A cloud platform system unintended access path discovery method, device and equipment

Abstract

The application relates to the technical field of network security, and discloses a method, device and equipment for discovering an unexpected access path of a cloud platform system, the method comprising the following steps: acquiring all nodes in the cloud platform system, and screening entry nodes from the all nodes according to a full-amount access control rule; taking each entry node as a starting point, and traversing all access paths of each entry node; respectively calculating path credibility values of the access paths, and determining unexpected access paths according to the size relationship between the path credibility values and a preset credibility threshold. Through full-path searching and path credibility value calculation, the cloud platform system can comprehensively and efficiently discover unexpected access paths, potential risks can be discovered in a timely manner, and the security and reliability of the cloud platform system are improved. The full-path searching can adapt to the dynamic changes of system topology and the changes of access behaviors, has better flexibility and adaptability, and improves the security protection capability of the system.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of network security, and particularly relates to a method, device and equipment for discovering an unexpected access path of a cloud platform system. BACKGROUND

[0002] With the popularity and development of cloud computing, enterprises and individuals increasingly rely on various services provided by cloud platforms. Cloud platforms provide convenient resource sharing and service distribution, enabling computing, storage, network and other resources to be used and expanded on demand. Systems on cloud platforms usually include multiple components (such as servers, databases, applications, etc.) and various services (such as storage services, computing services, network services, etc.), and communication and interaction are required between these components and services. In order to control and protect these communications and interactions, cloud platforms usually set a series of access control rules. However, due to the complexity and dynamics of cloud platforms, these rules are often difficult to completely correctly set and maintain, bringing challenges to system configuration and maintenance, especially in terms of security.

[0003] A common problem is the emergence of unexpected access paths, which are not foreseen in system design but may occur during operation, from one node to another. These paths may be exploited by attackers, posing a threat to the system, for example, attackers may steal sensitive data through these paths, or launch internal attacks.

[0004] Currently, there are some tools and methods for security auditing of cloud platforms, including rule-based access control systems, network traffic analysis tools, log analysis tools, etc. However, these tools and methods mainly focus on the analysis of a single node or a single network traffic, and generally cannot discover system-level unexpected access paths.

[0005] For example, rule-based access control systems can help administrators set and manage access control rules, but these rules are usually based on static source / destination / port / protocol tuples and cannot handle dynamically changing access paths. Network traffic analysis tools and log analysis tools can help administrators monitor and analyze network traffic and system logs, but they usually cannot provide a global view and cannot discover complex access paths. Therefore, how to effectively discover and manage unexpected access paths on cloud platforms is an important problem in the field of cloud computing security. SUMMARY

[0006] Therefore, the present application provides a method, device and equipment for discovering an unexpected access path of a cloud platform system, to solve the problem of being unable to effectively discover and manage unexpected access paths on cloud platforms.

[0007] In a first aspect, the present application provides a method for discovering unintended access paths of a cloud platform system, the method comprising:

[0008] obtaining all nodes in the cloud platform system, and screening entry nodes from the all nodes according to full access control rules;

[0009] taking each entry node as a starting point, and traversing all access paths of each entry node;

[0010] calculating a path trust value of each access path, and determining an unintended access path according to a size relationship between the path trust value and a preset trust threshold.

[0011] The method for discovering unintended access paths of a cloud platform system provided by the present application can comprehensively and efficiently discover unintended access paths through full path search and path trust value calculation, so as to discover potential risks in time and improve the security and reliability of the cloud platform system. The full path search can adapt to dynamic changes in system topology and changes in access behavior, has better flexibility and adaptability, and improves the security protection capability of the system.

[0012] In an optional implementation, taking each entry node as a starting point, and traversing all access paths of each entry node comprises:

[0013] obtaining full access control rules of the cloud platform system, and determining access edges and jump edges between all nodes in the cloud platform system according to the full access control rules;

[0014] taking each entry node as a starting point, and traversing all access paths of each entry node based on the access edges and the jump edges between all nodes, wherein the access paths comprise at least one access edge or at least one jump edge.

[0015] In an optional implementation, traversing all access paths of each entry node based on the access edges and the jump edges between all nodes comprises:

[0016] determining adjacent nodes of the starting point according to the access edges and the jump edges between all nodes, and adding the adjacent nodes to an access path list;

[0017] recursively traversing next adjacent nodes of the adjacent nodes until the access paths cannot be expanded, wherein the access paths in the access path list are all access paths of the starting point, and the access paths do not include paths with loops;

[0018] taking each entry node as a starting point, repeating the process of determining adjacent nodes of the starting point according to the access edges and the jump edges between all nodes, and adding the adjacent nodes to an access path list, recursively traversing next adjacent nodes of the adjacent nodes until the access paths cannot be expanded, and obtaining all access paths of each entry node.

[0019] The cloud platform system unintended access path discovery method provided by the application can quickly find all possible access paths in a complex cloud platform system through efficient path search capability, reduces the workload of manual configuration, saves time and human resources, and the access paths are effective and non-redundant.

[0020] In an optional implementation, the access edge includes an edge between the first node and the second node, and the first node can access the second node.

[0021] The jump edge includes an edge between the third node and the fourth node, and the third node can jump to the fourth node or execute a command on the fourth node.

[0022] The cloud platform system unintended access path discovery method provided by the application clearly defines the access relationship between system components, accurately describes the access and jump relationship between nodes, enhances the understandability and operability of the system, and provides a basis for subsequent path search through concept definition and edge establishment, so that the system can more efficiently calculate the path credibility value and evaluate the path.

[0023] In an optional implementation, the path credibility value of each access path is calculated, including:

[0024] The number of nodes, the number of access edges, and the number of jump edges of each access path are obtained.

[0025] According to the number of nodes, the preset node weight, the number of access edges, the preset access edge weight, the number of jump edges, and the preset jump edge weight, the path credibility value of each access path is calculated.

[0026] In an optional implementation, the unintended access path is determined according to the size relationship between the path credibility value and the preset credibility threshold, including:

[0027] If the path credibility value is greater than the preset credibility threshold, the access path corresponding to the path credibility value is the unintended access path.

[0028] The cloud platform system unintended access path discovery method provided by the application comprehensively considers the number of nodes, the number of access edges, and the number of jump edges of the path, evaluates the access path by calculating the path credibility value of each access path, quantifies the credibility of the access path, identifies the unintended access path with credibility higher than the threshold by setting the threshold, reminds the system administrator to focus on possible security risks, and can adjust the weight and threshold according to specific requirements to flexibly adapt to different system environments and security requirements.

[0029] In an optional implementation, the method further comprises:

[0030] access log data and security event data of the cloud platform system are acquired;

[0031] the access log data and the security event data are taken as a sample set, the sample set is used for model training, and an unexpected access path recognition model is obtained;

[0032] all access paths of each entry node are recognized by using the unexpected access path recognition model, and unexpected access paths of each entry node are determined.

[0033] The method for discovering the unexpected access path of the cloud platform system provided by the application trains an unexpected access path recognition model by using historical data, recognizes the unexpected access path by using a machine learning model, improves the recognition accuracy of the unexpected access path, provides more accurate path evaluation and risk early warning, and further improves the security and reliability of the cloud platform system.

[0034] In a second aspect, the application provides a device for discovering an unexpected access path of a cloud platform system, and the device comprises:

[0035] a node acquisition module configured to acquire all nodes in the cloud platform system and filter entry nodes from the all nodes according to a full access control rule;

[0036] a path traversal module configured to take each entry node as a starting point and traverse all access paths of the entry node;

[0037] an unexpected access path determination module configured to calculate a path credibility value of each access path and determine an unexpected access path according to a size relationship between the path credibility value and a preset credibility threshold.

[0038] In a third aspect, the application provides a computer device, which comprises a memory and a processor, the memory and the processor are communicatively connected with each other, the memory stores computer instructions, and the processor executes the computer instructions to perform the method of the first aspect or any of the corresponding embodiments thereof.

[0039] In a fourth aspect, the application provides a computer readable storage medium, which stores computer instructions, and the computer instructions are used to make a computer execute the method of the first aspect or any of the corresponding embodiments thereof. BRIEF DESCRIPTION OF DRAWINGS

[0040] In order to more clearly illustrate the technical solutions in the specific embodiments of the present application or the prior art, the following will briefly introduce the drawings needed to be used in the specific embodiments or prior art description. Obviously, the drawings described below are some embodiments of the present application, and other drawings can also be obtained by those skilled in the art without creative labor on the basis of these drawings.

[0041] Figure 1 is a flowchart of a method for discovering an unexpected access path of a cloud platform system according to an embodiment of the present application;

[0042] Figure 2 is a flowchart of another method for discovering an unexpected access path of a cloud platform system according to an embodiment of the present application;

[0043] Figure 3 is a structural diagram of an access path between nodes in a method for discovering an unexpected access path of a cloud platform system according to an embodiment of the present application;

[0044] Figure 4 is a structural block diagram of a device for discovering an unexpected access path of a cloud platform system according to an embodiment of the present application;

[0045] Figure 5 is a hardware structure diagram of a computer device according to an embodiment of the present application. DETAILED DESCRIPTION

[0046] In order to make the objects, technical solutions and advantages of the embodiments of the present application clearer, the following will combine the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are some of the embodiments of the present application, but not all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative labor fall within the scope of protection of the present application.

[0047] The embodiments of the present application provide a method for discovering an unexpected access path of a cloud platform system. The method analyzes the access control rules and the jumpable entry of system components on the cloud, and calculates and evaluates the trust values of all access paths to determine the unexpected access path, so as to actively discover the unexpected access path in the cloud platform system. The embodiments of the present application are suitable for scenarios of building complex systems on the cloud platform, including large-scale distributed applications, micro-service architecture, container deployment, etc. The network element devices involved can be cloud hosts, containers, load balancers, etc. The network element devices are interconnected through a network.

[0048] According to the embodiment of the present application, a method for discovering an unintended access path of a cloud platform system is provided. It should be noted that the steps shown in the flowchart can be executed in a computer system such as a set of computer executable instructions, and although a logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0049] In this embodiment, a method for discovering an unintended access path of a cloud platform system is provided, which can be used in the computer system described above, Figure 1 is a flowchart of the method for discovering an unintended access path of a cloud platform system according to the embodiment of the present application, as shown in the figure, the flow includes the following steps: Figure 1

[0050] In step S101, all nodes in the cloud platform system are obtained, and the entry nodes are selected from all nodes according to the full access control rule.

[0051] Specifically, the cloud platform system includes a plurality of cloud system components, which refer to various services, host nodes and other related software and hardware components running on the cloud platform, and each cloud system component can be an internal node of the cloud platform system. In addition to the internal nodes, the nodes in the cloud platform system also include external nodes, i.e. devices or network nodes outside the cloud platform system, such as user terminal devices or external networks.

[0052] The full access control rule refers to a complete set of access control rules between cloud system components, including but not limited to: source Internet Protocol Address (IP address), destination IP address, port number, protocol and other information.

[0053] All nodes in the cloud platform system cannot be all entry nodes, and nodes or services with traffic transfer function need to be selected as entry nodes from all nodes according to the full access control rule, for example: cloud host with Secure Shell (SSH) enabled, reverse proxy server, load balancer, etc.

[0054] In step S102, each entry node is taken as a starting point to traverse all access paths of each entry node.

[0055] ​Specifically, for each internal or external entry node as a starting point, the full path is searched, and the total access path of each entry node is calculated. The total access path set of the cloud platform system includes the total access paths of all entry nodes. For example, there are three entry nodes: a first entry node, a second entry node, and a third entry node. The total access path of the first entry node is traversed to obtain 100 access paths of the first entry node. The total access path of the second entry node is traversed to obtain 200 access paths of the first entry node. The total access path of the third entry node is traversed to obtain 150 access paths of the first entry node. The total access path set of the cloud platform system includes 450 access paths.

[0056] In step S103, the path trust value of each access path is calculated respectively, and the unexpected access path is determined according to the size relationship between the path trust value and the preset trust threshold.

[0057] Specifically, for each access path, the path trust value of the access path is calculated according to the number of nodes, the number of access edges, and the number of jump edges. The size of the preset trust threshold is determined according to the actual situation of the cloud platform system, including but not limited to the number of nodes, the access mode between nodes, whether there is a jump, etc.

[0058] The cloud platform system unexpected access path discovery method provided in the embodiment can comprehensively and efficiently discover unexpected access paths through full path search and path trust value calculation, so as to discover potential risks in time and improve the security and reliability of the cloud platform system. The full path search can adapt to the dynamic changes of system topology and the changes of access behavior, has better flexibility and adaptability, and improves the security protection ability of the system.

[0059] In some optional embodiments, the method further includes:

[0060] The access log data and the security event data of the cloud platform system are obtained.

[0061] Specifically, for all access paths, a machine learning algorithm can be introduced to optimize the calculation and evaluation of access paths. Historical access log data and known security event data are obtained, and the historical access log data and known security event data are preprocessed to obtain access log data and security event data that meet the sample data requirements.

[0062] The access log data and the security event data are used as a sample set, and the sample set is used for model training to obtain an unexpected access path identification model.

[0063] Specifically, the access log data and the security event data are taken as a sample set, and the sample set is divided into a training set and a test set according to a preset ratio, a machine learning model is trained by using the training set, and the trained learning model is tested by using the test set until the model converges to obtain the unexpected access path identification model.

[0064] The unexpected access path identification model is used to identify all access paths of each entry node, and the unexpected access paths of each entry node are determined.

[0065] Specifically, all access paths are sequentially input into the unexpected access path, and are respectively identified to obtain the unexpected access paths of each entry node, and the unexpected access paths of all entry nodes constitute the unexpected access paths of the entire cloud platform system.

[0066] The cloud platform system unexpected access path discovery method provided in the embodiment trains an unexpected access path identification model by using historical data, identifies the unexpected access path by using the machine learning model, improves the identification accuracy of the unexpected access path, provides more accurate path evaluation and risk early warning, and further improves the security and reliability of the cloud platform system.

[0067] In the embodiment, a cloud platform system unexpected access path discovery method is provided, which can be used in the computer system described above, Figure 2 is a flowchart of the cloud platform system unexpected access path discovery method according to the embodiment of the present application, as Figure 2 shown, the flowchart includes the following steps:

[0068] In step S201, all nodes in the cloud platform system are obtained, and entry nodes are selected from all nodes according to the full access control rule. For details, refer to step S101 of the embodiment shown in Figure 1 , which will not be repeated here.

[0069] In step S202, each entry node is taken as a starting point, and all access paths of each entry node are traversed.

[0070] Specifically, step S202 includes:

[0071] In step S2021, the full access control rule of the cloud platform system is obtained, and the access edges and the jump edges between all nodes in the cloud platform system are determined according to the full access control rule.

[0072] Specifically, the full access control rule of the cloud platform system includes but is not limited to source IP address, destination IP address, port number, protocol and other information, and according to the full access control rule, the access edges between all nodes that can be accessed and the jump edges that can be jumped can be determined.

[0073] Step S2022, taking each entry node as a starting point, traversing all access paths of each entry node based on the access edges and the jump edges between all nodes, and the access path includes at least one access edge or at least one jump edge.

[0074] Specifically, the access to the cloud platform system must be through the entry node, so taking each entry node as a starting point, all access paths of each entry node are determined based on the access edges and the jump edges between all nodes, and the access path of the entry node indicates that the entry node can reach other nodes through the access edge or the jump edge, so the access path includes at least one access edge or at least one jump edge.

[0075] In some optional embodiments, the access edge includes an edge between the first node and the second node, and the first node can access the second node.

[0076] Specifically, among all nodes, if the first node can access a certain port of the second node, it indicates that there is an access edge between the first node and the second node.

[0077] The jump edge includes an edge between the third node and the fourth node, and the third node can jump to the fourth node, or the third node can execute a command on the fourth node.

[0078] Specifically, among all nodes, if the third node can jump to the fourth node through SSH or the like, or the third node can execute any command of the third node on the fourth node, it indicates that there is a jump edge between the third node and the fourth node.

[0079] According to the definition of the above access edge and the jump edge, the access edge and the jump edge between all nodes can be determined.

[0080] The cloud platform system unexpected access path discovery method provided by the embodiment clearly defines the access relationship between system components, accurately describes the access and jump relationship between nodes, enhances the understandability and operability of the system, and provides a basis for subsequent full path search through concept definition and edge establishment, so that the system can more efficiently calculate the path credibility value and evaluate the path.

[0081] In some optional embodiments, the above step S2022 includes:

[0082] Step a1, determining the adjacent nodes of the starting point according to the access edges and the jump edges between all nodes, and adding the adjacent nodes to the access path list.

[0083] Specifically, the adjacent node of the starting point is determined according to the access edges and the jump edges between all nodes, there is an access edge or a jump edge between the starting point and the adjacent node, the adjacent node is added to the access path list, and the starting point to the adjacent node is an access path of the starting point. As shown in Figure 3 the first external node is taken as the starting point, there is an access edge between the first external node and the first internal node, and there is a jump edge between the first external node and the second internal node, so the first internal node and the second internal node are both adjacent nodes of the first external node, which are only examples and are not limited thereto.

[0084] Step a2, recursively traversing the next adjacent node of the adjacent node until the access path cannot be expanded, the access paths in the access path list are all access paths of the starting point, and the access path does not include a path with a loop.

[0085] Specifically, the next adjacent node of the adjacent node is recursively traversed, as shown in Figure 3 the next adjacent node of the first internal node is the second internal node, the next adjacent node of the second internal node is the third internal node, and all access paths of the first external node as the starting point include: first external node-first internal node-second internal node-third internal node, first external node-second internal node-third internal node, which are only examples and are not limited thereto. If a loop appears in the access path, it means that the access path returns to the starting point, and it is not necessary to calculate and evaluate the path credibility value of the access path. In addition, different entry nodes as the starting point may repeat the path with a loop. Therefore, when traversing all access paths of each entry node, the path with a loop is filtered out to reduce subsequent calculation and analysis and save computing resources.

[0086] Step a3, taking each entry node as the starting point, repeating the process of determining the adjacent node of the starting point according to the access edges and the jump edges between all nodes, and adding the adjacent node to the access path list, recursively traversing the next adjacent node of the adjacent node until the access path cannot be expanded, to obtain all access paths of each entry node.

[0087] Specifically, SP(x) is defined as the set of all reachable paths of the entry node x, and it is assumed that there is a jump edge from y to x. For each element path x of SP(x), path x +path [y,x] is added to SP(y), that is:

[0088] path x +path [y,x] ∈SP(y), wherein path [y,x]represents a jump edge from y to x, that is, a path from y to x, and the addition represents a path concatenation operation.

[0089] If there is an access edge from x to y, then the path path [x,y] belongs to the SP(x) set, and the path with a loop needs to be removed in the calculation process. After the traversal of all the access paths of each entry node is completed, the full access path set S of the cloud platform system is calculated, that is: S = SP(x_1) U SP(x_2) U... SP(x_n).

[0090] The cloud platform system unintended access path discovery method provided in the embodiment can quickly find all possible access paths in a complex cloud platform system through efficient path search capability, reduce the workload of manual configuration, save time and human resources, and the access paths are effective and non-redundant. Through full path search, unintended access paths can be comprehensively discovered, and the security of the system is improved.

[0091] In step S203, the path credibility values of the access paths are calculated respectively, and the unintended access paths are determined according to the size relationship between the path credibility values and the preset credibility threshold.

[0092] Specifically, the above step S203 includes:

[0093] In step S2031, the number of nodes, the number of access edges, and the number of jump edges of each access path are obtained.

[0094] Specifically, each element in the full access path set of the cloud platform system is an access path. For each access path, the number of nodes, the number of access edges, and the number of jump edges contained in the access path are determined.

[0095] In step S2032, the path credibility values of the access paths are calculated according to the number of nodes, the preset node weight, the number of access edges, the preset access edge weight, and the number of jump edges, and the preset jump edge weight.

[0096] Specifically, the formula for calculating the path credibility value of the access path is as follows:

[0097] Socre path(n) = NumNode(n) x W1 + NumAccwssEdge(n) x W2 + NumJumpEdge(n) x W3

[0098] Wherein, Score path(n)NumNode(n) represents the number of nodes included in the nth access path, W1 represents the weight of the nodes in the nth access path, NumAccessEdge(n) represents the number of access edges included in the nth access path, W2 represents the weight of the access edges in the nth access path, NumJumpEdge(n) represents the number of jump edges included in the nth access path, and W3 represents the weight of the jump edges in the nth access path. W1, W2, and W3 are adjustable weights, and the weights of the nodes, access edges, and jump edges are related to the business form of the cloud platform system, the access mode of each node, and whether there is a jump, for example, in a certain cloud platform system, the number of nodes is large, but the number of actually used nodes is only a small part, and therefore the weight of the nodes can be set to be small, which is only an example, but is not limited thereto.

[0099] In step S2033, if the path trust value is greater than the preset trust threshold, the access path corresponding to the path trust value is an unexpected access path.

[0100] Specifically, if the path trust value is greater than the preset trust threshold, the access path corresponding to the path trust value is not trusted and is an unexpected access path.

[0101] The cloud platform system unexpected access path discovery method provided in the embodiment comprehensively considers the number of nodes, the number of access edges, and the number of jump edges of the path, evaluates the access paths by calculating the path trust values of the access paths, quantifies the trust degree of the access paths, identifies the unexpected access paths with a trust degree higher than a threshold, reminds the system administrator to focus on possible security risks, and can adjust the weights and the threshold according to specific requirements to flexibly adapt to different system environments and security requirements.

[0102] In the embodiment, a cloud platform system unexpected access path discovery device is also provided, which is used to implement the above-described embodiments and preferred embodiments, and will not be described again. As used below, the term "module" can be a combination of software and / or hardware that implements a predetermined function. Although the device described in the following embodiments is preferably implemented in software, hardware or a combination of software and hardware is also possible and is contemplated.

[0103] The cloud platform system unexpected access path discovery device provided in the embodiment includes: Figure 4 As shown in the figure, the cloud platform system unexpected access path discovery device includes:

[0104] The node acquisition module 401 is configured to acquire all nodes in the cloud platform system and filter the entry nodes from the all nodes according to the full access control rule.

[0105] ​The path traversal module 402 is configured to take each entry node as a starting point to traverse all access paths of the entry node.

[0106] The unexpected access path determination module 403 is configured to calculate a path credibility value of each access path, and determine an unexpected access path according to a size relationship between the path credibility value and a preset credibility threshold.

[0107] In some optional embodiments, the path traversal module 402 includes:

[0108] The access and jump determination unit is configured to acquire full access control rules of the cloud platform system, and determine access edges and jump edges between all nodes in the cloud platform system according to the full access control rules.

[0109] The access path traversal unit is configured to take each entry node as a starting point to traverse all access paths of the entry node based on the access edges and the jump edges between all nodes, and each access path includes at least one access edge or at least one jump edge.

[0110] In some optional embodiments, the access path traversal unit includes:

[0111] The adjacent node determination subunit is configured to determine adjacent nodes of the starting point according to the access edges and the jump edges between all nodes, and add the adjacent nodes to an access path list.

[0112] The path expansion subunit is configured to recursively traverse next adjacent nodes of the adjacent nodes until the access paths cannot be expanded, and the access paths in the access path list are all access paths of the starting point, and the access paths do not include a path with a loop.

[0113] The full path traversal subunit is configured to take each entry node as a starting point to repeat the process of determining adjacent nodes of the starting point according to the access edges and the jump edges between all nodes, adding the adjacent nodes to an access path list, and recursively traversing next adjacent nodes of the adjacent nodes until the access paths cannot be expanded, to obtain all access paths of the entry node.

[0114] In some optional embodiments, the unexpected access path determination module 403 includes:

[0115] The quantity acquisition unit is configured to acquire a node quantity, an access edge quantity, and a jump edge quantity of each access path.

[0116] The path credibility value calculation unit is configured to calculate a path credibility value of each access path according to the node quantity, a preset node weight, the access edge quantity, a preset access edge weight, the jump edge quantity, and a preset jump edge weight.

[0117] The path analysis unit is used to determine that if the path trust value is greater than a preset trust threshold, the access path corresponding to the path trust value is an unexpected access path.

[0118] Further functional descriptions of the above modules and units are the same as those in the corresponding embodiments described above, and will not be repeated here.

[0119] In this embodiment, the device for discovering unexpected access paths in the cloud platform system is presented in the form of a functional unit. Here, a unit refers to an ASIC (Application Specific Integrated Circuit) circuit, a processor and memory that execute one or more software or fixed programs, and / or other devices that can provide the above functions.

[0120] This invention also provides a computer device having the above-described features. Figure 4 The device shown is for discovering unexpected access paths to the cloud platform system.

[0121] Please see Figure 5 , Figure 5 This is a schematic diagram of the structure of a computer device provided in an optional embodiment of the present invention, such as... Figure 5 As shown, the computer device includes one or more processors 10, memory 20, and interfaces for connecting the components, including high-speed interfaces and low-speed interfaces. The components communicate with each other via different buses and can be mounted on a common motherboard or otherwise installed as needed. The processors can process instructions executed within the computer device, including instructions stored in or on memory to display graphical information of a GUI on external input / output devices (such as display devices coupled to the interfaces). In some alternative implementations, multiple processors and / or multiple buses can be used with multiple memories and multiple memory modules, if desired. Similarly, multiple computer devices can be connected, each providing some of the necessary operations (e.g., as a server array, a group of blade servers, or a multiprocessor system). Figure 5 Take a processor 10 as an example.

[0122] Processor 10 may be a central processing unit, a network processor, or a combination thereof. Processor 10 may further include a hardware chip. The hardware chip may be an application-specific integrated circuit (ASIC), a programmable logic device (PLD), or a combination thereof. The programmable logic device may be a complex programmable logic device (CAMP), a field-programmable gate array (FPGA), a general-purpose array logic (GDA), or any combination thereof.

[0123] The memory 20 stores instructions executable by at least one processor 10 to cause the at least one processor 10 to perform the method shown in the above embodiments.

[0124] The memory 20 can include a program storage area and a data storage area. The program storage area can store an operating system and application programs required by at least one function. The data storage area can store data created according to the use of the computer device, and the like. In addition, the memory 20 can include a high-speed random access memory, and can also include a non-transitory memory such as at least one magnetic disk storage device, a flash memory device, or other non-transitory solid-state memory device. In some alternative embodiments, the memory 20 can optionally include a memory disposed remotely from the processor 10, which can be connected to the computer device through a network. Examples of the network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and a combination thereof.

[0125] The memory 20 can include a volatile memory such as a random access memory, and can also include a non-volatile memory such as a flash memory, a hard disk, or a solid state disk. The memory 20 can also include a combination of the above-mentioned types of memory.

[0126] The computer device also includes a communication interface 30 for communication of the computer device with other devices or communication networks.

[0127] The embodiments of the present application also provide a computer readable storage medium. The above-mentioned method according to the embodiments of the present application can be implemented in hardware, firmware, or recorded in a storage medium, or stored in a remote storage medium or a non-transitory machine readable storage medium and downloaded to a local storage medium through network downloading of computer code, so that the method described herein can be processed by such software on a storage medium using a general purpose computer, a special purpose processor, or programmable or special purpose hardware. The storage medium can be a magnetic disk, an optical disk, a read-only memory, a random access memory, a flash memory, a hard disk, or a solid state disk, and the like. Further, the storage medium can also include a combination of the above-mentioned types of memory. It can be understood that the computer, the processor, the microprocessor controller, or the programmable hardware includes a storage component that can store or receive software or computer code, which, when accessed and executed by the computer, the processor, or the hardware, implements the method shown in the above-mentioned embodiments.

[0128] Although the embodiments of the present application are described in conjunction with the accompanying drawings, various modifications and changes can be suggested by those skilled in the art without departing from the spirit and scope of the present application, and such modifications and changes are intended to fall within the scope of the appended claims.

Claims

1. A method for discovering unintended access paths of a cloud platform system, characterized in that, The method comprises: obtaining all nodes in a cloud platform system, and screening entry nodes from the all nodes according to full access control rules; taking each entry node as a starting point, traversing all access paths of each entry node, comprising: obtaining full access control rules of the cloud platform system, and determining access edges and jump edges between all nodes in the cloud platform system according to the full access control rules; taking each entry node as a starting point, traversing all access paths of each entry node based on the access edges and the jump edges between all nodes, the access path comprising at least one access edge or at least one jump edge, the access edge comprising: an edge between a first node and a second node, the first node being able to access the second node; the jump edge comprising: an edge between a third node and a fourth node, the third node being able to jump to the fourth node, or the third node being able to execute a command on the fourth node; calculating a path trust value of each access path respectively, and determining an unexpected access path according to a size relationship between the path trust value and a preset trust threshold, the calculation of the path trust value of each access path comprising: obtaining a node quantity, an access edge quantity, and a jump edge quantity of each access path; calculating the path trust value of each access path according to the node quantity, a preset node weight, the access edge quantity, a preset access edge weight, and the jump edge quantity, and a preset jump edge weight.

2. The method of claim 1, wherein, The traversal of all access paths of each entry node based on the access edges and the jump edges between all nodes comprises: determining adjacent nodes of a starting point according to the access edges and the jump edges between all nodes, and adding the adjacent nodes to an access path list; recursively traversing a next adjacent node of the adjacent node until the access path cannot be further expanded, the access path in the access path list being all access paths of the starting point, and the access path not including a path with a loop; taking each entry node as a starting point, repeating the process of determining adjacent nodes of a starting point according to the access edges and the jump edges between all nodes, and adding the adjacent nodes to an access path list, recursively traversing a next adjacent node of the adjacent node until the access path cannot be further expanded, to obtain all access paths of each entry node.

3. The method of claim 1, wherein, The determination of an unexpected access path according to a size relationship between a path trust value and a preset trust threshold comprises: if the path trust value is greater than the preset trust threshold, an access path corresponding to the path trust value is an unexpected access path.

4. The method of claim 1, wherein, The method further comprises: obtaining access log data and security event data of the cloud platform system; using the access log data and the security event data as a sample set, performing model training using the sample set to obtain an unexpected access path identification model; using the unexpected access path identification model to identify all access paths of each entry node, and determining an unexpected access path of each entry node.

5. A cloud platform system unintended access path discovery apparatus, characterized by, The device comprises: a node obtaining module configured to obtain all nodes in a cloud platform system, and screen entry nodes from the all nodes according to full access control rules; The path traversal module is configured to take each entry node as a starting point to traverse all access paths of the entry node, including: obtaining full access control rules of the cloud platform system, and determining access edges and jump edges between all nodes in the cloud platform system according to the full access control rules; taking each entry node as a starting point, traversing all access paths of the entry node based on the access edges and the jump edges between all nodes, the access path including at least one access edge or at least one jump edge, the access edge including an edge between a first node and a second node, the first node being able to access the second node, and the jump edge including an edge between a third node and a fourth node, the third node being able to jump to the fourth node or the third node being able to execute a command on the fourth node; The unexpected access path determination module is configured to calculate a path trust value of each access path respectively, and determine an unexpected access path according to a size relationship between the path trust value and a preset trust threshold, the calculation of the path trust value of each access path including: obtaining a node number, an access edge number and a jump edge number of each access path; and calculating the path trust value of each access path according to the node number, a preset node weight, the access edge number, a preset access edge weight and the jump edge number, and a preset jump edge weight.

6. A computer device, comprising: The method comprises: A memory and a processor are in communication connection with each other, the memory stores computer instructions, and the processor executes the computer instructions to perform the method in any one of claims 1 to 4.

7. A computer readable storage medium characterized in that, The computer readable storage medium stores computer instructions, and the computer instructions are used to make a computer execute the method in any one of claims 1 to 4.

Images