Information credential cloud security operation and maintenance method and device

Abstract

The invention relates to the technical field of operation and maintenance, and provides a credential cloud security operation and maintenance method and device. The method comprises the following steps: based on characteristics of different types of data in the credential cloud, collecting multi-platform security data in the credential cloud in an adaptive mode; integrating the multi-platform security data into a data warehouse, and performing cross-platform association on the security data in the data warehouse based on an organization field to obtain associated data; performing security operation and maintenance based on the associated data; the safety operation and maintenance comprises data retrieval, data display, safety protection, alarm notification and safety operation. According to the credential cloud security operation and maintenance method and device provided by the invention, multi-platform data intercommunication under any organization field and multi-platform data intercommunication among the organization fields can be realized, a data island is broken, and when various security operation and maintenance are carried out based on the intercommunicated associated data, multiple platforms do not need to be switched to check, collect and analyze the data, so that the security operation and maintenance efficiency is improved. The operation and maintenance efficiency is improved, and the security event occurrence frequency is reduced.

Description

Technical Field

[0001] The present application relates to the field of operation and maintenance technology, and specifically to a secure operation and maintenance method and device for a trusted cloud. Background Art

[0002] Xinchuang Cloud refers to a cloud platform independently developed with CPU and operating system as the foundation under the background of information technology application innovation. It makes overall use of software and hardware resources such as computing, storage, network, security, application support, and information resources, and gives full play to the characteristics of cloud computing virtualization, high reliability, high versatility, high scalability, and fast, elastic, on-demand self-service, to provide reliable computing, network and storage capabilities.

[0003] Since the trusted cloud includes the operation and maintenance platforms of various security devices and the management and control platforms of different cloud service providers, the data between the various platforms are not interoperable, forming data islands. As a result, the security operation and maintenance of the trusted cloud requires constant switching of multiple platforms to view, collect, and analyze data, which reduces operation and maintenance efficiency and leads to frequent security incidents. Summary of the invention

[0004] The embodiments of the present application provide a method and device for secure operation and maintenance of a trusted cloud, which are used to solve the technical problem that the data between various platforms in the trusted cloud are not interoperable, forming data islands, resulting in the need to constantly switch between multiple platforms to view, collect, and analyze data for the secure operation and maintenance of the trusted cloud, reducing operation and maintenance efficiency and leading to frequent security incidents.

[0005] In a first aspect, an embodiment of the present application provides a secure operation and maintenance method for a trusted cloud, including: Based on the characteristics of different types of data in the Xinchuang Cloud, the multi-platform security data in the Xinchuang Cloud is collected in an adaptive manner; Integrate the multi-platform security data into a data warehouse, and associate the security data in the data warehouse across platforms based on an organization field to obtain associated data; Security operation and maintenance are performed based on the associated data; the security operation and maintenance includes data retrieval, data display, security protection, alarm notification and security operation.

[0006] In one embodiment, based on the characteristics of different types of data in the trusted cloud, the multi-platform security data in the trusted cloud is collected in an adaptive manner, including: Using a search engine to collect log data and monitoring data of hardware devices in the Xinchuang cloud; the hardware devices include cloud security devices; Using the API interface to collect attribute data and instance data of cloud resource products in the Xinchuang Cloud; Use crawlers to collect attribute data and instance data of cloud security products in the Xinchuang Cloud.

[0007] In one embodiment, the cross-platform association of the security data in the data warehouse based on the organization field to obtain the associated data includes: Based on the organization field, attribute data and instance data of cloud resource products in the data warehouse are cross-platform associated to obtain cloud resource product associated data corresponding to each organization field; Based on the organization field, the attribute data and instance data of the cloud security product in the data warehouse are associated across cloud host IPs to obtain cloud security product association data corresponding to each organization field.

[0008] In one embodiment, performing data retrieval based on the associated data includes: Create a first data model using the MVC model for the associated data; The first data model is called based on the search keyword input by the user, the related associated data of the search keyword is linked by using the first data model, and the related associated data is pushed to the user.

[0009] In one embodiment, data display based on the associated data includes: The cloud security equipment includes vulnerability scanning equipment and situation awareness equipment; Acquire first log data of the vulnerability scanning device and second log data of the situation awareness device from the associated data; Based on the IP field in the first log data, the vulnerability scanning network segment in the first log data is divided into a government network segment and an Internet segment; Divide the number of high-risk ports in the first log data into corresponding government network segments and Internet segments, and obtain the number of high-risk ports corresponding to the government network segment and the number of high-risk ports corresponding to the Internet segment; Based on the time field in the first log data, the number of high-risk ports corresponding to the government network segment and the number of high-risk ports corresponding to the Internet segment are grouped and aggregated on a daily basis to obtain high-risk port data formed by the number of high-risk ports on the government network segment and the number of high-risk ports on the Internet segment every day in the past week; Based on the time field in the second log data, the target attack events in the second log data are grouped and aggregated by day to obtain the names of the attack events with the highest number of attacks within 24 hours in the past day and the high-risk event data formed by the attacked IP; the target attack events include successful attack events and failed attack events; The high-risk port data and the high-risk event data are used to create a second data model through the MVC mode; The second data model is called, the high-risk port data and the high-risk event data are linked using the second data model, and the high-risk port data and the high-risk event data are rendered as a chart for display.

[0010] In one embodiment, security protection is performed based on the associated data, including: Detecting abnormal data in the associated data; generating warning information based on the abnormal data; Parsing the alarm information to obtain key information of the alarm information; the key information includes the alarm level of the alarm information and the abnormal category of the abnormal data; Based on the alarm level and the abnormality category, generating protective measures according to preset rules; Safety protection is performed based on the protection measures.

[0011] In one embodiment, performing an alarm notification based on the associated data includes: The alarm information is sent to the 5G message terminal via the chat robot, the message gateway and the 5G message center in sequence to notify the user of the 5G message terminal of an alarm.

[0012] In one embodiment, performing security operations based on the associated data includes: The organizational fields include county, city, department, and project; Create a three-level directory of county, city, district, department, and project based on the organization field; Inputting the associated data into a safety hazard identification model to obtain safety hazard data output by the safety hazard identification model; the safety hazard identification model is obtained by training with historical associated data based on a random forest model; Labeling the potential safety hazard data to obtain labeled data; Add the annotated data, security service optimization suggestions for the annotated data, and vulnerability scanning reports to the adapted third-level directory to form a project file; Send the project files to the corresponding project leaders.

[0013] In a second aspect, an embodiment of the present application provides a secure operation and maintenance device for a trusted cloud, including: The data collection module is used to collect multi-platform security data in the Xinchuang Cloud in an adaptive manner based on the characteristics of different types of data in the Xinchuang Cloud; A data association module is used to: integrate the multi-platform security data into a data warehouse, and associate the security data in the data warehouse across platforms based on the organization field to obtain associated data; The security operation and maintenance module is used to: perform security operation and maintenance based on the associated data; the security operation and maintenance includes data retrieval, data display, security protection, alarm notification and security operation.

[0014] In one embodiment, the security operation and maintenance module includes: A data retrieval module, used to: perform data retrieval based on the associated data; A data display module, used to: display data based on the associated data; A security protection module, used to: perform security protection based on the associated data; An alarm notification module, used to: perform alarm notification based on the associated data; The security operation module is used to: perform security operations based on the associated data.

[0015] In a third aspect, an embodiment of the present application provides an electronic device comprising a processor and a memory storing a computer program, wherein when the processor executes the program, the steps of the secure operation and maintenance method of the trusted cloud computing system described in the first aspect are implemented.

[0016] In a fourth aspect, an embodiment of the present application provides a computer program product, including a computer program, which, when executed by a processor, implements the steps of the secure operation and maintenance method of the trusted cloud described in the first aspect.

[0017] In the fifth aspect, an embodiment of the present application provides a non-transitory computer-readable storage medium, including a computer program, which, when executed by a processor, implements the steps of the secure operation and maintenance method of the trusted cloud described in the first aspect.

[0018] The trusted cloud security operation and maintenance method and device provided in this application, based on the characteristics of different types of data in the trusted cloud, collects multi-platform security data in the trusted cloud in an adaptive manner, integrates the multi-platform security data into a data warehouse, and associates the security data in the data warehouse across platforms based on the organization field to obtain associated data, and performs security operation and maintenance based on the associated data, and the security operation and maintenance includes data retrieval, data display, security protection, alarm notification and security operation. This application collects multi-platform data in the trusted cloud in a targeted manner and integrates it into the same data warehouse, associates the data of different platforms in the warehouse based on the organization field, realizes the intercommunication of multi-platform data under any organization field and the intercommunication of multi-platform data between each organization field, breaks the data island, and when performing various security operations based on the intercommunication associated data, there is no need to switch multiple platforms to view, collect and analyze data, thereby improving the operation and maintenance efficiency and reducing the frequency of security incidents. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] In order to more clearly illustrate the technical solutions in the present application or the prior art, a brief introduction will be given below to the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0020] Figure 1 It is one of the flow diagrams of the secure operation and maintenance method of the Xinchuang Cloud provided in the embodiment of the present application; Figure 2 It is a schematic diagram of ECS product association data in the Xinchuang Cloud security operation and maintenance method provided in the embodiment of the present application; Figure 3 This is the second flow chart of the secure operation and maintenance method of the Xinchuang Cloud provided in the embodiment of the present application; Figure 4 This is the third flow chart of the secure operation and maintenance method of the Xinchuang Cloud provided in the embodiment of the present application; Figure 5 It is an architecture diagram of the alarm notification model in the Xinchuang Cloud security operation and maintenance method provided in the embodiment of the present application; Figure 6 It is an alarm notification interaction diagram in the Xinchuang Cloud security operation and maintenance method provided in the embodiment of the present application; Figure 7 It is a schematic diagram of an alarm notification SMS in the Xinchuang Cloud security operation and maintenance method provided in an embodiment of the present application; Figure 8 This is the fourth flow chart of the secure operation and maintenance method of the Xinchuang Cloud provided in the embodiment of the present application; Fig. 9 It is a schematic diagram of email sending in the Xinchuang Cloud security operation and maintenance method provided in the embodiment of the present application; Fig.10 It is a structural diagram of the Xinchuang Cloud security operation and maintenance device provided in an embodiment of the present application; Fig.11 It is a schematic diagram of the structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0021] In order to make the purpose, technical solutions and advantages of this application clearer, the technical solutions in this application will be clearly and completely described below in conjunction with the drawings in the embodiments of this application. Obviously, the described embodiments are part of the embodiments of this application, not all of them. Based on the embodiments in this application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0022] Figure 1 This is one of the flow charts of the secure operation and maintenance method of the Xinchuang Cloud provided in the embodiment of this application. Figure 1 , the embodiment of the present application provides a secure operation and maintenance method for a trusted cloud, which may include: 101. Based on the characteristics of different types of data in the Xinchuang Cloud, collect multi-platform security data in the Xinchuang Cloud in an adaptive manner; 102. Integrate multi-platform security data into a data warehouse, and associate the security data in the data warehouse across platforms based on organizational fields to obtain associated data; 103. Perform security operations and maintenance based on correlated data.

[0023] Security operation and maintenance includes data retrieval, data display, security protection, alarm notification and security operation.

[0024] In step 101, the multi-platform security data is not necessarily acquired directly in the corresponding platform, but can be acquired at any location where the data exists.

[0025] In step 102, data from multiple platforms can be uniformly aggregated into a fast, fully managed TB / PB-level data warehouse such as MaxCompute.

[0026] The trusted cloud security operation and maintenance method provided in this embodiment collects multi-platform security data in the trusted cloud in an adaptive manner based on the characteristics of different types of data in the trusted cloud, integrates the multi-platform security data into a data warehouse, associates the security data in the data warehouse across platforms based on the organization field, obtains associated data, and performs security operation and maintenance based on the associated data. The security operation and maintenance includes data retrieval, data display, security protection, alarm notification, and security operation. This embodiment collects multi-platform data in the trusted cloud in a targeted manner and integrates it into the same data warehouse, associates the data of different platforms in the warehouse based on the organization field, realizes the intercommunication of multi-platform data under any organization field and the intercommunication of multi-platform data between each organization field, breaks the data island, and when performing various security operations based on the intercommunication associated data, there is no need to switch multiple platforms to view, collect, and analyze data, thereby improving the operation and maintenance efficiency and reducing the frequency of security incidents.

[0027] In one embodiment, based on the characteristics of different types of data in the trusted cloud, collecting multi-platform security data in the trusted cloud in an adaptive manner may include: Use search engines to collect log data and monitoring data of hardware devices in Xinchuang Cloud; hardware devices include cloud security devices; Use the API interface to collect attribute data and instance data of cloud resource products in the Xinchuang Cloud; Use crawlers to collect attribute data and instance data of cloud security products in the Xinchuang Cloud.

[0028] The hardware devices in the Xinchuang Cloud include physical servers, switches, routers and a variety of cloud security devices, such as APT (Advanced Persistent Threat) defense devices, WAF (Web Application Firewall) devices, IPS (Intrusion Prevention System) devices, RSAS (Risk and Security Analytics System) devices, EDR (Endpoint Detection and Response), bastion host devices, situational awareness devices, vulnerability scanning devices, etc.

[0029] The log data and monitoring data of these hardware devices will be transmitted to the monitoring server and log server for storage through SNMP (Simple Network Management Protocol) and Syslog (System Log) protocols respectively. Among them, the monitoring server mainly stores the performance monitoring data of the CPU, memory, and disk of the hardware devices, as well as the status data of the fan, power supply, temperature sensor, etc.

[0030] Cloud resource products include cloud hosts, cloud load balancing, cloud databases, cloud object storage, cloud hard disks, cloud private networks, etc.

[0031] Cloud security products are security products supported by cloud security devices, which may include APT defense, WAF, IPS, RSAS, EDR, bastion host, situational awareness, vulnerability scanning, etc.

[0032] For log data and monitoring data of hardware devices, you can use search engines such as Elasticsearch to collect them in the corresponding servers; For the attribute data and instance data of cloud resource products, we can use the Restful API interface of Xinchuang Cloud, use Python program development and high-concurrency multi-threading technology to collect them; The attribute data and instance data of cloud security products can be collected on the Xinchuang Cloud website using crawlers.

[0033] This embodiment collects different types of data at different locations through various adaptation methods, and can collect security data of each platform as completely as possible.

[0034] In one embodiment, the security data in the data warehouse is associated across platforms based on the organization field to obtain associated data, which may include: Based on the organization field, attribute data and instance data of cloud resource products in the data warehouse are associated across platforms to obtain cloud resource product association data corresponding to each organization field; Based on the organization field, the attribute data and instance data of the cloud security product in the data warehouse are associated across cloud host IPs to obtain cloud security product association data corresponding to each organization field.

[0035] Cloud resource products can include four categories: ECS (Elastic Compute Service), OSS (Object Storage Service), RDS (Relational Database Service) and SLB (Server Load Balancer).

[0036] For each organization field, the attribute data and instance data of each type of cloud resource product under the organization field are obtained in the data warehouse, and the attribute data of each type of cloud resource product is associated, and the instance data of each type of cloud resource product is associated. Since these attribute data and instance data were originally data in different platforms, the association process realizes the cross-platform association of these attribute data and the cross-platform association of these instance data, thereby obtaining the associated data of each type of cloud resource product corresponding to the organization field. Figure 2 Two examples of ECS product-related data are shown, each of which includes a variety of attribute data and instance data; For each organization field, the attribute data and instance data of each cloud security product under the organization field are obtained in the data warehouse, and the attribute data of each cloud security product are associated, and the instance data of each cloud security product are associated. Since these attribute data and instance data are originally the data of cloud security products deployed under different cloud host IPs, the association process realizes the cross-cloud host IP association of these attribute data and the cross-cloud host IP association of these instance data, thereby obtaining the association data of each cloud security product corresponding to the organization field. Different cloud host IPs include private IP, NAT IP (Network Address Translation IP, Network Address Translation Public IP), SLB IP (Server LoadBalancer, Server Load Balancing Public IP), and EIP (Elastic IP, Elastic Public IP).

[0037] Furthermore, for each organizational field, the security product ordering data and security product deployment data under the organizational field can be associated to form multi-dimensional data under the organizational field, and data of other dimensions under the organizational field can be obtained based on any dimensional data.

[0038] This embodiment associates cloud resource product data across platforms and cloud security product data across cloud host IPs based on the organization field, which enables the data to be linked across platforms and host IPs, thereby improving subsequent operation and maintenance efficiency.

[0039] In one embodiment, performing data retrieval based on associated data may include: The associated data is used to create a first data model through the MVC (Model-View-Controller) mode, the first data model is called based on the search keyword input by the user, the first data model is used to link the related associated data of the search keyword, and the related associated data is pushed to the user.

[0040] Reference Figure 2 The data retrieval webpage can be built using Python language and Flask framework to ensure data security. According to the sensitivity and importance of the data, the page sets access permissions. Users need to register an account and obtain administrator approval before accessing the page. At the same time, an account expiration time is set to further ensure data security.

[0041] On this page, you can search for information about cloud resource products, including users, types, specifications, networks, and security. You can also view data such as the status and performance of cloud resource products. It also supports querying cloud security product deployment information through multiple dimensions such as users, projects, and instances. Operation and maintenance personnel do not need to log in to multiple platforms to obtain relevant data.

[0042] This embodiment constructs web pages and data models based on associated data, which can realize one-click retrieval of cloud resource product data and cloud security product data, improve data acquisition efficiency and integrity, and at the same time, set access permissions and account expiration time for the search page to ensure data security.

[0043] Figure 3 This is the second flow chart of the secure operation and maintenance method of the Xinchuang Cloud provided in the embodiment of this application. Figure 3 In one embodiment, data display based on associated data may include: Cloud security devices include vulnerability scanning devices and situational awareness devices; 301. Obtain first log data of a vulnerability scanning device and second log data of a situation awareness device from associated data; 302. Based on the IP field in the first log data, divide the vulnerability scanning network segment in the first log data into a government network segment and an Internet network segment; 303. Divide the number of high-risk ports in the first log data into corresponding government network segments and Internet network segments, and obtain the number of high-risk ports corresponding to the government network segment and the number of high-risk ports corresponding to the Internet segment; 304. Based on the time field in the first log data, the number of high-risk ports corresponding to the government network segment and the number of high-risk ports corresponding to the Internet segment are grouped and aggregated by day, and high-risk port data formed by the number of high-risk ports of the government network segment and the number of high-risk ports of the Internet segment every day in the past week are obtained; 305. Based on the time field in the second log data, group and aggregate the target attack events in the second log data by day, and obtain the names of the attack events with the highest number of attacks within 24 hours in the past day and the high-risk event data formed by the attacked IP; Target attack events include successful attack events and failed attack events; 306. Create a second data model using the high-risk port data and the high-risk event data through the MVC mode; 307 . Call the second data model, use the second data model to link the high-risk port data and the high-risk event data, and render the high-risk port data and the high-risk event data into a chart for display.

[0044] In step 302 to step 304, the part of the number of high-risk ports in the first log data belonging to the government network segment is divided into the government network segment, and the part belonging to the Internet segment is divided into the Internet segment. Then, the part of the number of high-risk ports in the government network segment belonging to each day in the past week is divided into the corresponding day, and the part of the number of high-end ports in the Internet segment belonging to each day in the past week is divided into the corresponding day. The daily data is integrated to obtain comparative data on the number of high-risk ports of the government network segment and the Internet network corresponding to each day in the past week.

[0045] In step 305, the part of the target attack event in the second log data that belongs to the daily part is divided into the corresponding day, so as to obtain all attack events within 24 hours of the past day, count the number of attacks of the same attack event, and arrange the corresponding attack event names and attacked IPs in descending order according to the number of attacks.

[0046] Among them, successful attack events usually refer to events in which the attacker has been able to penetrate or destroy the security measures of the target system and achieve its attack goals. For example, the attacker may have successfully gained unauthorized access to the system; compromised attack events usually refer to events in which the attacker has taken control of the system or caused serious damage to the system. In this case, the attacker may have established a persistent presence in the system and can remotely control the affected system to conduct malicious activities such as data theft, encryption extortion, and distributed denial of service attacks.

[0047] In step 307, charts can be displayed in various forms such as bar charts, line charts, pie charts, lists, etc. For example, a bar chart can be used to display the daily comparison data of the number of high-risk ports in the government network segment and the Internet network for high-risk port data. A list can be used to display the top ten attack event names and the attacked IP addresses in descending order according to the number of attacks within the past 24 hours for high-risk events.

[0048] This embodiment captures high-risk port data and attack event data, groups and aggregates these data, and presents them holographically in the form of charts to improve the readability of the data. It can provide operation and maintenance personnel with one-stop information on key security indicators to meet management and analysis needs at different levels.

[0049] Figure 4 This is the third flow chart of the secure operation and maintenance method of the Xinchuang Cloud provided in the embodiment of this application. Figure 4 In one embodiment, security protection based on associated data may include: 401. Detect abnormal data in the associated data; 402. Generate warning information based on abnormal data; 403. Analyze the alarm information to obtain key information of the alarm information; Key information includes the alarm level of the alarm information and the abnormal category of the abnormal data; 404. Based on the alarm level and abnormality category, generate protection measures according to preset rules; 405. Provide security protection based on protective measures.

[0050] In step 401, abnormal data may be obtained from log data and monitoring data of security devices, cloud security product instance data, and the like.

[0051] In step 403, the abnormal category may be login failure, access denied, high-risk copper leakage, etc. If there is attack data, the key information also includes the source IP and target IP of the attack.

[0052] In step 405, the protection measures may include one-click blocking of the source IP of the attack, blocking and repairing high-risk vulnerabilities, and strengthening protection against high-risk vulnerabilities.

[0053] This embodiment can automatically respond to detected abnormal data and quickly take corresponding security response measures, reducing dependence on manual work, improving the network security protection capabilities of the cloud environment, effectively reducing security risks, and ensuring users' business continuity and data security.

[0054] In one embodiment, the alarm notification based on the associated data may include: The alarm information is sent to the message terminal via the chat robot, the message gateway and the message center in sequence to notify the user of the message terminal of the alarm.

[0055] A B / S framework platform and a 5G message machine can be built on the server side, and a 5G message notification program can be developed. The ODPS (Open Data Processing Service) platform alarm data interface and the 5G message machine API can be connected to realize the mode in which alarm information is pushed by 5G messages.

[0056] Reference Figure 5 The 5G message program sends the alarm information to the chat robot, the chat robot encapsulates the alarm information and sends it to the Maap (Messaging as a Platform) message gateway, the message gateway sends the encapsulated alarm information to the 5G message center, the 5G message center converts the encapsulated alarm information into SIP (Session Initiation Protocol) message format, and finally sends it to the 5G message terminal via IMS (IP Multimedia Subsystem), 5GC (5G Core Network) and base station.

[0057] Reference Figure 6 The interaction process between the chatbot, Maap message gateway, 5G message center and 5G message terminal is as follows, where the 5G message center includes the message AS (Application Server) and the access module. IMS, 5GC and base station are omitted in this interaction: 1. The chatbot encapsulates the alarm information into an A2P (Application to Person) message and sends it to the Maap message gateway; 2. The Maap message gateway sends an OK status response to the chatbot; 3. Maap message gateway sends A2P message to message AS based on Hypertext Transfer Protocol HTTP; 4. The message AS sends a response with OK status to the Maap message gateway; 5. The message AS encapsulates the A2P message into a SIP message and sends it to the access module; 6. The access module forwards the SIP message to the 5G message terminal; 7. The 5G message terminal sends a response with a status of 200 OK to the access module; 8. The access module forwards the response with 200 OK status to the message AS; 9. The 5G message terminal sends a SIP message receipt to the access module; 10. The access module forwards the SIP message receipt to the message AS; 11. The message AS sends a response with a status of 202 ACCEPTED to the access module; 12. The access module forwards the response with 202 ACCEPTED status to the 5G message terminal; 13. The message AS sends a delivery receipt of the A2P message to the Maap message gateway; 14. The Maap message gateway sends a response with OK status to the message AS; 15. Maap message gateway forwards the delivery receipt to the chatbot; 16. The chatbot sends an OK status response to the Maap message gateway.

[0058] Reference Figure 7 ,Through the above interactions, 5G message terminals, such as mobile phones, can receive relevant SMS alarm notifications.

[0059] This embodiment uses 5G messages to send warning notifications to users, allowing users to quickly obtain the security protection status of the resources and products they use. Compared with platform viewing, it is more timely and reliable, effectively reduces the duration of failures, and can enhance user safety awareness, drive the subscription of security products, and ultimately make the business system run safely and stably, and security incidents gradually reduce.

[0060] Figure 8 This is the fourth flow chart of the secure operation and maintenance method of the Xinchuang Cloud provided in the embodiment of the present application. Figure 8 In one embodiment, performing security operations based on correlation data may include: Organization fields include county, city, department, and project; 801. Create a three-level directory of county, city, district, department, and project based on the organization field; 802. Inputting the associated data into the safety hazard identification model to obtain safety hazard data output by the safety hazard identification model; The safety hazard identification model is trained based on the random forest model using historical correlation data; 803. Label the potential safety hazard data to obtain labeled data; 804. Add the annotated data, security service optimization suggestions for the annotated data, and vulnerability scanning reports to the adapted third-level directory to form a project file; 805. Send the project files to the corresponding project leaders.

[0061] In step 801, the organization field may be a three-level field of county, city, district, department, and project, and thus a corresponding three-level directory may be created accordingly.

[0062] In step 802, before training the random forest model, the historical correlation data may be cleaned, converted, standardized, etc. to eliminate noise in the data.

[0063] In addition, the security risk identification model outputs security risk data including cloud security product configuration error data, system high-risk vulnerability data, application high-risk port data, security group non-compliance data, etc., which are not limited here. Among them, the judgment logic of security group non-compliance is that the security group policy is open for all ports and does not restrict the source IP address of the incoming traffic or the restricted source IP address segment mask is less than 24.

[0064] The use of safety hazard identification models can efficiently, accurately, real-time and intelligently locate safety hazard data, and solve the problem of error-prone manual operation and maintenance.

[0065] In step 804, Python's docx module can be used to combine the annotated data and the standardized text suggestions, and a comprehensive evaluation can be performed based on the usage of cloud security products, such as the number of cloud security products, usage rate, coverage rate, compliance rate and other indicators, to output security service optimization suggestions for the annotated data.

[0066] In step 805, the project files can be packaged and compressed and sent to the corresponding project leader in the form of an email, such as Fig. 9 shown.

[0067] In this embodiment, not only can the cloud security product service status related to the Xinchuang Cloud user business system be flexibly integrated and summarized as needed and users can be informed regularly, but also security protection can be provided to users based on cloud security best practices, such as baseline verification, vulnerability scanning, penetration testing, etc.

[0068] The following is a description of the trusted cloud security operation and maintenance device provided in the embodiment of the present application. The trusted cloud security operation and maintenance device described below and the trusted cloud security operation and maintenance method described above can be referenced to each other.

[0069] Fig.10 Schematic diagram of the structure of the secure operation and maintenance device of the Xinchuang Cloud provided in the embodiment of the present application. Fig.10, the embodiment of the present application provides a secure operation and maintenance device for a trusted cloud, which may include: The data collection module 1001 is used to collect multi-platform security data in the Xinchuang cloud in an adaptive manner based on the characteristics of different types of data in the Xinchuang cloud; The data association module 1002 is used to: integrate the multi-platform security data into a data warehouse, and perform cross-platform association on the security data in the data warehouse based on the organization field to obtain associated data; The security operation and maintenance module 1003 is used to: perform security operation and maintenance based on the associated data; the security operation and maintenance includes data retrieval, data display, security protection, alarm notification and security operation.

[0070] Among them, the security operation and maintenance module 1003 includes: A data retrieval module, used to: perform data retrieval based on the associated data; A data display module, used to: display data based on the associated data; A security protection module, used to: perform security protection based on the associated data; An alarm notification module, used to: perform alarm notification based on the associated data; The security operation module is used to: perform security operations based on the associated data.

[0071] The trusted cloud security operation and maintenance device provided in this embodiment collects multi-platform security data in the trusted cloud in an adaptive manner based on the characteristics of different types of data in the trusted cloud, integrates the multi-platform security data into a data warehouse, associates the security data in the data warehouse across platforms based on the organization field, obtains associated data, and performs security operation and maintenance based on the associated data, and the security operation and maintenance includes data retrieval, data display, security protection, alarm notification and security operation. This embodiment collects multi-platform data in the trusted cloud in a targeted manner and integrates it into the same data warehouse, associates the data of different platforms in the warehouse based on the organization field, realizes the intercommunication of multi-platform data under any organization field and the intercommunication of multi-platform data between each organization field, breaks the data island, and when performing various security operations based on the intercommunication associated data, there is no need to switch multiple platforms to view, collect and analyze data, thereby improving the operation and maintenance efficiency and reducing the frequency of security incidents.

[0072] In one embodiment, the data acquisition module 1001 is specifically used for: Using a search engine to collect log data and monitoring data of hardware devices in the Xinchuang cloud; the hardware devices include cloud security devices; Using the API interface to collect attribute data and instance data of cloud resource products in the Xinchuang Cloud; Use crawlers to collect attribute data and instance data of cloud security products in the Xinchuang Cloud.

[0073] In one embodiment, the data association module 1002 is specifically configured to: Based on the organization field, attribute data and instance data of cloud resource products in the data warehouse are cross-platform associated to obtain cloud resource product associated data corresponding to each organization field; Based on the organization field, the attribute data and instance data of the cloud security product in the data warehouse are associated across cloud host IPs to obtain cloud security product association data corresponding to each organization field.

[0074] In one embodiment, the data retrieval module is specifically used to: Create a first data model using the MVC model for the associated data; The first data model is called based on the search keyword input by the user, the related associated data of the search keyword is linked by using the first data model, and the related associated data is pushed to the user.

[0075] In one embodiment, the data display module is specifically used to: The cloud security equipment includes vulnerability scanning equipment and situation awareness equipment; Acquire first log data of the vulnerability scanning device and second log data of the situation awareness device from the associated data; Based on the IP field in the first log data, the vulnerability scanning network segment in the first log data is divided into a government network segment and an Internet segment; Divide the number of high-risk ports in the first log data into corresponding government network segments and Internet segments, and obtain the number of high-risk ports corresponding to the government network segment and the number of high-risk ports corresponding to the Internet segment; Based on the time field in the first log data, the number of high-risk ports corresponding to the government network segment and the number of high-risk ports corresponding to the Internet segment are grouped and aggregated on a daily basis to obtain high-risk port data formed by the number of high-risk ports on the government network segment and the number of high-risk ports on the Internet segment every day in the past week; Based on the time field in the second log data, the target attack events in the second log data are grouped and aggregated by day to obtain the names of the attack events with the highest number of attacks within 24 hours in the past day and the high-risk event data formed by the attacked IP; the target attack events include successful attack events and failed attack events; The high-risk port data and the high-risk event data are used to create a second data model through the MVC mode; The second data model is called, the high-risk port data and the high-risk event data are linked using the second data model, and the high-risk port data and the high-risk event data are rendered as a chart for display.

[0076] In one embodiment, the security protection module is specifically used to: Detecting abnormal data in the associated data; generating warning information based on the abnormal data; Parsing the alarm information to obtain key information of the alarm information; the key information includes the alarm level of the alarm information and the abnormal category of the abnormal data; Based on the alarm level and the abnormality category, generating protective measures according to preset rules; Safety protection is performed based on the protection measures.

[0077] In one embodiment, the alarm notification module is specifically used to: The alarm information is sent to the 5G message terminal via the chat robot, the message gateway and the 5G message center in sequence to notify the user of the 5G message terminal of an alarm.

[0078] In one embodiment, the security operation module is specifically used to: The organizational fields include county, city, department, and project; Create a three-level directory of county, city, district, department, and project based on the organization field; Inputting the associated data into a safety hazard identification model to obtain safety hazard data output by the safety hazard identification model; the safety hazard identification model is obtained by training with historical associated data based on a random forest model; Labeling the potential safety hazard data to obtain labeled data; Add the annotated data, security service optimization suggestions for the annotated data, and vulnerability scanning reports to the adapted third-level directory to form a project file; Send the project files to the corresponding project leaders.

[0079] FIG. 11 is a schematic diagram of the structure of an electronic device provided in an embodiment of the present application. Fig.11As shown, the electronic device may include: a processor 1110, a communication interface 1120, a memory 1130 and a communication bus 1140, wherein the processor 1110, the communication interface 1120, and the memory 1130 communicate with each other through the communication bus 1140. The processor 1110 may call a computer program in the memory 1130 to execute the steps of the secure operation and maintenance method of the Xinchuang Cloud, for example, including: Based on the characteristics of different types of data in the Xinchuang Cloud, the multi-platform security data in the Xinchuang Cloud is collected in an adaptive manner; Integrate the multi-platform security data into a data warehouse, and associate the security data in the data warehouse across platforms based on an organization field to obtain associated data; Security operation and maintenance are performed based on the associated data; the security operation and maintenance includes data retrieval, data display, security protection, alarm notification and security operation.

[0080] In addition, the logic instructions in the above-mentioned memory 1130 can be implemented in the form of a software functional unit and can be stored in a computer-readable storage medium when it is sold or used as an independent product. Based on this understanding, the technical solution of the present application can be essentially or partly embodied in the form of a software product that contributes to the prior art. The computer software product is stored in a storage medium, including several instructions to enable a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk, etc. Various media that can store program codes.

[0081] On the other hand, an embodiment of the present application further provides a computer program product, the computer program product including a computer program, the computer program can be stored on a non-transitory computer-readable storage medium, and when the computer program is executed by a processor, the computer can perform the steps of the secure operation and maintenance method of the Xinchuang Cloud provided in the above embodiments, for example, including: Based on the characteristics of different types of data in the Xinchuang Cloud, the multi-platform security data in the Xinchuang Cloud is collected in an adaptive manner; Integrate the multi-platform security data into a data warehouse, and associate the security data in the data warehouse across platforms based on an organization field to obtain associated data; Security operation and maintenance are performed based on the associated data; the security operation and maintenance includes data retrieval, data display, security protection, alarm notification and security operation.

[0082] On the other hand, an embodiment of the present application further provides a non-transitory computer-readable storage medium on which a computer program is stored, and the computer program is used to enable a processor to execute the steps of the secure operation and maintenance method of the Xinchuang Cloud provided in the above embodiments, for example, including: Based on the characteristics of different types of data in the Xinchuang Cloud, the multi-platform security data in the Xinchuang Cloud is collected in an adaptive manner; Integrate the multi-platform security data into a data warehouse, and associate the security data in the data warehouse across platforms based on an organization field to obtain associated data; Security operation and maintenance are performed based on the associated data; the security operation and maintenance includes data retrieval, data display, security protection, alarm notification and security operation.

[0083] The non-transitory computer-readable storage medium can be any available medium or data storage device that can be accessed by the processor, including but not limited to magnetic storage (such as floppy disks, hard disks, magnetic tapes, magneto-optical disks (MO), etc.), optical storage (such as CD, DVD, BD, HVD, etc.), and semiconductor storage (such as ROM, EPROM, EEPROM, non-volatile memory (NAND FLASH), solid-state drive (SSD)), etc.

[0084] The device embodiments described above are merely illustrative, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this embodiment. Ordinary technicians in this field can understand and implement it without paying creative labor.

[0085] Through the description of the above implementation methods, those skilled in the art can clearly understand that each implementation method can be implemented by means of software plus a necessary general hardware platform, and of course, can also be implemented by hardware. Based on this understanding, the above technical solution is essentially or the part that contributes to the prior art can be embodied in the form of a software product, and the computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, a disk, an optical disk, etc., including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in each embodiment or some parts of the embodiments.

[0086] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present application, rather than to limit it. Although the present application has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present application.

Claims

1. A secure operation and maintenance method for a trusted cloud, characterized in that: include: Based on the characteristics of different types of data in the Xinchuang Cloud, the multi-platform security data in the Xinchuang Cloud is collected in an adaptive manner; Integrate the multi-platform security data into a data warehouse, and associate the security data in the data warehouse across platforms based on an organization field to obtain associated data; Security operation and maintenance are performed based on the associated data; the security operation and maintenance includes data retrieval, data display, security protection, alarm notification and security operation.

2. The secure operation and maintenance method of the Xinchuang Cloud according to claim 1 is characterized in that: The method of collecting multi-platform security data in the Xinchuang Cloud in an adaptive manner based on the characteristics of different types of data in the Xinchuang Cloud includes: Using a search engine to collect log data and monitoring data of hardware devices in the Xinchuang cloud; the hardware devices include cloud security devices; Using the API interface to collect attribute data and instance data of cloud resource products in the Xinchuang Cloud; Use crawlers to collect attribute data and instance data of cloud security products in the Xinchuang Cloud.

3. The secure operation and maintenance method of the Xinchuang Cloud according to claim 2 is characterized in that: The cross-platform association of the security data in the data warehouse based on the organization field to obtain the associated data includes: Based on the organization field, attribute data and instance data of cloud resource products in the data warehouse are cross-platform associated to obtain cloud resource product associated data corresponding to each organization field; Based on the organization field, the attribute data and instance data of the cloud security product in the data warehouse are associated across cloud host IPs to obtain cloud security product association data corresponding to each organization field.

4. The secure operation and maintenance method of the Xinchuang Cloud according to claim 1 is characterized in that: Performing data retrieval based on the associated data includes: Create a first data model using the MVC model for the associated data; The first data model is called based on the search keyword input by the user, the related associated data of the search keyword is linked by using the first data model, and the related associated data is pushed to the user.

5. The secure operation and maintenance method of the Xinchuang Cloud according to claim 2 is characterized in that: The data display is performed based on the associated data, including: The cloud security equipment includes vulnerability scanning equipment and situation awareness equipment; Acquire first log data of the vulnerability scanning device and second log data of the situation awareness device from the associated data; Based on the IP field in the first log data, the vulnerability scanning network segment in the first log data is divided into a government network segment and an Internet segment; Divide the number of high-risk ports in the first log data into corresponding government network segments and Internet segments, and obtain the number of high-risk ports corresponding to the government network segment and the number of high-risk ports corresponding to the Internet segment; Based on the time field in the first log data, the number of high-risk ports corresponding to the government network segment and the number of high-risk ports corresponding to the Internet segment are grouped and aggregated on a daily basis to obtain high-risk port data formed by the number of high-risk ports on the government network segment and the number of high-risk ports on the Internet segment every day in the past week; Based on the time field in the second log data, the target attack events in the second log data are grouped and aggregated by day to obtain the names of the attack events with the highest number of attacks within 24 hours in the past day and the high-risk event data formed by the attacked IP; the target attack events include successful attack events and failed attack events; The high-risk port data and the high-risk event data are used to create a second data model through the MVC mode; The second data model is called, the high-risk port data and the high-risk event data are linked using the second data model, and the high-risk port data and the high-risk event data are rendered as a chart for display.

6. The secure operation and maintenance method of the Xinchuang Cloud according to claim 1 is characterized in that: Security protection is performed based on the associated data, including: Detecting abnormal data in the associated data; generating warning information based on the abnormal data; Parsing the alarm information to obtain key information of the alarm information; the key information includes the alarm level of the alarm information and the abnormal category of the abnormal data; Based on the alarm level and the abnormality category, generating protective measures according to preset rules; Safety protection is performed based on the protection measures.

7. The secure operation and maintenance method of the Xinchuang Cloud according to claim 6 is characterized in that: Providing an alarm notification based on the associated data includes: The alarm information is sent to the message terminal via the chat robot, the message gateway and the message center in sequence to notify the user of the message terminal of the alarm.

8. The secure operation and maintenance method of the Xinchuang Cloud according to claim 1 is characterized in that: Perform security operations based on the associated data, including: The organizational fields include county, city, department, and project; Create a three-level directory of county, city, district, department, and project based on the organization field; Inputting the associated data into a safety hazard identification model to obtain safety hazard data output by the safety hazard identification model; the safety hazard identification model is obtained by training with historical associated data based on a random forest model; Labeling the potential safety hazard data to obtain labeled data; Add the annotated data, security service optimization suggestions for the annotated data, and vulnerability scanning reports to the adapted third-level directory to form a project file; Send the project files to the corresponding project leaders.

9. A secure operation and maintenance device for a trusted cloud, characterized in that: include: The data collection module is used to collect multi-platform security data in the Xinchuang Cloud in an adaptive manner based on the characteristics of different types of data in the Xinchuang Cloud; A data association module is used to: integrate the multi-platform security data into a data warehouse, and associate the security data in the data warehouse across platforms based on the organization field to obtain associated data; The security operation and maintenance module is used to: perform security operation and maintenance based on the associated data; the security operation and maintenance includes data retrieval, data display, security protection, alarm notification and security operation.

10. The secure operation and maintenance device of the Xinchuang Cloud according to claim 9 is characterized in that: The security operation and maintenance module includes: A data retrieval module, used to: perform data retrieval based on the associated data; A data display module, used to: display data based on the associated data; A security protection module, used to: perform security protection based on the associated data; An alarm notification module, used to: perform alarm notification based on the associated data; The security operation module is used to: perform security operations based on the associated data.

11. An electronic device comprising a processor and a memory storing a computer program, characterized in that: When the processor executes the computer program, it implements the steps of the secure operation and maintenance method of the trusted cloud computing platform as described in any one of claims 1 to 8.

12. A computer program product, comprising a computer program, characterized in that When the computer program is executed by the processor, the steps of the secure operation and maintenance method of the trusted cloud computing system described in any one of claims 1 to 8 are implemented.

13. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by the processor, the steps of the secure operation and maintenance method of the trusted cloud computing system described in any one of claims 1 to 8 are implemented.

Images