Method, apparatus and system for processing attack behavior of cloud application in cloud computing system

A method for processing an attack behavior in a cloud computing system comprising:

• storing, by a policy manager, a security determining rule and a malicious application processing rule;
• converting, by the policy manager, the security determining rule into a behavior detection rule;
• sending, by the policy manager, the behavior detection rule to a security detector deployed on at least one cloud host among a plurality of cloud hosts in the cloud computing system;
• receiving, by a security analyzer, application behavior data from the security detector, wherein the application behavior data represents a running status of the cloud application running on the at least one cloud host, wherein the application behavior data corresponds to a behavior of the cloud application running on the at least one cloud host, and wherein the behavior of the cloud application is detected by the security detector using the behavior detection rule;
• determining, by the security analyzer, according to the application behavior data and the security determining rule that is stored in the policy manager, whether the cloud application running on the cloud host has an attack behavior;
• and
• invoking, according to a malicious application processing rule, an interface provided by a cloud controller to process the cloud application when the cloud application running on the at least one cloud host has the attack behavior.

A cloud computing system comprising:

• multiple cloud hosts, wherein on each of the multiple cloud hosts a security detector is deployed and one or more cloud applications run on each of the cloud hosts, and wherein a first security detector on a first cloud host among the multiple cloud hosts is configured to detect a first cloud application according to a behavior detection rule to obtain application behavior data and report the application behavior data;
• a cloud controller communicatively coupled to each of the multiple cloud hosts or integrated into one of the multiple cloud hosts, wherein the cloud controller is configured to manage and control the multiple cloud hosts;
• and
• an apparatus for processing an attack behavior coupled to the multiple cloud hosts and the cloud controller, wherein the apparatus comprises:
• a memory comprising instructions;
• and
• a processor coupled to the memory, wherein the processor is configured to execute the instructions in the memory to:
• store a security determining rule and a malicious application processing rule;
• convert the security determining rule into the behavior detection rule;
• send the behavior detection rule to the first security detector;
• receive the application behavior data reported by the first security detector on at least one cloud host among the multiple cloud hosts;
• determine, according to the application behavior data and the security determining rule, whether the first cloud application running on the first cloud host has an attack behavior;
• and
• invoke, according to the malicious application processing rule, an interface provided by the cloud controller to process the first cloud application when the first cloud application running on the first cloud host has the attack behavior.