Private cloud security management method based on multi-dimensional feature data analysis

Abstract

The invention belongs to the technical field of private cloud security management, and discloses a private cloud security management method based on multidimensional feature data analysis. According to the method, the internal network security abnormal condition and the global network security abnormal condition are comprehensively evaluated based on the multi-dimensional feature data in the private cloud environment, the security situation can be comprehensively perceived, the problem can be quickly positioned and triggered for disposal, threats can be timely blocked, the private cloud security is comprehensively guaranteed, and the overall security and reliability are improved. According to the method, association analysis is carried out on the security exception condition and the global security exception condition of each independent service partition, and then the disposal measures of the corresponding level are triggered, so that a threat source can be accurately positioned, whether the exception is from the inside or the global can be quickly judged, and targeted measures are taken according to different exceptions. Automatic quick response can be realized, the processing time is greatly shortened, and the service continuity is guaranteed.

Description

Technical Field

[0001] The present invention belongs to the technical field of private cloud security management, and relates to a private cloud security management method based on multi-dimensional feature data analysis. Background Art

[0002] A private cloud is a dedicated cloud computing environment built by an enterprise based on its own needs using cloud computing technology. It is only used within the enterprise and can provide customized computing, storage, network and other resource services. With the popularization of cloud computing technology, private cloud has become an important choice for enterprise information construction due to its security and controllability.

[0003] Private cloud stores a large amount of sensitive data of enterprises, which is related to core interests. The security of private cloud can avoid data leakage, tampering and loss, ensure business continuity, and prevent economic losses and reputation damage caused by service interruption. Therefore, private cloud security management based on multi-dimensional feature data analysis is of great significance.

[0004] There are also technical solutions for private cloud security management in the prior art, for example, the Chinese invention patent for a security inspection method to prevent email leakage in a private cloud with publication number CN102082804A, which includes reviewing the email content and attachments through a mail server, issuing authorization and sending it to an authorized signature server if qualified, otherwise sending the email to an administrator; the administrator issues authorization to qualified emails and sends them to an authorized signature server, and unqualified emails will be discarded; the authorized signature server verifies the email and its authorization, and digitally signs and forwards it to the gateway if it passes, otherwise the email will be discarded; the gateway checks the email message, and if there is a digital signature from the authorized signature server and the verification is correct, the email is allowed to pass, otherwise the email will be discarded.

[0005] In addition, a Chinese invention patent for a private cloud platform information system security operation and maintenance method and system with publication number CN116743603A includes recording historical operation and maintenance operations and recording corresponding historical operation and maintenance problem information; monitoring the private cloud platform information system, and when operation and maintenance problems are detected, integrating all monitored operation and maintenance problems to form current operation and maintenance problem information; matching the current operation and maintenance problem information with the historical operation and maintenance problem information, and retrieving the historical operation and maintenance operations determined by matching; executing historical operation and maintenance operations, and performing secondary monitoring after completion, and when remaining operation and maintenance problems are detected, sending the remaining operation and maintenance problems to the engineer end; receiving manual operation and maintenance operations performed by engineers, monitoring the manual operation and maintenance operations, and sending the manual operation and maintenance operations to another engineer end in real time.

[0006] Although the above two schemes have proposed some solutions for private cloud security management, they still have certain limitations. For example, although Scheme 1 proposes security analysis and management of external emails, it ignores the security issues within the private cloud environment, which may lead to lateral penetration risks and abuse of authority within the environment. It is impossible to comprehensively evaluate whether there are security issues in the private cloud from multiple internal and global perspectives, which reduces the effectiveness of private cloud security management.

[0007] Solution 2 proposes to handle possible operation and maintenance problems through historical operation and maintenance records, and push the problems that cannot be handled to the administrator. This analysis method is relatively slow in problem handling and cannot dynamically implement targeted handling strategies for different problems, which greatly increases the harmfulness of security issues and reduces security management efficiency. Summary of the invention

[0008] In view of this, in order to solve the problems raised in the above background technology, a private cloud security management method based on multi-dimensional feature data analysis is proposed.

[0009] The purpose of the present invention can be achieved through the following technical solutions: A private cloud security management method based on multidimensional feature data analysis, including: S1, multidimensional feature data collection: real-time collection of multidimensional feature data in a private cloud environment, including user behavior logs, system usage records and resource access records.

[0010] S2. Establish business partition isolation: Micro-segment the private cloud based on business logic to generate multiple independent business partitions.

[0011] S3. Internal network security analysis: Build a lateral penetration risk index and a permission abuse index based on the user behavior logs and resource access records of each independent business partition to evaluate the internal network security anomalies of the private cloud.

[0012] S4. Global network security analysis: Build system resource anomaly rate and log event entropy value based on the user behavior logs and system usage records to evaluate the global network security anomalies of the private cloud.

[0013] S5. Abnormal situation response decision: Based on the preset security policy library, a comprehensive analysis is conducted on the security abnormalities of each independent business partition and the global security abnormalities to trigger the corresponding level of disposal measures.

[0014] Compared with the prior art, the beneficial effects of the present invention are as follows: (1) The present invention can comprehensively perceive the security situation, quickly locate problems and trigger disposal, block threats in time, comprehensively protect the security of private clouds, and improve overall security and reliability by comprehensively evaluating internal network security anomalies and global network security anomalies based on multi-dimensional feature data in a private cloud environment.

[0015] (2) The present invention can accurately locate the source of threats, quickly determine whether the anomaly is internal or global, and take targeted measures based on different anomalies by comprehensively analyzing the security anomalies of each independent business partition and the global security anomaly, thereby triggering corresponding level of disposal measures. This can achieve automated rapid response, greatly shorten processing time, and ensure business continuity. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings required for describing the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other accompanying drawings can be obtained based on these accompanying drawings without paying creative work.

[0017] Figure 1 It is a schematic diagram for implementing the steps of the method of the present invention.

[0018] Figure 2 A flowchart of internal network security anomaly identification and judgment corresponding to an embodiment provided by the present invention.

[0019] Figure 3 A global network security anomaly identification and judgment flow chart corresponding to an embodiment provided by the present invention. DETAILED DESCRIPTION

[0020] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0021] See also Figure 1 As shown, the present invention provides a private cloud security management method based on multi-dimensional feature data analysis, including: S1, multi-dimensional feature data collection: real-time collection of multi-dimensional feature data in a private cloud environment, including user behavior logs, system usage records and resource access records.

[0022] It should be noted that multi-dimensional feature data is the core foundation of private cloud security management, which mainly includes the following four types of key data: 1. User behavior log records: user operation tracks in the private cloud, such as login, file access, permission changes, etc., are used to identify abnormal operation behaviors (such as unauthorized access, high-frequency sensitive operations), which is an important basis for constructing a permission abuse index.

[0023] 2. Network traffic data: Captures network communication data within and at the boundaries of the private cloud, including source / destination IP, port, protocol and other information. It can analyze lateral penetration paths and abnormal traffic characteristics (such as malicious code propagation) to provide support for the calculation of the lateral penetration risk index.

[0024] 3. System usage records: Collect real-time utilization data of CPU, memory, storage and other resources, and generate system resource anomaly rate by comparing with historical averages to detect resource exhaustion attacks (such as DDoS) or configuration anomalies.

[0025] 4. Resource access records: Record the access frequency and path of each business partition to storage, database and other resources, which is used to build an access relationship map between business partitions and support the path analysis of the lateral penetration risk index.

[0026] S2. Establish business partition isolation: Micro-segment the private cloud based on business logic to generate multiple independent business partitions.

[0027] It should be noted that the specific method of dividing independent business partitions is: based on the functional characteristics, security requirements and data sensitivity of different business systems, a refined network segmentation strategy is adopted to concentrate the resources of the same business or related businesses in specific partitions, and cross-partition network traffic is restricted through access control strategies, thereby achieving secure isolation between different businesses and effectively reducing the risk of lateral penetration.

[0028] It should be noted that by dividing the private cloud into multiple independent business partitions, the following goals can be achieved: 1. Risk isolation: limit the lateral spread of security threats between different business systems.

[0029] 2. Resource management and control: Allocate independent computing, storage, and network resources based on business needs.

[0030] 3. Compliance support: meet industry data isolation requirements (such as GDPR, HIPAA).

[0031] S3. Internal network security analysis: Build a lateral penetration risk index and a permission abuse index based on the user behavior logs and resource access records of each independent business partition to evaluate the internal network security anomalies of the private cloud.

[0032] In a preferred embodiment of the present invention, the specific analysis method of the lateral penetration risk index is as follows: extract resource access records from the multi-dimensional feature data in the private cloud environment, obtain the numbers of other independent business partitions corresponding to each resource access record in each independent business area, and count the number of visits from each independent business partition to other independent business partitions, which is recorded as ,in , Indicates the independent business partition number. , , Indicates the number of independent business partitions. .

[0033] Based on the breadth-first algorithm, the shortest path length from each independent business partition to other independent business partitions is obtained, which is recorded as .

[0034] It should be noted that the breadth-first algorithm is a graph search algorithm that starts from the starting node and expands the search outward layer by layer. During the search process, it will give priority to visiting nodes that are closer to the starting node until the target node is found or all nodes are traversed. In the network structure of the private cloud, each independent business partition is regarded as a node in the graph, and the connections between partitions are regarded as edges. To begin, mark it as visited and put it in a queue.

[0035] When the queue is not empty, take out the node at the head of the queue and check whether it is the target node If so, then we have found arrive The search ends.

[0036] If it is not the target node, all the neighboring nodes of the node that have not been visited are marked as visited and added to the queue. These neighboring nodes are other independent business partitions directly connected to the current node.

[0037] As the search progresses, nodes that are farther and farther from the starting node will be gradually traversed. Every time a new node is traversed, the distance from it to the starting node (path length) is recorded.

[0038] When the target node is found By recording the distance information, we can get the distance from the starting node To the target node The shortest path length.

[0039] Using the formula Analyze and obtain the lateral penetration risk index ,in Indicates the preset The asset value of an independent business partition is predefined by the business system based on the importance of the assets.

[0040] It should be noted that the construction logic of the above formula is: 1. Numerator: Representatives from independent business divisions To Partition The number of visits reflects the frequency of business interactions between two different partitions. It is The asset value of an independent business partition is predefined by the business system based on the asset importance, reflecting the importance of the target partition assets. The multiplication of the two means that the more frequent the access and the higher the asset value of the target partition, the greater the contribution to the risk index.

[0041] 2. Denominator: It is obtained from independent business partitions based on the breadth-first algorithm. To Partition The longer the path length, the more difficult it is to penetrate from the source partition to the target partition, and the lower the risk.

[0042] 3. Double summation part: by partitioning all independent services and ( , From 1 to , From 1 to ) can be double-summed to obtain the comprehensive risk value of different business partitions in the entire private cloud environment based on access conditions, asset value, and penetration difficulty. Since the pairwise relationship between all partitions is considered in the calculation process, potential risk paths are avoided from being missed.

[0043] 4. Scaling part: Divide by Scaling to make the lateral penetration risk index Within a reasonable range, it is convenient to compare the risk values ​​in private cloud environments of different sizes. Shown in The total number of combinations of two partitions (excluding combinations from themselves) in a partition can be used to standardize the comprehensive risk value.

[0044] In a feasible embodiment, data simulation is performed based on the above formula, assuming that the number of independent business partitions is 3, and the corresponding simulation results are shown in Table 1.

[0045] Table 1. Simulation results of some data based on the lateral penetration risk index analysis formula

[0046]

[0047] For the above simulation data results, the lateral penetration risk index LPRV = 210 (no unit, because it is a comprehensive risk index calculated through various relative relationships), which comprehensively reflects the degree of lateral penetration risk between the three independent business partitions (excluding the situation of self-to-self). The larger the value, the higher the overall lateral penetration risk. In this simulation, 210 means that there is a certain degree of lateral penetration risk between different business partitions in the current private cloud environment.

[0048] In a preferred embodiment of the present invention, the specific analysis method of the permission abuse index is as follows: extract user behavior logs from the multi-dimensional feature data in the private cloud environment, and then classify the users based on the marked users to obtain the user behavior logs of each user, identify whether there are abnormal operation marks in each user behavior log, record the user behavior logs marked as abnormal operations as the abnormal operation records of the corresponding users, and extract the corresponding marked operation time and abnormal level.

[0049] It should be explained that the abnormality level may be low risk, medium risk or high risk.

[0050] Extract each abnormal operation record corresponding to each user within the preset window time, and count the number of abnormal operation records of each user, recorded as ,in Indicates the user's ID. , Indicates the number of users.

[0051] Based on the preset correspondence between the abnormal level and the abnormal operation risk index, the abnormal level corresponding to each monitored abnormal operation record is assigned a value, and the abnormal operation risk index corresponding to each monitored abnormal operation record of each user is obtained, which is recorded as ,in Indicates the number of the abnormal operation record monitored. , Indicates the number of abnormal operation records monitored.

[0052] In a preferred embodiment, the correspondence between the abnormality level and the abnormal operation risk index is: low risk corresponds to an abnormal operation risk index of 2, medium risk corresponds to an abnormal operation risk index of 3, and high risk corresponds to an abnormal operation risk index of 4.

[0053] Get the permission change time of each user, calculate the difference between the current time and the permission change time of each user to get the permission change duration of each user, and then calculate the ratio with the corresponding duration of the window time to get the stability of the permission change of each user, which is recorded as .

[0054] It needs to be explained that Reflects the stability of user permissions. The larger the value, the longer the permissions have not changed and the higher the stability (for example, the system administrator permissions are fixed). The smaller the value, the more frequent the permissions have been adjusted recently, and the higher the potential risk (such as a temporary permission delegation scenario).

[0055] It should be explained that permission changes in private cloud security management refer to adjustments to the user's permission level, access scope, or operating capabilities. This includes but is not limited to: adding or deleting user roles (such as upgrading from an ordinary user to an administrator), adjusting resource access permissions (such as adding file read and write permissions), authorizing / revoking sensitive operations (such as database deletion permissions), and modifying the validity period of permissions (such as issuing and revoking temporary permissions).

[0056] Using the formula Analyze and obtain the authority abuse index ,in Indicates The user authority level coefficient for each user is predefined by the system administrator based on preset user authority levels.

[0057] It should be noted that the construction logic of the above formula is: 1. Core calculation part: It is a comprehensive consideration of the data related to abnormal user operations. Indicates user The number of abnormal operation records within the preset window time reflects the frequency of abnormal operations by users; Is a user No. The abnormal operation risk index corresponding to each monitored abnormal operation record is assigned a value based on the preset correspondence between the abnormal level and the abnormal operation risk index to measure the risk level of each abnormal operation; Is a user The user authority level coefficient is predefined by the system administrator based on the preset user authority level, reflecting the level of user authority. The higher the authority, the greater the harm that may be caused by abuse; Indicates user The stability of permission changes is obtained by calculating the ratio of the permission change duration calculated by the difference between the current time and the permission change time to the corresponding duration of the window time. The lower the stability, the more frequent the permission changes are and the higher the risk of possible permission abuse. The impact of abnormal operation frequency, danger level, user authority, and stability of authority change on the risk of authority abuse is comprehensively considered, and then the average of all monitored abnormal operation records (from b=1 to B) is calculated to obtain the user The average risk value of privilege abuse under current monitoring conditions.

[0058] 2. Maximum value operation: The max function is used in the formula because in the case of multiple users (or multiple calculations of the same user in different monitoring windows), the maximum average permission abuse risk value is selected as the permission abuse index. This is to highlight the most risky situations. Once the risk of user abuse of permissions is prominent, it needs to be paid special attention and handled in order to promptly detect and prevent potential abuse of permissions from causing serious harm to the system.

[0059] In a feasible embodiment, data simulation is performed based on the above formula, and the corresponding simulation results are shown in Table 2.

[0060] Table 2: Some data simulation results based on the authority abuse index analysis formula

[0061]

[0062] It should be noted that, in order to facilitate calculation in the above simulation process, the abnormal operation risk index corresponding to each monitored abnormal operation record of each user is set to be consistent.

[0063] For the above simulation data results, the permission abuse index PAI = 20 (no unit, because it is a risk indicator calculated by combining multiple relative factors), which means that among the simulated group of users, there is a user with a relatively high risk of permission abuse. In practical applications, this value can be used as a reference for judging whether there is a permission abuse risk in the private cloud system and the severity of the risk.

[0064] In a preferred embodiment of the present invention, the specific analysis method for evaluating the internal network security anomalies of the private cloud is as follows: extracting the lateral penetration risk index and the authority abuse index, and then adding them according to the weights to obtain the internal network security anomaly index of the private cloud, and the internal network security anomaly index is used to evaluate the corresponding degree of anomalies of the internal network security anomalies of the private cloud.

[0065] It should be noted that the weights of the lateral penetration risk index and the authority abuse index are set based on business characteristics, security priorities, and historical situations. If the business has frequent interactions between partitions, the lateral penetration risk has a great impact on the business, and the weight of the lateral penetration risk index will be high; if the business has high requirements for authority management, the weight of the authority abuse index will be higher. If the enterprise pays more attention to preventing lateral attacks, it will increase the weight of the lateral penetration risk index; conversely, if it pays attention to authority abuse, it will increase the weight of the authority abuse index. Historical data will also be referenced. Which type of anomaly causes more problems will have a higher corresponding index weight.

[0066] For example, the corresponding weights of the lateral penetration risk index and the authority abuse index are .

[0067] S4. Global network security analysis: Build system resource anomaly rate and log event entropy value based on the user behavior logs and system usage records to evaluate the global network security anomalies of the private cloud.

[0068] In a preferred embodiment of the present invention, the specific analysis method of the system resource anomaly rate is as follows: extract the user behavior log system usage records from the multi-dimensional feature data in the private cloud environment, obtain the real-time utilization of each system resource within the preset window time, and simultaneously obtain the historical average utilization of each system resource corresponding to the system usage record.

[0069] Using the formula Analyze the system resource abnormality rate ,in Indicates Real-time utilization of system resources, Indicates The historical average utilization of system resources, Indicates the number of system resources. , Indicates the amount of system resources.

[0070] It should be noted that the construction logic of the above formula is: 1. Calculate the difference adjustment value: first calculate , compared with real-time utilization and historical average utilization When the real-time utilization is higher than the historical average utilization, the larger the difference, On the contrary, if the real-time utilization is not higher than the historical average utilization, the value is not positive.

[0071] 2. Screening effective differences: using , only keep the difference values ​​with utilization higher than 0.

[0072] 3. Calculate the comprehensive deviation value: for all system resources (from arrive )of The sum is calculated to obtain the comprehensive deviation of all resource utilization rates above the historical average.

[0073] 4. Obtain the abnormality rate: Divide the comprehensive deviation value by the total number of system resources , get the system resource abnormality rate , reflecting the degree of abnormality of overall system resources.

[0074] 5. Practical significance: Quantifying the degree of abnormality: System resource abnormality rate Provides quantitative indicators for private cloud system management. The higher the value, the more system resources have real-time utilization rates higher than the historical average, and the more serious the resource usage anomaly.

[0075] Assisting operation and maintenance decision-making: If it exceeds the normal range, the administrator can troubleshoot the problem based on this, such as determining whether there is resource overload, abnormal tasks, etc., and then take measures such as optimizing resource allocation and adjusting task scheduling to ensure stable operation of the system.

[0076] It should be noted that in a private cloud environment, the real-time usage and historical average usage of system resources such as server CPU, memory, hard disk storage space and network bandwidth in an enterprise's private cloud are used to calculate the system resource anomaly rate to ensure the stable operation of the private cloud.

[0077] In a preferred embodiment of the present invention, the specific analysis method of the log event entropy value is as follows: extract the multi-dimensional feature data in the private cloud environment, obtain the number of log events corresponding to the preset window time based on the user behavior log, and then calculate the proportion of each log event, which is recorded as ,in Indicates the number of the log event. , Indicates the number of log events.

[0078] It should be explained that log events refer to operational behavior data recorded in a structured or semi-structured form, including timestamp, user ID, operation type, resource object, result status, etc. It includes but is not limited to user login and logout, file read and write operations, database query and modification, permission change records, and system error warning information.

[0079] Using the formula Analyze and obtain the entropy value of log events .

[0080] It should be noted that the construction logic of the above analysis formula is: 1. Significance: Represents the proportion of the pth log event within the preset window time. In a private cloud environment, the frequency of various log events is different. By calculating the proportion of each log event in the total number of log events, we can clearly understand the relative frequency of its occurrence. For example, within a specific time period, there are 100 log events, of which 20 are resource access events. Then the proportion of resource access events is That is 20÷100=0.2, It reflects the distribution of different log events in the whole.

[0081] 2. Function: Logarithmic function Used to measure The uncertainty of the log event represented. When it is close to 0, it means that the log event rarely occurs in the whole, and its uncertainty is high. The absolute value of is large; when When it is close to 1, it means that the log event dominates the whole, occurs frequently, and has low uncertainty. The absolute value of is also larger; when qp=0.5, The absolute value of is the smallest. This shows that when the proportion of a certain type of log event is extreme, the uncertainty is low; the more balanced the proportion of various types of log events, the higher the uncertainty.

[0082] 3. Overall summation and symbolic meaning: for all arrive ( is the number of types of log events) Sum and then negate to get the entropy value of the log event The sum is to comprehensively consider the uncertainty of all different log events, and the negative is to make the final entropy value conform to common cognition - the higher the entropy value, the more disordered and chaotic the system is. When the value of is large, it means that the log events are scattered, there may be a variety of complex activities in the system, and the possibility of anomalies is high; when When the value is small, it indicates that log events are concentrated and the system runs relatively stable and orderly.

[0083] In a preferred embodiment of the present invention, the specific analysis method for evaluating the global network security anomaly of the private cloud is as follows: extract the system resource anomaly rate and the log event entropy value, and then sum them up according to the weights to obtain the global network security anomaly index of the private cloud. The global network security anomaly index is used to evaluate the degree of anomaly of the global network security anomaly of the private cloud.

[0084] It should be noted that the weights of system resource anomaly rate and log event entropy value are set based on: First, business characteristics. For businesses that rely heavily on system resource stability, the weight of system resource anomaly rate is high; for businesses that focus on data interaction and operation records, the weight of log event entropy value is high. Second, security strategy. If the enterprise pays more attention to resource security, the weight of system resource anomaly rate will be increased; if the enterprise focuses on monitoring abnormal operation behavior, the weight of log event entropy value will be increased. Third, refer to historical data and risk assessment. Which anomaly causes more security issues, the corresponding indicator weight will be higher.

[0085] For example, the corresponding weights of system resource abnormality rate and log event entropy value are: .

[0086] It should be noted that the present invention can comprehensively perceive the security situation, quickly locate problems and trigger disposal, block threats in time, comprehensively protect the security of private clouds, and improve overall security and reliability by comprehensively evaluating internal network security anomalies and global network security anomalies based on multi-dimensional feature data in a private cloud environment.

[0087] S5. Abnormal situation response decision: Based on the preset security policy library, a comprehensive analysis is conducted on the security abnormalities of each independent business partition and the global security abnormalities to trigger the corresponding level of disposal measures.

[0088] In a preferred embodiment of the present invention, the specific analysis method for comprehensively analyzing the security anomalies of each independent business partition and the global security anomaly situation is as follows: extract the internal network security anomaly index and the global network security anomaly index of the private cloud, and then compare them with the pre-set internal network security anomaly index threshold and the global network security anomaly index threshold, respectively.

[0089] It should be noted that the threshold of the internal network security anomaly index is set mainly based on the degree of internal security risk that the business can bear. For example, financial enterprises that are extremely strict with data security and authority management will set a lower threshold for their internal network security anomaly index. Once the index exceeds the threshold, it indicates that the risk of internal authority abuse or lateral penetration may have a serious impact on the business.

[0090] It should be noted that the threshold of the global network security anomaly index is set based on the business's requirements for the overall network security and stable operation. For example, during promotional activities, in order to ensure uninterrupted business, e-commerce companies will set the global network security anomaly index threshold slightly higher, allowing a certain degree of system resource fluctuations and log anomalies.

[0091] If the internal network security anomaly index and the global network security anomaly index are both less than or equal to the corresponding thresholds, it is determined that there is no security anomaly.

[0092] If the internal network security anomaly index is greater than the internal network security anomaly index threshold or the global network security anomaly index is greater than the global network security anomaly index threshold, it is determined that a security anomaly exists.

[0093] When a security anomaly is detected, the direction of the security anomaly is further determined and feedback is provided.

[0094] In a preferred embodiment of the present invention, the specific method of further determining the security anomaly is as follows: Figure 2 As shown, if the internal network security anomaly index is greater than the internal network security anomaly index threshold, the specific security anomaly is identified as an internal network security anomaly.

[0095] See also Figure 3 As shown, if the global network security anomaly index is greater than the global network security anomaly index threshold, the specific security anomaly is identified as a global network security anomaly.

[0096] In a preferred embodiment of the present invention, when a specific security anomaly is identified as an internal network security anomaly, it is necessary to further perform abnormal independent business partition identification and abnormal user identification, and the specific method is as follows: extract the lateral penetration risk index of each independent business partition, and then sort them from large to small, and record the independent business partition corresponding to the largest lateral penetration risk index as an abnormal independent business partition.

[0097] The authority abuse index of each user is extracted, and then the user corresponding to the maximum authority abuse index is selected as an abnormal user.

[0098] It should be noted that the present invention can accurately locate the source of threats, quickly determine whether the anomaly is internal or global, and take targeted measures based on different anomalies by comprehensively analyzing the security anomalies of each independent business partition and the global security anomaly, thereby triggering corresponding level of disposal measures. This can achieve automated rapid response, greatly shorten processing time, and ensure business continuity.

[0099] The above contents are merely examples and explanations of the concept of the present invention. Those skilled in the art may make various modifications or additions to the specific embodiments described or replace them in a similar manner. As long as they do not deviate from the concept of the invention or exceed the scope defined by the present invention, they shall all fall within the protection scope of the present invention.

Claims

1. A private cloud security management method based on multi-dimensional feature data analysis, characterized in that: include: S1. Multi-dimensional feature data collection: Real-time collection of multi-dimensional feature data in the private cloud environment, including user behavior logs, system usage records, and resource access records; S2. Establish business partition isolation: Micro-segment the private cloud based on business logic to generate multiple independent business partitions; S3. Internal network security analysis: Build a lateral penetration risk index and a permission abuse index based on the user behavior logs and resource access records of each independent business partition to evaluate the internal network security anomalies of the private cloud; S4. Global network security analysis: constructing the system resource anomaly rate and log event entropy value based on the user behavior logs and system usage records, and evaluating the global network security anomalies of the private cloud; S5. Abnormal situation response decision: Based on the preset security policy library, a comprehensive analysis is conducted on the security abnormalities of each independent business partition and the global security abnormalities to trigger the corresponding level of disposal measures.

2. A private cloud security management method based on multi-dimensional feature data analysis as claimed in claim 1, characterized in that: The specific analysis method of the lateral penetration risk index is as follows: Extract resource access records from the multi-dimensional feature data in the private cloud environment, obtain the IDs of other independent business partitions corresponding to each resource access record in each independent business area, and count the number of visits from each independent business partition to other independent business partitions, which is recorded as ,in , Indicates the independent business partition number. , , Indicates the number of independent business partitions. ; Based on the breadth-first algorithm, the shortest path length from each independent business partition to other independent business partitions is obtained, which is recorded as ; Using the formula Analyze and obtain the lateral penetration risk index ,in Indicates the preset The asset value of an independent business partition is predefined by the business system based on the importance of the assets.

3. A private cloud security management method based on multi-dimensional feature data analysis as claimed in claim 1, characterized in that: The specific analysis method of the authority abuse index is as follows: Extract user behavior logs from multi-dimensional feature data in a private cloud environment, and then classify them based on the labeled users to obtain the user behavior logs of each user, identify whether there are abnormal operation annotations in each user behavior log, record the user behavior logs marked as abnormal operations as the abnormal operation records of the corresponding users, and extract the corresponding marked operation time and abnormality level; Extract each abnormal operation record corresponding to each user within the preset window time, and count the number of abnormal operation records of each user, recorded as ,in Indicates the user's ID. , Indicates the number of users; Based on the preset correspondence between the abnormal level and the abnormal operation risk index, the abnormal level corresponding to each monitored abnormal operation record is assigned a value, and the abnormal operation risk index corresponding to each monitored abnormal operation record of each user is obtained, which is recorded as ,in Indicates the number of the abnormal operation record monitored. , Indicates the number of abnormal operation records monitored; Get the permission change time of each user, calculate the difference between the current time and the permission change time of each user to get the permission change duration of each user, and then calculate the ratio with the corresponding duration of the window time to get the stability of the permission change of each user, which is recorded as ; Using the formula Analyze and obtain the authority abuse index ,in Indicates The user authority level factor for each user is predefined by the system administrator based on preset user authority levels.

4. The private cloud security management method based on multi-dimensional feature data analysis according to claim 1, characterized in that: The specific analysis method for evaluating the internal network security anomalies of the private cloud is as follows: The lateral penetration risk index and the authority abuse index are extracted, and then the internal network security anomaly index of the private cloud is obtained by adding them according to the weights. The internal network security anomaly index is used to evaluate the abnormal degree corresponding to the internal network security anomaly of the private cloud.

5. The private cloud security management method based on multi-dimensional feature data analysis according to claim 1, characterized in that: The specific analysis method of the system resource abnormality rate is as follows: Extract user behavior log system usage records from multi-dimensional feature data in the private cloud environment, obtain the real-time utilization of each system resource within the preset window time, and obtain the historical average utilization of each system resource corresponding to the system usage record; Using the formula Analyze the system resource abnormality rate ,in Indicates Real-time utilization of system resources, Indicates The historical average utilization of system resources, Indicates the number of system resources. , Indicates the amount of system resources.

6. A private cloud security management method based on multi-dimensional feature data analysis as claimed in claim 1, characterized in that: The specific analysis method of the log event entropy value is as follows: Extract multi-dimensional feature data from the private cloud environment, obtain the number of log events corresponding to the preset window time based on the user behavior log, and then calculate the proportion of each log event, which is recorded as ,in Indicates the number of the log event. , Indicates the number of log events; Using the formula Analyze and obtain the entropy value of log events .

7. A private cloud security management method based on multi-dimensional feature data analysis as claimed in claim 4, characterized in that: The specific analysis method for evaluating the global network security anomaly of the private cloud is as follows: The system resource anomaly rate and log event entropy value are extracted, and then summed up by weight to obtain the global network security anomaly index of the private cloud. The global network security anomaly index is used to evaluate the degree of anomaly of the global network security anomaly of the private cloud.

8. A private cloud security management method based on multi-dimensional feature data analysis as claimed in claim 7, characterized in that: The specific analysis method for comprehensively analyzing the security anomalies of each independent business partition and the global security anomalies is as follows: Extracting the internal network security anomaly index and the global network security anomaly index of the private cloud, and then comparing them with the preset internal network security anomaly index threshold and the global network security anomaly index threshold respectively; If the internal network security anomaly index and the global network security anomaly index are both less than or equal to the corresponding thresholds, it is determined that there is no security anomaly; If the internal network security anomaly index is greater than the internal network security anomaly index threshold or the global network security anomaly index is greater than the global network security anomaly index threshold, it is determined that a security anomaly exists; When a security anomaly is detected, the direction of the security anomaly is further determined and feedback is provided.

9. A private cloud security management method based on multi-dimensional feature data analysis as claimed in claim 8, characterized in that: The specific method of further determining the direction of the security anomaly is as follows: If the internal network security anomaly index is greater than the internal network security anomaly index threshold, the specific security anomaly is identified as an internal network security anomaly; If the global network security anomaly index is greater than the global network security anomaly index threshold, the specific security anomaly is identified as a global network security anomaly.

10. A private cloud security management method based on multi-dimensional feature data analysis as claimed in claim 9, characterized in that: When the specific security anomaly is identified as an internal network security anomaly, further abnormal independent business partition identification and abnormal user identification are required. The specific methods are as follows: Extract the lateral penetration risk index of each independent business partition, and then sort them from large to small, and record the independent business partition corresponding to the largest lateral penetration risk index as an abnormal independent business partition; The authority abuse index of each user is extracted, and then the user corresponding to the maximum authority abuse index is selected as an abnormal user.

Images