DPU security management method and device

Abstract

The invention discloses a DPU security management method and device. Comprising the following steps: acquiring a first DPU operation state data set of the cloud platform in a first time period and a historical security access data set of the cloud platform in a historical time period before the first time period, and preliminarily judging whether the DPU in the cloud platform is in an abnormal operation state in the first time period according to the two data sets; if not, determining a first access behavior data set when the cloud platform performs periodic access operation under the first DPU running state data set corresponding to the first time period, and analyzing a first predicted access risk value of the cloud platform in each first access time period according to a risk prediction model; and performing security management on the DPU in the cloud platform according to the first predicted access risk value of the cloud platform in each first access time period. The technical problem that the security and stability of a cloud platform are poor due to the fact that a DPU risk event cannot be early warned accurately in real time in the prior art is solved.

Description

Technical Field

[0001] This application relates to the technical field of cloud platforms, and more particularly, to a DPU security management method and apparatus. Background Art

[0002] With the rapid development of information technologies such as big data, artificial intelligence, and cloud computing, more and more services are deployed to the cloud. Therefore, cloud platforms have become one of the key infrastructures supporting economic and social development. Among them, the DPU (Data Processing Unit), as a key data processing component of the cloud platform, undertakes heavy data processing and network acceleration tasks, so its operation is particularly important.

[0003] However, the current DPU risk management system of cloud platforms has significant deficiencies, especially in the risk warning mechanism. Traditional security management methods often focus on post-event response, that is, taking actions after detecting abnormal access or resource abuse. This passive defense method is ineffective against rapidly evolving network threats. Therefore, in the face of increasingly complex network attack means, the existing DPU risk management framework is difficult to achieve real-time and accurate risk warning, which not only increases the operation and maintenance costs of the cloud platform but also poses a potential threat to the security of user data.

[0004] For the above problems, no effective solution has been proposed yet. Summary of the Invention

[0005] Embodiments of this application provide a DPU security management method and apparatus to at least solve the technical problem that the related art cannot real-time and accurately warn of DPU risk events, resulting in poor security and stability of the cloud platform.

[0006] According to one aspect of the embodiments of the present application, a DPU security management method for a cloud platform is provided, including: obtaining a first DPU operation status data set of the cloud platform in a first time period, and a historical security access data set of the cloud platform in a historical time period before the first time period, where the historical security access data set is used to record the corresponding relationship between the historical security access behavior data set and the historical DPU operation status data set in each historical access time period of the cloud platform in the historical time period; preliminarily determining whether the DPU in the cloud platform is in an abnormal operation state in the first time period according to the first DPU operation status data set and the historical security access data set; when the DPU in the cloud platform is in an abnormal operation state in the first time period, determining a first access behavior data set for the periodic access operation under the first DPU operation status data set corresponding to the first time period of the cloud platform, and analyzing the first access behavior data set according to a pre-trained risk prediction model to obtain a first predicted access risk value of the cloud platform in each first access time period; performing security management on the DPU in the cloud platform according to the first predicted access risk value of the cloud platform in each first access time period.

[0007] Optionally, both the first DPU operation status data set and the historical DPU operation status data set include multiple types of DPU operation status data. Among them, preliminarily determining whether the DPU in the cloud platform is in an abnormal operation state in the first time period according to the first DPU operation status data set and the historical security access data set includes: extracting first key feature vectors corresponding to various types of DPU operation status data in the first DPU operation status data set, and extracting second key feature vectors corresponding to various types of DPU operation status data in the historical DPU operation status data set corresponding to each historical access time period; calculating the similarity between each second key feature vector and the first key feature vector; in the case where the similarity between any second key feature vector and the first key feature vector is higher than a preset threshold value, preliminarily determining that the DPU in the cloud platform is in a safe operation state in the first time period; in the case where the similarity between all second key feature vectors and the first key feature vector is not higher than the preset threshold value, preliminarily determining that the DPU in the cloud platform is in an abnormal operation state in the first time period.

[0008] Optionally, determine the first access behavior dataset when the cloud platform performs a periodic access operation under the first DPU operating status dataset corresponding to the first time period, including: obtaining the logical area division rule of the cloud platform, where the logical area division rule is used to define the logical areas used by the cloud platform when performing different types of access operations, and the types of access operations include: random access operations or periodic access operations; determining the target logical area when performing the periodic access operation according to the logical area division rule; controlling the cloud platform to perform a periodic access operation within the target logical area based on the first DPU operating status dataset corresponding to the first time period to obtain the first access behavior dataset.

[0009] Optionally, controlling the cloud platform to perform a periodic access operation within the target logical area based on the first DPU operating status dataset corresponding to the first time period to obtain the first access behavior dataset includes: dividing the target logical area according to a preset periodic access resource allocation rule to obtain a plurality of target logical sub-areas, where the periodic access resource allocation rule is used to define the platform resource information required for different periodic access operations, and the periodic access operations include at least one of the following: regular system maintenance, regular resource access, and regular data backup; controlling the cloud platform to perform a periodic access operation within each target logical sub-area based on the first DPU operating status dataset corresponding to the first time period to obtain the first access behavior dataset.

[0010] Optionally, the training process of the risk prediction model includes: obtaining a training sample set and a sample label set, where the training sample set includes: a plurality of training samples, and the sample label set includes: a plurality of sample labels, and the training samples are the second access behavior datasets obtained by the cloud platform performing a periodic access operation under the second DPU operating status dataset corresponding to the second access time period, and the sample labels are the actual risk values of the cloud platform during the second access time period; constructing an initial learning model; for each training batch in the iterative training process, inputting the training samples of the training batch into the initial learning model to obtain the second predicted risk values corresponding to the training samples output by the initial learning model; constructing a target loss function using the sample labels and the second predicted risk values corresponding to the training samples of the training batch, and adjusting the model parameters of the initial learning model according to the target loss function until the model parameters converge to obtain the risk prediction model.

[0011] Optionally, performing security management on the DPU in the cloud platform according to the first predicted access risk value of the cloud platform in each first access time period includes: determining the first quantity of the first access time periods in which the first predicted access risk value is higher than a preset risk threshold, and determining the total quantity of the first time periods including the first access time periods; determining the ratio of the first quantity to the total quantity; and adjusting the first DPU operating status dataset corresponding to the first time period when the ratio is higher than a preset threshold value.

[0012] Optionally, determining the first quantity of first access time periods in which the first predicted access risk value is higher than a preset risk threshold includes: determining the average risk value of the first predicted risk values in each of the first access time periods within the first time period for the cloud platform; for each first access time period within the first time period, calculating the risk value standard deviation corresponding to the first access time period based on the first predicted risk value and the average risk value for the first access time period; determining at least first target access time periods for which the risk value standard deviation is not less than a preset standard deviation threshold, and determining the first quantity of first target access time periods in which the first predicted access risk value is higher than the preset risk threshold.

[0013] According to another aspect of the embodiments of the present application, there is also provided a DPU security management device for a cloud platform, including: an acquisition module, configured to acquire a first DPU operation state data set of the cloud platform within a first time period, and a historical security access data set of the cloud platform within a historical time period before the first time period, where the historical security access data set is used to record the correspondence between the historical security access behavior data set and the historical DPU operation state data set in each historical access time period of the cloud platform within the historical time period; a judgment module, configured to preliminarily judge whether the DPU in the cloud platform is in an abnormal operation state within the first time period based on the first DPU operation state data set and the historical security access data set; a risk analysis module, configured to, when the DPU in the cloud platform is in an abnormal operation state within the first time period, determine a first access behavior data set for performing a periodic access operation under the first DPU operation state data set corresponding to the first time period of the cloud platform, and analyze the first access behavior data set based on a pre-trained risk prediction model to obtain a first predicted access risk value for each first access time period of the cloud platform; and a management module, configured to perform security management on the DPU in the cloud platform based on the first predicted access risk value for each first access time period of the cloud platform.

[0014] According to another aspect of the embodiments of the present application, there is also provided a computer program product, which includes: a computer program, where when the computer program is executed by a processor, it implements the above-mentioned DPU security management method for a cloud platform.

[0015] According to another aspect of the embodiments of the present application, there is also provided an electronic device, which includes: a memory and a processor, where a computer program is stored in the memory, and the processor is configured to execute the above-mentioned DPU security management method for a cloud platform through the computer program.

[0016] In the embodiments of the present application, by comparing the real-time operation status data of the current DPU with the historical secure access data in real time, it is possible to quickly identify whether the current DPU operation status data deviates from the security baseline, so as to infer whether the DPU is currently in an abnormal operation state; after confirming that the DPU is currently in an abnormal operation state, by analyzing the first access behavior data set obtained from the periodic access operations of the cloud platform under the current DPU operation state, and using a pre-trained model to analyze the first access behavior data set, predicting the possible risk values for each access time period; finally, based on the predicted risk values, dynamic security management is carried out to ensure that the DPU in the cloud platform is protected from potential threats, achieving the technical effect of accurately monitoring and predicting the operation state of the DPU in the cloud platform, and achieving the purpose of effectively identifying and reducing the security risks of the DPU, reducing the impact of security threats on the cloud platform, and improving the security and stability of cloud services. Furthermore, it solves the technical problem that the related technologies cannot timely and accurately warn of DPU risk events, resulting in poor security and stability of the cloud platform. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] The drawings described herein are used to provide a further understanding of the present application and form a part of the present application. The illustrative embodiments of the present application and their descriptions are used to explain the present application and do not constitute an improper limitation to the present application. In the drawings:

[0018] Figure 1 is a flowchart of an optional method for DPU security management in a cloud platform according to an embodiment of the present application;

[0019] Figure 2 is a schematic structural diagram of an optional DPU security management device in a cloud platform according to an embodiment of the present application;

[0020] Figure 3 is a schematic structural diagram of an optional electronic device according to an embodiment of the present application. DETAILED DESCRIPTION OF THE EMBODIMENTS

[0021] In order to enable those skilled in the art to better understand the solutions of the present application, the technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are only a part of the embodiments of the present application, rather than all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative efforts shall fall within the protection scope of the present application.

[0022] It should be noted that the terms "first", "second", etc. in the description, claims and drawings of this application are used to distinguish similar objects and do not necessarily describe a specific order or sequence. It should be understood that such data used can be interchanged under appropriate circumstances so that the embodiments of the present application described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusion. For example, a process, method, system, product or device that includes a series of steps or units does not necessarily have to be limited to those steps or units clearly listed, but may include other steps or units not clearly listed or inherent to these processes, methods, products or devices.

[0023] To better understand the embodiments of the present application, the following is a translation and explanation of some nouns or terms that appear in the description process of the embodiments of the present application:

[0024] DPU (Data Processing Unit, data management unit): It is a programmable processor designed to efficiently process large-scale data-centric workloads in a data center, such as data transfer, reduction, security, compression, analysis, and encryption.

[0025] Embodiment 1

[0026] According to the embodiments of the present application, a DPU security management method for a cloud platform is provided. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions. And although the logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in a different order than here.

[0027] Figure 1 It is a schematic flowchart of a DPU security management method for a cloud platform provided according to the embodiments of the present application. As Figure 1 shown, the method includes the following steps:

[0028] Step S102, obtain the first data processing unit DPU operation status data set of the cloud platform in the first time period, and the historical security access data set of the cloud platform in the historical time period before the first time period.

[0029] In the technical solution provided in step S102 above, the first DPU operation status data set refers to the set of result data generated after the DPU of the cloud platform executes various tasks within the first time period, aiming to comprehensively reflect the safe operation status of the DPU. The historical secure access data set refers to the set of access records and operation environment status in multiple previous time windows of the cloud platform, used to establish the correlation between access behaviors and environmental conditions. Therefore, this data set includes the historical secure access behavior data set (i.e., the access behavior data without security incidents) and the historical DPU operation status data set. Since the historical secure access data set records past states, this provides an important historical reference for predicting and analyzing the current (i.e., the first time period) security level of the DPU.

[0030] Step S104, based on the first DPU operation status data set and the historical secure access data set, preliminarily determine whether the DPU in the cloud platform is in an abnormal operation state within the first time period.

[0031] In the technical solution provided in step S104 above, since the historical secure access data set records the DPU secure operation status corresponding to all secure access behaviors, therefore, by comparing the first DPU operation status data set with the known secure access patterns in the historical secure access data set to find similarities, thereby preliminarily determining whether there are abnormal or potentially security-risk behaviors in the current DPU operation.

[0032] Step S106, when the DPU in the cloud platform is in an abnormal operation state within the first time period, determine the first access behavior data set during the periodic access operation corresponding to the first DPU operation status data set of the cloud platform in the first time period, and analyze the first access behavior data set based on the pre-trained risk prediction model to obtain the first predicted access risk values of the cloud platform in each first access time period.

[0033] In the technical solution provided in step S106 above, when it is initially found that the operation status data of the DPU shows abnormal or potential security problems, capture and record all periodic access operations performed by the cloud platform within the first time period. Among them, the periodic access operations are executed at set time intervals or periodically to maintain the stability and security of the system, such as regular system maintenance, regular resource access, regular data backup, etc. Therefore, the embodiment of the present application can deeply analyze the first access behavior data set through the pre-trained risk prediction model to evaluate the first predicted access risk values of the cloud platform in each first access time period within the first time period, providing data support for subsequent environment adjustment and security warning.

[0034] Step S108, perform security management on the DPU in the cloud platform based on the first predicted access risk values of the cloud platform in each first access time period.

[0035] In the technical solution provided in the above step S108, the system, based on the first predicted access risk values of the cloud platform in each first access time period, adopts a series of strategies and measures by the cloud platform to ensure the safe operation of the DPU in each first access time period and avoid potential security risks from affecting the normal provision of cloud services.

[0036] The following describes each step of the DPU security management method of the cloud platform in combination with a specific implementation process.

[0037] As an optional implementation manner, in the technical solution provided in the above step S102, the system collects the operation status data of the DPU in the cloud platform within the current analysis time window (i.e., the first time period) by calling the data collection module. Data collection may involve indicators such as the CPU utilization rate of the DPU, memory usage, network traffic, storage I / O activities, error logs, security event records, etc., to comprehensively reflect the real-time operation status of the DPU. These data are integrated into a structured data set, namely the first DPU operation status data set.

[0038] Subsequently, the system can access the historical database, extract the security access data of the cloud platform within the historical time window before the first time period, and obtain the historical security access data set through summarization. Among them, the historical security access data set is used to record the correspondence between the historical security access behavior data set and the historical DPU operation status data set of the cloud platform in each historical access time period under the historical time period.

[0039] It should be noted that after collecting the data, in order to ensure the accuracy of subsequent analysis, the system can also preprocess the collected first DPU operation status data set and historical security access data set, including but not limited to data cleaning, format conversion, outlier detection, etc., to ensure the quality and consistency of the data.

[0040] As an optional implementation manner, in the technical solution provided in the above step S104, the system compares the preprocessed first data processing unit DPU operation status data set with the historical security access data set according to the following method to identify whether there are abnormal patterns associated with historical security events in the current DPU operation status, including:

[0041] First, extract the first key feature vectors corresponding to various DPU operation status data in the first DPU operation status data set, and extract the second key feature vectors corresponding to various DPU operation status data in the historical DPU operation status data sets corresponding to multiple historical access time periods. Among them, the key features include but are not limited to CPU usage rate, memory occupancy, network traffic, I / O operation frequency, etc.

[0042] Then, calculate the similarity between each second key feature vector and the first key feature vector through a preset matching algorithm (such as Euclidean distance, cosine similarity, Jaccard similarity, etc.).

[0043] In the case where the similarity between any second key feature vector and the first key feature vector is higher than a preset threshold, it is preliminarily determined that the DPU in the cloud platform is in a safe operating state during the first time period;

[0044] In the case where the similarity between all second key feature vectors and the first key feature vector is not higher than a preset threshold, it is preliminarily determined that the DPU in the cloud platform is in an abnormal operating state during the first time period.

[0045] The above solution can be understood as using the historical DPU operating state dataset in the historical secure access dataset as a security baseline to evaluate whether the indicators in the first DPU operating state dataset are within the normal range. Among them, the security baseline reflects the resource usage level, access pattern, and network behavior during normal operation, and can be used as a benchmark to measure whether the current operating state of the DPU is secure.

[0046] Furthermore, in order to verify whether the DPU in the platform is really in an abnormal operating state during the first time period, risk prediction can also be performed on the first access behavior dataset when performing periodic access operations on the first access behavior dataset of the cloud platform in the first time period, so as to accurately judge whether there is a risk in the current DPU operating state.

[0047] Therefore, first, the system can determine the first access behavior dataset when performing periodic access operations on the first access behavior dataset of the cloud platform in the first time period according to the following steps, including:

[0048] The first step: Obtain the logical area division rule of the cloud platform.

[0049] Among them, the logical region division rule is used to define the logical regions used by the cloud platform when performing different types of access operations, and the types of access operations include: random access operations or periodic access operations. Among them, random access operations are mainly to respond to immediate needs or events, and their results may have a direct impact on the short-term performance of the system, such as data query requests, application calls, data read and write requests, etc. Therefore, the resource consumption of such access operations is often uncontrollable, and the requirements for the immediate response ability and flexibility of the system are relatively high; while periodic access operations are often executed at set time intervals or periodically to maintain the stability and security of the system, such as regular system maintenance, regular resource access, regular data backup, etc. Therefore, the resource requirements of such access operations can be estimated in advance, which helps to avoid resource waste and over-occupation, has a small impact on the system performance, and is easy to perform load balancing.

[0050] Step 2: Determine the target logical region when performing periodic access operations according to the logical region division rule.

[0051] Step 3: Control the cloud platform to perform periodic access operations within the target logical region based on the first DPU operation state data set corresponding to the first time period to obtain the first access behavior data set.

[0052] Optionally, in the technical solution provided in the above Step 3, the method can be implemented through the following steps:

[0053] First, read the periodic access resource allocation rule, where the periodic access resource allocation rule is used to define the platform resource information required for different periodic access operations (such as regular system maintenance, regular resource access, regular data backup), including but not limited to CPU, memory, network bandwidth, storage space, etc.

[0054] Next, further divide the determined target logical region according to the read periodic access resource allocation rule to obtain multiple target logical sub-regions. Among them, the size and resource ratio of each logical sub-region are determined according to the type and requirements of the periodic access operation to ensure the efficient use of resources and the smooth progress of operations.

[0055] Then, control the cloud platform to deploy and execute the corresponding periodic access operations within each target logical sub-region. Among them, the execution of the access operation needs to follow rules such as preset access time, access frequency, operation process, etc. to ensure the standardization and effectiveness of the operation. For example, when performing regular system maintenance, tasks such as software update, hardware inspection, and security scanning can be executed in different logical sub-regions respectively.

[0056] Finally, collect all security-related data generated by the control cloud platform within each target logical sub-region, including resource usage, operation execution results, environmental change data, etc., to form a first access behavior dataset.

[0057] In the above embodiments, in the embodiments of the present application, considering the regularity, controllability, and planning of periodic access operations, it is proposed to periodically check the health status of the platform through system maintenance and monitoring to discover potential security risks, such as regularly updating security patches, scanning for viruses, detecting abnormal behaviors, etc. At the same time, periodic access operations can systematically and regularly collect the current security status of the DPU.

[0058] Furthermore, the system can call a pre-trained risk prediction model to analyze the first access behavior dataset to obtain the first predicted access risk values of the cloud platform within each first access time period.

[0059] As an optional implementation manner, the training process of the above risk prediction model includes:

[0060] Step S1, obtain a training sample set and a sample label set.

[0061] Among them, the training sample set includes: multiple training samples, the sample label set includes: multiple sample labels, and the training sample is a second access result dataset obtained by performing periodic access operations on the second DPU operating state dataset corresponding to the cloud platform within the second access time period, and the sample label is the actual risk value of the cloud platform within the second access time period.

[0062] Step S2, construct an initial learning model, where the type of the initial learning model includes but is not limited to algorithms such as deep learning models, support vector machines, random forests, and logistic regression.

[0063] Step S3, for each training batch in the iterative training process, input the training samples of the training batch into the initial learning model to obtain the second predicted risk values corresponding to the training samples output by the initial learning model; construct an objective loss function using the sample labels and the second predicted risk values corresponding to the training samples of the training batch, and adjust the model parameters of the initial learning model according to the objective loss function until the model parameters converge to obtain the risk prediction model.

[0064] As an optional implementation manner, in the technical solution provided in the above step S108, the system can further manage the cloud platform according to the following rules, including:

[0065] The first step: Determine the first quantity of the first access time periods with the first predicted access risk value higher than the preset risk threshold, and determine the total quantity of the first time periods including the first access time periods.

[0066] Specifically, the process of determining the above-mentioned first quantity includes: determining the average risk value (i.e., the risk benchmark value) of the first predicted risk values in each first access time period within the first time period for the cloud platform, which is used to evaluate whether the first predicted access risk value in a single access time period significantly deviates from the average level; for each first access time period within the first time period, calculating the standard deviation of the risk value corresponding to the first access time period based on the first predicted risk value and the average risk value under the first access time period; determining at least the first target access time periods whose standard deviation of the risk value is not less than the preset standard deviation threshold, and determining the first quantity of the first target access time periods whose first predicted access risk value is higher than the preset risk threshold, so as to ensure that only those access time periods that have both a significantly higher risk level than normal and relatively stable risk prediction will be identified as high-risk time periods.

[0067] Step 2: Determine the ratio of the first quantity to the total quantity.

[0068] Step 3: When the ratio is higher than the preset threshold value, it indicates that the security state of the cloud platform within the first time period is poor. At this time, corresponding security management measures can be taken, including but not limited to:

[0069] (1) Trigger the alarm mechanism and send an instant notification to the system administrator and the technical team, informing them of the specific details of the anomaly and the preliminary impact assessment, so as to enable a quick response and take measures.

[0070] (2) Dynamically adjust the access control policy according to the anomaly, restricting or changing the access permissions to specific resources, especially for sensitive data or core applications. This helps to contain potential security threats and reduce the possibility of malicious access.

[0071] (3) Once an anomaly is detected, immediately isolate the affected DPU or related resources to prevent the anomaly from spreading to other system components. Start the automatic or manual repair process and perform targeted repairs according to the nature of the anomaly, such as restarting the service, updating software patches or replacing hardware.

[0072] (4) Analyze the root cause of the anomaly. If it is caused by resource contention, the system should automatically adjust the resource allocation policy, give priority to meeting the needs of critical tasks, or distribute the load to other healthy DPUs to ensure service continuity and system performance.

[0073] (5) Immediately check and update the backup policy to ensure that all important data and services have the latest backup copies. When necessary, restore the damaged DPU or data from the backup to avoid business interruption and data loss.

[0074] By comprehensively applying the above security management measures, the negative impacts brought by the abnormal operation state of the DPU can be effectively controlled and mitigated, preventing potential performance degradation, data loss or security vulnerabilities, thereby maintaining the stability of the cloud platform and the security of data.

[0075] Based on the solution defined in the above steps S102 to S108, it can be known that in the embodiment of the present application, by comparing the real-time operation state data of the current DPU with the historical security access data in real time, it is possible to quickly identify whether the current DPU operation state data deviates from the security baseline to infer whether the DPU is currently in an abnormal operation state; after confirming that the DPU is currently in an abnormal operation state, by analyzing the first access behavior data set obtained by the cloud platform during the periodic access operation in the current DPU operation state, and using the pre-trained model to analyze the first access behavior data set, predicting the possible risk values in each access time period; finally, performing dynamic security management based on the predicted risk values to ensure that the DPU in the cloud platform is protected from potential threats, achieving the technical effect of accurately monitoring and predicting the operation state of the DPU in the cloud platform, achieving the purpose of effectively identifying and reducing the DPU security risk, reducing the impact of security threats on the cloud platform, and improving the security and stability of cloud services. Furthermore, it solves the technical problem that the related technology cannot real-time and accurately warn of DPU risk events, resulting in poor security and stability of the cloud platform.

[0076] Embodiment 2

[0077] According to the embodiment of the present application, there is also provided a DPU security management device for a cloud platform for implementing the DPU security management method of the cloud platform in Embodiment 1, as Figure 2 shown. The DPU security management device for the cloud platform at least includes: an acquisition module 22, a judgment module 24, a risk analysis module 26, and a management module 28, where:

[0078] The acquisition module 22 is configured to acquire a first DPU operation state data set of the cloud platform within a first time period, and a historical security access data set of the cloud platform within a historical time period before the first time period, where the historical security access data set is used to record the corresponding relationship between the historical security access behavior data set and the historical DPU operation state data set in each historical access time period of the cloud platform under the historical time period;

[0079] The judgment module 24 is configured to preliminarily judge whether the DPU in the cloud platform is in an abnormal operation state within the first time period according to the first DPU operation state data set and the historical security access data set;

[0080] A risk analysis module 26, configured to determine a first access behavior dataset during a periodic access operation under a first DPU operation state dataset corresponding to a first time period when a DPU in a cloud platform is in an abnormal operation state during the first time period, and analyze the first access behavior dataset based on a pre-trained risk prediction model to obtain a first predicted access risk value of the cloud platform during each first access time period;

[0081] A management module 28, configured to perform security management on the DPU in the cloud platform according to the first predicted access risk value of the cloud platform during each first access time period.

[0082] It should be noted that each module in the DPU security management device of the cloud platform in the embodiments of the present application corresponds one by one to each implementation step of the DPU security management method of the cloud platform in Embodiment 1. Since detailed descriptions have been made in Embodiment 1, some details not shown in this embodiment can be referred to Embodiment 1 and will not be elaborated here.

[0083] Embodiment 3

[0084] According to an embodiment of the present application, there is also provided a computer program product, which includes a computer program. When the computer program is executed by a processor, it implements the DPU security management method of the cloud platform in Embodiment 1.

[0085] According to an embodiment of the present application, there is also provided a non-volatile storage medium, which includes a stored computer program. When the device where the non-volatile storage medium is located runs the computer program, it executes the DPU security management method of the cloud platform in Embodiment 1.

[0086] According to an embodiment of the present application, there is also provided a processor, which is used to run a computer program. When the computer program runs, it executes the DPU security management method of the cloud platform in Embodiment 1.

[0087] According to an embodiment of the present application, there is also provided an electronic device, which includes: a memory and a processor. The memory stores a computer program, and the processor is configured to execute the DPU security management method of the cloud platform in Embodiment 1 through the computer program.

[0088] Specifically, when the computer program runs, it performs the following steps: obtaining a first DPU operation status data set of the cloud platform within a first time period, and a historical security access data set of the cloud platform within a historical time period before the first time period, where the historical security access data set is used to record the correspondence between the historical security access behavior data set and the historical DPU operation status data set of the cloud platform within each historical access time period under the historical time period; preliminarily determining whether the DPU in the cloud platform is in an abnormal operation state within the first time period based on the first DPU operation status data set and the historical security access data set; when the DPU in the cloud platform is in an abnormal operation state within the first time period, determining a first access behavior data set for the periodic access operation under the first DPU operation status data set corresponding to the cloud platform within the first time period, and analyzing the first access behavior data set based on a pre-trained risk prediction model to obtain a first predicted access risk value of the cloud platform within each first access time period; performing security management on the DPU in the cloud platform based on the first predicted access risk value of the cloud platform within each first access time period.

[0089] As an alternative implementation, the above-mentioned electronic device may exist in the form of a mobile terminal, a computer terminal, or a similar computing device. Figure 3 The hardware structure block diagram of an electronic device for implementing the DPU security management method of the cloud platform is shown. As Figure 3 shown, the electronic device 30 may include one or more (shown as 302a, 302b,..., 302n in the figure) processors 302 (the processor 302 may include, but is not limited to, a processing device such as a microprocessor MCU or a field programmable gate array FPGA), a memory 304 for storing data, and a transmission device 306 for communication functions. In addition, it may further include: a display, an input / output interface (I / O interface), a universal serial bus (USB) port (which may be included as one of the ports of the BUS bus), a network interface, a power supply, and / or a camera. Those of ordinary skill in the art can understand that Figure 3 the structure shown is only schematic and does not limit the structure of the above-mentioned electronic device. For example, the electronic device 30 may further include more or fewer components than Figure 3 shown, or have a different configuration from Figure 3 shown.

[0090] It should be noted that one or more of the above-mentioned processors 302 and / or other data processing circuits can generally be referred to as "data processing circuits" herein. The data processing circuit can be embodied in software, hardware, firmware, or any combination thereof, in whole or in part. In addition, the data processing circuit can be a single independent processing module, or be incorporated in whole or in part into any one of the other components in the electronic device 30. As involved in the embodiments of the present application, the data processing circuit is a kind of processor control (such as the selection of a variable resistor terminal path connected to an interface).

[0091] The memory 304 can be used to store software programs and modules of application software, such as the program instructions / data storage devices corresponding to the DPU security management method of the cloud platform in the embodiments of the present application. The processor 302 executes various functional applications and data processing by running the software programs and modules stored in the memory 304, that is, implements the vulnerability detection method of the above-mentioned application program. The memory 304 can include high-speed random access memory, and can also include non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memories. In some instances, the memory 304 can further include a memory remotely set relative to the processor 302, and these remote memories can be connected to the electronic device 30 through a network. Examples of the above-mentioned network include but are not limited to the Internet, enterprise intranet, local area network, mobile communication network, and combinations thereof.

[0092] The transmission device 306 is used to receive or send data via a network. Specific examples of the above-mentioned network can include the wireless network provided by the communication provider of the electronic device 30. In one instance, the transmission device 306 includes a network adapter (Network Interface Controller, NIC), which can be connected to other network devices through a base station and thus can communicate with the Internet. In one instance, the transmission device 306 can be a radio frequency (RF) module, which is used to communicate with the Internet wirelessly.

[0093] The display can be, for example, a touch-screen liquid crystal display (LCD), which enables the user to interact with the user interface of the electronic device 30.

[0094] The above-mentioned embodiment numbers are only for description and do not represent the advantages or disadvantages of the embodiments.

[0095] In the above embodiments of the present application, the descriptions of each embodiment have their own emphases. For the parts not detailed in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0096] In several embodiments provided by the present application, it should be understood that the disclosed technical content can be implemented in other ways. Among them, the device embodiments described above are only illustrative. For example, the division of units can be a logical function division. In actual implementation, there can be other division methods. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the couplings or direct couplings or communication connections shown or discussed with each other can be through some interfaces. The indirect couplings or communication connections of units or modules can be in electrical or other forms.

[0097] The units described as separate components may or may not be physically separated. The components shown as units may or may not be physical units, that is, they can be located in one place or distributed to multiple units. Some or all of the units can be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0098] In addition, in each embodiment of the present application, each functional unit can be integrated in a processing unit, or each unit can exist physically alone, or two or more units can be integrated in one unit. The above-mentioned integrated units can be implemented in the form of hardware or in the form of software functional units.

[0099] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on such an understanding, the technical solution of the present application, in essence, or the part that contributes to the prior art, or all or part of this technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions for causing a computer device (which can be a personal computer, a server or a network device, etc.) to execute all or part of the steps of the methods in each embodiment of the present application. The foregoing storage medium includes: various media such as USB flash drives, read-only memories (ROM, Read-Only Memory), random access memories (RAM, Random Access Memory), mobile hard disks, magnetic disks or optical discs that can store program codes.

[0100] The above is only the preferred embodiment of the present application. It should be noted that for those of ordinary skill in the art, without departing from the principle of the present application, several improvements and refinements can be made, and these improvements and refinements should also be regarded as the protection scope of the present application.

Claims

1. A DPU security management method for a cloud platform, characterized in that, Including: Obtain a first data processing unit (DPU) operation status data set of the cloud platform within a first time period, and a historical security access data set of the cloud platform within a historical time period before the first time period, where the historical security access data set is used to record the correspondence between the historical security access behavior data set and the historical DPU operation status data set of the cloud platform within each historical access time period under the historical time period; Based on the first DPU operation status data set and the historical security access data set, preliminarily determine whether the DPU in the cloud platform is in an abnormal operation state within the first time period; When the DPU in the cloud platform is in an abnormal operation state within the first time period, determine a first access behavior data set during a periodic access operation under the first DPU operation status data set corresponding to the first time period of the cloud platform, and analyze the first access behavior data set based on a pre-trained risk prediction model to obtain a first predicted access risk value of the cloud platform within each first access time period; Perform security management on the DPU in the cloud platform based on the first predicted access risk value of the cloud platform within each first access time period.

2. The method according to claim 1, characterized in that, Both the first DPU operation status data set and the historical DPU operation status data set include multiple types of DPU operation status data, where based on the first DPU operation status data set and the historical security access data set, preliminarily determining whether the DPU in the cloud platform is in an abnormal operation state within the first time period includes: Extract first key feature vectors corresponding to various types of DPU operation status data in the first DPU operation status data set, and extract second key feature vectors corresponding to various types of DPU operation status data in the historical DPU operation status data sets corresponding to multiple historical access time periods respectively; Calculate the similarity between each second key feature vector and the first key feature vector; In the case where the similarity between any second key feature vector and the first key feature vector is higher than a preset threshold, preliminarily determine that the DPU in the cloud platform is in a secure operation state within the first time period; In the case where the similarity between all second key feature vectors and the first key feature vector is not higher than the preset threshold, preliminarily determine that the DPU in the cloud platform is in an abnormal operation state within the first time period.

3. The method according to claim 1, wherein Determining the first access behavior data set during a periodic access operation under the first DPU operation status data set corresponding to the first time period of the cloud platform includes: Obtain the logical area division rule of the cloud platform, where the logical area division rule is used to define the logical areas used by the cloud platform when performing different types of access operations, and the types of access operations include: random access operation or periodic access operation; Determine the target logical area when performing the periodic access operation according to the logical area division rule; Control the cloud platform to perform a periodic access operation within the target logical area based on the first DPU operating status data set corresponding to the first time period, and obtain the first access behavior data set.

4. The method according to claim 3, characterized in that, Controlling the cloud platform to perform a periodic access operation within the target logical area based on the first DPU operating status data set corresponding to the first time period, and obtaining the first access behavior data set, includes: Dividing the target logical area according to a preset periodic access resource allocation rule to obtain a plurality of target logical sub-areas, where the periodic access resource allocation rule is used to define the platform resource information required for different periodic access operations, and the periodic access operation includes at least one of the following: regular system maintenance, regular resource access, regular data backup; Control the cloud platform to perform a periodic access operation within each of the target logical sub-areas based on the first DPU operating status data set corresponding to the first time period, and obtain the first access behavior data set.

5. The method according to claim 1, wherein The training process of the risk prediction model includes: Obtain a training sample set and a sample label set, where the training sample set includes: a plurality of training samples, the sample label set includes: a plurality of sample labels, and the training sample is the second access behavior data set obtained by the cloud platform performing a periodic access operation under the second DPU operating status data set corresponding to the second access time period, and the sample label is the actual risk value of the cloud platform during the second access time period; Construct an initial learning model; For each training batch in the iterative training process, input the training samples of the training batch into the initial learning model to obtain the second predicted risk values corresponding to the training samples output by the initial learning model; construct a target loss function using the sample labels and the second predicted risk values corresponding to the training samples of the training batch, and adjust the model parameters of the initial learning model according to the target loss function until the model parameters converge to obtain the risk prediction model.

6. The method according to claim 1, wherein Perform security management on the DPU in the cloud platform according to the first predicted access risk values of the cloud platform during each of the first access time periods, including: Determine the first quantity of the first access time periods in which the first predicted access risk value is higher than a preset risk threshold, and determine the total quantity of the first time periods including the first access time periods; Determine the ratio of the first quantity to the total quantity; In the case where the ratio is higher than a preset threshold value, perform security management measures on the DPU in the cloud platform, where the security management measures include but are not limited to: resource reallocation, triggering an alarm, access permission control.

7. The method according to claim 6, wherein Determining the first quantity of the first access time periods in which the first predicted access risk value is higher than a preset risk threshold, includes: Determine the average risk value of the first predicted risk values of the cloud platform during each of the first access time periods within the first time period; For each first access time period within the first time period, calculate the standard deviation of the risk value corresponding to the first access time period based on the first predicted risk value and the average risk value under the first access time period. Determine at least a first target access time period for which the standard deviation of the risk value is not less than a preset standard deviation threshold, and determine the first quantity of the first target access time periods for which the first predicted access risk value is higher than a preset risk threshold.

8. A DPU security management device for a cloud platform, characterized in that, Includes: An acquisition module, configured to acquire a first DPU operation status data set of the cloud platform within a first time period, and a historical security access data set of the cloud platform within a historical time period before the first time period, where the historical security access data set is used to record the correspondence between the historical security access behavior data set and the historical DPU operation status data set within each historical access time period of the cloud platform under the historical time period. A judgment module, configured to preliminarily judge whether the DPU in the cloud platform is in an abnormal operation state within the first time period based on the first DPU operation status data set and the historical security access data set. A risk analysis module, configured to, when the DPU in the cloud platform is in an abnormal operation state within the first time period, determine a first access behavior data set during a periodic access operation under the first DPU operation status data set corresponding to the cloud platform within the first time period, and analyze the first access behavior data set based on a pre-trained risk prediction model to obtain a first predicted access risk value of the cloud platform within each first access time period. A management module, configured to perform security management on the DPU in the cloud platform based on the first predicted access risk value of the cloud platform within each first access time period.

9. A computer program product, characterized in that, Includes: A computer program, where the computer program, when executed by a processor, implements the DPU security management method of the cloud platform according to any one of claims 1 to 7.

10. An electronic device, characterized in that, Includes: A memory and a processor, where a computer program is stored in the memory, and the processor is configured to execute the DPU security management method of the cloud platform according to any one of claims 1 to 7 through the computer program.

Images