloud asset proprietary attribute security management method proposed in the present invention can use a pre-built cloud asset proprietary attribute feature library to detect and verify the cloud asset feature data of the cloud asset host under the captured target IP segment, use a network security vulnerability library to perform security risk matching, and output the results of detection verification and security risk matching, thereby realizing the security management of the proprietary attributes of cloud assets.

[0017] Additional advantages, purposes, and features of the present invention will be described in part in the following description, and will become apparent to those skilled in the art after studying the following, or may be learned from the practice of the present invention. The purposes and other advantages of the present invention may be achieved and obtained by the structures specifically indicated in the specification and the accompanying drawings.

[0018] Those skilled in the art will appreciate that the objectives and advantages that can be achieved with the present invention are not limited to the above specific description, and the above and other objectives that can be achieved by the present invention will be more clearly understood from the following detailed description. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] The drawings described herein are used to provide a further understanding of the present invention, constitute a part of the present application, and do not constitute a limitation of the present invention. In the drawings:

[0020] Figure 1 The figure is a flow chart of a method for securely managing proprietary attributes of cloud assets in one embodiment of the present invention.

[0021] Figure 2 The present invention summarizes the detection and verification methods of cloud asset feature data in one embodiment of the present invention.

[0022] Figure 3 The figure is a schematic diagram of the structure of a proprietary attribute management system for cloud assets in one embodiment of the present invention. DETAILED DESCRIPTION

[0023] In order to make the purpose, technical solution and advantages of the present invention more clearly understood, the present invention is further described in detail below in conjunction with the embodiments and the accompanying drawings. Here, the illustrative embodiments of the present invention and their descriptions are used to explain the present invention, but are not intended to limit the present invention.

[0024] It should also be noted that, in order to avoid obscuring the present invention due to unnecessary details, only structures and / or processing steps closely related to the solutions according to the present invention are shown in the accompanying drawings, while other details that are not closely related to the present invention are omitted.

[0025] It should be emphasized that the term “include / comprises” when used herein refers to the presence of features, elements, steps or components, but does not exclude the presence or addition of one or more other features, elements, steps or components.

[0026] It should also be noted that, unless otherwise specified, the term “connection” herein may refer not only to a direct connection but also to an indirect connection involving an intermediate.

[0027] Hereinafter, embodiments of the present invention will be described with reference to the accompanying drawings. In the accompanying drawings, the same reference numerals represent the same or similar components, or the same or similar steps.

[0028] In order to overcome the problems existing in the prior art, the present invention aims to propose a cloud asset proprietary attribute management method and system. Cloud asset detection scanning, detecting surviving cloud asset hosts under the target IP segment, and feature data matching the fingerprint information in the cloud asset proprietary attribute feature library, and detecting and verifying the detected cloud asset feature data.

[0029] Figure 1 The following is a flow chart of a method for securely managing cloud asset properties in one embodiment of the present invention. The method includes the following steps:

[0030] Step S110: Detect cloud asset hosts that survive under the target IP segment, and capture cloud asset feature data of the cloud asset hosts.

[0031] In the specific implementation process, the execution subject of the method can be a cloud platform or a cloud server in a cloud computing environment.

[0032] Step S120: using a pre-built cloud asset-specific attribute feature library to detect and verify the captured cloud asset feature data; wherein the cloud asset-specific attribute feature library contains cloud asset feature data for detection and verification.

[0033] Step S130: Risk matching is performed on the cloud asset feature data that has passed the detection and verification in the network security vulnerability library, and the cloud asset host corresponding to the cloud asset feature data that has passed the risk matching is output.

[0034] The cloud asset proprietary attribute security management method proposed in the present invention can use a pre-built cloud asset proprietary attribute feature library to detect and verify the cloud asset feature data of the cloud asset host under the captured target IP segment, use a network security vulnerability library to perform security risk matching, and output the results of detection verification and security risk matching, thereby realizing the security management of the proprietary attributes of cloud assets.

[0035] In some embodiments of the present invention, the method further includes the step of pre-building a cloud asset-specific attribute feature library, which includes: (1) dividing the information contained in the cloud asset feature data into different categories; (2) pre-setting keywords for detection and verification in different categories of cloud asset feature data, thereby building a cloud asset-specific attribute feature library; wherein the keywords are used to identify the cloud asset feature data.

[0036] By adopting the embodiment of the invention, cloud asset characteristic data can be divided in detail, so as to construct a cloud asset-specific attribute characteristic library, and the cloud asset characteristic data can be detected and verified through the constructed cloud asset-specific attribute characteristic library.

[0037] In some embodiments of the present invention, the method further includes: for cloud asset feature data that fails detection and verification, generating a failure report that includes the category of the cloud asset feature data and the matched keywords.

[0038] During the specific implementation process, for those that fail the detection and verification, a cloud asset feature data detection and verification failure report can be generated, including the type and unmatched keywords.

[0039] By adopting the embodiment of the invention, the characteristic data of cloud assets that have not passed the detection and verification can be summarized in detail, so that users can clearly understand the problem.

[0040] In some embodiments of the present invention, cloud asset feature data includes proprietary cloud attribute fingerprint information, the categories of which include network server type, application server type, operating system type, network application firewall information, IP information, domain name information, port information, content distribution network information, front-end technology information, development language and vulnerability information, and the cloud assets include one or more of virtual machines, storage, networks, web pages and databases.

[0041] Figure 2The following is a summary of the detection and verification methods of cloud asset feature data in an embodiment of the present invention. In some embodiments of the present invention, the steps of capturing the cloud asset feature data of the cloud asset host and using the pre-built cloud asset-specific attribute feature library to detect and verify the captured cloud asset feature data include any of the following:

[0042] (1) Capture the static files contained in the cloud asset host and read their md5 checksums, compare and match the read md5 checksums with the md5 checksums of special files contained in the cloud asset-specific attribute feature library, and determine whether the detection and verification has passed based on the comparison and match.

[0043] In the specific implementation process, the detection and verification is carried out by verifying whether the match contains the md5 checksum value of the special file. The crawler is used to crawl the specific image files, JS files, css and other static files of the entered target website and compare the md5 checksum value. This method is relatively fast and has a relatively low false alarm rate, but it does not rule out that some secondary developed cms will modify these files.

[0044] Among them, JS file, full name JavaScript file, is a text file containing JavaScript code. Message Digest Algorithm 5 (MD5 for short) is a widely used encryption algorithm. The algorithm is essentially a hash function that can map data of any length to a fixed-length hash value. This process is one-way and theoretically cannot be reversed. CSS (Cascading Style Sheets) is a computer language used to add styles (fonts, spacing, colors, etc.) to structured documents (such as HTML documents or XML applications). Content management system (CMS for short) refers to a set of systems used to manage workflows in a cooperative mode. In the computer or network field, the content management system has the functions of centralized storage of related content, as well as group management, version control and other functions. In the process of web penetration, web fingerprinting is a relatively important step in the information collection process. It is crucial to use some open source tools, platforms or manual detection to determine whether the CMS system is a public CMS program or secondary development. Obtaining accurate information such as CMS type, Web service component type and version can help security engineers quickly and effectively verify known vulnerabilities.

[0045] (2) When the type of the cloud asset host is network, the header information returned by the response of the cloud asset host is captured, and the captured header information is matched with the header information keywords contained in the cloud asset proprietary attribute feature library to realize the detection and verification of the cloud asset feature data.

[0046] In the specific implementation process, detection and verification are performed through keyword matching of request header information. Keyword matching is performed through the header information returned by the target website's response (response) to obtain its response header information. According to relevant rules, characteristic character information is matched to quickly identify fingerprint information. The specific implementation process includes but is not limited to: ① Identify by viewing the x-powered-by field of the http response header, where the x-powered-by field is part of the HTTP response header and is used to indicate the technology or framework that generates the corresponding information; ② Judge through cookies, for example, some waf will contain some information in the return header, such as 360wzws, safedog, yunsuo, etc.; ③ Judge through the server information in the header, such as dvrdvs-webs, yunjiasu-nginx, mod_security, nginx-wallarm, etc.; ④ Judge through www-authenticate, some routing and switching devices may have this field, such as netcore, huawei, h3c and other devices.

[0047] (3) Read the uniform resource locator of the web page, crawl the web page address specified by the uniform resource locator with keywords, and match them with the keywords contained in the cloud asset proprietary attribute feature library to realize the detection and verification of cloud asset feature data.

[0048] In the specific implementation process, based on the Uniform Resource Locator (URL) keyword recognition, key features of URLs such as wp-includes and dede are verified. The asset fingerprint data recognition rule library is used to detect whether the corresponding directory is included, or the link URL is analyzed according to the crawler results, or the directory in the robots.txt file is detected, and the URL address is used to determine whether a certain cms is used. For example, WordPress has wp-includes and wp-admin directories by default.

[0049] (4) Read the development language of the cloud asset host, capture keywords by network scanning or web crawling, match the captured keywords with the keywords contained in the cloud asset proprietary attribute feature library, and realize the detection and verification of cloud asset feature data.

[0050] In the specific implementation process, the common web development languages ​​are php, jsp, aspx, asp, etc. Common identification methods include but are not limited to: ① Direct judgment method by crawling to obtain dynamic links. The asp judgment rule is as follows: <;a[^>;]*? href=('|")[^http][^>;]*?\.asp(\?|\#|\1), other languages ​​can replace the corresponding asp. ② Identify through x-powered-by, common ones are x-powered-by:asp.net or x-powered-by:php / 7.1.8. ③ Identify through set-cookie. This identification method is common and quick. For example: set-cookie contains phpssionid, which means it is php, contains jsessionid, which means it is java, contains asp.net_sessionid, which means it is aspx, etc.

[0051] Furthermore, in some embodiments of the present invention, the detection and verification step may also include detection using network scanning technology or web crawler technology. The detection and verification of the cloud asset feature data obtained by detection specifically includes but is not limited to: ① Determine the application name and version information of the target cloud asset host by receiving the sent tcp protocol packet response content and banner information, and by signature comparison; ② Determine the operating system type of the target cloud asset host by comparing the received and sent tcp / udp / icmp response data packet content with the operating system rule library; ③ Obtain the service information of the cloud asset host, enabled services, device type, domain name, web service response header and complete response body information by parsing the detection response information.

[0052] By adopting the embodiment of the invention, cloud asset-specific attribute characteristics can be captured for different types of cloud asset hosts, thereby quickly realizing detection and verification of cloud asset-specific attributes.

[0053] In some embodiments of the present invention, the network security vulnerability library includes multiple preset security vulnerability problem features, security configuration problem features, weak password problem features, unnecessary open account problem features, unnecessary open service problem features and unnecessary open port problem features.

[0054] Correspondingly, for the cloud asset host corresponding to the cloud asset characteristic data that fails to pass the risk matching, the method also includes: generating risk information including multiple items of security vulnerability issues, security configuration issues, weak passwords, unnecessarily open accounts, unnecessarily open services, and unnecessarily open ports, and outputting the cloud asset characteristic data and the risk information.

[0055] By adopting the embodiment of the invention, different types of security risk loopholes can be detected.

[0056] In another embodiment of the present invention, the method can also be implemented according to the following steps:

[0057] (1) Build a cloud asset-specific attribute feature library.

[0058] In the specific implementation process, the cloud asset proprietary attribute feature library is used to store cloud asset feature data, for example, the cloud asset feature data includes proprietary cloud attribute fingerprint information. The proprietary cloud attribute fingerprint information includes one or more of web server type, application server type, operating system type, Web Application Firewall (WAF) information, IP and domain name information, port information, content delivery network (CDN) information, front-end technology information, development language and vulnerability information.

[0059] Among them, WAF information, namely Web Application Firewall, is a network security device specially used to protect Web applications. CDN information: CDN (Content Delivery Network), namely content delivery network, is a distributed network system used to accelerate the delivery of website content. CDN information, namely CDN (Content Delivery Network), namely content delivery network, is a distributed network system used to accelerate the delivery of website content.

[0060] (2) Cloud asset detection scanning obtains and verifies the feature data of surviving cloud assets in the target IP segment, outputs the verified feature data of cloud assets, and regards the cloud assets involved as unknown cloud assets of the user.

[0061] In the specific implementation process, the cloud asset host surviving under the target IP segment is detected, the cloud asset feature data of the cloud asset host is captured, and the fingerprint information in the cloud asset-specific attribute feature library is tested and verified.

[0062] (3) Security risk matching: Verified cloud asset feature data is matched with the network security vulnerability database, and existing risk information is output to help security managers detect security issues in a timely manner and make timely repairs.

[0063] During the specific implementation process, the cloud asset feature data that has passed the detection and verification will be matched with the network security vulnerability library, and the risk information obtained from the match will be formed into a risk report for alarm. The risk information includes: security vulnerability issues, security configuration issues, weak passwords, and non-essentially open accounts, services, and ports. The cloud asset feature data that has passed the detection and verification and the risk information will be output.

[0064] By adopting the above-mentioned invention embodiment, accurate identification and security management of cloud asset's proprietary attributes can be achieved, including detection and verification of keyword matching and risk identification of security vulnerability matching. The method and system have high flexibility and scalability, and can adapt to cloud environments of different sizes and types.

[0065] Corresponding to the above method, the present invention also provides a proprietary attribute management system for cloud assets, the system comprising a computer device, the computer device comprising a processor and a memory, the memory storing computer instructions, the processor being used to execute the computer instructions stored in the memory, and when the computer instructions are executed by the processor, the system implements the steps of the method described above.

[0066] The cloud asset proprietary attribute security management method proposed in the present invention can use a pre-built cloud asset proprietary attribute feature library to detect and verify the cloud asset feature data of the cloud asset host under the captured target IP segment, use a network security vulnerability library to perform security risk matching, and output the results of detection verification and security risk matching, thereby realizing the security management of the proprietary attributes of cloud assets.

[0067] The key points and advantages of the present invention are: (1) using a pre-built cloud asset-specific attribute feature library to detect and verify the cloud asset feature data of the cloud asset host under the captured target IP segment; (2) using a network security vulnerability library to perform security risk matching, and outputting the cloud asset host corresponding to the cloud asset feature data that passes the risk matching; (3) dividing the cloud asset feature data into categories, and presetting keywords for keyword matching.

[0068] Figure 3 FIG. 1 is a schematic diagram of a proprietary attribute management system for cloud assets in an embodiment of the present invention. Figure 3 The proprietary attribute management system of cloud assets includes a computer device, and the computer device 00 includes: a processor 01, a memory 02, and a computer program stored in the memory 02 and executable on the processor 01. When the processor 01 executes the computer program, the human factors data server access control method provided in the above method embodiment is implemented.

[0069] Among them, the processor 01 is connected to the memory 02, such as through a bus 03. The processor 01 can be a CPU (Central Processing Unit), a general-purpose processor, a DSP (Digital Signal Processor), an ASIC (Application Specific Integrated Circuit), an FPGA (Field Programmable Gate Array) or other programmable logic devices, transistor logic devices, hardware components or any combination thereof. It can implement or execute various exemplary logic blocks, modules and circuits described in combination with the contents disclosed in this application. The processor 01 can also be a combination that implements computing functions, such as a combination of one or more microprocessors, a combination of DSP and microprocessors, etc. The bus 03 may include a path to transmit information between the above components. The bus 03 may be a PCI (Peripheral Component Interconnect) bus or an EISA (Extended Industry Standard Architecture) bus, etc. The bus 130 can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Figure 3 Only one thick line is used in the figure, but it does not mean that there is only one bus or one type of bus. The memory 02 is used to store a computer program corresponding to the human factor data server access control method of the above embodiment of the present application, and the computer program is controlled and executed by the processor 01. The processor 01 is used to execute the computer program stored in the memory 02 to implement the content shown in the above method embodiment.

[0070] Corresponding to the above method, the present invention also provides a computer-readable storage medium, on which a computer program / instruction is stored, and when the computer program / instruction is executed by a processor, the steps of the method described in any one of the above embodiments are implemented. The computer-readable storage medium can be a tangible storage medium, such as a random access memory (RAM), a memory, a read-only memory (ROM), an electrically programmable ROM, an electrically erasable programmable ROM, a register, a floppy disk, a hard disk, a removable storage disk, a CD-ROM, or any other form of storage medium known in the technical field.

[0071] Corresponding to the above method, the present invention also provides a computer program product, including a computer program / instruction, which implements the steps of the method described in any one of the above embodiments when executed by a processor.

[0072] It should be understood by those skilled in the art that the exemplary components, systems and methods described in conjunction with the embodiments disclosed herein can be implemented in hardware, software or a combination of the two. Whether it is performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of the present invention. When implemented in hardware, it can be, for example, an electronic circuit, an application specific integrated circuit (ASIC), appropriate firmware, a plug-in, a function card, etc. When implemented in software, the elements of the present invention are programs or code segments used to perform the required tasks. The program or code segment can be stored in a machine-readable medium, or transmitted on a transmission medium or a communication link via a data signal carried in a carrier.

[0073] It should be clear that the present invention is not limited to the specific configuration and processing described above and shown in the figures. For the sake of simplicity, a detailed description of the known method is omitted here. In the above embodiments, several specific steps are described and shown as examples. However, the method process of the present invention is not limited to the specific steps described and shown, and those skilled in the art can make various changes, modifications and additions, or change the order between the steps after understanding the spirit of the present invention.

[0074] In the present invention, features described and / or illustrated for one embodiment may be used in the same or similar manner in one or more other embodiments, and / or combined with features of other embodiments or replace features of other embodiments.

[0075] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. For those skilled in the art, the embodiments of the present invention may have various modifications and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention shall be included in the protection scope of the present invention.

Claims

1. A method for managing proprietary attributes of cloud assets, characterized in that: The method comprises the following steps: Detect cloud asset hosts that survive under the target IP segment and capture cloud asset feature data of the cloud asset hosts; Using a pre-built cloud asset-specific attribute feature library, the captured cloud asset feature data is tested and verified; wherein the cloud asset-specific attribute feature library contains the cloud asset feature data used for testing and verification; The cloud asset feature data that has passed the detection and verification is risk matched in the network security vulnerability library, and the cloud asset hosts corresponding to the cloud asset feature data that has passed the risk matching are output.

2. The method according to claim 1, characterized in that The method further comprises the step of pre-building a cloud asset-specific attribute feature library, the step comprising: Classify the information contained in the cloud asset feature data into different categories; Keywords for detection and verification are preset in different categories of cloud asset feature data, so as to construct a cloud asset-specific attribute feature library; wherein the keywords are used to identify the cloud asset feature data.

3. The method according to claim 2, characterized in that The method further comprises: For cloud asset feature data that fails detection and verification, a failure report is generated that includes the category of the cloud asset feature data and the matched keywords.

4. The method according to claim 2, characterized in that: The cloud asset feature data includes proprietary cloud attribute fingerprint information, the categories of which include network server type, application server type, operating system type, network application firewall information, IP information, domain name information, port information, content distribution network information, front-end technology information, development language and vulnerability information. The cloud assets include one or more of virtual machines, storage, networks, web pages and databases.

5. The method according to claim 4, characterized in that The step of capturing the cloud asset feature data of the cloud asset host and using a pre-built cloud asset-specific attribute feature library to detect and verify the captured cloud asset feature data includes: Capture static files contained in the cloud asset host and read their md5 checksums, compare and match the read md5 checksums with the md5 checksums of special files contained in the cloud asset proprietary attribute feature library, and determine whether the detection and verification has passed based on the comparison and match; or When the type of the cloud asset host is network, the header information returned by the cloud asset host's response is captured, and the captured header information is matched with the header information keywords contained in the cloud asset-specific attribute feature library to implement detection and verification of the cloud asset feature data; or Read the uniform resource locator of the web page, crawl the web page address specified by the uniform resource locator with keywords, and match them with the keywords contained in the cloud asset proprietary attribute feature library to realize the detection and verification of cloud asset feature data; or Read the development language of the cloud asset host, use network scanning or web crawling to capture keywords, match the captured keywords with the keywords contained in the cloud asset proprietary attribute feature library, and realize the detection and verification of cloud asset feature data.

6. The method according to claim 1, characterized in that The network security vulnerability library includes multiple preset security vulnerability problem features, security configuration problem features, weak password problem features, unnecessary open account problem features, unnecessary open service problem features and unnecessary open port problem features.

7. The method according to claim 6, characterized in that For cloud asset hosts corresponding to cloud asset feature data that fail to pass risk matching, the method also includes: generating risk information including multiple items of security vulnerability issues, security configuration issues, weak passwords, unnecessarily open accounts, unnecessarily open services, and unnecessarily open ports, and outputting the cloud asset feature data and the risk information.

8. A proprietary attribute management system for cloud assets, comprising a processor, a memory, and a computer program / instructions stored in the memory, characterized in that: The processor is used to execute the computer program / instructions, and when the computer program / instructions are executed, the system implements the steps of the method according to any one of claims 1 to 7.

9. A computer-readable storage medium having a computer program / instruction stored thereon, characterized in that: When the computer program / instructions are executed by a processor, the steps of the method as claimed in any one of claims 1 to 7 are implemented.

10. A computer program product comprising a computer program / instructions, characterized in that When the computer program / instructions are executed by a processor, the steps of the method according to any one of claims 1 to 7 are implemented.

Images