WO2017193845A1 - 虚拟网络功能的审计方法和装置 - Google Patents

虚拟网络功能的审计方法和装置 Download PDF

Info

Publication number
WO2017193845A1
WO2017193845A1 PCT/CN2017/082843 CN2017082843W WO2017193845A1 WO 2017193845 A1 WO2017193845 A1 WO 2017193845A1 CN 2017082843 W CN2017082843 W CN 2017082843W WO 2017193845 A1 WO2017193845 A1 WO 2017193845A1
Authority
WO
WIPO (PCT)
Prior art keywords
event
vnf
sequence
module
information corresponding
Prior art date
Application number
PCT/CN2017/082843
Other languages
English (en)
French (fr)
Inventor
张波
谢于明
黄志钢
汪洋
夏靓
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Priority to EP17795463.3A priority Critical patent/EP3445001B1/en
Publication of WO2017193845A1 publication Critical patent/WO2017193845A1/zh
Priority to US16/185,971 priority patent/US10990670B2/en

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/55—Detecting local intrusion or implementing counter-measures
    • G06F21/552—Detecting local intrusion or implementing counter-measures involving long-term monitoring or reporting
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/0892—Network architectures or network communication protocols for network security for authentication of entities by using authentication-authorization-accounting [AAA] servers or protocols
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
    • H04L41/08—Configuration management of networks or network elements
    • H04L41/0895—Configuration of virtualised networks or elements, e.g. virtualised network function or OpenFlow elements
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/55—Detecting local intrusion or implementing counter-measures
    • G06F21/554—Detecting local intrusion or implementing counter-measures involving event detection and direct action
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
    • H04L41/06—Management of faults, events, alarms or notifications
    • H04L41/0631—Management of faults, events, alarms or notifications using root cause analysis; using analysis of correlation between notifications, alarms or events based on decision criteria, e.g. hierarchy, tree or time analysis
    • H04L41/064—Management of faults, events, alarms or notifications using root cause analysis; using analysis of correlation between notifications, alarms or events based on decision criteria, e.g. hierarchy, tree or time analysis involving time analysis
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
    • H04L41/08—Configuration management of networks or network elements
    • H04L41/0803—Configuration setting
    • H04L41/0813—Configuration setting characterised by the conditions triggering a change of settings
    • H04L41/0816—Configuration setting characterised by the conditions triggering a change of settings the condition being an adaptation, e.g. in response to network events
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
    • H04L41/28—Restricting access to network management systems or functions, e.g. using authorisation function to access network configuration
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
    • H04L41/40—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks using virtualisation of network functions or resources, e.g. SDN or NFV entities
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/10—Network architectures or network communication protocols for network security for controlling access to devices or network resources
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1408—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic by monitoring network traffic
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L67/00—Network arrangements or protocols for supporting network services or applications
    • H04L67/50—Network services
    • H04L67/51—Discovery or management thereof, e.g. service location protocol [SLP] or web services
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F2221/00—Indexing scheme relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F2221/03—Indexing scheme relating to G06F21/50, monitoring users, programs or devices to maintain the integrity of platforms
    • G06F2221/034—Test or assess a computer or a system
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F2221/00—Indexing scheme relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F2221/21—Indexing scheme relating to G06F21/00 and subgroups addressing additional information or applications relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F2221/2101—Auditing as a secondary aspect

Definitions

  • the present invention relates to the field of virtual networks, and in particular, to an auditing method and apparatus for a virtual network function (VNF).
  • VNF virtual network function
  • Traditional network devices such as routers, switches, and firewalls, are generally based on the functions of the hardware included in the device, and have fixed network functions, such as support for various protocols, load balancing, rate control, etc., such network devices. Difficult to upgrade and expand.
  • the prior art generally uses the network function virtualization to solve the above problem.
  • the network function virtualization technology implements the VNF by creating a virtual machine in any network device, and the VNF can be flexibly created according to requirements, and there is no problem of upgrading and expanding.
  • VNF virtual machine
  • an existing platform such as an OpenStack cloud platform
  • a VNF is established through the virtual machine.
  • the existing OpenStack cloud platform includes an authentication and authorization component, a service component, and a virtual infrastructure.
  • the business components of the platform may have vulnerabilities.
  • the malicious users can use the vulnerabilities of the business components to create malicious VNFs.
  • the malicious VNF attacks other legitimate VNFs or hosts to obtain data of both communicating parties, thereby causing user data leakage.
  • the event log records generated by each component in the process of establishing the VNF are generally analyzed by a technician to discover a malicious VNF. This method not only requires high technical level and low efficiency of the technician; meanwhile, when the establishment process of the malicious VNF bypasses any component of the platform, the component does not generate any logs, and the technician only checks one component at a time.
  • the event log is more difficult to detect malicious VNF, which leads to the detection of the existing malicious VNF audit method is not comprehensive enough, and the missed detection rate is high.
  • the embodiment of the invention provides an auditing method and device for the virtual network function, so as to solve the problem that the existing VNF auditing method is not comprehensively detected and the missed detection rate is high.
  • an embodiment of the present invention provides an auditing method for a virtual network function, which is used to audit a virtual network function VNF generated by a platform including an authentication and authorization component, a service component, and a virtual infrastructure, and the method includes:
  • the above method receives an event reported by the authentication authorization component, the service component, and the virtual infrastructure, and acquires an event sequence that can indicate the order of occurrence of each VNF event according to all events received, and finally events for each VNF occur.
  • the sequence is audited to get the audit results.
  • the process of acquiring an event occurrence sequence specifically includes:
  • At least one authentication authorization event, at least one service event, and at least one access event according to at least one authentication authorization event, at least one business event, and a user identifier in event information corresponding to each event of the at least one access event, obtaining each All the events corresponding to the user identifiers are analyzed, and all the events corresponding to the same user identifier are analyzed according to the VNF identifiers included in the event information corresponding to each event in the event corresponding to each user identifier, and each VNF identifier is obtained. All the events of the same VNF identifier are sorted to obtain the event sequence of the VNF corresponding to each VNF identifier according to the occurrence time of the event information corresponding to each event in the event corresponding to the same VNF identifier. .
  • all the events are sorted according to the user identifier of the event, the VNF identifier, and the time of occurrence, and an event sequence with more obvious relationship between the two is obtained, which can improve the audit speed.
  • the at least one authentication authorization event, the at least one service event, and the event information corresponding to each event of the at least one access event Each includes the module number of the VNF operation call corresponding to the event, and the audit process specifically includes:
  • each VNF event occurrence sequence determine a module sequence consisting of the module number of the VNF operation call included in the event information corresponding to each event in the event occurrence sequence; determine whether the module sequence conforms to the preset module sequence; if the module sequence If the preset module sequence is not met, the VNF is obtained as a malicious VNF audit result.
  • the at least one authentication authorization event, the at least one service event, and the event information corresponding to each event in the at least one access event Each time includes the occurrence time of the VNF operation corresponding to the event, and the audit process specifically includes:
  • each VNF event occurrence sequence For each VNF event occurrence sequence, determining the execution duration of each event in the event occurrence sequence according to the occurrence time included in the event information corresponding to each event in the sequence of occurrence events; determining whether the execution duration of each event is uniform It is less than the preset duration; if there is an event whose execution duration is greater than or equal to the preset duration, then the VNF is obtained as the audit result of the malicious VNF.
  • the at least one authentication authorization event, the at least one service event, and the event information corresponding to each event in the at least one access event Both the operation type and the user type of the VNF operation corresponding to the event are included, and the audit process specifically includes:
  • VNF For each event sequence of the VNF, determining the user type included in the event information corresponding to each event in the event occurrence sequence and the operation type set corresponding to the user type; determining event information corresponding to each event in the event occurrence sequence Whether the type of the operation included in the operation type set corresponding to the user type included in the event information; when the operation type included in the event information corresponding to the at least one event is not in the operation type set corresponding to the user type included in the event information, VNF is the audit result of a malicious VNF.
  • the implementation of any one of the first to fourth aspects of the first aspect in a fifth possible implementation manner of the first aspect, if the audit result is that the VNF is a malicious VNF, The method also includes: outputting a warning information.
  • the authentication authorization event, the service event, and the access event correspond to
  • the event information includes at least one of the following: a module number, a user identifier, a user type, an operation type, a VNF identifier, an occurrence time, an operation result, and an image file type that are invoked by the VNF operation.
  • an embodiment of the present invention provides an auditing apparatus for a virtual network function, which is used for auditing a virtual network function VNF generated by a platform including an authentication and authorization component, a service component, and a virtual infrastructure, and the apparatus includes:
  • the receiving module is configured to receive at least one authentication authorization event triggered by the first VNF operation reported by the authentication authorization component, receive at least one service event triggered by the second VNF operation reported by the service component, and receive the third VNF reported by the virtual infrastructure. At least one access event triggered by the operation;
  • a sorting module configured to acquire an event occurrence sequence of each VNF according to the at least one authentication authorization event, the at least one service event, and the at least one access event, where an event occurrence sequence is used to indicate an occurrence sequence of multiple events corresponding to one VNF;
  • the audit module is used to audit the sequence of events of each VNF and obtain the audit result of the VNF.
  • the sorting module is specifically configured to:
  • At least one authentication authorization event, at least one service event, and at least one access event classifying at least one authentication authorization event, at least one service event, and at least one access event according to at least one authentication authorization event, at least one business event, and a user identifier in event information corresponding to each event of the at least one access event, obtaining each All events corresponding to the user ID;
  • All events corresponding to the same user identifier are analyzed according to the VNF identifier included in the event information corresponding to each event in the event corresponding to each user identifier, and all events corresponding to each VNF identifier are obtained.
  • the events corresponding to each VNF identifier are sorted according to the occurrence time of the event information corresponding to each event in the event corresponding to each VNF identifier, to obtain an event occurrence sequence of the VNF corresponding to each VNF identifier.
  • the at least one authentication authorization event, the at least one service event, and the event information corresponding to each event in the at least one access event Each includes the module number of the VNF operation call corresponding to the event, and the audit module is specifically used to:
  • each VNF event occurrence sequence determine a module sequence consisting of the module number of the VNF operation call included in the event information corresponding to each event in the event occurrence sequence; determine whether the module sequence conforms to the preset module sequence; if the module sequence If the preset module sequence is not met, the VNF is obtained as a malicious VNF audit result.
  • the at least one authentication authorization event, the at least one service event, and the event information corresponding to each event in the at least one access event contain the time when the VNF operation corresponding to the event occurs.
  • the audit module is specifically used to:
  • each VNF event occurrence sequence For each VNF event occurrence sequence, determining the execution duration of each event in the event occurrence sequence according to the occurrence time included in the event information corresponding to each event in the sequence of occurrence events; determining whether the execution duration of each event is uniform It is less than the preset duration; if there is an event whose execution duration is greater than or equal to the preset duration, then the VNF is obtained as the audit result of the malicious VNF.
  • the at least one authentication authorization event, the at least one service event, and the event information corresponding to each event of the at least one access event Both the operation type and user type of the VNF operation corresponding to the event are included, and the audit module is specifically used to:
  • VNF For each event sequence of the VNF, determining the user type included in the event information corresponding to each event in the event occurrence sequence and the operation type set corresponding to the user type; determining event information corresponding to each event in the event occurrence sequence Whether the type of the operation included in the operation type set corresponding to the user type included in the event information; when the operation type included in the event information corresponding to the at least one event is not in the operation type set corresponding to the user type included in the event information, VNF is the audit result of a malicious VNF.
  • the auditing The module is also used to: output a warning message.
  • the authentication authorization event, the service event, and the access event correspond to
  • the event information includes at least one of the following: a module number, a user identifier, a user type, an operation type, a VNF identifier, a time, an operation result, and an image file type that are invoked by the VNF operation.
  • an embodiment of the present invention provides a storage medium, where the storage medium has one or more programs, and one or more programs include instructions.
  • the instructions When the instructions are invoked by a processor in the host, the host is executed as described above.
  • the storage medium is used to store the instructions of the method embodiments of the first aspect, and has the same technical features and technical effects as the method of the first aspect, and the present invention will not be described again.
  • FIG. 1 is a schematic structural diagram of an auditing system according to an embodiment of the present invention
  • FIG. 2 is a schematic flowchart of a method for auditing a virtual network function according to an embodiment of the present invention
  • FIG. 3 is a schematic diagram of a process of acquiring an event occurrence sequence of each VNF in the method provided in FIG. 2;
  • FIG. 4 is a schematic structural diagram of an auditing apparatus for a virtual network function according to an embodiment of the present invention.
  • An embodiment of the present invention provides an auditing method and apparatus for a virtual network function, which is used to audit a VNF generated by a platform including an authentication and authorization component, a service component, and a virtual infrastructure, and generate each VNF according to an event reported by all components of the platform.
  • the sequence of events occurs, and the sequence of events of each VNF is audited according to a preset strategy, and the malicious VNF can be detected quickly and accurately.
  • the architecture of the auditing system provided by the embodiment of the present invention is described in detail below.
  • FIG. 1 is a schematic structural diagram of an auditing system according to an embodiment of the present invention.
  • the system includes an audit package. 1 and platform 2, the platform 2 includes an authentication authorization component 21, a service component 22, and a virtual infrastructure 23, wherein the authentication authorization component 21 is used to authenticate the user, generate a user token; the service component 22 is used to control the virtual infrastructure 23 to create a virtual
  • the VNF is implemented and the entire life cycle of the virtual machine and VNF is monitored; the virtual infrastructure 23 is used to create virtual machines and implement VNF.
  • the service component 22 detects whether the VNF operation request carries a token according to the VNF operation request, and if the token is not included, the user is required to authenticate to the authentication authority component 21 and obtain an order.
  • the service component 22 verifies whether the user has the right to create a virtual machine according to the token in the VNF operation request, and when the user has the authority to create the virtual machine, the service component 22 controls The virtual infrastructure 23 creates a virtual machine and implements the VNF functionality specified in the VNF operational request.
  • the platform 2 may be an OpenStack cloud platform
  • the authentication authorization component 21 may be a keystone component or a moon component
  • the service component 22 includes a nova component, a glance component, and the like
  • the virtual infrastructure 203 may be a kvm component.
  • the authentication and authorization component 21, the service component 22, and the virtual infrastructure 23 report the event triggered by the VNF operation to the auditing device 1, and the auditing apparatus 1 can further store all the reported events in the database.
  • VNF operations can create, delete, start, stop, pause, resume, etc. for VNF.
  • the event information corresponding to each reported event includes at least one of the following information: a module number, a user identifier, a user type, an operation type, a VNF identifier, an image file type, an occurrence time, an operation result, and the like, which are invoked by the VNF operation.
  • a malicious user sends a VNF operation request or a malicious VNF operation to the service component 22
  • the platform vulnerability is usually utilized to bypass (ie, not pass through) a component in the platform 2 to complete the virtual machine establishment and implement the VNF operation, such as bypassing the authentication.
  • Authorize component 21, or bypass virtual infrastructure 23 At this time, the authentication authority component 21 or the virtual infrastructure 23 will not report the event.
  • the auditing apparatus 1 of the present application can discover a VNF event that bypasses a component by summarizing all events, thereby discovering a malicious VNF.
  • VNF auditing method provided by the embodiment of the present invention is described in detail below by using specific embodiments.
  • FIG. 2 is a schematic flowchart of a method for auditing a virtual network function according to an embodiment of the present invention. The method is applied to an auditing device as shown in FIG. 1, which can be implemented by software or hardware. As shown in Figure 2, the method includes:
  • Step 201 Receive at least one authentication authorization event triggered by the first VNF operation reported by the authentication authorization component, at least one service event triggered by the second VNF operation reported by the receiving service component, and trigger a third VNF operation triggered by the virtual infrastructure. At least one access event.
  • the first VNF operation, the second VNF operation, and the third VNF operation may each include one or more VNF operations.
  • Step 202 Acquire an event occurrence sequence of each VNF according to at least one authentication authorization event, at least one service event, and at least one access event, and an event occurrence sequence is used to indicate an occurrence sequence of multiple events corresponding to one VNF.
  • Step 203 Perform an audit on the sequence of occurrence of each VNF, and obtain an audit result of the VNF.
  • the auditing device receives the events reported by the authentication and authorization component, the service component, and the virtual infrastructure, and stores event information corresponding to each event.
  • the user-initiated VNF operation may be one or more, so each component may report one or more events. When all components have not reported an event, there is no VNF operation.
  • an event triggered by a VNF operation in an authentication authorization component is recorded as an authentication authorization event triggered by a first VNF operation
  • an event triggered by a VNF operation in a service component is recorded as a second VNF operation.
  • the triggered service event records the event triggered by the VNF operation in the virtual infrastructure as an access event triggered by the third VNF operation, where the first VNF operation, the second VNF operation, and the third VNF operation may be different for the same VNF operation. Different names for operations in the component can also be used for different VNF operations.
  • the event information corresponding to the event reported by the authentication authorization component, the service component, or the virtual infrastructure to the auditing device includes at least one of the following: a module number of the VNF operation call, a user identifier, a user type, an operation type, and a VNF. ID, time of occurrence, result of operation, type of image file.
  • Different user types correspond to different user rights, and the types of operations that can be performed are different, corresponding to different sets of operation types.
  • the user identifier is used to identify the user who initiates the VNF operation; the user type is used to indicate the level or authority of the user who initiated the VNF operation, and the type of operation that the user initiating the VNF operation can perform is determined according to the user type; the operation type is used to indicate the user.
  • the type of VNF operation initiated; the VNF identifier is used to indicate the VNF involved in the VNF operation; the time of occurrence is used to indicate the moment when the VNF operation occurs; the result of the operation is used to indicate whether the VNF operation is successful; the image file type is used to indicate the use of the VNF when the VNF is created.
  • the type of image file, the image file can be classified according to network functions.
  • the event information corresponding to the event reported by the authentication and authorization component can be as follows:
  • ⁇ Module ID 1; User ID: admin1; User Type: admin; Operation Type: Create; VNF ID: vRouter; Time: 2015-12-20 15:10:27;
  • the event information indicates that the user admin1 whose user type is admin created a virtual router at 15:10:27 on December 20, 2015.
  • step 202 according to all the events received in step 201, an event occurrence sequence of each VNF is acquired, and an event occurrence sequence is used to indicate the sequence of occurrence of multiple events corresponding to one VNF, specifically in the event of acquisition During the sequence, all events corresponding to the same VNF received by the auditing device may be sorted according to the chronological order of occurrence of each event.
  • the event sequence sorts the events corresponding to the same VNF in each component in chronological order, which is convenient for the technician to view the events triggered by the same VNF operation request in each component.
  • the VNF operation is a malicious event, for example, When a component is deliberately bypassed, the technician can directly discover it.
  • all the reported events are sorted according to the user identifier or the VNF identifier of the VNF operation, and one or more event occurrence sequences are obtained, which further facilitates the technology.
  • Personnel conduct audits.
  • step 203 the event occurrence sequence of each VNF obtained in step 202 is audited, and an audit result is obtained.
  • the specific auditing strategy may be: performing auditing on event information corresponding to each event in the sequence of events corresponding to each VNF according to a preset rule. When there is information in a VNF event that does not meet the preset rule, the audit result is The VNF is a malicious VNF.
  • the preset rule may be set according to at least one of the following information: user identifier, user type, operation type, VNF identifier, image file type, module number of the VNF operation call, and occurrence time.
  • the preset rule may be: determining the user identifier in the event information corresponding to each event in the event occurrence sequence or the user type is not in the blacklist. That is, when an operation user who has been included in the blacklist performs a VNF operation, the VNF operation can be directly considered to be inconsistent with the preset rule, and a warning message is output.
  • the operation type indicates the action of operating the VNF, which may be creation, deletion, start, stop, pause, resume, and the like.
  • Different operating users or different roles can send VNF operation requests to business components differently, when the user role is administrator
  • the VNF operation request may include creation, deletion, start, stop, pause, resume, etc.
  • the VNF operation request may be only start, stop, pause, and resume.
  • the VNF identifier can represent a VNF set with certain attributes. Similarly, the user type is different, and the operational VNF objects are different.
  • the module number called by the VNF operation indicates the number of the module that must pass through the execution of the VNF operation.
  • the preset rule may be set in the order of the modules that must pass through the execution of the VNF operation, that is, in an event occurrence sequence. The number of the module corresponding to each event.
  • the execution time of each event in the sequence of events can be determined according to the time of occurrence, and the preset rule can be set according to the longest duration that each event can last.
  • the technician may perform auditing according to the foregoing preset rules, or may perform automatic auditing according to one or more preset rules according to a preset, and the audit result includes a malicious VNF or a malicious VNF.
  • the audit process may be performed in real time after the auditing device receives the reported event, or performed at intervals of a preset time period.
  • the auditing method provided by the embodiment of the present invention further includes:
  • warning messages including multiple malicious VNFs may be output, or warning messages may be separately sent for each malicious VNF.
  • the warning information may specifically include the event information corresponding to the event that does not meet the preset rule, and may also include a preset rule that is determined to be incompatible by the malicious VNF, so that the technician can quickly find the malicious VNF and solve the problem.
  • the specific warning information output mode may be a pop-up warning information window, may be highlighted for an event corresponding to the malicious VNF, or may be an alarm sound.
  • the auditing device receives the event reported by the authentication and authorization component, the service component, and the virtual infrastructure, and acquires an event sequence that can indicate the sequence of occurrence of each VNF event according to all the received events. Finally, the sequence of events of each VNF is audited to obtain audit results.
  • FIG. 3 is a schematic diagram of a process of acquiring an event occurrence sequence of each VNF in the method provided in FIG. 2, as shown in FIG. 3, the process includes:
  • Step 301 Perform at least one authentication authorization event, at least one service event, and at least one access event according to the user identifier in the event information corresponding to each event in the at least one authentication authorization event, the at least one service event, and the at least one access event user identifier. Classification, get all the events corresponding to each user ID;
  • Step 302 Analyze all events corresponding to the same user identifier according to the VNF identifier included in the event information corresponding to each event in the event corresponding to each user identifier, and obtain all events corresponding to each VNF identifier.
  • Step 303 Sort all events corresponding to each VNF identifier according to the occurrence time of the event information corresponding to each event in the event corresponding to each VNF identifier, to obtain an event occurrence of the VNF corresponding to each VNF identifier. sequence.
  • all the events received by the auditing device are classified into different classes according to different user identifiers, and the same type of event corresponds to the same operating user; For all the events of the same user, the analysis is performed according to the VNF identifier, and all events corresponding to each VNF identifier are obtained. All events corresponding to each VNF identifier have the same operation user and phase. The same operation object; finally, for the events with the same operation user and the same operation object, sorted by time, you can get the sequence of events of each VNF, each event sequence represents an operation user A VNF, what is done in chronological order.
  • the audit device receives three authentication authorization events reported by the authentication and authorization component, four service events reported by the service component, and four access events reported by the virtual infrastructure.
  • the event information corresponding to each of the three authentication and authorization events A1, A2, and A4 can be simply recorded as:
  • the event information corresponding to each of the four business events B1, B2, B3, and B4 can be simply recorded as:
  • the event information corresponding to each of the four access events C1, C2, C3, and C4 can be simply recorded as:
  • the auditing device first finds three categories according to the user identifiers in the event information corresponding to each of the events A1, A2, A4, B1, B2, B3, B4, C1, C2, C3, and C4 (11 in total): User1, user2, and user3 divide 11 events into 3 categories:
  • the first category all the events of the user user1, a total of six, A1, A4, B1, B4, C1, C4;
  • the second category all the events of the user user2, a total of three, A2, B2, C2;
  • the third category all events that operate user user3, a total of two, B3, C3.
  • the auditing device then analyzes events with the same VNF identifier for each event of each class according to the VNF identifier in the event information corresponding to each event.
  • events A1, B1, and C1 corresponding to the same VNF identifier are obtained, that is, A1, B1, and C1 are events that are reported by the operation user user1 to operate on file1, and event A4 corresponding to another VNF identifier.
  • B4 and C4; that is, A4, B4, and C4 are events that are caused by the operation user user1 operating on file4;
  • events A2, B2, and C2 corresponding to the same VNF identifier are obtained, that is, A2, B2, and C2 are events that are caused by the operation user user2 operating on file2 and causing the report to be reported;
  • events B3 and C3 corresponding to the same VNF identifier can be obtained, that is, both B3 and C3 are events in which the operation user user3 operates on file3 to cause reporting.
  • the audit process for different preset rules includes the following feasible implementations:
  • the at least one authentication authorization event, the at least one service event, and the event information corresponding to each event of the at least one access event respectively include a module number of the VNF operation call corresponding to the event, and the VNF audit process specifically includes:
  • the VNF is obtained as a legal VNF audit result; if the module sequence does not conform to the preset module sequence, the VNF is obtained as a malicious VNF audit result.
  • the preset module sequence may be determined according to a module sequence consisting of a module number of a VNF operation call included in the event information corresponding to each event in the event occurrence sequence triggered by the user in the goodwill user creation, and the preset module is determined.
  • the sequence defines a module that the VNF operation needs to be called in chronological order.
  • the VNF corresponding to the sequence of the event may be determined to be malicious. VNF, so a warning message is output.
  • Event information can be simply recorded as:
  • the event occurrence sequences A1, B1, and C1 can be obtained according to the embodiment shown in FIG.
  • the module sequence corresponding to the event occurrence sequence ⁇ 1, 2, 3, 4 ⁇ can be formed.
  • the module sequence is then compared with a preset module sequence to determine if the two match.
  • the VNF corresponding to the event occurrence sequence can be obtained as an audit result of the legal VNF; when the preset module sequence is ⁇ 1, 2, 3, 4, 5 ⁇ , it can be found that the sequence of the module corresponding to the current event sequence does not match the preset module sequence, and the VNF corresponding to the sequence of the event is obtained as the audit result of the malicious VNF, and an alarm message is issued.
  • the at least one authentication authorization event, the at least one service event, and the event information corresponding to each event of the at least one access event include the time when the VNF operation corresponding to the event occurs.
  • the VNF audit process specifically includes:
  • the VNF is obtained as the audit result of the malicious VNF; if the execution duration of each event is less than the preset duration, the VNF is obtained as the audit result of the legal VNF.
  • the execution time of each event in the event sequence of the goodwill VNF may be determined according to the occurrence time of the event information corresponding to each event in the event occurrence sequence triggered by the goodwill user to create the VNF, according to the execution duration.
  • Setting a preset duration which defines a maximum interval time of each event in the sequence of event occurrences corresponding to the VNF created by the bona fide user, and at least one execution time in the execution duration of all events indicated by the sequence of discovery events
  • the duration exceeds the preset duration, the VNF corresponding to the sequence of the event is obtained as the audit result of the malicious VNF, so the warning message is output.
  • the preset duration is set in consideration of the normal authentication and authorization process being 10 minutes.
  • the 1 hour in the sequence of the event obviously exceeds the preset duration, and the VNF corresponding to the sequence of the event is obtained as the audit result of the malicious VNF.
  • the execution duration of the event C1 may be further determined according to a subsequent operation performed by the user user1 for file1, or may not be set for the event C1. Further, different preset durations can be set for events reported by different components.
  • the at least one authentication authorization event, the at least one service event, and the event information corresponding to each event of the at least one access event include an operation type and a user type of the VNF operation corresponding to the event, and the VNF audit process specifically includes:
  • the VNF is obtained as the audit result of the malicious VNF; if the event information corresponding to each event includes the operation.
  • the VNF is obtained as the audit result of the legal VNF.
  • different user types correspond to different user rights, and the types of operations that can be performed are different, corresponding to different sets of operation types.
  • the operation type range corresponding to the sequence of the event occurrence may be determined, and the audit process specifically detects the sequence of the event occurrence. Whether the operation type of each event is within the operation type set of the event occurrence sequence, when the collection range is exceeded, the VNF corresponding to the current event occurrence sequence is obtained as the audit result of the malicious VNF, so the warning message is output.
  • the operation type set ⁇ delete, pause ⁇ corresponding to the current operation user can be determined, that is, the current operation user user1 can only perform deletion and
  • the operation operation in the event information corresponding to each event in the event occurrence sequence is not in the operation type set corresponding to the user type of the event occurrence sequence, and the current operation user user1 has exceeded the permission.
  • the operation can obtain the audit result of the VNF corresponding to the current event sequence as a malicious VNF.
  • the feasible implementation manner can be used for the VNF audit.
  • FIG. 4 is a schematic structural diagram of an auditing apparatus for a virtual network function according to an embodiment of the present invention. As shown in Figure 4, the device comprises:
  • the receiving module 401 is configured to receive at least one authentication authorization event triggered by the first VNF operation reported by the authentication authorization component, at least one service event triggered by the second VNF operation reported by the receiving service component, and the third reported by the receiving virtual infrastructure. At least one access event triggered by the VNF operation;
  • the sorting module 402 is configured to acquire an event occurrence sequence of each VNF according to the at least one authentication authorization event, the at least one service event, and the at least one access event, where an event occurrence sequence is used to indicate an occurrence sequence of the multiple events corresponding to one VNF;
  • the auditing module 403 is configured to audit the sequence of event occurrences of each VNF to obtain an audit result of the VNF.
  • the sorting module 402 is specifically configured to:
  • At least one authentication authorization event, at least one service event, and at least one access event classifying at least one authentication authorization event, at least one service event, and at least one access event according to at least one authentication authorization event, at least one business event, and a user identifier in event information corresponding to each event of the at least one access event, obtaining each All events corresponding to the user ID;
  • All events corresponding to the same user identifier are analyzed according to the VNF identifier included in the event information corresponding to each event in the event corresponding to each user identifier, and all events corresponding to each VNF identifier are obtained.
  • the events corresponding to each VNF identifier are sorted according to the occurrence time of the event information corresponding to each event in the event corresponding to each VNF identifier, to obtain an event occurrence sequence of the VNF corresponding to each VNF identifier.
  • the at least one authentication authorization event, the at least one service event, and the event information corresponding to each event of the at least one access event respectively include a module number of the VNF operation call corresponding to the event
  • the auditing module 403 is specifically configured to:
  • each VNF event occurrence sequence determine a module sequence consisting of the module number of the VNF operation call included in the event information corresponding to each event in the event occurrence sequence; determine whether the module sequence conforms to the preset module sequence; if the module sequence If the preset module sequence is not met, the VNF is obtained as a malicious VNF audit result.
  • the at least one authentication authorization event, the at least one service event, and the event information corresponding to each event of the at least one access event all include an occurrence time of the VNF operation corresponding to the event, and the auditing module 403 is specifically configured to:
  • each VNF event occurrence sequence For each VNF event occurrence sequence, determining the execution duration of each event in the event occurrence sequence according to the occurrence time included in the event information corresponding to each event in the sequence of occurrence events; determining whether the execution duration of each event is uniform It is less than the preset duration; if there is an event whose execution duration is greater than or equal to the preset duration, then the VNF is obtained as the audit result of the malicious VNF.
  • the at least one authentication authorization event, the at least one service event, and the event information corresponding to each event of the at least one access event include an operation type and a user type of the VNF operation corresponding to the event, and the auditing module 403 is specifically configured to:
  • VNF For each event sequence of the VNF, determining the user type included in the event information corresponding to each event in the event occurrence sequence and the operation type set corresponding to the user type; determining event information corresponding to each event in the event occurrence sequence Whether the type of the operation included in the operation type set corresponding to the user type included in the event information; when the operation type included in the event information corresponding to the at least one event is not in the operation type set corresponding to the user type included in the event information, VNF is the audit result of a malicious VNF.
  • the auditing module 403 is further configured to: output a warning message.
  • Yet another aspect of an embodiment of the present invention provides an auditing apparatus for a virtual network function for auditing a virtual network function VNF generated by a platform including an authentication and authorization component, a service component, and a virtual infrastructure, and the apparatus may execute any of the above embodiments.
  • the implementation method and technical effect of the VNF audit method are similar, and will not be described here.
  • the device includes:
  • the receiver is configured to receive at least one authentication authorization event triggered by the first VNF operation reported by the authentication authorization component, receive at least one service event triggered by the second VNF operation reported by the service component, and receive the third VNF reported by the virtual infrastructure. At least one access event triggered by the operation;
  • a processor configured to acquire an event occurrence sequence of each VNF according to at least one authentication authorization event, at least one service event, and at least one access event received by the receiver, where an event occurrence sequence is used to indicate multiple events corresponding to one VNF The order of occurrence; auditing the sequence of events for each VNF and obtaining the audit results of the VNF.
  • the device further includes a memory for storing all events received by the receiver, and the processor performs a subsequent audit process according to all events stored in the memory.
  • the processor is specifically configured to:
  • At least one authentication authorization event, at least one service event, and at least one access event classifying at least one authentication authorization event, at least one service event, and at least one access event according to at least one authentication authorization event, at least one business event, and a user identifier in event information corresponding to each event of the at least one access event, obtaining each All events corresponding to the user ID;
  • All events corresponding to the same user identifier are analyzed according to the VNF identifier included in the event information corresponding to each event in the event corresponding to each user identifier, and all events corresponding to each VNF identifier are obtained.
  • All events corresponding to each VNF identifier are sorted according to the occurrence time of the event information corresponding to each event in the event corresponding to each VNF identifier, to obtain an event occurrence sequence of the VNF corresponding to each VNF identifier;
  • the sequence of events of each VNF is audited to obtain the audit results of the VNF.
  • the at least one authentication authorization event, the at least one service event, and the event information corresponding to each event of the at least one access event respectively include a module number of the VNF operation call corresponding to the event, where the processor is specifically configured to:
  • each VNF event occurrence sequence determine a module sequence consisting of the module number of the VNF operation call included in the event information corresponding to each event in the event occurrence sequence; determine whether the module sequence conforms to the preset module sequence; if the module sequence If the preset module sequence is not met, the VNF is obtained as a malicious VNF audit result.
  • the at least one authentication authorization event, the at least one service event, and the event information corresponding to each event of the at least one access event all include an occurrence time of the VNF operation corresponding to the event, and the processor is specifically configured to:
  • each VNF event occurrence sequence For each VNF event occurrence sequence, determining the execution duration of each event in the event occurrence sequence according to the occurrence time included in the event information corresponding to each event in the sequence of occurrence events; determining whether the execution duration of each event is uniform It is less than the preset duration; if there is an event whose execution duration is greater than or equal to the preset duration, then the VNF is obtained as the audit result of the malicious VNF.
  • the at least one authentication authorization event, the at least one service event, and the event information corresponding to each event of the at least one access event include an operation type and a user type of the VNF operation corresponding to the event, and the processor is specifically configured to:
  • VNF For each event sequence of the VNF, determining the user type included in the event information corresponding to each event in the event occurrence sequence and the operation type set corresponding to the user type; determining event information corresponding to each event in the event occurrence sequence Whether the type of the operation included in the operation type set corresponding to the user type included in the event information; when the operation type included in the event information corresponding to the at least one event is not in the operation type set corresponding to the user type included in the event information, VNF is the audit result of a malicious VNF.
  • the device further includes a transmitter, configured to output a warning message when the audit result is that the VNF is a malicious VNF.
  • a further aspect of the embodiments of the present invention provides a storage medium storing one or more programs, where one or more programs include instructions, and when the instructions are invoked by a processor in the host, the host may be controlled to perform any of the above The method of auditing the VNF in the method embodiment.
  • the foregoing storage medium includes: a U disk, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk, and the like, which can store program codes. medium.
  • the disclosed systems, devices, and methods may be implemented in other manners.
  • the device embodiments described above are merely illustrative.
  • the division of the unit is only a logical function division.
  • there may be another division manner for example, multiple units or components may be combined or Can be integrated into another system, or some features can be ignored or not executed.
  • the mutual coupling or direct coupling or communication connection shown or discussed may be an indirect coupling or communication connection through some interface, device or unit, and may be in an electrical, mechanical or other form.
  • the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, may be located in one place, or may be distributed to multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of the embodiment.
  • each functional unit in each embodiment of the present invention may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Hardware Design (AREA)
  • General Engineering & Computer Science (AREA)
  • Software Systems (AREA)
  • Theoretical Computer Science (AREA)
  • Computing Systems (AREA)
  • Physics & Mathematics (AREA)
  • General Physics & Mathematics (AREA)
  • Accounting & Taxation (AREA)
  • Business, Economics & Management (AREA)
  • Management, Administration, Business Operations System, And Electronic Commerce (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)

Abstract

本发明实施例提供一种虚拟网络功能的审计方法和装置，用于审计由包括认证授权组件、业务组件和虚拟基础设施的平台生成的虚拟网络功能，该方法包括：接收认证授权组件上报的事件、接收业务组件上报的事件、接收虚拟基础设施上报的事件；根据接收到的所有事件，获取每个VNF的事件发生序列；对每个VNF的事件发生序列进行审计，得到VNF的审计结果。该方法通过将分散在不同组件的事件，整合在一个事件发生序列中，可直观快速的检测出绕过某个组件而实现的恶意VNF，可以更全面的检测出恶意VNF，降低VNF操作审计的漏检率。

Description

虚拟网络功能的审计方法和装置 技术领域
本发明涉及虚拟网络领域，尤其涉及一种虚拟网络功能(virtual network function，简称VNF)的审计方法和装置。
背景技术
传统的网络设备例如路由器、交换机、防火墙等一般都是基于该设备包含的硬件所具有的功能，而具有固定网络功能，例如对各种协议的支持、负载均衡、速率控制等，该类网络设备难以升级和扩容。现有技术通常采用网络功能虚拟化来解决上述问题，网络功能虚拟化技术通过在任意网络设备中创建虚拟机来实现VNF，VNF可以灵活的根据需求来创建，不存在升级和扩容的问题。
但是与传统的网络设备相比，VNF的这种灵活性导致网络安全管理的复杂度增大。在实现VNF时，通常在已有的平台(如OpenStack云平台)中建立虚拟机，然后通过虚拟机建立VNF。示例性的，现有的OpenStack云平台包括认证授权组件、业务组件和虚拟基础设施，在建立VNF时，合法用户需向认证授权组件申请令牌，通过虚拟基础设施控制业务组件验证令牌权限并完成VNF的建立。
其中平台的业务组件可能存在漏洞，恶意用户能够利用业务组件的漏洞创建恶意VNF，恶意VNF攻击其他合法的VNF或者宿主机，以获取到通信双方的数据，从而造成用户数据泄露。现有技术中，通常由技术人员对各组件在建立VNF过程中生成的事件记录日志逐个进行分析，以发现恶意VNF。该方法不仅对技术人员的技术水平要求较高，而且效率低下；同时，当恶意VNF的建立过程绕过平台的任一组件时，该组件不会产生任何日志，技术人员一次只检查一个组件的事件记录日志更难以发现恶意VNF，导致现有恶意VNF的审计方法检测不够全面、漏检率高。
发明内容
本发明实施例提供一种虚拟网络功能的审计方法和装置，以解决现有VNF的审计方法检测不够全面、漏检率高的问题。
第一方面，本发明实施例提供一种虚拟网络功能的审计方法，用于审计由包括认证授权组件、业务组件和虚拟基础设施的平台生成的虚拟网络功能VNF，该方法包括：
接收认证授权组件上报的第一VNF操作所触发的至少一个认证授权事件、接收业务组件上报的第二VNF操作所触发的至少一个业务事件、接收虚拟基础设施上报的第三VNF操作触发的至少一个访问事件；根据至少一个认证授权事件、至少一个业务事件、至少一个访问事件，获取每个VNF的事件发生序列，一个事件发生序列用于指示对应一个VNF的多个事件的发生顺序；对每个VNF的事件发生序列进行审计，得到VNF的审计结果。
上述方法通过接收认证授权组件、业务组件和虚拟基础设施上报的事件，并将根据接收到的所有事件获取能够指示每个VNF的事件的发生顺序的事件发生序列，最后对每个VNF的事件发生序列进行审计，以得到审计结果。通过将分散在不同组件的对应于一个VNF的事件，整合在一个事件发生序列中，可直观快速的检测出绕过某个组件而实现的恶意VNF，可以更全面的检测出恶意VNF，降低VNF操作审计的漏检率。
结合第一方面，在第一方面的第一种可能的实现方式中，获取事件发生序列的过程具体包括：
根据至少一个认证授权事件、至少一个业务事件、至少一个访问事件中每个事件对应的事件信息中的用户标识，对至少一个认证授权事件、至少一个业务事件、至少一个访问事件分类，得到每个用户标识所对应的所有事件；根据每个用户标识所对应的所有事件中每个事件对应的事件信息所包含的VNF标识，对同一用户标识所对应的所有事件进行分析，得到每个VNF标识对应的所有事件；根据同一VNF标识对应的所有事件中每个事件对应的事件信息所包含的发生时间，对同一VNF标识对应的所有事件进行排序，以获取每个VNF标识对应的VNF的事件发生序列。
上述方法中通过根据事件的用户标识、VNF标识、发生时间的不同，将所有的事件进行整理，得到相互间关系更明显的事件发生序列，可提高审计速度。
结合第一方面的第一种可能的实现方式，在第一方面的第二种可能的实现方式中，至少一个认证授权事件、至少一个业务事件、至少一个访问事件中每个事件对应的事件信息均包含事件对应的VNF操作调用的模块编号，审计过程具体包括：
对于每个VNF的事件发生序列，确定事件发生序列中的每个事件对应的事件信息所包含的VNF操作调用的模块编号所组成的模块序列；判断模块序列是否符合预设模块序列；如果模块序列不符合预设模块序列，则得到VNF为恶意VNF的审计结果。
结合第一方面的第一种可能的实现方式，在第一方面的第三种可能的实现方式中，至少一个认证授权事件、至少一个业务事件、至少一个访问事件中每个事件对应的事件信息均包含事件对应的VNF操作的发生时间，审计过程具体包括：
对于每个VNF的事件发生序列，根据事件发生序列中的每个事件对应的事件信息所包含的发生时间，确定事件发生序列中的每个事件的执行时长；判断每个事件的执行时长是否均小于预设时长；如果存在执行时长大于或等于预设时长的事件时，则得到VNF为恶意VNF的审计结果。
结合第一方面的第一种可能的实现方式，在第一方面的第四种可能的实现方式中，至少一个认证授权事件、至少一个业务事件、至少一个访问事件中每个事件对应的事件信息均包含事件对应的VNF操作的操作类型和用户类型，审计过程具体包括：
对于每个VNF的事件发生序列，确定事件发生序列中的每个事件对应的事件信息所包含的用户类型以及用户类型对应的操作类型集合；判断事件发生序列中的每个事件对应的事件信息所包含的操作类型是否在事件信息所包含的用户类型对应的操作类型集合内；当至少一个事件对应的事件信息所包含的操作类型不在事件信息所包含的用户类型对应的操作类型集合内时，得到VNF为恶意VNF的审计结果。
结合第一方面、第一方面的第一种至第四种中任一种可行的实现方式，在第一方面的第五种可能的实现方式中，若审计结果为VNF为恶意VNF时，该方法还包括：输出警告 信息。
结合第一方面、第一方面的第一种至第五种中任一种可行的实现方式，在第一方面的第六种可能的实现方式中，认证授权事件、业务事件和访问事件对应的事件信息中均包括如下中的至少一种：VNF操作调用的模块编号、用户标识、用户类型、操作类型、VNF标识、发生时间、操作结果、镜像文件类型。
下面介绍本发明实施例提供的一种虚拟网络功能的审计装置，该装置与方法一一对应，用以实现上述实施例中的VNF的审计方法，具有相同的技术特征和技术效果，本发明实施例对此不再赘述。
第二方面，本发明实施例提供一种虚拟网络功能的审计装置，用于审计由包括认证授权组件、业务组件和虚拟基础设施的平台生成的虚拟网络功能VNF，该装置包括：
接收模块，用于接收认证授权组件上报的第一VNF操作所触发的至少一个认证授权事件、接收业务组件上报的第二VNF操作所触发的至少一个业务事件、接收虚拟基础设施上报的第三VNF操作触发的至少一个访问事件；
排序模块，用于根据至少一个认证授权事件、至少一个业务事件、至少一个访问事件，获取每个VNF的事件发生序列，一个事件发生序列用于指示对应一个VNF的多个事件的发生顺序；
审计模块，用于对每个VNF的事件发生序列进行审计，得到VNF的审计结果。
结合第二方面，在第二方面的第一种可能的实现方式中，排序模块具体用于：
根据至少一个认证授权事件、至少一个业务事件、至少一个访问事件中每个事件对应的事件信息中的用户标识，对至少一个认证授权事件、至少一个业务事件、至少一个访问事件分类，得到每个用户标识所对应的所有事件；
根据每个用户标识所对应的所有事件中每个事件对应的事件信息所包含的VNF标识，分析同一用户标识所对应的所有事件，得到每个VNF标识对应的所有事件；
根据每个VNF标识对应的所有事件中每个事件对应的事件信息所包含的发生时间，对每个VNF标识对应的所有事件进行排序，以获取每个VNF标识对应的VNF的事件发生序列。
结合第二方面的第一种可能的实现方式，在第二方面的第二种可能的实现方式中，至少一个认证授权事件、至少一个业务事件、至少一个访问事件中每个事件对应的事件信息均包含事件对应的VNF操作调用的模块编号，审计模块具体用于：
对于每个VNF的事件发生序列，确定事件发生序列中的每个事件对应的事件信息所包含的VNF操作调用的模块编号所组成的模块序列；判断模块序列是否符合预设模块序列；如果模块序列不符合预设模块序列，则得到VNF为恶意VNF的审计结果。
结合第一方面的第一种可能的实现方式，在第一方面的第三种可能的实现方式中，至少一个认证授权事件、至少一个业务事件、至少一个访问事件中每个事件对应的事件信息均包含事件对应的VNF操作的发生时间，审计模块具体用于：
对于每个VNF的事件发生序列，根据事件发生序列中的每个事件对应的事件信息所包含的发生时间，确定事件发生序列中的每个事件的执行时长；判断每个事件的执行时长是否均小于预设时长；如果存在执行时长大于或等于预设时长的事件时，则得到VNF为恶意VNF的审计结果。
结合第二方面的第一种可能的实现方式，在第二方面的第四种可能的实现方式中，至少一个认证授权事件、至少一个业务事件、至少一个访问事件中每个事件对应的事件信息均包含事件对应的VNF操作的操作类型和用户类型，审计模块具体用于：
对于每个VNF的事件发生序列，确定事件发生序列中的每个事件对应的事件信息所包含的用户类型以及用户类型对应的操作类型集合；判断事件发生序列中的每个事件对应的事件信息所包含的操作类型是否在事件信息所包含的用户类型对应的操作类型集合内；当至少一个事件对应的事件信息所包含的操作类型不在事件信息所包含的用户类型对应的操作类型集合内时，得到VNF为恶意VNF的审计结果。
结合第二方面、第二方面的第一种至第四种中任一种可行的实现方式，在第二方面的第五种可能的实现方式中，若审计结果为VNF为恶意VNF时，审计模块还用于：输出警告信息。
结合第二方面、第二方面的第一种至第五种中任一种可行的实现方式，在第二方面的第六种可能的实现方式中，认证授权事件、业务事件和访问事件对应的事件信息中均包括如下中的至少一种：VNF操作调用的模块编号、用户标识、用户类型、操作类型、VNF标识、时间、操作结果、镜像文件类型。
第三方面，本发明实施例提供一种存储介质，该存储介质为存储有一个或多个程序，一个或多个程序包括指令，当指令被主机中的处理器调用时，使主机执行如上述第一方面、第一方面的第一种至第六种中任一种可行的实现方式中的VNF的审计方法。
该存储介质用于存储能够执行上述第一方面的各方法实施方式的指令，与第一方面的方法具有相同的技术特征和技术效果，本发明对此不再赘述。
附图说明
为了更清楚地说明本发明实施例的技术方案，下面将对实施例描述中所需要使用的附图作简单地介绍。
图1为本发明实施例提供的审计系统的架构示意图；
图2为本发明实施例提供的一种虚拟网络功能的审计方法的流程示意图；
图3为图2提供的方法中获取每个VNF的事件发生序列的过程示意图；
图4为本发明实施例提供的一种虚拟网络功能的审计装置的结构示意图。
具体实施方式
为使本发明实施例的目的、技术方案和优点更加清楚，下面将结合本发明实施例中的附图，对本发明实施例中的技术方案进行描述。
本发明实施例提供一种虚拟网络功能的审计方法和装置，用于审计由包括认证授权组件、业务组件和虚拟基础设施的平台生成的VNF，根据平台的所有组件上报的事件，生成每个VNF的事件发生序列，并根据预设策略对每个VNF的事件发生序列进行审计，可快速准确的检测出恶意VNF。下面对本发明实施例提供的审计系统的架构进行详细说明。
图1为本发明实施例提供的审计系统的架构示意图。如图1所示，该系统包括审计装 置1和平台2，平台2包括认证授权组件21、业务组件22和虚拟基础设施23，其中认证授权组件21用于认证用户、生成用户令牌；业务组件22用于控制虚拟基础设施23创建虚拟机并实现VNF，并监测虚拟机和VNF的整个生命周期；虚拟基础设施23用于创建虚拟机并实现VNF。当用户向业务组件22发送VNF操作请求时，业务组件22根据VNF操作请求，检测该VNF操作请求中是否携带有令牌，若不含有令牌则要求用户向认证授权组件21进行认证并获取令牌，若该VNF操作请求中携带有令牌，则业务组件22根据VNF操作请求中的令牌验证该用户是否具有创建虚拟机的权限，当用户具有创建虚拟机的权限时，业务组件22控制虚拟基础设施23创建虚拟机并实现VNF操作请求中指定的VNF功能。
示例性的，平台2具体可以为OpenStack云平台，认证授权组件21可以为keystone组件或moon组件，业务组件22包括nova组件、glance组件等，虚拟基础设施203可以为kvm组件。当善意用户创建VNF时，认证授权组件21、业务组件22、虚拟基础设施23均会向审计装置1上报因执行VNF操作触发的事件，审计装置1还可进一步将上报的所有事件存储在数据库中。VNF操作可以为VNF创建、删除、启动、停止、暂停、恢复等。各上报事件对应的事件信息至少包括如下信息中的一个：VNF操作调用的模块编号、用户标识、用户类型、操作类型、VNF标识、镜像文件类型、发生时间、操作结果等。当恶意用户向业务组件22发送VNF操作请求或存在恶意VNF操作时，通常利用平台漏洞，绕过(即不经过)平台2中的某一组件完成虚拟机建立和实现VNF操作，例如绕过认证授权组件21，或绕过虚拟基础设施23。此时，认证授权组件21或虚拟基础设施23将不会上报事件。本申请的审计装置1可以通过汇总所有事件，来发现绕过某个组件的VNF事件，从而发现恶意VNF。
下面采用具体实施例对本发明实施例提供的VNF审计方法进行详细说明。
图2为本发明实施例提供的一种虚拟网络功能的审计方法的流程示意图。该方法应用于如图1所示的审计装置中，该审计装置可以通过软件或硬件实现。如图2所示，该方法包括：
步骤201、接收认证授权组件上报的第一VNF操作所触发的至少一个认证授权事件、接收业务组件上报的第二VNF操作所触发的至少一个业务事件、接收虚拟基础设施上报的第三VNF操作触发的至少一个访问事件。
其中，所述第一VNF操作，第二VNF操作，第三VNF操作均可以包括一个或多个VNF操作。
步骤202、根据至少一个认证授权事件、至少一个业务事件、至少一个访问事件，获取每个VNF的事件发生序列，一个事件发生序列用于指示对应一个VNF的多个事件的发生顺序。
步骤203、对每个VNF的事件发生序列进行审计，得到VNF的审计结果。
具体的，在步骤201中，审计装置接收认证授权组件、业务组件和虚拟基础设施上报的事件，并存储各事件对应的事件信息。用户发起的VNF操作可以为一个或多个，因此每个组件上报的事件可以为一个或多个。当所有组件均未上报事件，则说明没有VNF操作。示例性的，本发明实施例中将认证授权组件中因VNF操作触发的事件记为第一VNF操作所触发的认证授权事件，将业务组件中因VNF操作触发的事件记为第二VNF操作所 触发的业务事件，将虚拟基础设施中因VNF操作触发的事件记为第三VNF操作触发的访问事件，此处第一VNF操作、第二VNF操作和第三VNF操作可以为同一VNF操作在不同组件中操作时的不同名称，也可为不同的VNF操作。
示例性的，认证授权组件、业务组件或者虚拟基础设施向审计装置报告的事件对应的事件信息均包括如下中的至少一种：VNF操作调用的模块编号、用户标识、用户类型、操作类型、VNF标识、发生时间、操作结果、镜像文件类型。其中，不同的用户类型对应不同的用户权限，可执行的操作类型不同，对应不同的操作类型集合。其中，用户标识用于识别发起VNF操作的用户；用户类型用于指示发起VNF操作的用户的级别或权限，根据用户类型可确定发起VNF操作的用户能够执行的操作类型；操作类型用于指示用户发起的VNF操作的类型；VNF标识用于指示VNF操作涉及的VNF；发生时间用于指示VNF操作发生的时刻；操作结果用于指示VNF操作是否成功；镜像文件类型用于指示创建VNF时使用的镜像文件的类型，镜像文件可以按照网络功能进行分类。
下面以认证授权组件为例，对事件信息进行详细说明。认证授权组件上报的事件对应的事件信息可以如下所示：
{模块编号：1；用户标识：admin1；用户类型：admin；操作类型：创建；VNF标识：vRouter；时间：2015-12-20 15:10:27；}。
该事件信息表示用户类型为admin的用户admin1在2015年12月20日15点10分27时创建了一个虚拟路由器(Virtual Router)。
具体的，在步骤202中，根据步骤201中接收到的所有事件，获取每个VNF的事件发生序列，一个事件发生序列用于指示对应一个VNF的多个事件的发生顺序，具体在获取事件发生序列时，可根据各事件发生的时间先后顺序将审计装置接收到的对应同一个VNF的所有事件进行排序。事件发生序列将每一组件中发生的对应同一个VNF的事件按照时间先后进行排序，方便了技术人员查看同一个VNF操作请求在各组件所分别引发的事件，当该VNF操作为恶意事件，例如故意绕过某个组件时，技术人员可直接发现。可选的，还可进一步在按照时间先后将事件进行排序后，根据VNF操作的用户标识或VNF标识等参数，对所有上报的事件进行整理，得到一个或多个事件发生序列，进一步方便了技术人员进行审计。
具体的，在步骤203中，对步骤202中得到的每个VNF的事件发生序列进行审计，得到审计结果。具体的审计策略可以为，依据预设规则对每个VNF对应的事件发生序列中各事件对应的事件信息进行审计，当一个VNF的事件信息中存在不符合预设规则的信息时，审计结果为该VNF为恶意VNF。
示例性的，预设规则可依据如下信息中的至少一种进行设置：用户标识、用户类型、操作类型、VNF标识、镜像文件类型、VNF操作调用的模块编号、发生时间。
当依据用户标识或用户类型设置预设规则时，预设规则可以为：确定事件发生序列中各事件对应的事件信息中的用户标识或者该用户类型不在黑名单中。即当曾经被列入到黑名单中的操作用户执行VNF操作时，可直接认为该VNF操作不符合预设规则，则输出警告信息。
操作类型表示操作VNF的动作，可能是创建、删除、启动、停止、暂停、恢复等。不同操作用户或不同角色可向业务组件发送的VNF操作请求不同，当用户角色为管理员 时，其VNF操作请求可以包括创建、删除、启动、停止、暂停、恢复等，当用户角色为VNF拥有者时，其VNF操作请求可仅为启动、停止、暂停和恢复。
VNF标识可以表示具有某些属性的VNF集合，同样的，用户类型不同，其可操作的VNF对象也不同。VNF操作调用的模块编号表示执行VNF操作必须经过的模块的编号，在依据模块编号设置预设规则时，可按照执行VNF操作必须经过的模块的顺序设置预设规则，即一个事件发生序列中的各事件依次对应的模块的编号。根据发生时间可确定事件发生序列中的每个事件的执行时长，可根据各事件可持续的最长时长设置预设规则。
具体在审计时，可以为技术人员依照上述预设规则进行审计，也可以为依据预设的一个或多个预设规则进行自动审计，审计结果包括存在恶意VNF或不存在恶意VNF。该审计过程可以在审计装置接收上报事件后实时进行，或间隔预设时间段执行。
可选的，在步骤203之后，本发明实施例提供的审计方法还包括：
若审计结果为VNF为恶意VNF时，则输出警告信息。
当对每个VNF的事件发生序列进行审计，发现多个VNF为恶意VNF时，可以输出包括多个恶意VNF的警告信息，或分别针对每个恶意VNF分别发送警告信息。
警告信息可具体包括不符合预设规则的事件对应的事件信息，还可包括判断为恶意VNF所不符合的预设规则，以方便技术人员快速发现恶意VNF并解决。具体的警告信息输出方式可以为弹出警告信息窗、可以为将恶意VNF对应的事件高亮显示、也可为发出警报声。
本发明实施例提供的审计方法中，审计装置接收认证授权组件、业务组件和虚拟基础设施上报的事件，并根据接收到的所有事件获取能够指示每个VNF的事件的发生顺序的事件发生序列，最后对每个VNF的事件发生序列进行审计，以得到审计结果。通过将分散在不同组件的对应于一个VNF的事件，整合在一个事件发生序列中，可直观快速的检测出绕过某个组件而实现的恶意VNF，可以更全面的检测出恶意VNF，降低VNF操作审计的漏检率。
下面结合图3，采用具体的实施例，对步骤202中的获取每个VNF的事件发生序列的过程进行详细说明。图3为图2提供的方法中获取每个VNF的事件发生序列的过程示意图，如图3所示，该过程包括：
步骤301、根据至少一个认证授权事件、至少一个业务事件、至少一个访问事件用户标识中每个事件对应的事件信息中的用户标识，对至少一个认证授权事件、至少一个业务事件、至少一个访问事件分类，得到每个用户标识所对应的所有事件；
步骤302、根据每个用户标识所对应的所有事件中每个事件对应的事件信息所包含的VNF标识，分析同一用户标识所对应的所有事件，得到每个VNF标识对应的所有事件；
步骤303、根据每个VNF标识对应的所有事件中每个事件对应的事件信息所包含的发生时间，对每个VNF标识对应的所有事件进行排序，以获取每个VNF标识对应的VNF的事件发生序列。
在本实施例中，首先根据各上报事件各自对应的事件信息中包含的用户标识将审计装置接收到的所有事件按照用户标识的不同，划分为不同类，同一类事件对应同一个操作用户；然后，针对同一个操作用户的所有事件，再按照VNF标识的不同，进行分析，得到每个VNF标识对应的所有事件，每个VNF标识对应的所有事件具有相同的操作用户和相 同的操作对象；最后，对于具有相同的操作用户和相同的操作对象的事件，按照时间的先后进行排序，即可得到每个VNF的事件发生序列，每个事件发生序列代表了一个操作用户针对一个VNF，按照时间顺序进行了哪些操作。通过对所有上报的事件进行汇总和分类，可方便用户设定更具有针对性的VNF的预设策略，并方便后续根据预设策略进行审计，提高审计效率。
下面举一个具体实施例来说明上述事件发生序列的获取方式。
审计装置接收到认证授权组件上报的3个认证授权事件，业务组件上报的4个业务事件，虚拟基础设施上报的4个访问事件。
其中，3个认证授权事件A1、A2、A4各自对应的事件信息可分别简单记为：
A1{user1，file1，2015-12-20 15:10:27}；
A2{user2，file2，2015-12-20 16:10:27}；
A4{user1，file4，2015-12-20 20:10:27}。
四个业务事件B1、B2、B3、B4各自对应的事件信息可分别简单记为：
B1{user1，file1，2015-12-20 15:20:27}；
B2{user2，file2，2015-12-20 16:20:27}；
B3{user3，file3，2015-12-20 17:20:27}；
B4{user1，file4，2015-12-20 20:20:27}。
四个访问事件C1、C2、C3、C4各自对应的事件信息可分别简单记为：
C1{user1，file1，2015-12-20 15:30:27}；
C2{user2，file2，2015-12-20 16:30:27}；
C3{user3，file3，2015-12-20 17:30:27}；
C4{user1，file4，2015-12-20 20:30:27}。
审计装置首先按照所有事件A1、A2、A4、B1、B2、B3、B4、C1、C2、C3、C4(共11个)各自对应的事件信息中的用户标识的不同，可发现共有3类：user1、user2、user3，将11个事件划分为3类：
第一类：操作用户为user1的所有事件，共6个，A1、A4、B1、B4、C1、C4；
第二类：操作用户为user2的所有事件，共3个，A2、B2、C2；
第三类：操作用户为user3的所有事件，共2个，B3、C3。
然后审计装置将每一类的所有事件按照每个事件对应的事件信息中的VNF标识的不同，对具有相同VNF标识的事件进行分析。
在第一类中：可得到对应同一VNF标识的事件A1、B1和C1，即A1、B1和C1均为操作用户user1对file1进行操作而引发上报的事件，以及对应另一个VNF标识的事件A4、B4和C4；即A4、B4和C4均为操作用户user1对file4进行操作而引发上报的事件；
在第二类中：可得到对应同一VNF标识的事件A2、B2和C2，即A2、B2和C2均为操作用户user2对file2进行操作而引发上报的事件；
在第三类中：可得到对应同一VNF标识的事件B3和C3，即B3和C3均为操作用户user3对file3进行操作而引发上报的事件。
最后，对每组事件，即A1、B1和C1；A4、B4和C4；A2、B2和C2；B3和C3分别按照发生时间进行排序，得到4个事件发生序列，即A1、B1和C1；A4、B4和C4； A2、B2和C2；B3和C3。
在得到4个事件发生序列后，可直观的发现B3和C3所组成的事件发生序列中缺少认证授权组件所上报的事件，即表明user3对file3进行操作没有经过认证授权，可认为file3为恶意VNF。通过根据事件的操作用户、操作对象、发生时间的不同，将所有的事件进行整理，得到每个VNF的更明显更直观的事件发生序列，可提高审计速度。因此，通过获取事件发生序列可直观快速的检测出恶意VNF并降低漏检率。
下面在图3实施例的基础上，结合不同的预设规则，对事件发生序列的具体审计方式进行详细说明。
示例性的，针对不同预设规则的审计过程包括如下可行的实现方式：
可行的实现方式一：
至少一个认证授权事件、至少一个业务事件、至少一个访问事件中每个事件对应的事件信息均包含事件对应的VNF操作调用的模块编号，VNF的审计过程具体包括：
对于每个VNF的事件发生序列，确定事件发生序列中的每个事件对应的事件信息所包含的VNF操作调用的模块编号所组成的模块序列；
判断模块序列是否符合预设模块序列；
如果模块序列符合预设模块序列，则得到VNF为合法VNF的审计结果；如果模块序列不符合预设模块序列，则得到VNF为恶意VNF的审计结果。
具体的，可根据善意用户创建VNF时所触发的事件发生序列中的每个事件对应的事件信息所包含的VNF操作调用的模块编号所组成的模块序列，确定预设模块序列，该预设模块序列限定了善意的VNF操作需按时间顺序依次调用的模块，当发现事件发生序列中的模块调用情况与预设模块序列指示的模块调用情况不符时，可确定事件发生序列所对应的VNF为恶意VNF，故输出警告信息。
例如，当审计装置接收到认证授权组件上报的1个认证授权事件A1，业务组件上报的1个业务事件B1，虚拟基础设施上报的1个访问事件C1；其中，A1、B1、C1各自对应的事件信息可分别简单记为：
A1{user1，file1，1，2015-12-20 15:10:27}；
B1{user1，file1，2、3，2015-12-20 15:20:27}；
C1{user1，file1，4，2015-12-20 15:30:27}。
首先根据图3所示实施例即可得到事件发生序列A1、B1、C1。根据事件发生序列中的每个事件对应的事件信息所包含的VNF操作调用的模块编号1、2、3和4，即可组成该事件发生序列对应的模块序列{1、2、3、4}。然后将该模块序列与预设模块序列进行比较，判断二者是否相符。示例性的，当预设模块序列为{1、2、3、4}时，可得到该事件发生序列对应的VNF为合法VNF的审计结果；当预设模块序列为{1、2、3、4、5}时，可发现当前事件发生序列对应的模块序列与预设模块序列不符，可得到该事件发生序列对应的VNF为恶意VNF的审计结果，并发出警报信息。
可行的实现方式二：
至少一个认证授权事件、至少一个业务事件、至少一个访问事件中每个事件对应的事件信息均包含事件对应的VNF操作的发生时间，VNF的审计过程具体包括：
对于每个VNF的事件发生序列，根据事件发生序列中的每个事件对应的事件信息所 包含的发生时间，确定事件发生序列中的每个事件的执行时长；
判断每个事件的执行时长是否均小于预设时长；
如果存在执行时长大于或等于预设时长的事件时，则得到VNF为恶意VNF的审计结果；如果每个事件的执行时长均小于预设时长，则得到VNF为合法VNF的审计结果。
具体的，可根据善意用户创建VNF时所触发的事件发生序列中的各事件对应的事件信息所包含的发生时间，确定善意VNF的事件发生序列中每个事件的执行时长，根据该执行时长可设定预设时长，该预设时长限定了善意用户创建的VNF对应的事件发生序列中每个事件的最长间隔时间，当发现事件发生序列所指示的所有事件的执行时长中存在至少一个执行时长超过了预设时长时，可得到该事件发生序列对应的VNF为恶意VNF的审计结果，故输出警告信息。
示例性的，参考可行的实现方式一中的具体示例，当事件发生序列A1、B1、C1各自对应的事件信息为如下所示时：
A1{user1，file1，1，2015-12-20 15:10:27}；
B1{user1，file1，2、3，2015-12-20 16:10:27}；
C1{user1，file1，4，2015-12-20 16:30:27}。
根据事件A1和B1的发生时间，可知用户user1在认证授权组件中花费了1小时，然后才在业务组件中开始事件B1，考虑到通常认证授权过程10分钟即可结束，可将预设时长设置为10分钟，该事件发生序列中的1小时明显超出了预设时长，可得到该事件发生序列对应的VNF为恶意VNF的审计结果。
示例性的，事件C1的执行时长可进一步根据用户user1针对file1所做的后续操作确定，也可不为事件C1设定预设时长。进一步的，还可针对不同组件上报的事件设定不同的预设时长。
可行的实现方式三：
至少一个认证授权事件、至少一个业务事件、至少一个访问事件中每个事件对应的事件信息均包含事件对应的VNF操作的操作类型和用户类型，VNF的审计过程具体包括：
对于每个VNF的事件发生序列，确定事件发生序列中的每个事件对应的事件信息所包含的用户类型以及用户类型对应的操作类型集合；
判断事件发生序列中的每个事件对应的事件信息所包含的操作类型是否在事件信息所包含的用户类型对应的操作类型集合内；
当至少一个事件对应的事件信息所包含的操作类型不在事件信息所包含的用户类型对应的操作类型集合内时，得到VNF为恶意VNF的审计结果；如果每个事件对应的事件息所包含的操作类型均在事件信息所包含的用户类型对应的操作类型集合内时，得到VNF为合法VNF的审计结果。
具体的，不同的用户类型对应不同的用户权限，可执行的操作类型不同，对应不同的操作类型集合。根据事件发生序列中每个事件对应的事件信息包含的用户类型，以及该用户类型对应的操作类型集合，可确定该事件发生序列对应的操作类型范围，审计过程具体为检测出事件发生序列中的每个事件的操作类型是否在该事件发生序列的操作类型集合内，当超出集合范围时，得到当前事件发生序列对应的VNF为恶意VNF的审计结果，故输出警告信息。
示例性的，仍参考可行的实现方式一中的具体示例，当事件发生序列A1、B1、C1各自对应的事件信息为如下所示时：
A1{user1，file1，creat，1，2015-12-20 15:10:27}；
B1{user1，file1，creat，2、3，2015-12-20 16:10:27}；
C1{user1，file1，creat，4，2015-12-20 16:30:27}。
根据事件发生序列的用户标识user1，确定当前操作用户user1所属的用户类型为普通用户user，进而可确定当前操作用户对应的操作类型集合{delete、pause}，即当前操作用户user1只能执行删除和暂停操作，不能执行创建操作，即事件发生序列中的每个事件对应的事件信息中的操作类型不在该事件发生序列的用户类型对应的操作类型集合内，当前操作用户user1进行了超出其权限的操作，可得到当前事件发生序列对应的VNF为恶意VNF的审计结果。
示例性的，当事件发生序列中只要有一个事件对应的事件信息中包含有VNF操作的操作类型时，即可采用该可行的实现方式进行VNF审核。
本发明实施例另一方面提供一种VNF的审计装置，用于审计由包括认证授权组件、业务组件和虚拟基础设施的平台生成的虚拟网络功能VNF，该装置可以执行上述任一实施例中的VNF的审计方法，其实现原理和技术效果类似，在此不再赘述。图4为本发明实施例提供的一种虚拟网络功能的审计装置的结构示意图。如图4所示，该装置包括：
接收模块401，用于接收认证授权组件上报的第一VNF操作所触发的至少一个认证授权事件、接收业务组件上报的第二VNF操作所触发的至少一个业务事件、接收虚拟基础设施上报的第三VNF操作触发的至少一个访问事件；
排序模块402，用于根据至少一个认证授权事件、至少一个业务事件、至少一个访问事件，获取每个VNF的事件发生序列，一个事件发生序列用于指示对应一个VNF的多个事件的发生顺序；
审计模块403，用于对每个VNF的事件发生序列进行审计，得到VNF的审计结果。
可选的，在图4所述实施例的基础上，对排序模块进行详细说明。排序模块402具体用于：
根据至少一个认证授权事件、至少一个业务事件、至少一个访问事件中每个事件对应的事件信息中的用户标识，对至少一个认证授权事件、至少一个业务事件、至少一个访问事件分类，得到每个用户标识所对应的所有事件；
根据每个用户标识所对应的所有事件中每个事件对应的事件信息所包含的VNF标识，分析同一用户标识所对应的所有事件，得到每个VNF标识对应的所有事件；
根据每个VNF标识对应的所有事件中每个事件对应的事件信息所包含的发生时间，对每个VNF标识对应的所有事件进行排序，以获取每个VNF标识对应的VNF的事件发生序列。
可选的，至少一个认证授权事件、至少一个业务事件、至少一个访问事件中每个事件对应的事件信息均包含事件对应的VNF操作调用的模块编号，审计模块403具体用于：
对于每个VNF的事件发生序列，确定事件发生序列中的每个事件对应的事件信息所包含的VNF操作调用的模块编号所组成的模块序列；判断模块序列是否符合预设模块序列；如果模块序列不符合预设模块序列，则得到VNF为恶意VNF的审计结果。
可选的，至少一个认证授权事件、至少一个业务事件、至少一个访问事件中每个事件对应的事件信息均包含事件对应的VNF操作的发生时间，审计模块403具体用于：
对于每个VNF的事件发生序列，根据事件发生序列中的每个事件对应的事件信息所包含的发生时间，确定事件发生序列中的每个事件的执行时长；判断每个事件的执行时长是否均小于预设时长；如果存在执行时长大于或等于预设时长的事件时，则得到VNF为恶意VNF的审计结果。
可选的，至少一个认证授权事件、至少一个业务事件、至少一个访问事件中每个事件对应的事件信息均包含事件对应的VNF操作的操作类型和用户类型，审计模块403具体用于：
对于每个VNF的事件发生序列，确定事件发生序列中的每个事件对应的事件信息所包含的用户类型以及用户类型对应的操作类型集合；判断事件发生序列中的每个事件对应的事件信息所包含的操作类型是否在事件信息所包含的用户类型对应的操作类型集合内；当至少一个事件对应的事件信息所包含的操作类型不在事件信息所包含的用户类型对应的操作类型集合内时，得到VNF为恶意VNF的审计结果。
可选的，若审计结果为VNF为恶意VNF时，审计模块403还用于：输出警告信息。
本发明实施例又一方面提供一种虚拟网络功能的审计装置，用于审计由包括认证授权组件、业务组件和虚拟基础设施的平台生成的虚拟网络功能VNF，该装置可以执行上述任一实施例中的VNF的审计方法，其实现原理和技术效果类似，在此不再赘述。该装置包括：
接收器，用于接收认证授权组件上报的第一VNF操作所触发的至少一个认证授权事件、接收业务组件上报的第二VNF操作所触发的至少一个业务事件、接收虚拟基础设施上报的第三VNF操作触发的至少一个访问事件；
处理器，用于根据接收器接收到的至少一个认证授权事件、至少一个业务事件、至少一个访问事件，获取每个VNF的事件发生序列，一个事件发生序列用于指示对应一个VNF的多个事件的发生顺序；对每个VNF的事件发生序列进行审计，得到VNF的审计结果。
可选的，该装置还包括存储器，用于存储接收器接收到的所有事件，处理器根据存储器中存储的所有事件进行后续的审计过程。
可选的，处理器具体用于：
根据至少一个认证授权事件、至少一个业务事件、至少一个访问事件中每个事件对应的事件信息中的用户标识，对至少一个认证授权事件、至少一个业务事件、至少一个访问事件分类，得到每个用户标识所对应的所有事件；
根据每个用户标识所对应的所有事件中每个事件对应的事件信息所包含的VNF标识，分析同一用户标识所对应的所有事件，得到每个VNF标识对应的所有事件；
根据每个VNF标识对应的所有事件中每个事件对应的事件信息所包含的发生时间，对每个VNF标识对应的所有事件进行排序，以获取每个VNF标识对应的VNF的事件发生序列；
对每个VNF的事件发生序列进行审计，得到VNF的审计结果。
可选的，至少一个认证授权事件、至少一个业务事件、至少一个访问事件中每个事件对应的事件信息均包含事件对应的VNF操作调用的模块编号，处理器具体用于：
对于每个VNF的事件发生序列，确定事件发生序列中的每个事件对应的事件信息所包含的VNF操作调用的模块编号所组成的模块序列；判断模块序列是否符合预设模块序列；如果模块序列不符合预设模块序列，则得到VNF为恶意VNF的审计结果。
可选的，至少一个认证授权事件、至少一个业务事件、至少一个访问事件中每个事件对应的事件信息均包含事件对应的VNF操作的发生时间，处理器具体用于：
对于每个VNF的事件发生序列，根据事件发生序列中的每个事件对应的事件信息所包含的发生时间，确定事件发生序列中的每个事件的执行时长；判断每个事件的执行时长是否均小于预设时长；如果存在执行时长大于或等于预设时长的事件时，则得到VNF为恶意VNF的审计结果。
可选的，至少一个认证授权事件、至少一个业务事件、至少一个访问事件中每个事件对应的事件信息均包含事件对应的VNF操作的操作类型和用户类型，处理器具体用于：
对于每个VNF的事件发生序列，确定事件发生序列中的每个事件对应的事件信息所包含的用户类型以及用户类型对应的操作类型集合；判断事件发生序列中的每个事件对应的事件信息所包含的操作类型是否在事件信息所包含的用户类型对应的操作类型集合内；当至少一个事件对应的事件信息所包含的操作类型不在事件信息所包含的用户类型对应的操作类型集合内时，得到VNF为恶意VNF的审计结果。
可选的，该装置还包括发送器，用于在审计结果为VNF为恶意VNF时，输出警告信息。
本发明实施例再一方面提供一种存储介质，该存储介质存储有一个或多个程序，一个或多个程序包括指令，当指令被主机中的处理器调用时，可以控制主机执行上述任一方法实施例中的VNF的审计方法。
前述的存储介质包括：U盘、移动硬盘、只读存储器(read-only memory，简称ROM)、随机存取存储器(random access memory，简称RAM)、磁碟或者光盘等各种可以存储程序代码的介质。
本领域普通技术人员可以意识到，结合本文中所公开的实施例描述的各示例的单元及算法步骤，能够以电子硬件、或者计算机软件和电子硬件的结合来实现。这些功能究竟以硬件还是软件方式来执行，取决于技术方案的特定应用和设计约束条件。专业技术人员可以对每个特定的应用来使用不同方法来实现所描述的功能，但是这种实现不应认为超出本发明的范围。
所属领域的技术人员可以清楚地了解到，为描述的方便和简洁，上述描述的系统、装置和单元的具体工作过程，可以参考前述方法实施例中的对应过程，在此不再赘述。
在本申请所提供的几个实施例中，应该理解到，所揭露的系统、装置和方法，可以通过其它的方式实现。例如，以上所描述的装置实施例仅仅是示意性的，例如，所述单元的划分，仅仅为一种逻辑功能划分，实际实现时可以有另外的划分方式，例如多个单元或组件可以结合或者可以集成到另一个系统，或一些特征可以忽略，或不执行。另一点，所显示或讨论的相互之间的耦合或直接耦合或通信连接可以是通过一些接口，装置或单元的间接耦合或通信连接，可以是电性，机械或其它的形式。
本发明的说明书和权利要求书及上述附图中的术语“第一”、“第二”、“第三”“第四”等(如果存在)是用于区别类似的对象，而不必用于描述特定的顺序或先后次序。应该理解这样使用的数据在适当情况下可以互换，以便这里描述的本发明的实施例例如能够以除了在这里图示或描述的那些以外的顺序实施。此外，术语“包括”和“具有”以及他们的任何变形，意图在于覆盖不排他的包含，例如，包含了一系列步骤或单元的过程、方法、系统、产品或设备不必限于清楚地列出的那些步骤或单元，而是可包括没有清楚地列出的或对于这些过程、方法、产品或设备固有的其它步骤或单元。
所述作为分离部件说明的单元可以是或者也可以不是物理上分开的，作为单元显示的部件可以是或者也可以不是物理单元，即可以位于一个地方，或者也可以分布到多个网络单元上。可以根据实际的需要选择其中的部分或者全部单元来实现本实施例方案的目的。
另外，在本发明各个实施例中的各功能单元可以集成在一个处理单元中，也可以是各个单元单独物理存在，也可以两个或两个以上单元集成在一个单元中。
最后应说明的是：以上各实施例仅用以说明本发明的技术方案，而非对其限制；尽管参照前述各实施例对本发明进行了详细的说明，本领域的普通技术人员应当理解：其依然可以对前述各实施例所记载的技术方案进行修改，或者对其中部分或者全部技术特征进行等同替换；而这些修改或者替换，并不使相应技术方案的本质脱离本发明各实施例技术方案的范围。

Claims (13)

  1. 一种虚拟网络功能的审计方法，用于审计由包括认证授权组件、业务组件和虚拟基础设施的平台生成的虚拟网络功能VNF，其特征在于，所述方法包括：
    接收所述认证授权组件上报的第一VNF操作所触发的至少一个认证授权事件、接收所述业务组件上报的第二VNF操作所触发的至少一个业务事件、接收所述虚拟基础设施上报的第三VNF操作触发的至少一个访问事件；
    根据所述至少一个认证授权事件、所述至少一个业务事件、所述至少一个访问事件，获取每个VNF的事件发生序列，一个事件发生序列用于指示对应一个VNF的多个事件的发生顺序；
    对每个VNF的事件发生序列进行审计，得到所述VNF的审计结果。
  2. 根据权利要求1所述的方法，其特征在于，所述根据所述至少一个认证授权事件、所述至少一个业务事件、所述至少一个访问事件，获取每个VNF的事件发生序列，包括：
    根据所述至少一个认证授权事件、所述至少一个业务事件、所述至少一个访问事件中每个事件对应的事件信息中的用户标识，对所述至少一个认证授权事件、所述至少一个业务事件、所述至少一个访问事件分类，得到每个用户标识所对应的所有事件；
    根据每个用户标识所对应的所有事件中每个事件对应的事件信息所包含的VNF标识，分析所述同一用户标识所对应的所有事件，得到每个VNF标识对应的所有事件；
    根据每个VNF标识对应的所有事件中每个事件对应的事件信息所包含的发生时间，对每个VNF标识对应的所有事件进行排序，以获取每个VNF标识对应的VNF的事件发生序列。
  3. 根据权利要求2所述的方法，其特征在于，
    所述至少一个认证授权事件、所述至少一个业务事件、所述至少一个访问事件中每个事件对应的事件信息均包含所述事件对应的VNF操作调用的模块编号，
    所述对每个VNF的事件发生序列进行审计，得到所述VNF的审计结果，包括：
    对于每个VNF的事件发生序列，确定所述事件发生序列中的每个事件对应的事件信息所包含的VNF操作调用的模块编号所组成的模块序列；
    判断所述模块序列是否符合预设模块序列；
    如果所述模块序列不符合预设模块序列，则得到所述VNF为恶意VNF的审计结果。
  4. 根据权利要求2所述的方法，其特征在于，
    所述至少一个认证授权事件、所述至少一个业务事件、所述至少一个访问事件中每个事件对应的事件信息均包含所述事件对应的VNF操作的发生时间，
    所述对每个VNF的事件发生序列进行审计，得到所述VNF的审计结果，包括：
    对于每个VNF的事件发生序列，根据所述事件发生序列中的每个事件对应的事件信息所包含的发生时间，确定所述事件发生序列中的每个事件的执行时长；
    判断所述每个事件的执行时长是否均小于预设时长；
    如果存在执行时长大于或等于所述预设时长的事件时，则得到所述VNF为恶意VNF的审计结果。
  5. 根据权利要求2所述的方法，其特征在于，
    所述至少一个认证授权事件、所述至少一个业务事件、所述至少一个访问事件中每个 事件对应的事件信息均包含所述事件对应的VNF操作的操作类型和用户类型；
    所述对每个VNF的事件发生序列进行审计，得到所述VNF的审计结果，包括：
    对于每个VNF的事件发生序列，确定所述事件发生序列中的每个事件对应的事件信息所包含的用户类型以及所述用户类型对应的操作类型集合；
    判断所述事件发生序列中的每个事件对应的事件信息所包含的操作类型是否在所述事件信息所包含的用户类型对应的操作类型集合内；
    当至少一个事件对应的事件信息所包含的操作类型不在所述事件信息所包含的用户类型对应的操作类型集合内时，得到所述VNF为恶意VNF的审计结果。
  6. 根据权利要求1至5任一项所述的方法，其特征在于，若所述审计结果为所述VNF为恶意VNF时，所述方法还包括：
    输出警告信息。
  7. 一种虚拟网络功能的审计装置，用于审计由包括认证授权组件、业务组件和虚拟基础设施的平台生成的虚拟网络功能VNF，其特征在于，包括：
    接收模块，用于接收所述认证授权组件上报的第一VNF操作所触发的至少一个认证授权事件、接收所述业务组件上报的第二VNF操作所触发的至少一个业务事件、接收所述虚拟基础设施上报的第三VNF操作触发的至少一个访问事件；
    排序模块，用于根据所述至少一个认证授权事件、所述至少一个业务事件、所述至少一个访问事件，获取每个VNF的事件发生序列，一个事件发生序列用于指示对应一个VNF的多个事件的发生顺序；
    审计模块，用于对每个VNF的事件发生序列进行审计，得到所述VNF的审计结果。
  8. 根据权利要求7所述的装置，其特征在于，所述排序模块，具体用于：
    根据所述至少一个认证授权事件、所述至少一个业务事件、所述至少一个访问事件中每个事件对应的事件信息中的用户标识，对所述至少一个认证授权事件、所述至少一个业务事件、所述至少一个访问事件分类，得到每个用户标识所对应的所有事件；
    根据每个用户标识所对应的所有事件中每个事件对应的事件信息所包含的VNF标识，分析所述同一用户标识所对应的所有事件，得到每个VNF标识对应的所有事件；
    根据每个VNF标识对应的所有事件中每个事件对应的事件信息所包含的发生时间，对每个VNF标识对应的所有事件进行排序，以获取每个VNF标识对应的VNF的事件发生序列。
  9. 根据权利要求8所述的装置，其特征在于，所述至少一个认证授权事件、所述至少一个业务事件、所述至少一个访问事件中每个事件对应的事件信息均包含所述事件对应的VNF操作调用的模块编号，所述审计模块具体用于：
    对于每个VNF的事件发生序列，确定所述事件发生序列中的每个事件对应的事件信息所包含的VNF操作调用的模块编号所组成的模块序列；
    判断所述模块序列是否符合预设模块序列；
    如果所述模块序列不符合预设模块序列，则得到所述VNF为恶意VNF的审计结果。
  10. 根据权利要求8所述的装置，其特征在于，所述至少一个认证授权事件、所述至少一个业务事件、所述至少一个访问事件中每个事件对应的事件信息均包含所述事件对应的VNF操作的发生时间，所述审计模块具体用于：
    对于每个VNF的事件发生序列，根据所述事件发生序列中的每个事件对应的事件信息所包含的发生时间，确定所述事件发生序列中的每个事件的执行时长；
    判断所述每个事件的执行时长是否均小于预设时长；
    如果存在执行时长大于或等于所述预设时长的事件时，则得到所述VNF为恶意VNF的审计结果。
  11. 根据权利要求8所述的装置，其特征在于，所述至少一个认证授权事件、所述至少一个业务事件、所述至少一个访问事件中每个事件对应的事件信息均包含所述事件对应的VNF操作的操作类型和用户类型，所述审计模块具体用于：
    对于每个VNF的事件发生序列，确定所述事件发生序列中的每个事件对应的事件信息所包含的用户类型以及所述用户类型对应的操作类型集合；
    判断所述事件发生序列中的每个事件对应的事件信息所包含的操作类型是否在所述事件信息所包含的用户类型对应的操作类型集合内；
    当至少一个事件对应的事件信息所包含的操作类型不在所述事件信息所包含的用户类型对应的操作类型集合内时，得到所述VNF为恶意VNF的审计结果。
  12. 根据权利要求7至11任一项所述的装置，其特征在于，若所述审计结果为VNF为恶意VNF时，所述审计模块还用于：
    输出警告信息。
  13. 一种存储介质，其特征在于，所述存储介质存储有一个或多个程序，所述一个或多个程序包括指令，当所述指令被主机中的处理器调用时，使所述主机执行权利要求1至6中任一项所述的方法。
PCT/CN2017/082843 2016-05-10 2017-05-03 虚拟网络功能的审计方法和装置 WO2017193845A1 (zh)

Priority Applications (2)

Application Number Priority Date Filing Date Title
EP17795463.3A EP3445001B1 (en) 2016-05-10 2017-05-03 Method and device for auditing virtual network function
US16/185,971 US10990670B2 (en) 2016-05-10 2018-11-09 Virtual network function audit method and apparatus

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201610304572.8A CN107360120B (zh) 2016-05-10 2016-05-10 虚拟网络功能的审计方法和装置
CN201610304572.8 2016-05-10

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US16/185,971 Continuation US10990670B2 (en) 2016-05-10 2018-11-09 Virtual network function audit method and apparatus

Publications (1)

Publication Number Publication Date
WO2017193845A1 true WO2017193845A1 (zh) 2017-11-16

Family

ID=60266211

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2017/082843 WO2017193845A1 (zh) 2016-05-10 2017-05-03 虚拟网络功能的审计方法和装置

Country Status (4)

Country Link
US (1) US10990670B2 (zh)
EP (1) EP3445001B1 (zh)
CN (1) CN107360120B (zh)
WO (1) WO2017193845A1 (zh)

Families Citing this family (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US11271948B2 (en) * 2017-05-22 2022-03-08 Amdocs Development Limited System, method, and computer program for verifying virtual network function (VNF) package and/or network service definition integrity
CN111385262B (zh) * 2018-12-29 2022-08-09 西安华为技术有限公司 一种控制权限的方法及网络设备
CN110298769A (zh) * 2019-06-13 2019-10-01 浙江口碑网络技术有限公司 点餐业务请求的处理方法、装置及系统

Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102750475A (zh) * 2012-06-07 2012-10-24 中国电子科技集团公司第三十研究所 基于虚拟机内外视图交叉比对恶意代码行为检测方法及系统
CN104331662A (zh) * 2013-07-22 2015-02-04 深圳市腾讯计算机系统有限公司 Android恶意应用检测方法及装置
US20160112443A1 (en) * 2014-10-21 2016-04-21 IronNet Cybersecurity, Inc. Cybersecurity system

Family Cites Families (16)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US5696906A (en) * 1995-03-09 1997-12-09 Continental Cablevision, Inc. Telecommunicaion user account management system and method
US7340776B2 (en) * 2001-01-31 2008-03-04 International Business Machines Corporation Method and system for configuring and scheduling security audits of a computer network
US7159125B2 (en) * 2001-08-14 2007-01-02 Endforce, Inc. Policy engine for modular generation of policy for a flat, per-device database
JP2009508274A (ja) * 2005-09-13 2009-02-26 スペースタイムスリーディー・インコーポレーテッド ３次元グラフィカル・ユーザ・インターフェースを提供するシステム及び方法
US8341123B2 (en) * 2006-01-27 2012-12-25 El Fresko Technologies Limited Event structured file system (ESFS)
US8401982B1 (en) * 2010-01-14 2013-03-19 Symantec Corporation Using sequencing and timing information of behavior events in machine learning to detect malware
US9117080B2 (en) * 2013-07-05 2015-08-25 Bitdefender IPR Management Ltd. Process evaluation for malware detection in virtual machines
US9838483B2 (en) * 2013-11-21 2017-12-05 Oracle International Corporation Methods, systems, and computer readable media for a network function virtualization information concentrator
US9760428B1 (en) * 2013-12-19 2017-09-12 Amdocs Software Systems Limited System, method, and computer program for performing preventative maintenance in a network function virtualization (NFV) based communication network
US9853869B1 (en) * 2015-01-27 2017-12-26 Amdocs Software Systems Limited System, method, and computer program for automatically instructing a virtual network function (VNF) to operate in accordance with one of a plurality of function definitions
WO2015149062A1 (en) * 2014-03-28 2015-10-01 Zitovault, Inc. System and method for predicting impending cyber security events using multi channel behavioral analysis in a distributed computing environment
US9948493B2 (en) * 2014-04-03 2018-04-17 Centurylink Intellectual Property Llc Network functions virtualization interconnection gateway
US9536084B1 (en) * 2015-03-23 2017-01-03 Bitdefender IPR Management Ltd. Systems and methods for delivering event-filtered introspection notifications
US10142353B2 (en) * 2015-06-05 2018-11-27 Cisco Technology, Inc. System for monitoring and managing datacenters
US9742790B2 (en) * 2015-06-16 2017-08-22 Intel Corporation Technologies for secure personalization of a security monitoring virtual network function
US10089687B2 (en) * 2015-08-04 2018-10-02 Fidelity National Information Services, Inc. System and associated methodology of creating order lifecycles via daisy chain linkage

Patent Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102750475A (zh) * 2012-06-07 2012-10-24 中国电子科技集团公司第三十研究所 基于虚拟机内外视图交叉比对恶意代码行为检测方法及系统
CN104331662A (zh) * 2013-07-22 2015-02-04 深圳市腾讯计算机系统有限公司 Android恶意应用检测方法及装置
US20160112443A1 (en) * 2014-10-21 2016-04-21 IronNet Cybersecurity, Inc. Cybersecurity system

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
See also references of EP3445001A4 *

Also Published As

Publication number Publication date
US20190080084A1 (en) 2019-03-14
CN107360120A (zh) 2017-11-17
CN107360120B (zh) 2019-06-11
EP3445001A4 (en) 2019-02-20
EP3445001A1 (en) 2019-02-20
US10990670B2 (en) 2021-04-27
EP3445001B1 (en) 2020-01-29

Similar Documents

Publication Publication Date Title
US10666686B1 (en) Virtualized exploit detection system
US11036836B2 (en) Systems and methods for providing real time security and access monitoring of a removable media device
US11044264B2 (en) Graph-based detection of lateral movement
US11005893B2 (en) Automatic generation of security rules for network micro and nano segmentation
US8806629B1 (en) Automatic generation of policy-driven anti-malware signatures and mitigation of DoS (denial-of-service) attacks
US20170048195A1 (en) Security information and event management
US9954896B2 (en) Preconfigured honey net
US8516586B1 (en) Classification of unknown computer network traffic
Inayat et al. Cloud-based intrusion detection and response system: open research issues, and solutions
EP3414663A1 (en) Automated honeypot provisioning system
US20040260945A1 (en) Integrated intrusion detection system and method
US20100043047A1 (en) Unauthorized data transfer detection and prevention
WO2016084073A1 (en) Systems and methods for malicious code detection
US20070056020A1 (en) Automated deployment of protection agents to devices connected to a distributed computer network
AU2008325044A1 (en) System and method for providing data and device security between external and host devices
US20190319923A1 (en) Network data control method, system and security protection device
WO2017193845A1 (zh) 虚拟网络功能的审计方法和装置
Holik et al. The deployment of security information and event management in cloud infrastructure
CN107231365B (zh) 一种取证的方法及服务器以及防火墙
US20230032139A1 (en) High speed trust evaluation for file activity
TWI711939B (zh) 用於惡意程式碼檢測之系統及方法
US20220138320A1 (en) Detection of Unauthorized Encryption Using Deduplication Efficiency Metric
CN114205169A (zh) 网络安全防御方法、装置及系统
JP2006330926A (ja) ウィルス感染検知装置
KR100961438B1 (ko) 실시간 침입 탐지 시스템 및 방법, 그리고 그 방법을수행하기 위한 프로그램이 기록된 기록매체

Legal Events

Date Code Title Description
WWE Wipo information: entry into national phase

Ref document number: 2017795463

Country of ref document: EP

NENP Non-entry into the national phase

Ref country code: DE

ENP Entry into the national phase

Ref document number: 2017795463

Country of ref document: EP

Effective date: 20181112

121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 17795463

Country of ref document: EP

Kind code of ref document: A1