CN103916376A - Cloud system with attack protection mechanism and its protection method - Google Patents

Abstract

The present invention discloses a cloud system with an attack protection mechanism and a protection method thereof, the system comprising a security center server, a monitoring server and a host. After the host is turned on, it accepts the deployment of the monitoring server to install a sensing program and run a local security rule. The host monitors itself through the sensing program and reports to the monitoring server when any data exceeds a threshold value. The monitoring server determines whether the host is under attack based on the relevant data reported, and notifies the security center server when it is determined to be under attack. When the security center server receives the notification, it analyzes what kind of attack the host has suffered based on the relevant data, and generates new security rules after the analysis. Finally, the security center server redeploys the attacked host according to the new security rules to update the local security rules running in the host.

Description

Cloud system with attack protection mechanism and its protection method

technical field

The present invention relates to a cloud system, in particular to a cloud system with an attack protection mechanism, and a protection method used in the cloud system.

Background technique

Generally speaking, when the cloud system is under attack (for example, a hacker invades from the outside, or the host is implanted with a Trojan horse to launch an internal attack), it is necessary for the administrator to make a judgment after detection, or import an algorithm for analysis. In order to obtain information such as the mode, source and purpose of the attack.

Moreover, in addition to finding out the above-mentioned attack information, it is necessary to further analyze the solution, so that the administrator can log in to the attacked host, and manually modify the internal settings of the host according to the solution, and then let the host The host can rule out this attack.

Furthermore, some cloud systems will add a filtering server that can provide packet filtering function, and all packets including data and/or instructions that will enter the cloud system will be first imported into the filtering server for filtering. After the filtering server confirms that there is no problem with the data or command, it will be sent to the corresponding host in the cloud system. However, under such a system architecture, once the filtering server is destroyed, all hosts in the cloud system will be disconnected from the outside, thus causing the problem that all hosts in the cloud system cannot be accessed.

Moreover, because all packets in the cloud system must first be filtered by the filter server, the network traffic (traffic) of the entire cloud system will be concentrated on the filter server, which will cause serious damage to the entire cloud system. It is a huge burden, which can easily affect the operation of the cloud system.

Contents of the invention

The main purpose of the present invention is to provide a cloud system with an attack protection mechanism and its protection method, which can generate new security rules and re-deploy the attacked host when the host is attacked, so as to eliminate the attack on the host attack.

To achieve the above purpose, the present invention provides a cloud system with an attack protection mechanism, including:

A host is installed with a sensing program to monitor various data of the host, and the host triggers an event when any of the data exceeds a threshold value;

a monitoring server, connected to the host, judging whether the host is under attack according to the event, and sending a warning message to the outside when it is determined that the host is under attack; and

A security center server, connected to the monitoring server and the host, to receive the warning information from the monitoring server;

Wherein, the security center server analyzes the warning information and generates an updated security rule, and redeploys the host computer according to the updated security rule.

The present invention also provides a cloud system attack protection method, wherein the cloud system includes a host, a monitoring server connected to the host, and a security center server connected to the host and the monitoring server, the attack protection method include:

a) The host monitors various data through a sensing program;

b) an event is triggered when any item of the data exceeds a threshold value;

c) The monitoring server judges whether the host is attacked according to the event;

d) The monitoring server generates a warning message and notifies the security center server when it is determined that the host is under attack;

e) The security center server receives the warning information from the monitoring server, analyzes what kind of attack the host is subjected to, and generates an updated security rule according to the analysis result; and

f) The security center server redeploys the host according to the updated security rules.

The present invention also provides a cloud system with an attack protection mechanism, including:

A host is installed with a sensing program to monitor various data of the host, and a local safety rule is run inside the host to protect the host and set a threshold value. An event is triggered when the data exceeds the threshold;

A monitoring server, connected to the host, judging whether the host is under attack according to the event, and sending a warning message to the outside when it is determined that the host is under attack;

A security center server, connected to the monitoring server and the host, receives the warning information from the monitoring server, analyzes the attack on the host, and generates an updated security rule based on the analysis result; and

A knowledge base, connected to the security center server, storing the updated security rules generated by the security center server;

Wherein, the security center server redeploys the host with the updated security rules, so as to update the local security rules running inside the host.

Compared with the previous technology, the present invention can achieve the effect that when the host monitors its own data, if it finds that it is under attack, it can notify the security center server through the monitoring server. Thus, the security center server can analyze what kind of attack the host may have suffered, and generate a new security rule for the purpose of excluding the attack, and then redeploy the host with the new security rule. Since the new security rules are generated in response to the attack, when the host is re-deployed with the new security rules, the attack can be effectively ruled out and the attack can be prevented. In this way, it really helps to improve the security of the entire cloud system.

Description of drawings

FIG. 1 is a system architecture diagram of a preferred embodiment of the present invention.

FIG. 2 is a schematic diagram of a cabinet of a cloud computer room according to a preferred embodiment of the present invention.

FIG. 3 is a system block diagram of a preferred embodiment of the present invention.

Fig. 4 is a deployment flowchart of a preferred embodiment of the present invention.

Fig. 5 is a flow chart of updating security rules in a preferred embodiment of the present invention.

Fig. 6 is a flow chart of attack notification in a preferred embodiment of the present invention.

Fig. 7 is a flow chart of attack protection in a preferred embodiment of the present invention.

FIG. 8 is a system block diagram of another preferred embodiment of the present invention.

FIG. 9 is a flowchart of a protection sequence in a preferred embodiment of the present invention.

Wherein, the reference signs are explained as follows:

1…monitoring server

10...notification rules

2, 2'...Security Center Server

20…Attack Analysis Algorithm

3… knowledge base

30…Updated Safety Rules

4…host

40…Sensing program

400...local security rules

41…computing endpoint host

42…Storage Endpoint Host

43…Network switch

5…cabinet

S10~S16...steps

S20~S24...steps

S30~S42...steps

S50~S58...steps

S60~S80...Steps

Detailed ways

A preferred embodiment of the present invention will be described in detail below in conjunction with the drawings.

First please refer to FIG. 1 , which is a system architecture diagram of a preferred embodiment of the present invention. The present invention mainly discloses a cloud system with an attack protection mechanism. As shown in the figure, the cloud system mainly includes a monitoring server 1 (management server), a security center server 2 (security center), and a knowledge base 3 (knowledge base ) and at least one host 4 (node). In this embodiment, these hosts 4 can be various physical machines (Physical Machine, PM), such as physical computing endpoint host 41 (computingnode), storage endpoint host 42 (storage node) or network switch 43 (switch), or , and may also be various virtual machines (Virtual Machine, VM), such as a virtual endpoint host (virtual node) or a virtual switch (virtual switch), etc., without limitation. For the convenience of description, a single host 4 will be used as an example in the description below, but the number of the host 4 is not limited to one.

The host 4 mainly acts as a corresponding role in the cloud system to provide services for clients. The monitoring server 1 is connected to the host 4 to monitor the operation status of the host 4. When the host 4 is abnormal, it will report to the monitoring server 1, and the monitoring server 1 will determine whether the host 4 is attacked. exception.

The attack referred to in this embodiment mainly refers to the attack behavior of viruses or hackers, and these attack behaviors will generally cause, for example, a sudden increase in the external throughput (throughput) of the host 4, or a certain internal file is destroyed. Implantation of Trojan horses leads to abnormal access rate, etc. Once the above situation is reported to the monitoring server 1, the monitoring server 1 can determine that the host 4 has indeed been attacked.

When the monitoring server 1 thinks that the host 4 has been attacked, it will notify the security center server 2 in the form of an event based on the monitored information at that time, and the security center server 2 will perform event evaluation, analysis and processing. The security center server 2 is the information security core of the entire cloud system. When the security center server 2 receives the event notification from the monitoring server 1, it can evaluate and analyze the host computer 4 according to the corresponding data provided by the algorithm. What kind of attack was encountered. In this way, the security center server 2 can generate a set of solutions in real time according to the analysis results, and re-deploy information security rules for the host 4 that has been attacked, so that the host 4 can be After re-deployment, use the new information security rules to rule out the previous attacks.

It is worth mentioning that, after each analysis, the security center server 2 will store the analysis result and the solution generated according to the analysis result in the knowledge base 3 . Thus, when a new host is activated in the cloud system, it can be directly deployed with the latest information security rules, so that the new host can protect other hosts from previous attacks.

Please refer to FIG. 2 , which is a schematic diagram of a cabinet of a cloud computer room according to a preferred embodiment of the present invention. In this embodiment, the monitoring server 1, the security center server 2, the knowledge base 3 and the host 4 in the cloud system can all be set in the same cabinet 5 in the cloud computer room, and pass through the cabinet 5 to each other. Connect with the physical cable of the network switch (not shown in the figure). Furthermore, in this embodiment, the single cabinet 5 in the cloud computer room is taken as an example. In other embodiments, the monitoring server 1, the security center server 2, the knowledge base 3 and the host 4 can also be set in Different cabinets in a cloud computer room are connected to each other through the network. However, the above is only a preferred specific embodiment of the present invention and should not be limited thereto.

Referring to FIG. 3 , it is a system block diagram of a preferred embodiment of the present invention. After the host 4 is started, it accepts the deployment of the monitoring server 1 , thereby installing a sensing program 40 and a local security rule 400 into the host 4 . The host 4 runs the local security rule 400 to perform security protection, and sets a corresponding threshold value for each data of the host 4 . It is worth mentioning that the local security rule 400 deployed by the monitoring server 1 to the host 4 is mainly a firewall rule, so that the host 4 can protect against various possible malicious attacks, but does not impose limited.

The host 4 is self-monitored through the sensing program 40 to monitor various data of the host 4, such as external throughput, CPU usage, hard disk capacity, temperature, file access rate, etc. . When the sensing program 40 monitors and finds that any item of data exceeds the threshold set by the local security rule 400 , an event will be triggered and reported to the monitoring server 1 .

More specifically, the sensing program 40 is deployed by the monitoring server 1 and installed into the host 4 , so the host 4 can report back to the monitoring server 1 through the sensing program 40 . When the event is triggered, the host 4 can generate event-related data (ie, the data related to the data exceeding the threshold), and report the event-related data to the monitoring server 1 at the same time.

When the event is triggered, the monitoring server 1 can judge according to the event whether the host 4 is under attack, or the data is unstable due to other problems. More specifically, the monitoring server 1 can run a notification rule 10 internally, and the monitoring server 1 analyzes the received event-related data through the notification rule 10, thereby determining whether the host 4 is indeed under attack.

If the event is caused by other factors, the monitoring server 1 will perform corresponding actions, and if it is determined that the host 4 is indeed under attack, the monitoring server 1 will generate a warning message based on the event-related data, and The security center server 2 is notified in an event mode. More specifically, after analysis, the monitoring server 1 can judge whether it complies with the notification standard established by the notification rule 10, and if it is met, send the warning message to notify the security center server 2, wherein the warning message includes Data related to this event.

After the security center server 2 receives the notification from the monitoring server 1 (that is, receives the warning message), it will evaluate the event to analyze what kind of attack the host 4 has suffered, and then according to the analysis results An updated security rule 30 is generated and stored in the knowledge base 3 . More specifically, the security center server 2 can run an attack analysis algorithm 20 internally, and the security center server 2 mainly analyzes the event-related data through the attack analysis algorithm 20, thereby obtaining the attack on the host 4. model, and then develop a corresponding solution. And, the updated security rule 30 is generated by the solution.

Finally, the security center server 2 redeploys the attacked host 4 according to the updated security rules 30 , thereby updating the local security rules 400 inside the host 4 to a new version. The technical feature of the present invention is that the updated security rule 30 is generated for the attack suffered by the host 4, so after the host 4 deploys the updated security rule 30, the attack can be easily ruled out. personnel has considerable benefits. It is worth mentioning that the updated security rule 30 can mainly be a firewall rule, which is used to protect the host 4 from various possible attacks, but it is not limited thereto.

For example, when the attack is an external attack, the security center server 2 can calculate the source (source address) of the attack according to the event-related data, thereby blocking the access of the source in the updated security rule 30 action. For another example, if the attack is an internal attack, the security center server 2 can also calculate which program or file is launching the attack according to the event-related data, and thus isolate the program or file in the updated security rule 30 , so that it cannot disturb other programs or files in the host 4, and delete it when the host 4 is idle. However, the above description is only a preferred specific example of the present invention. The security center server 2 can actually analyze different results for different attack methods, and then generate different updated security rules 30. limit.

Furthermore, in addition to the host 4 under attack, the security center server 2 can also redeploy all hosts in the cloud system according to the updated security rules 30, thereby preventing other hosts in the cloud system from The host is subjected to the same attack, so an effective defense mechanism can be achieved.

Please refer to FIG. 4 and FIG. 5 at the same time, which are respectively a deployment flow chart and a security rule update flow chart of a preferred embodiment of the invention. Referring first to FIG. 4 , to establish the cloud system of the present invention, firstly, the administrator needs to first order the host computer 4 to start up (step S10 ). More specifically, if the host 4 is a physical machine, the administrator can start it up by means of wake on lan, or directly press the physical power-on button (not shown) on the host 4 to start it; if The host 4 is a virtual machine, and the administrator can generate the host 4 through a standard virtual machine generation method.

Then, the monitoring server 1 will know the existence of the host 4, and deploy the corresponding sensing program 40 for the host 4 (step S12), thus, the sensing program 40 will perform self-control for the host 4 monitor. And, the monitoring server 1 can further deploy the required local security rules 400 for the host 4 (step S14), thereby allowing the host 4 to run the local security rules 400 for security protection (S16), and According to the local security rules 400, the threshold values of various data of the host 4 are set. After the step S16, the host 4 officially becomes the corresponding role in the cloud system of the present invention.

Next, as shown in FIG. 5 , when the host 4 is deployed with the local-end security rule 400, the host 4 can further ask the security center server 2 according to the local-end security rule 400 (step S20), and, by The security center server 2 inquires whether the updated security rule 30 has been generated (step S22). More specifically, the host 4 can ask the security center server 2 in the form of MD5 or Hash table to confirm the old and new relationship between the version of the local security rule 400 and the version of the security rule in the knowledge base 3 .

If the security center server 2 inquires and finds that the updated security rule 30 has not been generated, it means that the local security rule 400 is the latest version of the security rule, so the host 4 and the security center server 2 do not take any action. If the security center server 2 inquires and finds that the knowledge base 3 has the updated security rule 30, then the security center server 2 will use the updated security rule 30 to redeploy the host 4 (step S24). Thus, the version of the local security rule 400 in the host 4 is updated so that the host 4 can run in the best protection state.

Continue referring to FIG. 6 , which is a flow chart of attack notification in a preferred embodiment of the present invention. First, the host 4 carries out self-monitoring through the internal sensing program 40 (step S30), thereby obtaining various data of the host 4 itself, such as throughput, CPU usage, hard disk speed, hard disk capacity, temperature, Humidity, access rate of each program or file, etc. Next, periodically determine whether any item of data exceeds the threshold set by the local security rule 400 (step S32 ). If all the data are correct and there is no phenomenon exceeding the threshold value, then the host 4 does not take any action, and continues to monitor itself through the sensing program 40 .

Furthermore, when any item of data exceeds the threshold, the host 4 triggers an event and automatically reports to the monitoring server 1 (step S34). More specifically, the host 4 can report the event-related data (that is, the data related to the data that exceeds the threshold) to the monitoring server 1 when the event is triggered, so that the monitoring server 1 for detailed analysis.

After the event is triggered, the monitoring server 1 mainly receives the event-related data reported by the host 4 (step S36), and analyzes the event-related data according to the notification rule 10 of internal operation (step S38), thus , judging whether the host 4 is really under attack (step S40). If the monitoring server 1 finds that the notification standard set by the notification rule 10 is not met after analysis, it means that the host 4 is not attacked, but the data is unstable due to other factors. In this case, the monitoring server 1 will perform corresponding actions (such as recording data or notifying management personnel, etc.), but will not notify the security center server 2 .

However, if the monitoring server 1 finds that the host 4 is indeed under attack after analysis, the monitoring server 1 will notify the security center server 2 with the warning message (step S42). More specifically, the monitoring server 1 mainly generates the warning information based on the event-related data to notify the security center server 2, thereby allowing the security center server 2 to monitor the attack mode through the event-related data. detailed analysis.

Next, please refer to FIG. 7 , which is a flow chart of attack protection in a preferred embodiment of the present invention. When the host 4 is suspected of being attacked, it will report to the monitoring server 1, and when the monitoring server 1 confirms that the host 4 is indeed attacked, it will notify the security center server 2. The security center server 2 receives the warning information from the monitoring server 1 (step S50 ), and analyzes what kind of attack the host 4 is subjected to. More specifically, the security center server 2 analyzes the event-related data through the attack analysis algorithm 20 running internally (step S52), thereby analyzing the attack pattern, and then generates the updated security rule according to the analysis result 30 (step S54). That is to say, the updated security rule 30 is updated based on the original security rule and the solution obtained after analysis. Therefore, the updated security rule 30 can effectively eliminate the attack.

After the step S54, the security center server 2 uses the updated security rules 30 to redeploy the attacked host 4 (step S56). And as mentioned above, the updated security rule 30 is born due to the attack, so when the host 4 deploys the updated security rule 30, the attack can be easily ruled out, so that the operation of the host 4 and various Data returned to normal. It is worth mentioning that, except the host 4 under attack, the security center server 2 can use the updated security rules 30 to redeploy all hosts in the cloud system (step S58). The advantage of this is that the updated security rule 30 increases the protection against the attack, so when all the hosts in the cloud system deploy the updated security rule 30, these hosts will not be affected by the host 4 once. suffered attacks. That is to say, for other hosts, it can effectively achieve the effect of prevention.

Through the system and method of the present invention, as long as any host in the cloud system is attacked, and the attack is notified to the security center server 2 via the monitoring server 1, the security center server 2 will analyze it and generate After the updated security rule 30, as long as all hosts in the cloud system accept redeployment and run the updated security rule 30, all hosts in the cloud system will no longer be affected by the same attack mode.

Referring to FIG. 8 , it is a system block diagram of another preferred embodiment of the present invention. In the foregoing embodiments, the knowledge base 3 mainly takes an independent server in the cloud system as an example, which is responsible for storing the updated security rules 30 and is connected to the security center server 2 through a physical connection line or network. However, in this embodiment, the cloud system can also provide another security center server 2', the security center server 2' internally provides a storage unit, and uses the storage unit as the knowledge base 3 in the cloud system . In this embodiment, the cloud system does not need to provide an additional physical server as the knowledge base 3, so the number of servers can be effectively saved. However, the above is only another specific example of the present invention. The knowledge base 3 is served by an independent server, or integrated with the security center server 2', depending on the actual needs of the cloud system, and should not This is the limit.

Referring to FIG. 9 , it is a flowchart of a protection sequence in a preferred embodiment of the present invention. In the cloud system of the present invention, the monitoring server 1 first needs to deploy the sensing program 40 for all the hosts 4 (step S60), and then the monitoring server 1 deploys the local Terminal security rules 400 (step S62). Then, the host 4 inquires whether the security center server 2 is the latest version according to the local security rules 400 (step S64), and then, if it is the latest version, the security center server 2 can reply that the host 4 is the latest version; and If the updated security rule 30 is generated in the knowledge base 3, the security center server 2 can redeploy the host computer 4 to upgrade the local security rule 400 to the updated security rule 30 (step S66) .

After the host 4 is started, it continuously monitors itself through the sensing program 40 to sense various data of the host 4 (step S68 ). And, when any item of data exceeds the threshold set by the local security rule 400, an event is triggered and reported to the monitoring server 1 (step S70). After the monitoring server 1 accepts the report, it first analyzes the event to determine whether the host 4 is attacked (step S72), and when it is determined that the host 4 is attacked, it notifies the security center server 2 with the warning message (step S74 ).

After the security center server 2 receives the warning information, it analyzes the attack mode, and according to the analysis result, generates the updated security rule 30 (step S76), and stores the updated security rule 30 in the knowledge base 3 (Step 78 ), thereby upgrading the existing security rules in the knowledge base 3 to the updated security rules 30 . Finally, the security center server 2 re-deploys the attacked host 4 according to the updated security rules 30 (step S80), thereby updating the local security rules 400 inside the host 4, so that the updated The local security rule 400 can exclude the host 4 from being attacked, so that the host 4 can resume stable operation. Moreover, after the step S80, the host 4 continues to monitor itself through the sensing program 40, so as to monitor the next possible attack.

The above descriptions are only preferred specific examples of the present invention, and are not intended to limit the patent scope of the present invention. Therefore, all equivalent changes made by using the content of the present invention are all included in the scope of the present invention in the same way, and are suitable for the present invention. Chen Ming.

Claims (20)

1. tool is attacked a high in the clouds system for preventing mechanism, comprising:

One main frame, is provided with a detection procedure, monitors every data of this main frame, and this main frame triggers an event in the time that these data of any one exceed a threshold value;

One monitoring server, connects this main frame, judges according to this event whether this main frame is attacked, and externally sends a warning message in the time that definite this main frame is attacked; And

One security centre's server, connects this monitoring server and this main frame, receives this warning message of this monitoring server;

Wherein, this security centre's server analyze this warning message and produce a renewal after safety regulation, and with safety regulation after this renewal, this main frame is re-started to deployment.

2. high in the clouds as claimed in claim 1 system, wherein this main frame internal operation one local side safety regulation, to carry out the security protection of this main frame and to set this threshold value, this security centre's server with this renewal after safety regulation this main frame is re-started to deployment, to upgrade this local side safety regulation.

3. high in the clouds as claimed in claim 2 system, wherein after this local side safety regulation and this renewal, safety regulation is a firewall rule.

4. high in the clouds as claimed in claim 1 system, wherein this main frame is entity machine, virtual machine, the network switch or virtual network switch.

5. tool as claimed in claim 1 is attacked the high in the clouds system of preventing mechanism, wherein also comprises a knowledge base, connects this security centre's server, stores safety regulation after this renewal that this security centre's server produces.

6. high in the clouds as claimed in claim 5 system, wherein this main frame, this monitoring server, this security centre's server and this knowledge base are arranged in the same rack of high in the clouds machine room.

7. high in the clouds as claimed in claim 1 system, when wherein this main frame triggers this event, return an event related data to this monitoring server simultaneously, this monitoring server internal operation one notification rule, analyze this event related data according to this notification rule, to judge whether this main frame is attacked, and in the time that definite this main frame is attacked, this monitoring server produces this warning message to notify this security centre's server according to this event related data.

8. high in the clouds as claimed in claim 7 system, wherein this security centre's server internal operation one attack analysis algorithm, this security centre's server is according to this this event related data of attack analysis Algorithm Analysis, with the attack mode that show that this main frame suffers, and produces according to this safety regulation after this renewal.

9. an attack guarding method for high in the clouds system, the monitoring server that wherein this high in the clouds system comprises a main frame, is connected with this main frame, and the security centre's server being connected with this main frame and this monitoring server, this attack guarding method comprises:

A) this main frame is monitored every data by a detection procedure;

B) in the time having these data of any one to exceed a threshold value, trigger an event;

C) this monitoring server judges according to this event whether this main frame is attacked;

D) this monitoring server produces a warning message and notifies this security centre's server in the time that definite this main frame is attacked;

E) this security centre's server receives this warning message of this monitoring server, analyzes according to this this main frame and attacked by which kind of, and produce the rear safety regulation of a renewal according to analysis result; And

F) this security centre's server according to this renewal after safety regulation this main frame is re-started to deployment.

10. attack guarding method as claimed in claim 9, wherein also comprises a step g: this security centre's server according to this renewal after safety regulation, all main frames of being attacked in this high in the clouds system are re-started to deployment.

11. attack guarding methods as claimed in claim 9, wherein this step c comprises the following steps:

C1) this monitoring server receives the event related data that this main frame produces and returns according to this event; And

C2) this monitoring server is analyzed this event related data according to a notification rule, to judge whether this main frame is attacked;

Wherein, in this steps d, this monitoring server produces this warning message to notify this security centre's server according to this event related data.

12. attack guarding methods as claimed in claim 11, wherein this step e comprises the following steps:

E1) this security centre's server receives this event related data;

E2) according to an attack analysis algorithm, this event related data is analyzed, to judge this main frame is attacked by which kind of; And

E2) produce safety regulation after this renewal according to analysis result.

13. attack guarding methods as claimed in claim 9, wherein also comprise the following steps: before this step a

A01) this main frame start;

A02) this monitoring server is disposed this detection procedure for this main frame;

A03) this monitoring server is disposed a local side safety regulation for this main frame; And

A04) this main frame moves this local side safety regulation, to carry out security protection and to set this threshold value.

14. attack guarding methods as claimed in claim 13, wherein also comprise the following steps: before this step a

A05) this main frame proposes inquiry according to this local side safety regulation to this security centre's server;

A06) whether this security centre's server lookup has safety regulation after this renewal; And

A07) if there is safety regulation after this renewal, this security centre's server re-starts deployment according to safety regulation after this renewal to this main frame, to upgrade this local side safety regulation.

15. attack guarding methods as claimed in claim 14, wherein this high in the clouds system also comprises a knowledge base that connects this security centre's server, store safety regulation after this renewal, in this step a06, this security centre's server inquires about whether there is safety regulation after this renewal in this knowledge base.

16. attack guarding methods as claimed in claim 13, wherein after this local side safety regulation and this renewal, safety regulation is a firewall rule.

17. 1 kinds of tools are attacked the high in the clouds system of preventing mechanism, comprising:

One main frame, one detection procedure is installed, monitors every data of this main frame, and this main frame internal operation there is a local side safety regulation, to carry out the security protection of this main frame and to set a threshold value, this main frame triggers an event in the time that these data of any one exceed this threshold value;

One monitoring server, connects this main frame, judges according to this event whether this main frame is attacked, and externally sends a warning message in the time that definite this main frame is attacked;

One security centre's server, connects this monitoring server and this main frame, receives this warning message of this monitoring server, analyzes according to this this main frame and attacked by which kind of, and produce the rear safety regulation of a renewal according to analysis result; And

One knowledge base, connects this security centre's server, stores safety regulation after this renewal that this security centre server produces;

Wherein, this security centre's server with this renewal after safety regulation this main frame is re-started to deployment, to upgrade this local side safety regulation of this main frame internal operation.

18. high in the clouds as claimed in claim 17 systems, when wherein this main frame triggers this event, return an event related data to this monitoring server simultaneously, this monitoring server internal operation one notification rule, analyze this event related data according to this notification rule, to judge whether this main frame is attacked, and in the time that definite this main frame is attacked, this monitoring server produces this warning message to notify this security centre's server according to this event related data.

19. high in the clouds as claimed in claim 18 systems, wherein this security centre's server internal operation one attack analysis algorithm, this security centre's server is according to this this event related data of attack analysis Algorithm Analysis, with the attack mode that show that this main frame suffers, and produce according to this safety regulation after this renewal.

20. high in the clouds as claimed in claim 17 systems, wherein this knowledge base is arranged in this security centre's server.