Method, device and equipment for discovering unexpected access path of cloud platform system

Abstract

The invention relates to the technical field of network security, and discloses a method, a device and equipment for discovering an unexpected access path of a cloud platform system, and the method comprises the steps: obtaining all nodes in the cloud platform system, and screening from all nodes according to a full access control rule to obtain an entrance node; traversing all access paths of each entry node by taking each entry node as a starting point; and respectively calculating a path credible value of each access path, and determining an unexpected access path according to a size relationship between the path credible value and a preset credible threshold value. According to the method, the cloud platform system can comprehensively and efficiently discover the unexpected access path through full-path search and calculation of the credible value of the path, so that potential risks are timely discovered, the safety and the reliability of the cloud platform system are improved, full-path search can adapt to dynamic changes of system topology and changes of access behaviors, and the safety of the system is improved. The method has better flexibility and adaptability, and the safety protection capability of the system is improved.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a method, device and equipment for discovering unexpected access paths of a cloud platform system. Background Art

[0002] With the popularity and development of cloud computing, enterprises and individuals are increasingly dependent on the various services provided by cloud platforms. Cloud platforms provide convenient resource sharing and service distribution, so that computing, storage, network and other resources can be used and expanded on demand. Systems on cloud platforms usually include multiple components (such as servers, databases, applications, etc.) and multiple services (such as storage services, computing services, network services, etc.), and these components and services need to communicate and interact with each other. In order to control and protect these communications and interactions, cloud platforms usually set a series of access control rules. However, due to the complexity and dynamism of cloud platforms, these rules are often difficult to set and maintain completely correctly, which brings challenges to system configuration and maintenance, especially in terms of security.

[0003] A common problem is the emergence of unexpected access paths, which are access paths from one node to another that were not foreseen during system design but may appear during operation. These paths may be exploited by attackers to threaten the system. For example, attackers may steal sensitive data or launch internal attacks through these paths.

[0004] Currently, there are some tools and methods for security auditing of cloud platforms, including rule-based access control systems, network traffic analysis tools, log analysis tools, etc. However, these tools and methods mainly focus on the analysis of a single node or a single network flow, and usually cannot discover unexpected access paths at the system level.

[0005] For example, rule-based access control systems can help administrators set and manage access control rules, but these rules are usually based on static source / destination / port / protocol tuples and cannot handle dynamically changing access paths. Network traffic analysis tools and log analysis tools can help administrators monitor and analyze network traffic and system logs, but they usually cannot provide a global view and cannot discover complex access paths. Therefore, how to effectively discover and manage unexpected access paths on cloud platforms is an important issue in the field of cloud computing security. Summary of the invention

[0006] In view of this, the present invention provides a method, device and equipment for discovering unexpected access paths of a cloud platform system to solve the problem of being unable to effectively discover and manage unexpected access paths on the cloud platform.

[0007] In a first aspect, the present invention provides a method for discovering unexpected access paths of a cloud platform system, the method comprising:

[0008] Obtain all nodes in the cloud platform system, and filter out entry nodes from all nodes according to the full access control rules;

[0009] Take each entry node as the starting point and traverse all access paths of each entry node;

[0010] The path credibility value of each access path is calculated respectively, and the unexpected access path is determined according to the magnitude relationship between the path credibility value and a preset credibility threshold.

[0011] The method for discovering unexpected access paths of a cloud platform system provided by the present invention can comprehensively and efficiently discover unexpected access paths through full-path search and calculation of path trust values, thereby timely discovering potential risks and improving the security and reliability of the cloud platform system. The full-path search can adapt to dynamic changes in system topology and changes in access behavior, has better flexibility and adaptability, and improves the security protection capability of the system.

[0012] In an optional implementation, each entry node is used as a starting point, and all access paths of each entry node are traversed, including:

[0013] Obtain the full access control rules of the cloud platform system, and determine the access edges and jump edges between all nodes in the cloud platform system according to the full access control rules;

[0014] Each entry node is taken as a starting point, and all access paths of each entry node are traversed based on the access edges and jump edges between all nodes. The access path includes at least one access edge or at least one jump edge.

[0015] In an optional implementation, traversing all access paths of each entry node based on access edges and jump edges between all nodes includes:

[0016] Determine the adjacent nodes of the starting point based on the access edges and jump edges between all nodes, and add the adjacent nodes to the access path list;

[0017] Recursively traverse the next adjacent node of the adjacent node until the access path cannot be further expanded. The access paths in the access path list are all the access paths starting from the starting point. The access paths do not include the paths with loops.

[0018] Take each entry node as the starting point, repeatedly determine the adjacent nodes of the starting point based on the access edges and jump edges between all nodes, add the adjacent nodes to the access path list, recursively traverse the next adjacent node of the adjacent node until the access path can no longer be expanded, and obtain all access paths for each entry node.

[0019] The method for discovering unexpected access paths of a cloud platform system provided by the present invention can quickly find all possible access paths in a complex cloud platform system through efficient path search capabilities, thereby reducing the workload of manual configuration, saving time and human resources. The access paths are effective and non-repetitive, and through full-path search, unexpected access paths can be comprehensively discovered, thereby improving the security of the system.

[0020] In an optional implementation, the access edge includes: an edge between a first node and a second node, the first node being able to access the second node;

[0021] The jump edge includes: an edge between a third node and a fourth node, the third node can jump to the fourth node, or the third node can execute a command on the fourth node.

[0022] The method for discovering unexpected access paths of a cloud platform system provided by the present invention clearly defines the access relationship between system components, accurately describes the access and jump relationship between nodes, enhances the comprehensibility and operability of the system, and provides a basis for subsequent path search through concept definition and edge establishment, so that the system can more efficiently calculate path trust values ​​and evaluate paths.

[0023] In an optional implementation, calculating the path credibility value of each access path includes:

[0024] Get the number of nodes, access edges, and jump edges of each access path;

[0025] The path credibility value of each access path is calculated based on the number of nodes and preset node weights, the number of access edges and preset access edge weights, and the number of jump edges and preset jump edge weights of each access path.

[0026] In an optional implementation, determining the unexpected access path according to the magnitude relationship between the path credibility value and a preset credibility threshold value includes:

[0027] If the path credibility value is greater than a preset credibility threshold, the access path corresponding to the path credibility value is an unexpected access path.

[0028] The method for discovering unexpected access paths of a cloud platform system provided by the present invention comprehensively considers the number of nodes, the number of access edges and the number of jump edges of the path, evaluates the access path by calculating the path credibility value of each access path, quantifies the credibility of the access path, and identifies unexpected access paths with a credibility higher than the threshold by setting a threshold, reminding system administrators to focus on possible security risks. The weights and thresholds can be adjusted according to specific needs, and can be flexibly adapted to different system environments and security requirements.

[0029] In an optional embodiment, the method further includes:

[0030] Obtain access log data and security event data of the cloud platform system;

[0031] The access log data and security event data are used as sample sets, and the model is trained using the sample sets to obtain an unexpected access path recognition model;

[0032] The unexpected access path identification model is used to identify all access paths of each entry node, and the unexpected access path of each entry node is determined.

[0033] The method for discovering unexpected access paths of a cloud platform system provided by the present invention utilizes historical data to train an unexpected access path identification model, utilizes a machine learning model to identify unexpected access paths, improves the accuracy of identifying unexpected access paths, provides more accurate path evaluation and risk warning, and further improves the security and reliability of the cloud platform system.

[0034] In a second aspect, the present invention provides a device for discovering unexpected access paths of a cloud platform system, the device comprising:

[0035] The node acquisition module is used to obtain all nodes in the cloud platform system and filter the entry nodes from all nodes according to the full access control rules;

[0036] The path traversal module is used to take each entry node as a starting point and traverse all access paths of each entry node;

[0037] The unexpected access path determination module is used to calculate the path credibility value of each access path respectively, and determine the unexpected access path according to the magnitude relationship between the path credibility value and a preset credibility threshold.

[0038] In a third aspect, the present invention provides a computer device, comprising: a memory and a processor, the memory and the processor being communicatively connected to each other, the memory storing computer instructions, and the processor executing the method of the first aspect or any corresponding embodiment thereof by executing the computer instructions.

[0039] In a fourth aspect, the present invention provides a computer-readable storage medium having computer instructions stored thereon, the computer instructions being used to cause a computer to execute the method of the first aspect or any corresponding embodiment thereof. BRIEF DESCRIPTION OF THE DRAWINGS

[0040] In order to more clearly illustrate the specific implementation methods of the present invention or the technical solutions in the prior art, the drawings required for use in the specific implementation methods or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are some implementation methods of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0041] Figure 1 It is a flowchart of a method for discovering unexpected access paths of a cloud platform system according to an embodiment of the present invention;

[0042] Figure 2 It is a flowchart of another method for discovering unexpected access paths of a cloud platform system according to an embodiment of the present invention;

[0043] Figure 3 It is a structural diagram of access paths between nodes in a method for discovering unexpected access paths in a cloud platform system according to an embodiment of the present invention;

[0044] Figure 4 is a structural block diagram of a device for discovering unexpected access paths of a cloud platform system according to an embodiment of the present invention;

[0045] Figure 5 It is a schematic diagram of the hardware structure of a computer device according to an embodiment of the present invention. DETAILED DESCRIPTION

[0046] In order to make the purpose, technical solution and advantages of the embodiments of the present invention clearer, the technical solution in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative work are within the scope of protection of the present invention.

[0047] The embodiment of the present invention provides a method for discovering unexpected access paths in a cloud platform system, by analyzing the access control rules and jumpable entries of the cloud system components, and calculating and evaluating the trusted values ​​of all access paths to determine unexpected access paths, so as to achieve the effect of actively discovering unexpected access paths in the cloud platform system. The embodiment of the present invention is suitable for scenarios where complex systems are built on cloud platforms, including large-scale distributed applications, microservice architectures, containerized deployments, etc. The network element devices involved may be cloud hosts, containers, load balancers, etc., and each network element device is interconnected through a network.

[0048] According to an embodiment of the present invention, an embodiment of a method for discovering unexpected access paths of a cloud platform system is provided. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and although a logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0049] In this embodiment, a method for discovering unexpected access paths of a cloud platform system is provided, which can be used in the above-mentioned computer system. Figure 1 is a flow chart of a method for discovering unexpected access paths of a cloud platform system according to an embodiment of the present invention. Figure 1 As shown, the process includes the following steps:

[0050] Step S101, obtain all nodes in the cloud platform system, and filter out entry nodes from all nodes according to full access control rules.

[0051] Specifically, the cloud platform system includes multiple cloud system components. Cloud system components refer to various services, host nodes and other related software and hardware components running on the cloud platform. Each cloud system component can serve as an internal node of a cloud platform system. In addition to internal nodes, the nodes in the cloud platform system also include external nodes, that is, devices or network nodes outside the cloud platform system, such as user terminal devices or external networks.

[0052] Full access control rules refer to the complete set of access control rules between system components on the cloud, including but not limited to: source Internet Protocol Address (IP address), destination IP address, port number, protocol and other information.

[0053] Not all nodes in the cloud platform system can be used as entry nodes. It is necessary to select nodes or services with traffic transfer functions from all nodes as entry nodes according to the full access control rules, such as cloud hosts, reverse proxy servers, load balancers, etc. with Secure Shell (SSH) enabled.

[0054] Step S102: taking each entry node as a starting point, traversing all access paths of each entry node.

[0055] Specifically, for each internal or external entry node as the starting point, traverse the entire path to search, calculate all access paths of each entry node, and the cloud platform system's total access path set includes all access paths of all entry nodes. For example, there are three entry nodes: the first entry node, the second entry node, and the third entry node. Traverse all access paths of the first entry node to obtain 100 access paths of the first entry node, traverse all access paths of the second entry node to obtain 200 access paths of the first entry node, and traverse all access paths of the third entry node to obtain 150 access paths of the first entry node. Then the cloud platform system's total access path set includes 450 access paths.

[0056] Step S103, respectively calculating the path credibility value of each access path, and determining the unexpected access path according to the magnitude relationship between the path credibility value and a preset credibility threshold.

[0057] Specifically, for each access path, the path trust value of the access path is calculated based on the number of nodes, the number of access edges and the number of jump edges in the path. The size of the preset trust threshold is determined based on the actual situation of the cloud platform system, including but not limited to the number of nodes, the access method between nodes, whether there is a jump, etc.

[0058] The method for discovering unexpected access paths of a cloud platform system provided in this embodiment enables the cloud platform system to comprehensively and efficiently discover unexpected access paths through full-path search and calculation of path trust values, thereby timely discovering potential risks and improving the security and reliability of the cloud platform system. The full-path search can adapt to dynamic changes in system topology and changes in access behavior, has better flexibility and adaptability, and improves the security protection capabilities of the system.

[0059] In some optional embodiments, the method further comprises:

[0060] Obtain access log data and security event data of the cloud platform system.

[0061] Specifically, for all access paths, machine learning algorithms can be introduced to optimize the calculation and evaluation of access paths, obtain historical access log data and known security event data, and preprocess the historical access log data and known security event data to obtain access log data and security event data that meet the sample data requirements.

[0062] The access log data and security event data are used as sample sets, and the model is trained using the sample sets to obtain an unexpected access path recognition model.

[0063] Specifically, the access log data and security event data are used as sample sets, and the sample sets are divided into training sets and test sets according to a preset ratio. The training set is used to train the machine learning model, and the test set is used to test the trained learning model until the model converges to obtain an unexpected access path identification model.

[0064] The unexpected access path identification model is used to identify all access paths of each entry node, and the unexpected access path of each entry node is determined.

[0065] Specifically, all access paths are input into the unexpected access paths in sequence, and are identified respectively to obtain the unexpected access path of each entry node. The unexpected access paths of all entry nodes constitute the unexpected access path of the entire cloud platform system.

[0066] The method for discovering unexpected access paths of a cloud platform system provided in this embodiment uses historical data to train an unexpected access path identification model, uses a machine learning model to identify unexpected access paths, improves the accuracy of identifying unexpected access paths, provides more accurate path evaluation and risk warning, and further improves the security and reliability of the cloud platform system.

[0067] In this embodiment, a method for discovering unexpected access paths of a cloud platform system is provided, which can be used in the above-mentioned computer system. Figure 2 is a flow chart of a method for discovering unexpected access paths of a cloud platform system according to an embodiment of the present invention. Figure 2 As shown, the process includes the following steps:

[0068] Step S201, obtain all nodes in the cloud platform system, and filter out the entry node from all nodes according to the full access control rules. Figure 1 Step S101 of the illustrated embodiment will not be described in detail here.

[0069] Step S202: taking each entry node as a starting point, traversing all access paths of each entry node.

[0070] Specifically, the above step S202 includes:

[0071] Step S2021, obtain the full access control rules of the cloud platform system, and determine the access edges and jump edges between all nodes in the cloud platform system according to the full access control rules.

[0072] Specifically, the full access control rules of the cloud platform system include but are not limited to: source IP address, destination IP address, port number, protocol and other information. According to the full access control rules, the access edges that can be accessed and the jump edges that can be jumped between all nodes can be determined.

[0073] Step S2022: taking each entry node as a starting point, traversing all access paths of each entry node based on the access edges and jump edges between all nodes, wherein the access path includes at least one access edge or at least one jump edge.

[0074] Specifically, access to the cloud platform system must go through the entry node, so each entry node is taken as the starting point, and the entire access path of each entry node is determined based on the access edges and jump edges between all nodes. The access path of the entry node indicates that the entry node can reach other nodes through access edges or jump edges, so the access path includes at least one access edge or at least one jump edge.

[0075] In some optional implementations, the access edge includes: an edge between a first node and a second node, and the first node can access the second node.

[0076] Specifically, among all nodes, if a first node can access a port of a second node, it means that there is an access edge between the first node and the second node.

[0077] The jump edge includes: an edge between a third node and a fourth node, the third node can jump to the fourth node, or the third node can execute a command on the fourth node.

[0078] Specifically, among all nodes, if the third node can jump to the fourth node through SSH or the like, or the third node can execute any command of the third node on the fourth node, it indicates that there is a jump edge between the third node and the fourth node.

[0079] According to the above definitions of access edges and jump edges, the access edges and jump edges between all nodes can be determined.

[0080] The method for discovering unexpected access paths of a cloud platform system provided in this embodiment clearly defines the access relationship between system components, accurately describes the access and jump relationship between nodes, enhances the comprehensibility and operability of the system, and provides a basis for subsequent full-path search through concept definition and edge establishment, enabling the system to more efficiently calculate path trust values ​​and evaluate paths.

[0081] In some optional implementations, the above step S2022 includes:

[0082] Step a1, determine the adjacent nodes of the starting point according to the access edges and jump edges between all nodes, and add the adjacent nodes to the access path list.

[0083] Specifically, the adjacent nodes of the starting point are determined based on the access edges and jump edges between all nodes. If there is an access edge or a jump edge between the starting point and the adjacent node, the adjacent node is added to the access path list, and the starting point to the adjacent node is an access path of the starting point. Figure 3 As shown, taking the first external node as the starting point, there is an access edge between it and the first internal node, and there is a jump edge between it and the second internal node. Then the first internal node and the second internal node are both adjacent nodes of the first external node. This is only an example, but not limited to this.

[0084] Step a2, recursively traverse the next adjacent node of the adjacent node until the access path cannot be further extended, and the access paths in the access path list are all access paths as the starting point, and the access paths do not include paths with loops.

[0085] Specifically, recursively traverse the next adjacent node of the adjacent node, such as Figure 3 As shown, the next adjacent node of the first internal node is the second internal node, and the next adjacent node of the second internal node is the third internal node. Then, all access paths starting from the first external node include: the first external node-the first internal node-the second internal node-the third internal node, the first external node-the second internal node-the third internal node, for example only, but not limited thereto. If a loop appears in the access path, it means that the access path has returned to the starting point, and there is no need to calculate and evaluate the path trust value. In addition, when different entry nodes are used as starting points, the path with loops may be repeated. Therefore, when traversing all access paths of each entry node, the path with loops is screened out to reduce subsequent calculations and analysis and save computing resources.

[0086] Step a3, take each entry node as the starting point, repeatedly determine the adjacent nodes of the starting point based on the access edges and jump edges between all nodes, and add the adjacent nodes to the access path list, recursively traverse the next adjacent node of the adjacent node until the access path cannot be further expanded, and obtain all access paths for each entry node.

[0087] Specifically, define SP(x) as the set of all reachable paths from entry node x. Assuming there is a jump edge from y to x, for each element path of SP(x) x ∈SP(x), the path x +path [y,x] Add to SP(y), that is:

[0088] path x +path [y,x] ∈SP(y), where path [y,x]It represents the jump edge from y to x, that is, the path from y to x, and addition represents the path connection operation.

[0089] If there is a visited edge from x to y, then the path path [x,y] It belongs to the SP(x) set. During the calculation process, it is necessary to eliminate the paths with loops. After traversing all access paths of each entry node, the total access path set S of the cloud platform system is calculated, that is: S = SP(x_1)∪SP(x_2)∪...SP(x_n).

[0090] The method for discovering unexpected access paths of a cloud platform system provided in this embodiment can quickly find all possible access paths in a complex cloud platform system through efficient path search capabilities, thereby reducing the workload of manual configuration, saving time and human resources. In addition, the access paths are effective and non-repetitive, and through full-path search, unexpected access paths can be comprehensively discovered, thereby improving the security of the system.

[0091] Step S203, respectively calculating the path credibility value of each access path, and determining the unexpected access path according to the magnitude relationship between the path credibility value and a preset credibility threshold.

[0092] Specifically, the above step S203 includes:

[0093] Step S2031, obtaining the number of nodes, the number of access edges, and the number of jump edges of each access path.

[0094] Specifically, each element in the set of all access paths of the cloud platform system is an access path. For each access path, the number of nodes, the number of access edges, and the number of jump edges included in the access path are first determined.

[0095] Step S2032, calculating the path credibility value of each access path according to the number of nodes and preset node weights, the number of access edges and preset access edge weights, and the number of jump edges and preset jump edge weights of each access path.

[0096] Specifically, the formula for calculating the path trust value of the access path is as follows:

[0097] Socre path(n) =NumNode(n)×W1+NumAccwssEdge(n)×W2+NumJumpEdge(n)×W3

[0098] Among them, Socre path(n)represents the path trust value of the nth access path, NumNode(n) represents the number of nodes included in the nth access path, W1 represents the weight of the nodes in the nth access path, NumAccwssEdge(n) represents the number of access edges included in the nth access path, W2 represents the weight of the access edges in the nth access path, NumJumpEdge(n) represents the number of jump edges included in the nth access path, and W3 represents the weight of the jump edges in the nth access path. W1, W2, and W3 are adjustable weights. The weights of nodes, access edges, and jump edges are related to the business form of the cloud platform system, the access method to each node, whether there is a jump, etc. For example, if a cloud platform system has a large number of nodes, but only a small number of nodes are actually used, the weight of the nodes can be set smaller. This is just an example, but it is not limited to this.

[0099] Step S2033: If the path credibility value is greater than the preset credibility threshold, the access path corresponding to the path credibility value is an unexpected access path.

[0100] Specifically, if the path credibility value is greater than a preset credibility threshold, the access path corresponding to the path credibility value is untrustworthy and is an unexpected access path.

[0101] The method for discovering unexpected access paths of a cloud platform system provided in this embodiment comprehensively considers the number of nodes, the number of access edges, and the number of jump edges of the path, evaluates the access path by calculating the path credibility value of each access path, quantifies the credibility of the access path, and identifies unexpected access paths with a credibility higher than the threshold by setting a threshold, reminding system administrators to focus on possible security risks. The weights and thresholds can be adjusted according to specific needs to flexibly adapt to different system environments and security requirements.

[0102] In this embodiment, a device for discovering unexpected access paths of a cloud platform system is also provided, which is used to implement the above-mentioned embodiments and preferred implementation modes, and will not be repeated hereafter. As used below, the term "module" can implement a combination of software and / or hardware for a predetermined function. Although the devices described in the following embodiments are preferably implemented in software, the implementation of hardware, or a combination of software and hardware, is also possible and conceivable.

[0103] This embodiment provides a device for discovering unexpected access paths of a cloud platform system, such as Figure 4 As shown, including:

[0104] The node acquisition module 401 is used to acquire all nodes in the cloud platform system and filter the entry nodes from all nodes according to the full access control rules.

[0105] The path traversal module 402 is used to take each entry node as a starting point and traverse all access paths of each entry node.

[0106] The unexpected access path determination module 403 is used to calculate the path credibility value of each access path respectively, and determine the unexpected access path according to the magnitude relationship between the path credibility value and a preset credibility threshold.

[0107] In some optional implementations, the path traversal module 402 includes:

[0108] The access and jump determination unit is used to obtain the full access control rules of the cloud platform system and determine the access edges and jump edges between all nodes in the cloud platform system according to the full access control rules.

[0109] The access path traversal unit is used to take each entry node as a starting point and traverse all access paths of each entry node based on the access edges and jump edges between all nodes. The access path includes at least one access edge or at least one jump edge.

[0110] In some optional implementations, the access path traversal unit includes:

[0111] The adjacent node determination subunit is used to determine the adjacent nodes of the starting point according to the access edges and jump edges between all nodes, and add the adjacent nodes to the access path list.

[0112] The path extension subunit is used to recursively traverse the next adjacent node of the adjacent node until the access path cannot be further extended. The access paths in the access path list are all access paths as the starting point, and the access paths do not include paths with loops.

[0113] The full path traversal subunit is used to take each entry node as the starting point, repeatedly determine the adjacent nodes of the starting point based on the access edges and jump edges between all nodes, add the adjacent nodes to the access path list, recursively traverse the next adjacent node of the adjacent node until the access path cannot be further expanded, and obtain the entire access path of each entry node.

[0114] In some optional implementations, the unexpected access path determination module 403 includes:

[0115] The quantity acquisition unit is used to obtain the number of nodes, the number of access edges, and the number of jump edges of each access path.

[0116] The path credibility calculation unit is used to calculate the path credibility value of each access path according to the number of nodes and preset node weights, the number of access edges and preset access edge weights, and the number of jump edges and preset jump edge weights of each access path.

[0117] The path analysis unit is used to determine that if the path credibility value is greater than a preset credibility threshold, then the access path corresponding to the path credibility value is an unexpected access path.

[0118] The further functional description of each of the above modules and units is the same as that of the above corresponding embodiments and will not be repeated here.

[0119] The cloud platform system unexpected access path discovery device in this embodiment is presented in the form of a functional unit, where the unit refers to an ASIC (Application Specific Integrated Circuit) circuit, a processor and memory that executes one or more software or fixed programs, and / or other devices that can provide the above functions.

[0120] The embodiment of the present invention also provides a computer device having the above Figure 4 The cloud platform system shown is a device for discovering unexpected access paths.

[0121] See also Figure 5 , Figure 5 is a schematic diagram of the structure of a computer device provided by an optional embodiment of the present invention, such as Figure 5 As shown, the computer device includes: one or more processors 10, a memory 20, and interfaces for connecting various components, including high-speed interfaces and low-speed interfaces. Various components are connected to each other using different buses for communication, and can be installed on a common mainboard or installed in other ways as needed. The processor can process the instructions executed in the computer device, including instructions stored in or on the memory to display the graphical information of the GUI on an external input / output device (such as, a display device coupled to the interface). In some optional embodiments, if necessary, multiple processors and / or multiple buses can be used together with multiple memories and multiple memories. Similarly, multiple computer devices can be connected, and each device provides some necessary operations (for example, as a server array, a group of blade servers, or a multi-processor system). Figure 5 A processor 10 is taken as an example.

[0122] The processor 10 may be a central processing unit, a network processor or a combination thereof. The processor 10 may further include a hardware chip. The hardware chip may be a dedicated integrated circuit, a programmable logic device or a combination thereof. The programmable logic device may be a complex programmable logic device, a field programmable gate array, a general purpose array logic or any combination thereof.

[0123] The memory 20 stores instructions executable by at least one processor 10, so that the at least one processor 10 executes the method shown in the above embodiment.

[0124] The memory 20 may include a program storage area and a data storage area, wherein the program storage area may store an operating system, an application required for at least one function; the data storage area may store data created according to the use of the computer device, etc. In addition, the memory 20 may include a high-speed random access memory, and may also include a non-transient memory, such as at least one disk storage device, a flash memory device, or other non-transient solid-state storage device. In some optional embodiments, the memory 20 may optionally include a memory remotely arranged relative to the processor 10, and these remote memories may be connected to the computer device via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0125] The memory 20 may include a volatile memory, such as a random access memory; the memory may also include a non-volatile memory, such as a flash memory, a hard disk or a solid state drive; the memory 20 may also include a combination of the above types of memory.

[0126] The computer device further comprises a communication interface 30 for the computer device to communicate with other devices or a communication network.

[0127] The embodiment of the present invention also provides a computer-readable storage medium. The method according to the embodiment of the present invention can be implemented in hardware, firmware, or can be implemented as a computer code that can be recorded in a storage medium, or can be implemented as a computer code that is originally stored in a remote storage medium or a non-temporary machine-readable storage medium and will be stored in a local storage medium through a network download, so that the method described herein can be stored in such software processing on a storage medium using a general-purpose computer, a dedicated processor, or programmable or dedicated hardware. Among them, the storage medium can be a magnetic disk, an optical disk, a read-only storage memory, a random access memory, a flash memory, a hard disk or a solid-state hard disk, etc.; further, the storage medium can also include a combination of the above types of memories. It can be understood that a computer, a processor, a microprocessor controller, or programmable hardware includes a storage component that can store or receive software or computer code. When the software or computer code is accessed and executed by a computer, a processor, or hardware, the method shown in the above embodiment is implemented.

[0128] Although the embodiments of the present invention have been described in conjunction with the accompanying drawings, those skilled in the art may make various modifications and variations without departing from the spirit and scope of the present invention, and such modifications and variations are all within the scope defined by the appended claims.

Claims

1. A method for discovering unexpected access paths in a cloud platform system, characterized in that: The method comprises: Obtain all nodes in the cloud platform system, and filter out entry nodes from all nodes according to full access control rules; Take each entry node as the starting point and traverse all access paths of each entry node; The path credibility value of each access path is calculated respectively, and the unexpected access path is determined according to the magnitude relationship between the path credibility value and a preset credibility threshold.

2. The method according to claim 1, characterized in that The method of taking each entry node as a starting point and traversing all access paths of each entry node includes: Obtaining the full access control rules of the cloud platform system, and determining the access edges and jump edges between all nodes in the cloud platform system according to the full access control rules; Each entry node is taken as a starting point, and all access paths of each entry node are traversed based on access edges and jump edges between all nodes, wherein the access path includes at least one access edge or at least one jump edge.

3. The method according to claim 2, characterized in that The traversing all access paths of each entry node based on the access edges and jump edges between all nodes includes: Determine the adjacent nodes of the starting point based on the access edges and jump edges between all nodes, and add the adjacent nodes to the access path list; Recursively traverse the next adjacent node of the adjacent node until the access path cannot be further extended, and the access paths in the access path list are all access paths as starting points, and the access paths do not include paths with loops; Take each entry node as the starting point, repeatedly determine the adjacent nodes of the starting point based on the access edges and jump edges between all nodes, add the adjacent nodes to the access path list, recursively traverse the next adjacent node of the adjacent node until the access path cannot be expanded any further, and obtain all access paths for each entry node.

4. The method according to claim 2, characterized in that: The access edge includes: an edge between a first node and a second node, the first node can access the second node; The jump edge includes: an edge between a third node and a fourth node, the third node can jump to the fourth node, or the third node can execute a command on the fourth node.

5. The method according to claim 1 or 3, characterized in that: The calculating of the path credibility value of each access path includes: Get the number of nodes, access edges, and jump edges of each access path; The path credibility value of each access path is calculated based on the number of nodes and preset node weights, the number of access edges and preset access edge weights, and the number of jump edges and preset jump edge weights of each access path.

6. The method according to claim 1, characterized in that The determining of the unexpected access path according to the magnitude relationship between the path credibility value and the preset credibility threshold value includes: If the path credibility value is greater than a preset credibility threshold, the access path corresponding to the path credibility value is an unexpected access path.

7. The method according to claim 1, characterized in that The method further comprises: Obtain access log data and security event data of the cloud platform system; The access log data and security event data are used as a sample set, and the sample set is used to perform model training to obtain an unexpected access path recognition model; The unexpected access path identification model is used to identify all access paths of each entry node, and the unexpected access path of each entry node is determined.

8. A device for discovering unexpected access paths of a cloud platform system, characterized in that: The device comprises: A node acquisition module is used to acquire all nodes in the cloud platform system and filter out entry nodes from all nodes according to the full access control rules; The path traversal module is used to take each entry node as a starting point and traverse all access paths of each entry node; The unexpected access path determination module is used to calculate the path credibility value of each access path respectively, and determine the unexpected access path according to the magnitude relationship between the path credibility value and a preset credibility threshold.

9. A computer device, characterized in that: include: A memory and a processor, wherein the memory and the processor are communicatively connected to each other, the memory stores computer instructions, and the processor executes the method according to any one of claims 1 to 7 by executing the computer instructions.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a computer to execute the method according to any one of claims 1 to 7.

Images