After the Security Center agent is installed on your servers, Security Center collaborates with Alibaba Cloud to protect your servers. Security Center provides a wide array of features, including alerting, vulnerability management, antivirus, baseline checks, and attack analysis.
Information about suspicious files
Security Center can detect suspicious files on your servers. After Security Center detects a suspicious file, information about the file is uploaded to Alibaba Cloud for further verification. The file information includes but is not limited to the file path, MD5 hash value, and creation time. If the suspicious file is determined as a malicious file, Security Center sends you an alert notification.
Information about suspicious processes
Security Center can detect suspicious processes on your servers. After Security Center detects a suspicious process, information about the process is uploaded to Alibaba Cloud for further verification. The process information includes but is not limited to the process name, parameters used to start the process, file path of the process, and start time of the process. If the suspicious process is determined as a malicious process, Security Center sends you an alert notification.
Information about accounts
Security Center provides features such as logon audit, suspicious account alerting, and brute-force attack prevention. Security Center regularly analyzes and uploads account and logon information about protected servers. The account information includes but is not limited to the usernames and user permissions. The logon information includes but is not limited to the usernames and IP addresses that are used for logons. If a logon is determined as an unusual logon, Security Center sends you an alert notification.
Information about suspicious connections
Security Center detects suspicious network connections to your servers. After Security Center detects a suspicious network connection, information about the connection is uploaded to Alibaba Cloud for further verification. The connection information includes but is not limited to the source IP address, source port, destination IP address, and destination port. If the suspicious network connection is determined as a malicious connection, Security Center sends you an alert notification.
Information about servers
Security Center supports server management. Security Center regularly collects information about servers. The server information includes but is not limited to the software information, port listening information, and information about the websites running on your servers. You can log on to the Security Center console and view the information on the Assets page.
Security Center provides the feature of container image scan. Security Center regularly scans containers to check whether vulnerabilities and malicious files exist in your images. You can log on to the Security Center console and view detected vulnerabilities and malicious files on the Image Security page.
Container security in runtime
To ensure container security in runtime, Security Center dynamically detects threats, including viruses, malicious programs, intrusions, container escapes, and high-risk operations in the runtime of containers. If threats are detected in the runtime of containers, Security Center sends you an alert notification.
- ×: This edition does not support this check item.
- √: This edition supports this check item.
- 〇: The Basic and Anti-virus editions of Security Center support only the automatic detection of vulnerabilities. These editions do not support quick scan for vulnerabilities or fixing of vulnerabilities. Before you can use Security Center to run manual scan tasks, you must upgrade Security Center to the Advanced, Enterprise, or Ultimate edition. If you want to use Security Center to fix detected vulnerabilities, you must upgrade Security Center to the Advanced, Enterprise, or Ultimate edition.
|Linux software vulnerabilities||〇||〇||√||√||√|
|Windows system vulnerabilities||〇||〇||√||√||√|
|Webpage Tampering||Security Center monitors web directories in real time and restores tampered files
or directories by using the backup files. This protects websites from malicious modifications,
trojans, hidden links, and uploads of violent or illicit content. Security Center
can detect the following suspicious activities:
Note Web tamper proofing is a value-added feature that is provided by Security Center. To use the feature, you must purchase and enable the feature. Security Center Anti-virus, Advanced, Enterprise, and Ultimate support web tamper proofing. Security Center Basic does not support web tamper proofing. For more information, see Overview of web tamper proofing.
|Suspicious Process||Security Center can detect the following suspicious processes:
|Webshell||Security Center uses engines developed by Alibaba Cloud to scan for common webshell
files. Security Center supports scheduled scan tasks, provides real-time protection,
and quarantines webshell files.
Note Security Center Basic detects only some types of webshells. If you want to detect all types of webshells, we recommend that you upgrade Security Center Basic to the Anti-virus, Advanced, Enterprise, or Ultimate edition. For more information, see Upgrade and downgrade Security Center.
|Unusual Login||Security Center detects unusual logons to your servers. You can configure approved
logon IP addresses, time periods, and accounts. Logons from unapproved IP addresses,
accounts, or time periods trigger alerts. You can manually add approved logon locations
or configure the system to automatically update approved logon locations. You can
also specify the assets on which alerts are triggered when unusual logon locations
Security Center can detect the following logon events:
|Suspicious Event||Security Center detects suspicious activities.|
|Sensitive File Tampering||Security Center checks whether the sensitive files on your servers are tampered with. The sensitive files include pre-loaded configuration files in the shared libraries of Linux.|
|Malicious Process||Security Center uses an agent to scan your servers in real time. If viruses are detected,
Security Center generates alerts. You can handle the detected viruses in the Security Center console.
Security Center can detect the following malicious activities and processes:
|Unusual Network Connection||Security Center detects unusual network connections and disconnections.
Security Center can detect the following suspicious network activities:
|Other||Security Center detects unusual disconnections of the Security Center agent and network intrusions such as DDoS attacks.|
|Suspicious Account||Security Center detects unapproved accounts that attempt to log on to your assets.|
|Application intrusion event||Security Center detects intrusions that use system application components.|
|Cloud threat detection||Security Center detects whether threats exist in the other Alibaba Cloud services that you have purchased. The threats include suspicious deletion of ECS security group rules.|
|Precise defense||The antivirus feature provides precise protection against common ransomware, DDoS trojans, mining programs, trojans, malicious processes, webshells, and computer worms. For more information about how to enable the feature, see Use proactive defense.|
|Application Whitelist||You can create a whitelist policy for servers that require reinforced protection. If the suspicious or malicious processes that are identified by the policy are not added to the whitelist, Security Center generates alerts.|
|Persistence||Security Center detects suspicious scheduled tasks on servers. If persistent threats against the servers are detected, Security Center generates alerts.|
|Web Application Threat Detection||Security Center detects intrusions that use web applications.|
|Malicious scripts||Security Center detects whether the system services of your assets are attacked or
modified by malicious scripts. If potential script attacks are detected, Security
Center generates alerts.
Malicious scripts are classified into file-based scripts and fileless scripts. After an attacker gains control over a server, the attacker uses scripts for additional attacks. For example, the attacker may insert mining programs and webshells, or add administrator accounts to your system. Programming languages of malicious scripts include Bash, Python, Perl, PowerShell, Batch, and VBScript.
|Threat intelligence||Security Center uses the threat intelligence library developed by Alibaba Cloud to perform correlation analysis on access traffic and logs. Security Center also detects threat events, including access to malicious domains, malicious download sources, and malicious IP addresses.|
|Malicious Network Activity||Security Center identifies unusual network behavior based on log data, such as packet content and server behavior. Unusual network behavior includes intrusions into servers by using network services and unusual behavior of compromised servers.|
|K8s Abnormal Behavior||Security Center monitors the security status of running containers in a Kubernetes
cluster. This allows you to detect security risks and intrusions at the earliest opportunity.
Log on to the Security Center console and click Settings in the left-side navigation pane. In the K8s Threat Detection section of the General tab, you can turn on Threat Detection to allow Security Center to detect the exceptions to Kubernetes clusters. For more information, see Use threat detection on Kubernetes containers.
|Trusted exception||Security Center detects whether your system processes have been modified and whether exceptions occur when you start the system.|