Cloud system with attack protection mechanism and protection method using for the same

A protection method using for a cloud system with an attack protection mechanism, the cloud system having a host, a monitoring server connected to the host, and a security center server connected to the host and the monitoring server, the protection method comprising following steps:

• (a) detecting various data of the host through a detecting procedure by the host;
• (b) triggering an event when any one of the data exceeding corresponding threshold value;
• (c) judging whether the host is attacked according to the event by the monitoring server;
• (d) generating a warning message and notifying the security center server by the monitoring server when the host is really attacked;
• (e) analyzing an attacked type to the host by the security center server according to the warning message sent from the monitoring server and then generating an updated security policy;
• and
• (f) redeploying the host by the security center server according to the updated security policy.

A cloud system with an attack protection mechanism, comprising:

• a host configured to install a detecting procedure to detect various data of the host and execute a local security policy therein, the local security policy is configured to perform security protection to the host and set threshold values of the data;
• the host is configured to trigger an event when any one of the data exceeding corresponding threshold value;
• a monitoring server connected to the host and configured to judge whether the host is attacked according to the event, and configured to send a warning message when the host is really attacked;
• and
• a security center server connected to the monitoring server and the host and configured to receive the warning message;
• and configured to analyze the warning message to identify an attacked type to the host and generate an updated security policy;
• and
• a knowledge base connected to the security center server and configured to store the updated security policy generated from the security center server;
• wherein the security center server is configured to redeploy the host and update the local security policy according to the updated security policy.