Cluster security monitoring method and device, equipment and medium

Abstract

The invention relates to the technical field of artificial intelligence, is applied to smart medical and financial scenes, and discloses a cluster security monitoring method, device, equipment and medium, and the method comprises the steps: creating a daemon set and associating the daemon set to an HIDS client container, and creating a copy of a corresponding Pod; creating a first deployment and associating the first deployment to a container of a callback server, creating a plurality of copies of Pod for running the same callback server process, creating a callback service and associating the callback service to the callback server; establishing and verifying dynamic admission controller configuration, and appointing a receiving end of a forwarding request and a resource type and an operation type of the request needing to be forwarded; the HTTPS service is started, the report service is created, the forwarded request is detected through the callback server, the request is forwarded to the HIDS server side through the HIDS client side, and the request is detected; and creating a second deployment and associating the second deployment to the probe container, sending an HTTPS request to the callback service and the report service according to a preset period, and judging whether the callback service and the report service are available or not.

Description

Technical Field

[0001] This invention relates to the fields of artificial intelligence technology and intelligent decision-making technology, and in particular to a cluster security monitoring method, device, equipment and medium. Background Technology

[0002] Container technology is used to effectively divide the resources of a single operating system into independent groups in order to better balance conflicting resource usage demands among independent groups. However, the dynamic nature of containers and their shared kernel architecture can easily lead to security vulnerabilities. Container security covers the entire lifecycle protection from image building, orchestration and deployment to runtime. Among these, orchestration and deployment involves monitoring and detecting operations such as privileged container creation, privileged account creation, sensitive configuration modification, and sensitive data querying during the operation of the container cluster.

[0003] Existing container security testing mainly relies on cluster audit logs for operational monitoring during the orchestration and deployment phases. However, existing cluster audit logs require restarting the cluster when changes are made, which hinders the development of security testing. Summary of the Invention

[0004] This invention provides a cluster security monitoring method, apparatus, computer equipment, and medium to solve the technical problem that existing security detection relies on cluster audit logs and requires restarting the cluster when changes are made.

[0005] Firstly, a cluster security monitoring method is provided, including: Create a set of daemons and associate them with containers that are clients of the host intrusion detection system. Create a copy of the Pod of the container that runs the client of the host intrusion detection system on all hosts of the cluster. Create the first container deployed and associated with the callback server; create several replicas of Pods running the same callback server process in the cluster; create a callback service and associate the created callback service with the callback server. Create a dynamic admission controller configuration for verification, specifying the callback server associated with the first deployment as the receiver for the application programming interface server to forward requests, and specifying the resource type and operation type of the requests to be forwarded; The client of the host intrusion detection system running on the cluster's management node starts the Hypertext Transfer Protocol service, creates a report service and associates it with the Pod of the host intrusion detection system client running on the management node. The callback server performs real-time detection on the forwarded requests according to preset rules and forwards the requests to the host intrusion detection system server via the host intrusion detection system client for further detection. Create a second deployment and associate it with the probe container. Through the second deployment in the probe container, send Hypertext Transfer Protocol requests to the callback service and the reporting service according to a preset period, obtain the response results, and determine whether the callback service and the reporting service are available based on the response results.

[0006] Secondly, a cluster security monitoring device is provided, including: The daemon set creation module is used to create daemon sets and associate them with containers that are clients of the host intrusion detection system. It creates a copy of the Pod of the container that runs the client of the host intrusion detection system on all hosts of the cluster. The first deployment module is used to create containers for the first deployment and associate them with the callback server. It creates several copies of Pods that run the same callback server process through the cluster, creates callback services, and associates the created callback services with the callback server. The forwarding request settings module is used to create a dynamic admission controller configuration for verification, specifying the callback server associated with the first deployment as the receiving end of the application programming interface server to forward requests, and specifying the resource type and operation type of the requests to be forwarded. The multi-party detection module is used to start the Hypertext Transfer Protocol Security (HTTP) service through the client of the host intrusion detection system running on the cluster's management node, create a report service and associate it with the Pod of the host intrusion detection system client running on the management node, and perform real-time detection on the forwarded requests through the callback server according to preset rules, and forward the request to the host intrusion detection system server through the host intrusion detection system client for detection. The service availability determination module is used to create a second deployment and associate the created second deployment with the probe container. Through the second deployment in the probe container, it sends Hypertext Transfer Protocol requests to the callback service and the reporting service according to a preset period, obtains the response results, and determines whether the callback service and the reporting service are available based on the response results.

[0007] Thirdly, a computer device is provided, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the steps of the above-described cluster security monitoring method.

[0008] Fourthly, a computer-readable storage medium is provided, which stores a computer program that, when executed by a processor, implements the steps of the aforementioned cluster security monitoring method.

[0009] In the above-mentioned cluster security monitoring method, device, equipment, and medium, the following scheme can be implemented: a daemon set can be created by the client and associated with a container of the host intrusion detection system client; a copy of the Pod for running the host intrusion detection system client can be created on all hosts through the cluster; a first deployment can be created and associated with a callback server container; several copies of Pods for running the same callback server process can be created through the cluster; a callback service can be created and associated with the created callback service; a dynamic admission controller configuration can be created, specifying the callback server associated with the created first deployment as the receiving end of the application programming interface server forwarding requests, and specifying the resource type and operation type of the requests to be forwarded; the Hypertext Transfer Protocol service can be started by the host intrusion detection system client running on the cluster management node; a reporting service can be created and associated with the Pod of the host intrusion detection system client running on the management node; the callback server can perform real-time detection of the forwarded requests according to preset rules, and forward the requests to the host intrusion detection system server through the host intrusion detection system client for detection;A second deployment is created and associated with a probe container. The second deployment, within the probe container, sends Hypertext Transfer Protocol (HTTP) requests to the callback and reporting services according to a preset period. Response results are obtained, and the availability of the callback and reporting services is determined based on these results, which are then fed back to the client. In this invention, for intelligent customer service in the medical field, or intelligent customer service in the financial field, a cluster security monitoring scheme can be utilized. This involves creating a daemon set and associating it with a container on the client side of the host intrusion detection system, creating a first deployment and associating it with a container on the callback server, creating a callback service and associating it with the callback server, creating a dynamic access controller configuration for verification, specifying the forwarding request receiver and the resource and operation types for which requests need to be forwarded, and starting the HTTP service through the client side of the host intrusion detection system running on the cluster's management node. A reporting service is also created and associated with the host intrusion detection system running on the management node. The client Pod of the testing system performs real-time detection of forwarded requests through a callback server according to preset rules. The request is then forwarded by the client of the host intrusion detection system to the server of the host intrusion detection system for further detection. A second deployment is created and associated with a probe container. Based on a preset period, HTTP requests are sent to the callback service and reporting service to determine their availability. This enables real-time monitoring of orchestration phase operations and intrusion detection. Furthermore, by linking with other components within the host intrusion detection system, detection capabilities are improved, and the potential negative impact of dynamic access control on the cluster is reduced. By detecting requests through the host intrusion detection system and checking the availability of the callback and reporting services through the probe container, multi-faceted detection is achieved, avoiding timeout connections. Moreover, it does not rely on cluster audit logs for orchestration phase monitoring, avoiding cluster restarts caused by changes to cluster audit log functionality, and it does not consume disk space. Attached Figure Description

[0010] To more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings used in the description of the embodiments of the present invention will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0011] Figure 1 This is a schematic diagram of an application environment for a cluster security monitoring method according to an embodiment of the present invention; Figure 2 This is a flowchart illustrating a cluster security monitoring method according to an embodiment of the present invention; Figure 3 This is a schematic diagram of a cluster security monitoring device in one embodiment of the present invention; Figure 4This is a schematic diagram of the structure of a computer device according to an embodiment of the present invention; Figure 5 This is another structural schematic diagram of a computer device according to one embodiment of the present invention. Detailed Implementation

[0012] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0013] The cluster security monitoring method provided in this embodiment of the invention can be applied to, for example... Figure 1In application environments, such as intelligent customer service or intelligent assistants used in medical and financial application scenarios, they are usually implemented through the server, where the client communicates with the server through the network.The client creates a daemon set and associates it with the container of the host intrusion detection system client. A replica of the Pod for running the host intrusion detection system client is created on all hosts in the cluster. A container for the first deployment is created and associated with the callback server. Several replicas of the Pod for running the same callback server process are created in the cluster. A callback service is created and associated with the callback server. A dynamic admission controller configuration is created, specifying the callback server associated with the first deployment as the receiving end of the application programming interface server's request forwarding, and specifying the resource type and operation type of the requests to be forwarded. The host intrusion detection system client running on the cluster's management node starts the super... The Hypertext Transfer Protocol (HTTP) service creates a reporting service and associates it with the Pod of the host intrusion detection system (HIS) client running on the management node. A callback server performs real-time detection on forwarded requests according to preset rules and forwards the requests to the HIS server via the HIS client for further detection. A second deployment is created and associated with a probe container. This second deployment sends HTTP requests to the callback and reporting services at preset intervals through the probe container, obtains response results, determines the availability of the callback and reporting services based on the response results, and sends feedback back to the client. In this invention, it is used for intelligent customer service in the medical field or intelligent customer service in the financial field. A cluster-based security monitoring solution can be implemented by creating a daemon set and associating it with a container of the host intrusion detection system's client, creating a container for the initial deployment and associating it with a callback server, creating a callback service and associating it with the callback server, creating a dynamic access controller configuration for verification, specifying the receiving end for forwarding requests, and specifying the resource type and operation type of the requests to be forwarded. The Hypertext Transfer Protocol Security (HTTP) service is started through the host intrusion detection system's client running on the cluster's management node. A reporting service is created and associating it with the Pod of the host intrusion detection system's client running on the management node. The callback server performs real-time detection of forwarded requests according to preset rules and forwards the requests to the host intrusion detection system's service via the host intrusion detection system's client. On the service side, requests are inspected, a second deployment is created and associated with the probe container, and HTTP requests are sent to the callback service and reporting service according to a preset period to determine their availability. This enables real-time monitoring of orchestration phase operations and intrusion detection. Furthermore, by linking with other components within the host intrusion detection system, detection capabilities are improved, and the potential negative impact of dynamic access control on the cluster is reduced. Requests are detected through the host intrusion detection system, and the availability of callback and reporting services is checked through the probe container, achieving multi-faceted detection and avoiding timeout connections. Moreover, it does not rely on cluster audit logs for orchestration phase monitoring, avoiding cluster restarts caused by changes in cluster audit log functionality, and it does not consume disk space, making it highly practical.The client can be, but is not limited to, various personal computers, laptops, smartphones, tablets, and portable wearable devices. The server can be implemented using a standalone server or a server cluster consisting of multiple servers. The invention will now be described in detail through specific embodiments.

[0014] Please see Figure 2 As shown, Figure 2 A flowchart illustrating the cluster security monitoring method provided in this embodiment of the invention includes the following steps: S10: Create a DaemonSet and associate the created DaemonSet with the container of the Host-based Intrusion Detection System (HIDS) client. Create a copy of the Pod of the container running the HIDS client on all hosts in the cluster.

[0015] Daemon sets are a built-in resource type in Kubernetes and one method of Pod scheduling. When a daemon set is created, the cluster ensures that a replica of the Pod associated with the daemon set is running on eligible nodes. When a Pod stops running, the cluster rebuilds a replica of the Pod on that node. A Pod replica is simply called a Pod copy. Host intrusion detection systems detect network attacks by monitoring abnormal operations on a computer. They generally consist of a client and a server. The client runs on the target computer, collecting abnormal operations and generating logs to send back to the server. The server runs on a remote server, checking the logs sent back by the client to determine if an attack has occurred. Checking methods include special matching and machine learning. The client of the host intrusion detection system collects operation logs from the host, receives dynamic admission controller (Webhook) logs, and sends all logs back to the host intrusion detection system server. Operation logs include process and network connections. The cluster security monitoring method provided by this invention can be applied to intelligent customer service, intelligent assistants, or intelligent management systems in various application scenarios such as healthcare, finance, and insurance, and is typically implemented through a server. For example, in the medical field, intelligent medical management systems can manage surgical procedures, medical records, and patient information across hospital departments. Users can upload their health information via a smart assistant, or doctors can upload surgical procedures and medical records. Similarly, in the financial field, intelligent financial management systems can manage users' financial product information and personal information. Users can change their personal information through intelligent customer service, or employees can modify users' financial product information and contract information through a smart assistant.

[0016] S20: Create the first deployment and associate the created first deployment with the container of the CallbackServer. Create several copies of Pods in the cluster to run the same CallbackServer process. Create a callback service and associate the created callback service with the CallbackServer.

[0017] In this deployment, replicas of the Pods running the same callback server process can receive and process requests forwarded by the Application Programming Interface (API) server, enabling real-time detection. Preferably, the first deployment can run replicas of three Pods. By creating callback services associated with the callback server, load balancing and port exposure of the callback server can be achieved. A service is a built-in resource type in Kubernetes and is one way to expose Pod network ports to the external network and achieve load balancing. A service can be associated with the network ports of several Pods. When the external network accesses the service, the service uses a built-in scheduling strategy to evenly forward external access traffic to the network ports of the associated Pods.

[0018] Specifically, after creating the callback service and associating the created callback service with the callback server in step S20, the cluster security monitoring method further includes: Set a liveness probe for the first deployment of the container associated with the callback server. Perform liveness detection on the Pod running the callback server process based on the liveness probe. Set the preset liveness detection timeout to 1 second, the preset liveness detection period interval to 10 seconds, and the preset number of liveness detection failures to 5. The first deployment of the container associated with the callback server sets a readiness probe. Based on the readiness probe, the Pod running the callback server process is checked for readiness. The preset readiness check timeout is set to 1 second and the preset readiness check interval is set to 10 seconds. The Pod running the callback server process that successfully accesses the callback service is associated with the callback service, and the Pod running the callback server process that fails to access the callback service is unassociated with the callback service.

[0019] S30: Create a ValidatingWebhookConfiguration configuration, specifying the callback server associated with the first deployment as the receiver for forwarding requests to the Application Programming Interface Server (APIServer), and specifying the resource type and operation type of the requests to be forwarded.

[0020] Among them, the dynamic admission controller (Webhook) is one of the authorization methods for Kubernetes clusters. The user-defined backend Hypertext Transfer Security Protocol (HTTPS) service implements the authorization function and is integrated into the Kubernetes authorization process. After integration, non-query type requests from the Kubernetes cluster's application programming interface server are forwarded to the backend HTTPS service defined in the dynamic admission controller for authorization.

[0021] S40: The Hypertext Transfer Protocol Secure (HTTPS) service is started by the client of the host intrusion detection system running on the cluster's management node. A ReportService is created and associated with the Pod of the host intrusion detection system client running on the management node. The callback server performs real-time detection on the forwarded requests according to preset rules and forwards the requests to the host intrusion detection system server via the host intrusion detection system client for further detection.

[0022] Specifically, in some embodiments, before step S40, which involves the callback server performing real-time detection of forwarded requests according to preset rules, the cluster security monitoring method further includes: In the configuration of the dynamic admission controller, a waiting delay time is set. The request is forwarded to the callback server through the application programming interface server. When the network access response time of the callback server exceeds the waiting delay time or the network access fails, the request is processed directly through the application programming interface server.

[0023] Preferably, in some embodiments, in step S40, the step of using a callback server to perform real-time detection of the forwarded request according to preset rules, and forwarding the request from the client of the host intrusion detection system to the server of the host intrusion detection system for detection, specifically involves: The callback server performs real-time detection on the requests forwarded by the application programming interface server according to preset rules, and forwards the requests to the reporting service. The client of the host intrusion detection system receives the forwarded requests through the reporting service and forwards them to the server of the host intrusion detection system, where the server of the host intrusion detection system detects the requests.

[0024] Specifically, in some embodiments, after the request is detected by the server of the host intrusion detection system in step S40, the cluster security monitoring method further includes: The request is saved to the database for archiving and statistics.

[0025] The database can be a search server (ElasticSearch).

[0026] S50: Create a second deployment and associate the created second deployment with the probe container. Through the second deployment in the probe container, send Hypertext Transfer Security Protocol (HTTPS) requests to the callback service and the reporting service according to a preset period, obtain the response results, and determine whether the callback service and the reporting service are available based on the response results.

[0027] Specifically, in some embodiments, step S50, namely, sending Hypertext Transfer Protocol requests to the callback service and the reporting service through the second probe container according to a preset period, obtaining the response result, and determining whether the callback service and the reporting service are available based on the response result, includes: The client of the host intrusion detection system uses a second probe container to send Hypertext Transfer Protocol (HTTP) requests to the callback service at a preset period, where the preset period can be 10 seconds.

[0028] The client of the host intrusion detection system uses a second probe container to send Hypertext Transfer Protocol (HTTP) requests to the reporting service at a preset period, where the preset period can be 10 seconds.

[0029] Obtain the callback service response result and the report service response result. Determine whether the callback service is available based on the callback service response result and whether the report service is available based on the report service response result.

[0030] Specifically, after determining whether the callback service and reporting service are available based on the response result in step S50, the cluster security monitoring method further includes: When both the callback service and the reporting service are available, create an instance of the dynamic admission controller configuration to validate it. If the callback service is deemed unavailable 10 times consecutively or the reporting service is deemed unavailable 10 times consecutively, delete the verification dynamic admission controller configuration and its corresponding deployment to prevent the application programming interface server from continuously forwarding requests to the abnormal dynamic admission controller.

[0031] The availability of the dynamic admission controller is improved by judging the availability of callback services and reporting services, and timely rollback is ensured in case of anomalies, so as to guarantee the normal operation of the application programming interface server.

[0032] As can be seen, in the above solutions, for intelligent customer service in the medical field or the financial field, a cluster security monitoring solution can be used. This involves creating a daemon set and associating it with the client container of the host intrusion detection system, creating a container for the first deployment and associating it with the callback server, creating a callback service and associating it with the callback server, creating a dynamic access controller configuration for verification, specifying the receiving end of the forwarding request and the resource type and operation type of the request to be forwarded, starting the Hypertext Transfer Protocol Security (HTTP) service through the client of the host intrusion detection system running on the cluster's management node, creating a reporting service and associating it with the Pod of the client of the host intrusion detection system running on the management node, and having the callback server perform real-time detection of the forwarded requests according to preset rules and pass the host intrusion detection system through the callback server. The client of the detection system forwards requests to the server of the host intrusion detection system, which then detects the requests, creates a second deployment and associates it with the probe container. Based on a preset period, it sends HTTP requests to the callback service and the reporting service to determine their availability, enabling real-time monitoring of orchestration phase operations and intrusion detection. Furthermore, by linking with other components within the host intrusion detection system, it enhances detection capabilities and reduces the potential negative impact of dynamic access control on the cluster. By detecting requests through the host intrusion detection system and checking the availability of the callback and reporting services through the probe container, it achieves multi-faceted detection, avoids timeout connections, and eliminates the need to rely on cluster audit logs for orchestration phase monitoring, thus avoiding cluster restarts caused by changes to the cluster audit log function and saving disk space.

[0033] It should be understood that the sequence number of each step in the above embodiments does not imply the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present invention.

[0034] In one embodiment, a cluster security monitoring device is provided, which corresponds one-to-one with the cluster security monitoring methods described in the above embodiments. For example... Figure 3 As shown, the cluster security monitoring device includes a daemon set creation module 101, a first deployment module 102, a forwarding request setting module 103, a multi-party request detection module 104, and a service availability judgment module 105. Detailed descriptions of each functional module are as follows: The daemon set creation module 101 is used to create daemon sets and associate them with containers of the host intrusion detection system's client. It creates a copy of the Pod of the container that runs the host intrusion detection system's client on all hosts through the cluster. The first deployment module 102 is used to create a container for the first deployment and associate it with the callback server. It creates several copies of Pods that run the same callback server process through the cluster, creates a callback service, and associates the created callback service with the callback server. The forwarding request setting module 103 is used to create a dynamic admission controller configuration for verification, specify the callback server associated with the first deployment as the receiving end of the application programming interface server to forward requests, and specify the resource type and operation type of the requests to be forwarded. The multi-party detection module 104 is used to start the Hypertext Transfer Protocol Security Service through the client of the host intrusion detection system running on the management node of the cluster, create a report service and associate it with the Pod of the client of the host intrusion detection system running on the management node, and perform real-time detection on the forwarded request through the callback server according to preset rules, and forward the request to the server of the host intrusion detection system through the client of the host intrusion detection system for detection. The service availability determination module 105 is used to create a second deployment and associate the created second deployment with the probe container. The second deployment is sent to the callback service and the reporting service through the probe container according to a preset period, and the response results are obtained. The availability of the callback service and the reporting service is determined based on the response results.

[0035] In one embodiment, the first deployment module 102 is further configured to: Set a liveness probe for the first deployment of the container associated with the callback server. Perform liveness detection on the Pod running the callback server process based on the liveness probe. Set the preset liveness detection timeout to 1 second, the preset liveness detection period interval to 10 seconds, and the preset number of liveness detection failures to 5. Set a readiness probe for the first deployment of the container associated with the callback server. Based on the readiness probe, perform readiness checks on the Pod running the callback server process. Set the preset readiness check timeout to 1 second and the preset readiness check interval to 10 seconds. Associate the Pod running the callback server process that successfully accesses the callback service with the callback service, and remove the association between the Pod running the callback server process that fails to access the callback service and the callback service.

[0036] In one embodiment, the request multi-party detection module 104 is specifically used for: In the configuration of the dynamic admission controller, a waiting delay time is set. The request is forwarded to the callback server through the application programming interface server. When the network access response time of the callback server exceeds the waiting delay time or the network access fails, the request is processed directly through the application programming interface server.

[0037] In one embodiment, the request multi-party detection module 104 is specifically used for: The callback server performs real-time detection on the requests forwarded by the application programming interface server according to preset rules, and forwards the requests to the reporting service. The client of the host intrusion detection system receives the forwarded requests through the reporting service and forwards them to the server of the host intrusion detection system, where the server of the host intrusion detection system detects the requests.

[0038] In one embodiment, the determination module 104 is further configured to: Save the request to the database.

[0039] In one embodiment, the service availability determination module 105 is specifically used for: The client of the host intrusion detection system uses a second probe container to send Hypertext Transfer Protocol requests to the callback service according to a preset period. The client of the host intrusion detection system uses a second probe container to send Hypertext Transfer Protocol (HTTP) requests to the reporting service at a preset period. Obtain the callback service response result and the report service response result. Determine whether the callback service is available based on the callback service response result and whether the report service is available based on the report service response result.

[0040] In one embodiment, the service availability determination module 105 is further configured to: When both the callback service and the reporting service are available, create an instance of the dynamic admission controller configuration to validate it. If the callback service is deemed unavailable 10 times consecutively or the reporting service is deemed unavailable 10 times consecutively, delete the verification dynamic admission controller configuration and the corresponding deployment.

[0041] This invention provides a cluster security monitoring device. It creates a daemon set and associates it with a container of a host intrusion detection system client; creates a first deployment container and associates it with a callback server; creates a callback service and associates it with the callback server; creates a dynamic access controller configuration for verification; specifies the receiving end for forwarding requests and the resource type and operation type of the requests to be forwarded; starts a Hypertext Transfer Protocol (HTTP) service through the host intrusion detection system client running on the cluster's management node; creates a reporting service and associates it with the Pod of the host intrusion detection system client running on the management node; and uses the callback server to perform real-time detection of forwarded requests according to preset rules, and forwards the requests to the host intrusion detection system client via the host intrusion detection system client. The system's server detects requests, creates a second deployment and associates it with the probe container. Based on a preset cycle, it sends HTTP requests to the callback and reporting services to determine their availability, enabling real-time monitoring of orchestration phase operations and intrusion detection. Furthermore, by integrating with other components within the host intrusion detection system, it enhances detection capabilities and reduces the potential negative impact of dynamic access control on the cluster. By detecting requests through the host intrusion detection system and assessing the availability of callback and reporting services through the probe container, it achieves multi-faceted detection, avoiding timeouts. Moreover, it eliminates the need to rely on cluster audit logs for orchestration phase monitoring, preventing cluster restarts when cluster audit log functionality changes, and consuming no disk space.

[0042] Specific limitations regarding the cluster security monitoring device can be found in the limitations of the cluster security monitoring method described above, and will not be repeated here. Each module in the aforementioned cluster security monitoring device can be implemented entirely or partially through software, hardware, or a combination thereof. These modules can be embedded in the processor of the computer device in hardware form or independent of it, or stored in the memory of the computer device in software form, so that the processor can call and execute the corresponding operations of each module.

[0043] In one embodiment, a computer device is provided, which may be a server, and its internal structure diagram may be as follows: Figure 4 As shown, the computer device includes a processor, memory, network interface, and database connected via a system bus. The processor provides computing and control capabilities. The memory includes non-volatile and / or volatile storage media and internal memory. The non-volatile storage media stores the operating system, computer programs, and database. The internal memory provides an environment for the operation of the operating system and computer programs stored in the non-volatile storage media. The network interface is used to communicate with external clients via a network connection. When the computer program is executed by the processor, it implements the functions or steps of a cluster security monitoring method on the server side.

[0044] In one embodiment, a computer device is provided, which may be a client, and its internal structure diagram may be as follows: Figure 5 As shown, the computer device includes a processor, memory, network interface, display screen, and input devices connected via a system bus. The processor provides computing and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores the operating system and computer programs. The internal memory provides an environment for the operation of the operating system and computer programs stored in the non-volatile storage media. The network interface is used to communicate with an external server via a network connection. When the computer program is executed by the processor, it implements the functions or steps of a cluster security monitoring method on the client side.

[0045] In one embodiment, a computer device is provided, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to perform the following steps: Create a set of daemons and associate them with containers that are clients of the host intrusion detection system. Create a copy of the Pod of the container that runs the client of the host intrusion detection system on all hosts of the cluster. Create the first container deployed and associated with the callback server; create several replicas of Pods running the same callback server process in the cluster; create a callback service and associate the created callback service with the callback server. Create a dynamic admission controller configuration for verification, specifying the callback server associated with the first deployment as the receiver for the application programming interface server to forward requests, and specifying the resource type and operation type of the requests to be forwarded; The client of the host intrusion detection system running on the cluster's management node starts the Hypertext Transfer Protocol service, creates a report service and associates it with the Pod of the host intrusion detection system client running on the management node. The callback server performs real-time detection on the forwarded requests according to preset rules and forwards the requests to the host intrusion detection system server via the host intrusion detection system client for further detection. Create a second deployment and associate it with the probe container. Through the second deployment in the probe container, send Hypertext Transfer Protocol requests to the callback service and the reporting service according to a preset period, obtain the response results, and determine whether the callback service and the reporting service are available based on the response results.

[0046] In one embodiment, a computer-readable storage medium is provided having a computer program stored thereon, the computer program performing the following steps when executed by a processor: Create a set of daemons and associate them with containers that are clients of the host intrusion detection system. Create a copy of the Pod of the container that runs the client of the host intrusion detection system on all hosts of the cluster. Create the first container deployed and associated with the callback server; create several replicas of Pods running the same callback server process in the cluster; create a callback service and associate the created callback service with the callback server. Create a dynamic admission controller configuration for verification, specifying the callback server associated with the first deployment as the receiver for the application programming interface server to forward requests, and specifying the resource type and operation type of the requests to be forwarded; The client of the host intrusion detection system running on the cluster's management node starts the Hypertext Transfer Protocol service, creates a report service and associates it with the Pod of the host intrusion detection system client running on the management node. The callback server performs real-time detection on the forwarded requests according to preset rules and forwards the requests to the host intrusion detection system server via the host intrusion detection system client for further detection. Create a second deployment and associate it with the probe container. Through the second deployment in the probe container, send Hypertext Transfer Protocol requests to the callback service and the reporting service according to a preset period, obtain the response results, and determine whether the callback service and the reporting service are available based on the response results.

[0047] It should be noted that the functions or steps that can be implemented by the computer-readable storage medium or computer device described above can be referred to the relevant descriptions on the server side and client side in the foregoing method embodiments. To avoid repetition, they will not be described one by one here.

[0048] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium. When executed, the computer program can include the processes of the embodiments of the above methods. Any references to memory, storage, databases, or other media used in the embodiments provided in this application can include non-volatile and / or volatile memory. Non-volatile memory may include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM), or flash memory. Volatile memory may include random access memory (RAM) or external cache memory. By way of illustration and not limitation, RAM is available in a variety of forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), dual data rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), synchronous link DRAM (SLDRAM), RAMbus direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM), etc.

[0049] Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the above-described division of functional units and modules is used as an example. In practical applications, the above functions can be assigned to different functional units and modules as needed, that is, the internal structure of the device can be divided into different functional units or modules to complete all or part of the functions described above.

[0050] The above-described embodiments are only used to illustrate the technical solutions of the present invention, and are not intended to limit it. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention, and should all be included within the protection scope of the present invention.

Claims

1. A cluster security monitoring method, characterized in that, include: Create a set of daemons and associate them with containers that are clients of the host intrusion detection system. Create a copy of the Pod of the container that runs the client of the host intrusion detection system on all hosts of the cluster. Create the first container deployed and associated with the callback server; create several replicas of Pods running the same callback server process in the cluster; create a callback service and associate the created callback service with the callback server. Create a dynamic admission controller configuration for verification, specifying the callback server associated with the first deployment as the receiver for the application programming interface server to forward requests, and specifying the resource type and operation type of the requests to be forwarded; The client of the host intrusion detection system running on the cluster's management node starts the Hypertext Transfer Protocol service, creates a report service and associates it with the Pod of the host intrusion detection system client running on the management node. The callback server performs real-time detection on the forwarded requests according to preset rules and forwards the requests to the host intrusion detection system server via the host intrusion detection system client for further detection. Create a second deployment and associate it with the probe container. Through the second deployment in the probe container, send Hypertext Transfer Protocol requests to the callback service and the reporting service according to a preset period, obtain the response results, and determine whether the callback service and the reporting service are available based on the response results.

2. The cluster security monitoring method as described in claim 1, characterized in that, After creating the callback service and associating the created callback service with the callback server, the cluster security monitoring method further includes: Set a liveness probe for the first deployment of the container associated with the callback server. Perform liveness detection on the Pod running the callback server process based on the liveness probe. Set the preset liveness detection timeout to 1 second, the preset liveness detection period interval to 10 seconds, and the preset number of liveness detection failures to 5. Set a readiness probe for the first deployment of the container associated with the callback server. Based on the readiness probe, perform readiness checks on the Pod running the callback server process. Set the preset readiness check timeout to 1 second and the preset readiness check interval to 10 seconds. Associate the Pod running the callback server process that successfully accesses the callback service with the callback service, and remove the association between the Pod running the callback server process that fails to access the callback service and the callback service.

3. The cluster security monitoring method as described in claim 1, characterized in that, Before the real-time detection of forwarded requests by the callback server according to preset rules, the cluster security monitoring method further includes: In the configuration of the dynamic admission controller, a waiting delay time is set. The request is forwarded to the callback server through the application programming interface server. When the network access response time of the callback server exceeds the waiting delay time or the network access fails, the request is processed directly through the application programming interface server.

4. The cluster security monitoring method as described in claim 1, characterized in that, The process involves the callback server performing real-time detection of forwarded requests according to preset rules, and then forwarding the request from the client of the host intrusion detection system to the server of the host intrusion detection system for further detection. Specifically: The callback server performs real-time detection on the requests forwarded by the application programming interface server according to preset rules, and forwards the requests to the reporting service. The client of the host intrusion detection system receives the forwarded requests through the reporting service and forwards them to the server of the host intrusion detection system, where the server of the host intrusion detection system detects the requests.

5. The cluster security monitoring method as described in claim 4, characterized in that, After the request is detected by the server of the host intrusion detection system, the cluster security monitoring method further includes: Save the request to the database.

6. The cluster security monitoring method as described in claim 1, characterized in that, The step of sending Hypertext Transfer Protocol (HTTP) requests to the callback service and the reporting service at a preset periodic interval via a second probe container, obtaining response results, and determining whether the callback service and the reporting service are available based on the response results includes: The client of the host intrusion detection system uses a second probe container to send Hypertext Transfer Protocol requests to the callback service according to a preset period. The client of the host intrusion detection system uses a second probe container to send Hypertext Transfer Protocol (HTTP) requests to the reporting service at a preset period. Obtain the callback service response result and the report service response result. Determine whether the callback service is available based on the callback service response result and whether the report service is available based on the report service response result.

7. The cluster security monitoring method as described in claim 1, characterized in that, After determining whether the callback service and reporting service are available based on the response results, the cluster security monitoring method further includes: When both the callback service and the reporting service are available, create an instance of the dynamic admission controller configuration to validate it. If the callback service is deemed unavailable 10 times consecutively or the reporting service is deemed unavailable 10 times consecutively, delete the verification dynamic admission controller configuration and the corresponding deployment.

8. A cluster security monitoring device, characterized in that, include: The daemon set creation module is used to create daemon sets and associate them with containers that are clients of the host intrusion detection system. It creates a copy of the Pod of the container that runs the client of the host intrusion detection system on all hosts of the cluster. The first deployment module is used to create containers for the first deployment and associate them with the callback server. It creates several copies of Pods that run the same callback server process through the cluster, creates callback services, and associates the created callback services with the callback server. The forwarding request settings module is used to create a dynamic admission controller configuration for verification, specifying the callback server associated with the first deployment as the receiving end of the application programming interface server to forward requests, and specifying the resource type and operation type of the requests to be forwarded. The multi-party detection module is used to start the Hypertext Transfer Protocol Security (HTTP) service through the client of the host intrusion detection system running on the cluster's management node, create a report service and associate it with the Pod of the host intrusion detection system client running on the management node, and perform real-time detection on the forwarded requests through the callback server according to preset rules, and forward the request to the host intrusion detection system server through the host intrusion detection system client for detection. The service availability determination module is used to create a second deployment and associate the created second deployment with the probe container. Through the second deployment in the probe container, it sends Hypertext Transfer Protocol requests to the callback service and the reporting service according to a preset period, obtains the response results, and determines whether the callback service and the reporting service are available based on the response results.

9. A computer device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the computer program, it implements the steps of the cluster security monitoring method as described in any one of claims 1 to 7.

10. A computer-readable storage medium storing a computer program, characterized in that, When the computer program is executed by the processor, it implements the steps of the cluster security monitoring method as described in any one of claims 1 to 7.

Images