Traffic collection method, apparatus and device, and computer readable storage medium

Abstract

The invention provides a flow collection method, device and equipment and a computer readable storage medium, and the method comprises the steps: searching a calculation instance group to which a to-be-collected calculation instance belongs for each to-be-collected calculation instance in a cloud platform, and grouping each calculation instance in the cloud platform into a plurality of calculation instance groups in advance, each computing instance group is configured with a corresponding flow collection strategy, and all similar computing instances in the cloud platform are located in the same computing instance group; for each to-be-collected calculation instance, flow collection is carried out on the to-be-collected calculation instance according to the flow collection strategy corresponding to the calculation instance group to which the to-be-collected calculation instance belongs, and when the calculation instance changes, the used flow collection strategy can still be found through grouping to carry out flow collection. Flow collection under the condition of dynamic change of the calculation instance is realized.

Description

Technical Field

[0001] The present application relates to the field of network security, and more specifically, to a flow collection method, apparatus, device, and computer-readable storage medium. Background Art

[0002] In the prior art, traffic collection strategies are all static, that is, the traffic collection strategy of each computing instance is configured, and traffic collection is performed according to the traffic collection strategy.

[0003] However, in a cloud-native environment, computing instances (such as containers) are constantly being eliminated and newly created, that is, computing instances are constantly changing dynamically. This results in the configuration of traffic collection policies according to existing technologies. When the original computing instance is eliminated or a new computing instance is established, the traffic collection policies retained after the computing instance is eliminated may not necessarily be adapted to the newly created computing instance, and the newly created computing instance may not find an available traffic collection policy. Therefore, the existing static traffic collection policy configuration scheme cannot meet the traffic collection needs in a cloud-native environment. Summary of the invention

[0004] The purpose of the embodiments of the present application is to provide a flow collection method, device, equipment and computer-readable storage medium to realize flow collection when computing instances change dynamically.

[0005] In a first aspect, an embodiment of the present application provides a traffic collection method, which is applied to a traffic collection device, and the method includes: for each computing instance to be collected in the cloud platform, searching for the computing instance group to which the computing instance to be collected belongs, wherein the computing instances in the cloud platform are pre-grouped into multiple computing instance groups, and each computing instance group is configured with a corresponding traffic collection strategy, and all similar computing instances in the cloud platform are located in the same computing instance group; for each computing instance to be collected, traffic is collected for the computing instance to be collected according to the traffic collection strategy corresponding to the computing instance group to which the computing instance to be collected belongs.

[0006] The above-mentioned traffic collection method divides the computing instances into different groups, and performs traffic collection according to the traffic collection strategy corresponding to the group to which the computing instances belong. When the computing instances change, the corresponding traffic collection strategy can still be found through the group to perform traffic collection, thereby realizing the collection of traffic when the computing instances change dynamically.

[0007] In an optional embodiment of the present application, the method also includes: sending group information of each of the computing instance groups to a threat detection device, the group information including a virtual extended local area network identifier VNI and notification information of the computing instance; after collecting traffic for the computing instance to be collected according to a traffic collection policy corresponding to the group to which the computing instance to be collected belongs, the method also includes: sending the traffic and VNI of the computing instance to be collected to the threat detection device, so that when the threat detection device determines that there is a threat in the traffic, according to the VNI of the computing instance to be collected, the target group information with the VNI is determined from the group information of each computing instance group, and a threat alarm is issued based on the notification information in the target group information.

[0008] In the above embodiment, the traffic of the computing instance to be collected carries the virtual extended local area network identifier VNI and is sent to the threat detection device, so that the threat detection device matches the traffic with the computing instance and can identify the computing instance of the traffic.

[0009] In an optional embodiment of the present application, the traffic collection device includes multiple proxy sub-modules, and each of the proxy sub-modules is respectively arranged on each node of the cloud platform; before collecting traffic for the computing instance to be collected according to the traffic collection strategy corresponding to the computing instance group to which the computing instance to be collected belongs, the method also includes: for each computing instance to be collected, annotating the computing instance according to the traffic collection strategy corresponding to the computing instance group to which the computing instance to be collected belongs, and generating annotation information; the annotation information includes the policy content of the traffic collection strategy; correspondingly, for each computing instance to be collected, traffic is collected for the computing instance to be collected according to the traffic collection strategy corresponding to the computing instance group to which the computing instance to be collected belongs, including: for each computing instance to be collected, traffic is collected for the computing instance to be collected according to the annotation information of the computing instance to be collected through the proxy sub-module of the node where the computing instance to be collected is located.

[0010] In the above embodiment, the proxy submodule is used to perform traffic collection, thereby decoupling the traffic collection function from the grouping function, and can enhance the robustness of the traffic collection method.

[0011] In an optional embodiment of the present application, for each computing instance to be collected, the computing instance is annotated according to the traffic collection policy corresponding to the computing instance group to which the computing instance to be collected belongs, and annotation information is generated, including: for each computing instance group, and the traffic collection policy of the computing instance group, a first custom resource CRD object corresponding to the computing instance group is generated; the first CRD object carries the traffic collection policy of the corresponding computing instance group; for each computing instance to be collected, the computing instance is annotated according to the first CRD object of the computing instance group to which the computing instance to be collected belongs, and the annotation information is generated.

[0012] In the above embodiment, the computing instance is annotated to generate annotation information, and the proxy submodule can independently realize traffic collection based on the annotation only, decoupling the proxy submodule from other parts of the traffic collection device, thereby enhancing the scalability and robustness of the traffic collection device.

[0013] In an optional embodiment of the present application, for each computing instance to be collected, traffic is collected on the computing instance according to the annotation information of the computing instance through the proxy sub-module of the node where the computing instance to be collected is located, including: for each computing instance to be collected, the annotation information of the computing to be collected is obtained through the proxy sub-module of the node where the computing instance to be collected is located, and a local traffic collection strategy for the computing instance to be collected is generated in the node; the local traffic collection strategy includes the strategy content in the annotation information; and traffic is collected on the computing instance according to the local traffic collection strategy through the proxy sub-module of the node where the computing instance to be collected is located.

[0014] In the above embodiment, a local traffic collection strategy is generated according to the annotation of the computing instance, and traffic collection is performed directly according to the local traffic collection strategy, which can avoid multiple readings and improve collection efficiency.

[0015] In an optional embodiment of the present application, for each computing instance to be collected, before obtaining the annotation information of the computing to be collected through the proxy sub-module of the node where the computing instance to be collected is located, and generating the local traffic collection policy of the computing instance to be collected in the node, the method also includes: determining whether there is a target local traffic collection policy in the node through the proxy sub-module of the node where the computing instance to be collected is located; the target local traffic collection policy is: the local traffic collection policy of the computing instance in the node that belongs to the same computing instance group as the computing instance to be collected; the method also includes: when the target local traffic collection policy exists in the node, traffic collection is performed on the computing instance to be collected through the proxy sub-module of the node where the computing instance to be collected is located and the target local traffic collection policy.

[0016] In the above embodiment, when there is a target local traffic collection strategy, traffic collection is performed directly according to the target local traffic collection strategy, which can avoid repeatedly creating the same local traffic collection strategy, save storage space, and improve collection efficiency.

[0017] In an optional embodiment of the present application, the method also includes: monitoring changes in computing instances within the cloud platform; when a new computing instance is generated within the cloud platform, classifying the new computing instance into a computing instance group of the category to which the new computing instance belongs.

[0018] In the above embodiment, the changes of computing instances in the cloud platform are monitored. When new computing instances exist, they are grouped so that the new computing instances correspond to the traffic collection strategy, so that traffic can be collected from the new computing instances, thereby enhancing the collection capability of the traffic collection method.

[0019] In an optional embodiment of the present application, the method also includes: when the new computing instance is classified into the computing instance group of the category to which the new computing instance belongs, updating the second CRD object of the computing instance group of the category to which the new computing instance belongs; the second CRD object records the situation of the computing instance in the computing instance group to which it belongs.

[0020] In an optional embodiment of the present application, the method also includes: grouping the computing instances within the cloud platform according to preset grouping information; the grouping information includes at least one of the following: the cluster to which the computing instance belongs, the namespace of the computing instance, the service to which the computing instance belongs, the type of workload to which the computing instance belongs, and the label of the computing instance.

[0021] In the above embodiment, the computing instances are grouped according to the attribution information of the computing instances. The attribution information can simply and effectively divide all the computing instances, thereby avoiding omission of computing instances in the grouping.

[0022] In the second aspect, the present application provides a traffic collection device, which includes: a control end, which is used to search for the computing instance group to which each computing instance to be collected belongs in the cloud platform, wherein the computing instances in the cloud platform are pre-grouped into multiple computing instance groups, and each computing instance group is configured with a corresponding traffic collection strategy, and all similar computing instances in the cloud platform are located in the same computing instance group; an agent end, which is used to collect traffic for each computing instance to be collected according to the traffic collection strategy corresponding to the computing instance group to which the computing instance to be collected belongs.

[0023] In an optional embodiment of the present application, the cloud platform includes multiple nodes, each node includes at least one computing instance, the agent end includes multiple agent sub-modules, and each of the agent sub-modules is deployed on one of the nodes; the control end is also used to annotate each computing instance to be collected according to the traffic collection strategy corresponding to the computing instance group to which the computing instance to be collected belongs, and generate annotation information; the annotation information includes the policy content of the traffic collection strategy; the agent sub-module is used to obtain the annotation information of the computing instance to be collected in the node, and perform traffic collection on the computing instance to be collected based on the annotation information.

[0024] In an optional embodiment of the present application, the control end includes a group control module and an annotation module; the group control module is used to generate a first custom resource CRD object corresponding to each computing instance group and the traffic collection strategy of the computing instance group; the first CRD object carries the traffic collection strategy of the corresponding computing instance group; the annotation module is used to annotate each computing instance to be collected according to the first CRD object of the computing instance group to which the computing instance to be collected belongs, and generate the annotation information.

[0025] In a third aspect, the present application provides an electronic device, comprising: a processor; a memory for storing processor-executable instructions; wherein the processor is configured to execute the processor-executable instructions to implement a traffic collection method as described in any one of the first aspects.

[0026] In a fourth aspect, the present application provides a computer storage medium, wherein the computer-readable storage medium stores computer program instructions, and when the computer program instructions are read and executed by a computer, the flow collection method as described in any one of the first aspects is executed. BRIEF DESCRIPTION OF THE DRAWINGS

[0027] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings required for use in the embodiments of the present application will be briefly introduced below. It should be understood that the following drawings only show certain embodiments of the present application and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying creative work.

[0028] Figure 1 A flow chart of a flow collection method provided in an embodiment of the present application;

[0029] Figure 2 A schematic block diagram of a flow collection device provided in an embodiment of the present application;

[0030] Figure 3A schematic block diagram of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0031] The technical solutions in the embodiments of the present application will be described below in conjunction with the drawings in the embodiments of the present application.

[0032] In the prior art, traffic is generally mirrored to NDS (threat detection device) and other detection devices for threat detection based on physical switch port mirroring. In cloud environments, cloud vendors generally provide traffic mirroring functions based on cloud host elastic network cards to mirror cloud host traffic to vNDS (virtual threat detection device) for threat detection. The alarm styles output by NDS and vNDS are based on the IP five-tuple method, and the asset is located and the alarm is handled through the IP in the alarm. In the prior art, the traffic collection strategies are all static and are all configured once based on IP.

[0033] However, in a cloud-native environment, the number and IP addresses of container workloads often change. The lifecycle of most containers does not exceed 5 minutes. The IP address of a container changes during reconstruction or migration. At the same time, the number of container workloads will be elastically scaled according to the size of the business. In the case where the IP address and number of container workloads change dynamically, a static traffic collection strategy cannot meet the needs.

[0034] Based on this, the present application proposes a traffic collection method to group computing instances according to their attribution information. The attribution information can simply and effectively divide all computing instances to avoid omission of computing instances in the grouping.

[0035] Figure 1 A flow chart of a traffic collection method provided for the present application, the method is applied to a traffic collection device, the traffic collection device is deployed on a cloud platform, which is also called a cloud computing platform, and refers to a computing service platform based on cloud computing technology, which is used to provide flexible, scalable, and shareable computing resources and system services. The cloud platform also runs an operating system for resource container scheduling, such as the kubernetes system. Multiple computing instances are managed under the resource container scheduling system. The computing instance is also called a Pod, which is a logical component that brings together multiple application containers, storage resources, and other configuration options that support container operation. It is the deployment unit and atomic operation unit of the resource container scheduling system. The computing instance can be a virtual machine (Virtual Machine), a container (dockers), etc.

[0036] like Figure 1 As shown, the method includes steps 110 to 120:

[0037] Step 110, for each computing instance to be collected in the cloud platform, find the computing instance group to which the computing instance to be collected belongs. The computing instances in the cloud platform are pre-grouped into multiple computing instance groups, and each computing instance group is configured with a corresponding traffic collection strategy. All similar computing instances in the cloud platform are located in the same computing instance group.

[0038] Get the computing instance of the traffic to be collected, and find out which computing instance group the computing instance belongs to. The computing instance group is generated by pre-grouping. For example, all computing instances under the resource container scheduling system in the cloud platform are grouped in advance, and computing instances of the same type are grouped into the same group to generate multiple computing instance groups. The same type in the above refers to the same type. The computing instances can be classified according to the preset information, and the computing instances of the same type can be grouped according to the classification.

[0039] In one embodiment of the present application, the method further includes: grouping the computing instances within the cloud platform according to preset grouping information; the grouping information includes at least one of the following: the cluster to which the computing instance belongs, the namespace of the computing instance, the service to which the computing instance belongs, the type of workload to which the computing instance belongs, and the label of the computing instance.

[0040] The container scheduling system can manage multiple clusters. A cluster consists of a group of nodes. A node is a virtual machine or a physical machine that includes multiple computing instances.

[0041] Namespace is a mechanism that divides resources in the same cluster into isolated groups. Service is a component that runs on pods and provides services. It selects pods with certain characteristics and defines an access method for them. Which pods a service selects is usually determined by LabelSelector. Label is a defined label for each pod, which can be efficiently queried and monitored by label selectors.

[0042] Each computing instance in the container scheduling system can be attributed to different concepts, and computing instances belonging to the same concept are regarded as computing instances of the same type, thereby realizing grouping. Therefore, grouping information can be set according to the characteristics to which the computing instances can be attributed, and the computing instances of the resource container scheduling system can be grouped. For example, the grouping information is set to group the computing instances of the same cluster into one group, thereby grouping the computing instances in the container scheduling system.

[0043] No matter how the computing instance changes, it is always attributed to the concept of the container scheduling system. The computing instance always has the attribute of belonging. For example, whether the computing instance is generated or destroyed, it will be located in a cluster. When each group corresponds to a traffic collection strategy, the computing instance can always correspond to a traffic collection strategy, which can realize the collection of computing instance traffic. For example, the grouping information is set to: the cluster to which the computing instance belongs. After grouping according to the grouping information, when a new computing instance is generated, it will also be grouped. Furthermore, when it is collected, it can be applied to the existing traffic collection strategy. For example, in response to the change of the computing instance IP, although the IP has changed, the computing instance still belongs to the existing group and can still be collected through the traffic collection strategy.

[0044] In the above embodiment, the computing instances are grouped according to the attribution information of the computing instances. The attribution information can simply and effectively divide all the computing instances, thereby avoiding omission of computing instances in the grouping.

[0045] Step 120 , for each computing instance to be collected, traffic is collected for the computing instance to be collected according to the traffic collection strategy corresponding to the computing instance group to which the computing instance to be collected belongs.

[0046] The computing instance to be collected is a computing instance that needs to perform flow collection. For a computing instance to be collected, the flow collection device will perform flow collection on the computing instance to be collected according to the flow collection strategy corresponding to the computing instance group to which the computing instance to be collected belongs.

[0047] For example, in the above embodiment of grouping based on the cluster to which the computing instance belongs, the computing instances of the same cluster are grouped together. When the computing instance changes, the IP of a computing instance changes. However, when traffic is collected for the computing instance, the grouping of the computing instance can be found based on the cluster to which the computing instance belongs, thereby obtaining the traffic collection strategy of the computing instance, and the traffic can still be collected through the traffic collection strategy without being affected by the IP change.

[0048] Similarly, when a computing instance changes and is generated in a new computing instance, when traffic is collected for the computing instance, the grouping of the computing instance can be discovered based on the cluster to which the computing instance belongs, thereby obtaining the traffic collection strategy of the computing instance, which can be applied to the existing traffic collection strategy to achieve traffic collection.

[0049] The above-mentioned traffic collection method divides the computing instances into different groups, and performs traffic collection according to the traffic collection strategy corresponding to the group to which the computing instances belong. When the computing instances change, the corresponding traffic collection strategy can still be found through the group to perform traffic collection, thereby realizing the collection of traffic when the computing instances change dynamically.

[0050] In one embodiment of the present application, the traffic collection device includes multiple proxy sub-modules, and each of the proxy sub-modules is respectively arranged on each node of the cloud platform; before collecting traffic for the computing instance to be collected according to the traffic collection strategy corresponding to the computing instance group to which the computing instance to be collected belongs, the method also includes: for each computing instance to be collected, annotating the computing instance according to the traffic collection strategy corresponding to the computing instance group to which the computing instance to be collected belongs, and generating annotation information; the annotation information includes the policy content of the traffic collection strategy; correspondingly, for each computing instance to be collected, traffic is collected for the computing instance to be collected according to the traffic collection strategy corresponding to the computing instance group to which the computing instance to be collected belongs, including: for each computing instance to be collected, traffic is collected for the computing instance to be collected according to the annotation information of the computing instance to be collected through the proxy sub-module of the node where the computing instance to be collected is located.

[0051] For each computing instance to be collected, the traffic collection strategy corresponding to the computing instance group to which the computing instance to be collected belongs can be obtained, and the computing instance can be annotated according to the obtained traffic collection strategy to generate annotation information, wherein the annotation information includes the policy content of the traffic collection strategy, such as traffic filtering conditions and traffic outbound addresses. Traffic filtering conditions refer to the conditions for filtering traffic, such as filtering traffic based on IP five-tuples, and traffic outbound addresses refer to the addresses to which traffic should be sent. For example, multiple threat detection devices can be set, and an address can be set for each threat detection device. The address of each threat detection device is the traffic outbound address.

[0052] The traffic collection device can be provided with multiple proxy submodules, and one proxy submodule is deployed on a node managed by the container scheduling system, and the two correspond one to one.

[0053] Each proxy submodule collects traffic from the computing instance in the node where it is located according to the annotation information of the computing instance to be collected.

[0054] In the above embodiment, the proxy submodule is used to perform traffic collection, thereby decoupling the traffic collection function from the grouping function, and can enhance the robustness of the traffic collection method.

[0055] In one embodiment of the present application, for each computing instance to be collected, the computing instance is annotated according to the traffic collection strategy corresponding to the computing instance group to which the computing instance to be collected belongs, and annotation information is generated, including: for each computing instance group, and the traffic collection strategy of the computing instance group, a first custom resource CRD object corresponding to the computing instance group is generated; the first CRD object carries the traffic collection strategy of the corresponding computing instance group; for each computing instance to be collected, the computing instance is annotated according to the first CRD object of the computing instance group to which the computing instance to be collected belongs, and the annotation information is generated.

[0056] CRD (Custom Resource Definition) is a resource object customized by the developer. For each computing instance group, a first custom resource CRD object is generated based on the information of the computing instance group, such as the group's ownership information, the information of the computing instances in the group, and the traffic collection strategy of the computing instance group. The traffic collection strategy used to generate the first custom resource CRD object needs to be saved in the CRD object, such as generating the first custom resource CRD object in the form of a label, and at the same time making the first CRD object carry the traffic collection strategy of the corresponding computing instance group.

[0057] For each computing instance to be collected, the computing instance is annotated according to the first CRD object of the computing instance group to which the computing instance to be collected belongs, so as to generate the annotation information.

[0058] In the above embodiment, the computing instance is annotated to generate annotation information, and the proxy submodule can independently realize traffic collection based on the annotation only, decoupling the proxy submodule from other parts of the traffic collection device, thereby enhancing the scalability and robustness of the traffic collection device.

[0059] In one embodiment of the present application, for each computing instance to be collected, traffic is collected on the computing instance according to the annotation information of the computing instance through the proxy sub-module of the node where the computing instance to be collected is located, including: for each computing instance to be collected, the annotation information of the computing to be collected is obtained through the proxy sub-module of the node where the computing instance to be collected is located, and a local traffic collection strategy for the computing instance to be collected is generated in the node; the local traffic collection strategy includes the strategy content in the annotation information; and traffic is collected on the computing instance according to the local traffic collection strategy through the proxy sub-module of the node where the computing instance to be collected is located.

[0060] For each computing instance to be collected in the node, the proxy submodule obtains the annotation information of the computing instance to be collected, and generates a local traffic collection strategy for the computing instance to be collected in the node based on the obtained annotation information. The local traffic collection strategy includes the strategy content in the annotation information.

[0061] Then, for each computing instance to be collected, the agent submodule of the node where the computing instance to be collected is located collects traffic for the computing instance according to the local traffic collection strategy corresponding to the computing instance to be collected.

[0062] In the above embodiment, a local traffic collection strategy is generated according to the annotation of the computing instance, and traffic collection is performed directly according to the local traffic collection strategy, which can avoid multiple readings and improve collection efficiency.

[0063] In one embodiment of the present application, for each computing instance to be collected, before obtaining the annotation information of the computing to be collected through the proxy sub-module of the node where the computing instance to be collected is located, and generating the local traffic collection policy of the computing instance to be collected in the node, the method also includes: determining whether there is a target local traffic collection policy in the node through the proxy sub-module of the node where the computing instance to be collected is located; the target local traffic collection policy is: the local traffic collection policy of the computing instance in the node that belongs to the same computing instance group as the computing instance to be collected; the method also includes: when the target local traffic collection policy exists in the node, traffic is collected for the computing instance to be collected through the proxy sub-module of the node where the computing instance to be collected is located and the target local traffic collection policy.

[0064] For a computing instance to be collected, the proxy submodule of the node where the computing instance to be collected is located determines whether there is a target local traffic collection policy corresponding to the computing instance to be collected in the node; the target local traffic collection policy is: the local traffic collection policy of the computing instance in the node that belongs to the same computing instance group as the computing instance to be collected. For example, for a computing instance to be collected, the proxy submodule searches on the node whether a local traffic collection policy has been established for the computing instance in the same group as the computing instance.

[0065] In the case where a target local traffic collection policy exists in the node, the proxy submodule may perform traffic collection on the computing instance to be collected according to the target local traffic collection policy.

[0066] In the above embodiment, when there is a target local traffic collection strategy, traffic collection is performed directly according to the target local traffic collection strategy, which can avoid repeatedly creating the same local traffic collection strategy, save storage space, and improve collection efficiency.

[0067] In one embodiment of the present application, the method also includes: monitoring changes in computing instances within the cloud platform; when a new computing instance is generated within the cloud platform, classifying the new computing instance into a computing instance group of the category to which the new computing instance belongs.

[0068] Monitor changes in computing instances in the container scheduling system. When a new computing instance is generated in the cloud platform, classify the computing instance into a computing instance group of the corresponding category.

[0069] When a computing instance is grouped, it corresponds to a traffic collection strategy, and the traffic collection device can perform traffic collection according to the corresponding traffic collection strategy.

[0070] In the above embodiment, the changes of computing instances in the cloud platform are monitored. When new computing instances exist, they are grouped so that the new computing instances correspond to the traffic collection strategy, so that traffic can be collected from the new computing instances, thereby enhancing the collection capability of the traffic collection method.

[0071] In one embodiment of the present application, the method also includes: when the new computing instance is classified into the computing instance group of the category to which the new computing instance belongs, updating the second CRD object of the computing instance group of the category to which the new computing instance belongs; the second CRD object records the situation of the computing instance in the computing instance group to which it belongs.

[0072] After the new computing instance is classified into the computing instance group of the category to which the new computing instance belongs, the second CRD object of the computing instance group is updated. In this embodiment, the second CRD object records the situation of the computing instance in the computing instance group.

[0073] In one embodiment of the present application, the method also includes: sending group information of each of the computing instance groups to a threat detection device, the group information including the virtual extended local area network identifier VNI and notification information of the computing instance; after collecting traffic for the computing instance to be collected according to the traffic collection policy corresponding to the group to which the computing instance to be collected belongs, the method also includes: sending the traffic and VNI of the computing instance to be collected to the threat detection device, so that when the threat detection device determines that there is a threat in the traffic, according to the VNI of the computing instance to be collected, the target group information with the VNI is determined from the group information of each computing instance group, and a threat alarm is issued based on the notification information in the target group information.

[0074] After the grouping is completed, grouping information is generated and sent to the threat detection device, which is used to detect the traffic. The grouping result carries the virtual extended local area network identifier VNI and notification information of the computing instance group. VNI (VXLAN Network Identifier) ​​is used to represent a virtual machine in a VXLAN network. VXLAN (Visual extensible Local Area Network) is an extension protocol of a VLAN. In this application, the traffic detection device and the threat detection device communicate through VXLAN. The notification information may include the group name of each group, which computing instances are in the group, etc.

[0075] After the traffic collection is completed, the traffic and VNI of the computing instance to be collected are sent to the threat detection device.

[0076] The threat detection device detects the received traffic, and when it is determined that there is a threat in the traffic, the VNI of the computing instance to be collected contained in the traffic is determined from the group information of each computing instance group to determine the target group information with the VNI. For example, the VNI contained in the traffic is matched with the VNI in the target group information, and a threat alarm is issued according to the notification information in the target group information. The notification information is used to specify the alarm method, and the alarm method includes but is not limited to displaying on the display screen of the threat device itself, broadcasting by voice, sending to a preset engineer terminal, etc.

[0077] In the above embodiment, the traffic of the computing instance to be collected carries the virtual extended local area network identifier VNI and is sent to the threat detection device, so that the threat detection device matches the traffic with the computing instance and can identify the computing instance of the traffic.

[0078] The present application also provides another embodiment of the traffic collection method. In this embodiment, the resource container management system running on the cloud platform is a Kubernetes system. The method is applied to a traffic collection device, which is composed of a platform entrance, a first control terminal, a second control terminal, and a proxy terminal. The method includes:

[0079] The first control end (KSPM controller) is the core controller of the kubernetes cluster, which is mainly used for the collection of cloud-native assets. The KSPM controller dynamically senses the changes of resource objects in K8S by connecting to the K8S cluster API and monitoring mechanisms such as the watch mechanism, and dynamically generates cloud-native asset groups. The groups can be grouped according to clusters, namespaces, services, workload types, and labels.

[0080] The first control terminal sends the grouping information to the platform portal (CSPM Platform), where users can view cloud native asset groups and assets that pass through the groups, and set traffic collection strategies based on the groups. Specifically, after users view cloud native asset groups through the CSPM Platform, they can set traffic collection strategies for different asset groups as needed. The traffic collection strategy mainly includes the asset groups to be collected, traffic filtering conditions, and traffic outbound addresses. CSPMPlatform sends the traffic collection strategy set by the user to the KSPM controller.

[0081] After receiving the traffic collection strategy, the KSPM controller searches for the corresponding pod object according to the asset group to be collected indicated in the traffic collection strategy, and generates or updates the CRD object of the sniffergroup according to the attribute information of the searched Pod object.

[0082] The sniffer group controller reads the CRD object generated by the KSPM controller, and generates the CRD object of the sniffer policy based on the traffic filtering conditions, traffic outbound address, VNI information, etc. in the traffic collection policy. In addition, the sniffer group controller monitors the CRD object of the sniffer group.

[0083] The sniffer group controller matches the CRD object of the sniffer policy with the pod object that needs to collect traffic. If the match is successful, it means that the grouping and traffic collection strategy of the pod object have been found, and the pod that needs to collect traffic is marked with the corresponding annotation. The annotation mainly includes information such as the outbound address of the traffic and VNI information.

[0084] The agent on each K8S node obtains the annotation of the pod object on the node, caches and generates a local traffic collection strategy. In addition, the agent on each K8S node monitors the pod object on its own node, checks the changes in the annotation, and adjusts the local traffic collection strategy according to the traffic collection information in the annotation.

[0085] The proxy collects the traffic that needs to be collected and sends it out, and turns off the traffic collection that is not needed.

[0086] The proxy sends the collected traffic data (carrying VNI) through the Vxlan tunnel to the external threat detection device for threat detection.

[0087] Threat detection devices also receive cloud-native asset grouping information and VNIs assigned for traffic collection from the CSPM Platform through the control plane. Threat detection devices use VNIs to achieve a one-to-one correspondence between traffic and cloud-native assets.

[0088] Figure 2 A schematic block diagram of a flow collection device 200 provided in an embodiment of the present application is shown in FIG. Figure 2 As shown, the flow collection device 200 includes:

[0089] The control terminal 210 is used to search for the computing instance group to which the computing instance to be collected belongs for each computing instance to be collected in the cloud platform, wherein the computing instances in the cloud platform are pre-grouped into multiple computing instance groups, and each computing instance group is configured with a corresponding traffic collection strategy, and all computing instances of the same type in the cloud platform are located in the same computing instance group;

[0090] The agent 220 is used to collect traffic from each computing instance to be collected according to the traffic collection strategy corresponding to the computing instance group to which the computing instance to be collected belongs.

[0091] In an optional embodiment of the present application, the cloud platform includes a plurality of nodes, each node includes at least one computing instance, the agent terminal 220 includes a plurality of agent submodules, and each of the agent submodules is deployed on one of the nodes;

[0092] The control terminal 210 is further used to annotate each computing instance to be collected according to the traffic collection strategy corresponding to the computing instance group to which the computing instance to be collected belongs, and generate annotation information; the annotation information includes the strategy content of the traffic collection strategy;

[0093] The proxy submodule is used to obtain annotation information of the computing instance to be collected in the node, and collect traffic for the computing instance to be collected based on the annotation information.

[0094] In an optional embodiment of the present application, the control terminal 210 includes a group control module and an annotation module;

[0095] The group control module is used to generate a first custom resource CRD object corresponding to each computing instance group and the traffic collection strategy of the computing instance group; the first CRD object carries the traffic collection strategy of the corresponding computing instance group;

[0096] The annotation module is used to annotate each computing instance to be collected according to the first CRD object of the computing instance group to which the computing instance to be collected belongs, so as to generate the annotation information.

[0097] Figure 3 A schematic block diagram of an electronic device 300 provided in an embodiment of the present application is shown in FIG. Figure 3 As shown, the electronic device 300 includes: a processor 310 and a memory 320 for storing processor-executable instructions; wherein the processor 310 is configured to execute the processor-executable instructions to implement any of the above-mentioned traffic collection methods.

[0098] An embodiment of the present application further provides a computer storage medium, characterized in that computer program instructions are stored on the computer-readable storage medium, and when the computer program instructions are read and executed by a computer, any of the above-mentioned traffic collection methods is executed.

[0099] In the embodiments provided in the present application, it should be understood that the disclosed devices and methods can be implemented in other ways. The device embodiments described above are merely schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some communication interfaces, and the indirect coupling or communication connection of the devices or units can be electrical, mechanical or other forms.

[0100] In addition, the units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0101] Furthermore, the functional modules in the various embodiments of the present application may be integrated together to form an independent part, or each module may exist separately, or two or more modules may be integrated to form an independent part.

[0102] It should be noted that if the function is implemented in the form of a software function module and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application can essentially be embodied in the form of a software product, or the part that contributes to the prior art or the part of the technical solution. The computer software product is stored in a storage medium, including a number of instructions to enable a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM) random access memory (RAM), disk or optical disk, and other media that can store program codes.

[0103] In this document, relational terms such as first and second, etc. are used merely to distinguish one entity or operation from another entity or operation, but do not necessarily require or imply any such actual relationship or order between these entities or operations.

[0104] The above description is only an embodiment of the present application and is not intended to limit the protection scope of the present application. For those skilled in the art, the present application may have various modifications and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application shall be included in the protection scope of the present application.

Claims

1. A flow collection method, characterized in that: The method is applied to a flow collection device, and the method comprises: For each computing instance to be collected in the cloud platform, find the computing instance group to which the computing instance to be collected belongs, wherein the computing instances in the cloud platform are pre-grouped into multiple computing instance groups, and each computing instance group is configured with a corresponding traffic collection strategy, and all computing instances of the same type in the cloud platform are located in the same computing instance group; For each computing instance to be collected, traffic is collected for the computing instance to be collected according to the traffic collection strategy corresponding to the computing instance group to which the computing instance to be collected belongs.

2. The method according to claim 1, characterized in that The method further comprises: Sending grouping information of each computing instance group to a threat detection device, wherein the grouping information includes a virtual extended local area network identifier VNI of the computing instance and notification information; After collecting traffic from the computing instance to be collected according to the traffic collection strategy corresponding to the group to which the computing instance to be collected belongs, the method further includes: The traffic and VNI of the computing instance to be collected are sent to a threat detection device, so that when the threat detection device determines that there is a threat in the traffic, it determines the target group information with the VNI from the group information of each computing instance group according to the VNI of the computing instance to be collected, and issues a threat alarm based on the notification information in the target group information.

3. The method according to claim 1, characterized in that: The traffic collection device includes a plurality of proxy submodules, each of which is arranged on each node of the cloud platform; Before collecting traffic from the computing instance to be collected according to the traffic collection strategy corresponding to the computing instance group to which the computing instance to be collected belongs, the method further includes: For each computing instance to be collected, annotate the computing instance according to the traffic collection strategy corresponding to the computing instance group to which the computing instance to be collected belongs, and generate annotation information; the annotation information includes the strategy content of the traffic collection strategy; Correspondingly, for each computing instance to be collected, traffic is collected for the computing instance to be collected according to the traffic collection strategy corresponding to the computing instance group to which the computing instance to be collected belongs, including: For each computing instance to be collected, the agent submodule of the node where the computing instance to be collected is located collects traffic from the computing instance to be collected according to the annotation information of the computing instance to be collected.

4. The method according to claim 3, characterized in that For each computing instance to be collected, annotating the computing instance according to the traffic collection strategy corresponding to the computing instance group to which the computing instance to be collected belongs, and generating annotation information includes: For each computing instance group and the traffic collection strategy of the computing instance group, a first custom resource CRD object corresponding to the computing instance group is generated; the first CRD object carries the traffic collection strategy of the corresponding computing instance group; For each computing instance to be collected, the computing instance is annotated according to the first CRD object of the computing instance group to which the computing instance to be collected belongs, so as to generate the annotation information.

5. The method according to claim 3, characterized in that: For each computing instance to be collected, the agent submodule of the node where the computing instance to be collected is located collects traffic from the computing instance according to the annotation information of the computing instance, including: For each computing instance to be collected, the annotation information of the computing instance to be collected is obtained through the proxy submodule of the node where the computing instance to be collected is located, and a local traffic collection strategy of the computing instance to be collected is generated in the node; the local traffic collection strategy includes the strategy content in the annotation information; Traffic collection is performed on the computing instance according to the local traffic collection strategy through the proxy submodule of the node where the computing instance to be collected is located.

6. The method according to claim 5, characterized in that For each computing instance to be collected, before obtaining annotation information of the computing instance to be collected through the proxy submodule of the node where the computing instance to be collected is located and generating a local traffic collection strategy for the computing instance to be collected in the node, the method further includes: Determine whether there is a target local traffic collection policy in the node through the proxy submodule of the node where the computing instance to be collected is located; the target local traffic collection policy is: the local traffic collection policy of the computing instance in the node that belongs to the same computing instance group as the computing instance to be collected; The method further comprises: In the case where the target local traffic collection policy exists in the node, traffic collection is performed on the computing instance to be collected through the proxy submodule of the node where the computing instance to be collected is located and the target local traffic collection policy.

7. The method according to any one of claims 1 to 6, characterized in that The method further comprises: Monitoring changes in computing instances within the cloud platform; When a new computing instance is generated in the cloud platform, the new computing instance is classified into a computing instance group of the category to which the new computing instance belongs.

8. The method according to claim 7, characterized in that The method further comprises: When the new computing instance is classified into the computing instance group of the category to which the new computing instance belongs, the second CRD object of the computing instance group of the category to which the new computing instance belongs is updated; the second CRD object records the situation of the computing instance in the computing instance group.

9. The method according to any one of claims 1 to 6, characterized in that The method further comprises: Grouping computing instances in the cloud platform according to preset grouping information; The grouping information includes at least one of the following: The cluster to which the compute instance belongs, the namespace of the compute instance, the service to which the compute instance belongs, the type of workload to which the compute instance belongs, and the label of the compute instance.

10. A flow collection device, characterized in that: The flow collection device comprises: The control end is used to find the computing instance group to which each computing instance to be collected belongs for each computing instance to be collected in the cloud platform, wherein each computing instance in the cloud platform is pre-grouped into a plurality of computing instance groups, and each computing instance group is configured with a corresponding traffic collection strategy, and all computing instances of the same type in the cloud platform are located in the same computing instance group; The proxy end is used to collect traffic from each computing instance to be collected according to the traffic collection strategy corresponding to the computing instance group to which the computing instance to be collected belongs.

11. The device according to claim 10, characterized in that The cloud platform includes a plurality of nodes, each node includes at least one computing instance, the agent terminal includes a plurality of agent sub-modules, and each of the agent sub-modules is deployed on one of the nodes; The control end is further used to annotate each computing instance to be collected according to the traffic collection strategy corresponding to the computing instance group to which the computing instance to be collected belongs, and generate annotation information; the annotation information includes the strategy content of the traffic collection strategy; The proxy submodule is used to obtain annotation information of the computing instance to be collected in the node, and perform traffic collection on the computing instance to be collected according to the annotation information.

12. The device according to claim 11, characterized in that The control end includes a group control module and an annotation module; The group control module is used to generate a first custom resource CRD object corresponding to each computing instance group and the traffic collection strategy of the computing instance group; the first CRD object carries the traffic collection strategy of the corresponding computing instance group; The annotation module is used to annotate each computing instance to be collected according to the first CRD object of the computing instance group to which the computing instance to be collected belongs, so as to generate the annotation information.

13. An electronic device, characterized in that: include: processor; a memory for storing processor-executable instructions; The processor is configured to execute the processor executable instructions to implement the traffic collection method as described in any one of claims 1-9.

14. A computer storage medium, characterized in that: The computer-readable storage medium stores computer program instructions, and when the computer program instructions are read and executed by a computer, the flow collection method according to any one of claims 1 to 9 is executed.

Images