A cloud platform security monitoring system based on big data

Abstract

The application discloses a kind of cloud platform security monitoring systems based on big data, belong to cloud platform security technical field, comprising: cloud platform associated data acquisition module, obtains the associated data when cloud platform is accessed without authorization user and when authorized user accesses;Data processing and analysis module, the abnormal risk value is generated by processing and analysis to the associated data obtained, whether the security abnormal problem exists in cloud platform according to abnormal risk value is judged;Alarm module, alarm reminder instruction is generated according to the result of judgment;Response module, according to alarm reminder instruction, emergency response is carried out.The application can integrate the data of each single-point monitoring tool, can comprehensively and accurately evaluate the security situation of cloud platform as a whole, increase the accuracy of monitoring;In addition, the corresponding level alarm reminder instruction is generated when judging that cloud platform exists security abnormal problem, and corresponding emergency treatment is carried out, which can reduce loss in time and ensure the security of cloud platform data.

Description

TECHNICAL FIELD

[0001] The application belongs to the technical field of cloud platform security, and particularly relates to a cloud platform security monitoring system based on big data. BACKGROUND

[0002] A cloud platform is a service based on hardware resources and software resources, and is used for providing computing, network and storage capabilities. The cloud platform is widely applied to many fields such as finance, medical treatment, education and government affairs due to its strong computing capability, flexible resource allocation, efficient data storage and convenient remote access. However, the wide application of the cloud platform also brings serious security challenges. Since the cloud platform stores and processes a large amount of sensitive data, once a security attack such as data leakage, malicious software intrusion, phishing and the like occurs, serious consequences will be caused.

[0003] When the cloud platform is monitored, a single-point monitoring tool such as a firewall and an antivirus software is usually used to monitor the security of a specific aspect of the cloud platform. Although the single-point monitoring can perform security monitoring to a certain extent, the single-point monitoring tools lack effective cooperation and information sharing mechanism, and cannot comprehensively and accurately evaluate the security status of the cloud platform as a whole. SUMMARY

[0004] The application aims to provide a cloud platform security monitoring system based on big data to solve the problems in the background.

[0005] The application can be achieved by the following technical solutions.

[0006] A cloud platform security monitoring system based on big data, the monitoring system comprising:

[0007] A cloud platform associated data acquisition module, which is used to acquire associated data of the cloud platform when there is no authorized user access and when there is authorized user access;

[0008] A data processing and analysis module, which is used to process and analyze the acquired associated data, so as to generate an abnormal risk value, and judge whether there is a security abnormal problem in the cloud platform according to the abnormal risk value;

[0009] An alarm module, which generates an alarm reminding instruction when it is judged that there is a security abnormal problem in the cloud platform;

[0010] A response module, which performs corresponding emergency response according to the alarm reminding instruction.

[0011] Further, the working method of the data processing and analysis module is as follows.

[0012] According to the acquired correlation data of the cloud platform when the authorized user accesses, a second abnormal value R f is generated s , and then an abnormal risk value R is obtained through the formula R = γ1*R f + γ2*R s ;

[0013] When R > R V , it is determined that the cloud platform has a security anomaly problem;

[0014] Wherein, γ1 and γ2 are weight coefficients, and R V is an abnormal risk judgment threshold.

[0015] Further, the first abnormal value R f is obtained by the following method:

[0016] When the authorized user accesses, a monitoring period Δt is set, and the CPU usage and memory occupation of the cloud platform server are obtained;

[0017] The first abnormal value R f is obtained through the formula ; and

[0018] Wherein, σ is a risk coefficient, maxCPU'(t) is the maximum slope value of CPU(t), minCPU'(t) is the minimum slope value of CPU(t), ΔCPU is the CPU slope reference value, CPU(t) is the obtained CPU usage function changing with time, CPU0(t) is the preset standard CPU usage function changing with time, maxMU'(t) is the maximum slope value of MU(t), minMU'(t) is the minimum slope value of MU(t), ΔMU is the memory slope reference value, MU(t) is the obtained memory occupation function changing with time, MU0(t) is the preset standard memory occupation function changing with time, t1 is the start time of the monitoring period Δt, and t2 is the end time of the monitoring period Δt.

[0019] Further, the risk coefficient σ is obtained by the following method:

[0020] The number of IP addresses n trying to access in the monitoring period Δt and the number of unauthorized API calls h in the log, the number of vulnerabilities LD m and the type of vulnerabilities LD n in the firewall are obtained;

[0021] The risk coefficient σ is obtained through the formula ; and

[0022] Wherein, L iis the straight-line distance of the i-th IP address from the commonly used login IP address, P i is the number of attempts to log in by the i-th IP address, and i∈[1, n].

[0023] Further, the second abnormal value R s The acquisition method is:

[0024] When there is an authorized user access, a monitoring period ΔT is set, and according to the flow transmission change, a flow transmission amount-time change curve B(T) in the detection period is drawn;

[0025] The second abnormal value R is obtained by the formula s ;

[0026] Wherein, m is the number of files of the cloud platform accessed by the user, B j (T) is the flow transmission amount-time change curve under the j-th file, is the standard flow transmission amount-time change curve drawn for the j-th file, maxB j '(T) is the maximum slope value of B(T) under the j-th file, α j is the importance coefficient of the j-th file, and j∈[1, m], T1 is the start time of the monitoring period ΔT, T2 is the end time of the monitoring period ΔT, and k is the login abnormal value.

[0027] Further, the login abnormal value k acquisition method is:

[0028] The login duration D t of the authorized user when logging in, the number of authentication failures D FA when logging in, the interval duration J t between the login location this time and the login location last time, and the interval distance J L ;

[0029] The login abnormal value k is obtained by the formula ;

[0030] Wherein, is the standard login duration set according to the login data, is the standard interval duration set according to the login data.

[0031] Further, the alarm module working method is:

[0032] The alarm reminder instruction includes a first-level alarm reminder instruction and a second-level alarm reminder instruction;

[0033] When R V <R<R Q , a first-level alarm reminder instruction is generated;

[0034] When R >= R Q a secondary alarm reminding instruction is generated, wherein R Q is another abnormal risk judgment threshold set for the system.

[0035] Further, the response module working method is:

[0036] When the primary alarm reminding instruction is generated, the cloud platform disinfection system is controlled to disinfect and the cloud platform protection system is updated at this time;

[0037] When the secondary alarm reminding instruction is generated, the cloud platform server is restarted at this time, and the maintenance management personnel are arranged to perform risk investigation on the system.

[0038] The beneficial effects of the present application are:

[0039] The present application can integrate the data of various single-point monitoring tools, can comprehensively and accurately evaluate the security status of the cloud platform as a whole, and increase the monitoring accuracy; in addition, the corresponding level alarm reminding instruction is generated when the cloud platform has security abnormal problems, and the corresponding emergency treatment is performed, which can reduce the loss in time and ensure the safety of the cloud platform data.

[0040] The present application can start from the unauthorized user access to the cloud platform when the cloud platform is not accessed by the authorized user, and judge whether the cloud platform has security problems according to the information such as the CPU usage, memory occupancy and firewall vulnerabilities of the cloud platform, so that the abnormality of the cloud platform can be perceived in the early stage of unauthorized access, so as to block the access in time and avoid data leakage or damage; and the vulnerabilities and weaknesses of the cloud platform in network boundary and identity authentication can be found by analyzing the data information when the unauthorized user accesses, so that the cloud platform can be repaired in time, and the boundary protection of the cloud platform can be strengthened to protect the safety of the cloud platform.

[0041] The present application can judge whether the authorized user is stolen according to the login status and download browsing situation of the authorized user, so as to monitor the cloud platform and security risks and ensure the safety of the cloud platform.

[0042] Of course, any product implementing the present application does not necessarily need to achieve all the advantages described above. BRIEF DESCRIPTION OF DRAWINGS

[0043] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the following will briefly introduce the drawings needed to be used in the embodiment description. Obviously, the drawings in the following description only some embodiments of the present application, and for those skilled in the art, other drawings can be obtained without creative labor on the basis of these drawings.

[0044] Figure 1 System block diagram of the present application. DETAILED DESCRIPTION

[0045] The technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are only a part of the embodiments of the present application, rather than all the embodiments of the present application. Based on the embodiments in the present application, all other embodiments obtained by a person of ordinary skill in the art without creative work fall within the protection scope of the present application.

[0046] In one embodiment, a cloud platform security monitoring system based on big data is disclosed, as shown in the figure, the monitoring system comprises: Figure 1

[0047] A cloud platform associated data acquisition module is configured to acquire associated data of the cloud platform when there is no authorized user access and when there is authorized user access;

[0048] A data processing and analysis module is configured to process and analyze the acquired associated data, thereby generating an abnormal risk value, and judging whether there is a security abnormal problem in the cloud platform according to the abnormal risk value;

[0049] An alarm module is configured to generate an alarm reminder instruction when it is judged that there is a security abnormal problem in the cloud platform;

[0050] A response module is configured to perform corresponding emergency response according to the alarm reminder instruction.

[0051] Through the above technical solutions, the cloud platform associated data acquisition module is configured to acquire associated data of the cloud platform when there is no authorized user access and when there is authorized user access, the associated data including relevant data such as firewall, antivirus software, intrusion detection system, cloud platform running, etc., the data processing and analysis module is configured to perform comprehensive analysis to generate an abnormal risk value, thereby judging whether there is a security abnormal problem in the cloud platform. In this way, the single-point monitoring tool is integrated, the security status of the cloud platform can be comprehensively and accurately evaluated from the whole, and the accuracy is increased. In addition, when it is judged that there is a security abnormal problem in the cloud platform, a corresponding level of alarm reminder instruction is generated, and corresponding emergency processing is performed, so that the loss can be reduced in time, and the safety of the cloud platform data is ensured.

[0052] The working method of the data processing and analysis module is as follows: according to the acquired associated data of the cloud platform when there is no authorized user access, a first abnormal value R f is generated, according to the acquired associated data of the cloud platform when there is authorized user access, a second abnormal value R s is generated, and then the formula R = γ1*R f + γ2*R s ​Obtain the abnormal risk value R;

[0053] When R>R V When the cloud platform is detected, it is judged that there is a security anomaly problem;

[0054] Among them, γ1 and γ2 are weight coefficients, R V is the abnormal risk judgment threshold;

[0055] Among them, the first outlier R f The acquisition method is as follows: when there is no authorized user access, set a monitoring period Δt to obtain the CPU usage and memory usage of the cloud platform server;

[0056] By formula The first outlier R f ;

[0057] Wherein, σ is the risk coefficient, maxCPU'(t) is the maximum slope value of CPU(t), minCPU'(t) is the minimum slope value of CPU(t), ΔCPU is the CPU slope reference value, CPU(t) is the obtained CPU usage change function over time, CPU0(t) is the preset standard CPU usage change function over time, maxMU'(t) is the maximum slope value of MU(t), minMU'(t) is the minimum slope value of MU(t), ΔMU is the memory slope reference value, MU(t) is the obtained memory occupancy change function over time, MU0(t) is the preset standard memory occupancy change function over time, t1 is the start time of the monitoring period Δt, and t2 is the end time of the monitoring period Δt. The risk coefficient σ is obtained by obtaining the number of IP addresses attempted to access n and the number of unauthorized API calls h in the log within the monitoring period Δt, and the number of vulnerabilities generated in the firewall LD m And vulnerability type LD n ;

[0058] By formula The risk factor σ is obtained;

[0059] Among them, L i is the straight-line distance between the ith IP address and the commonly used login IP address, P i is the number of times the i-th IP address attempts to log in, and i∈[1,n];

[0060] The second outlier R s The acquisition method is as follows: when an authorized user accesses, a monitoring period ΔT is set, and according to the traffic transmission changes, a curve B(T) of traffic transmission volume changing with time within the detection period is drawn up;

[0061] By formula The second outlier Rs ;

[0062] Among them, m is the number of files on the cloud platform accessed by the user, B j (T) is the curve of traffic transmission volume changing with time under the jth file, is the time variation curve of the standard traffic transmission volume proposed for the jth file, maxB j '(T) is the maximum slope value of B(T) under the jth file, α j is the important coefficient of the jth file, and j∈[1,m], T1 is the start time of the monitoring period ΔT, T2 is the end time of the monitoring period ΔT, k is the login abnormality value, and the login abnormality value k is obtained by obtaining the login time D of the authorized user at the time of login t , the number of authentication failures during login D FA , the interval between this login location and the last login location J t and the interval distance J L ;

[0063] By formula Obtain the login anomaly value k;

[0064] in, The standard login duration is set based on the login data. This is a standard interval length set based on login data.

[0065] Through the above technical solution, this embodiment provides a method for judging whether there is a security anomaly problem in the cloud platform. When the cloud platform is invaded, it may be a violent invasion or the authorized user ID may be stolen to impersonate the access, thereby stealing the data in the cloud platform. Therefore, this application first sets a monitoring period Δt when there is no authorized user access, and obtains the CPU usage and memory occupancy of the cloud platform server; through the formula The first outlier R f ;formula It is expressed as the difference between the current CPU usage change and the standard CPU usage change. The formula is It is expressed as the difference between the current memory usage change and the standard memory usage change. During a brute force intrusion, the CPU usage and memory usage in the cloud platform will be significantly different from normal times. Therefore, the larger the difference, the greater the possibility of a brute force intrusion. The same formula Indicates the difference between the maximum slope value and the minimum slope value of CPU(t) within the monitoring period Δt. represents the difference between the maximum slope value and the minimum slope value of MU(t) in the monitoring period Δt. Obviously, the greater the difference, the greater the change in CPU usage and memory occupancy, and the greater the possibility of intrusion into the cloud platform. When calculating the first abnormal value R f , the risk coefficient σ is also taken into account, and the risk coefficient σ is obtained by the formula . Since when there is no authorized user access, the greater the number of IP addresses n accessed in the monitoring period Δt, or the greater the straight-line distance of a single IP address from the commonly used login IP address, or the higher the number of attempts to log in by a single IP address, the greater the abnormal security problem of the cloud platform. Similarly, when the number of unauthorized API calls h in the firewall and antivirus software, the number of vulnerabilities LD m , and the vulnerability type LD n are higher, the greater the abnormal security problem of the cloud platform. Therefore, from the formula, the higher the risk coefficient, the greater the abnormal security problem of the cloud platform. In this way, when there is no authorized user access, the external attack attempts to illegally intrude the cloud platform, and the CPU usage, memory occupancy, and firewall vulnerability information of the cloud platform are used to determine whether the cloud platform has a security problem. This can detect the abnormality of the cloud platform at an early stage of unauthorized access, thereby blocking access in time and avoiding data leakage or damage. Moreover, according to the data information analysis and judgment of unauthorized user access, vulnerabilities and weaknesses in the network boundary and identity authentication of the cloud platform can be found, so that they can be repaired in time, and the boundary protection of the cloud platform can be strengthened to protect the security of the cloud platform.

[0066] Similarly, when there is authorized user access, a monitoring period ΔT is set, and the traffic transmission curve B(T) in the detection period is determined according to the change in traffic transmission. The second abnormal value R s is obtained by the formula . The formula represents the difference between the traffic transmission amount when the authorized user downloads or browses and the standard traffic transmission amount when there is authorized user access. Obviously, the greater the difference, the greater the possibility of abnormality, and maxB j '(T) is the maximum slope value of B(T) under the jth file, and the greater the value, the greater the fluctuation. Similarly, when calculating the second abnormal value R s , the login abnormal value k is taken into account, which can more accurately determine the access status of the authorized user. The login abnormal value k is obtained by the formula . From the formula, it can be seen that the longer the login duration D t of the authorized user when logging in compared with the standard duration, and the higher the number of authentication failures D FAThe more, the longer the interval between the current login location and the last login location. t The longer the time compared to the standard time, the longer the interval between two logins. L The further away, the greater the possibility of account theft. The larger the second outlier value, the greater the security risk of the cloud platform. This method allows us to determine whether an authorized user has been stolen based on their login status and download and browsing behavior, thereby monitoring the cloud platform and security risks to ensure its security.

[0067] Finally, through the formula R = γ1*R f +γ2*R s Combined with the first outlier R f , the second outlier R s Comprehensive analysis is used to obtain the abnormal risk value R, and then the abnormal risk value R is compared with the preset abnormal risk judgment threshold R V Compare, when R>R V When , it is judged that there is a security anomaly problem on the cloud platform. Among them, γ1 and γ2 are weight coefficients, R V The abnormal risk judgment threshold can be formulated based on historical monitoring data and experience.

[0068] It should be noted that the CPU slope reference value ΔCPU and the memory slope reference value ΔMU can be determined based on experimental data. The preset standard CPU usage rate change function CPU0(t) and the preset standard memory usage rate change function MU0(t) can be formulated based on the operating data of the cloud platform during normal operation. The standard traffic transmission volume change curve under each file over time The importance coefficient α of each file is formulated based on the data of the accessing user during normal access. j The start and end times of the monitoring periods Δt and ΔT can be determined independently based on the file type and will not be described in detail here.

[0069] The alarm module works as follows: the alarm reminder instruction includes the first-level alarm reminder instruction and the second-level alarm reminder instruction;

[0070] When R V <R<R Q When a first-level alarm reminder instruction is generated, the cloud platform antivirus system is controlled to perform antivirus and update the cloud platform's protection system at the same time;

[0071] When R≥R Q When the second level warning instruction is generated, R QAnother abnormal risk judgment threshold is set for the system, when the secondary alarm reminding instruction is generated, the cloud platform server is restarted at this time, and the maintenance management personnel are arranged to check the system risk.

[0072] Through the above technical solution, the embodiment provides the method for generating the alarm reminding instruction and the corresponding specific steps, first, the alarm reminding instruction includes the primary alarm reminding instruction and the secondary alarm reminding instruction, when R V <R<R Q At this time, although there is a security risk, the risk is not big, the primary alarm reminding instruction is generated, when the primary alarm reminding instruction is generated, the cloud platform antivirus system is controlled to perform the antivirus and the protection system of the cloud platform is updated; when R≥R Q At this time, the cloud platform has a big security risk, in order to ensure the data security, the secondary alarm reminding instruction is generated, when the secondary alarm reminding instruction is generated, the cloud platform server is restarted at this time, and the maintenance management personnel are arranged to check the system risk, so as to ensure the cloud platform data security.

[0073] The above content is only an example and description of the concept of the application, the skilled in the art can make various modifications or supplements or adopt similar ways to replace the described specific embodiments, as long as the concept of the application is not deviated or the scope defined by the claims is not exceeded, which shall belong to the protection scope of the application.

Claims

1. A cloud platform security monitoring system based on big data, characterized in that: The monitoring system comprises: A cloud platform related data acquisition module, which is used to acquire related data of the cloud platform when no authorized user accesses the cloud platform and when authorized users access the cloud platform; A data processing and analysis module is used to process and analyze the acquired correlation data to generate an abnormal risk value, and to determine whether there is a security anomaly problem on the cloud platform based on the abnormal risk value; An alarm module generates an alarm reminder instruction when it determines that there is a security anomaly on the cloud platform; A response module, wherein the response module performs corresponding emergency response according to the alarm reminder instruction; The data processing and analysis module works as follows: generating a first abnormal value based on the associated data obtained when the cloud platform is accessed by an unauthorized user , based on the associated data obtained when the cloud platform is accessed by authorized users, a second outlier is generated , and then through the formula Abnormal risk value ; when When the cloud platform is detected, it is judged that there is a security anomaly problem; in, as well as is the weight coefficient, is the abnormal risk judgment threshold; The first abnormal value The acquisition method is: when no authorized user accesses, set a monitoring cycle , obtain the CPU usage and memory occupancy of the cloud platform server; By formula Get the first outlier ; in, is the risk factor, for The maximum slope value of for The minimum slope value, for Slope reference value, To obtain the CPU usage changing function over time, It is a preset standard CPU usage change function over time. for The maximum slope value of for The minimum slope value, is the memory slope reference value, To obtain the function of memory usage changing over time, is the preset standard memory usage changing function over time, Monitoring cycle Start time, Monitoring cycle End time; The second outlier The acquisition method is: when an authorized user accesses, set a monitoring cycle , according to the change of traffic transmission, draw up the curve of traffic transmission volume changing with time within the detection period ; By formula The second outlier ; in, The number of files on the cloud platform accessed by the user, is the curve of traffic transmission volume changing with time under the jth file, is the time variation curve of the standard traffic transmission volume proposed for the jth file, For the jth file The maximum slope value of is the important coefficient of the jth file, and , Monitoring cycle The start time, Monitoring cycle The end time, This is a login exception value.

2. A cloud platform security monitoring system based on big data according to claim 1, characterized in that: The risk factor The acquisition method is: Get monitoring period The number of IP addresses that attempted to access The number of unauthorized API calls in the logs, the number of vulnerabilities in the firewall and vulnerability types ; By formula Determine the risk factor ; in, is the straight-line distance between the ith IP address and the commonly used login IP address, is the number of login attempts by the i-th IP address, and .

3. A cloud platform security monitoring system based on big data according to claim 2, characterized in that: The login abnormal value The acquisition method is: Get the login time of the authorized user , the number of authentication failures during login , the interval between this login location and the last login location and the distance between them ; By formula Get login anomaly value ; in, The standard login duration is set based on the login data. This is a standard interval length set based on login data.

4. A cloud platform security monitoring system based on big data according to claim 3, characterized in that: The alarm module works as follows: The alarm reminder instructions include a first-level alarm reminder instruction and a second-level alarm reminder instruction; when When a level 1 alarm is generated, a warning instruction is generated; when When the second level alarm is generated, Another abnormal risk judgment threshold set for the system.

5. A cloud platform security monitoring system based on big data according to claim 4, characterized in that: The response module works as follows: When a level 1 alarm is generated, the cloud platform antivirus system is controlled to perform virus scanning and update the cloud platform's protection system. When a second-level alarm reminder instruction is generated, the cloud platform server is restarted and maintenance management personnel are arranged to conduct risk inspections on the system.

Images