Cloud security product identification method and device, computer equipment, readable storage medium and program product

Abstract

The invention relates to a cloud security product identification method and device, computer equipment, a computer readable storage medium and a computer program product. The method comprises the following steps: acquiring a candidate cloud security product list, and acquiring product information and network information of each candidate cloud security product in the candidate cloud security product list; based on the product information and network information of each candidate cloud security product, screening a cloud security product associated with a target cloud platform in the candidate cloud security product list; based on the network information of the cloud security product, performing detection processing on the cloud security product to obtain a detection result, and determining a target cloud security product of which the detection result meets a preset condition; and storing the information of the target cloud security product, wherein the information at least comprises product information and network information. By adopting the method, the cloud security product can be identified, and powerful support is provided for cloud security governance and vulnerability verification.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and in particular to a cloud security product identification method, apparatus, computer equipment, computer-readable storage medium, and computer program product. Background Art

[0002] As enterprises and organizations increasingly rely on cloud platforms to host their critical business applications and business data, cloud security has gradually become a core topic in the field of information security. Cloud security products, as the main line of defense to protect cloud platforms from malicious attacks, play a key role in protecting the security of business data and business applications hosted in cloud platforms.

[0003] Identification of cloud security products is of great significance for cloud security governance and vulnerability verification. Since cloud service providers, OEMs (Original Equipment Manufacturers), and cloud security vendors provide a variety of cloud security products, there is an urgent need for a cloud security product identification method to provide strong support for cloud security governance and vulnerability verification. Summary of the invention

[0004] Based on this, it is necessary to provide a cloud security product identification method, apparatus, computer device, computer-readable storage medium and computer program product that can identify cloud security products in response to the above technical problems.

[0005] In a first aspect, the present application provides a cloud security product identification method, the method comprising:

[0006] Obtain a list of candidate cloud security products, and obtain product information and network information of each candidate cloud security product in the list of candidate cloud security products;

[0007] Based on the product information and network information of each of the candidate cloud security products, filter the cloud security products associated with the target cloud platform in the candidate cloud security product list;

[0008] Based on the network information of the cloud security product, the cloud security product is detected and processed to obtain a detection result, and a target cloud security product whose detection result meets a preset condition is determined;

[0009] The information of the target cloud security product is stored, where the information at least includes product information and network information.

[0010] In one embodiment, obtaining a list of candidate cloud security products includes:

[0011] Acquire a first cloud security product currently provided by a cloud security product provider, and add the first cloud security product to the candidate cloud security product list; and / or,

[0012] The second cloud security product is searched for through a cyberspace search engine, and the searched second cloud security product is added to the candidate cloud security product list; wherein the cloud security product provider includes at least one or more of a cloud service provider, an OEM manufacturer, and a cloud security product manufacturer.

[0013] In one embodiment, obtaining product information and network information of each candidate cloud security product in the candidate cloud security product list includes:

[0014] Based on the pre-stored configuration information, obtaining product information of each candidate cloud security product in the candidate cloud security product list; and,

[0015] For each candidate cloud security product in the candidate cloud security product list, a network search syntax corresponding to the candidate cloud security product is obtained, and network information of the candidate cloud security product is searched through a cyberspace search engine and the network search syntax.

[0016] In one of the embodiments, the product information of the candidate cloud security product includes at least a product type, and the product type includes at least one or more of a self-developed type, an OEM type, and a third-party type;

[0017] The network information of the candidate cloud security product includes at least one or more of an IP address, a port number, and an ASN.

[0018] In one embodiment, the filtering of cloud security products associated with the target cloud platform in the candidate cloud security product list based on the product information and network information of each candidate cloud security product includes:

[0019] In the case where the product type is a self-developed type, determining the candidate cloud security product as a cloud security product associated with the target cloud platform;

[0020] In the case where the product type is an OEM type, the candidate cloud security products whose network information meets the first screening condition are determined as cloud security products associated with the target cloud platform; wherein the first screening condition includes at least one of the following: the IP address belongs to the IP asset library of the cloud service provider, the IP address or ASN belongs to the ASN of the cloud service provider, and the product features corresponding to the cloud service provider are included;

[0021] When the product type is a third-party type, the candidate cloud security products whose network information meets the second screening condition are determined as cloud security products associated with the target cloud platform; wherein the second screening condition includes at least one of the following: the IP address belongs to the IP asset library of the cloud service provider, and the IP address or ASN belongs to the ASN of the cloud service provider.

[0022] In one embodiment, the detecting and processing the cloud security product based on the network information of the cloud security product to obtain the detection result, and determining the target cloud security product whose detection result meets the preset condition includes:

[0023] Based on the network information of the cloud security product, construct a detection data packet of the cloud security product;

[0024] Based on the detection data packet, the cloud security product is detected and processed to obtain a detection result, and a cloud security product that is detected as being alive and providing security services is determined as a target cloud security product.

[0025] In a second aspect, the present application provides a cloud security product identification device, the device comprising:

[0026] An acquisition module is used to acquire a list of candidate cloud security products, and acquire product information and network information of each candidate cloud security product in the list of candidate cloud security products;

[0027] A screening module, configured to screen cloud security products associated with a target cloud platform in the candidate cloud security product list based on product information and network information of each candidate cloud security product;

[0028] A determination module, configured to detect the cloud security product based on the network information of the cloud security product, obtain a detection result, and determine a target cloud security product whose detection result meets a preset condition;

[0029] The storage module is used to store information of the target cloud security product, where the information at least includes product information and network information.

[0030] In one embodiment, the acquisition module is specifically used to:

[0031] Acquire a first cloud security product currently provided by a cloud security product provider, and add the first cloud security product to the candidate cloud security product list; and / or,

[0032] The second cloud security product is searched for through a cyberspace search engine, and the searched second cloud security product is added to the candidate cloud security product list; wherein the cloud security product provider includes at least one or more of a cloud service provider, an OEM manufacturer, and a cloud security product manufacturer.

[0033] In one embodiment, the acquisition module is specifically used to:

[0034] Based on the pre-stored configuration information, obtaining product information of each candidate cloud security product in the candidate cloud security product list; and,

[0035] For each candidate cloud security product in the candidate cloud security product list, a network search syntax corresponding to the candidate cloud security product is obtained, and network information of the candidate cloud security product is searched through a cyberspace search engine and the network search syntax.

[0036] In one of the embodiments, the product information of the candidate cloud security product includes at least a product type, and the product type includes at least one or more of a self-developed type, an OEM type, and a third-party type;

[0037] The network information of the candidate cloud security product includes at least one or more of an IP address, a port number, and an ASN.

[0038] In one embodiment, the screening module is specifically used for:

[0039] In the case where the product type is a self-developed type, determining the candidate cloud security product as a cloud security product associated with the target cloud platform;

[0040] In the case where the product type is an OEM type, the candidate cloud security products whose network information meets the first screening condition are determined as cloud security products associated with the target cloud platform; wherein the first screening condition includes at least one of the following: the IP address belongs to the IP asset library of the cloud service provider, the IP address or ASN belongs to the ASN of the cloud service provider, and the product features corresponding to the cloud service provider are included;

[0041] When the product type is a third-party type, the candidate cloud security products whose network information meets the second screening condition are determined as cloud security products associated with the target cloud platform; wherein the second screening condition includes at least one of the following: the IP address belongs to the IP asset library of the cloud service provider, and the IP address or ASN belongs to the ASN of the cloud service provider.

[0042] In one embodiment, the determining module is specifically used to:

[0043] Based on the network information of the cloud security product, construct a detection data packet of the cloud security product;

[0044] Based on the detection data packet, the cloud security product is detected and processed to obtain a detection result, and a cloud security product that is detected as being alive and providing security services is determined as a target cloud security product.

[0045] In a third aspect, the present application provides a computer device, comprising a memory and a processor, wherein the memory stores a computer program, and the processor implements the steps of any one of the methods described in the first aspect when executing the computer program.

[0046] In a fourth aspect, the present application provides a computer-readable storage medium having a computer program stored thereon, wherein the computer program, when executed by a processor, implements the steps of any one of the methods described in the first aspect.

[0047] In a fifth aspect, the present application provides a computer program product, comprising a computer program, which, when executed by a processor, implements the steps of any one of the methods in the first aspect.

[0048] The above-mentioned cloud security product identification method, device, computer equipment, computer-readable storage medium and computer program product. First, the cloud security management device obtains a list of candidate cloud security products, and obtains the product information and network information of each candidate cloud security product in the list of candidate cloud security products. Then, based on the product information and network information of each candidate cloud security product, the cloud security management device screens the cloud security products associated with the target cloud platform in the list of candidate cloud security products, and based on the network information of the cloud security product, detects and processes the cloud security product to obtain the detection result, and determines the target cloud security product whose detection result meets the preset conditions. Finally, the cloud security management device stores the information of the target cloud security product, and the information at least includes product information and network information. In this way, the cloud security management device can identify cloud security products in the cloud platform to provide strong support for cloud security governance and vulnerability verification. BRIEF DESCRIPTION OF THE DRAWINGS

[0049] In order to more clearly illustrate the technical solutions in the embodiments of the present application or related technologies, the drawings required for use in the embodiments of the present application or related technical descriptions will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying creative work.

[0050] Figure 1 is a schematic diagram of an application scenario in an embodiment;

[0051] Figure 2The following is a flowchart of a cloud security product identification method in one embodiment;

[0052] Figure 3 The following is a flowchart of a cloud security product identification method in one embodiment;

[0053] Figure 4 The following is a flowchart of a cloud security product identification method in one embodiment;

[0054] Figure 5 The following is a flowchart of a cloud security product identification method in one embodiment;

[0055] Figure 6 The following is a flowchart of a cloud security product identification method in one embodiment;

[0056] Figure 7 A flowchart of an example of a cloud security product identification method in one embodiment;

[0057] Figure 8 It is a structural block diagram of a cloud security product identification device in one embodiment;

[0058] FIG. 9 is a diagram showing the internal structure of a computer device in one embodiment. DETAILED DESCRIPTION

[0059] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0060] As enterprises and organizations increasingly rely on cloud platforms to host their critical business applications and business data, cloud security has gradually become a core topic in the field of information security. Cloud security products, as the main line of defense to protect cloud platforms from malicious attacks, play a key role in protecting the security of business data and business applications hosted in cloud platforms.

[0061] The identification of cloud security products is of great significance for cloud security governance and vulnerability verification. Since cloud service providers, OEM manufacturers, and cloud security vendors provide a variety of cloud security products, there is an urgent need for a cloud security product identification method to provide strong support for cloud security governance and vulnerability verification.

[0062] An embodiment of the present application provides a cloud security product identification method, which can be applied to a cloud security management device in a cloud platform. Figure 1 FIG. 1 is a schematic diagram of an application scenario in an embodiment. Figure 1As shown, the cloud platform includes a cloud security management device 110 and a cloud security product 120. The cloud security management device 110 and the cloud security product 120 are connected via a network device. The cloud security management device 110 is used to identify, manage, and verify vulnerabilities of the cloud security product 120 in the cloud platform.

[0063] A cloud security product identification method provided in the embodiment of the present application can be applied to the following application scenarios: (1) Understanding the distribution of cloud security products, collecting statistics on the product categories, geographical distribution, port distribution and other information of cloud security products, and understanding the deployment scale and other information of cloud security products. (2) Identification and governance of shadow assets. For the IP of a surviving cloud security product, if the IP of the cloud security product is not in the IP asset library of the cloud service provider, the cloud security product belongs to the category of shadow assets, which can promote internal governance of shadow assets. (3) Vulnerability verification and disposal. When a cloud security product has a vulnerability, the IP address and port number of the cloud security product can be queried from the database. Then, the IP address and port number of the cloud security product with the vulnerability are disposed, so as to prevent it before it happens and promote tenants to manage it before the attacker discovers it. (4) Vulnerability disposal of OEM-type cloud security products. The information of the cloud OEM manufacturer is recorded in the product information of the cloud security product. When the cloud security product of the OEM manufacturer has a vulnerability, the IP address and port number of the cloud security product can be queried from the database. Then, the IP address and port number of the cloud security product with the vulnerability are disposed, so as to prevent it before it happens.

[0064] The following will describe in detail the cloud security product identification method provided by this application in conjunction with specific implementation methods. Figure 2 As shown, the method comprises the following steps:

[0065] Step 201, obtain a list of candidate cloud security products, and obtain product information and network information of each candidate cloud security product in the list of candidate cloud security products.

[0066] In one implementation, since the cloud security products deployed on the cloud platform may be provided by cloud service providers, OEM manufacturers, and cloud security manufacturers, and the cloud security products provided by cloud service providers, OEM manufacturers, and cloud security manufacturers are also diverse. Therefore, in order to accurately and comprehensively identify the cloud security products deployed on the cloud platform, the cloud security management device may first obtain a list of candidate cloud security products. The list of candidate cloud security products is a list of all cloud security products that can be deployed on the cloud platform (including cloud security products that are deployed on the cloud platform and provide security services, cloud security products that are deployed on the cloud platform and do not provide security services, cloud security products that are not deployed on the cloud platform, etc.).

[0067] After the cloud security management device obtains the candidate cloud security product list, it can further obtain the product information and network information of each candidate cloud security product in the candidate cloud security product list. Among them, the product information of the candidate cloud security product may include at least one or more of the product name (product_name), the vendor name (vendor), the OEM vendor name (oem_vendor) and the product type (type). The product type may include at least one or more of the self-developed type, the OEM type and the third-party type; the product type of the cloud security product provided by the cloud service provider is the self-developed type, the product type of the cloud security product provided by the OEM vendor is the OEM type, and the product type of the cloud security product provided by the cloud security vendor is the third-party type. The network information of the candidate cloud security product may include at least one or more of the IP address, country, longitude and latitude, port number and ASN (Autonomous System Number).

[0068] Step 202 , based on the product information and network information of each candidate cloud security product, filter the cloud security products associated with the target cloud platform in the candidate cloud security product list.

[0069] In one embodiment, since the candidate cloud security products in the candidate cloud security product list are all cloud security products that can be deployed on the cloud platform, the cloud security management device needs to filter out the cloud security products associated with the target cloud platform from the candidate cloud security product list. Based on this, after the cloud security management device obtains the product information and network information of each candidate cloud security product, it can further filter out the cloud security products associated with the target cloud platform from the candidate cloud security product list based on the product information and network information of each candidate cloud security product. Among them, the target cloud platform is a cloud platform provided by a cloud service provider, and the cloud security products associated with the target cloud platform are cloud security products deployed on the target cloud platform and providing security services.

[0070] Step 203: Based on the network information of the cloud security product, the cloud security product is detected and processed to obtain a detection result, and a target cloud security product whose detection result meets a preset condition is determined.

[0071] In one embodiment, since the survival status of cloud security products deployed on the cloud platform may change over time, and the security services deployed on the cloud security products may also change over time. Therefore, after the cloud security management device screens out the cloud security products associated with the target cloud platform, it can detect and process the cloud security products based on the network information of the cloud security products to obtain the detection results of the cloud security products. Then, the cloud security management device can further determine the target cloud security products whose detection results meet the preset conditions based on the detection results of the cloud security products. Among them, the target cloud security product is a cloud security product whose survival status on the cloud platform is alive and whose deployed security services have not changed.

[0072] Step 204: Store the information of the target cloud security product, wherein the information at least includes product information and network information.

[0073] In one implementation, after the cloud security management device determines the target cloud security product, it can store information about the target cloud security product, where the information at least includes product information and network information.

[0074] The cloud security management device can store the information of the target cloud security product in a database, wherein the database can be MySQL, Elasticsearch, etc., which is not limited in the embodiment of the present application.

[0075] In an exemplary embodiment, Figure 3 As shown, the process of the cloud security management device obtaining the candidate cloud security product list is as follows:

[0076] Step 301: obtain a first cloud security product currently provided by a cloud security product provider, and add the first cloud security product to a candidate cloud security product list, wherein the cloud security product provider includes at least one or more of a cloud service provider, an OEM manufacturer, and a cloud security product manufacturer.

[0077] In one implementation, since the cloud security products deployed on the cloud platform may be provided by cloud security product providers (such as cloud service providers, OEM manufacturers, cloud security manufacturers, etc.), the cloud security management device may directly obtain the cloud security products currently provided or currently disclosed by the cloud security product providers, i.e., the first cloud security products, from the cloud security product providers. Then, the cloud security management device may add the obtained first cloud security products to the candidate cloud security product list.

[0078] In one example, the cloud security management device may use a crawler tool to obtain a first cloud security product currently provided or currently disclosed by a cloud security product provider from the official website of the cloud security product provider.

[0079] Step 302: Search for a second cloud security product through a cyberspace search engine, and add the searched second cloud security product to a candidate cloud security product list.

[0080] In one embodiment, since the cloud security products deployed on the cloud platform may also include cloud security products that have been removed from the shelves by the cloud security product provider but are still used by the cloud tenant, i.e., second cloud security products, in order to make up for the omission problem in the list of candidate cloud security products obtained by the cloud security management device in step 301, the cloud security management device may also search for the second cloud security product through a cyberspace search engine, and add the searched second cloud security product to the list of candidate cloud security products.

[0081] Specifically, the cloud security management device can search for the second cloud security product through the cyberspace search engine based on the pre-built product search syntax. For example, based on the product search syntax "cert=A.cn", the cloud security products whose certificate information contains the main site of the cloud security vendor A are searched through the cyberspace search engine. Among them, the technicians can pre-determine the product search syntax in the cyberspace search engine for all cloud security products. Since different versions of cloud security products may correspond to different product search syntaxes. Therefore, one cloud security product may correspond to multiple product search syntaxes.

[0082] The product search syntax of cloud security products in cyberspace search engines can be divided into two categories. The first category is cloud security products that have been identified by cyberspace search engines. For example, the VPN (Virtual Private Network) cloud security product of cloud security vendor B, its corresponding product search syntax can be "product=B-SSL-VPN". The second category is cloud security products that have not been identified by cyberspace search engines, or have been identified but inaccurately, and their corresponding product search syntax can be constructed by technical personnel according to specific circumstances. For example, the web anti-tampering system of cloud security vendor C, its product search syntax can be "title=B Web Anti-tampering System".

[0083] It should be noted that the cloud security management device may determine the product type of each candidate cloud security product included in the candidate cloud security product list during the process of obtaining the candidate cloud security product list.

[0084] In an exemplary embodiment, Figure 4 As shown in the figure, the cloud security management device obtains the candidate cloud security product list, and the process of processing the product information and network information of each candidate cloud security product is as follows:

[0085] Step 401, based on the pre-stored configuration information, obtain product information of each candidate cloud security product in the candidate cloud security product list.

[0086] In one embodiment, the cloud security management device can obtain the product information of each candidate cloud security product in the candidate cloud security product list based on the pre-stored configuration information. The configuration information includes the product information of each candidate cloud security product; the product information of the candidate cloud security product can include at least one or more of the product name (product_name), the manufacturer name (vendor), the OEM manufacturer name (oem_vendor) and the product type (type); the product type can include at least one or more of the self-developed type, the OEM type and the third-party type; the product type of the cloud security product provided by the cloud service provider is the self-developed type, the product type of the cloud security product provided by the OEM manufacturer is the OEM type, and the product type of the cloud security product provided by the cloud security vendor is the third-party type.

[0087] Step 402, for each candidate cloud security product in the candidate cloud security product list, obtain the network search syntax corresponding to the candidate cloud security product, and search the network information of the candidate cloud security product through the network space search engine and the network search syntax.

[0088] In one implementation, since the IP address range is large and the ports opened by cloud security products after deployment are uncertain, it is impossible to scan only specific ports. Therefore, it is not cost-effective to build a full IP address and full port scanning platform by yourself. At the same time, considering that attackers generally obtain the IP address and port number of cloud security products through existing mature cyberspace search engines and then launch attacks. Therefore, the cloud security management device can search for network information of candidate cloud security products based on mainstream cyberspace search engines.

[0089] For each candidate cloud security product in the candidate cloud security product list, the cloud security management device can obtain the network search syntax corresponding to the candidate cloud security product. The network search syntax is used to search for the network information of the candidate cloud security product. Then, based on the network search syntax of the candidate cloud security product, the cloud security management device can search for the network information of the candidate cloud security product whose update time is within a preset time period through the network space search engine. For example, in the first search, in order to avoid omissions, the preset time period should be as long as possible, and the network space search engine can search for the network information of the candidate cloud security product within the past 2 years. After the first search, in order to avoid data redundancy, in each subsequent search, the network space search engine can only search the network information of the candidate cloud security product from the last search time to the current time.

[0090] In order to facilitate automated processing, cyberspace search engines usually provide APIs (Application Programming Interface). Accordingly, cloud security management devices can obtain network information of each candidate cloud security product through the API of the cyberspace search engine. Among them, the network information of the candidate cloud security product can include at least one or more of IP address, country, longitude and latitude, port number and ASN. The cloud security management device can select and discard network information as needed, but the network information at least includes IP address, port number and ASN.

[0091] It should be noted that after the cloud security management device obtains the product information and network information of each candidate cloud security product, it can be stored in the database. Among them, the database can be selected from MySQL, Elasticsearch, etc., and the embodiment of this application is not limited. Taking JSON format as an example, the data structure of the product information and network information of the candidate cloud security product stored in the database is as follows:

[0092] "product_name":"Product Name"

[0093] "vendor":"Manufacturer name"

[0094] "oem_vendor":"OEM manufacturer name"

[0095] "type":"Self-developed / OEM / Third-party"

[0096] "search_time":"Search time"

[0097] "data":"Network information"

[0098] In an exemplary embodiment, the cloud security management device has different screening methods for candidate cloud security products of different product types. Figure 5 As shown, the cloud security management device selects cloud security products associated with the target cloud platform from the candidate cloud security product list based on the product information and network information of each candidate cloud security product as follows:

[0099] Step 501: When the product type is a self-developed type, the candidate cloud security product is determined as a cloud security product associated with the target cloud platform.

[0100] In one implementation, since the self-developed candidate cloud security product is a cloud security product developed by the cloud service provider, it will not be deployed on other cloud platforms other than the target cloud platform. Therefore, when the product type of the candidate cloud security product is a self-developed type, the cloud security management device can directly determine the candidate cloud security product as a cloud security product associated with the target cloud platform.

[0101] Step 502: When the product type is OEM type, the candidate cloud security products whose network information meets the first screening condition are determined as cloud security products associated with the target cloud platform. The first screening condition includes at least one of the following: the IP address belongs to the IP asset library of the cloud service provider, the IP address or ASN belongs to the ASN of the cloud service provider, and the product features corresponding to the cloud service provider are included.

[0102] In one embodiment, OEM refers to companies that produce cloud security products for other companies. The cloud security products produced by them are packaged by the cloud service provider according to their own choices and use their own brand name on the final product.

[0103] For OEM-type cloud security products, there are usually multiple cloud service providers OEM the same cloud security product, and the network search syntax is generally a general syntax that cannot distinguish which OEM-type candidate cloud security products belong to the cloud service provider. Therefore, the network information of the OEM-type candidate cloud security products obtained by the cloud security management device may include the network information of the candidate cloud security products of non-cloud service provider OEM. Based on this, the cloud security management device can preset a first filtering condition based on the OEM-type candidate cloud security products. Then, in the case where the product type of the candidate cloud security product is of OEM type, the candidate cloud security product whose network information meets the first filtering condition is determined as a cloud security product associated with the target cloud platform. Among them, the first filtering condition can mainly include at least one of the following.

[0104] The first type: The IP address belongs to the IP asset library of the cloud service provider. When building a security operation platform, the cloud service provider will establish an IP asset library to record the IP addresses it owns. Although it is difficult to avoid the existence of shadow assets (usually referring to cloud security products that are not under the control of cloud security management devices), they can also be used to screen candidate cloud security products of the OEM type. The cloud security management device can retrieve the IP in the network information of the candidate cloud security product obtained through the cyberspace search engine. If it is hit in the IP asset library, it means that the candidate cloud security product of the OEM type belongs to the cloud service provider.

[0105] The second type: including product features corresponding to cloud service providers. OEMs can usually carry out customized production and design according to the specifications of cloud service providers, and the cloud security products they produce usually include product features of cloud service providers. Generally, OEM-type cloud security products will have some product features of cloud service providers. Based on this, the cloud security management device can determine the candidate cloud security products that include product features corresponding to cloud service providers as cloud security products associated with the target cloud platform.

[0106] For example, take the cloud wall of a cloud service provider as an example. It is OEMed from the firewall of an OEM manufacturer. And this OEM manufacturer will store the name of the cloud service provider under the static / localize / oem.js path of the cloud security product. The data content stored under this path is as follows. Among them, the COPYRIGHT_CN field stores the name of the cloud service provider. Therefore, for this cloud wall, the cloud security management device can obtain the content under the static / localize / oem.js path, and then determine whether the COPYRIGHT_CN field is the name of the cloud service provider. If the COPYRIGHT_CN field is the name of the cloud service provider, the cloud security management device can determine that the cloud wall is a cloud security product associated with the target cloud platform.

[0107] var OEM_CN="Next Generation Firewall"

[0108] var OEM_EN="NGFW"

[0109] var COPYRIGHT_CN="©2023 ** Co., Ltd. All rights reserved"

[0110] var COPYRIGHT_EN="©2023 ** Corporation Ltd."

[0111] var LOGIN_TITLE_CN="Please log in to the next generation firewall"

[0112] var LOGIN_TITLE_EN="Please Login NGFW"

[0113] var INDEX_TITLE_CN="Next Generation Firewall"

[0114] var INDEX_TITLE_EN="NGFW"

[0115] var DASH_PIE_COLOR="#3ec289:#686868" / / Home page ring chart color and the rest of the color

[0116] var AUTH_CN="Authentication login"

[0117] var AUTH_EN="Authentication Login"

[0118] It should be noted that the cloud security management device can compare the product features of cloud security products before and after OEM, or even analyze the product features of cloud security products of other cloud service providers OEM. If there are similar features, it can be screened in this way to determine the cloud security products that are truly associated with the target cloud platform.

[0119] The third type: The IP address or ASN belongs to the ASN of the cloud service provider. Generally, cloud service providers also have their own unique ASN. If the IP address or ASN in the network information of the OEM-type candidate cloud security product belongs to the ASN of the cloud service provider, it means that the OEM-type candidate cloud security product is a cloud security product of the cloud server provider, and the cloud security management device can determine the OEM-type candidate cloud security product as a cloud security product associated with the target cloud platform.

[0120] Step 503: If the product type is a third-party type, the candidate cloud security products whose network information meets the second screening condition are determined as cloud security products associated with the target cloud platform. The second screening condition includes at least one of the following: the IP address belongs to the IP asset library of the cloud service provider, and the IP address or ASN belongs to the ASN of the cloud service provider.

[0121] In one embodiment, for cloud security products of third-party cloud security vendors, the cyberspace search engine will search for all cloud security products of the cloud security vendor exposed on the Internet based on the network search syntax. Therefore, the cloud security management device can preset a second screening condition based on the candidate cloud security products of the third-party type. Then, in the case where the product type of the candidate cloud security product is a third-party type, the candidate cloud security product whose network information meets the second screening condition is determined as a cloud security product associated with the target cloud platform. Among them, the screening method is similar to that of OEM-type cloud security products, and can be screened through the IP asset library and ASN. Since the product features of the cloud service provider do not exist in the third-party type cloud security products. Therefore, the screening method that includes the product features corresponding to the cloud service provider is not suitable for candidate cloud security products of the third-party type. Based on this, the second screening condition includes at least one of the following: the IP address belongs to the IP asset library of the cloud service provider, and the IP address or ASN belongs to the ASN of the cloud service provider.

[0122] In an exemplary embodiment, Figure 6 As shown, the cloud security management device detects the cloud security product based on the network information of the cloud security product, obtains the detection result, and determines the target cloud security product whose detection result meets the preset conditions. The processing process is as follows:

[0123] Step 601: construct a detection data packet of the cloud security product based on the network information of the cloud security product.

[0124] In one implementation, since the survival status of cloud security products deployed on the cloud platform may change over time, and the security services deployed on the cloud security products may also change over time, the network information of cloud security products obtained through the cyberspace search engine cannot reflect the latest status of the cloud security products, but can only indicate that the cloud security products are deployed on a specific IP address and port number at the time of the cyberspace search engine search. Therefore, the cloud security management device can also detect the cloud security products based on the network information of the cloud security products.

[0125] Since the network information of cloud security products obtained through the cyberspace search engine already includes the IP address, port number and the security services opened thereon, the cloud security management device can construct a detection data packet of the cloud security product based on the network information of the cloud security product.

[0126] Step 602: Based on the detection data packet, the cloud security product is detected and processed to obtain a detection result, and the cloud security product whose detection result indicates that it is alive and provides security services is determined as a target cloud security product.

[0127] In one embodiment, after the cloud security management device constructs a detection data packet for the cloud security product based on the network information of the cloud security product, the constructed detection data packet for the corresponding security service can be sent to the corresponding IP address and port number. The cloud security management device can then make a judgment based on the detection results. If the connection times out, or the detection result is not the original security service, it means that the IP address and port number have changed and are no longer related to the cloud security product, so they can be filtered out. If the verification is alive and the security service is consistent, it is also necessary to determine whether the detection result contains the characteristic information of the cloud security product. If not, it also needs to be filtered out. By detecting and verifying the IP address and port number, the cloud security management device can open the IP address and port, and the service matches, and the product characteristics also match the cloud security product to determine it as the target cloud security product.

[0128] It should be noted that the cloud security management device can store the detection results in a database. The database can be MySQL, Elasticsearch, etc., which is not limited in the embodiment of the present application.

[0129] Taking JSON format as an example, the data structure of the detection results stored in the database is as follows:

[0130] "scan_time":"Detection time",

[0131] "is_alive": "Alive status, True / False"

[0132] "is_security_product": "Whether the security rules are met, True / False"

[0133] In addition, as time goes by, cloud service providers will deploy more cloud security products on cloud platforms, and new cloud security products may also be launched. Therefore, cloud security management devices can continuously update data, and the update cycle can be determined based on actual conditions.

[0134] like Figure 7 As shown, the embodiment of the present application provides an example of a cloud security product identification method, including the following steps:

[0135] Step 701: obtain a first cloud security product currently provided by a cloud security product provider, and add the first cloud security product to a candidate cloud security product list, wherein the cloud security product provider includes at least one or more of a cloud service provider, an OEM manufacturer, and a cloud security product manufacturer.

[0136] Step 702: Search for a second cloud security product through a cyberspace search engine, and add the searched second cloud security product to a candidate cloud security product list.

[0137] Step 703: Based on the pre-stored configuration information, obtain product information of each candidate cloud security product in the candidate cloud security product list.

[0138] Step 704: for each candidate cloud security product in the candidate cloud security product list, obtain the network search syntax corresponding to the candidate cloud security product, and search for network information of the candidate cloud security product through the network space search engine and the network search syntax.

[0139] Step 705a: When the product type is a self-developed type, the candidate cloud security product is determined as a cloud security product associated with the target cloud platform.

[0140] Step 705b, when the product type is OEM type, the candidate cloud security products whose network information meets the first screening condition are determined as cloud security products associated with the target cloud platform. The first screening condition includes at least one of the following: the IP address belongs to the IP asset library of the cloud service provider, the IP address or ASN belongs to the ASN of the cloud service provider, and the product features corresponding to the cloud service provider are included.

[0141] Step 705c, when the product type is a third-party type, the candidate cloud security products whose network information meets the second screening condition are determined as cloud security products associated with the target cloud platform. The second screening condition includes at least one of the following: the IP address belongs to the IP asset library of the cloud service provider, and the IP address or ASN belongs to the ASN of the cloud service provider.

[0142] Step 706: construct a detection data packet for the cloud security product based on the network information of the cloud security product.

[0143] Step 707: Based on the detection data packet, the cloud security product is detected and processed to obtain a detection result, and the cloud security product whose detection result indicates that it is alive and provides security services is determined as a target cloud security product.

[0144] Step 708: Store the information of the target cloud security product, wherein the information at least includes product information and network information.

[0145] In the embodiment of the present application, first, the cloud security management device obtains a list of candidate cloud security products, and obtains the product information and network information of each candidate cloud security product in the list of candidate cloud security products. Then, based on the product information and network information of each candidate cloud security product, the cloud security management device screens the cloud security products associated with the target cloud platform in the list of candidate cloud security products, detects and processes the cloud security products based on the network information of the cloud security products, obtains the detection results, and determines the target cloud security products whose detection results meet the preset conditions. Finally, the cloud security management device stores the information of the target cloud security product, and the information at least includes product information and network information. In this way, on the first hand, the cloud security management device can comprehensively identify cloud security products of self-developed type, OEM type, and third-party type. On the second hand, the cloud security management device obtains the data of cloud security products based on the cyberspace search engine, without the need to build a full IP address and full port number scanning platform by itself, and is consistent with the attacker's perspective, so that problems with cloud security products can be discovered in a timely manner and promoted governance. On the third hand, the cloud security management device ensures the accuracy of cloud security product data by screening, detecting and verifying the data obtained from the cyberspace search engine. Fourthly, cloud security management equipment can identify the shadow assets of cloud service providers. Fifthly, cloud security management equipment records the information of OEM manufacturers. When vulnerabilities appear in the cloud security products of OEM manufacturers, it can also verify and deal with the vulnerabilities of the OEM type cloud security products of cloud service providers in a timely manner.

[0146] It should be understood that, although the steps in the flowcharts involved in the above embodiments are displayed in sequence according to the indication of the arrows, these steps are not necessarily executed in sequence according to the order indicated by the arrows. Unless there is a clear explanation in this article, the execution of these steps is not strictly limited in order, and these steps can be executed in other orders. Moreover, at least a part of the steps in the flowcharts involved in the above embodiments may include multiple steps or multiple stages, and these steps or stages are not necessarily executed at the same time, but can be executed at different times, and the execution order of these steps or stages is not necessarily carried out in sequence, but can be executed in turn or alternately with other steps or at least a part of the steps or stages in other steps.

[0147] Based on the same inventive concept, the embodiment of the present application also provides a cloud security product identification device for implementing the cloud security product identification method involved above. The implementation scheme for solving the problem provided by the device is similar to the implementation scheme recorded in the above method, so the specific limitations in one or more cloud security product identification device embodiments provided below can refer to the limitations of the cloud security product identification method above, and will not be repeated here.

[0148] In an exemplary embodiment, Figure 8 As shown, a cloud security product identification device is provided, the device includes: an acquisition module 810, a screening module 820, a determination module 830 and a storage module 840; wherein,

[0149] The acquisition module 810 is used to acquire a list of candidate cloud security products, and acquire product information and network information of each candidate cloud security product in the list of candidate cloud security products;

[0150] A screening module 820, configured to screen cloud security products associated with a target cloud platform in the candidate cloud security product list based on product information and network information of each candidate cloud security product;

[0151] The determination module 830 is used to detect the cloud security product based on the network information of the cloud security product, obtain a detection result, and determine a target cloud security product whose detection result meets a preset condition;

[0152] The storage module 840 is used to store information of the target cloud security product, where the information at least includes product information and network information.

[0153] In one embodiment, the acquisition module 810 is specifically used to:

[0154] Acquire a first cloud security product currently provided by a cloud security product provider, and add the first cloud security product to the candidate cloud security product list; and / or,

[0155] The second cloud security product is searched for through a cyberspace search engine, and the searched second cloud security product is added to the candidate cloud security product list; wherein the cloud security product provider includes at least one or more of a cloud service provider, an OEM manufacturer, and a cloud security product manufacturer.

[0156] In one embodiment, the acquisition module 810 is specifically used to:

[0157] Based on the pre-stored configuration information, obtaining product information of each candidate cloud security product in the candidate cloud security product list; and,

[0158] For each candidate cloud security product in the candidate cloud security product list, a network search syntax corresponding to the candidate cloud security product is obtained, and network information of the candidate cloud security product is searched through a cyberspace search engine and the network search syntax.

[0159] In one of the embodiments, the product information of the candidate cloud security product includes at least a product type, and the product type includes at least one or more of a self-developed type, an OEM type, and a third-party type;

[0160] The network information of the candidate cloud security product includes at least one or more of an IP address, a port number, and an ASN.

[0161] In one embodiment, the screening module 820 is specifically used to:

[0162] In the case where the product type is a self-developed type, determining the candidate cloud security product as a cloud security product associated with the target cloud platform;

[0163] In the case where the product type is an OEM type, the candidate cloud security products whose network information meets the first screening condition are determined as cloud security products associated with the target cloud platform; wherein the first screening condition includes at least one of the following: the IP address belongs to the IP asset library of the cloud service provider, the IP address or ASN belongs to the ASN of the cloud service provider, and the product features corresponding to the cloud service provider are included;

[0164] When the product type is a third-party type, the candidate cloud security products whose network information meets the second screening condition are determined as cloud security products associated with the target cloud platform; wherein the second screening condition includes at least one of the following: the IP address belongs to the IP asset library of the cloud service provider, and the IP address or ASN belongs to the ASN of the cloud service provider.

[0165] In one embodiment, the determining module 830 is specifically configured to:

[0166] Based on the network information of the cloud security product, construct a detection data packet of the cloud security product;

[0167] Based on the detection data packet, the cloud security product is detected and processed to obtain a detection result, and a cloud security product that is detected as being alive and providing security services is determined as a target cloud security product.

[0168] Each module in the above-mentioned cloud security product identification device can be implemented in whole or in part by software, hardware and their combination. Each of the above-mentioned modules can be embedded in or independent of the processor in the computer device in the form of hardware, or can be stored in the memory of the computer device in the form of software, so that the processor can call and execute the corresponding operations of each of the above modules.

[0169] In an exemplary embodiment, a computer device is provided, which may be a terminal, and its internal structure diagram may be shown in FIG9. The computer device includes a processor, a memory, an input / output interface, a communication interface, a display unit, and an input device. The processor, the memory, and the input / output interface are connected via a system bus, and the communication interface, the display unit, and the input device are connected to the system bus via the input / output interface. The processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system and a computer program. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The input / output interface of the computer device is used to exchange information between the processor and an external device. The communication interface of the computer device is used to communicate with an external terminal in a wired or wireless manner, and the wireless manner may be implemented through WIFI, a mobile cellular network, near field communication (NFC) or other technologies. When the computer program is executed by the processor, a cloud security product identification method is implemented. The display unit of the computer device is used to form a visually visible picture, which may be a display screen, a projection device, or a virtual reality imaging device. The display screen can be a liquid crystal display screen or an electronic ink display screen, and the input device of the computer device can be a touch layer covering the display screen, or a button, trackball or touchpad set on the computer device shell, or an external keyboard, touchpad or mouse.

[0170] Those skilled in the art will understand that the structure shown in FIG. 9 is merely a block diagram of a partial structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than shown in the figure, or combine certain components, or have a different arrangement of components.

[0171] In an exemplary embodiment, a computer device is provided, including a memory and a processor, wherein a computer program is stored in the memory, and the processor implements the steps of the above-mentioned cloud security product identification method when executing the computer program.

[0172] In one embodiment, a computer-readable storage medium is provided, on which a computer program is stored, and when the computer program is executed by a processor, the steps of the above-mentioned cloud security product identification method are implemented.

[0173] In one embodiment, a computer program product is provided, including a computer program, which implements the steps of the above-mentioned cloud security product identification method when executed by a processor.

[0174] It should be noted that the user information (including but not limited to user device identification, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with relevant regulations.

[0175] A person of ordinary skill in the art can understand that all or part of the processes in the above-mentioned embodiment method can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to the memory, database or other medium used in the embodiments provided in the present application can include at least one of non-volatile memory and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. As an illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM). The database involved in each embodiment provided in this application may include at least one of a relational database and a non-relational database. Non-relational databases may include distributed databases based on blockchains, etc., but are not limited to this. The processor involved in each embodiment provided in this application may be a general-purpose processor, a central processing unit, a graphics processor, a digital signal processor, a programmable logic device, a data processing logic device based on quantum computing, an artificial intelligence (AI) processor, etc., but are not limited to this.

[0176] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this application.

[0177] The above-described embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the present application. It should be pointed out that, for a person of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the present application shall be subject to the attached claims.

Claims

1. A cloud security product identification method, characterized in that: The method comprises: Obtain a list of candidate cloud security products, and obtain product information and network information of each candidate cloud security product in the list of candidate cloud security products; Based on the product information and network information of each of the candidate cloud security products, filter the cloud security products associated with the target cloud platform in the candidate cloud security product list; Based on the network information of the cloud security product, the cloud security product is detected and processed to obtain a detection result, and a target cloud security product whose detection result meets a preset condition is determined; The information of the target cloud security product is stored, where the information at least includes product information and network information.

2. The method according to claim 1, characterized in that The obtaining of a list of candidate cloud security products includes: Acquire a first cloud security product currently provided by a cloud security product provider, and add the first cloud security product to the candidate cloud security product list; and / or, The second cloud security product is searched for through a cyberspace search engine, and the searched second cloud security product is added to the candidate cloud security product list; wherein the cloud security product provider includes at least one or more of a cloud service provider, an original equipment manufacturer OEM manufacturer and a cloud security product manufacturer.

3. The method according to claim 1, characterized in that The obtaining of product information and network information of each candidate cloud security product in the candidate cloud security product list includes: Based on the pre-stored configuration information, obtaining product information of each candidate cloud security product in the candidate cloud security product list; and, For each candidate cloud security product in the candidate cloud security product list, a network search syntax corresponding to the candidate cloud security product is obtained, and network information of the candidate cloud security product is searched through a cyberspace search engine and the network search syntax.

4. The method according to claim 1, characterized in that The product information of the candidate cloud security product includes at least a product type, and the product type includes at least one or more of a self-developed type, an OEM type, and a third-party type; The network information of the candidate cloud security product includes at least one or more of an Internet Protocol IP address, a port number, and an Autonomous System Number ASN.

5. The method according to claim 4, characterized in that The step of screening cloud security products associated with the target cloud platform in the candidate cloud security product list based on the product information and network information of each candidate cloud security product includes: In the case where the product type is a self-developed type, determining the candidate cloud security product as a cloud security product associated with the target cloud platform; In the case where the product type is an OEM type, the candidate cloud security products whose network information meets the first screening condition are determined as cloud security products associated with the target cloud platform; wherein the first screening condition includes at least one of the following: the IP address belongs to the IP asset library of the cloud service provider, the IP address or ASN belongs to the ASN of the cloud service provider, and the product features corresponding to the cloud service provider are included; When the product type is a third-party type, the candidate cloud security products whose network information meets the second screening condition are determined as cloud security products associated with the target cloud platform; wherein the second screening condition includes at least one of the following: the IP address belongs to the IP asset library of the cloud service provider, and the IP address or ASN belongs to the ASN of the cloud service provider.

6. The method according to claim 1, characterized in that The detecting and processing the cloud security product based on the network information of the cloud security product to obtain a detection result, and determining a target cloud security product whose detection result meets a preset condition, includes: Based on the network information of the cloud security product, construct a detection data packet of the cloud security product; Based on the detection data packet, the cloud security product is detected and processed to obtain a detection result, and a cloud security product that is detected as being alive and providing security services is determined as a target cloud security product.

7. A cloud security product identification device, characterized in that: The device comprises: An acquisition module is used to acquire a list of candidate cloud security products, and acquire product information and network information of each candidate cloud security product in the list of candidate cloud security products; A screening module, configured to screen cloud security products associated with a target cloud platform in the candidate cloud security product list based on product information and network information of each candidate cloud security product; A determination module, configured to detect the cloud security product based on the network information of the cloud security product, obtain a detection result, and determine a target cloud security product whose detection result meets a preset condition; The storage module is used to store information of the target cloud security product, where the information at least includes product information and network information.

8. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 6 are implemented.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

10. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

Images