TWI820961B - Electronic device and method for processing intelligence based on microservice and public cloud component - Google Patents

Abstract

An electronic device and a method for processing intelligence based on microservice and public cloud component are provided. The method includes the following steps: scheduling, by an original-intelligence-processing-module, a microservice and a public cloud component and obtaining a processed-intelligence using an original-intelligence, the microservice and the public cloud component; scheduling, by a valid-intelligence-obtaining-module, the microservice and the public cloud component and obtaining a valid-intelligence using the processed-intelligence, the microservice, and the public cloud component; and scheduling, by an effective-intelligence-providing module, the microservice and the public cloud component and providing the valid-intelligence using the microservice and the public cloud component.

Description

Electronic device and method for processing information based on microservices and public cloud components

The present invention relates to an electronic device and method for processing information based on microservices and public cloud components.

As the number and complexity of cyber threats continue to increase, the amount of relevant intelligence data has become large and difficult to handle. How to handle information related to cyber threats more efficiently is a goal that technicians in this field should strive for.

The electronic device for processing information based on microservices and public cloud components of the present invention includes microservices, an original information processing module, an effective information obtaining module, and an effective information providing module. The original information processing module schedules microservices and public cloud components, and uses original information, microservices, and public cloud components to obtain processed information; the effective information acquisition module schedules microservices and public cloud components, and uses processed information Information, microservices and public cloud components obtain effective information; effective information provides module scheduling microservices and public cloud components, and uses microservices and public cloud components to provide effective information.

The method of processing information based on microservices and public cloud components of the present invention includes the following steps: scheduling the microservices and public cloud components by the original information processing module, and using the original information, microservices and public cloud components to obtain the processed information. information; obtain module scheduling microservices and public cloud components from effective information, and use processed information, microservices, and public cloud components to obtain effective information; and provide module scheduling microservices and public cloud components from effective information , and use microservices and public cloud components to provide effective intelligence.

FIG. 1 is a schematic diagram of an electronic device 100 based on microservices and public cloud component processing information according to an embodiment of the present invention. The electronic device 100 may include microservices 110a, microservices 110b, ... until microservices 110n. Furthermore, the electronic device 100 may include an original information processing module 120, a valid information obtaining module 130, a valid information providing module 140, and an application gateway 160. It should be noted that the number of microservices shown in Figure 1 is only for illustration, and the present invention is not limited to this. In this embodiment, the electronic device 100 can be communicatively connected to the intelligence source device 200 , the public cloud component 400 and the public cloud storage 500 .

In one embodiment, each microservice (microservice 110a, microservice 110b, ... until microservice 110n), the original information processing module 120, the effective information obtaining module 130, the effective information providing module 140 and the application Program gateway 160 may be software and/or firmware code executed by the processor. In another embodiment, each microservice, the original information processing module 120, the effective information obtaining module 130, the effective information providing module 140, and the application gateway 160 may be implemented as circuits. In another embodiment, each microservice, the original information processing module 120, the effective information obtaining module 130, the effective information providing module 140 and the application gateway 160 can be implemented as software and/or firmware programs. A combination of codes and circuits. The present invention does not limit the implementation methods of each microservice, the original information processing module 120, the effective information obtaining module 130, the effective information providing module 140, and the application gateway 160. In this embodiment, microservices 110a, microservices 110b, ... until microservice 110n can communicate with each other through API, for example.

Figure 2 is a flow chart illustrating a method of processing information based on microservices and public cloud components according to an embodiment of the present invention. Please refer to FIG. 1 and FIG. 2 at the same time. The method of this embodiment is applicable to the electronic device 100 shown in FIG. 1 . The detailed steps of the information processing method based on microservices and public cloud components of the present invention will be described below with the electronic device 100 .

In step S210, the original information processing module 120 can schedule the microservices and public cloud components 400, and obtain processed information using the original information, microservices, and public cloud components 400.

In detail, the original information processing module 120 may receive original information from the information source device 200 . The information source device 200 is, for example, an enterprise's server or network equipment. Raw intelligence is, for example, network device logs or network traffic. Furthermore, the original information processing module 120 can monitor the current assignment status/resource usage status of the microservices 110a, microservices 110b, ... until the microservice 110n. After receiving the original information, the original information processing module 120 may schedule the microservice according to the filtering rules or the information type of the original information. For example, for each filtering rule, the original information processing module 120 can schedule (assign) one or several microservices from the microservices 110a, microservices 110b, ... until the microservice 110n. On the other hand, the original information processing module 120 can schedule (assign) different microservices for different types of original information. In other embodiments, for a large number of original information belonging to the same information type, the original information processing module 120 can slice (Slicing and Dicing) these original information to obtain a specific number of original information slices, and This specific number of microservices is scheduled from microservices 110a, microservices 110b, ... until microservice 110n to speed up the processing of raw information. After completing the scheduling of the microservices, the original information processing module 120 can execute filtering rules to obtain filtered information using the original information. For example, filtering rules may include, but are not limited to, deleting missing fields in the original information, identifying ambiguous strings in the original information, removing unrecognizable strings in the original information, and based on specific information fields. (e.g. the timestamp of the original information, the source address of the original information, the source port of the original information, the destination address of the original information, and/or the destination port of the original information) Perform normalization on the original information .

In this embodiment, the original information processing module 120 can monitor the resource usage status of the public cloud component 400. After obtaining the filtered information, the original information processing module 120 can schedule the public cloud component 400 and store the filtered information in the public cloud storage 500 (for example, the original information processing module 120 can store it in a batch manner The filtered information is stored in public cloud storage 500). The public cloud storage 500 can be used as a data lake for intelligence information. In other words, the public cloud storage 500 can be flexibly expanded to store a large amount of intelligence information. Next, in order to avoid contamination of the intelligence caused by the operation of each intelligence analysis sub-module in the subsequent effective intelligence acquisition module 130, and/or in order to perform parallel analysis and processing for a specific intelligence analysis sub-module, the original intelligence is processed The module 120 can schedule the public cloud component 400 and copy the filtered information from the public cloud storage 500 to obtain the processed information.

Please return to Figure 2. In step S220, the effective information obtaining module 130 can schedule the microservices and the public cloud component 400, and obtain effective information using the processed information, the microservices and the public cloud component 400. In this embodiment, the effective intelligence obtaining module 130 may include multiple intelligence analysis sub-modules. This will be further explained later.

Specifically, the effective information acquisition module 130 can schedule microservices according to multiple information analysis sub-modules. In one embodiment, the plurality of intelligence analysis sub-modules may include, but are not limited to, Domain Name Server Tunneling artificial intelligence detection module, counterfeit domain name artificial intelligence detection module and domain name generation algorithm (DGA, Domain Generation Algorithm) artificial intelligence detection module. The explanation will continue below.

FIG. 3 is a schematic diagram of multiple intelligence analysis sub-modules according to an embodiment of the present invention. Please refer to Figure 1, Figure 2 and Figure 3 at the same time. It should be noted that the number of intelligence analysis sub-modules shown in Figure 3 is only for illustration, and the present invention is not limited to this. For convenience of explanation, it is assumed here that the effective information acquisition module 130 includes an information analysis sub-module 130a, an information analysis sub-module 130b, an information analysis sub-module 130c, an information analysis sub-module 130d, and an information analysis sub-module. Submodule 130e. The effective information acquisition module 130 can monitor the current assignment status/resource usage status of the microservices 110a, 110b, ... up to the microservice 110n, and provide the information analysis sub-module 130a, the information analysis sub-module 130b, and the information analysis sub-module 130b. The information analysis sub-module 130c, the information analysis sub-module 130d and the information analysis sub-module 130e respectively schedule/assign a microservice. It is assumed here that the effective intelligence acquisition module 130 schedules microservices 110a for the intelligence analysis sub-module 130a, microservices 110b for the intelligence analysis sub-module 130b, and schedules microservices for the intelligence analysis sub-module 130c. 110c. The microservice 110d is scheduled for the intelligence analysis sub-module 130d and the microservice 110e is scheduled for the intelligence analysis sub-module 130e. The effective information acquisition module 130 can respectively set microservice weight values for the microservices 110a ~ microservices 110e according to their respective operating loads. Next, for specific processed information, the effective information obtaining module 130 can determine whether the information analysis sub-modules 130a to 130e need to be executed in a specific order. If the information analysis sub-module 130a ~ the information analysis sub-module 130e do not need to be executed in a specific order, the effective information acquisition module 130 can determine the information based on the respective microservice weight values of the microservices 110a ~ microservices 110e. The execution order of the information analysis sub-module 130a ~ the information analysis sub-module 130e, that is, determines the execution order of the microservices 110a ~ microservices 110e (microservice routing topology). For example, if the microservice weight value of microservice 110a is 1, the microservice weight value of microservice 110b is 2, the microservice weight value of microservice 110c is 3, the microservice weight value of microservice 110d is 4, and the microservice weight value of microservice 110e The weight value of microservices is 5 (that is, the operating load of microservices in order from low to high is microservice 110a, microservice 110b, microservice 110c, microservice 110d and microservice 110e), then the effective information acquisition model The group 130 can determine the execution order of the intelligence analysis sub-module 130a ~ the intelligence analysis sub-module 130e as follows: intelligence analysis sub-module 130a, intelligence analysis sub-module 130b, intelligence analysis sub-module 130c , intelligence analysis sub-module 130d and intelligence analysis sub-module 130e. In other embodiments, the effective intelligence obtaining module 130 may determine the execution order of the intelligence analysis sub-modules 130a to 130e according to the shortest path algorithm.

After determining the execution order of the intelligence analysis sub-modules 130a ~ the intelligence analysis sub-modules 130e, the effective intelligence acquisition module 130 can execute the intelligence analysis sub-modules 130a ~ the intelligence analysis sub-modules (according to this execution order) Group 130e uses the processed intelligence to obtain intelligence analysis results. For example, the effective information acquisition module 130 can sequentially call/execute the microservices 110a, 110b, and Microservice 110c, microservice 110d and microservice 110e to obtain intelligence analysis results.

As explained in the previous embodiment, the effective information acquisition module 130 can monitor the current assignment status/resource usage status of the microservices 110a to 110e. For example, the effective information acquisition module 130 can monitor the operating load and/or operating time of the microservices 110a ~ 110e. If the operating load and/or operating time of a specific microservice exceeds the maximum threshold or is lower than the minimum threshold, the effective information acquisition module 130 can expand/adjust the execution resources and/or storage resources of the specific microservice, and Restart this microservice after executing this specific microservice. In addition, if a specific microservice needs to process a large amount of processed information, the effective information acquisition module 130 can copy the specific microservice to execute the specific microservice synchronously/in parallel. In other embodiments, when a new intelligence analysis sub-module is added to the effective intelligence acquisition module 130, the effective intelligence acquisition module 130 can create a new microservice, and for this new intelligence analysis The submodule schedules/assigns this new microservice. In other embodiments, the effective information obtaining module 130 can shut down microservices that are infrequently used and no longer running. In other embodiments, the effective information acquisition module 130 can hibernate microservices that are commonly used and are not currently running. In other embodiments, the effective information acquisition module 130 can wake up/re-run the dormant microservice. In other embodiments, for a specific microservice that is running but has no response, the effective information obtaining module 130 can first copy the specific microservice and delete the microservice that originally had no response.

After obtaining the intelligence analysis results, the effective intelligence acquisition module 130 can schedule the microservice and execute the sandbox verification program to obtain effective intelligence using the intelligence analysis results. Specifically, the effective intelligence acquisition module 130 can schedule a microservice for multiple external intelligence providers, and mirror the above intelligence analysis results to the microservices scheduled for multiple external intelligence providers. Microservice, whereby the effective intelligence acquisition module 130 can compare/verify the intelligence analysis results with external intelligence from the external intelligence provider, so as to filter out the intelligence analysis results (with the external intelligence matching) valid information.

In this embodiment, the effective information acquisition module 130 can monitor the resource usage status of the public cloud component 400 . After obtaining the valid information, the valid information obtaining module 130 can schedule the public cloud component 400 and store the valid information in the public cloud storage 500 . Specifically, the effective intelligence acquisition module 130 can schedule the public cloud component 400 to create an intelligence queue, an associated intelligence database, a graphical intelligence database, and a time series intelligence database in the public cloud storage 500 . Furthermore, the effective information acquisition module 130 can monitor the load status of the associative information database, the graphical information database, and/or the time series information database, and dynamically perform resource allocation for each information database. Expand. In one embodiment, the valid information obtaining module 130 can store the valid information in the information queue of the public cloud storage 500 . In another embodiment, the valid intelligence information acquisition module 130 can store the valid intelligence information in a relational intelligence database, a graphical intelligence database and/or a time series intelligence database of the public cloud storage 500 . This will be explained further below.

Please return to Figure 2. In step S230, the effective information providing module 140 can schedule microservices and public cloud components 400, and use the microservices and public cloud components 400 to provide effective information. The effective information providing module 140 can monitor the current assignment status/resource usage status of the microservice 110, and the effective information providing module 140 can monitor the resource usage status of the public cloud component 400 to perform the process described in the following embodiments. .

In one embodiment, the effective information providing module 140 may (actively) provide effective information. Specifically, the valid intelligence providing module 140 can schedule the microservices and the public cloud component 400 to receive valid intelligence from the intelligence queue of the public cloud storage 500 and transmit the valid intelligence to the outside through the application gateway 160 Information system (not shown). For example, the valid intelligence providing module 140 can periodically transmit valid intelligence to an external intelligence system through the application gateway 160 .

In another embodiment, the effective information providing module 140 may passively provide effective information after receiving the information query request. Specifically, in response to receiving an information inquiry request from an information inquiry end device (not shown) through the application gateway 160, the effective information provision module 140 may schedule the microservice and the public cloud component 400 to obtain the information from the public cloud. The associative intelligence database, graphical intelligence database and time series intelligence database of the storage body 500 receive valid intelligence. Then, the valid information providing module 140 can send the valid information to the information inquiry terminal device through the application gateway 160 . Specifically, in this embodiment, the correlational intelligence database can store intelligence related to intrusion threat indicators in the effective intelligence, and the graphical intelligence database can store threat-related intelligence in the effective intelligence, and the time series The type of information database can store the passive domain name query related information in the valid information. The effective information providing module 140 can schedule microservices (for example, one or more microservices among the schedulable/assignable microservices 110a, microservices 110b, ... until microservices 110n) to use visual methods such as graphical interfaces to The valid information is sent to the information query terminal device through the application gateway 160, thereby allowing the information queryer to more conveniently read/review the valid information in the future. It is worth mentioning that the effective information providing module 140 can monitor the network connection load for the physical network/virtual network where each microservice that is scheduled to execute the above process is located. If the network connection exceeds the load, the active intelligence module 140 can replicate this particular microservice. Furthermore, if the subsequent network connection is lower than the load, the effective information providing module 140 can delete the copied specific microservice for downloading.

In other embodiments, the valid information providing module 140 may store in the cache part of the valid information that is more frequently queried. When the effective information providing module 140 receives an information inquiry request from the information inquiry terminal device through the application gateway 160, and the information to be inquired by the information inquiry terminal device has been pre-stored in the cache, the effective information provision module 140 can obtain the information to be queried from the cache and send the valid information to the information inquiry terminal device through the application gateway 160 . On the other hand, when the information to be queried by the information query terminal device is not pre-stored in the cache, the effective information providing module 140 can obtain the relevant information database or graphical information data from the public cloud storage 500 The database and the time-series intelligence database receive the valid intelligence. Then, the valid intelligence providing module 140 can update the cache according to the valid intelligence, and transmit the valid intelligence to the intelligence inquiry terminal device through the application gateway 160 .

In other embodiments, the effective information providing module 140 can schedule the public cloud component 400 to execute the application when transmitting effective information to the external information system and/or the information query terminal device through the application gateway 160 Load balancing operation of gateway 160.

In other embodiments, the effective information providing module 140 can schedule the public cloud component 400 to set up a Web Application Firewall (WAF, Web Application Firewall) on the application gateway 160 to increase security when providing effective information. .

In other embodiments, the effective intelligence providing module 140 can schedule the public cloud component 400 to use a key to encrypt the connection between the application gateway 160 and the external intelligence system and/or the intelligence query terminal device to increase Security when providing valid intelligence.

In summary, the electronic device and method for processing information based on microservices and public cloud components of the present invention can perform filtering and analysis of information based on microservices and public cloud components, and provide effective information. Since each microservice is independent, the programs and data of each microservice will not interfere with each other, thereby improving the security of information. In addition, by monitoring the resource usage status of microservices and public cloud components, the electronic device and method based on microservices and public cloud component processing information of the present invention can dynamically schedule microservices and public cloud components to complete the processing. Various operations of information, thus improving the efficiency of processing information.

100: Electronic devices that process information based on microservices and public cloud components 110a, 110b, 110c, 110d, 110e, 110n: microservices 120: Original information processing module 130: Effective information acquisition module 140: Effective information provision module 160:Application Gateway 200:Information source device 400: Public cloud components 500:Public cloud storage S210, S220, S230: steps 130a, 130b, 130c, 130d, 130e: Intelligence analysis sub-module

FIG. 1 is a schematic diagram of an electronic device based on microservices and public cloud components processing information according to an embodiment of the present invention. Figure 2 is a flow chart illustrating a method of processing information based on microservices and public cloud components according to an embodiment of the present invention. FIG. 3 is a schematic diagram of multiple intelligence analysis sub-modules according to an embodiment of the present invention.

S210, S220, S230: steps

Claims (7)

An electronic device for processing information based on microservices and public cloud components, including: microservices; an original information processing module, scheduling the microservices and public cloud components, and utilizing the original information, the microservices, and the The public cloud component obtains the processed information; the effective information obtaining module schedules the microservice and the public cloud component, and uses the processed information, the microservice and the public cloud component to obtain valid information. and an effective information provision module that schedules the microservice and the public cloud component, and uses the microservice and the public cloud component to provide the effective information. The electronic device of claim 1, wherein the original information processing module schedules the microservice according to a filtering rule or an information type of the original information, and executes the filtering rule to utilize the original information. Obtain filtered information; the original information processing module schedules the public cloud component, and stores the filtered information in a public cloud storage; the original information processing module schedules the public cloud component , and copy the filtered information from the public cloud storage to obtain the processed information. The electronic device according to claim 1, wherein the effective information obtaining module includes a plurality of information analysis sub-modules, and the effective information obtaining module is scheduled according to the plurality of information analysis sub-modules. Place Describe the microservices, and execute the multiple intelligence analysis sub-modules to obtain intelligence analysis results using the processed intelligence; the effective intelligence acquisition module schedules the microservices, and executes a sandbox verification program The effective information is obtained using the information analysis results. The electronic device of claim 3, wherein the effective information acquisition module schedules the public cloud component and stores the effective information in a public cloud storage. The electronic device of claim 1, further comprising an application gateway, wherein the effective information providing module schedules the microservice and the public cloud component to receive the information queue from the public cloud storage. Describe valid information and transmit the valid information to an external information system through the application gateway. The electronic device of claim 1, further comprising an application gateway, wherein in response to receiving an information inquiry request from an information inquiry terminal device through the application gateway, the effective information providing module schedules the The microservice and the public cloud component receive the effective information from the relational information database, the graphical information database and the time series information database of the public cloud storage, and pass the application gateway Send the valid information to the information inquiry terminal device. A method for processing information based on microservices and public cloud components, suitable for electronic devices including microservices, original information processing modules, effective information obtaining modules, and effective information providing modules. The method includes the following steps : The original information processing module schedules the microservices and public cloud components, and uses the original information, the microservices and the public cloud components to obtain processed information; the effective information acquisition module Scheduling the microservice and the public cloud component, and using the processed information, the microservice and the public cloud component to obtain effective information; and scheduling the microservice by the effective information providing module services and the public cloud components, and utilize the microservices and the public cloud components to provide the effective information.

Images