Virtual machine protection method, cloud security platform, cloud service system, equipment and medium

Abstract

The invention provides a virtual machine protection method, a cloud security platform, a cloud service system, equipment and a medium, and relates to the technical field of cloud, the method is applied to the cloud security platform in the cloud service system, the cloud service system further comprises a virtual machine platform and a threat detection processing platform, virtual machine assets are arranged in the virtual machine platform, and the threat detection processing platform is arranged in the cloud security platform. The method comprises the following steps: judging whether virtual machine assets meet a triggering condition of a preset workflow or not; the preset workflows are obtained by performing flow arrangement on various virtual machine control operations provided by a virtual machine platform and / or various threat detection processing operations provided by a threat detection processing platform, and the cloud security platform is provided with various preset workflows; if the virtual machine assets meet the trigger condition of the preset workflow, calling a virtual machine management and control operation and / or a threat detection processing operation according to a preset workflow sequence to perform virtual machine protection processing on the virtual machine assets; according to the invention, multiple platforms can be linked to realize comprehensive protection of virtual machine assets, so that the security of the virtual machine assets can be improved.

Description

Technical Field

[0001] The present application relates to the field of cloud technology, and in particular to a virtual machine protection method, a cloud security platform, a cloud service system, equipment and medium. Background Art

[0002] With the continuous development of cloud technology, more and more users choose to deploy business services in the cloud. In order to ensure that virtual machine assets such as virtualized servers and virtualized storage set up in the cloud are protected from attacks, relevant technologies can generally set up virtual machine protection functions in the virtual machine platform that manages these virtual machine assets, and at the same time, a threat detection and processing platform can be introduced to detect and deal with possible threat risks in virtual machine assets. However, the security protection functions provided by each platform are relatively scattered, and the docking between platforms is difficult, which is not conducive to platform linkage protection of virtual machine assets. Summary of the invention

[0003] The purpose of this application is to provide a virtual machine protection method, cloud security platform, cloud service system, equipment and medium, which can link multiple platforms to achieve comprehensive protection of virtual machine assets, thereby improving the security of virtual machine assets.

[0004] In order to solve the above technical problems, the present application provides a virtual machine protection method, which is applied to a cloud security platform in a cloud service system. The cloud service system further includes a virtual machine platform and a threat detection and processing platform. The virtual machine platform is provided with virtual machine assets. The method includes:

[0005] Determine whether the virtual machine asset meets the triggering condition of a preset workflow; the preset workflow is obtained by orchestrating a plurality of virtual machine management and control operations provided by the virtual machine platform and / or a plurality of threat detection and processing operations provided by the threat detection and processing platform, and the cloud security platform is provided with a plurality of preset workflows;

[0006] If the virtual machine asset meets the triggering condition of the preset workflow, the virtual machine management and control operation and / or the threat detection and processing operation are called according to the preset workflow sequence to perform virtual machine protection processing on the virtual machine asset.

[0007] Optionally, after calling the virtual machine management and control operation and / or the threat detection and processing operation according to the preset workflow sequence to perform virtual machine protection processing on the virtual machine asset, the method further includes:

[0008] Acquire risk information identified from the virtual machine assets during the virtual machine protection process, and classify the risk information according to the risk information type;

[0009] Aggregate each type of risk information to obtain warning information, and output the warning information to a visualization interface;

[0010] The amount of each type of risk information is counted to obtain statistical information, and the statistical information is output to the visualization interface.

[0011] Optionally, a mutual trust relationship is established between the cloud security platform, the virtual machine platform and the threat detection and processing platform, and both the cloud security platform and the threat detection and processing platform are deployed on the virtual machine platform in the form of virtual machines.

[0012] Optionally, calling the virtual machine management and control operation and / or the threat detection and processing operation according to the preset workflow sequence to perform virtual machine protection processing on the virtual machine asset includes:

[0013] Generate tasks corresponding to each operation in the preset workflow by using the asset information of the virtual machine assets and the operation information of each operation in the preset workflow;

[0014] According to the operation process sequence specified by the preset workflow and the execution results of each task, each task is orderly sent to the operation interface corresponding to the operation type of each task for processing; the operation interface includes a variety of virtual machine management and control operation interfaces provided by the virtual machine platform and a variety of threat detection and processing operation interfaces provided by the threat detection and processing platform, and the execution results are obtained through the operation interface.

[0015] Optionally, it also includes:

[0016] The task information and execution result of the task are updated to the database, and the task information and execution result of the task are output to the visualization interface.

[0017] Optionally, the preset workflow is a security protection configuration workflow, and the tasks corresponding to the security protection configuration workflow include agent installation tasks, threat detection tasks, real-time data protection tasks, and periodic data protection tasks;

[0018] The step of sending each task in order to an operation interface corresponding to the operation type of each task for processing according to the operation process sequence specified by the preset workflow and the execution result of each task includes:

[0019] Sending the agent program installation task to the agent program installation interface of the threat detection processing platform so that the threat detection processing platform performs the agent program installation operation on the virtual machine asset;

[0020] Obtaining the execution result of the agent program installation task through the agent program installation interface, and when determining that the execution result of the agent program installation task is successful, sending the threat detection task to the threat detection interface of the threat detection processing platform, so that the threat detection processing platform performs a threat detection operation on the virtual machine asset through the agent program in the virtual machine asset;

[0021] The execution result of the threat detection task is obtained through the threat detection interface, and when it is determined that the execution result of the threat detection task is that a threat risk is detected, the immediate data protection task is sent to the data protection interface of the virtual machine platform, so that the virtual machine platform immediately performs a data backup operation on the virtual machine assets, or when it is determined that the execution result of the threat detection task is that no threat risk is detected, the periodic data protection task is sent to the data protection interface of the virtual machine platform, so that the virtual machine platform periodically performs a data backup operation on the virtual machine assets.

[0022] Optionally, the determining whether the virtual machine asset meets a trigger condition of a preset workflow includes:

[0023] Collecting asset information of the virtual machine assets from the virtual machine platform, and using a global configuration table to determine whether the asset information is newly added virtual machine asset information; the global configuration table contains asset information of the added virtual machine assets;

[0024] If not, it is determined that the virtual machine asset meets the triggering condition of the security protection configuration workflow.

[0025] The present application also provides a cloud security platform, which is arranged in a cloud service system, and the cloud service system further includes a virtual machine platform and a threat detection and processing platform, and the cloud security platform has established a mutual trust relationship with both the virtual machine platform and the threat detection and processing platform, and the virtual machine platform is provided with virtual machine assets, and the cloud security platform includes:

[0026] A trigger judgment module is used to judge whether the virtual machine assets meet the trigger conditions of a preset workflow; the preset workflow is obtained by arranging the processes of various virtual machine management and control operations provided by the virtual machine platform and / or various threat detection and processing operations provided by the threat detection and processing platform, and the cloud security platform is provided with a variety of preset workflows;

[0027] The scheduling module is used to call the virtual machine management and control operation and / or the threat detection and processing operation according to the preset workflow sequence to perform virtual machine protection processing on the virtual machine asset if the virtual machine asset meets the triggering condition of the preset workflow.

[0028] The present application also provides a cloud service system, including: a cloud security platform, a virtual machine platform, and a threat detection and processing platform, wherein the virtual machine platform is provided with virtual machine assets;

[0029] The virtual machine platform is used to provide a variety of virtual machine management and control operations for the cloud security platform;

[0030] The threat detection and processing platform is used to provide a variety of threat detection and processing operations for the cloud security platform;

[0031] The cloud security platform is used to execute the virtual machine protection method as described above.

[0032] The present application also provides an electronic device, comprising:

[0033] Memory for storing computer programs;

[0034] A processor is used to implement the virtual machine protection method as described above when executing the computer program.

[0035] The present application also provides a computer-readable storage medium, in which computer-executable instructions are stored. When the computer-executable instructions are loaded and executed by a processor, the virtual machine protection method as described above is implemented.

[0036] The present application provides a virtual machine protection method, which is applied to a cloud security platform in a cloud service system, wherein the cloud service system further includes a virtual machine platform and a threat detection and processing platform, wherein the virtual machine platform is provided with virtual machine assets, and the method includes: determining whether the virtual machine assets meet the triggering conditions of a preset workflow; the preset workflow is obtained by orchestrating a plurality of virtual machine management and control operations provided by the virtual machine platform and / or a plurality of threat detection and processing operations provided by the threat detection and processing platform, wherein the cloud security platform is provided with a plurality of preset workflows; if the virtual machine assets meet the triggering conditions of the preset workflows, then calling the virtual machine management and control operations and / or the threat detection and processing operations in sequence according to the preset workflows to perform virtual machine protection processing on the virtual machine assets.

[0037] It can be seen that the present application can firstly add a cloud security platform to a cloud service system that already includes a virtual machine platform and a threat detection and processing platform. In addition, a variety of preset workflows can be set in the cloud security platform. These preset workflows can be obtained by orchestrating the various virtual machine control operations provided by the virtual machine platform, or by orchestrating the various threat detection and processing operations provided by the threat detection and processing platform, or by orchestrating the above-mentioned various virtual machine control operations and various threat detection and processing operations at the same time, that is, the various operations provided by the virtual machine platform and the threat detection and processing platform can be integrated and linked based on the preset workflow. Furthermore, the cloud security platform can determine whether the virtual machine assets in the virtual machine platform meet the triggering conditions of the preset workflow. If so, it can sequentially call the virtual machine control operations and threat detection and processing operations covered by the preset workflow to perform virtual machine protection processing on the virtual machine assets, thereby realizing the linkage protection of virtual machine assets, and thus improving the security of virtual machine assets. The present application also provides a cloud security platform, a cloud service system, an electronic device and a computer-readable storage medium, which have the above-mentioned beneficial effects. BRIEF DESCRIPTION OF THE DRAWINGS

[0038] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on the provided drawings without paying any creative work.

[0039] Figure 1 A structural block diagram of a cloud service system provided in an embodiment of the present application;

[0040] Figure 2 A structural block diagram of another cloud service system provided in an embodiment of the present application;

[0041] Figure 3 A flowchart of a virtual machine protection method provided in an embodiment of the present application;

[0042] Figure 4 A schematic diagram of a cloud security platform provided in an embodiment of the present application;

[0043] Figure 5 A schematic diagram of a security protection configuration workflow provided in an embodiment of the present application;

[0044] Figure 6 A structural block diagram of a cloud security platform provided in an embodiment of the present application;

[0045] Figure 7 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application;

[0046] Figure 8 A schematic diagram of the specific structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0047] In order to make the purpose, technical solution and advantages of the embodiments of the present application clearer, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0048] With the continuous development of cloud technology, more and more users choose to deploy business services in the cloud. In order to ensure that virtual machine assets such as virtualized servers and virtualized storage set up in the cloud are protected from attacks, the relevant technology can generally set up virtual machine protection functions in the virtual machine platform that manages these virtual machine assets, and at the same time, a threat detection and processing platform can be introduced to detect and deal with possible threat risks in virtual machine assets. However, the security protection functions provided by each platform are relatively scattered, and the docking between the platforms is difficult, which is not conducive to the joint protection of virtual machine assets. In view of this, the present application can provide a virtual machine protection method, which can be set up to dock with the cloud security platform and the virtual machine platform and the threat detection and processing platform, and can use the workflow to arrange the virtual machine management operations provided by the virtual machine platform and the threat detection and processing operations provided by the threat detection and processing platform. The virtual machine resources in the virtual machine platform can be automatically protected according to the workflow, so that multiple platforms can be linked to achieve comprehensive protection of virtual machine assets and improve the security of virtual machine assets.

[0049] For ease of understanding, the following will first introduce the system environment to which this application applies. Figure 1 , Figure 1This is a structural block diagram of a cloud service system provided by an embodiment of the present application. The system includes a virtual machine platform 20, a threat detection and processing platform 30, and a cloud security platform 10, wherein a virtual machine asset 21 is provided in the virtual machine platform 20. The virtual machine platform 20 is used to manage and control the virtual machine asset 21, and can provide a variety of virtual machine management and control operations for managing and controlling virtual machine assets, such as virtual machine query operations, virtual machine asset backup operations (such as asset storage snapshot creation operations, asset snapshot policy setting operations), and distributed firewall configuration operations. The threat detection and processing platform 30 is used to access the virtual machine asset 21 (such as access through an agent program), perform threat detection and processing on the virtual machine asset 21, and can provide a variety of threat detection and processing operations required for accessing the virtual machine asset 21 and performing threat detection and processing on the virtual machine asset 21, such as agent program installation operations, virus scanning operations, virus disposal operations, security event reporting operations, vulnerability scanning operations, vulnerability disposal operations, vulnerability event reporting operations, etc. The cloud security platform 10 is a newly added platform in the embodiment of the present application. It has established access relationships with the virtual machine platform 20 and the threat detection and processing platform 30, and can call various virtual machine control operations provided by the virtual machine platform 20 and various threat detection and processing operations provided by the threat detection and processing platform 30; at the same time, a variety of preset workflows can be set in the cloud security platform 10. These preset workflows can be obtained by process orchestration of the various virtual machine control operations provided by the virtual machine platform 20, and can also be obtained by process orchestration of the various threat detection and processing operations provided by the threat detection and processing platform 30, and can also be obtained by process orchestration of the above-mentioned various virtual machine control operations and the above-mentioned various threat detection and processing operations. Furthermore, by using these preset workflows, the cloud security platform 10 can grasp the asset information and risk information of each virtual machine asset 21 in the virtual machine platform 20, and can link the operations provided by the virtual machine platform 20 and the threat detection and processing platform 30 to perform virtual machine protection processing on the virtual machine asset 21, thereby improving the security of the virtual machine asset 21. Among them, the asset information is the device information of the virtual machine asset 21 itself, such as device identification, device configuration, communication information, etc.; the risk information is identified from the virtual machine asset 21 during the process of performing virtual machine protection processing on the virtual machine asset 21, and can be actively reported by the virtual machine platform 20 and the threat detection and processing platform 30, or can be further analyzed by the cloud security platform 10 based on the information reported by the virtual machine platform 20 and the threat detection and processing platform 30.

[0050] It should be noted that the embodiments of the present application do not limit the deployment relationship among the cloud security platform 10, the virtual machine platform 20 and the threat detection and processing platform 30. The three platforms can be deployed separately or together. Figure 2This is a structural block diagram of another cloud service system provided by an embodiment of the present application, wherein the cloud security platform 10 and the threat detection and processing platform 30 can be deployed in the form of virtual machines on the virtual machine platform 20. In addition, in order to facilitate the invocation of the operations provided by the virtual machine platform 20 and the threat detection and processing platform 30, the cloud security platform 10 can also establish a mutual trust relationship with both the virtual machine platform 10 and the threat detection and processing platform 30. The embodiment of the present application does not limit the mutual trust mechanism based on which the mutual trust relationship is established, for example, it can be an AK / SK mutual trust mechanism (Access Key / Secret Key, access key / security key). The embodiment of the present invention also does not limit the specific virtual machine platform 20 and the specific threat detection and processing platform 30, for example, the virtual machine platform 20 can be an HCI hyper-convergence platform (Hyper convergence Infrastructure, hyper-convergence platform), and the threat detection and processing platform 30 can be an EDR terminal management platform (Endpoint Detection and Response, endpoint detection and response). The embodiment of the present application also does not limit the number and type of virtual machine assets 21, and the virtual machine assets 21 can specifically be virtual machine devices such as virtualized servers, virtualized storage, virtualized networks, and virtualized security.

[0051] Based on the above system structure description, the virtual machine protection method provided by this application will be described in detail below. Please refer to Figure 3 , Figure 3 A flowchart of a virtual machine protection method provided in an embodiment of the present application, the method is applied to a cloud security platform in a cloud service system, the cloud service system further includes a virtual machine platform and a threat detection and processing platform, the virtual machine platform is provided with virtual machine assets, the method may include:

[0052] S301, determine whether the virtual machine assets meet the triggering conditions of the preset workflow; if the virtual machine assets meet the triggering conditions of the preset workflow, go to step S302; if the virtual machine assets do not meet the triggering conditions of the preset workflow, go to step S301; the preset workflow is obtained by orchestrating the various virtual machine management operations provided by the virtual machine platform and / or the various threat detection and processing operations provided by the threat detection and processing platform. The cloud security platform is set with multiple preset workflows.

[0053] In order to realize the linkage of multi-platform operations to provide comprehensive security protection for virtual machine assets, the cloud security platform in the embodiment of the present application can be connected to the virtual machine platform and the threat detection and processing platform, and can call a variety of virtual machine control operations provided by the virtual machine platform and a variety of threat detection and processing operations provided by the threat detection and processing platform, so that the above operations can be called to control the asset information and risk information of the virtual machine assets. More importantly, the cloud security platform can process the above-mentioned multiple virtual machine control operations and multiple threat detection and processing operations to obtain multiple preset workflows, and can set corresponding trigger conditions for each preset workflow. Furthermore, the platform only needs to determine whether the virtual machine assets meet the trigger conditions of a preset workflow, and when it is determined that they meet, it automatically calls the virtual machine control operations provided by the virtual machine platform and the threat detection and processing operations provided by the threat detection and processing platform according to the preset workflow to protect the virtual machine assets. It can improve the comprehensiveness of the protection of virtual machine assets, and at the same time, it can also improve the convenience of managers to protect virtual machine assets. It should be noted that the embodiment of the present invention does not limit the specific arrangement form of the preset workflow, and can be set according to actual application requirements.

[0054] Furthermore, each preset workflow is provided with a corresponding trigger condition, which can be either an automatic trigger condition or a manual trigger condition. For the automatic trigger condition, it can be: periodic execution, execution when it is determined that the asset information of the virtual machine asset meets a specific condition, execution when it is determined that the risk information of the virtual machine asset meets a specific condition, etc. For the manual trigger condition, the cloud security platform can determine that the virtual machine asset meets the trigger condition of the preset workflow when it is determined that the user triggers a preset workflow for a virtual machine asset. The embodiment of the present application does not limit the specific trigger condition, and it can be set according to the actual application requirements.

[0055] S302: If the virtual machine asset meets the triggering condition of the preset workflow, the virtual machine management and control operation and / or the threat detection and processing operation are called according to the preset workflow sequence to perform virtual machine protection processing on the virtual machine asset.

[0056] It should be emphasized here that calling refers to the process in which the cloud security platform sends a call request to the virtual machine platform or the threat detection processing platform so that the virtual machine platform or the threat detection processing platform executes the operation corresponding to the call request. In other words, the virtual machine control operation is actually executed by the virtual machine platform, the threat detection processing operation is actually executed by the threat detection processing platform, and the cloud security platform mainly plays the role of scheduling the operation sequence. When it is determined that the virtual machine asset meets the triggering conditions of the preset workflow, the cloud security platform can call the virtual machine control operation and / or the threat detection processing operation according to the preset workflow sequence to perform virtual machine protection processing on the virtual machine asset. Among them, the preset workflow includes any one or more of the above-mentioned multiple virtual machine control operations and multiple threat detection processing operations, and the preset workflow includes an operation process sequence, which records the execution order and operation jump conditions of each operation covered by the preset workflow. For example, a possible preset workflow may include an agent installation operation and a threat detection operation, and the operation process sequence in the preset workflow may be: first perform the agent installation operation, then perform the threat detection operation, and the threat detection operation can only be executed under the condition that the agent installation operation is successfully executed. Therefore, the cloud security platform needs to call operations in order according to the operation process sequence in the preset workflow and the execution result of each operation in the preset workflow. It is understandable that the execution result of the operation can be fed back to the cloud security platform by the virtual machine platform or the threat detection and processing platform.

[0057] Further, the embodiments of the present application do not limit the calling method of these virtual machine management and control operations and threat detection and processing operations, which depends on how the virtual machine platform and the threat detection and processing platform provide these operations to the outside. In one possible case, both the virtual machine platform and the threat detection and processing platform can provide an operation interface (Open API, open API interface, Application Programming Interface) corresponding to each operation to the outside, wherein the operation interface provided by the virtual machine platform can be called a virtual machine management and control operation interface, and the operation interface provided by the threat detection and processing platform can be called a threat detection and processing operation interface. In this way, the cloud security platform can call various operations by calling the above-mentioned various virtual machine management and control operation interfaces and various threat detection and processing operation interfaces. Further, in order to perform the above operations on specific virtual machine assets, the cloud security platform can use the asset information of the virtual machine assets and the operation information of each operation in the preset workflow to generate tasks corresponding to each operation in the preset workflow, and send each task in order to the operation interface corresponding to the operation type of each task for processing according to the operation process sequence specified by the preset workflow and the execution results of each task. It can be understood that the execution results of each task can be fed back to the cloud security platform by the virtual machine platform or the threat detection and processing platform through the operation interface.

[0058] Based on this, calling the virtual machine management and control operation and / or the threat detection and processing operation according to the preset workflow sequence to perform virtual machine protection processing on the virtual machine assets may include:

[0059] Step 11: Generate tasks corresponding to each operation in the preset workflow using the asset information of the virtual machine assets and the operation information of each operation in the preset workflow;

[0060] Step 12: According to the operation process sequence specified by the preset workflow and the execution results of each task, each task is sent in order to the operation interface corresponding to the operation type of each task for processing; the operation interface includes a variety of virtual machine management and control operation interfaces provided by the virtual machine platform and a variety of threat detection and processing operation interfaces provided by the threat detection and processing platform, and the execution results are obtained through the operation interface.

[0061] It should be noted that the embodiments of the present application do not limit the content that can be included in the task information of each task, such as the asset information of the virtual machine assets, and the parameters required to perform the operation, etc., which can be set according to the actual application requirements. The embodiments of the present application do not limit the specific task delivery method, such as synchronous delivery, asynchronous delivery, etc., which can be set according to the actual application requirements. It is worth noting that the cloud security platform can provide functions such as asynchronous task framework, asynchronous callback, task set, etc., to facilitate the flexible delivery of tasks.

[0062] Furthermore, in order to achieve effective management and control of task information and execution results, and to facilitate users to understand the execution status of each task in a timely manner, a database can be set up in the cloud security platform to save the task information and execution results of each task. At the same time, these task information and execution results can be output to a visual interface for users to view.

[0063] Based on this, the method may further include:

[0064] Step 21: Update the task information and execution results of the task to the database, and output the task information and execution results of the task to the visualization interface.

[0065] It should be noted that the embodiment of the present application does not limit the output display format of the task information and execution results in the visual interface, which can be set according to actual application requirements.

[0066] In addition, in order to facilitate users to understand the risk status of each virtual machine asset in a timely manner, the cloud security platform can also obtain risk information identified from virtual machine assets during the virtual machine protection process, and can output this risk information to the visualization interface for users to view. It should be noted that the embodiment of the present application does not limit the output form of risk information, and can be set according to actual application requirements. For example, each risk information can be classified according to the type of risk information, each type of risk information can be aggregated to obtain alarm information, and the alarm information can be output to the visualization interface so that users can batch process the same type of alarm information; for another example, the number of each type of risk information can be counted to obtain statistical information, and the statistical information can be output to the visualization interface so that users can view the risk changes of virtual machine assets.

[0067] Based on this, after the virtual machine management and control operation and / or the threat detection and processing operation are called according to the preset workflow sequence to perform virtual machine protection processing on the virtual machine assets, the following may also be included:

[0068] Step 31: Obtain risk information identified from virtual machine assets during the virtual machine protection process, and classify the risk information according to the risk information type;

[0069] Step 32: Aggregate each type of risk information to obtain warning information, and output the warning information to a visualization interface;

[0070] Step 33: Count the amount of each type of risk information to obtain statistical information, and output the statistical information to the visualization interface.

[0071] It should be noted that the embodiments of the present application do not limit specific risk information, for example, it may include emergency security incident handling information (such as ransomware), general security incident handling, hot vulnerability handling (such as high-risk vulnerability repair), general vulnerability handling, configuration or update of built-in protection workflows for new assets, and incomplete configuration of existing asset protection workflows (prompts for virtual machine assets with poor protection effects), etc. In addition, areas can be divided in the visual interface to output alarm information and statistical information respectively. For example, a security risk handling panel and a security risk statistical analysis panel can be set in the visual interface, where the security risk handling panel is used to output various risk information by category and risk level, and the security risk statistical analysis panel displays the statistical results and trend data obtained by statistically analyzing data of multiple types of security risks (such as viruses, vulnerabilities, and network attacks) from various dimensions, so that you can pay better attention to assets at risk and focus on processing.

[0072] Based on the above embodiments, the present application can first add a cloud security platform to a cloud service system that already includes a virtual machine platform and a threat detection and processing platform. In addition, a variety of preset workflows can be set in the cloud security platform. These preset workflows can be obtained by orchestrating the various virtual machine control operations provided by the virtual machine platform, or by orchestrating the various threat detection and processing operations provided by the threat detection and processing platform, or by orchestrating the aforementioned various virtual machine control operations and various threat detection and processing operations at the same time, that is, the various operations provided by the virtual machine platform and the threat detection and processing platform can be integrated and linked based on the preset workflow. Furthermore, the cloud security platform can determine whether the virtual machine assets in the virtual machine platform meet the triggering conditions of the preset workflow. If so, the virtual machine control operations and threat detection and processing operations covered by the preset workflow can be sequentially called to perform virtual machine protection processing on the virtual machine assets, thereby realizing linkage protection of virtual machine assets, and thus improving the security of virtual machine assets.

[0073] Based on the above embodiments, the structure of the cloud security platform is introduced based on a specific schematic diagram. Figure 4 , Figure 4 A schematic diagram of a cloud security platform provided by an embodiment of the present application. The core modules of the platform are a workflow generation center, a task scheduling, a data classification aggregation module, and an alarm module, wherein the workflow generation center is used to dynamically generate tasks based on the asset information of the virtual machine assets and the preset workflow that has been triggered, and send the tasks to the task scheduling module for distribution. The task scheduling module is used to distribute the tasks to the operation interface of the corresponding platform for processing, and monitor the execution of each task based on the operation interface. The data classification aggregation module is used to collect risk information identified from the virtual machine assets during the execution of the task, and cluster the risk information by category to obtain alarm information. The alarm module is used to output the alarm information to a visual interface (UI interface). In addition, the cloud security platform also includes a database and a one-stop workbench interface, wherein the database is used to save the task information and status information of each task; the one-stop workbench interface includes a workflow panel, a threat alarm panel, and a security information analysis panel. Users can trigger preset workflows in the one-stop workbench interface, and can also view alarm information and statistical information in the one-stop workbench interface.

[0074] Based on the above embodiments, the following describes how to link the virtual machine platform and the threat detection processing platform to perform virtual machine protection processing on virtual machine assets based on a specific preset workflow. In one possible scenario, the preset workflow is a security protection configuration workflow, which is used to add security protection to virtual machine assets newly connected to the cloud security platform. The tasks corresponding to the security protection configuration workflow include agent installation tasks, threat detection tasks, immediate data protection tasks, and periodic data protection tasks. The agent installation task can instruct the threat detection processing platform to install an agent program (such as EDR Agent, EDR agent) in the virtual machine asset. The threat detection task can instruct the threat detection processing platform to use the agent program in the virtual machine asset to perform threat detection (such as virus detection and vulnerability detection) on the virtual machine asset. The immediate data protection task can instruct the virtual machine platform to immediately back up the data of the virtual machine asset (such as taking a snapshot of the storage of the virtual machine asset). The periodic data protection task can instruct the virtual machine platform to periodically back up the data of the virtual machine asset. The triggering method of the security protection configuration workflow will be first introduced below. In one possible scenario, judging whether the virtual machine asset meets the triggering conditions of the preset workflow may include:

[0075] S401, collecting asset information of virtual machine assets from the virtual machine platform, and using the global configuration table to determine whether the asset information is newly added virtual machine asset information; the global configuration table contains the asset information of the added virtual machine assets;

[0076] S402: If not, determine whether the virtual machine assets meet the triggering conditions of the security protection configuration workflow.

[0077] In order to achieve effective control over the security status of virtual machine assets, a global configuration table is set up in the cloud security platform to record the asset information of virtual machine assets that have been connected to the cloud security platform. Therefore, for virtual machine assets that are connected to the cloud security platform for the first time, since their asset information is not recorded in the global configuration table, the global configuration table can be used to determine whether the virtual machine asset is a newly added virtual machine asset. Furthermore, if the virtual machine asset is determined to be a newly added virtual machine asset, it means that the security protection configuration workflow needs to be triggered to add security protection for the virtual machine asset.

[0078] The following will first introduce the execution process of the security protection configuration workflow. In one possible scenario, each task is sent to the operation interface corresponding to the operation type of each task for processing in an orderly manner according to the operation process sequence specified by the preset workflow and the execution results of each task, which may include:

[0079] S501: Send an agent program installation task to the agent program installation interface of the threat detection and processing platform, so that the threat detection and processing platform performs an agent program installation operation on the virtual machine assets.

[0080] In this step, to ensure that the threat detection and processing platform can access the virtual machine assets, the cloud security platform first needs to send the agent installation task to the agent installation interface of the threat detection and processing platform, so that the threat detection and processing platform can perform the agent installation operation on the virtual machine assets, so that the threat detection and processing platform can subsequently use the agent in the virtual machine assets to perform threat detection and processing operations, where the agent installation interface is a threat detection and processing operation interface provided by the threat detection and processing platform. It is worth pointing out that the task information of the agent installation task can be saved to the database for user retrieval and viewing.

[0081] S502. Obtain the execution result of the agent installation task through the agent installation interface, and when it is determined that the execution result of the agent installation task is successful, send the threat detection task to the threat detection interface of the threat detection processing platform, so that the threat detection processing platform performs threat detection operations on the virtual machine assets through the agent in the virtual machine assets.

[0082] In this step, it can be understood that the cloud security platform can only send threat detection tasks to the threat detection processing platform when the agent program is successfully installed. Therefore, the cloud security platform can obtain the execution result of the agent program installation task through the agent program installation interface polling, and only when it is determined that the execution result is successful, will it continue to send threat detection tasks. It is worth pointing out that the execution result of the agent program installation task can also be saved to the database so that users can understand the execution status of the agent program installation task.

[0083] Further, after the agent program is successfully installed, the cloud security platform can send a threat detection task to the threat detection interface of the threat detection processing platform, so that the threat detection processing platform can perform threat detection operations on the virtual machine assets through the agent program in the virtual machine assets, wherein the threat detection interface is a threat detection processing operation interface provided by the threat detection processing platform. The embodiments of the present application do not limit specific threat detection tasks, for example, it can be a virus detection task, it can also be a vulnerability detection task, or it can include both a virus detection task and a vulnerability detection task.

[0084] S503. Obtain the execution result of the threat detection task through the threat detection interface, and when it is determined that the execution result of the threat detection task is that a threat risk is detected, send an immediate data protection task to the data protection interface of the virtual machine platform, so that the virtual machine platform immediately performs a data backup operation on the virtual machine assets, or when it is determined that the execution result of the threat detection task is that no threat risk is detected, send a periodic data protection task to the data protection interface of the virtual machine platform, so that the virtual machine platform periodically performs data backup operations on the virtual machine assets.

[0085] In this step, since the execution results of the threat detection task are divided into multiple situations, the cloud security platform needs to choose which data protection task to issue according to the execution results of the threat detection task. Specifically, when it is determined that the execution result of the threat detection task is that a threat risk is detected, the cloud security platform needs to issue an immediate data protection task to the data protection interface of the virtual machine platform, so that the virtual machine platform immediately performs a data backup operation on the virtual machine assets to immediately protect the virtual machine assets. When it is determined that the execution result of the threat detection task is that no threat risk is detected, the cloud security platform issues a periodic data protection task to the data protection interface of the virtual machine platform, so that the virtual machine platform periodically performs a data backup operation on the virtual machine assets to add the virtual machine assets to the general data protection policy of the virtual machine platform. Of course, when it is determined that the execution result of the threat detection task is an execution failure, the cloud security platform may not issue any data protection tasks.

[0086] For ease of understanding, the above process can be referred to Figure 5 , Figure 5 A schematic diagram of a security protection configuration workflow provided in an embodiment of the present application, wherein the operation of determining whether the tenant's permissions have passed the inspection is used to verify whether the user (i.e., the tenant) corresponding to the virtual machine asset meets the requirements of the virtual machine platform; the configuration protection table is a data table that stores task information and execution results of tasks in the database. During the execution of each task, the corresponding task information and execution results need to be updated in the configuration protection table in a timely manner.

[0087] The cloud security platform, cloud service system, electronic device and computer-readable storage medium provided in the embodiments of the present application are introduced below. The cloud security platform, cloud service system, electronic device and computer-readable storage medium described below can be referenced to each other with the virtual machine protection method described above.

[0088] Please refer to Figure 6 , Figure 6 This is a structural block diagram of a cloud security platform provided in an embodiment of the present application. The cloud security platform is arranged in a cloud service system. The cloud service system further includes a virtual machine platform and a threat detection and processing platform. A mutual trust relationship is established between the cloud security platform and the virtual machine platform and the threat detection and processing platform. Virtual machine assets are arranged in the virtual machine platform. The cloud security platform includes:

[0089] The trigger judgment module 701 is used to judge whether the virtual machine assets meet the trigger conditions of the preset workflow; the preset workflow is obtained by arranging the processes of various virtual machine management and control operations provided by the virtual machine platform and / or various threat detection and processing operations provided by the threat detection and processing platform. The cloud security platform is provided with various preset workflows;

[0090] The scheduling module 702 is used to call the virtual machine management and control operation and / or the threat detection and processing operation according to the preset workflow sequence to perform virtual machine protection processing on the virtual machine asset if the virtual machine asset meets the triggering condition of the preset workflow.

[0091] Optionally, the cloud security platform may also include:

[0092] A data classification and aggregation module obtains risk information identified from virtual machine assets during virtual machine protection processing and classifies the risk information according to the risk information type;

[0093] The alarm module is used to aggregate each type of risk information to obtain alarm information and output the alarm information to a visual interface;

[0094] The statistical module is used to count the number of each type of risk information to obtain statistical information, and output the statistical information to a visualization interface.

[0095] Optionally, the trigger determination module 701 may include:

[0096] A task generation module, used to generate tasks corresponding to each operation in the preset workflow by using the asset information of the virtual machine assets and the operation information of each operation in the preset workflow;

[0097] The task scheduling module is used to orderly send each task to the operation interface corresponding to the operation type of each task for processing according to the operation process sequence specified by the preset workflow and the execution results of each task; the operation interface includes a variety of virtual machine management and control operation interfaces provided by the virtual machine platform and a variety of threat detection and processing operation interfaces provided by the threat detection and processing platform, and the execution results are obtained through the operation interface.

[0098] Optionally, the cloud security platform may also include:

[0099] The task information management and output module is used to update the task information and execution results of the task to the database, and output the task information and execution results of the task to the visual interface.

[0100] Optionally, the preset workflow is a security protection configuration workflow, and the tasks corresponding to the security protection configuration workflow include agent installation tasks, threat detection tasks, real-time data protection tasks, and periodic data protection tasks;

[0101] Optionally, the task scheduling module may include:

[0102] A first sending submodule is used to send an agent program installation task to an agent program installation interface of a threat detection and processing platform, so that the threat detection and processing platform performs an agent program installation operation on virtual machine assets;

[0103] The second sending submodule is used to obtain the execution result of the agent program installation task through the agent program installation interface, and when it is determined that the execution result of the agent program installation task is successful, send the threat detection task to the threat detection interface of the threat detection processing platform, so that the threat detection processing platform performs threat detection operations on the virtual machine assets through the agent program in the virtual machine assets;

[0104] The third sending sub-module is used to obtain the execution result of the threat detection task through the threat detection interface, and when it is determined that the execution result of the threat detection task is that a threat risk is detected, send an immediate data protection task to the data protection interface of the virtual machine platform, so that the virtual machine platform immediately performs a data backup operation on the virtual machine assets; or when it is determined that the execution result of the threat detection task is that no threat risk is detected, send a periodic data protection task to the data protection interface of the virtual machine platform, so that the virtual machine platform periodically performs data backup operations on the virtual machine assets.

[0105] Optionally, the trigger determination module 701 may include:

[0106] The security protection configuration workflow trigger determination submodule is used to collect asset information of virtual machine assets from the virtual machine platform, and use the global configuration table to determine whether the asset information is newly added virtual machine asset information; the global configuration table contains the asset information of the added virtual machine assets; if not, it is determined that the virtual machine assets meet the triggering conditions of the security protection configuration workflow.

[0107] Please refer to Figure 1 , Figure 1 A structural block diagram of a cloud service system provided in an embodiment of the present application, the system may include: a cloud security platform 10, a virtual machine platform 20, a threat detection and processing platform 30, and a virtual machine asset 21 is provided in the virtual machine platform 20;

[0108] The virtual machine platform 20 is used to provide a variety of virtual machine management and control operations for the cloud security platform;

[0109] A threat detection and processing platform 30, used for providing various threat detection and processing operations for the cloud security platform;

[0110] The cloud security platform 10 is used to execute the virtual machine protection method as described in the above embodiment.

[0111] Of course, the cloud service system can also provide Figure 2 In the form shown, the cloud security platform 10 and the threat detection and processing platform 30 are both set in the virtual machine platform 20 in the form of virtual machines.

[0112] The present application also provides an electronic device. Figure 7 As shown, the electronic device may include:

[0113] A memory 132, for storing computer programs;

[0114] The processor 122 is used to implement the virtual machine protection method of the above method embodiment when executing a computer program.

[0115] For details, please refer to Figure 8 , Figure 8 A schematic diagram of the specific structure of an electronic device provided in an embodiment of the present application, which may have relatively large differences due to different configurations or performances, may include one or more processors (Central Processing Units, CPU) 122 (for example, one or more processors) and a memory 132, and one or more storage media 130 (for example, one or more mass storage devices) storing application programs 142 or data 144. Among them, the memory 132 and the storage medium 130 can be short-term storage or permanent storage. The program stored in the storage medium 130 may include one or more modules (not shown in the figure), and each module may include a series of instruction operations in the data processing device. Furthermore, the processor 122 can be configured to communicate with the storage medium 130 to execute a series of instruction operations in the storage medium 130 on the electronic device 101.

[0116] The electronic device 101 may further include one or more power supplies 126, one or more wired or wireless network interfaces 150, one or more input / output interfaces 158, and / or one or more operating systems 141. For example, Windows Server™, Mac OS X™, Unix™, Linux™, FreeBSD™, etc.

[0117] The present application also provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the steps of the above-mentioned virtual machine protection method are implemented.

[0118] The computer-readable storage medium may include: a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, and other media that can store program codes.

[0119] The various embodiments in the specification are described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the various embodiments can be referred to each other. For the device disclosed in the embodiment, since it corresponds to the method disclosed in the embodiment, the description is relatively simple, and the relevant parts can be referred to the method part description.

[0120] Professionals may further appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the composition and steps of each example have been generally described in the above description according to function. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professionals and technicians may use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0121] The steps of the method or algorithm described in conjunction with the embodiments disclosed herein may be implemented directly using hardware, a software module executed by a processor, or a combination of the two. The software module may be placed in a random access memory (RAM), a memory, a read-only memory (ROM), an electrically programmable ROM, an electrically erasable programmable ROM, a register, a hard disk, a removable disk, a CD-ROM, or any other form of storage medium known in the art.

[0122] The virtual machine protection method, cloud security platform, cloud service system, equipment and medium provided by the present application are introduced in detail above. Specific examples are used in this article to illustrate the principles and implementation methods of the present application. The description of the above embodiments is only used to help understand the method and core idea of ​​the present application. It should be pointed out that for ordinary technicians in this technical field, without departing from the principles of the present application, several improvements and modifications can be made to the present application, and these improvements and modifications also fall within the scope of protection of the present application.

Claims

1. A virtual machine protection method, characterized in that: A cloud security platform applied to a cloud service system, wherein the cloud service system further comprises a virtual machine platform and a threat detection and processing platform, wherein the virtual machine platform is provided with virtual machine assets, and the method comprises: Determine whether the virtual machine asset meets the triggering condition of a preset workflow; the preset workflow is obtained by orchestrating a plurality of virtual machine management and control operations provided by the virtual machine platform and / or a plurality of threat detection and processing operations provided by the threat detection and processing platform, and the cloud security platform is provided with a plurality of preset workflows; If the virtual machine asset meets the triggering condition of the preset workflow, the virtual machine management and control operation and / or the threat detection and processing operation are called according to the preset workflow sequence to perform virtual machine protection processing on the virtual machine asset.

2. The virtual machine protection method according to claim 1, characterized in that: After calling the virtual machine management and control operation and / or the threat detection and processing operation according to the preset workflow sequence to perform virtual machine protection processing on the virtual machine asset, the method further includes: Acquire risk information identified from the virtual machine assets during the virtual machine protection process, and classify the risk information according to the risk information type; Aggregate each type of risk information to obtain warning information, and output the warning information to a visualization interface; The amount of each type of risk information is counted to obtain statistical information, and the statistical information is output to the visualization interface.

3. The virtual machine protection method according to claim 1, characterized in that: The cloud security platform has established a mutual trust relationship with the virtual machine platform and the threat detection and processing platform. The cloud security platform and the threat detection and processing platform are both deployed on the virtual machine platform in the form of virtual machines.

4. The virtual machine protection method according to any one of claims 1 to 3, characterized in that: The calling of the virtual machine management and control operation and / or the threat detection and processing operation according to the preset workflow sequence to perform virtual machine protection processing on the virtual machine asset includes: Generate tasks corresponding to each operation in the preset workflow by using the asset information of the virtual machine assets and the operation information of each operation in the preset workflow; According to the operation process sequence specified by the preset workflow and the execution results of each task, each task is orderly sent to the operation interface corresponding to the operation type of each task for processing; the operation interface includes a variety of virtual machine management and control operation interfaces provided by the virtual machine platform and a variety of threat detection and processing operation interfaces provided by the threat detection and processing platform, and the execution results are obtained through the operation interface.

5. The virtual machine protection method according to claim 4, characterized in that: Also includes: The task information and execution result of the task are updated to the database, and the task information and execution result of the task are output to the visualization interface.

6. The virtual machine protection method according to claim 4, characterized in that: The preset workflow is a security protection configuration workflow, and the tasks corresponding to the security protection configuration workflow include agent installation tasks, threat detection tasks, real-time data protection tasks, and periodic data protection tasks; The step of sending each task in order to an operation interface corresponding to the operation type of each task for processing according to the operation process sequence specified by the preset workflow and the execution result of each task includes: Sending the agent program installation task to the agent program installation interface of the threat detection processing platform so that the threat detection processing platform performs the agent program installation operation on the virtual machine asset; Obtaining the execution result of the agent program installation task through the agent program installation interface, and when determining that the execution result of the agent program installation task is successful, sending the threat detection task to the threat detection interface of the threat detection processing platform, so that the threat detection processing platform performs a threat detection operation on the virtual machine asset through the agent program in the virtual machine asset; The execution result of the threat detection task is obtained through the threat detection interface, and when it is determined that the execution result of the threat detection task is that a threat risk is detected, the immediate data protection task is sent to the data protection interface of the virtual machine platform, so that the virtual machine platform immediately performs a data backup operation on the virtual machine assets, or when it is determined that the execution result of the threat detection task is that no threat risk is detected, the periodic data protection task is sent to the data protection interface of the virtual machine platform, so that the virtual machine platform periodically performs a data backup operation on the virtual machine assets.

7. The virtual machine protection method according to claim 6, characterized in that: The determining whether the virtual machine asset meets the triggering condition of the preset workflow includes: Collecting asset information of the virtual machine assets from the virtual machine platform, and using a global configuration table to determine whether the asset information is newly added virtual machine asset information; the global configuration table contains asset information of the added virtual machine assets; If not, it is determined that the virtual machine asset meets the triggering condition of the security protection configuration workflow.

8. A cloud security platform, characterized in that: The cloud security platform is arranged in a cloud service system, and the cloud service system further comprises a virtual machine platform and a threat detection and processing platform, wherein the virtual machine platform is provided with virtual machine assets, and the cloud security platform comprises: A trigger judgment module is used to judge whether the virtual machine assets meet the trigger conditions of a preset workflow; the preset workflow is obtained by arranging the processes of various virtual machine management and control operations provided by the virtual machine platform and / or various threat detection and processing operations provided by the threat detection and processing platform, and the cloud security platform is provided with a variety of preset workflows; The scheduling module is used to call the virtual machine management and control operation and / or the threat detection and processing operation according to the preset workflow sequence to perform virtual machine protection processing on the virtual machine asset if the virtual machine asset meets the triggering condition of the preset workflow.

9. A cloud service system, characterized in that: include: A cloud security platform, a virtual machine platform, and a threat detection and processing platform, wherein the cloud security platform has established a mutual trust relationship with the virtual machine platform and the threat detection and processing platform, and the virtual machine platform is provided with virtual machine assets; The virtual machine platform is used to provide a variety of virtual machine management and control operations for the cloud security platform; The threat detection and processing platform is used to provide a variety of threat detection and processing operations for the cloud security platform; The cloud security platform is used to execute the virtual machine protection method as described in any one of claims 1 to 7.

10. An electronic device, characterized in that: include: Memory for storing computer programs; A processor, used to implement the virtual machine protection method as described in any one of claims 1 to 7 when executing the computer program.

11. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer-executable instructions, and when the computer-executable instructions are loaded and executed by the processor, the virtual machine protection method according to any one of claims 1 to 7 is implemented.

Images