Self-adaptive data security management and risk early warning system based on intelligent analysis under cloud platform

Abstract

The invention relates to the technical field of data security management, in particular to a self-adaptive data security management and risk early warning system based on intelligent analysis under a cloud platform. Comprising a multi-dimensional data acquisition module; an intelligent analysis module; a self-adaptive strategy generation module; a risk early warning module; and a user behavior portrait construction module. In the design, the security policy can be dynamically adjusted along with the risk situation of the cloud platform, the problem that a static policy cannot adapt to real-time change is solved, and dynamic mapping of risk characteristics-policy parameters is realized; according to the design, the one-sidedness of single-dimension analysis is broken through, multi-modal feature association modeling of user behaviors is achieved, an abnormal behavior triggering threshold value is accurately recognized, and the integrity and accuracy of risk feature analysis are improved; the security policy can be continuously optimized through historical event data, so that protection efficiency attenuation caused by long-term static operation is avoided, and an autonomous lifting link of data driving, algorithm optimization and policy evolution is realized.

Description

Technical Field

[0001] The present invention relates to the technical field of data security management, and more specifically, to an adaptive data security management and risk warning system based on intelligent analysis under a cloud platform. Background Art

[0002] With the evolution of cloud computing technology towards distributed and microservices architectures, data security management in cloud platforms faces unprecedented complexity. On the one hand, user behaviors exhibit characteristics such as multi-device access (e.g., PC, mobile terminal, IoT device), high-frequency operations (e.g., real-time data reading and writing), and concealment of abnormal behaviors (e.g., zero-day attacks infiltrating through legitimate permissions); on the other hand, the dynamic flow of data assets (e.g., cross-regional storage, multi-tenant sharing) and the widespread application of encrypted traffic make it difficult for traditional security protection means to effectively identify risks. Traditional security management systems generally adopt an architecture of "static policy + single algorithm": the fixed RBAC role permission configuration cannot perceive the abnormal fluctuations in the user operation sequence (e.g., mutation of device fingerprint entropy value, disruption of access time interval regularity), the risk assessment model based on single-dimensional features (e.g., operation frequency or asset sensitivity level) is difficult to capture the spatio-temporal correlation of multi-source data (e.g., encrypted traffic payload, external threat intelligence), and the policy adjustment mechanism relying on manual experience is even less able to cope with the risk situation that changes in real time in the cloud environment.

[0003] Such solutions lack the ability to perceive the real-time dynamics of the cloud environment: on the one hand, they cannot effectively capture the subtle abnormalities in the user behavior sequence (e.g., mutation of device fingerprint entropy value, disruption of access time interval regularity), resulting in a lag in the detection of zero-day attacks or privilege abuse behaviors; on the other hand, it is difficult to fuse multi-source heterogeneous data (e.g., user operation trajectories, encrypted traffic payload characteristics, external threat intelligence) for correlation analysis, making the risk assessment results unable to comprehensively reflect the real risk situation, and often resulting in problems such as a high false alarm rate and a mismatch between the response strategy and the risk level. In addition, traditional systems generally lack a policy self-optimization mechanism, and the adjustment of security policies depends on manual experience, and cannot achieve a closed-loop evolution of "data collection - model training - policy execution" through historical security event data, resulting in a gradual decline in the protection effectiveness after the system runs for a long time; the above defects are concentrated in: a lag in perceiving the dynamics of the cloud environment, insufficient ability to fuse multi-source data, and lack of a policy self-evolution mechanism, ultimately resulting in problems such as a high false alarm rate, significant response delay, and attenuation of protection effectiveness over time. In view of this, we propose an adaptive data security management and risk warning system based on intelligent analysis under a cloud platform. Summary of the Invention

[0004] The object of the present invention is to provide an adaptive data security management and risk warning system based on intelligent analysis under a cloud platform, so as to solve the problems in the prior art mentioned in the above background technology, such as the lag in perceiving the dynamics of the cloud environment, the insufficient ability to fuse and analyze multi-source data, and the lack of a policy self-evolution mechanism, which ultimately result in a high false alarm rate, a significant response delay, and a decay of the protection effectiveness over time.

[0005] To solve the above-mentioned technical problems, the object of the present invention is to provide an adaptive data security management and risk warning system based on intelligent analysis under a cloud platform, including: A multi-dimensional data acquisition module, which obtains data asset metadata (including sensitive level, storage path), user operation sequences (including device fingerprints, access trajectories), encrypted traffic payload characteristics, and external threat intelligence streams in the cloud platform in real time based on a time synchronization engine unit; An intelligent analysis module, which generates risk feature vectors in multiple dimensions based on a built-in dynamic risk assessment unit; An adaptive policy generation module, which dynamically generates a differentiated security policy system based on risk feature vectors in multiple dimensions by using a decision tree model optimized by reinforcement learning; A risk warning module, which is used to construct a four-color dynamic warning model; A user behavior portrait construction module, which classifies user behavior sequences (including device fingerprint entropy values, access time entropy values) based on the DBSCAN density clustering algorithm, generates a dynamic portrait (including the normal behavior baseline interval and the abnormal behavior trigger threshold), and outputs it to the intelligent analysis module to calibrate the weights of risk feature vectors.

[0006] As a further improvement of this technical solution, the time synchronization engine unit includes a high-precision clock source sub-unit and a time deviation calibration sub-unit; Among them, the high-precision clock source sub-unit obtains the reference time through GPS timing or IEEE1588 boundary clock; The time deviation calibration sub-unit dynamically compensates for the network transmission delay by using an adaptive filtering algorithm, and the adaptive filtering algorithm includes Kalman filtering and its improved algorithms, and the improved algorithm dynamically updates the state estimation by using a sliding window mechanism.

[0007] As a further improvement of this technical solution, the steps for the dynamic risk assessment unit to extract risk feature vectors in multiple dimensions are as follows: S211. Filter the noise of the original data obtained by the multi-dimensional data acquisition module, and normalize the data by using a standardization method to eliminate the dimensional differences of different features, and form a structured feature data set; S212. Input the user operation sequence into the long short-term memory network, capture the temporal features (such as operation time intervals, frequency changes, etc.) through the hidden layer state transfer, and output the temporal dimension feature representation of the user behavior; S213. Based on the graph neural network, construct an association graph of data assets, user entities, and external threat intelligence, calculate the risk propagation coefficient and association weight between nodes, and extract the graph structure features (such as asset association complexity, threat impact scope, etc.); S214. Through the feature splicing layer, fuse the temporal features output by the long short-term memory network and the graph structure features generated by the graph neural network to form a preliminary feature vector containing behavior patterns and association relationships; S215. Use the gradient boosting decision tree to calculate the importance scores of each feature, screen out multiple key dimensions with high contribution to risk assessment, and form the final risk feature vector for the intelligent analysis module to perform dynamic risk assessment.

[0008] As a further improvement of this technical solution, the noise filtering and data normalization processing in step S211 include the following steps: S211.1. Adopt an improved isolation forest algorithm for outlier detection, which specifically includes: Adaptive tree depth control: Dynamically adjust the maximum depth of the tree , and the calculation formula is: ; where is the number of samples, and the value range is a positive integer; is the adjustment coefficient, with a fixed value of 0.2, used to balance the influence of the basic tree depth and data fluctuations; is the feature set 's standard deviation, reflecting the degree of dispersion of the data distribution; Weighted outlier score: Weight the outlier scores based on feature importance, and the calculation formula is: ; Among them, is the total number of feature dimensions; is the importance weight of the th feature, through Impurity calculation: ; In the formula, is the impurity of the parent node , is the impurity of the child node , is the total impurity change of all features; is the outlier score of the original isolation forest algorithm for the sample on the th feature; Represents the weighted anomaly score of the sample ; Ensemble learning strategy: Construct multiple improved isolation forest sub-models, each sub-model using a different feature subset (subset size is 60% of the original features), and the final anomaly score is the weighted average of the scores of each sub-model: ; Among them, is the weight of the th sub-model, calculated by the F1 score of the sub-model on the validation set: ; Among them, is the F1 score of the th sub-model on the validation set; represents the total number of sub-models, that is, the number of improved isolation forest sub-models participating in the ensemble learning, with a fixed value of 10; : represents the F1 score of the th sub-model on the validation set; S211.2. Perform Z-score standardization: Perform Z-score standardization on the valid data passed the detection, and the calculation formula is: ; Among them, is the original data value; is the mean of this feature, and the calculation method is: ; is the standard deviation of this feature, and the calculation method is: ; S211.3. Perform exponentially weighted moving average smoothing: Construct a sliding time window (window size = 100 time stamps), and perform exponentially weighted moving average smoothing on the data within the window; its calculation formula is: ; Among them: is the smoothed value at time ; is the original data value at time ; is the smoothed value of the previous time, and the initial value ; is the weight coefficient, with a fixed value of 0.8, controlling the attenuation rate of historical data.

[0009] As a further improvement of this technical solution, in the adaptive policy generation module (300), the training process of the decision tree model optimized by reinforcement learning is as follows: Define the state space ; Design the reward function , where is the asset value coefficient, is the delay penalty coefficient; Represents the probability of a successful attack; Represents the time span from when a defense strategy is decided to be executed until the strategy actually takes effect in the system and plays a defensive role; Represents the reward function in reinforcement learning; The proximal policy optimization (PPO) algorithm is used to update the decision tree parameters, and the model is iterated every 1000 interaction steps.

[0010] As a further improvement of this technical solution, the differentiated security policies generated by the adaptive policy generation module include data classification protection policies, dynamic access control policies, and desensitization policies, where: Data classification protection policy: The RSA-2048 algorithm is used to encrypt and protect the data; Dynamic access control policy: Based on the risk feature vector, the RBAC role permissions are adjusted in real time, and the time window mechanism is used to achieve dynamic access control; Desensitization policy: Implement role-based dynamic desensitization for medical data, and use the masking algorithm: MaskedValue = Hash(original value + role ID timestamp) mod , and desensitize the data.

[0011] As a further improvement of this technical solution, the adaptive policy generation module includes a policy effect evaluation unit, a reinforcement learning optimization unit, a policy combination evolution unit, and a fitness evaluation unit, where: Policy effect evaluation unit: Through security event backtracking analysis, calculate the interception rate, false alarm rate, and system performance impact coefficient of each security policy within a preset time window, and construct a multi-dimensional evaluation index system; Reinforcement learning optimization unit: Based on the evaluation index system, use the Q-learning algorithm to dynamically adjust the weight parameters of each differentiated security policy; its optimization objective function is: ; Where: is the discount factor, with a value range of 0 1, which is used to measure the relative importance of future rewards and current rewards, The closer it is to 1, the more it indicates that the influence of future rewards on the current decision is valued; , , are dynamic weight coefficients, which respectively represent the weights of the interception rate, false alarm rate, and performance impact in the optimization objective, reflecting the relative importance of each index to policy optimization, and satisfying + + = 1; is the time step, with a value ranging from 0 to , representing a sequence for evaluating the strategy effect at different time points; is the preset time window length, which defines the time range covered by evaluating the strategy effect; refers to the interception ratio of the security strategy against security threats at the time step. The higher the value, the stronger the defense ability of the strategy against threats at that moment; refers to the false alarm ratio of the security strategy at the time step. The lower the value, the higher the accuracy of the strategy judgment; refers to at the time step when, the impact degree of the security strategy on the system performance (such as operation speed, resource occupancy, etc.). The lower the value, the smaller the interference of the strategy to the normal operation of the system; Strategy combination evolution unit: Using genetic algorithm to optimize the combination of data hierarchical protection strategy, dynamic access control strategy and desensitization strategy, including: Crossover operation: Recombining gene segments of the selected strategy combinations to generate new strategy combinations; Mutation operation: Randomly perturbing the parameters of the strategy combination to explore potential better strategy combinations; Fitness evaluation unit: Constructing a fitness function based on the evaluation index system to quantify the comprehensive performance of each strategy combination; The fitness function takes core indicators such as the interception efficiency, false alarm rate and system resource occupancy rate of the security strategy as input variables; Through the above iterative optimization of the genetic algorithm, an optimal strategy combination that meets the preset security and performance requirements is generated.

[0012] Through the collaborative work of the above multiple units, a closed-loop optimization system is formed, enabling the differential security strategy to adapt to the dynamic changes of the cloud platform security situation.

[0013] As a further improvement of this technical solution, the four-color dynamic early warning model includes a dynamic parameter optimization unit, a multi-modal feature enhancement unit, a dynamic threshold decision unit and a response strategy self-optimization unit, where: Dynamic parameter optimization unit: Continuously collecting and analyzing real-time security event data of the cloud platform through an online learning algorithm, and dynamically adjusting the internal parameter configuration of the risk assessment model. The adjustment process uses a heuristic search algorithm to avoid falling into local optima; Multi-modal feature enhancement unit: Using a deep learning network to perform dimensionality expansion and correlation mining on the risk feature vector, generating an enhanced feature representation that fuses the original features and high-order features; Dynamic Threshold Decision-making Unit: Based on enhanced feature representation, combined with the current cloud platform load status and historical warning data, it calculates and optimizes the trigger thresholds for each warning level in real time; Response Strategy Self-optimization Unit: Dynamically matches the preset hierarchical response strategies according to the warning levels, and continuously optimizes the strategy combination and trigger conditions through a reinforcement learning mechanism.

[0014] Through the synergistic effects of data collection, feature enhancement, threshold dynamicization, and strategy self-learning, the optimization mechanism forms a closed-loop optimization system, significantly improving the adaptability of the warning model to complex cloud environments and the accuracy of risk determination.

[0015] The warning level determination rules of the four-color dynamic warning model are as follows: Green, risk value < 40 points, the system maintains regular monitoring; Yellow, 40 ≤ risk value < 60 points, trigger in-depth auditing of access logs; Orange, 60 ≤ risk value < 80 points, automatically restrict non-privileged user access; Red, risk value ≥ 80 points, immediately activate the policy fusing mechanism and isolate relevant assets; Among them, the risk value is calculated using a logistic regression model: Risk value = ; are model training parameters; are the values of each dimension of the risk feature vector respectively corresponding regression coefficients; are the specific values of each dimension that make up the risk feature vector; is the natural constant.

[0016] As a further improvement of this technical solution, the user behavior portrait construction module includes a multi-dimensional feature extraction unit, a dynamic clustering unit, and a portrait generation unit, where: Multi-dimensional Feature Extraction Unit: Extracts device fingerprint features, access time features, and operation frequency features from the user behavior sequence, calculates the information entropy of the device fingerprint, the distribution entropy of the access time, and the fluctuation entropy of the operation frequency respectively, and forms a three-dimensional feature vector; Dynamic Clustering Unit: Uses the DBSCAN density clustering algorithm to perform clustering analysis on the three-dimensional feature vector, and dynamically determines the neighborhood radius and the minimum number of samples through an adaptive parameter adjustment mechanism. The adaptive parameter adjustment mechanism automatically optimizes the clustering parameters based on the distance distribution characteristics between samples; Portrait Generation Unit: Generates a multi-dimensional behavior model including the normal behavior baseline interval based on the clustering results. The multi-dimensional behavior model includes: Normal Behavior Baseline Interval: Determined by analyzing the statistical center and distribution range of the clustering results; Abnormal behavior trigger threshold: Set based on the fluctuation boundary of the baseline interval, used to identify abnormal operations that deviate from normal behavior.

[0017] As a further improvement of this technical solution, the user behavior portrait construction module further includes a portrait evolution unit, an abnormal behavior warning unit, and a risk feature calibration unit, where: Portrait evolution unit: Adjust the weights of historical behavior data through a time decay mechanism, so that the impact of recent behavior on the portrait is greater than that of long-term behavior; Abnormal behavior warning unit: When the real-time behavior data deviates from the normal behavior baseline interval by more than the threshold, generate a warning signal and output it to the intelligent analysis module. The warning signal includes a quantitative index representing the degree of deviation; Risk feature calibration unit: Dynamically adjust the weights of the corresponding dimensions in the risk feature vector according to the degree of deviation of the warning signal, and the adjustment amplitude is positively correlated with the degree of deviation.

[0018] Compared with the prior art, the beneficial effects of the present invention are: 1. The present invention dynamically generates data classification protection, dynamic access control, desensitization and other policies through a decision tree model optimized by reinforcement learning, and uses the Q-learning algorithm to adjust the policy weights according to real-time indicators such as interception rate, false alarm rate, and performance impact. Combined with the genetic algorithm, the policy combination is optimized by crossover and mutation. In this design, the security policy can be dynamically adjusted according to the risk situation of the cloud platform, solving the problem that static policies cannot adapt to real-time changes, and realizing the dynamic mapping of "risk features - policy parameters".

[0019] 2. The present invention obtains multi-dimensional data such as device fingerprints, access time, and operation frequency through a multi-dimensional data acquisition module, and uses the DBSCAN density clustering algorithm to dynamically classify three-dimensional feature vectors to generate a multi-dimensional behavior model including the normal behavior baseline interval. This design breaks through the one-sidedness of single-dimensional analysis, realizes the multi-modal feature correlation modeling of user behavior, accurately identifies the abnormal behavior trigger threshold, and improves the integrity and accuracy of risk feature analysis.

[0020] 3. The present invention constructs a multi-dimensional evaluation index system through the policy effect evaluation unit, and forms a "evaluation - optimization - evolution" closed loop in combination with the reinforcement learning optimization unit and the policy combination evolution unit: the Q-learning algorithm maximizes the long-term cumulative reward, and the genetic algorithm iteratively generates the optimal policy combination through the fitness function. The security policy in this design can be continuously optimized through historical event data, avoiding the attenuation of protection effectiveness caused by long-term static operation, and realizing the autonomous improvement link of "data-driven - algorithm optimization - policy evolution".

[0021] 4. The present invention generates a dynamic portrait through the user behavior portrait construction module and outputs it to the intelligent analysis module to calibrate the weights of the risk feature vectors. At the same time, the four-color dynamic early warning model calculates the risk value in real time based on the logistic regression model and realizes the adaptive adjustment of the early warning level in combination with the dynamic threshold decision unit. This design highly matches the risk judgment result with the real-time risk situation, and the response strategy can be dynamically triggered according to the risk level, reducing the false alarm rate and response delay.

[0022] 5. The present invention dynamically compensates for network delays through the high-precision clock source of the time synchronization engine unit and the improved Kalman filtering algorithm to ensure the timestamp consistency of multi-source data. At the same time, the original data is denoised and normalized through the improved isolation forest algorithm and exponential weighted moving average smoothing processing. This design eliminates the time deviation and noise interference in data collection, provides a high-quality data source for subsequent feature extraction and risk assessment, and ensures the timeliness and reliability of the analysis results. BRIEF DESCRIPTION OF THE DRAWINGS

[0023] Figure 1 is the system framework diagram of the present invention; Figure 2 is the step schematic diagram of extracting risk feature vectors in the present invention; The meanings of the various reference numerals in the figure are as follows: 100, multi-dimensional data acquisition module; 110, time synchronization engine unit; 111, high-precision clock source sub-unit; 112, time deviation calibration sub-unit; 200, intelligent analysis module; 210, dynamic risk assessment unit; 300, adaptive strategy generation module; 310, strategy effect evaluation unit; 320, reinforcement learning optimization unit; 330, strategy combination evolution unit; 340, fitness evaluation unit; 400, risk early warning module; 410, dynamic parameter optimization unit; 420, multi-modal feature enhancement unit; 430, dynamic threshold decision unit; 440, response strategy self-optimization unit; 500, user behavior portrait construction module; 510, multi-dimensional feature extraction unit; 520, dynamic clustering unit; 530, portrait generation unit; 540, portrait evolution unit; 550, abnormal behavior early warning unit; 560, risk feature calibration unit. DETAILED DESCRIPTION OF THE EMBODIMENTS

[0024] Next, the technical solutions in the embodiments of the present invention will be clearly and completely described in conjunction with the accompanying drawings in the embodiments of the present invention. Obviously, the described embodiments are only a part of the embodiments of the present invention, rather than all the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those of ordinary skill in the art without creative efforts shall fall within the protection scope of the present invention.

[0025] As Figure 1 - Figure 2 shown, this embodiment provides an adaptive data security management and risk warning system based on intelligent analysis under a cloud platform, including: A multi-dimensional data acquisition module 100, which obtains data asset metadata (including sensitivity level, storage path), user operation sequences (including device fingerprints, access trajectories), encrypted traffic payload characteristics, and external threat intelligence flows in the cloud platform in real time based on a time synchronization engine unit 110; this design realizes the real-time acquisition of multi-source heterogeneous data, covering assets, user behaviors, traffic characteristics, and threat intelligence, ensuring the comprehensiveness of risk analysis; In this embodiment, the time synchronization engine unit 110 includes a high-precision clock source subunit 111 and a time deviation calibration subunit 112; by adopting a hierarchical architecture design, the acquisition of the reference time and the compensation of transmission delay are decoupled, improving the maintainability of the system; Among them, the high-precision clock source subunit 111 obtains the reference time through GPS timing or IEEE1588 boundary clock; The time deviation calibration subunit 112 uses an adaptive filtering algorithm to dynamically compensate for network transmission delay. The adaptive filtering algorithm includes Kalman filtering and its improved algorithms, and the improved algorithm uses a sliding window mechanism to dynamically update the state estimation.

[0026] As a further description of this embodiment, the high-precision clock source subunit 111 in this embodiment defaults to GPS timing to obtain UTC time with nanosecond-level accuracy; when the GPS signal is lost or the error exceeds the threshold (such as 100 ns), it automatically switches to the IEEE1588 boundary clock mode to achieve microsecond-level accuracy synchronization through the PTP protocol. The time bases in both modes can be manually configured through the management interface to meet the requirements of different security level scenarios (such as giving priority to using the IEEE1588 internal clock source in classified scenarios).

[0027] As a further description of this embodiment, the state space model of the improved Kalman filtering algorithm is: ; Among them, is the state vector, ; in the formula, is the estimated mean value of the network delay at the th moment (unit: millisecond, ms); is the estimated variance of the network delay at the th moment (unit: square millisecond, ms²); is the state transition matrix: the identity matrix , indicating the first-order Markov property of the state (the current state depends only on the previous state); is the input matrix: zero matrix , because there is no external control input; is the process noise: Gaussian white noise, with a mean of 0 and a covariance matrix , where and are the process noise intensities of the mean and variance respectively (value range: ).

[0028] is the observation vector: a scalar, the network delay value measured in real time (unit: ms), that is , where is the true delay, is the observation noise; is the observation matrix: a row vector = , which maps the mean of the state vector to the observation space (the variance is not directly observed and is estimated by filtering).

[0029] is the observation noise: Gaussian white noise, with a mean of 0; The sliding window size N is dynamically adjusted according to the statistical standard deviation of the network delay, and its calculation formula is: ; where, is the statistical standard deviation of the network delay within the historical window (unit: ms), calculated through the sample standard deviation formula: , where in the formula, is the number of samples; is the th network delay sample; is the arithmetic mean of the samples; is the adjustment factor, with a value range of 1.5 2.0, used to dynamically expand the window according to the degree of delay fluctuation (increase N when the fluctuation is large, and decrease it otherwise).

[0030] This design can effectively suppress the interference of burst noise on the filtering result by updating the state estimate with the sample mean within the window.

[0031] The intelligent analysis module 200 generates risk feature vectors in multiple dimensions based on the built-in dynamic risk assessment unit 210; As Figure 2 shown, in this embodiment, the steps for the dynamic risk assessment unit 210 to extract risk feature vectors in multiple dimensions are as follows: S211. Filter the noise of the original data obtained by the multi-dimensional data acquisition module 100, and perform normalization processing on the data using the standardization method to eliminate the dimensional differences of different features, forming a structured feature dataset; S212. Input the user operation sequence into the long short-term memory network, and capture the temporal features (such as operation time intervals, frequency changes, etc.) through the hidden layer state transfer, and output the temporal dimension feature representation of the user behavior; This design combines the long short-term memory network (LSTM) to capture the temporal dynamics of user behavior (such as operation intervals, frequency mutations) and the graph neural network (GNN) to model the association topology of data assets and threats (such as risk propagation paths, influence scopes), breaking through the limitations of traditional single-dimensional feature analysis, constructing a three-dimensional risk feature covering behavior patterns and association relationships, and improving the comprehensiveness and accuracy of risk assessment.

[0032] S213. Based on the graph neural network, construct an association graph of data assets, user entities, and external threat intelligence, calculate the risk propagation coefficient and association weight between nodes, and extract the graph structure features (such as asset association complexity, threat influence scope, etc.); S214. Through the feature splicing layer, fuse the temporal features output by the long short-term memory network and the graph structure features generated by the graph neural network to form a preliminary feature vector containing behavior patterns and association relationships; S215. Use the gradient boosting decision tree to calculate the importance scores of each feature, screen out multiple key dimensions with high contribution to risk assessment, and form the final risk feature vector for the intelligent analysis module 200 to perform dynamic risk assessment. This design realizes an end-to-end automated process from data preprocessing (denoising, normalization) to feature screening (GBDT importance calculation), reduces manual intervention, adapts to the real-time processing requirements of massive data in the cloud platform, and significantly improves the efficiency and stability of risk feature generation.

[0033] As a further illustration of this embodiment, this embodiment uses a 3-layer LSTM network to process the user operation sequence, the number of units in each layer is 128, 64, and 32 in turn, the activation function uses tanh, and the output layer obtains a 64-dimensional temporal feature through a fully connected layer. Its specific calculation formula is: ; Among them, represents the operation feature at time (such as device type, access permission), is the LSTM hidden state, is the temporal feature matrix, which can capture the long-term dependencies of the operation sequence (such as the time pattern of continuous abnormal device access). This structure effectively models the time evolution law of behavior through multi-layer state transfer, providing dynamic behavior features for risk assessment.

[0034] Furthermore, construct an association graph that includes users (U), data assets (D), and external threats (T). The edge weights are defined as follows: the access frequency of user-asset (reflecting data access activity) and the impact degree of asset-threat (quantifying the risk of threats to assets). Use the PageRank algorithm to calculate the risk propagation coefficient of nodes: ; where is the PageRank value of node , quantifying its risk propagation influence in the graph; is the damping factor; is the out-degree of node ; is the set of in-edge nodes of node (all nodes that directly point to node ); is the PageRank value of node . The extracted graph structure features include: Asset association complexity: the number of assets with the top-5 PageRank values (reflecting the association density of high-risk assets); Threat impact scope: (quantifying the scale of assets directly affected by threats); In summary, concatenate the 64-dimensional time series features output by LSTM and the 32-dimensional graph structure features generated by GNN, and dynamically weighted fusion through the attention mechanism (such as giving priority to graph features in the attack scenario) to form a preliminary feature vector. Then use the Gradient Boosting Decision Tree (GBDT) to screen the top 30 key features with the largest gains (threshold = 0.01) to form the final risk feature vector (dimension ≤ 30), providing multi-modal and high-value inputs for subsequent dynamic risk assessment.

[0035] It should be added that in step S214, first concatenate the 64-dimensional time series features generated by LSTM and the 32-dimensional graph structure features generated by GNN in terms of dimension to form a 96-dimensional vector . Calculate the dynamic weights through the attention weight matrix , and its calculation formula is: , and weighted fusion to obtain: , where: is the fused risk feature vector, with a dimension of 96 (64-dimensional time series features + 32-dimensional graph structure features weighted by attention); is the attention weight; is the 64-dimensional time series feature; is the 32-dimensional graph structure feature; in addition, the attention weight matrix Through backpropagation training, the learning rate is set to , and it is iterated 1000 times to make the weights adapt to different risk scenarios and improve the accuracy of feature fusion. For example, in the data leakage scenario, it inclines towards GNN features to highlight the risk propagation path of asset associations; in the scenario of abnormal device access it focuses on LSTM features to capture the temporal anomalies of operation sequences; while in step S215, the gain of each feature is calculated using GBDT, and the top 30 largest (K = 30) features with a gain ≥ 0.01( = 0.01)) are retained, such as "user operation frequency change rate" (Gain = 0.25) and "asset association complexity" (Gain = 0.22), to form the final risk feature vector (dimension ≤ 30). This vector fuses temporal dynamics and association topology information, and redundant information is removed through gain screening to ensure the efficiency and accuracy of subsequent dynamic risk assessment.

[0036] In this embodiment, the noise filtering and data normalization processing in step S211 include the following steps: S211.1. An improved isolation forest algorithm is used for outlier detection, which specifically includes: Adaptive tree depth control: Dynamically adjust the maximum depth of the tree , and the calculation formula is: ; where is the number of samples, and the value range is a positive integer; is the adjustment coefficient, with a fixed value of 0.2, used to balance the influence of the basic tree depth and data fluctuations; is the standard deviation of the feature set, reflecting the degree of dispersion of the data distribution; Weighted outlier score: The outlier score is weighted based on feature importance, and the calculation formula is: ; where is the total number of feature dimensions; is the importance weight of the th feature, through Impurity calculation: ; in the formula, is the impurity of the parent node , is the impurity of the child node , is the total change in impurity of all features ; is the outlier score of the original isolation forest algorithm for the sample on the th feature; Represents the weighted anomaly score of the sample ; Ensemble learning strategy: Construct multiple improved isolation forest sub-models, each sub-model using a different feature subset (subset size is 60% of the original features), and the final anomaly score is the weighted average of the scores of each sub-model: ; Among them, is the weight of the -th sub-model, calculated by the F1 score of the sub-model on the validation set: ; Among them, is the F1 score of the -th sub-model on the validation set; represents the total number of sub-models, that is, the number of improved isolation forest sub-models participating in the ensemble learning; : represents the F1 score of the -th sub-model on the validation set; Through adaptive tree depth control (combining sample size and data fluctuation), weighted anomaly scoring (weighting feature importance), and ensemble learning (fusion of multiple sub-models), the robustness of outlier detection is significantly improved. Compared with the original isolation forest, the false detection rate and missed detection rate are reduced, and noise and anomalies in data such as device fingerprints and access frequencies are effectively filtered (such as random access interference of IoT devices).

[0037] As a further illustration of this embodiment, the adaptive tree depth control in this embodiment can use the formula: , dynamically adjust the tree depth, and balance the detection accuracy and efficiency according to the sample size and data fluctuation (quantified by the standard deviation of the feature set). For example, when = 1000 and = 0.5, the tree depth is 11, adapting to the data scale and complexity to avoid overfitting or underfitting; At the same time, the weighted anomaly scoring in this embodiment can calculate the feature weight (such as higher weights for key features such as device fingerprint entropy value), and through , preferentially detect anomalies of high-importance features, enhance the sensitivity to core risks, and reduce missed detections; In addition, in the ensemble learning strategy of this embodiment, 10 sub-models (feature subset 60%) can be constructed, and the weight is normalized according to the F1 score of the validation set. After fusion, the robustness of anomaly detection is improved, effectively filtering noise such as random access of IoT devices, ensuring data purity, and providing reliable input for subsequent processing.

[0038] It can be understood that in this embodiment, improved isolation forest is used to denoise multi-source heterogeneous data (such as user operation logs, asset traffic, threat intelligence), and the key parameters Used to balance the time decay effect of historical anomaly data: Time decay logic: The closer the data timestamp is, the higher the weight (e.g., , is the decay period, which can be adjusted according to the scenario. For example, taking 15 days makes the weight ratio of data within the recent 3 days ≥ 70%); Value range: Determine ∈[0.9, 1.1] through conventional grid search or cross - validation to optimize the anomaly detection's ability to capture time - sensitive features (e.g., the high weight of recent abnormal operations improves the real - time risk identification accuracy).

[0039] S211.2. Perform Z - score standardization: Perform Z - score standardization on the valid data that has passed the detection. The calculation formula is: ; where, is the standardized data value; is the original data value; is the mean of this feature, and the calculation method is: , where, represents the central position of the data distribution, is the total number of samples (the number of data points), is the th original value of the data point; is the standard deviation of this feature, and the calculation method is: ; is the deviation of a single data point from the mean, represents the sum of the squared deviations of all data points.

[0040] As a further illustration of this embodiment, this embodiment performs on the valid data to eliminate the dimensional difference (such as normalizing the user access frequency to a unified range), making the feature weights balanced during the LSTM network training, accelerating convergence, ensuring the model's efficient learning of multi - dimensional data, and avoiding training bias caused by feature scale differences.

[0041] S211.3. Perform exponential weighted moving average smoothing: Construct a sliding time window (window size = 100 timestamps), and perform exponential weighted moving average smoothing on the data within the window; its calculation formula is: ; where: is the smoothed value at time; is the original data value at time ; is the smoothed value of the previous time, and the initial value ; is the weight coefficient, with a fixed value of 0.8, which controls the attenuation rate of historical data.

[0042] As a further illustration of this embodiment, the default size of the sliding window in this embodiment is 100 (increased to 200 when the fluctuation is large), and is adopted, where = 0.8 adapts to aperiodic data, = 0.9 adapts to periodic data, smooths high-frequency fluctuations such as the entropy value of the device fingerprint, reduces variance, and enhances the stability of time-series features. For example, for the instantaneous noise of the device fingerprint entropy value (such as ±5% fluctuation), after smoothing, it is compressed to ±1%, improving the subsequent LSTM's ability to identify abnormal time series and outputting stable features.

[0043] The adaptive policy generation module 300 dynamically generates a differentiated security policy system based on risk feature vectors in multiple dimensions by using a decision tree model optimized by reinforcement learning; In this embodiment, in the adaptive policy generation module 300, the training process of the decision tree model optimized by reinforcement learning is as follows: Define the state space ; Design the reward function , where is the asset value coefficient, is the delay penalty coefficient; represents the probability of a successful attack; represents the time span from when the defense policy is decided and executed to when the policy actually takes effect and plays a defensive role in the system; represents the reward function in reinforcement learning; Use the proximal policy optimization (PPO) algorithm to update the decision tree parameters, and perform a model iteration every 1000 interaction steps.

[0044] As a further illustration of this embodiment, the quantization of the state space in this embodiment is as follows: Risk level: The value range is from 0 (low) to 5 (extremely high), which is obtained by normalizing the risk feature vector of the intelligent analysis module, accurately quantifying the risk situation of the cloud environment; Asset confidentiality level: 1 (public), 2 (internal), 3 (confidential), 4 (top secret), corresponding to data classification (such as medical data confidentiality level 3, financial data confidentiality level 4), to achieve differentiated protection; User trust score: 0 - 100, dynamically calculated based on historical behavior compliance (abnormal operations < 40 points, trigger high security policies; compliant operations > 80 points, relax access control).

[0045] System load: 0 - 1 (normalized CPU and memory utilization), when the load > 0.8, lightweight policies are preferred first to avoid resource overload.

[0046] As a further illustration of this embodiment, the PPO algorithm optimization in this embodiment can adopt the Proximal Policy Optimization (PPO) algorithm, configure the learning rate , process 2048 samples per batch, and introduce an entropy regularization coefficient of 0.01. Through large-scale parallel training and the entropy regularization mechanism, the policy generation speed can be improved, and the response latency can be controlled. This configuration can efficiently adapt to complex cloud scenarios such as multi-tenancy and cross-region. While ensuring the security protection intensity, it can effectively balance the system performance overhead, realize the real-time optimization and precise response of dynamic risk policies, and provide intelligent and efficient decision-making support for the data security of the cloud platform.

[0047] For example, when it is detected that the user's trust score < 40 (high risk) and the asset classification level = 4 (top secret), the state space =(5, 4, 35, 0.6), triggering a high protection policy (such as RSA-4096 encryption + two-factor authentication), and the reward function gives priority to maximizing (C = 106).

[0048] It can be understood that the policy generation module in this embodiment adopts the PPO algorithm, and the clip parameter is fixed at 0.2 (which follows the standard configuration of the reinforcement learning policy gradient optimization, such as the default value of OpenAI Baselines), used to limit the change range of the objective function during policy update, avoid policy oscillation, and ensure the stability and convergence of dynamic policy generation. This parameter selection is well-known to those skilled in the art and can be directly applied to the policy optimization scenario in this embodiment (such as rapid convergence without oscillation during policy iteration, improving the protection efficiency).

[0049] In this embodiment, the differentiated security policies generated by the adaptive policy generation module 300 include: Data classification protection policy: Use the RSA-2048 algorithm to encrypt and protect the data; Dynamic access control policy: Based on the risk feature vector, adjust the RBAC role permissions in real time, and use the time window mechanism to achieve dynamic access control; Desensitization policy: Implement role-based dynamic desensitization for medical data, using the masking algorithm: MaskedValue = Hash(original value + role ID timestamp) mod to desensitize the data.

[0050] As a further illustration of this embodiment, in the differentiated security policies of this embodiment, the following technologies are used to achieve the dynamic optimization of data protection: Hierarchical encryption: Public data (Level 1): For fully public information (such as official website announcements), unencrypted or AES-128 algorithm is used to ensure storage and transmission efficiency (encryption latency < 0.5ms, suitable for processing large amounts of public data); Internal data (Level 2): For non-sensitive data within the enterprise (such as employee attendance records, department collaboration documents), AES-192 algorithm (192-bit key) is used, which improves the security strength compared to Level 1 (the cracking time increases from years for AES-128 to years), while avoiding the high computational overhead of Level 3 (the encryption latency of the RSA+AES combination > 2ms), and adapting to the daily transfer requirements of internal data (such as quick access after encryption during cross-departmental sharing, response latency < 1ms); Confidential data (Level 3): For sensitive data such as medical records and financial transactions, the combination of RSA-2048 (key exchange) + AES-256 (data encryption) is used to ensure double security for transmission and storage (RSA resists man-in-the-middle attacks, AES-256 encrypts data content, meeting the protection standards of the confidential level in Equal Protection 2.0); Top-secret data (Level 4): For core government data and enterprise business secrets, national cryptography SM2 (key negotiation) + SM4 (data encryption) algorithms are used, strictly following national cryptography management specifications (such as the "Regulations on the Administration of Commercial Cryptography"), meeting the highest security level requirements (such as the transmission of confidential data in government cloud platforms, ensuring compliance and anti-attack capabilities); Dynamic permission management: A 5-minute window (refreshed every 1 minute) is set for high-risk scenarios (such as attack tracing), and a 1-hour window (supporting 10-minute temporary approvals) is adopted for normal scenarios, achieving a dynamic balance between security and business efficiency. For example, when a data analyst temporarily accesses sensitive data, the system automatically generates a temporary permission, which is valid within 1 hour after approval, ensuring compliance without affecting the workflow; Data desensitization: Through the mask formula MaskedValue = Hash(original value + role ID timestamp) mod ( = 4 - 8 for medical data = 6), sensitive information is desensitized (such as desensitizing the ID number to a 6-digit mask), ensuring privacy security during data sharing and analysis, and meeting regulatory requirements (such as the regulations on data desensitization in the "Personal Information Protection Law of the People's Republic of China").

[0051] In summary, through the coordination of classification mapping, dynamic windows, and desensitization algorithms, a security system with hierarchical protection, fine-grained access control, and privacy compliance processing is constructed, effectively coping with complex risks in the multi-tenant and cross-region scenarios of the cloud platform, providing intelligent protection for data assets throughout the entire life cycle, and enhancing the security, compliance, and business adaptability of the system.

[0052] In this embodiment, the adaptive policy generation module 300 includes a policy effect evaluation unit 310, a reinforcement learning optimization unit 320, a policy combination evolution unit 330, and a fitness evaluation unit 340, where: Policy effect evaluation unit 310: Through security event backtracking analysis, calculate the interception rate, false alarm rate, and system performance impact coefficient of each security policy within a preset time window, and construct a multi-dimensional evaluation index system; Reinforcement learning optimization unit 320: Based on the evaluation index system, use the Q-learning algorithm to dynamically adjust the weight parameters of each differential security policy; the optimization objective function is: ; Where: is the discount factor, with a value range of 0 1, which is used to measure the relative importance of future rewards and current rewards, The closer it is to 1, the more important it indicates the impact of future rewards on the current decision; , , are dynamic weight coefficients, representing the weights of the interception rate, false alarm rate, and performance impact in the optimization objective respectively, reflecting the relative importance of each index to policy optimization, and satisfying + + = 1; is the time step, with a value ranging from 0 to , indicating the sequence of evaluating policy effects at different time points; is the preset time window length, which defines the time range covered by evaluating policy effects; refers to the interception ratio of the security policy against security threats at the time step , and the higher the value, the stronger the defense ability of the policy against threats at that moment; refers to the false alarm ratio of the security policy at the time step , and the lower the value, the higher the accuracy of the policy judgment; refers to the impact degree of the security policy on system performance (such as operation speed, resource occupancy, etc.) at the time step , and the lower the value, the less interference the policy has on the normal operation of the system; Policy combination evolution unit 330: Use genetic algorithm to optimize the combination of data hierarchical protection policy, dynamic access control policy, and desensitization policy, including: Crossover operation: Recombine gene segments of the selected strategy combinations to generate new strategy combinations; Mutation operation: Randomly perturb the parameters of the strategy combinations to explore potential better strategy combinations; Fitness evaluation unit 340: Construct a fitness function based on the evaluation index system to quantify the comprehensive performance of each strategy combination; the fitness function takes core indicators such as the interception efficiency, false alarm rate, and system resource occupancy rate of the security strategy as input variables; Through the iterative optimization of the above genetic algorithm, an optimal strategy combination that meets the preset security and performance requirements is generated.

[0053] Through the collaborative work of the above multiple units, a closed-loop optimization system is formed, enabling the differential security strategy to adapt to the dynamic changes of the cloud platform security situation.

[0054] As a further description of this embodiment, the strategy effect evaluation index system of the strategy effect evaluation unit 310 in this embodiment includes: Interception rate: ; This index is used to measure the interception ability of the security strategy against attacks. For example, in the malicious traffic protection scenario, the interception rate is required to be not less than 95% to ensure the security of core assets (such as financial trading systems, medical record databases). By continuously monitoring the interception rate, the system can dynamically adjust the protection strategy (such as optimizing firewall rules, updating intrusion detection models), improve the interception effect against new attacks (such as zero-day vulnerability exploitation), reduce the risk exposure time, and ensure the security of data assets; False alarm rate: ; The false alarm rate reflects the accuracy of the strategy and directly affects business continuity. Usually, the false alarm rate needs to be controlled within 5% to avoid business interruptions caused by false alarms (such as blocking legitimate user access, interrupting critical data transmission). In daily operation and maintenance, the system analyzes the reasons for false alarms (such as over-sensitive feature libraries, improper rule configurations), optimizes the detection model (such as using machine learning algorithms to reduce false alarms, or manually reviewing high-confidence alarms), balances security protection and business availability, and ensures the normal operations of legitimate users are not affected; Performance impact coefficient: Performance impact = ; This coefficient evaluates the consumption of system resources by the strategy and ensures that the performance impact does not exceed 10%. In high-concurrency scenarios (such as e-commerce promotions, financial trading peaks), the system preferentially selects lightweight strategies (such as AES-128 encryption, coarse-grained access control) to reduce CPU and memory overhead and maintain normal business operations (such as response latency < 200ms). By dynamically adjusting the strategy complexity (such as switching encryption algorithms according to system load, optimizing the permission verification process), a refined balance between security protection and system performance is achieved, improving the user experience; In summary, the above indicators jointly constitute a three-dimensional evaluation system to drive the dynamic optimization of strategies (such as adjusting weights by Q-learning and evolving strategy combinations by genetic algorithms). In a multi-tenant and cross-region cloud environment, the system can automatically adjust protection strategies according to real-time risk levels and business requirements, achieving the efficiency, accuracy, and resource-friendliness of security protection, providing intelligent protection for data assets throughout their life cycles, and enhancing the overall security performance of the cloud platform.

[0055] As a further illustration of this embodiment, when the Q-learning algorithm is adopted in this embodiment, the initial weight configuration is as follows: = 0.6 (interception rate weight), which gives priority to enhancing the interception ability against attacks and is applicable to high-risk scenarios (such as attack tracing and real-time threat detection phases); = 0.3 (false alarm rate weight), which ensures the accuracy of the strategy and avoids service interruptions caused by false alarms; = 0.1 (performance impact weight), which initially balances security protection and system resource consumption and provides a basis for subsequent dynamic adjustment; In high-risk scenarios (when real-time attacks occur), when the system detects high risks (such as sudden increase in malicious traffic and abnormal device access), it automatically increases to 0.8 to strengthen the interception strategy (such as tightening firewall rules and enabling deep packet inspection). At this time, the false alarm rate can be temporarily relaxed to 8% to give priority to ensuring the continuity of critical services (such as financial transactions and medical data transmission) and avoid service interruptions caused by overly conservative security policies; In low-risk scenarios (such as daily data backup), in low-risk scenarios (such as regular data backup and internal system access), the system increases to 0.5 to prioritize performance optimization. For example, select strategies with low resource consumption (such as AES-128 encryption instead of RSA+AES combination) to control the performance impact coefficient within 5%, ensure the efficient execution of backup tasks, and maintain basic security protection at the same time, achieving a refined balance between security and efficiency; In summary, through the above dynamic adjustment mechanism, the system can automatically optimize the weight allocation of security strategies according to real-time risk levels, prioritize security in high risks and efficiency in low risks, adapt to the complex scenarios of multi-tenant and cross-region cloud platforms, enhance the intelligence and flexibility of security protection, and ensure the security and efficient operation of data assets in different business scenarios.

[0056] The risk warning module 400 is used to construct a four-color dynamic warning model; In this embodiment, the four-color dynamic warning model includes a dynamic parameter optimization unit 410, a multi-modal feature enhancement unit 420, a dynamic threshold decision-making unit 430, and a response strategy self-optimization unit 440, where: Dynamic parameter optimization unit 410: Continuously collect and analyze real-time security event data on the cloud platform through an online learning algorithm, dynamically adjust the internal parameter configuration of the risk assessment model, and use a heuristic search algorithm during the adjustment process to avoid falling into local optima; adapt to cloud environment changes in real time through online learning, combine with heuristic search to avoid local optima, improve the dynamic optimization ability of model parameters, and ensure the accuracy of risk assessment.

[0057] Multi-modal feature enhancement unit 420: Use a deep learning network to perform dimensionality expansion and correlation mining on risk feature vectors, and generate an enhanced feature representation that combines original features and high-order features; use deep learning to mine high-order features and correlation relationships, break through the limitations of traditional feature engineering, and improve the expression ability of risk features.

[0058] Dynamic threshold decision-making unit 430: Based on the enhanced feature representation, combine the current cloud platform load status and historical warning data, and calculate and optimize the trigger thresholds for each warning level in real time; this design dynamically adjusts the warning thresholds in combination with the load status and historical data, avoids the lag of static thresholds, and improves the scenario adaptability of warnings.

[0059] Response strategy self-optimization unit 440: Dynamically match preset hierarchical response strategies according to the warning level, and continuously optimize the strategy combination and trigger conditions through a reinforcement learning mechanism.

[0060] The optimization mechanism forms a closed-loop optimization system through the synergistic effects of data collection, feature enhancement, threshold dynamicization, and strategy self-learning, significantly improving the adaptability of the warning model to complex cloud environments and the accuracy of risk determination. Dynamically match hierarchical strategies through reinforcement learning to achieve closed-loop optimization of "warning-response" and improve the automation and intelligence level of security policies.

[0061] As a further explanation of this embodiment, the warning level determination rule of the four-color dynamic warning model is: Green, risk value < 40 points, the system maintains routine monitoring; Yellow, 40 ≤ risk value < 60 points, trigger in-depth audit of access logs; Orange, 60 ≤ risk value < 80 points, automatically restrict non-privileged user access; Red, risk value ≥ 80 points, immediately activate the policy fusing mechanism and isolate relevant assets; Among them, the risk value is calculated using a logistic regression model: Risk value = ; are model training parameters; They are the values of each dimension of the risk feature vector respectively. The corresponding regression coefficients; They are the specific values of each dimension that make up the risk feature vector; is the natural constant.

[0062] As a further illustration of this embodiment, the online learning algorithm in this embodiment adopts an online variant of stochastic gradient descent (SGD), and combines a forgetting factor mechanism to achieve concept drift adaptation. Its calculation formula is: ; where the learning rate schedule is the initial learning rate, is the decay rate), is the decay exponent; As a further illustration of this embodiment, this embodiment can adopt a particle swarm optimization (PSO) algorithm to efficiently iteratively optimize the parameters of the risk assessment model, specifically as follows: The core mechanism and parameters of the algorithm: Particle representation: Each particle corresponds to the coefficient vector of the risk assessment model , and searches for the optimal solution in a 15-dimensional parameter space. The configuration of 30 particles ensures the breadth and efficiency of the search, avoiding local optima and controlling computational resources (such as completing the iteration within 50 ms to meet the real-time requirements of the cloud platform); Dynamic parameter adjustment: Inertia weight : Linear decay , promoting global exploration (such as traversing feature weights such as user behavior and asset classification levels) with 0.7 in the initial stage (the first 30% of the iteration), and decaying to 0.4 in the later stage (the last 70% of the iteration) to focus on local fine-tuning (such as the threat intelligence matching degree coefficient ), achieving "extensive search first and fine-tuning later". Learning factor : Both are 2.0, balancing the optimal of the individual (pbest) and the group (gbest), avoiding individual dispersion or group convergence, and ensuring the optimization efficiency; Iterative update and convergence control: The calculation formulas for speed and position update are as follows: ; where is the th iteration of the particle 's velocity vector (the dimension is the same as the parameter space, such as the change speed of 15-dimensional risk feature coefficients). is the inertia weight (dynamically decaying, such as from 0.7 to 0.4), controlling the retention degree of the particle's current speed, and balancing global exploration (high ) and local exploitation (low ). is a uniformly random number, introducing randomness to avoid premature convergence. is the historical optimal position of the particle (parameter vector, recording the optimal solution found by the particle). is the th iteration of the particle position (parameter vector, such as the coefficient combination of the current risk model). is the global optimal position (parameter vector, the historical optimal solution of the entire particle swarm, guiding the population to converge to the global optimum). is the th iteration of the particle new position (parameter vector), which realizes parameter optimization (such as adjusting the weight coefficient of risk characteristics) through the position movement after velocity update.

[0063] Introduce diversity through random numbers to avoid falling into local optima (such as in a medical data model, jumping out of the "device classification weight trap" and exploring the correlation between user trust scores and operation frequencies).

[0064] As a further illustration of this embodiment, the deep learning architecture in this embodiment can adopt a Transformer + graph neural network (GNN) hybrid model, and its technical solution is as follows: Transformer processes temporal features (such as user operation sequences) and generates 32-dimensional enhanced features through the self-attention mechanism; among them, the self-attention calculation formula is: ; in the formula: are the query, key, and value matrices respectively, is the dimension of the key (mapping 15-dimensional original features to 32 dimensions here). That is, the query matrix and the transpose of the key matrix are multiplied. Through this mechanism, the dependence relationship of operations at different time steps can be captured (such as the strong correlation of multiple abnormal logins in a short period of time), generating 32-dimensional enhanced temporal features, and effectively identifying abnormal risks in user behavior patterns.

[0065] Construct a graph structure of asset-user-threat (the nodes include assets, users, threats, and the edges represent asset vulnerability associations, user access relationships, threat propagation paths, etc.), and use a graph convolutional network (GCN) for message passing. The formula is: ; where, is the neighbor of node , is the normalization coefficient, is the weight matrix, ​​is an activation function (such as ReLU). This process can model the relationship between asset vulnerabilities and threat propagation (such as the propagation path of high-risk threats exploiting asset vulnerabilities), output 24-dimensional graph features, and enhance the ability to analyze risks at the asset level.

[0066] The 32-dimensional time series features and the 24-dimensional graph features are concatenated by channel to obtain a 56-dimensional enhanced feature representation. The fused features contain both the temporal dependency of user operations and the graph structure association between assets and threats, significantly improving the cross-modal risk analysis capabilities (such as detecting joint risk scenarios of abnormal user behavior and asset vulnerability exploitation at the same time).

[0067] Furthermore, in the dynamic threshold decision unit 430 of this embodiment, by integrating the load status and historical warning data, intelligent dynamic adjustment of the warning threshold is achieved to ensure the accuracy of warning and timeliness of response in different scenarios. The technical solution is as follows: The threshold calculation model is adopted, and its formula is: ;in, It is the basic threshold for the four-color warning (green 40, yellow 60, orange 80, red 80 points), which serves as the benchmark for threshold adjustment and covers the warning range from low risk to high risk. is the cloud platform load rate (CPU / memory utilization, 0 1 ). is the historical warning frequency of the same level (times / hour). The positive correlation coefficient (0.1) causes the threshold to float downward during high-frequency warnings.

[0068] The user behavior profile construction module 500 classifies the user behavior (including device fingerprint entropy value and access time entropy value) sequence based on the DBSCAN density clustering algorithm, generates a dynamic profile (including normal behavior baseline interval and abnormal behavior trigger threshold), and outputs it to the intelligent analysis module 200 to calibrate the risk feature vector weight; when 0.8 (system resources are tight), the threshold formula (-0.2 ) item significantly increases the threshold (e.g. orange threshold 80 0.84=67.2 points, original =0.8 is calculated as 80 (1-0.2 0.8)=67.2 points), to avoid normal business operations (such as high-frequency trading, data backup) being falsely reported due to high system load, and to ensure business continuity; the red threshold (80 points) remains unchanged to ensure that serious risks (such as core system vulnerability exploitation) are intercepted first.

[0069] In this embodiment, the user behavior portrait construction module 500 includes a multi-dimensional feature extraction unit 510, a dynamic clustering unit 520, and a portrait generation unit 530, where: Multi-dimensional feature extraction unit 510: Extracts device fingerprint features, access time features, and operation frequency features from the user behavior sequence, calculates the information entropy of the device fingerprint, the distribution entropy of the access time, and the fluctuation entropy of the operation frequency respectively, and forms a three-dimensional feature vector; constructs a three-dimensional feature vector through the entropy value calculation (information entropy, distribution entropy, fluctuation entropy) of the device fingerprint, access time, and operation frequency, quantifies the diversity and regularity of user behavior, and provides a refined feature representation for subsequent clustering and portrait generation.

[0070] As a further illustration of this embodiment, the specific calculation methods for calculating the information entropy of the device fingerprint, the distribution entropy of the access time, the fluctuation entropy of the operation frequency, and the three-dimensional feature vector in this embodiment are as follows: Device fingerprint information entropy: , where is the distribution probability of device features (such as IP, MAC, model); represents the number of types of device features; is an index used to traverse different device features; Access time distribution entropy: ; where, is the probability of the access time in each interval (such as hour, weekday); represents the access time distribution entropy, which is used to measure the uncertainty or chaos degree of the access time distribution in different intervals. The larger the value, the more dispersed and irregular the access time distribution; the smaller the value, the more concentrated and regular the access time distribution; represents different intervals of the access time; is all access time intervals set; Operation frequency fluctuation entropy: ; where, is the distribution probability of the operation frequency (times / hour); i.e., the operation frequency fluctuation entropy; represents different operation frequency values; is all operation frequency values set; Three-dimensional feature vector: ; where the dimension is 3, corresponding to the entropy value features of device, time, and frequency respectively. is a three-dimensional feature vector that integrates the entropy value feature information related to device, time, and frequency, and is used for multi-dimensional feature description of a certain object (such as user operation behavior, device usage pattern, etc.).

[0071] Dynamic clustering unit 520: The DBSCAN density clustering algorithm is used to perform clustering analysis on three-dimensional feature vectors. The neighborhood radius and the minimum number of samples are dynamically determined through an adaptive parameter adjustment mechanism. The adaptive parameter adjustment mechanism automatically optimizes the clustering parameters based on the distance distribution characteristics between samples. The DBSCAN density clustering algorithm, combined with adaptive parameter adjustment, adapts to the changes in behavior patterns in different scenarios (such as the behavior differences in office, transaction, and medical scenarios).

[0072] As a further illustration of this embodiment, in this embodiment, DBSCAN clusters the three-dimensional feature vectors of user behavior (device fingerprint entropy, access time entropy, operation frequency entropy) through adaptive parameters, specifically as follows: Parameter configuration: The parameter adaptive formula is as follows: Neighborhood radius: ( ); Minimum number of samples: , is the number of samples (e.g., when = 1000, = 3); is set to the median of the feature space distance (e.g., 0.6), MinPts = 3, to ensure capturing the dense patterns of user behavior (such as the device access during normal working hours forms a core cluster, and the isolated access in the early morning is marked as noise). Clustering process: Traverse each feature vector, expand all points that are density-reachable from the core points (neighborhood ≥ 3 samples) to form normal behavior clusters (such as the device access cluster of medical staff, including high-frequency operations from 9 to 17 o'clock); non-core and isolated points (such as abnormal logins in the early morning) are marked as noise, triggering the abnormal behavior warning unit 550.

[0073] Technical effect: In the financial scenario, DBSCAN effectively clusters the device and time characteristics of normal transactions, improves the recognition rate of noise points (abnormal transaction devices), reduces the false alarm rate, provides accurate input for the risk feature calibration unit 560, and thus enhances the detection ability for behaviors such as account theft and money laundering; Through the DBSCAN algorithm, the user behavior portrait construction module realizes the adaptive clustering of complex behavior patterns, provides a refined behavior feature representation for cloud platform risk assessment, significantly improves the accuracy of the dynamic threshold decision unit 430 and the response strategy self-optimization unit 440, and ensures the intelligence and efficiency of security protection in the multi-tenant scenario.

[0074] Portrait generation unit 530: Based on the clustering results, a multi-dimensional behavior model including the normal behavior baseline interval is generated. The multi-dimensional behavior model includes: Normal behavior baseline interval: determined by analyzing the statistical center and distribution range of the clustering results; Abnormal behavior trigger threshold: set based on the fluctuation boundary of the baseline interval, used to identify abnormal operations that deviate from normal behavior. This design generates a normal behavior baseline (statistical center and distribution range) and an abnormal threshold based on the clustering results, providing a quantitative basis for abnormal detection and improving the accuracy of risk identification.

[0075] As a further illustration of this embodiment, the technology of the normal behavior baseline in this embodiment adopts Interval (3 Principle), covering approximately 99.7% of the normal behavior data. Among them, Is the mean value of the behavior characteristics (such as operation frequency, access time, etc.), Is the standard deviation, jointly describing the central tendency and fluctuation range of normal behavior; the abnormal behavior trigger threshold in this embodiment is set to +4 (4 Boundary), when the behavior data exceeds this threshold, the system determines it as abnormal and triggers an alarm. This threshold effectively identifies high-risk behaviors that significantly deviate from the normal mode (such as sudden high-frequency operations, abnormal time access, etc.) by expanding the upper boundary of the normal baseline (relative to 3 ).

[0076] For example, taking the monitoring of office operation frequency as an example: Baseline and threshold setting: Calculate the mean value of the operation frequency = 30 times / hour, standard deviation = 10, then the normal baseline is [10, 50] times / hour (covering 99.7% of normal operations), and the abnormal threshold is 70 times / hour (30 + 4 10); Abnormal detection process: When the operation frequency suddenly increases to 80 times / hour (such as high-frequency requests caused by brute-force cracking attacks), the system compares this value with the threshold (70 times / hour), triggers an abnormal alarm, and timely identifies and intercepts risk behaviors.

[0077] In this embodiment, the user behavior portrait construction module 500 further includes a portrait evolution unit 540, an abnormal behavior warning unit 550, and a risk feature calibration unit 560, where: Portrait evolution unit 540: Adjusts the weights of historical behavior data through a time decay mechanism, making the impact of recent behavior on the portrait greater than that of long-term behavior; by introducing a time decay mechanism (higher weight for recent behavior than for long-term behavior), the portrait is dynamically updated over time to adapt to long-term changes in user behavior (such as the evolution of operation habits, device replacement), improving timeliness.

[0078] As a further illustration of this embodiment, the calculation formula of the time decay mechanism in this embodiment is as follows: ; where, is the current time, is the data generation time (timestamp), represents the "time span" of the data (such as days, hours). is the decay coefficient (with a value range of 0.8 0.95), which controls the decay rate of historical data; represents the time decay weight, which is used to quantify the influence degree of data at different time points on the current portrait; For example: When is 0.95, the weight of data 10 days ago is , and that 30 days ago is , reflecting the characteristic that "recent data has a greater impact".

[0079] If = 0.8, the decay is faster (the weight 10 days ago is , and that 30 days ago is ), which is suitable for scenarios highly sensitive to behavior changes (such as device switching detection in instant messaging tools); In addition, when calculating portrait features (such as the average operation frequency, device fingerprint distribution, etc.), the data with different timestamps is weighted and summed according to . For example, if a user recently changes the device (new MAC address), the weight of the data of the old device decays over time, and the proportion of the features of the new device in the portrait gradually increases, ensuring that the portrait accurately reflects the current device usage status.

[0080] Abnormal behavior warning unit 550: When the real-time behavior data deviates from the normal behavior baseline interval by more than the threshold, a warning signal is generated and output to the intelligent analysis module 200. The warning signal includes a quantitative index representing the degree of deviation; by real-time monitoring the degree of deviation between the behavior data and the baseline, a warning signal including a quantitative index (degree of deviation) is generated, providing a clear abnormal input for the intelligent analysis module and enhancing the pertinence of risk response.

[0081] As a further illustration of this embodiment, the abnormal behavior warning unit 550 in this embodiment is responsible for real-time monitoring of the deviation between the behavior data and the normal baseline. Through the formula , the degree of deviation is quantified (where is the current behavior data, is the baseline mean value, is the baseline standard deviation), and when the degree of deviation exceeds 4 A warning is triggered when it occurs. The warning signal includes a specific Deviation value (e.g., (5.2) indicates a serious deviation), thereby providing a clear abnormal input for the intelligent analysis module, helping to accurately judge the risk level, and enhancing the pertinence of risk response.

[0082] Risk feature calibration unit 560: According to the deviation degree of the warning signal, dynamically adjust the weight of the corresponding dimension in the risk feature vector, and the adjustment amplitude is positively correlated with the deviation degree. Dynamically adjust the risk feature weight according to the deviation degree of the warning signal (the adjustment amplitude is positively correlated with the deviation degree), realize the adaptive optimization of the risk assessment model, and improve the detection ability of specific abnormal behaviors (such as enhancing the device fingerprint weight during high-frequency abnormal access).

[0083] As a further illustration of this embodiment, the risk feature calibration unit 560 takes dynamic weight adjustment as the core to realize the adaptive optimization of the risk assessment model. Based on the deviation degree (Deviation) output by the abnormal behavior warning unit 550, it enhances the weight of relevant risk features, and the adjustment amplitude is positively correlated with the deviation degree. The weight adjustment calculation formula is: ; ; is the adjusted risk feature weight; is the original risk feature weight; is the weight adjustment coefficient ( ); is the th feature's deviation degree.

[0084] For example, when the device fingerprint deviation degree reaches 5.2 ( =0.3), its weight is increased from 0.2 to 0.35, making the model more focused on device dimension anomalies and enhancing the detection accuracy.

[0085] Those of ordinary skill in the art can understand that the process of implementing all or part of the steps of the above embodiment can be completed by hardware or by a program instructing the relevant hardware.

[0086] The above shows and describes the basic principles, main features and advantages of the present invention. Those skilled in the art of this industry should understand that the present invention is not limited by the above embodiments. The above embodiments and descriptions in the specification are only preferred examples of the present invention and are not used to limit the present invention. Without departing from the spirit and scope of the present invention, the present invention will have various changes and improvements, and these changes and improvements all fall within the scope of the present invention claimed. The scope of protection claimed by the present invention is defined by the appended claims and their equivalents.

Claims

1. An adaptive data security management and risk warning system based on intelligent analysis under a cloud platform, characterized in that Comprising: A multi-dimensional data acquisition module (100) that, based on a time synchronization engine unit (110), real-time obtains data asset metadata, user operation sequences, encrypted traffic payload characteristics, and external threat intelligence flows within a cloud platform; An intelligent analysis module (200) that, based on a built-in dynamic risk assessment unit (210), generates risk feature vectors in multiple dimensions; An adaptive policy generation module (300) that, based on risk feature vectors in multiple dimensions, dynamically generates a differentiated security policy system using a decision tree model optimized by reinforcement learning; A risk warning module (400) for constructing a four-color dynamic warning model; A user behavior portrait construction module (500) that classifies user behavior sequences based on the DBSCAN density clustering algorithm, generates a dynamic portrait, and outputs it to the intelligent analysis module (200) to calibrate the weights of risk feature vectors.

2. The adaptive data security management and risk warning system based on intelligent analysis under the cloud platform according to claim 1, wherein: The time synchronization engine unit (110) includes a high-precision clock source subunit (111) and a time deviation calibration subunit (112); Among them, the high-precision clock source subunit (111) obtains a reference time through GPS timing or an IEEE 1588 boundary clock; The time deviation calibration subunit (112) dynamically compensates for network transmission delays using an adaptive filtering algorithm.

3. The adaptive data security management and risk warning system based on intelligent analysis under the cloud platform according to claim 1, characterized in that The steps for the dynamic risk assessment unit (210) to extract risk feature vectors in multiple dimensions are as follows: S211. Filter the noise of the raw data obtained by the multi-dimensional data acquisition module (100), and perform normalization processing on the data using a standardization method to eliminate the dimensional differences of different features, forming a structured feature data set; S212. Input the user operation sequence into a long short-term memory network, capture the timing features through the transfer of the hidden layer state, and output the time dimension feature representation of the user behavior; S213. Based on a graph neural network, construct an association graph of data assets, user entities, and external threat intelligence, calculate the risk propagation coefficient and association weight between nodes, and extract the graph structure features; S214. Through a feature splicing layer, fuse the timing features output by the long short-term memory network and the graph structure features generated by the graph neural network to form a preliminary feature vector containing behavior patterns and association relationships; S215. Use a gradient boosting decision tree to calculate the importance scores of each feature, screen out multiple key dimensions with a high contribution degree to risk assessment, and form the final risk feature vector for the intelligent analysis module (200) to perform dynamic risk assessment.

4. The adaptive data security management and risk warning system based on intelligent analysis under the cloud platform according to claim 3, characterized in that, The noise filtering and data normalization processing in step S211 include the following steps: S211.

1. Use an improved isolation forest algorithm for outlier detection, which specifically includes: Adaptive tree depth control: Dynamically adjust the maximum depth of the tree , and the calculation formula is: ; where is the number of samples; is the adjustment coefficient; is the feature set is the standard deviation of Weighted anomaly score: The anomaly scores are weighted based on feature importance, and the calculation formula is: ; Among them, is the total number of feature dimensions; is the importance weight of the th feature, calculated by impurity calculation: ; in the formula, is the impurity of the parent node , is the impurity of the child node , is the total change in impurity of all features; is the anomaly score of the original isolation forest algorithm for the sample at the th feature; Represents a sample of the weighted anomaly score; Integrated learning strategy: Construct multiple improved isolation forest sub-models, each sub-model using a different feature subset, and finally the anomaly score is the weighted average of the scores of each sub-model: ; Among them, is the weight of the th sub-model, calculated by the F1 score of the sub-model on the validation set: ; among them, is the th sub-model's F1 score on the validation set; represents the total number of sub-models, that is, the number of improved isolation forest sub-models participating in the ensemble learning; represents the th sub-model's F1 score on the validation set; S211.

2. Perform Z-score standardization: Perform Z-score standardization on the valid data passed through the detection; S211.

3. Perform exponential weighted moving average smoothing processing: Construct a sliding time window and perform exponential weighted moving average smoothing processing on the data within the window.

5. The adaptive data security management and risk warning system based on intelligent analysis under the cloud platform according to claim 1, characterized in that, In the adaptive policy generation module (300), the training process of the decision tree model optimized by reinforcement learning is as follows: Define the state space ; Design the reward function , where is the asset value coefficient, is the delay penalty coefficient; represents the probability of a successful attack; represents the time span from when the defense strategy is decided and executed to when the strategy actually takes effect and plays a defensive role in the system; represents the reward function in reinforcement learning; The proximal policy optimization (PPO) algorithm is used to update the decision tree parameters, and model iteration is performed every 1000 interaction steps.

6. The adaptive data security management and risk warning system based on intelligent analysis under the cloud platform according to claim 1, characterized in that, The differentiated security policies generated by the adaptive policy generation module (300) include data classification protection policies, dynamic access control policies, and data masking policies, where: Data classification protection policy: The RSA-2048 algorithm is used to encrypt and protect the data; Dynamic access control policy: Based on the risk feature vector, the RBAC role permissions are adjusted in real time, and the time window mechanism is used to achieve dynamic access control; Desensitization strategy: Implement role-based dynamic desensitization for medical data, and use the masking algorithm: MaskedValue = Hash(original value + role ID timestamp) mod , and desensitize the data.

7. The adaptive data security management and risk warning system based on intelligent analysis under the cloud platform according to claim 1, characterized in that The adaptive policy generation module (300) includes a policy effect evaluation unit (310), a reinforcement learning optimization unit (320), a policy combination evolution unit (330), and a fitness evaluation unit (340), where: Policy effect evaluation unit (310): Through security event backtracking analysis, calculate the interception rate, false alarm rate, and system performance impact coefficient of each security policy within a preset time window, and construct a multi-dimensional evaluation index system; Reinforcement learning optimization unit (320): Based on the evaluation index system, use the Q-learning algorithm to dynamically adjust the weight parameters of each differentiated security policy; Policy combination evolution unit (330): Use genetic algorithms to optimize the combination of data classification protection policies, dynamic access control policies, and data masking policies, including: Crossover operation: Cross-recombine the gene segments of the selected policy combination to generate a new policy combination; Mutation operation: Randomly perturb the parameters of the policy combination to explore potential better policy combinations; Fitness evaluation unit (340): Based on the evaluation index system, construct a fitness function to quantify the comprehensive performance of each policy combination.

8. The adaptive data security management and risk warning system based on intelligent analysis under the cloud platform according to claim 1, characterized in that, The four-color dynamic warning model includes a dynamic parameter optimization unit (410), a multi-modal feature enhancement unit (420), a dynamic threshold decision unit (430), and a response policy self-optimization unit (440), where: Dynamic parameter optimization unit (410): Continuously collect and analyze the real-time security event data of the cloud platform through an online learning algorithm, and dynamically adjust the internal parameter configuration of the risk assessment model. The adjustment process uses a heuristic search algorithm to avoid falling into local optima; Multi-modal feature enhancement unit (420): Use a deep learning network to perform dimensionality expansion and correlation mining on the risk feature vector, and generate an enhanced feature representation that combines the original features and high-order features; Dynamic threshold decision unit (430): Based on the enhanced feature representation, combined with the current cloud platform load status and historical warning data, calculate and optimize the trigger thresholds for each warning level in real time; Response policy self-optimization unit (440): Dynamically match the preset hierarchical response policies according to the warning level, and continuously optimize the policy combination and trigger conditions through a reinforcement learning mechanism.

9. The adaptive data security management and risk warning system based on intelligent analysis under the cloud platform according to claim 1, characterized in that The user behavior portrait construction module (500) includes a multi-dimensional feature extraction unit (510), a dynamic clustering unit (520), and a portrait generation unit (530), where: Multi-dimensional Feature Extraction Unit (510): Extract device fingerprint features, access time features, and operation frequency features in the user behavior sequence, calculate the information entropy of the device fingerprint, the distribution entropy of the access time, and the fluctuation entropy of the operation frequency respectively, and form a three-dimensional feature vector; Dynamic Clustering Unit (520): Use the DBSCAN density clustering algorithm to perform clustering analysis on the three-dimensional feature vector, dynamically determine the neighborhood radius and the minimum number of samples through an adaptive parameter adjustment mechanism, and the adaptive parameter adjustment mechanism automatically optimizes the clustering parameters based on the distance distribution characteristics between samples; Portrait Generation Unit (530): Generate a multi-dimensional behavior model including the normal behavior baseline interval based on the clustering result, and the multi-dimensional behavior model includes: Normal Behavior Baseline Interval: Determined by analyzing the statistical center and distribution range of the clustering result; Abnormal Behavior Trigger Threshold: Set based on the fluctuation boundary of the baseline interval, and used to identify abnormal operations that deviate from normal behavior.

10. The adaptive data security management and risk warning system based on intelligent analysis under the cloud platform according to claim 9, characterized in that The user behavior portrait construction module (500) further includes a portrait evolution unit (540), an abnormal behavior warning unit (550), and a risk feature calibration unit (560), where: Portrait Evolution Unit (540): Adjust the weights of historical behavior data through a time decay mechanism, so that the influence of recent behavior on the portrait is greater than that of long-term behavior; Abnormal Behavior Warning Unit (550): When the real-time behavior data deviates from the normal behavior baseline interval by more than the threshold, generate a warning signal and output it to the intelligent analysis module (200), and the warning signal includes a quantization index representing the degree of deviation; Risk Feature Calibration Unit (560): Dynamically adjust the weights of the corresponding dimensions in the risk feature vector according to the degree of deviation of the warning signal, and the adjustment amplitude is positively correlated with the degree of deviation.

Images