Information security cloud computing platform based on intelligent computing center

Abstract

The invention relates to the technical field of information security, in particular to an information security cloud computing platform based on an intelligent computing center, which comprises a user identity and access control module, a self-adaptive threat detection module, a data protection and backup module, a virtualization and resource management module, an edge computing collaborative security module and a security event management module, the user identity and access control module performs identity verification and management; the self-adaptive threat detection module automatically analyzes and identifies novel security threats; the data protection and backup module encrypts the stored and transmitted data; the virtualization and resource management module manages and monitors the security state of the virtual machine; the edge computing collaborative security module deploys a security agent at an edge node; and the security event management module records security events of the platform. According to the method, the accuracy and real-time performance of threat detection and response are improved, and efficient and safe operation of the platform is ensured.

Description

Technical Field

[0001] The present invention relates to the field of information security technology, and in particular to an information security cloud computing platform based on an intelligent computing center. Background Art

[0002] With the rapid development of cloud computing technology, cloud computing platforms are being used more and more widely in various industries. However, information security issues in cloud computing environments are becoming increasingly prominent, becoming an important factor restricting the further development of cloud computing. Cloud computing platforms usually involve a large number of users' sensitive data and business operations. Once a security incident occurs, it will cause huge losses to users and platforms. Therefore, how to build an efficient and secure information security cloud computing platform is an urgent problem to be solved in the current cloud computing field.

[0003] The existing cloud computing platform has many shortcomings in information security. First, the user authentication and access control mechanisms are relatively simple and can be easily bypassed or attacked, leading to unauthorized access and data leakage. Second, the existing threat detection technology mainly relies on traditional rule matching and statistical analysis methods, which are difficult to cope with complex and changeable new security threats, and the detection accuracy and response speed are insufficient. In addition, the traditional centralized security management model is prone to cause system bottlenecks, large data transmission and processing delays, and cannot achieve real-time and efficient security detection and response. The existing technology lacks effective use of distributed security detection and edge computing, and the overall security and management efficiency need to be improved.

[0004] The purpose of the present invention is to provide an information security cloud computing platform based on an intelligent computing center, to improve the overall security and response efficiency of the system, to solve many deficiencies in the prior art, and to significantly improve the information security management level of the cloud computing platform. Summary of the invention

[0005] Based on the above objectives, the present invention provides an information security cloud computing platform based on an intelligent computing center.

[0006] An information security cloud computing platform based on an intelligent computing center includes a user identity and access control module, an adaptive threat detection module, a data protection and backup module, a virtualization and resource management module, an edge computing collaborative security module, and a security event management module, wherein; The user identity and access control module authenticates and manages users who access the platform; The adaptive threat detection module automatically analyzes and identifies new security threats and provides threat detection and response, specifically including: Data collection: real-time collection of security monitoring data, including network traffic, operation logs, and user behavior data; Feature extraction: extract threat features from collected security monitoring data; Threat identification: Based on the extracted threat features, a threat detection model is constructed, and security threats are identified and classified through the threat detection model; Threat response: Automatically generate and execute response strategies based on threat identification results; The data protection and backup module encrypts the stored and transmitted data and regularly backs up user data; The virtualization and resource management module manages and monitors the security status of virtual machines, and schedules and manages the computing resources of the intelligent computing center; The edge computing collaborative security module deploys security agents on edge nodes and uses edge computing resources to perform distributed security detection and response; The security event management module records and analyzes the security events of the platform and provides security logs.

[0007] Furthermore, the user identity and access control module includes: Multi-factor authentication mechanism: a combination of password, SMS verification, fingerprint recognition, facial recognition or iris recognition; Role and permission management: dynamically assign access rights based on the user's role and permission level; Real-time monitoring and logging: real-time monitoring of user access behavior and recording of access logs; Security policy application: Apply predefined security policies and dynamically adjust access control rules based on user identity and access behavior; Identity management and audit: Regularly review and update user identity information, and perform identity verification and authentication management for users.

[0008] Furthermore, the feature extraction includes: Data preprocessing: Clean, normalize and reduce the dimension of the collected security monitoring data to eliminate noise and redundant information; Time series analysis: Perform time series analysis on network traffic and user behavior data, and use sliding window technology to calculate traffic characteristics and behavior patterns; Frequency domain analysis: Perform frequency domain analysis on the operation log and use fast Fourier transform (FFT) to extract frequency features; Statistical feature extraction: Calculate the basic statistical features of security monitoring data, including mean, standard deviation, skewness and kurtosis; High-dimensional feature mapping: Use principal component analysis (PCA) to map high-dimensional features to a low-dimensional space.

[0009] Furthermore, the threat detection model adopts a convolutional neural network (CNN) model, and the convolutional neural network (CNN) model includes: Data preprocessing: normalize and standardize the collected security monitoring data; Multi-scale convolution: Use multi-scale convolution kernels (convolution kernels of different sizes) for convolution operation. The calculation formula is: Small-scale convolution kernel: ; Large-scale convolution kernel: ; in, and are the sizes of small-scale and large-scale convolution kernels, respectively. is the convolution kernel weight, is the bias, is the convolution output; Attention mechanism: The attention mechanism is introduced to weight the output of the convolutional layer. The calculation formula is: ; in, is the importance score of the feature, is the attention weight, and are the width and height of the feature map respectively; ; in, is the output feature of the convolutional layer, is the weighted feature; Pooling layer: A strategy combining maximum pooling and average pooling is adopted, and the calculation formula is: ; ; in, is the pooling window size, They are the outputs of maximum pooling and average pooling respectively; Fully connected layer and output: Flatten the feature map output by the pooling layer and input it into the fully connected layer for classification. The calculation formula is: ; in, is the flattened pooling layer output, is the weight of the fully connected layer, is the bias, For output, is the activation function (softmax).

[0010] Furthermore, the threat response includes: Threat assessment: Based on the threat identification results, the severity of the threat is assessed and the threat level is determined. The calculation formula is: ; in, is the threat score, For the The weight of the feature, For the The value of the feature, is the characteristic number; Strategy selection: Based on the threat level, a response strategy is selected from the predefined response strategy library. The calculation formula is: ; in, For the selected response strategy, To respond to the strategy set, To select a strategy for a given threat score The probability of Strategy generation: Generate response actions based on the selected response strategy, including blocking, isolation, alarming, and logging; Policy enforcement: Execute generated response actions through automated scripts and security tools.

[0011] Furthermore, the virtualization and resource management module includes: Virtual machine security monitoring: The integrated security agent monitors the virtual machine's operating status, network traffic, and operation logs in real time to detect abnormal behaviors and potential threats. The calculation formula is: ; in, Assign a security score to the virtual machine. For the The weight of the monitoring parameters, For the The value of the monitoring parameter, is the number of monitoring parameters; Resource utilization monitoring: Real-time monitoring of virtual machine and physical host resource usage, including CPU usage, memory usage, storage utilization, and network bandwidth usage. The calculation formula is: ; in, is the amount of resources used, is the total resources; Dynamic resource scheduling: Dynamically adjust the resource allocation and scheduling strategy of virtual machines based on the results of real-time resource utilization monitoring; Security policy application: Automatically apply or adjust security policies based on the results of virtual machine security monitoring, including network isolation, access control, and patch management; Automated management tools: Use automated management tools to perform virtual machine configuration, migration, and backup operations.

[0012] Furthermore, the edge computing collaborative security module includes: Edge security agent deployment: Deploy lightweight security agents on each edge node to collect and perform preliminary analysis of local data. Distributed data processing: Utilize the computing resources of edge nodes to perform distributed processing on locally collected data; Security detection: Real-time security detection is performed through security agents at edge nodes, including intrusion detection, abnormal behavior analysis, and malicious activity identification; Collaborative response: Based on the results of security detection, edge nodes independently or in collaboration with adjacent edge nodes execute security response strategies, including blocking suspicious traffic, isolating infected devices, and sending alarms to the central server.

[0013] Further, the edge security agent deployment includes: Lightweight security agent deployment: A lightweight security agent is deployed on each edge node. The lightweight security agent runs on the edge device and monitors network traffic, operation logs, and user behavior data. The calculation formula is: ; in, The dataset collected for edge nodes, For the data points; Preliminary data analysis: The lightweight security agent performs preliminary analysis on the collected data and uses anomaly detection algorithms based on statistical analysis to identify abnormal behaviors and potential threats, including: ; ; in, is the mean of the data set, is the standard deviation, For the data points, is the number of data points; ; in, For the Anomaly score for each data point; like , then it is believed that It is abnormal data; Edge data aggregation: Aggregate the results of preliminary data analysis and send them to the central server for analysis and response. The calculation formula is: ; in, is the sum of anomaly scores aggregated from edge nodes, is the number of abnormal data points.

[0014] Furthermore, the distributed data processing includes: Data sharding: Divide the locally collected data set into multiple data blocks. The calculation formula is: ; in, The dataset collected for edge nodes, For the data points, For the data blocks, is the number of shards; Parallel processing: Use the computing resources of edge nodes to process the divided data blocks in parallel. The calculation formula is: ; in, For the The processing result of each data block is For the processing function, For the data blocks; Result aggregation: Aggregate the processing results of each data block to form the overall processing result. The calculation formula is: ; in, For the overall processing results, For the The processing result of each data block is is the number of shards.

[0015] Furthermore, the safety detection includes: Intrusion detection: Identify intrusion behaviors by analyzing network traffic and operation logs. The calculation formula is: ; ; in, is the original data, is the mean, is the standard deviation, is the normalized data, is a known intrusion characteristic pattern; Abnormal behavior analysis: By analyzing user behavior data, anomaly detection algorithms based on statistical analysis can identify abnormal behaviors and potential threats; Malicious activity identification: By analyzing operation logs and network traffic, malicious activities are identified using a naive Bayes classifier.

[0016] Beneficial effects of the present invention: The present invention builds a comprehensive, intelligent and efficient information security management system by integrating user identity and access control module, adaptive threat detection module, data protection and backup module, virtualization and resource management module, edge computing collaborative security module and security event management module. The platform can realize all-round management and protection of user identity, data, virtual machines and security events, significantly improves the accuracy and real-time performance of threat detection and response, and ensures the efficient and safe operation of the platform.

[0017] In the present invention, through the collaborative work of the user identity and access control module and the adaptive threat detection module, the platform can perform multi-factor authentication, role and authority management, real-time monitoring and logging, and dynamic adjustment of security policies for users, effectively preventing unauthorized access and data leakage. At the same time, the adaptive threat detection module improves the recognition ability and detection accuracy of complex threat features through data collection, feature extraction, threat identification and threat response steps, using advanced convolutional neural network models and improved algorithms, enhances the focus on important features, and provides a fast and accurate threat response strategy.

[0018] The present invention deploys lightweight security agents at each edge node, utilizes edge computing resources for distributed data processing and real-time security detection, and realizes distributed security detection and response through intrusion detection, abnormal behavior analysis, and malicious activity identification. The virtualization and resource management module dynamically adjusts resource allocation and scheduling strategies to ensure efficient resource utilization and load balancing, improve system performance, reduce resource waste, and enhance system stability and responsiveness. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] In order to more clearly illustrate the technical solutions in the present invention or the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings in the following description are only for the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0020] Figure 1 A schematic diagram of a platform function module according to an embodiment of the present invention; Figure 2 Schematic diagram of an adaptive threat detection module according to an embodiment of the present invention. DETAILED DESCRIPTION

[0021] In order to make the objectives, technical solutions and advantages of the present invention more clearly understood, the present invention is further described in detail below in conjunction with specific embodiments.

[0022] It should be noted that, unless otherwise defined, the technical terms or scientific terms used in the present invention should be understood by people with ordinary skills in the field to which the present invention belongs. The words "first", "second" and similar words used in the present invention do not indicate any order, quantity or importance, but are only used to distinguish different components. "Include" or "comprise" and similar words mean that the elements or objects appearing before the word include the elements or objects listed after the word and their equivalents, without excluding other elements or objects. "Connect" or "connected" and similar words are not limited to physical or mechanical connections, but may include electrical connections, whether direct or indirect. "Up", "down", "left", "right" and the like are only used to indicate relative positional relationships. When the absolute position of the described object changes, the relative positional relationship may also change accordingly.

[0023] like Figure 1-Figure 2 As shown, an information security cloud computing platform based on an intelligent computing center includes a user identity and access control module, an adaptive threat detection module, a data protection and backup module, a virtualization and resource management module, an edge computing collaborative security module, and a security event management module, wherein; The user identity and access control module authenticates and manages users accessing the platform, preventing unauthorized access and ensuring the uniqueness and security of user identities; The adaptive threat detection module automatically analyzes and identifies new security threats and provides threat detection and response, including: Data collection: real-time collection of security monitoring data, including network traffic, operation logs, and user behavior data; Feature extraction: extract threat features from collected security monitoring data; Threat identification: Based on the extracted threat features, a threat detection model is constructed, and security threats are identified and classified through the threat detection model; Threat response: Automatically generate and execute response strategies based on threat identification results; The data protection and backup module encrypts the stored and transmitted data and regularly backs up user data to prevent data leakage and loss during transmission; The virtualization and resource management module manages and monitors the security status of virtual machines, schedules and manages the computing resources of the intelligent computing center, and ensures efficient use and secure isolation of resources; The edge computing collaborative security module deploys security agents on edge nodes and uses edge computing resources for distributed security detection and response to improve real-time performance and processing efficiency. The security event management module records and analyzes the security events of the platform, provides security logs, and ensures the coordinated operation of each module; Through the above content, comprehensive management and protection of user identity, data, virtual machines and security incidents are achieved, providing efficient threat detection and response, data transmission security, efficient resource utilization and real-time security detection, ensuring the efficient and safe operation of the platform, and effectively solving the information security problems in existing technologies. It is highly innovative and practical.

[0024] The user identity and access control module includes: Multi-factor authentication mechanism: Combining passwords, SMS verification, fingerprint recognition, facial recognition or iris recognition to ensure the uniqueness and security of user identity; Role and permission management: dynamically assign access rights based on the user's role and permission level to ensure that only authorized users can access specific resources and perform specific operations; Real-time monitoring and logging: real-time monitoring of user access behavior, recording access logs, and timely detection and response to abnormal access behavior; Security policy application: Apply predefined security policies and dynamically adjust access control rules based on user identity and access behavior to prevent unauthorized access and data leakage; Identity management and audit: Regularly review and update user identity information to ensure the legitimacy and accuracy of user identities, and perform identity verification and authentication management on users; Through the above content, the uniqueness and security of user identity can be effectively ensured, unauthorized access and data leakage can be prevented, dynamic access control and compliance management can be achieved, and the overall security and management efficiency of the platform can be improved.

[0025] Feature extraction includes: Data preprocessing: Clean, normalize and reduce the dimension of the collected security monitoring data to eliminate noise and redundant information and ensure data quality; Time series analysis: Perform time series analysis on network traffic and user behavior data, and use sliding window technology to calculate traffic characteristics and behavior patterns. The calculation formula is: ; in, is the original data in the time series, is the mean value in the sliding window, is the standard deviation within the sliding window, is the normalized data; Frequency domain analysis: Perform frequency domain analysis on the operation log and use fast Fourier transform (FFT) to extract frequency features. The calculation formula is: ; in, is the time domain signal, is the frequency domain signal, is the number of data points, is the frequency; Statistical feature extraction: Calculate the basic statistical features of security monitoring data, including mean, standard deviation, skewness and kurtosis. The calculation formula is: Mean ; Standard Deviation ; Skewness ; Kurtosis ; in, is the data point, is the mean, is the standard deviation, is the number of data points; High-dimensional feature mapping: Use principal component analysis (PCA) to map high-dimensional features to low-dimensional space for subsequent analysis. The calculation formula is: ; in, is the data after dimension reduction, is the original data matrix, is the eigenvector matrix; Through the above method, threat features can be efficiently extracted from security monitoring data, providing accurate feature input for threat identification and response, and significantly improving the accuracy and response speed of threat detection.

[0026] The threat detection model uses a convolutional neural network (CNN) model, which includes: Data preprocessing: Normalize and standardize the collected security monitoring data to reduce the impact of noise and data deviation on model training. The calculation formula is: ; in, is the original data, and are the minimum and maximum values ​​of the data, respectively. is the normalized data; ; in, is the original data, is the mean, is the standard deviation, is the standardized data; Multi-scale convolution: Use multi-scale convolution kernels (convolution kernels of different sizes) for convolution operations to capture features of different scales and improve the ability to identify threat features. The calculation formula is: Small-scale convolution kernel: ; Large-scale convolution kernel: ; in, and are the sizes of small-scale and large-scale convolution kernels, respectively. is the convolution kernel weight, is the bias, is the convolution output; Attention mechanism: The attention mechanism is introduced to weight the output of the convolutional layer to highlight important features and improve the detection accuracy of the model. The calculation formula is: ; in, is the importance score of the feature, is the attention weight, and are the width and height of the feature map respectively; ; in, is the output feature of the convolutional layer, is the weighted feature; Pooling layer: A combination of maximum pooling and average pooling is used to retain important features while reducing data dimensions. The calculation formula is: ; ; in, is the pooling window size, They are the outputs of maximum pooling and average pooling respectively; Fully connected layer and output: Flatten the feature map output by the pooling layer and input it into the fully connected layer for classification. The calculation formula is: ; in, is the flattened pooling layer output, is the weight of the fully connected layer, is the bias, For output, is the activation function (softmax); Through the above content, security monitoring data can be better processed and analyzed, the model's recognition ability and detection accuracy of complex threat features are improved, the focus on important features is enhanced, the data dimension is reduced, and the computing efficiency is improved, thereby providing more accurate and efficient threat detection and response capabilities.

[0027] Threat responses include: Threat assessment: Based on the threat identification results, the severity of the threat is assessed and the threat level is determined. The calculation formula is: ; in, is the threat score, For the The weight of the feature, For the The value of the feature, is the characteristic number; Strategy selection: Based on the threat level, a response strategy is selected from the predefined response strategy library. The calculation formula is: ; in, For the selected response strategy, To respond to the strategy set, To select a strategy for a given threat score The probability of Strategy generation: Generate response actions based on the selected response strategy, including blocking, isolation, alarming, and logging; Policy enforcement: Execute the generated response actions through automated scripts and security tools; Through the above content, it is possible to automatically generate and execute effective response strategies based on the results of threat identification, achieve rapid and accurate threat response, improve the security and stability of the platform, reduce human intervention and response time, and ensure timely handling of various security threats and continuous protection of the system.

[0028] The virtualization and resource management modules include: Virtual machine security monitoring: The integrated security agent monitors the virtual machine's operating status, network traffic, and operation logs in real time to detect abnormal behaviors and potential threats. The calculation formula is: ; in, Assign a security score to the virtual machine. For the The weight of the monitoring parameters, For the The value of the monitoring parameter, is the number of monitoring parameters; Resource utilization monitoring: Real-time monitoring of virtual machine and physical host resource usage, including CPU usage, memory usage, storage utilization, and network bandwidth usage, to ensure efficient resource utilization and load balancing. The calculation formula is: ; in, is the amount of resources used, is the total resources; Dynamic resource scheduling: According to the results of real-time resource utilization monitoring, dynamically adjust the resource allocation and scheduling strategy of the virtual machine to optimize resource utilization and reduce resource waste; Security policy application: Automatically apply or adjust security policies based on the results of virtual machine security monitoring, including network isolation, access control, and patch management, to ensure the security of virtual machines; Automated management tools: Use automated management tools to perform virtual machine configuration, migration, and backup operations, simplify management processes, and improve management efficiency; Through the above content, resource allocation and scheduling strategies can be dynamically adjusted to ensure efficient resource utilization and load balancing. By automatically increasing or decreasing resource allocation and migrating virtual machines to achieve load balancing, system performance is improved, resource waste is reduced, system stability and responsiveness are enhanced, management processes are simplified, and overall management efficiency is improved.

[0029] The edge computing collaborative security module includes: Edge security agent deployment: Deploy lightweight security agents on each edge node to collect and perform preliminary analysis of local data. Distributed data processing: Utilize the computing resources of edge nodes to perform distributed processing on locally collected data, reduce the pressure of data transmission to the central server, and improve response speed; Security detection: Real-time security detection is performed through security agents at edge nodes, including intrusion detection, abnormal behavior analysis, and malicious activity identification; Collaborative response: Based on the results of security detection, edge nodes independently or in collaboration with adjacent edge nodes execute security response strategies, including blocking suspicious traffic, isolating infected devices, and sending alarms to the central server; Through the above content, security agents can be deployed on edge nodes, and edge computing resources can be used for distributed security detection and response, thereby improving the security and response efficiency of the overall system.

[0030] Edge security agent deployment includes: Lightweight security agent deployment: A lightweight security agent is deployed on each edge node. The lightweight security agent runs on the edge device and monitors network traffic, operation logs, and user behavior data. The calculation formula is: ; in, The dataset collected for edge nodes, For the data points; Preliminary data analysis: The lightweight security agent performs preliminary analysis on the collected data and uses anomaly detection algorithms based on statistical analysis to identify abnormal behaviors and potential threats, including: ; ; in, is the mean of the data set, is the standard deviation, For the data points, is the number of data points; ; in, For the Anomaly score for each data point; like , then it is believed that It is abnormal data; Edge data aggregation: Aggregate the results of preliminary data analysis and send them to the central server for analysis and response. The calculation formula is: ; in, is the sum of anomaly scores aggregated from edge nodes, is the number of abnormal data points; Through the above method, lightweight security agents can be effectively deployed on each edge node to collect and preliminarily analyze local data, and promptly detect and respond to security threats.

[0031] Distributed data processing includes: Data sharding: Divide the locally collected data set into multiple data blocks to facilitate parallel processing on edge nodes. The calculation formula is: ; in, The dataset collected for edge nodes, For the data points, For the data blocks, is the number of shards; Parallel processing: Utilize the computing resources of edge nodes to process the divided data blocks in parallel to improve processing efficiency and response speed. The calculation formula is: ; in, For the The processing result of each data block is For the processing function, For the data blocks; Result aggregation: Aggregate the processing results of each data block to form the overall processing result. The calculation formula is: ; in, For the overall processing results, For the The processing result of each data block is is the number of shards; Through the above content, the efficiency and response speed of data processing are improved, the pressure of data transmission to the central server is reduced, the real-time and reliability of the system are ensured, and at the same time, the effective integration of the processing results of each edge node is guaranteed, thereby improving the security and management efficiency of the overall system.

[0032] Processing Function Specifically include: Data preprocessing: normalize and denoise the data. The calculation formula is: ; in, is the normalized data, is the original data, and are the minimum and maximum values ​​in the data set, respectively; Feature extraction: Extract key features from the data, including mean, standard deviation, and kurtosis. The calculation formula is: ; ; ; Preliminary analysis: Use K-means clustering to classify or cluster the data. The calculation formula is: ; in, is the clustering objective function, is the number of clusters, For the The centers of the clusters, are the normalized data points.

[0033] Safety testing includes: Intrusion detection: Identify intrusion behaviors by analyzing network traffic and operation logs. The calculation formula is: ; ; in, is the original data, is the mean, is the standard deviation, is the normalized data, is a known intrusion characteristic pattern; Abnormal behavior analysis: By analyzing user behavior data, anomaly detection algorithms based on statistical analysis can identify abnormal behaviors and potential threats; Malicious activity identification: By analyzing operation logs and network traffic, a naive Bayes classifier is used to identify malicious activities; The Naive Bayes classifier consists of: Posterior probability calculation: ; in, is the category (malicious or normal), is the feature vector, is the posterior probability, For the likelihood, is the prior probability; Naive Bayes Assumptions: ; in, Features is the characteristic number; Classification Decision: ; in, is the predicted category; Through the above content, real-time security detection can be achieved, and potential intrusions, abnormal behaviors and malicious activities can be identified and responded to in a timely manner. This distributed detection method improves the overall security and response efficiency of the system, reduces the burden on the central server, and ensures the real-time and accuracy of data processing.

[0034] Those skilled in the art should understand that the discussion of any of the above embodiments is merely illustrative and is not intended to imply that the scope of the present invention is limited to these examples. Under the concept of the present invention, the technical features in the above embodiments or different embodiments may be combined, the steps may be implemented in any order, and there are many other variations of the different aspects of the present invention as described above, which are not provided in detail for the sake of simplicity.

Claims

1. An information security cloud computing platform based on an intelligent computing center, characterized in that: It includes user identity and access control module, adaptive threat detection module, data protection and backup module, virtualization and resource management module, edge computing collaborative security module and security incident management module, among which; The user identity and access control module authenticates and manages users who access the platform; The adaptive threat detection module automatically analyzes and identifies new security threats and provides threat detection and response, specifically including: Data collection: real-time collection of security monitoring data, including network traffic, operation logs, and user behavior data; Feature extraction: extract threat features from collected security monitoring data; Threat identification: Based on the extracted threat features, a threat detection model is constructed, and security threats are identified and classified through the threat detection model; Threat response: Automatically generate and execute response strategies based on threat identification results; The data protection and backup module encrypts the stored and transmitted data and regularly backs up user data; The virtualization and resource management module manages and monitors the security status of virtual machines, and schedules and manages the computing resources of the intelligent computing center; The edge computing collaborative security module deploys security agents on edge nodes and uses edge computing resources to perform distributed security detection and response; The security event management module records the security events of the platform and provides a security log.

2. The information security cloud computing platform based on the intelligent computing center according to claim 1 is characterized in that: The user identity and access control module includes: Multi-factor authentication mechanism: a combination of password, SMS verification, fingerprint recognition, facial recognition or iris recognition; Role and permission management: dynamically assign access rights based on the user's role and permission level; Real-time monitoring and logging: real-time monitoring of user access behavior and recording of access logs; Security policy application: Apply predefined security policies and dynamically adjust access control rules based on user identity and access behavior; Identity management and audit: Regularly review and update user identity information, and perform identity verification and authentication management for users.

3. The information security cloud computing platform based on the intelligent computing center according to claim 1 is characterized in that: The feature extraction comprises: Data preprocessing: Clean, normalize and reduce the dimension of the collected security monitoring data to eliminate noise and redundant information; Time series analysis: Perform time series analysis on network traffic and user behavior data, and use sliding window technology to calculate traffic characteristics and behavior patterns; Frequency domain analysis: Perform frequency domain analysis on the operation log and use fast Fourier transform to extract frequency features; Statistical feature extraction: Calculate the basic statistical features of security monitoring data, including mean, standard deviation, skewness and kurtosis; High-dimensional feature mapping: Use principal component analysis to map high-dimensional features to low-dimensional space.

4. The information security cloud computing platform based on the intelligent computing center according to claim 3 is characterized in that: The threat detection model adopts a convolutional neural network model, and the convolutional neural network model includes: Data preprocessing: normalize and standardize the collected security monitoring data; Multi-scale convolution: Use multi-scale convolution kernels for convolution operation, and the calculation formula is: Small-scale convolution kernel: ; Large-scale convolution kernel: ; in, and are the sizes of small-scale and large-scale convolution kernels, respectively. is the convolution kernel weight, is the bias, is the convolution output; Attention mechanism: The attention mechanism is introduced to weight the output of the convolutional layer. The calculation formula is: ； in, is the importance score of the feature, is the attention weight, and are the width and height of the feature map respectively; ； in, is the output feature of the convolutional layer, is the weighted feature; Pooling layer: A strategy combining maximum pooling and average pooling is adopted, and the calculation formula is: ； ； in, is the pooling window size, They are the outputs of maximum pooling and average pooling respectively; Fully connected layer and output: Flatten the feature map output by the pooling layer and input it into the fully connected layer for classification. The calculation formula is: ； in, is the flattened pooling layer output, is the weight of the fully connected layer, is the bias, For output, is the activation function.

5. The information security cloud computing platform based on the intelligent computing center according to claim 4 is characterized in that: The threat responses include: Threat assessment: Based on the threat identification results, the severity of the threat is assessed and the threat level is determined. The calculation formula is: ； in, is the threat score, For the The weight of the feature, For the The value of the feature, is the characteristic number; Strategy selection: Based on the threat level, a response strategy is selected from the predefined response strategy library. The calculation formula is: ； in, For the selected response strategy, To respond to the strategy set, To select a strategy for a given threat score probability; Strategy generation: Generate response actions based on the selected response strategy, including blocking, isolation, alarming, and logging; Policy enforcement: Execute generated response actions through automated scripts and security tools.

6. The information security cloud computing platform based on the intelligent computing center according to claim 1 is characterized in that: The virtualization and resource management module includes: Virtual machine security monitoring: The integrated security agent monitors the virtual machine's operating status, network traffic, and operation logs in real time to detect abnormal behaviors and potential threats. The calculation formula is: ； in, Assign a security score to the virtual machine. For the The weight of the monitoring parameters, For the The value of the monitoring parameter, is the number of monitoring parameters; Resource utilization monitoring: Real-time monitoring of virtual machine and physical host resource usage, including CPU usage, memory usage, storage utilization, and network bandwidth usage. The calculation formula is: ； in, is the amount of resources used, is the total resources; Dynamic resource scheduling: Dynamically adjust the resource allocation and scheduling strategy of virtual machines based on the results of real-time resource utilization monitoring; Security policy application: Automatically apply or adjust security policies based on the results of virtual machine security monitoring, including network isolation, access control, and patch management; Automated management tools: Use automated management tools to perform virtual machine configuration, migration, and backup operations.

7. The information security cloud computing platform based on the intelligent computing center according to claim 1 is characterized in that: The edge computing collaborative security module includes: Edge security agent deployment: Deploy lightweight security agents on each edge node to collect and perform preliminary analysis of local data. Distributed data processing: Utilize the computing resources of edge nodes to perform distributed processing on locally collected data; Security detection: Real-time security detection is performed through security agents at edge nodes, including intrusion detection, abnormal behavior analysis, and malicious activity identification; Collaborative response: Based on the results of security detection, edge nodes independently or in collaboration with adjacent edge nodes execute security response strategies, including blocking suspicious traffic, isolating infected devices, and sending alarms to the central server.

8. The information security cloud computing platform based on the intelligent computing center according to claim 7 is characterized in that: The edge security agent deployment includes: Lightweight security agent deployment: A lightweight security agent is deployed on each edge node. The lightweight security agent runs on the edge device and monitors network traffic, operation logs, and user behavior data. The calculation formula is: ； in, The dataset collected for edge nodes, For the data points; Preliminary data analysis: The lightweight security agent performs preliminary analysis on the collected data and uses anomaly detection algorithms based on statistical analysis to identify abnormal behaviors and potential threats, including: ； ； in, is the mean of the data set, is the standard deviation, For the data points, is the number of data points; ； in, For the Anomaly score for each data point; like , then it is believed that It is abnormal data; Edge data aggregation: Aggregate the results of preliminary data analysis and send them to the central server for analysis and response. The calculation formula is: ； in, is the sum of anomaly scores aggregated from edge nodes, is the number of abnormal data points.

9. The information security cloud computing platform based on the intelligent computing center according to claim 8 is characterized in that: The distributed data processing includes: Data sharding: Divide the locally collected data set into multiple data blocks. The calculation formula is: ； in, The dataset collected for edge nodes, For the data points, For the data blocks, is the number of shards; Parallel processing: Use the computing resources of edge nodes to process the divided data blocks in parallel. The calculation formula is: ； in, For the The processing result of each data block is For the processing function, For the data blocks; Result aggregation: Aggregate the processing results of each data block to form the overall processing result. The calculation formula is: ； in, For the overall processing results, For the The processing result of each data block is is the number of shards.

10. The information security cloud computing platform based on the intelligent computing center according to claim 9, characterized in that: The safety detection includes: Intrusion detection: Identify intrusion behaviors by analyzing network traffic and operation logs. The calculation formula is: ； ； in, is the original data, is the mean, is the standard deviation, is the normalized data, is a known intrusion characteristic pattern; Abnormal behavior analysis: By analyzing user behavior data, anomaly detection algorithms based on statistical analysis can identify abnormal behaviors and potential threats; Malicious activity identification: By analyzing operation logs and network traffic, malicious activities are identified using a naive Bayes classifier.

Images