Cloud platform threat diagnosis control method and device, equipment, storage medium and computer program product

Abstract

The invention discloses a cloud platform threat diagnosis control method and device, equipment, a storage medium and a computer program product, and relates to the technical field of network security. The cloud platform threat diagnosis control method comprises the following steps: acquiring terminal information including in-cloud firewall data and physical firewall data, and acquiring network information including in-cloud mirror image traffic and out-of-cloud mirror image traffic at the same time; performing threat comparison on the terminal information and the network information to obtain cloud platform risk vulnerability information; and generating a virtual patch according to the cloud platform risk vulnerability information, and performing vulnerability protection according to the virtual patch. Threat analysis and positioning are carried out by combining the discovery capabilities of the terminal and the network side for vulnerability information, closed-loop processing can be carried out on a host with a security threat condition by independently utilizing a virtual patch technology, and the reliability and flexibility of cloud platform threat discovery and blocking are improved.

Description

Technical Field

[0001] The present application relates to the field of network security technology, and in particular to a cloud platform threat diagnosis and control method, device, equipment, storage medium and computer program product. Background Art

[0002] Cloud platforms, also known as cloud computing platforms, can create a virtual shared resource pool and provide computing, data storage and network services through the Internet. Users can access resources on the cloud platform when needed. Cloud platforms use virtualization technology to create multiple virtual machines on a single server so that separate operating systems and applications can be run for different users on a single physical server. Therefore, information security for multiple users is also taken seriously to avoid the risk of leaks due to vulnerabilities.

[0003] In the existing technology, vulnerability detection of cloud platforms is generally performed from the network side. It is not possible to fully detect the vulnerabilities on the host, nor can it actively block them. It can only link the firewall to block IP addresses to protect against vulnerabilities. However, the vulnerability library that can be repaired is incomplete, and it is not possible to solve all vulnerability problems. Some vulnerabilities cannot be directly blocked.

[0004] The above contents are only used to assist in understanding the technical solution of the present application and do not constitute an admission that the above contents are prior art. Summary of the invention

[0005] The main purpose of this application is to provide a cloud platform threat diagnosis control method, device, equipment, storage medium and computer program product, aiming to solve the technical problem of imperfect cloud platform threat detection capabilities in the prior art.

[0006] To achieve the above objectives, the present application proposes a cloud platform threat diagnosis control method, the cloud platform threat diagnosis control method comprising:

[0007] Obtain terminal information including in-cloud firewall data and physical firewall data, and obtain network information including in-cloud mirror traffic and out-cloud mirror traffic;

[0008] Use the terminal information and the network information to perform threat comparison to obtain cloud platform risk vulnerability information;

[0009] A virtual patch is generated according to the cloud platform risk vulnerability information to perform vulnerability protection according to the virtual patch.

[0010] In one embodiment, the step of performing threat comparison using the terminal information and the network information to obtain cloud platform risk vulnerability information includes:

[0011] Obtaining the host address information of the terminal side vulnerability in the terminal information;

[0012] Using the network information to perform threat comparison and determine risk status information of the host address information;

[0013] The cloud platform risk vulnerability information is obtained according to the host address information and the risk status information.

[0014] In one embodiment, the step of using the network information to perform threat comparison and determine the risk status information of the host address information includes:

[0015] Building a threat analysis model based on the network information;

[0016] Using the threat analysis model to perform threat comparison on the network information included in the host address information;

[0017] The risk status information of the host address information is determined according to the comparison result.

[0018] In one embodiment, before the step of building a threat analysis model according to the network information, the method further includes:

[0019] Obtain software vulnerability judgment information of endpoint security software;

[0020] The step of building a threat analysis model based on the network information further includes:

[0021] A threat analysis model is constructed based on the network information and the software vulnerability judgment information.

[0022] In one embodiment, the step of generating a virtual patch according to the cloud platform risk vulnerability information to perform vulnerability protection according to the virtual patch includes:

[0023] Generate the virtual patch corresponding to the host address information according to the cloud platform risk vulnerability information;

[0024] Based on the firewall custom rules, the host with the terminal-side vulnerability is blocked according to the virtual patch.

[0025] In one embodiment, after the step of using the terminal information to perform threat comparison with the network information to obtain cloud platform risk vulnerability information, the step further includes:

[0026] Prompt information is generated according to the cloud platform risk vulnerability information, so as to issue a cloud platform vulnerability threat warning according to the prompt information.

[0027] In addition, to achieve the above-mentioned purpose, the present application also proposes a cloud platform threat diagnosis control device, the cloud platform threat diagnosis control device comprising:

[0028] An information acquisition module is used to acquire terminal information including in-cloud firewall data and physical firewall data, and network information including in-cloud mirror traffic and out-cloud mirror traffic;

[0029] A vulnerability diagnosis module, used to perform threat comparison using the terminal information and the network information to obtain cloud platform risk vulnerability information;

[0030] The protection processing module is used to generate a virtual patch according to the risk vulnerability information of the cloud platform, so as to perform vulnerability protection according to the virtual patch.

[0031] In addition, to achieve the above-mentioned purpose, the present application also proposes a cloud platform threat diagnosis control device, which includes: a memory, a processor, and a computer program stored in the memory and executable on the processor, and the computer program is configured to implement the steps of the cloud platform threat diagnosis control method as described above.

[0032] In addition, to achieve the above-mentioned purpose, the present application also proposes a storage medium, which is a computer-readable storage medium, and a computer program is stored on the storage medium. When the computer program is executed by the processor, the steps of the cloud platform threat diagnosis control method as described above are implemented.

[0033] In addition, to achieve the above-mentioned purpose, the present application also proposes a computer program product, which includes a computer program, and when the computer program is executed by a processor, it implements the steps of the cloud platform threat diagnosis control method as described above.

[0034] The present application provides a cloud platform threat diagnosis and control method. The present application first obtains terminal information including firewall data in the cloud and physical firewall data, and simultaneously obtains network information including mirrored traffic in the cloud and mirrored traffic outside the cloud; uses the terminal information and the network information to perform threat comparison to obtain cloud platform risk vulnerability information; generates a virtual patch based on the cloud platform risk vulnerability information to perform vulnerability protection based on the virtual patch. By combining the terminal and network side's ability to discover vulnerability information, threat analysis and positioning are performed, and virtual patch technology can be used to perform closed-loop processing on hosts that have security threats, thereby improving the reliability and flexibility of cloud platform threat discovery and blocking. BRIEF DESCRIPTION OF THE DRAWINGS

[0035] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present application and, together with the description, serve to explain the principles of the present application.

[0036] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, for ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative labor.

[0037] Figure 1 This is a flowchart of the first embodiment of the cloud platform threat diagnosis and control method of the present application;

[0038] Figure 2 This is a schematic diagram of the information flow in the first embodiment of the cloud platform threat diagnosis control method of this application;

[0039] Figure 3 A flowchart of the second embodiment of the cloud platform threat diagnosis and control method of the present application is provided;

[0040] Figure 4 This is a schematic diagram of the module structure of the cloud platform threat diagnosis control device according to an embodiment of the present application;

[0041] Figure 5 Schematic diagram of the cloud platform threat diagnosis control device structure of the hardware operating environment involved in the cloud platform threat diagnosis control method in the embodiment of the present application.

[0042] The purpose, features and advantages of this application will be further described in conjunction with the embodiments and with reference to the accompanying drawings. DETAILED DESCRIPTION

[0043] It should be understood that the specific embodiments described herein are only used to explain the technical solutions of the present application and are not used to limit the present application.

[0044] In order to better understand the technical solution of the present application, a detailed description will be given below in conjunction with the accompanying drawings and specific implementation methods.

[0045] The main solution of the embodiment of the present application is: obtaining terminal information including firewall data within the cloud and physical firewall data, and at the same time obtaining network information including mirrored traffic within the cloud and mirrored traffic outside the cloud; using the terminal information and the network information to perform threat comparison to obtain cloud platform risk vulnerability information; generating a virtual patch based on the cloud platform risk vulnerability information to perform vulnerability protection based on the virtual patch.

[0046] In the prior art, vulnerability detection of cloud platforms is generally performed from the network side, which cannot fully detect vulnerabilities on the host, nor can it actively block them. Instead, it can only link the firewall to block IP addresses to protect against vulnerabilities. However, the vulnerability library that can be repaired is incomplete, and all vulnerability problems cannot be solved. Some vulnerabilities cannot be directly blocked.

[0047] The present application provides a solution that combines the vulnerability information discovery capabilities of the terminal and the network side to conduct threat analysis and location, and can use virtual patch technology to perform closed-loop processing on hosts that have security threats, thereby improving the reliability and flexibility of threat discovery and blocking on the cloud platform.

[0048] It should be noted that the execution subject of this embodiment can be a computing service device with data processing, network communication and program running functions, such as a tablet computer, a personal computer, a mobile phone, etc., or a cloud platform threat diagnosis control device capable of realizing the above functions, etc. The following takes the cloud platform threat diagnosis control device as an example to illustrate this embodiment and the following embodiments.

[0049] Based on this, the embodiment of the present application provides a cloud platform threat diagnosis control method, referring to Figure 1 , Figure 1 This is a flow chart of the first embodiment of the cloud platform threat diagnosis and control method of the present application.

[0050] In this embodiment, the cloud platform threat diagnosis control method includes steps S10 to S30:

[0051] Step S10: obtaining terminal information including in-cloud firewall data and physical firewall data, and obtaining network information including in-cloud mirror traffic and out-cloud mirror traffic.

[0052] It should be noted that a cloud firewall can be a firewall product deployed in a cloud environment, used to monitor and control the data flow in and out of the virtual network of the cloud platform, and provide traffic control and security protection between the Internet and the virtual network. A physical firewall can be a firewall product deployed in a data center, which can filter, proxy, and check data packets, and is used to prevent unauthorized access and various network attacks, and provide traffic control and security protection between the Internet and the virtual network. Terminal information can include data information of the above-mentioned cloud firewall and physical firewall.

[0053] Furthermore, the in-cloud mirrored traffic can be the network traffic copied and transmitted between virtual machines in the cloud environment, which can be used for network security monitoring, performance analysis, and troubleshooting by capturing and analyzing traffic samples. The out-of-cloud mirrored traffic can be the network traffic in the cloud environment copied to a target outside the cloud, usually a physical device or the network traffic in the system of another cloud service provider, which is suitable for scenarios where it is necessary to monitor and analyze network traffic outside the cloud environment. The network information can be network traffic information including the in-cloud mirrored traffic and the out-of-cloud mirrored traffic mentioned above.

[0054] Reference Figure 2 , Figure 2This is a schematic diagram of the information flow in the first embodiment of the cloud platform threat diagnosis control method of the present application.

[0055] Step S20: Use the terminal information and the network information to perform threat comparison to obtain cloud platform risk vulnerability information.

[0056] It should be noted that network-side detection usually relies on traffic analysis and feature matching to identify potential security threats, and cannot cover all types of vulnerabilities, especially those that are not directly manifested through network traffic. At the same time, it is difficult to conduct in-depth analysis of encrypted traffic without decryption. This limits their effectiveness in detecting vulnerabilities in encrypted communications. By combining network information on the network side and terminal information on the terminal side, terminal information can be used to discover vulnerabilities, network information can be used to detect vulnerabilities, and comprehensive threat comparison can be performed to obtain cloud platform risk vulnerability information. Among them, the cloud platform risk vulnerability information can be vulnerability information with certain threats in the cloud platform. For different terminals connected to the cloud platform, the specific vulnerability threats may be different. Cloud platform risk vulnerability information can include all vulnerability threat status information of all terminals connected to the cloud platform.

[0057] Step S30: Generate a virtual patch according to the cloud platform risk vulnerability information to perform vulnerability protection according to the virtual patch.

[0058] It should be noted that the virtual patch can be a security policy patch that patches database vulnerabilities outside the database. Since the virtual patch is a temporary solution, it relies on a predefined vulnerability library to identify and prevent attacks. If the vulnerability library is incomplete or has different vulnerabilities for different terminals, it may not cover all security threats. This embodiment can generate different virtual patches for the vulnerability threat status of different terminals based on the cloud platform risk vulnerability information, integrate the threat of the discovered vulnerabilities, and perform closed-loop disposal on the host.

[0059] Furthermore, prompt information can be generated according to the cloud platform risk vulnerability information, so as to issue a cloud platform vulnerability threat warning through the cloud platform hardware structure (such as a buzzer and indicator light, etc.) according to the prompt information.

[0060] In this embodiment, terminal information including firewall data in the cloud and physical firewall data is obtained, and network information including mirrored traffic in the cloud and mirrored traffic outside the cloud is obtained at the same time; threat comparison is performed using the terminal information and the network information to obtain cloud platform risk vulnerability information; a virtual patch is generated based on the cloud platform risk vulnerability information to perform vulnerability protection based on the virtual patch. By combining the terminal and network side's ability to discover vulnerability information, threat analysis and positioning are performed, and virtual patch technology can be used to perform closed-loop processing on hosts that have security threats, thereby improving the reliability and flexibility of cloud platform threat discovery and blocking.

[0061] Based on the first embodiment of the present application, in the second embodiment of the present application, the same or similar contents as those in the above-mentioned embodiment 1 can be referred to the above introduction, and will not be repeated in the following. Figure 3 , Figure 3 A flowchart of the second embodiment of the cloud platform threat diagnosis control method of the present application is provided. In step S20, the cloud platform threat diagnosis control method includes:

[0062] Step S301: Acquire the host address information where the terminal-side vulnerability occurs in the terminal information.

[0063] It should be noted that the host address information may include the IP address where the terminal-side vulnerability occurs, and the vulnerability can be blocked and rules can be issued based on the IP address. The current status information of the terminal can be obtained based on the existing version and middleware information in the terminal information, and the built-in detection software can be used to determine whether a vulnerability threat occurs and determine the host address information.

[0064] Step S302: Use the network information to perform threat comparison to determine risk status information of the host address information.

[0065] It should be noted that the network information of the target IP address is extracted based on the determined host address information for threat comparison analysis to determine the risk status information of the host address information. The risk status information may include information on the risk threat level of the vulnerability. For vulnerabilities with low risk threat levels, real-time monitoring can be used to prevent the threat from increasing. For vulnerabilities that are already at a high risk threat level, corresponding virtual patches need to be used for vulnerability protection.

[0066] It should be understood that a threat analysis model can be constructed in advance based on the network information; the threat analysis model includes vulnerability risk threat levels corresponding to different network information conditions. The threat analysis model is then used to perform a threat comparison on the network information included in the host address information, and the risk status information of the host address information is determined based on the comparison result.

[0067] Furthermore, software vulnerability judgment information of the endpoint security software can also be obtained to build a threat analysis model based on the network information and the software vulnerability judgment information. The host vulnerability risk status can be judged by combining the power-off security software and the network information of the network side risk.

[0068] It should be noted that endpoint security software, namely Endpoint Detection and Response software, continuously collects data about processes, performance, configuration changes, etc. through agent tools installed on each endpoint device, and stores this data in a central database or cloud. Using machine learning algorithms, EDR can identify signs of known threats or suspicious activities in real time, and correlate with data from threat intelligence services to identify the latest network threat strategies and techniques.

[0069] Step S303: Obtain the cloud platform risk vulnerability information according to the host address information and the risk status information.

[0070] It should be noted that the cloud platform risk vulnerability information also includes host address information and risk status information, so that the virtual patch corresponding to the host address information is generated according to the cloud platform risk vulnerability information, and based on the firewall custom rules, the host with the terminal-side vulnerability is blocked according to the virtual patch. Automated policy adjustment is achieved, one policy for each machine, and no host resources and configuration are required.

[0071] It should be understood that the rules of the firewall are divided into inbound rules and outbound rules. Inbound rules are used to block certain network requests from external hosts to actively connect to the local machine, while outbound rules are used to block the local machine's active external connections. Custom rules can be used to set specific IP addresses, protocol ports, etc. to allow or block specific traffic. Virtual patches can be used to target high-risk vulnerabilities and emergency vulnerabilities, and custom rules can be used to provide patches at the network layer to intercept vulnerability attacks in real time, avoiding interruptions to business when repairing host vulnerabilities.

[0072] In this embodiment, the host address information of the terminal-side vulnerability is obtained from the terminal information; the network information is used to perform threat comparison to determine the risk status information of the host address information; and the cloud platform risk vulnerability information is obtained based on the host address information and the risk status information. The virtual patch corresponding to the host address information is generated according to the cloud platform risk vulnerability information; based on the firewall custom rules, the host with the terminal-side vulnerability is blocked according to the virtual patch. By combining the vulnerability information discovery capabilities of the terminal and the network side, threat analysis and positioning are performed, and the virtual patch technology can be used to perform closed-loop processing on the host with security threat conditions, thereby improving the reliability and flexibility of cloud platform threat discovery and blocking. Combine information inside and outside the cloud to achieve automatic policy adjustment, one policy for each machine, and no host resources and configuration are required.

[0073] This application also provides a cloud platform threat diagnosis control device, please refer to Figure 4 , the cloud platform threat diagnosis control device comprises:

[0074] The information acquisition module 10 is used to acquire terminal information including in-cloud firewall data and physical firewall data, and network information including in-cloud mirror traffic and out-cloud mirror traffic;

[0075] A vulnerability diagnosis module 20 is used to perform threat comparison using the terminal information and the network information to obtain cloud platform risk vulnerability information;

[0076] The protection processing module 30 is used to generate a virtual patch according to the cloud platform risk vulnerability information, so as to perform vulnerability protection according to the virtual patch.

[0077] Optionally, the vulnerability diagnosis module 20 is also used to obtain the host address information of the terminal-side vulnerability in the terminal information; use the network information to perform threat comparison to determine the risk status information of the host address information; and obtain the cloud platform risk vulnerability information based on the host address information and the risk status information.

[0078] Optionally, the vulnerability diagnosis module 20 is also used to build a threat analysis model based on the network information; use the threat analysis model to perform threat comparison on the network information contained in the host address information; and determine the risk status information of the host address information based on the comparison result.

[0079] Optionally, the vulnerability diagnosis module 20 is further used to obtain software vulnerability judgment information of the endpoint security software; and to construct a threat analysis model according to the network information and the software vulnerability judgment information.

[0080] Optionally, the protection processing module 30 is also used to generate the virtual patch corresponding to the host address information according to the cloud platform risk vulnerability information; based on the firewall custom rules, the host with the terminal-side vulnerability is blocked according to the virtual patch.

[0081] Optionally, the protection processing module 30 is further used to generate prompt information according to the cloud platform risk vulnerability information, so as to issue a cloud platform vulnerability threat alarm according to the prompt information.

[0082] The cloud platform threat diagnosis control device provided by the present application adopts the cloud platform threat diagnosis control method in the above embodiment, which can solve the technical problem of imperfect cloud platform threat detection capabilities. Compared with the prior art, the beneficial effects of the cloud platform threat diagnosis control device provided by the present application are the same as the beneficial effects of the cloud platform threat diagnosis control method provided by the above embodiment, and the other technical features in the cloud platform threat diagnosis control device are the same as the features disclosed in the above embodiment method, which will not be repeated here.

[0083] The present application provides a cloud platform threat diagnosis control device, which includes: at least one processor; and a memory that is communicatively connected to the at least one processor; wherein the memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute the cloud platform threat diagnosis control method in the above-mentioned embodiment one.

[0084] Reference below Figure 5 , which shows a schematic diagram of the structure of a cloud platform threat diagnosis control device suitable for implementing an embodiment of the present application. Figure 5 The cloud platform threat diagnosis and control device shown is merely an example and should not bring any limitation to the functions and scope of use of the embodiments of the present application.

[0085] like Figure 5As shown, the cloud platform threat diagnosis control device may include a processing device 1001 (such as a central processing unit, a graphics processing unit, etc.), which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM: Read Only Memory) 1002 or a program loaded from a storage device 1003 to a random access memory (RAM: Random Access Memory) 1004. In RAM1004, various programs and data required for the operation of the cloud platform threat diagnosis control device are also stored. The processing device 1001, ROM1002 and RAM1004 are connected to each other via a bus 1005. An input / output (I / O) interface 1006 is also connected to the bus. Typically, the following systems can be connected to the I / O interface 1006: input devices 1007 including, for example, a touch screen, a touchpad, a keyboard, a mouse, an image sensor, a microphone, an accelerometer, a gyroscope, etc.; output devices 1008 including, for example, a liquid crystal display (LCD), a speaker, a vibrator, etc.; storage devices 1003 including, for example, a magnetic tape, a hard disk, etc.; and communication devices 1009. The communication device 1009 can allow the cloud platform threat diagnosis control device to communicate wirelessly or wired with other devices to exchange data. Although the figure shows a cloud platform threat diagnosis control device with various systems, it should be understood that it is not required to implement or have all the systems shown. More or fewer systems may be implemented or have alternatively.

[0086] In particular, according to the embodiments disclosed in the present application, the process described above with reference to the flowchart can be implemented as a computer software program. For example, the embodiments disclosed in the present application include a computer program product, which includes a computer program carried on a computer-readable medium, and the computer program includes a program code for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from a network through a communication device, or installed from a storage device 1003, or installed from a ROM 1002. When the computer program is executed by the processing device 1001, the above-mentioned functions defined in the method of the embodiment disclosed in the present application are executed.

[0087] The cloud platform threat diagnosis control device provided by the present application adopts the cloud platform threat diagnosis control method in the above embodiment, which can solve the technical problem of imperfect cloud platform threat detection capabilities. Compared with the prior art, the beneficial effects of the cloud platform threat diagnosis control device provided by the present application are the same as the beneficial effects of the cloud platform threat diagnosis control method provided by the above embodiment, and the other technical features in the cloud platform threat diagnosis control device are the same as the features disclosed in the method of the previous embodiment, which will not be repeated here.

[0088] It should be understood that the various parts disclosed in this application can be implemented by hardware, software, firmware or a combination thereof. In the description of the above embodiments, specific features, structures, materials or characteristics can be combined in any one or more embodiments or examples in a suitable manner.

[0089] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any person skilled in the art who is familiar with the present technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

[0090] The present application provides a computer-readable storage medium having computer-readable program instructions (ie, computer programs) stored thereon, and the computer-readable program instructions are used to execute the cloud platform threat diagnosis control method in the above-mentioned embodiment.

[0091] The computer-readable storage medium provided in the present application may be, for example, a USB flash drive, but is not limited to electrical, magnetic, optical, electromagnetic, infrared, or semiconductor systems, systems or devices, or any combination of the above. More specific examples of computer-readable storage media may include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In this embodiment, the computer-readable storage medium may be any tangible medium containing or storing a program that can be used by or in combination with an instruction execution system, system or device. The program code contained on the computer-readable storage medium may be transmitted using any appropriate medium, including but not limited to: wires, optical cables, RF (Radio Frequency), etc., or any suitable combination of the above.

[0092] The above-mentioned computer-readable storage medium may be included in the cloud platform threat diagnosis control device; or it may exist independently without being assembled into the cloud platform threat diagnosis control device.

[0093] Computer program code for performing the operations of the present application may be written in one or more programming languages ​​or a combination thereof, including object-oriented programming languages ​​such as Java, Smalltalk, C++, and conventional procedural programming languages ​​such as "C" or similar programming languages. The program code may be executed entirely on the user's computer, partially on the user's computer, as a separate software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In the case of a remote computer, the remote computer may be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0094] The flow chart and block diagram in the accompanying drawings illustrate the possible architecture, function and operation of the system, method and computer program product according to various embodiments of the present application. In this regard, each square box in the flow chart or block diagram can represent a module, a program segment or a part of a code, and the module, the program segment or a part of the code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the square box can also occur in a sequence different from that marked in the accompanying drawings. For example, two square boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each square box in the block diagram and / or flow chart, and the combination of the square boxes in the block diagram and / or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0095] The modules involved in the embodiments described in this application may be implemented by software or hardware, wherein the name of the module does not constitute a limitation on the unit itself in some cases.

[0096] The readable storage medium provided in this application is a computer-readable storage medium, which stores computer-readable program instructions (i.e., computer programs) for executing the above-mentioned cloud platform threat diagnosis control method, and can solve the technical problem of imperfect cloud platform threat detection capabilities. Compared with the prior art, the beneficial effects of the computer-readable storage medium provided in this application are the same as the beneficial effects of the cloud platform threat diagnosis control method provided in the above-mentioned embodiment, and will not be repeated here.

[0097] The present application also provides a computer program product, including a computer program, which implements the steps of the cloud platform threat diagnosis and control method as described above when executed by a processor.

[0098] The computer program product provided by this application can solve the technical problem of imperfect threat detection capabilities of cloud platforms. Compared with the prior art, the beneficial effects of the computer program product provided by this application are the same as the beneficial effects of the cloud platform threat diagnosis control method provided by the above embodiment, which will not be repeated here.

[0099] The above descriptions are only some embodiments of the present application, and are not intended to limit the patent scope of the present application. All equivalent structural changes made using the contents of the present application specification and drawings under the technical concept of the present application, or direct / indirect applications in other related technical fields are included in the patent protection scope of the present application.

Claims

1. A cloud platform threat diagnosis and control method, characterized in that: The cloud platform threat diagnosis and control method includes: Obtain terminal information including in-cloud firewall data and physical firewall data, and obtain network information including in-cloud mirror traffic and out-cloud mirror traffic; Use the terminal information and the network information to perform threat comparison to obtain cloud platform risk vulnerability information; A virtual patch is generated according to the cloud platform risk vulnerability information to perform vulnerability protection according to the virtual patch.

2. The cloud platform threat diagnosis and control method according to claim 1, characterized in that: The step of using the terminal information and the network information to perform threat comparison to obtain cloud platform risk vulnerability information includes: Obtaining the host address information of the terminal side vulnerability in the terminal information; Using the network information to perform threat comparison and determine risk status information of the host address information; The cloud platform risk vulnerability information is obtained according to the host address information and the risk status information.

3. The cloud platform threat diagnosis and control method according to claim 2, characterized in that: The step of using the network information to perform threat comparison and determine the risk status information of the host address information includes: Building a threat analysis model based on the network information; Using the threat analysis model to perform threat comparison on the network information included in the host address information; The risk status information of the host address information is determined according to the comparison result.

4. The cloud platform threat diagnosis and control method according to claim 3, characterized in that: Before the step of building a threat analysis model according to the network information, the method further includes: Obtain software vulnerability judgment information of endpoint security software; The step of building a threat analysis model based on the network information further includes: A threat analysis model is constructed based on the network information and the software vulnerability judgment information.

5. The cloud platform threat diagnosis and control method according to claim 2, characterized in that: The step of generating a virtual patch according to the cloud platform risk vulnerability information to perform vulnerability protection according to the virtual patch includes: Generate the virtual patch corresponding to the host address information according to the cloud platform risk vulnerability information; Based on the firewall custom rules, the host with the terminal-side vulnerability is blocked according to the virtual patch.

6. The cloud platform threat diagnosis and control method according to claim 1, characterized in that: After the step of using the terminal information to perform threat comparison with the network information to obtain cloud platform risk vulnerability information, the method further includes: Prompt information is generated according to the cloud platform risk vulnerability information, so as to issue a cloud platform vulnerability threat warning according to the prompt information.

7. A cloud platform threat diagnosis and control device, characterized in that: The device comprises: An information acquisition module is used to acquire terminal information including in-cloud firewall data and physical firewall data, and network information including in-cloud mirror traffic and out-cloud mirror traffic; A vulnerability diagnosis module, used to perform threat comparison using the terminal information and the network information to obtain cloud platform risk vulnerability information; The protection processing module is used to generate a virtual patch according to the risk vulnerability information of the cloud platform, so as to perform vulnerability protection according to the virtual patch.

8. A cloud platform threat diagnosis and control device, characterized in that: The cloud platform threat diagnosis control device includes: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the computer program is configured to implement the steps of the cloud platform threat diagnosis control method as described in any one of claims 1 to 6.

9. A storage medium, characterized in that: The storage medium is a computer-readable storage medium, and a computer program is stored on the storage medium. When the computer program is executed by a processor, the steps of the cloud platform threat diagnosis and control method according to any one of claims 1 to 6 are implemented.

10. A computer program product, characterized in that The computer program product includes a computer program, and when the computer program is executed by a processor, the steps of the cloud platform threat diagnosis and control method as described in any one of claims 1 to 6 are implemented.

Images