Cloud host-based environmental perception detection method, device and electronic equipment

Abstract

The present application provides a cloud host-based environmental perception detection method, device and electronic equipment, which relates to the field of data perception technology, including collecting the initial cloud perception data of the cloud host through a preset data collection method; performing data cleaning and feature extraction processing on the initial cloud perception data to obtain pre-processed cloud perception data; performing pattern recognition processing and behavior prediction processing on the pre-processed cloud perception data, abnormal identification results and predicting potential environmental changes of the cloud host, so as to perform security reinforcement processing on the cloud host. The present application can detect and prevent data leakage more accurately and timely through in-depth analysis and identification of process behavior, providing a more efficient, comprehensive and intelligent solution for environmental perception detection of cloud hosts, and significantly improving the security monitoring capabilities in cloud environments.

Description

Technical Field

[0001] The present application relates to the field of data perception technology, and in particular to a cloud host-based environment perception detection method, device and electronic equipment. Background Art

[0002] Currently, cloud hosts face numerous security threats during system operations, such as malicious processes, abnormal user behavior, and potential data leaks. Currently, monitoring and analyzing various system operating parameters within cloud hosts mostly relies on monitoring methods based on process names and highly sensitive process characteristics, as well as those based on abnormal traffic and resource usage fluctuations. However, these monitoring methods based on process names, highly sensitive process characteristics, and traffic usage fluctuations have significant shortcomings in data leak detection, including easily bypassable vulnerabilities, insufficient detection accuracy, and a lack of insight into process behavior. Summary of the Invention

[0003] The purpose of this application is to provide a cloud host-based environmental perception detection method, device and electronic equipment to alleviate the above-mentioned technical problems existing in the prior art.

[0004] In a first aspect, the present invention provides an environment perception detection method based on a cloud host, the method comprising:

[0005] Collect the initial cloud perception data of the cloud host through the preset data collection method;

[0006] Perform data cleaning and feature extraction on the initial cloud perception data to obtain pre-processed cloud perception data;

[0007] Perform pattern recognition and behavior prediction processing on pre-processed cloud perception data, identify abnormal results and predict potential environmental changes of the cloud host, so as to carry out security reinforcement processing of the cloud host.

[0008] In an optional embodiment, the preset data collection method includes one or more of physical sensing, virtual detection, and traffic probes. Accordingly, the initial cloud perception data includes one or more of cloud environment data, cloud performance data, and cloud traffic data. Collecting cloud environment data of the cloud host through the preset data collection method includes:

[0009] When physical sensing is used to collect data, cloud environment data is collected at a preset period by sensors installed in the cloud data center, and the cloud environment data is uploaded to the cloud platform through edge computing nodes;

[0010] When using virtual probes to collect data, cloud performance data is obtained by calling the cloud host's log interface and virtualization API. The cloud performance data includes virtual machine performance data and abnormal access data used to monitor abnormal access behavior of the cloud host. The virtual machine performance data includes at least CPU utilization, memory usage, and network traffic. The abnormal access data includes at least repeated login failure records.

[0011] When using traffic probes to collect data, cloud traffic data in the cloud host is captured in real time.

[0012] In an optional embodiment, data cleaning and feature extraction are performed on the initial cloud perception data to obtain preprocessed cloud perception data, including:

[0013] Perform data denoising on the initial cloud perception data and perform data normalization on the denoised data;

[0014] Key features are extracted through principal component analysis to obtain preprocessed cloud perception data.

[0015] In an optional embodiment, pattern recognition processing and behavior prediction processing are performed on the pre-processed cloud perception data, abnormal recognition results are monitored, and potential environmental changes of the cloud host are predicted, including:

[0016] Based on the pre-trained first neural network model, abnormal pattern recognition processing is performed on the pre-processed cloud perception data to monitor the abnormal mode of the cloud host operation and the abnormal operation behavior data of the cloud host;

[0017] Based on the pre-trained second neural network model, behavior prediction processing is performed on the pre-processed cloud perception data to predict the potential environmental change data of the cloud host.

[0018] In an optional embodiment, the first neural network model includes a convolutional neural network, and the second neural network includes a long short-term memory network.

[0019] In an optional embodiment, the method further comprises:

[0020] Automatically configure security testing based on anomaly identification results and report them in log form.

[0021] In an optional embodiment, the method further comprises:

[0022] The abnormal mode of the cloud host during operation, the potential environmental change data of the cloud host and the log reporting results are displayed on the graphical user interface.

[0023] In a second aspect, the present invention provides an environment perception detection device based on a cloud host, the device comprising:

[0024] The collection component is used to collect the initial cloud perception data of the cloud host through a preset data collection method;

[0025] The processing component is used to perform data cleaning and feature extraction on the initial cloud perception data to obtain pre-processed cloud perception data;

[0026] The detection component is used to perform pattern recognition and behavior prediction processing on pre-processed cloud perception data, identify abnormal results and predict potential environmental changes of the cloud host in order to carry out security reinforcement processing of the cloud host.

[0027] In a third aspect, the present invention provides an electronic device comprising a processor and a memory, wherein the memory stores computer-executable instructions that can be executed by the processor, and the processor executes the computer-executable instructions to implement the cloud host-based environmental perception detection method of any of the aforementioned embodiments.

[0028] In a fourth aspect, the present invention provides a computer-readable storage medium, which stores computer-executable instructions. When the computer-executable instructions are called and executed by a processor, the computer-executable instructions prompt the processor to implement the cloud host-based environmental perception detection method of any one of the aforementioned implementation methods.

[0029] The cloud host-based environment perception detection method, device, and electronic device provided in this application have the following beneficial effects:

[0030] By collecting various cloud perception data of the cloud host through preset data collection methods, it can fully cover various operations within the cloud host, provide sufficient data support for security monitoring, and reduce information blind spots; through real-time data analysis, it can automatically monitor and analyze internal behavior, effectively reduce the need for manual intervention, improve response speed, and ensure that potential intrusions are blocked in time; through comprehensive analysis of various types of data and timely automated testing and log reporting, it can improve the detection and response capabilities of complex security incidents, provide a more efficient, comprehensive and intelligent solution for the environmental perception detection of the cloud host, and significantly improve the security monitoring capabilities in the cloud environment. BRIEF DESCRIPTION OF THE DRAWINGS

[0031] In order to more clearly illustrate the specific implementation methods of the present application or the technical solutions in the prior art, the following is a brief introduction to the drawings required for use in the specific implementation methods or the description of the prior art. Obviously, the drawings described below are some implementation methods of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without any creative work.

[0032] Figure 1 A flowchart of a cloud host-based environment perception detection method provided in an embodiment of the present application;

[0033] Figure 2 A system structure diagram for implementing the above-mentioned cloud host-based environment perception detection method provided in an embodiment of the present application;

[0034] Figure 3 A system structure diagram of another embodiment of the present application for implementing the above-mentioned cloud host-based environment perception detection method;

[0035] Figure 4 A system timing diagram provided in an embodiment of the present application;

[0036] Figure 5 A system processing flow chart provided in an embodiment of the present application;

[0037] Figure 6 A structural diagram of a cloud host-based environment perception detection device provided in an embodiment of the present application;

[0038] Figure 7 A structural diagram of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0039] To make the objectives, technical solutions, and advantages of the embodiments of the present application more clear, the technical solutions in the embodiments of the present application will be clearly and completely described below in conjunction with the accompanying drawings of the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Generally, the components of the embodiments of the present application described and shown in the drawings herein can be arranged and designed in various different configurations.

[0040] Therefore, the following detailed description of the embodiments of the present application provided in the accompanying drawings is not intended to limit the scope of the present application for protection, but merely represents selected embodiments of the present application. All other embodiments obtained by persons of ordinary skill in the art based on the embodiments in the present application without creative work are within the scope of protection of the present application.

[0041] It should be noted that similar reference numerals and letters denote similar items in the following drawings, and therefore, once an item is defined in one drawing, it does not need to be further defined or explained in subsequent drawings.

[0042] With the widespread adoption of cloud computing, more and more businesses and organizations are migrating their IT infrastructure to cloud environments. However, the dynamic and multi-tenant nature of cloud hosts makes security management increasingly complex. Currently, cloud hosts face numerous security threats, such as malicious processes, abnormal user behavior, and potential data leaks. This requires real-time monitoring and analysis of various system operating parameters within cloud hosts to promptly identify security risks and take effective measures.

[0043] Traditional data leakage detection methods primarily rely on monitoring process names and highly sensitive process characteristics. Specifically, these methods continuously monitor the activities of processes running in the system using pre-defined rules and characteristics. Behavior that matches these characteristics is considered anomaly and blocked or reported.

[0044] However, these traditional methods have significant disadvantages, as shown in the following aspects:

[0045] 1. Dependence on process names: Traditional methods usually focus on specific process names, which allows attackers to bypass monitoring by simply changing the process name, creating a defense loophole.

[0046] 2. Limitations of Signature Behavior Monitoring: While monitoring the signature behavior of highly sensitive processes can identify some abnormal activity, its fixed behavioral patterns limit its ability to effectively identify new attack methods. This monitoring approach may become ineffective if attackers adopt different techniques or approaches.

[0047] 3. Insufficient monitoring of traffic and resource usage fluctuations: While monitoring of traffic and resource usage fluctuations can detect anomalies to a certain extent, it lacks a detailed understanding of specific operational behaviors. This makes it less effective in detecting attacks that use low-frequency and covert means.

[0048] 4. Insufficient in-depth analysis of behavioral details: Traditional methods often fail to delve into the behavioral details when analyzing process behavior, which makes them inadequate when faced with complex or advanced attack methods.

[0049] The aforementioned monitoring method based on process names and highly sensitive process signatures relies on a predefined process name and signature library to monitor running processes, identify qualifying anomalous behavior, and immediately take appropriate action. However, the following technical flaws exist: 1) attackers can easily modify process names or use camouflage techniques to evade detection; 2) the highly sensitive process behavior signature library is not updated in a timely manner, resulting in an inability to respond to emerging threats; 3) the monitoring accuracy of abnormal traffic and resource usage fluctuations is insufficient, making it unable to capture even subtle anomalous changes.

[0050] The above-mentioned monitoring method based on abnormal traffic and resource usage fluctuations identifies potential abnormal behavior by monitoring network traffic and system resource usage (such as CPU and memory) in real time. Once abnormal fluctuations in traffic or resource usage are detected, the system will take blocking or alarm measures. Existing technical defects: 1) The accuracy of identifying anomalies through fluctuation monitoring is limited, and it is difficult to capture detailed information about process behavior in detail; 2) Low-frequency attack methods that are more concealed are difficult to detect effectively; 3) Because fluctuations in traffic and resource usage may be affected by multiple factors, it is easy to lead to a high false alarm rate, thereby reducing the effectiveness of detection.

[0051] Therefore, current monitoring methods based on process names, highly sensitive process characteristics, and traffic usage fluctuations have significant shortcomings in data leakage detection, including easily bypassable vulnerabilities, insufficient detection accuracy, and an inability to gain a deep understanding of process behavior. Based on this, the embodiments of the present application provide a cloud host-based environmental awareness detection method, device, and electronic device that can improve the accuracy and timeliness of detecting and preventing data leakage by deeply analyzing and identifying process behavior.

[0052] This application embodiment provides a cloud host-based environment perception detection method, see Figure 1 As shown, the method mainly includes the following steps:

[0053] Step S110: collecting initial cloud perception data of the cloud host through a preset data collection method.

[0054] The above-mentioned preset data collection methods may include physical sensing, virtual detection, and traffic probes. Accordingly, the initial cloud perception data collected by physical sensing is cloud environment data, the initial cloud perception data collected by virtual probes is cloud performance data, and the initial cloud perception data collected by traffic probes is cloud traffic data. In a specific embodiment, the cloud environment data of the cloud host is collected by the preset data collection method, and the following specific implementation means can be used:

[0055] 1) When physical sensing is used to collect data, cloud environment data is collected at a preset period by sensors installed in the cloud data center, and the cloud environment data is uploaded to the cloud platform through edge computing nodes;

[0056] 2) When using a virtual probe to collect data, cloud performance data is obtained by calling the cloud host's log interface and virtualization API; the cloud performance data includes virtual machine performance data and abnormal access data used to monitor abnormal access behavior of the cloud host. The virtual machine performance data includes at least CPU utilization, memory usage, and network traffic. The abnormal access data includes at least repeated login failure records.

[0057] 3) When using traffic probes to collect data, cloud traffic data in the cloud host is captured in real time.

[0058] Through the above-mentioned multi-dimensional data collection mechanism, various system operating parameters of the cloud host can be collected in real time, including CPU, memory, disk usage, running processes, service status, scheduled tasks, environment variables, installation packages, execution commands, user logins, account operations and network connections, etc., thereby ensuring comprehensive monitoring of cloud host behavior and timely detection of abnormal behavior.

[0059] Step S120 , performing data cleaning and feature extraction processing on the initial cloud perception data to obtain pre-processed cloud perception data.

[0060] In one embodiment, in order to improve the effective and accurate perception monitoring of the collected cloud host data, the initial cloud perception data obtained can be preprocessed, and the preprocessing can include data cleaning and feature extraction processing. Among them, data cleaning can include processing missing values ​​(for identifying and filling or deleting missing data points), noise removal (for eliminating outliers or erroneous information in cloud perception data), and format standardization (ensuring that all cloud perception data follows a unified format standard). Feature extraction processing can be used to extract the features required for subsequent model predictions, thereby improving the accuracy of subsequent cloud host environments and operating behaviors.

[0061] In specific implementation, the initial cloud perception data can be subjected to data denoising, and the denoised data can be subjected to data normalization; key features can be extracted through principal component analysis to obtain preprocessed cloud perception data.

[0062] Preferably, in order to improve the effect of data preprocessing, it can also include: 1) data integration (by integrating data from multiple sources to solve the problem of duplicate records, matching fields between different data sets to ensure consistency); 2) data transformation (normalization / standardization: adjusting the numerical scale so that data of different scales can be compared with each other; clustering / binning: converting continuous variables into discrete variables), feature encoding (such as one-hot encoding (One-Hot encoding) 1) Data compression: The data is divided into three parts: 1) Encoding (for converting categorical data into numerical form), data type conversion (such as string to number, etc.); 2) Data reduction (PCA (principal component analysis), LDA (linear discriminant analysis), etc. to reduce the number of features to reduce data dimensionality, extract subsets from large data sets for data sampling to simplify calculations, and use algorithms to compress the data volume without losing important information for data compression); 3) Feature selection: Select the features that are most helpful to the model and remove redundant or irrelevant features to improve model performance and training speed; 4) Data labeling: For supervised learning tasks, it is necessary to add labels or category information to the data, manually review or semi-automatically label it; 5) Create derived features: Generate new features from existing features to capture more complex patterns or relationships, for example, create time period features of the day based on timestamps; 6) Data segmentation: Divide the dataset into training, validation and test sets to evaluate model performance, ensure that the data distribution of each part is similar, and avoid overfitting problems; 7) Data encryption and privacy protection: It can improve the security of sensitive data of the cloud host and the privacy of users, and use encryption technology to protect static data and data in transit.

[0063] Step S130, performing pattern recognition processing and behavior prediction processing on the pre-processed cloud perception data, identifying abnormal results and predicting potential environmental changes of the cloud host, so as to perform security reinforcement processing on the cloud host.

[0064] In one embodiment, pre-processed cloud perception data can be processed for abnormal pattern recognition based on a pre-trained first neural network model to monitor abnormal operating patterns and abnormal operating behavior data of cloud hosts, such as sudden traffic peaks or abnormal login behavior. Pre-processed cloud perception data can be processed for behavior prediction based on a pre-trained second neural network model to predict potential environmental changes of cloud hosts, thereby enabling trend prediction of multi-dimensional time series data and providing early warning of possible load changes, thereby effectively avoiding resource bottlenecks. The first neural network model comprises a convolutional neural network, and the second neural network comprises a long short-term memory network.

[0065] Furthermore, to ensure that abnormalities can be quickly addressed after anomalies occur in the identification results, in an optional implementation, security tests can be automatically configured based on the abnormal identification results and reported in the form of logs. In actual applications, security tests can be automatically configured based on the abnormal identification results and reported to the administrator in the form of logs.

[0066] In addition, in order to improve the visualization of monitoring results and facilitate real-time awareness of various situations during cloud host monitoring, the abnormal mode of cloud host operation, potential environmental change data of the cloud host and log reporting results can be displayed in the graphical user interface, so that administrators can understand the risk situation of the cloud host and ensure the security of the cloud host.

[0067] The present application also provides an embodiment of the above-mentioned cloud host-based environment perception detection method in combination with the system structure. In a specific implementation, the system architecture consists of three core modules, see Figure 2 As shown, it can include data acquisition and processing module, data analysis module and data display module. Each module plays a vital role in the implementation of cloud host environment perception detection technology, and works closely with other modules to ensure the efficient operation of the system.

[0068] First, data acquisition and processing is used to obtain environmental information from various data sources. This module consists of two parts: data acquisition and data preprocessing. Data acquisition provides three methods for accessing data on cloud hosts: physical sensing, virtual detection, and traffic probing. Data processing is responsible for preprocessing, feature extraction, and storage management of the collected raw data, modifying the network traffic format into data that can be recognized by deep neural networks.

[0069] The data analysis module, serving as the system's core decision-making layer, is used to identify data patterns and predict trends based on deep learning models. This module uses convolutional neural networks (CNNs) to identify anomalies and long short-term memory networks (LSTMs) to predict trends in time series data. Furthermore, this module automatically configures security tests based on anomaly identification results and reports them to administrators in the form of logs.

[0070] Finally, the data display module is responsible for displaying the results of abnormal pattern matching, data trend prediction, and log reporting on the interface, making it easier for administrators to understand the risk situation of the cloud host and thus ensure the security of the cloud host.

[0071] Through the close collaboration of these modules, the system achieves comprehensive awareness and intelligent analysis of the cloud host environment, and automatically responds and optimizes based on the analysis results, significantly improving the resource management efficiency and security monitoring capabilities of the cloud host. These modules not only ensure the real-time and accuracy of the system through data collection and analysis, but also provide powerful decision-making support through intelligent analysis and prediction mechanisms, ultimately ensuring the stability and security of the cloud environment.

[0072] In another embodiment, the above system architecture can also be composed of four core modules, including data acquisition module, data processing module, intelligent analysis module and data display module, see Figure 3 As shown in the figure, when performing environmental awareness detection on a cloud host, the functions of each module are as follows:

[0073] The data acquisition module obtains environmental data through physical sensors and virtual detection sub-modules. The physical sensors collect physical parameters such as temperature and humidity in real time. The virtual detection uses virtualization APIs and log analysis tools to obtain the cloud host operating status and user behavior characteristics. The traffic probe module can obtain specific traffic on the cloud host.

[0074] The collected data undergoes preprocessing steps such as denoising and normalization in the data processing module, and key features are extracted through principal component analysis (PCA), and then stored in a distributed database with high concurrency support for fast query.

[0075] The intelligent analysis module uses deep learning technologies such as convolutional neural networks (CNN) and long short-term memory networks (LSTM) to identify patterns and predict trends in data, identifying abnormal behavior and predicting potential future environmental changes, providing a basis for system decision-making. Based on these analysis results, the emergency response mechanism can update security policies (such as firewall rules) in real time or dynamically adjust cloud host resource allocation through container orchestration tools (such as Kubernetes) to ensure system security and stability. Detected anomalies and processing results are recorded and reported in log form.

[0076] The data display module uses a dynamic dashboard built through a modern Web UI framework to display real-time monitoring data, historical records, and analysis results in a graphical manner. It supports user-defined configuration and report generation, provides intuitive support for management and decision-making, and provides a display of reported logs.

[0077] Through the collaborative collaboration among the above-mentioned data acquisition module, data processing module, intelligent analysis module and data display module, the comprehensiveness, real-time and intelligent cloud host environment perception detection is achieved.

[0078] Figure 4 The system processing time relationship is shown, that is, the system timing diagram, which mainly includes the following processing stages:

[0079] First, during the data collection and synchronization phase, physical environment sensors collect environmental data at a fixed interval and upload the data through edge computing nodes. The virtual detection module queries the performance data and network traffic status of the cloud host through the API interface at a preset interval (for example, every 5 seconds), obtaining key indicators such as CPU, memory usage, and network traffic in real time. The traffic probe interface captures the traffic data information of the cloud host in real time.

[0080] During the data processing stage, the data is cleaned and standardized to ensure that the noise and inconsistency in the original data are corrected and the data is converted into a standard format that is easy to analyze.

[0081] Next, the intelligent analysis phase begins. The processed data is fed into an analytical model for deep learning calculations. The anomaly detection model processes the data in batches to identify potential abnormal patterns. Time series forecasting, using a long short-term memory (LSTM) network, predicts future trends based on historical data, while also preparing for resource scheduling. Based on the results of the intelligent analysis, the system promptly takes appropriate action, which is then logged to the administrator.

[0082] Finally, the results display module presents real-time monitoring data through a dynamic dashboard. The dashboard refreshes every second to ensure users have the latest cloud host operating status and present data trends in real time. Real-time updates to charts and logs help system administrators gain comprehensive visibility into the environment and make quick decisions.

[0083] Applied to the above system architecture, Figure 5A specific system processing flow chart is shown. First, the data acquisition module acquires information through three methods: physical perception, virtual detection, and traffic probes. Physical perception uses sensors installed in the cloud data center to collect environmental data at a fixed interval and uploads it to the cloud platform via edge computing nodes, ensuring real-time and accuracy. Virtual detection uses the cloud host's log interface and virtualization API to obtain virtual machine performance data, such as CPU utilization, memory usage, and network traffic, while also monitoring abnormal access behavior, such as repeated login failures. Traffic probes can capture traffic within the cloud host in real time.

[0084] Next, the data processing module performs data preprocessing and storage tasks. The preprocessed data is stored in a distributed file system to ensure that the system can handle large-scale concurrent data access while providing efficient historical data query capabilities.

[0085] The intelligent analysis module then conducts in-depth analysis of the processed data, using convolutional neural networks (CNNs) for anomaly detection to identify unusual patterns in cloud server operations, such as sudden traffic spikes or unusual login behavior. Furthermore, using long-short-term memory (LSTM) networks, the system can predict trends in multidimensional time series data, providing early warning of potential load fluctuations and effectively avoiding resource bottlenecks.

[0086] Finally, the data display module presents the analysis results to users via a graphical dashboard. This dashboard not only displays real-time monitoring data but also displays the status distribution of cloud hosts via pie charts or bar graphs, providing system administrators with a comprehensive view of the environment. Users can also query log data as needed.

[0087] Optionally, a dynamic feedback module can be added based on the analysis results generated by the aforementioned intelligent analysis module. This dynamic feedback module activates an automatic response mechanism to quickly implement countermeasures. The system can dynamically schedule resources based on predicted high load conditions, scaling cloud host resources by increasing the number of CPU cores or launching more container instances to ensure stable system operation. If abnormal login behavior is detected, the system will update firewall rules in real time and block the abnormal IP address to ensure security. In addition, the system will notify system administrators of abnormal events through logs to ensure rapid processing.

[0088] By adding a dynamic feedback module, the system architecture can include five main modules, namely data acquisition module, data processing module, intelligent analysis module, dynamic feedback module and data display module. This approach can further optimize and improve the environmental perception detection of cloud hosts, and enhance the comprehensiveness, real-time nature and intelligence of environmental perception detection of cloud hosts.

[0089] In summary, this application uses a multi-dimensional data collection mechanism, and the system can fully cover all operations within the cloud host, provide sufficient data support for security monitoring, and reduce information blind spots; through real-time data analysis, it can automatically monitor and analyze internal behavior, effectively reduce the need for manual intervention, improve response speed, and ensure that potential intrusions are blocked in a timely manner; through comprehensive analysis of various types of data, and timely automated testing and log reporting, it can improve the detection and response capabilities of complex security incidents. In addition, the above system structure can be easily integrated into the existing cloud environment, ensuring the flexibility and scalability of cloud host security monitoring, and adapting to users of different sizes and needs. Through multi-dimensional data collection and intelligent analysis mechanisms, it provides a more efficient, comprehensive and intelligent solution for environmental perception detection of cloud hosts, significantly improving the security monitoring capabilities in the cloud environment.

[0090] Based on the above method embodiment, the present application embodiment also provides an environment perception detection device based on a cloud host, see Figure 6 As shown, the device mainly includes the following parts:

[0091] The collection component 610 is used to collect the initial cloud perception data of the cloud host through a preset data collection method;

[0092] The processing component 620 is used to perform data cleaning and feature extraction on the initial cloud perception data to obtain pre-processed cloud perception data;

[0093] The detection component 630 is used to perform pattern recognition processing and behavior prediction processing on the pre-processed cloud perception data, identify abnormal results and predict potential environmental changes of the cloud host, so as to perform security reinforcement processing on the cloud host.

[0094] In a feasible embodiment, the preset data collection method includes one or more of physical sensing, virtual detection, and traffic probe. Accordingly, the initial cloud sensing data includes one or more of cloud environment data, cloud performance data, and cloud traffic data. The above-mentioned collection component 610 is further used to:

[0095] When physical sensing is used to collect data, cloud environment data is collected at a preset period by sensors installed in the cloud data center, and the cloud environment data is uploaded to the cloud platform through edge computing nodes;

[0096] When using virtual probes to collect data, cloud performance data is obtained by calling the cloud host's log interface and virtualization API. The cloud performance data includes virtual machine performance data and abnormal access data used to monitor abnormal access behavior of the cloud host. The virtual machine performance data includes at least CPU utilization, memory usage, and network traffic. The abnormal access data includes at least repeated login failure records.

[0097] When using traffic probes to collect data, cloud traffic data in the cloud host is captured in real time.

[0098] In a feasible implementation manner, the processing component 620 is further configured to:

[0099] Perform data denoising on the initial cloud perception data and perform data normalization on the denoised data;

[0100] Key features are extracted through principal component analysis to obtain preprocessed cloud perception data.

[0101] In a feasible embodiment, the detection component 630 is further used to:

[0102] Based on the pre-trained first neural network model, abnormal pattern recognition processing is performed on the pre-processed cloud perception data to monitor the abnormal mode of the cloud host operation and the abnormal operation behavior data of the cloud host;

[0103] Based on the pre-trained second neural network model, behavior prediction processing is performed on the pre-processed cloud perception data to predict the potential environmental change data of the cloud host.

[0104] In one feasible embodiment, the first neural network model includes a convolutional neural network, and the second neural network includes a long short-term memory network.

[0105] In a feasible implementation manner, the above-mentioned apparatus further includes a reporting component configured to:

[0106] Automatically configure security testing based on anomaly identification results and report them in log form.

[0107] In a feasible embodiment, the above device further includes a display component for:

[0108] The abnormal mode of the cloud host during operation, the potential environmental change data of the cloud host and the log reporting results are displayed on the graphical user interface.

[0109] The cloud host-based environmental perception detection device provided in the embodiment of the present application has the same implementation principle and technical effects as those of the aforementioned method embodiment. For the sake of brief description, for parts not mentioned in the embodiment of the cloud host-based environmental perception detection device, reference may be made to the corresponding content in the aforementioned cloud host-based environmental perception detection method embodiment.

[0110] The present application also provides an electronic device, such as Figure 7As shown, it is a structural diagram of the electronic device, wherein the electronic device 100 includes a processor 71 and a memory 70, the memory 70 stores computer executable instructions that can be executed by the processor 71, and the processor 71 executes the computer executable instructions to implement any of the above-mentioned cloud host-based environmental perception detection methods.

[0111] exist Figure 7 In the illustrated embodiment, the electronic device further includes a bus 72 and a communication interface 73 , wherein the processor 71 , the communication interface 73 and the memory 70 are connected via the bus 72 .

[0112] Among them, the memory 70 may include a high-speed random access memory (RAM), and may also include a non-volatile memory (non-volatile memory), such as at least one disk storage. The communication connection between the system network element and at least one other network element is realized through at least one communication interface 73 (which can be wired or wireless), and the Internet, wide area network, local area network, metropolitan area network, etc. can be used. The bus 72 can be an ISA (Industry Standard Architecture) bus, a PCI (Peripheral Component Interconnect) bus or an EISA (Extended Industry Standard Architecture) bus, etc. The bus 72 can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Figure 7 Only one bidirectional arrow is used in the diagram, but this does not mean that there is only one bus or one type of bus.

[0113] The processor 71 may be an integrated circuit chip with signal processing capabilities. During implementation, each step of the above method can be completed by hardware integrated logic circuits in the processor 71 or by software instructions. The above processor 71 may be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc.; it may also be a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components. The general-purpose processor may be a microprocessor or any conventional processor. The steps of the method disclosed in the embodiments of the present application can be directly implemented and executed by a hardware decoding processor, or by a combination of hardware and software modules in the decoding processor. The software module can be located in a storage medium mature in the art, such as random access memory, flash memory, read-only memory, programmable read-only memory, electrically erasable programmable memory, registers, etc. The storage medium is located in the memory, and the processor 71 reads the information in the memory and combines its hardware to complete the steps of the cloud host-based environment perception detection method of the aforementioned embodiment.

[0114] An embodiment of the present application also provides a computer-readable storage medium, which stores computer-executable instructions. When the computer-executable instructions are called and executed by the processor, the computer-executable instructions prompt the processor to implement the above-mentioned cloud host-based environmental perception detection method. The specific implementation can be found in the aforementioned method embodiment, which will not be repeated here.

[0115] The computer program products of the cloud host-based environmental perception detection method, device and electronic device provided in the embodiments of the present application include a computer-readable storage medium storing program code. The instructions included in the program code can be used to execute the methods in the previous method embodiments. For specific implementation, please refer to the method embodiments and will not be repeated here.

[0116] Unless otherwise specifically stated, the relative steps, numerical expressions and values ​​of the components and steps set forth in these embodiments do not limit the scope of the present application.

[0117] If the function is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a non-volatile computer-readable storage medium that is executable by a processor. Based on this understanding, the technical solution of the present application, or the part that contributes to the prior art, or the part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium and includes several instructions for enabling a computer device (which can be a personal computer, server, or network device, etc.) to execute all or part of the steps of the various embodiments of the present application. The aforementioned storage medium includes various media that can store program codes, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk.

[0118] In the description of this application, it should be noted that the terms "first", "second", etc. are only used to distinguish the description and cannot be understood as indicating or implying relative importance.

[0119] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present application, rather than to limit them. Although the present application has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some or all of the technical features therein. These modifications or replacements do not deviate the essence of the corresponding technical solutions from the scope of the technical solutions of the embodiments of the present application.

Claims

1. A cloud host-based environment perception detection method, characterized in that: The method comprises: Collect initial cloud perception data of the cloud host through a preset data collection method; Performing data cleaning and feature extraction processing on the initial cloud perception data to obtain pre-processed cloud perception data; The pre-processed cloud perception data is subjected to pattern recognition processing and behavior prediction processing, abnormal identification results are obtained, and potential environmental changes of the cloud host are predicted, so as to perform security reinforcement processing on the cloud host.

2. The cloud host-based environment perception detection method according to claim 1 is characterized in that: The preset data collection method includes one or more of physical perception, virtual detection and flow probe, and correspondingly, the initial cloud perception data includes one or more of cloud environment data, cloud performance data and cloud flow data; Collect cloud environment data of cloud hosts through preset data collection methods, including: When physical sensing is used to collect data, cloud environment data is collected at a preset period by sensors installed in the cloud data center, and the cloud environment data is uploaded to the cloud platform through edge computing nodes; When a virtual probe is used to collect data, cloud performance data is obtained by calling the log interface and virtualization API of the cloud host; wherein the cloud performance data includes virtual machine performance data and abnormal access data for monitoring abnormal access behavior of the cloud host, the virtual machine performance data includes at least CPU utilization, memory occupancy and network traffic, and the abnormal access data includes at least repeated login failure records; When a traffic probe is used to collect data, the cloud traffic data in the cloud host is captured in real time.

3. The cloud host-based environment perception detection method according to claim 1 is characterized in that: The initial cloud perception data is cleaned and feature extracted to obtain pre-processed cloud perception data, including: Performing data denoising processing on the initial cloud sensing data, and performing data normalization processing on the denoised data; Key features are extracted through principal component analysis to obtain preprocessed cloud perception data.

4. The cloud host-based environment perception detection method according to claim 1 is characterized in that: Performing pattern recognition processing and behavior prediction processing on the pre-processed cloud perception data, monitoring abnormal recognition results and predicting potential environmental changes of the cloud host, including: Based on the pre-trained first neural network model, the pre-processed cloud perception data is subjected to abnormal pattern recognition processing to monitor the abnormal mode of the cloud host during operation and the abnormal operation behavior data of the cloud host; Based on the pre-trained second neural network model, behavior prediction processing is performed on the pre-processed cloud perception data to predict potential environmental change data of the cloud host.

5. The cloud host-based environment perception detection method according to claim 4 is characterized in that: The first neural network model includes a convolutional neural network, and the second neural network includes a long short-term memory network.

6. The cloud host-based environment perception detection method according to claim 4 is characterized in that: The method further comprises: Automatically configure security testing based on the anomaly identification results and report them in the form of logs.

7. The cloud host-based environment perception detection method according to claim 6 is characterized in that: The method further comprises: The abnormal mode in which the cloud host is running, the potential environmental change data of the cloud host and the log reporting results are displayed on the graphical user interface.

8. An environment sensing detection device based on a cloud host, characterized in that: The device comprises: A collection component, used to collect initial cloud perception data of the cloud host through a preset data collection method; A processing component, used for performing data cleaning and feature extraction processing on the initial cloud perception data to obtain pre-processed cloud perception data; The detection component is used to perform pattern recognition processing and behavior prediction processing on the pre-processed cloud perception data, identify abnormal results and predict potential environmental changes of the cloud host, so as to perform security reinforcement processing on the cloud host.

9. An electronic device, characterized in that: It includes a processor and a memory, the memory stores computer executable instructions that can be executed by the processor, and the processor executes the computer executable instructions to implement the cloud host-based environment perception detection method as described in any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer-executable instructions. When the computer-executable instructions are called and executed by the processor, the computer-executable instructions prompt the processor to implement the cloud host-based environment perception detection method as described in any one of claims 1 to 7.

Images