Clustering decision-based security baseline setting method, system and device, and medium

Abstract

The invention relates to the technical field of information security, in particular to a security baseline setting method and system equipment based on clustering decision and a medium, and the method comprises the steps: collecting original data, carrying out the construction of a feature vector through feature conversion, generating a sample, and marking and extracting the sample; constructing a classification model by using manifold learning, inputting the extracted feature vectors into the constructed classification model, optimizing the model through training, and outputting classification labels; processing the decision boundary by using constraint optimization and feature scaling to obtain a standardized feature vector converted by a decision boundary model, grouping based on the standardized feature vector, and extracting a baseline; the security policy is generated through data analysis, and the data is dynamically updated and continuously monitored, so that the unified configuration and centralized management of the security policy are realized, and the policy implementation efficiency and the system expansibility are remarkably improved.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of information security technology, and in particular to a security baseline setting method and system based on clustering decision, a device and a medium. BACKGROUND

[0002] With the wide application of API in distributed systems, its security requirements are increasingly complex. Traditional API security baseline relies on static rules, which is difficult to cope with dynamic threats, lacks cross-system coordination and is highly dependent on manual operation, and cannot meet the needs of modern complex environments. Static rules are difficult to adapt to business iteration and new attacks; single-system independent modeling leads to high conflict rate and long deployment cycle, and manual dependence restricts the scale of operation and maintenance, making it difficult to meet real-time protection needs.

[0003] In cross-application systems, the setting of API security baseline currently mainly relies on static rules and manual configuration, which has many problems. First, it is difficult to unify standards because different business systems have heterogeneous interface protocols, identity authentication methods, traffic models and risk tolerance, resulting in differences in security standards for the same API type in different systems, fragmented security policies and difficulty in centralized management and evaluation. Second, the traditional rule-based detection method lacks context awareness and behavior modeling capability, resulting in fuzzy security boundaries and easy occurrence of false negatives and false positives. Third, the current security baseline strategy has poor adaptability and is difficult to cope with the dynamic changes of API usage behavior, requiring frequent manual adjustment, which increases management complexity and the risk of configuration errors. Finally, with the increasing complexity of the number and interface structure of APIs, traditional baseline setting can only adopt conservative strategies, resulting in increased security boundary pressure and rising potential attack risk. At the same time, there is a lack of coordinated management of strategies between different systems, which easily leads to redundancy, vacancy and conflict, reducing the overall protection efficiency of the system. SUMMARY

[0004] In view of the above existing problems, the present application is proposed.

[0005] Therefore, this invention provides a security baseline setting method, system, device, and medium based on clustering decision-making to solve the following problems: First, it is difficult to unify standards because different business systems have heterogeneous interface protocols, authentication methods, traffic models, and risk tolerance, resulting in differences in security standards for the same API type in different systems, fragmented security policies, and difficulties in centralized management and evaluation; Second, traditional rule-based detection methods lack context awareness and behavior modeling capabilities, leading to blurred security boundaries and a high likelihood of false negatives and false negatives; Third, current security baseline policies have poor adaptability and are unable to cope with dynamic changes in API usage behavior, requiring frequent manual adjustments, increasing management complexity and the risk of configuration errors; Finally, as the number of APIs and the complexity of interface structures increase, traditional baseline setting can only adopt conservative strategies, leading to increased pressure on security boundaries, increased potential attack risks, and a lack of collaborative management between different systems, which can easily result in redundancy, gaps, and conflicts, reducing the overall system protection efficiency.

[0006] To solve the above-mentioned technical problems, the present invention provides the following technical solution:

[0007] In a first aspect, the present invention provides a method for setting a safety baseline based on clustering decision-making, comprising:

[0008] Collect raw data, construct feature vectors using feature transformation, generate samples, label the samples, and extract them;

[0009] A classification model is built using manifold learning. The extracted feature vectors are input into the constructed classification model, and the model is optimized through training to output the classification label.

[0010] Constraint optimization and feature scaling are used to process the decision boundary, resulting in a standardized feature vector of the decision boundary model. Based on the standardized feature vector, the model is grouped and the baseline is extracted.

[0011] Security policies are generated through data analysis, and the data is dynamically updated and continuously monitored.

[0012] As a preferred embodiment of the safety baseline setting method based on clustering decision-making described in this invention, the method includes: collecting raw data, constructing feature vectors using feature transformation, generating samples, labeling and extracting the samples, including:

[0013] Collect raw data, and extract feature vectors based on the collected raw data using feature transformation;

[0014] Filter out abnormal samples, extract normal samples, generate labeled safe samples, and annotate the samples.

[0015] As a preferred embodiment of the safety baseline setting method based on clustering decision-making described in this invention, the method includes: constructing a classification model using manifold learning, inputting the extracted feature vectors into the constructed classification model, optimizing the model through training, and outputting classification labels, including:

[0016] After completing the sample labeling, select a suitable clustering analysis model architecture, use manifold learning to build a classification model, input the feature vector into the classification model, and output the corresponding classification label;

[0017] The model is trained, and the parameters are adjusted and optimized to obtain the optimized model.

[0018] As a preferred embodiment of the safe baseline setting method based on clustering decision-making described in this invention, the method includes: processing the decision boundary using constraint optimization and feature scaling to obtain a standardized feature vector transformed from the decision boundary model; grouping based on the standardized feature vector and extracting the baseline, including:

[0019] After initial modeling, constraint optimization and feature scaling are performed on the decision boundary, and the processed model representation is output.

[0020] Based on the processed model representation, unsupervised learning is used to group the models and extract baselines.

[0021] As a preferred embodiment of the clustering-based decision-making method for setting a security baseline according to the present invention, the method includes: generating a security strategy through data analysis, dynamically updating and continuously monitoring the data, including:

[0022] After performing data analysis based on the decision boundary model, the analysis results are transformed into executable security policies.

[0023] After the strategy is deployed, the sample set is updated, real-time monitoring is performed, and the model parameters are fine-tuned periodically to manage the strategy's lifecycle.

[0024] The beneficial effects of this preferred technical solution are as follows: it utilizes manifold learning kernel functions to accurately analyze complex attack patterns, eliminates redundant support vectors through decision boundary compression technology to improve real-time interception efficiency, and maps thresholds and policies to a comparable space through feature normalization processing to provide standardized input for security baseline clustering. Finally, it achieves automatic evolution from attack identification to baseline iteration through dynamic policy closed loop, reducing the cost of multi-system operation and maintenance.

[0025] As a preferred embodiment of the safety baseline setting method based on clustering decision-making described in this invention, the method utilizes manifold learning to construct a classification model, including:

[0026] After completing the sample labeling, each system builds a classification model to identify abnormal API behavior. The overall model is constructed through techniques such as model architecture selection, nonlinear boundary fitting, and training optimization.

[0027] In terms of model architecture, the Support Vector Machine (SVM) model is selected as the core classification model. Each system trains a model separately to adapt to the differences in API behavior of different systems, but shares the underlying feature encoding logic, such as the request frequency being uniformly calculated as the number of times per minute. The model input is the API request feature vector, and the output is a binary classification security label.

[0028] A nonlinear boundary fitting strategy is adopted to handle complex scenarios with multiple feature interactions. The SVM model maps low-dimensional linearly inseparable features to a high-dimensional space through radial basis function (RBF), polynomial kernel function, and higher-order kernel function.

[0029] During training, parameter tuning and cross-validation are combined. Bayesian optimization algorithms are used to search for optimal hyperparameters such as the regularization parameter and kernel function parameter of SVM. Hierarchical k-fold cross-validation is used to ensure balanced sample distribution. At the same time, cross-system validation is introduced to optimize feature encoding, such as using the model of system A to test the API data of system B. If the accuracy decreases, the feature encoding is optimized.

[0030] The beneficial effects of this preferred technical solution are as follows: by training support vector machine models independently for each system and unifying the underlying feature encoding, feature comparability is ensured while taking into account business differences; complex attack patterns are analyzed by using higher-order mappings such as radial basis kernel functions, and feature engineering is continuously optimized by combining Bayesian optimization, automatic tuning, and cross-system verification, significantly improving the model's generalization ability; finally, millisecond-level attack interception is achieved based on the sparsity characteristics of support vectors, and the foundation is laid for subsequent clustering to generate cross-system security baseline templates, forming a "personalized defense-strategy reuse" closed loop, which ensures accurate protection for high-sensitivity scenarios such as financial payments while reducing the cost of multi-platform collaborative operation and maintenance.

[0031] As a preferred embodiment of the safety baseline setting method based on clustering decision-making described in this invention, the decision boundary is processed using constraint optimization and feature scaling, including:

[0032] After initial boundary modeling, the decision boundary is compressed, optimized, and normalized.

[0033] Identify and remove boundary points with large support vector spacing and high confidence, compress the decision boundary, simplify the model, enhance the classification ability of marginal samples, reduce the false alarm rate, map the decision function values ​​of each model to a unified space, facilitate cross-system evaluation and cluster analysis, and output the compressed and normalized model expression.

[0034] The beneficial effects of this preferred technical solution are as follows: by removing redundant decision boundary points and compressing the model size, the identification efficiency of edge attack samples is significantly improved; at the same time, the discriminant function values ​​of different systems are normalized to a unified scale, so that the threshold and the lenient policy can be directly quantified and compared, laying the foundation for cross-system security baseline clustering, ensuring millisecond-level response in e-commerce high-concurrency scenarios, and supporting the rapid migration and iteration of subsequent policy templates.

[0035] Secondly, the present invention provides a safety baseline setting system based on clustering decision-making, comprising:

[0036] The feature vector extraction module is used to collect data, extract feature vectors using a sequence model, generate samples, label the samples, and extract them.

[0037] The feature vector extraction module is used to collect raw data, construct feature vectors using feature transformation, generate samples, label the samples, and extract them.

[0038] The classification model building module is used to build a classification model using manifold learning. The extracted feature vectors are input into the built classification model, the model is optimized through training, and the classification label is output.

[0039] The decision boundary processing module uses constraint optimization and feature scaling to process the decision boundary, obtains a standardized feature vector transformed from the decision boundary model, groups the data based on the standardized feature vector, and extracts the baseline.

[0040] The security policy generation module is used to generate security policies through data analysis, and to dynamically update and continuously monitor the data.

[0041] Thirdly, the present invention provides an electronic device, comprising:

[0042] Memory and processor;

[0043] The memory is used to store computer-executable instructions, and the processor is used to execute the computer-executable instructions, which, when executed by the processor, implement the steps of a security baseline setting method based on clustering decision.

[0044] Fourthly, the present invention provides a computer-readable storage medium storing computer-executable instructions that, when executed by a processor, implement the steps of the security baseline setting method based on clustering decision.

[0045] Compared with existing technologies, the beneficial effects of this invention are as follows: This invention can automatically establish security baselines in a standardized and structured manner in various heterogeneous application systems, achieving unified configuration and centralized management of security policies, effectively solving the problems of inconsistent baseline setting standards and cumbersome manual adjustments between existing systems; by introducing a boundary contraction strategy based on density and distribution differences, it can effectively narrow the decision boundary range between normal and abnormal behaviors, reduce the redundancy tolerance zone, thereby reducing false alarm rate and false negative rate, and improving the policy discrimination accuracy and risk identification capability; the security policies output by this method can be standardized and encapsulated into policy rule sets, supporting direct deployment with existing automated protection components such as security gateways and security proxies, significantly improving the engineering level of policy implementation and the level of operation and maintenance automation, and shortening the response cycle from modeling to implementation; by using clustering algorithms to model the similarity of API call patterns of different systems, the system has good cross-domain migration and generalization capabilities. When a new system is connected, it can automatically match similar security baseline templates based on existing models, achieving rapid policy generation and deployment, improving system scalability and adaptation efficiency. Attached Figure Description

[0046] To more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings used in the following description of the embodiments will be briefly introduced. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0047] Figure 1 This is a schematic diagram of the overall process of a safety baseline setting method based on clustering decision-making according to an embodiment of the present invention. Detailed Implementation

[0048] To make the above-mentioned objects, features, and advantages of the present invention more apparent and understandable, specific embodiments of the present invention will be described in detail below with reference to the accompanying drawings. Obviously, the described embodiments are only a part of the embodiments of the present invention, and not all of them. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the protection scope of the present invention.

[0049] Example 1, referring to Figure 1 As an embodiment of the present invention, a method for setting a safety baseline based on clustering decision is provided, comprising:

[0050] S1: Collect raw data, construct feature vectors using feature transformation, generate samples, label the samples, and extract them;

[0051] S2: Utilize manifold learning to build a classification model, input the extracted feature vectors into the constructed classification model, optimize the model through training, and output the classification label;

[0052] S3: Use constraint optimization and feature scaling to process the decision boundary, obtain the standardized feature vector of the decision boundary model transformation, group based on the standardized feature vector and extract the baseline;

[0053] S4: Generate security policies through data analysis, and dynamically update and continuously monitor the data.

[0054] It should be noted that this technical solution achieves dynamic and intelligent leaps in API security baselines through intelligent compression of decision boundaries: In terms of accuracy, constraint optimization eliminates redundant boundary points, significantly reducing false alarms, while feature scaling unifies the decision space and enhances the ability to identify edge attacks; in terms of efficiency, it greatly shortens the deployment cycle of new interfaces and achieves broad compatibility with multi-protocol heterogeneous environments; in terms of sustainability, the closed-loop feedback mechanism combined with real-time feature analysis drives the baseline to evolve autonomously, effectively improving the resilience against new threats, while the policy output provides standardized support for auditing and tracing, significantly optimizing compliance management costs, and ultimately laying the technical foundation for a cross-system API immunity system under a zero-trust architecture.

[0055] Example 2, refer to Figure 1 As an embodiment of the present invention, based on the above embodiment, a method for setting a safety baseline based on clustering decision is provided.

[0056] In this embodiment of the application, step S1 involves collecting raw data, constructing feature vectors using feature transformation, generating samples, labeling the samples, and extracting them, including the following steps A1-A3:

[0057] A1: Collect raw data related to API access from multiple application systems;

[0058] A2: Based on the above raw data, each request is mapped to a standardized numerical feature vector;

[0059] A3: Generate labeled security samples, filter abnormal request samples, extract normal samples in combination with access control policies, and divide them into training set, validation set and test set according to system dimensions.

[0060] Specifically, the sources of A1 raw data mainly include:

[0061] In terms of data sources, the system mainly relies on components such as API gateway, reverse proxy server, and security module in the system deployment to collect log information and event records, including: access logs (such as Nginx or APIGateway logs), security alerts generated by anomaly detection systems (such as IDS / IPS), and samples of high-risk request behaviors in historical security events.

[0062] The fields extracted from the logs cover three main categories of information:

[0063] Request metadata: HTTP method, URL path, request header fields, and request body parameters;

[0064] Behavioral attributes: User behavior-related metrics such as request frequency, timestamp, source IP, User-Agent field, and duration of a single session;

[0065] System feedback: Interface response code, response time, error type (such as connection timeout, access denied, return of abnormal status code), and other system feedback data on the request.

[0066] Specifically, the main features in A2 include:

[0067] Request frequency statistics: such as the number of requests per minute, the growth rate of sudden requests, etc.;

[0068] Parameter structure complexity: Statistical parameters nesting level, total number of parameters, and type diversity;

[0069] Source IP credibility: A scoring label is provided based on external threat intelligence databases;

[0070] Response latency statistics: average response time and fluctuation range (standard deviation);

[0071] User behavior sequence: Based on the access path and time sequence, user behavior trajectory is modeled, and behavioral pattern features can be further extracted using models such as LSTM.

[0072] In this embodiment of the application, the feature vector is constructed using feature transformation. In the data acquisition and feature extraction stages, mapping is used as a core technical means to systematically transform the raw data of the API request into a structured feature vector. The conversion from discrete to numerical values ​​is achieved through a regularization function, and the behavioral attributes generate dynamic pattern features. Finally, the features are concatenated into a standardized vector of fixed length.

[0073] In an alternative implementation, the construction of feature vectors using feature transformation in step S1 can also be achieved through a relational graph embedding method, which constructs entities in API requests as a heterogeneous information network and encodes the association topology of high-frequency IP clusters and sensitive API paths into low-dimensional vectors.

[0074] In another alternative implementation, the construction of feature vectors using feature transformation in step S1 can also be achieved through rule template feature generation. Based on prior security knowledge, key events are combined and transformed into Boolean features to directly generate symbolic feature vectors. However, this method relies on expert experience and is difficult to detect new threats.

[0075] In this embodiment of the application, step S2 utilizes manifold learning to construct a classification model, inputs the extracted feature vectors into the constructed classification model, optimizes the model through training, and outputs classification labels, including the following steps B1-B4:

[0076] B1: The first-level algorithm is selected as the core classification model;

[0077] B2: Use manifold learning to build a classification model for identifying abnormal API behavior. The input of the model is a feature vector, and the output is a binary classification security label.

[0078] B3: Optimize the model through training to improve its ability to judge complex boundary samples;

[0079] B4: Extract representative critical samples to generate a formal rule verification model.

[0080] Specifically, the first-level algorithm in B1 uses the Support Vector Machine (SVM) model, with each system training its own model to adapt to the different API behaviors of various systems. However, the underlying feature encoding logic is shared, such as calculating request frequency uniformly based on the number of requests per minute, to ensure consistency of the basic feature space across systems.

[0081] Specifically, B3 optimizes the model through training by combining parameter tuning and cross-validation during the training process to improve the model's generalization ability. It uses Bayesian optimization algorithms to search for optimal hyperparameters, such as the regularization parameter and kernel function parameter of SVM, employs hierarchical k-fold cross-validation to ensure balanced sample distribution, and introduces cross-system validation to optimize feature encoding. For example, it uses the model from system A to test API data from system B; if the accuracy decreases, it optimizes the feature encoding to enhance the model's cross-system transferability.

[0082] In the embodiments of this application, the first-level algorithm adopts the Support Vector Machine (SVM) model. The SVM implicitly maps the structured feature vectors to the high-dimensional regenerating kernel Hilbert space through the kernel function to achieve accurate fitting. Its sparse support vector mechanism only relies on key historical attack samples to define the decision boundary, and solves the problem of imbalance of security samples by adjusting the class weights, and finally outputs binary classification labels.

[0083] In an alternative implementation, the first-level algorithm in step B2 can also be implemented using a random forest, which constructs multiple decision trees through random sampling and feature selection, and finally obtains the classification result through voting or averaging. However, this method has high complexity and takes too long to predict.

[0084] In another alternative implementation, the first-level algorithm in step B2 can also be implemented using a decision tree, which classifies the data through a series of rules. However, decision trees are prone to overfitting and are sensitive to noisy data.

[0085] In this application example, the classification model constructed using manifold learning employs a nonlinear boundary fitting strategy. This strategy is used to handle complex scenarios with multiple feature interactions. The SVM model uses higher-order kernel functions such as radial basis function (RBF) and polynomial kernel function to map low-dimensional linearly inseparable features to a high-dimensional space, thereby achieving linear separability of the "safe-unsafe" boundary.

[0086] In an alternative implementation, the classification model constructed using manifold learning in step S2 can also be achieved through an ensemble decision forest. An ensemble decision forest directly utilizes the mixed features of the output and learns explicit rule combinations through multiple decision trees. Its traceability is beneficial for the security team to optimize strategies, but the tree depth needs to be controlled to avoid overfitting.

[0087] In another optional implementation, the classification model built using manifold learning in step S2 can also be achieved through similarity nearest neighbor classification. A dynamic boundary is constructed, and the cosine similarity between the new request and the historical attack sample is calculated. If the similarity is greater than 90%, it is judged as abnormal. The model can be automatically adapted to the new attack mode. It can be deployed on the edge Nginx node by only incrementally updating the sample library, which meets the requirement of less than one millisecond response time. However, in the log scenario, it needs to be accelerated by combining KD tree index.

[0088] It should be noted that by training SVM models independently for each system and unifying the feature encoding basis, cross-system feature comparability is ensured while adapting to business differences. Complex attack patterns are accurately analyzed. Combined with Bayesian optimization, automatic parameter tuning, and cross-system verification, feature engineering is continuously optimized, significantly improving the model's generalization ability, compressing decision boundaries, and achieving millisecond-level attack interception. At the same time, it provides standardized input for subsequent security baseline clustering, forming a closed loop from precise defense to strategy reuse. Under the premise of ensuring the protection effect in high-sensitivity scenarios such as finance, the cost of multi-platform collaborative operation and maintenance is reduced.

[0089] In this embodiment, step S3 utilizes constraint optimization and feature scaling to process the decision boundary, obtaining a standardized feature vector transformed from the decision boundary model. Based on the standardized feature vector, grouping is performed and baselines are extracted, including the following steps C1-C2:

[0090] C1: Perform constraint optimization and feature scaling on the decision boundary to transform the processed decision boundary model into a structured feature vector;

[0091] C2: Based on the features of the processed model, perform unsupervised learning, conduct data analysis, and generate a cross-system security judgment baseline.

[0092] Specifically, in C1, constrained optimization and feature analysis are manifested through compression optimization and normalization:

[0093] After initial boundary modeling, in order to improve discrimination efficiency and cross-system universality, the decision boundary needs to be compressed, optimized and normalized.

[0094] Identify and remove boundary points that have little impact on classification, compress the decision boundary, simplify the model, enhance the classification ability of marginal samples, reduce the false alarm rate, and map the decision function values ​​of each model to a unified space to facilitate cross-system evaluation and cluster analysis. This step outputs a compressed and normalized model expression, providing stable and comparable input for intelligent generation of safety baselines.

[0095] In this application example, the constraint optimization used to process the decision boundary adopts compression optimization. This technical solution identifies and removes redundant boundary points, compresses the size of the decision boundary, simplifies the model, and enhances the ability to identify critical attack samples. Furthermore, it normalizes the discriminant function values ​​of different systems to a unified dimension space, making the strategy directly quantifiable and comparable, providing standardized input for cross-system security baseline clustering, and laying the foundation for strategy reuse while ensuring high interception efficiency.

[0096] In an alternative implementation, the constraint optimization in step S3 can also be achieved through dynamic boundary sparsification, which automatically preserves the core boundary regions that are truly critical for identifying abnormal API behavior across the system through mathematical constraints, thereby simplifying the boundary structure.

[0097] In another alternative implementation, the constraint optimization in step S3 can also be achieved through meta-boundary learning. The core of this method is to train a "boundary generator" that can quickly adapt to the new system. It uses historical data from multiple different systems to learn how to dynamically construct a suitable decision boundary for the new system based on a small number of normal samples.

[0098] Specifically, in C2, unsupervised learning is carried out based on the features of the processed model, using the K-Means algorithm as the specific method:

[0099] A fixed or adaptive clustering strategy is employed. The K-Means algorithm is used to group feature vectors by calculating the Euclidean distance between them. K-Means iteratively optimizes cluster centers, maximizing the similarity of feature vectors within clusters and maximizing the difference between clusters, thus grouping boundary models with similar features into one class. During clustering, the effectiveness of clusters is verified using silhouette coefficients (only clusters with a coefficient ≥ 0.6 are retained), ensuring that each class represents a true shared security model, and baseline extraction is performed. For each valid cluster, the top 25% of critical samples closest to the cluster center (mean of feature vectors) are selected as the benchmark to form a common baseline sample set. General rules are abstracted from this sample set, including standardized boundary thresholds, trusted parameter ranges, and typical request structures, and integrated to generate a unified security judgment template. This template supports export to JSON or YAML format, providing a reusable baseline for cross-system policy deployment.

[0100] In this application example, the unsupervised learning based on the features of the processed model adopts the K-Means algorithm. By extracting the core attributes of the decision boundary models of each system and normalizing them into comparable feature vectors, the cluster center is iteratively optimized to achieve automatic grouping of similar boundary models. Combined with the hard index of silhouette coefficient ≥0.6, effective safety pattern clusters are selected. Finally, based on the cluster center, the top 25% critical samples are selected to abstract standardized rules and generate JSON / YAML policy templates that can be transferred across systems, so as to achieve accurate reduction from the scattered models to the common safety baseline.

[0101] In one optional implementation, unsupervised learning is carried out in step S3 based on the features of the processed model. This can also be achieved through hierarchical clustering. By using a bottom-up aggregation strategy, feature vectors of similar boundary models are merged layer by layer to generate a tree-like clustering hierarchy diagram. The tree structure is then dynamically cut using silhouette coefficients to adapt to scenarios with an unknown number of clusters.

[0102] In another alternative implementation, unsupervised learning can be carried out based on the features of the processed model in step S3, which can also be achieved through density clustering. Dense clusters are automatically identified and outliers are filtered out based on the spatial density of the feature vector. Cluster boundaries are defined by core samples to capture local safe patterns. Its noise resistance avoids the forced classification of outlier models.

[0103] It should be noted that by compressing redundant boundary points to simplify the model, the efficiency of edge attack identification is significantly improved; normalization processing maps the decision function values ​​of different systems to a unified scale; based on K-Means clustering analysis, effective clusters with a silhouette coefficient ≥0.6 are extracted, and the most recent 25% critical samples of the cluster center are extracted to generate a cross-system security baseline template; finally, a standardized JSON / YAML policy file is output, realizing minute-level migration of electrical security rules, reducing the operation and maintenance costs of multi-platform policies while ensuring interception accuracy.

[0104] In this embodiment of the application, step S4 generates a security policy through data analysis, dynamically updates and continuously monitors the data, including the following steps D1-D4:

[0105] D1: Transform the analysis results into an executable security policy;

[0106] D2: Set up a periodic update mechanism to dynamically train the model and update the clustering results, and generate and replace the strategy;

[0107] D3: Continuously monitor the operation and update the sample set;

[0108] D4: Regularly retrain the model and fine-tune the parameters.

[0109] Specifically, D1 transforms the analysis results into executable security policies in the following ways:

[0110] Based on a unified judgment template, a policy file is generated, which includes boundary thresholds, parameter rules, request patterns, and trusted behavior ranges. It supports exporting to JSON or YAML, which facilitates the policy engine's parsing and integration. With the help of automated deployment, the policy is pushed to the control module or edge gateway of the target system to ensure that the policy is loaded and applied in real time and that the distribution is timely and consistent.

[0111] Specifically, D4 periodically retrains the model and fine-tunes the parameters in the following ways:

[0112] Based on the updated sample set, the model is retrained and its parameters are fine-tuned regularly, with a focus on optimizing the ability to distinguish critical samples, improving the model's generalization performance, generating new security policy templates and automatically deploying them. Combined with a version management mechanism, the policy is ensured to be auditable and rollback is supported. A closed-loop verification is formed through continuous monitoring and feedback to evaluate the optimization effect. Combined with the suggestions of security experts, human-machine collaborative adjustments are made to continuously improve the policy and model.

[0113] In summary, this invention achieves intelligent leaps in API security baselines through decision boundary learning and cross-system clustering collaboration mechanisms: In terms of accuracy, the nonlinear boundary fitting strategy accurately captures complex attack patterns, and combined with boundary compression optimization, it significantly reduces false positives; in terms of efficiency, normalization processing constructs a unified metric space, making the general security template generated by clustering compatible with heterogeneous protocols and business scenarios, and greatly shortening the deployment cycle of new interfaces; in terms of autonomy, the closed-loop feedback mechanism drives the baseline to evolve autonomously, continuously improving the resilience against new threats; and more innovatively, it integrates interpretable design and automated deployment, transforming the black-box model into an auditable and rapidly adjustable white-box strategy, significantly reducing operational complexity and manual verification costs, and ultimately constructing a three-in-one intelligent security immunity system of "accurate discrimination - cross-system generalization - self-evolving protection".

[0114] Example 3: The above is an illustrative scheme of a safety baseline setting method based on clustering decision.

[0115] This embodiment also provides a safety baseline setting system based on clustering decision-making, including:

[0116] The feature vector extraction module is used to collect raw data, construct feature vectors using feature transformation, generate samples, label the samples, and extract them.

[0117] The classification model building module is used to build a classification model using manifold learning. The extracted feature vectors are input into the built classification model, the model is optimized through training, and the classification label is output.

[0118] The decision boundary processing module uses constraint optimization and feature scaling to process the decision boundary, obtains a standardized feature vector transformed from the decision boundary model, groups the data based on the standardized feature vector, and extracts the baseline.

[0119] The security policy generation module is used to generate security policies through data analysis, and to dynamically update and continuously monitor the data.

[0120] This embodiment also provides an electronic device suitable for setting a security baseline based on clustering decisions, including: a memory and a processor; the memory is used to store computer-executable instructions, and the processor is used to execute the computer-executable instructions to implement the security baseline setting method based on clustering decisions as proposed in the above embodiment.

[0121] This embodiment also provides a storage medium storing a computer program that, when executed by a processor, implements the method for setting a safe baseline based on clustering decisions as proposed in the above embodiments.

[0122] The storage medium proposed in this embodiment and the method for setting a security baseline based on clustering decision proposed in the above embodiments belong to the same inventive concept. Technical details not described in detail in this embodiment can be found in the above embodiments, and this embodiment has the same beneficial effects as the above embodiments.

[0123] Based on the above description of the implementation methods, those skilled in the art will clearly understand that the present invention can be implemented using software and necessary general-purpose hardware, and of course, it can also be implemented using hardware. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as a computer floppy disk, read-only memory (ROM), random access memory (RAM), flash memory, hard disk, or optical disk, etc., including several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the methods of the various embodiments of the present invention.

[0124] It should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and not to limit it. Although the present invention has been described in detail with reference to preferred embodiments, those skilled in the art should understand that modifications or equivalent substitutions can be made to the technical solutions of the present invention without departing from the spirit and scope of the technical solutions of the present invention, and all such modifications or substitutions should be covered within the scope of the claims of the present invention.

Claims

1. A method for setting a safety baseline based on clustering decision-making, characterized in that, include: Collect raw data, construct feature vectors using feature transformation, generate samples, label the samples, and extract them; A classification model is built using manifold learning. The extracted feature vectors are input into the constructed classification model, and the model is optimized through training to output the classification label. Constraint optimization and feature scaling are used to process the decision boundary, resulting in a standardized feature vector of the decision boundary model. Based on the standardized feature vector, the model is grouped and the baseline is extracted. Security policies are generated through data analysis, and the data is dynamically updated and continuously monitored.

2. The method for setting a safety baseline based on clustering decision-making as described in claim 1, characterized in that, The process of collecting raw data, constructing feature vectors using feature transformation, generating samples, labeling the samples, and extracting data includes: Collect raw data, and extract feature vectors based on the collected raw data using feature transformation; Filter out abnormal samples, extract normal samples, generate labeled safe samples, and annotate the samples.

3. The method for setting a safety baseline based on clustering decision-making as described in claim 2, characterized in that, The method of constructing a classification model using manifold learning involves inputting the extracted feature vectors into the constructed classification model, optimizing the model through training, and outputting classification labels, including: After completing the sample labeling, a first-level algorithm is selected as the core classification model. Manifold learning is used to construct the classification model. The feature vector is input into the classification model and the corresponding classification label is output. The model is trained, and the parameters are adjusted and optimized to obtain the optimized model.

4. The method for setting a safety baseline based on clustering decision-making as described in claim 3, characterized in that, The process of using constraint optimization and feature scaling to process the decision boundary yields a standardized feature vector transformed from the decision boundary model. Based on this standardized feature vector, grouping is performed and baselines are extracted, including: After initial modeling, constraint optimization and feature scaling are performed on the decision boundary, and the processed model representation is output. Based on the processed model representation, unsupervised learning is used to group the models and extract baselines.

5. The method for setting a safety baseline based on clustering decision-making as described in claim 4, characterized in that, The process of generating security policies through data analysis, and dynamically updating and continuously monitoring the data, includes: After performing data analysis based on the decision boundary model, the analysis results are transformed into executable security policies. After the strategy is deployed, the sample set is updated, real-time monitoring is performed, and the model parameters are fine-tuned periodically to manage the strategy's lifecycle.

6. The method for setting a safety baseline based on clustering decision-making as described in claim 5, characterized in that, The method of constructing a classification model using manifold learning includes: After completing the sample labeling, each system builds a classification model to identify abnormal API behavior. The overall model is constructed through model architecture selection, nonlinear boundary fitting, and training optimization techniques. In terms of model architecture, the Support Vector Machine (SVM) model is selected as the core classification model. The model input is the API request feature vector, and the output is a binary classification security label. A nonlinear boundary fitting strategy is adopted to handle complex scenarios with multiple feature interactions. The SVM model maps low-dimensional linearly inseparable features to a high-dimensional space through radial basis function (RBF), polynomial kernel function, and higher-order kernel function. During training, parameter tuning and cross-validation are combined. The Bayesian optimization algorithm is used to search for the optimal hyperparameters, and hierarchical k-fold cross-validation is used to ensure a balanced sample distribution. At the same time, cross-system validation is introduced to optimize feature encoding. If the accuracy decreases, the feature encoding is optimized.

7. The method for setting a safety baseline based on clustering decision-making as described in claim 6, characterized in that, The process of using constraint optimization and feature scaling to handle the decision boundary includes: After initial boundary modeling, the decision boundary is compressed, optimized, and normalized. Identify and remove boundary points with large support vector spacing and high confidence, compress the decision boundary, simplify the model, enhance the classification ability of edge samples, reduce the false alarm rate, map the decision function values ​​of each model to a unified space, and output the compressed and normalized model expression.

8. A safety baseline setting system based on clustering decision-making, using the method described in any one of claims 1-7, characterized in that, include: The feature vector extraction module is used to collect raw data, construct feature vectors using feature transformation, generate samples, label the samples, and extract them. The classification model building module is used to build a classification model using manifold learning. The extracted feature vectors are input into the built classification model, the model is optimized through training, and the classification label is output. The decision boundary processing module uses constraint optimization and feature scaling to process the decision boundary, obtains a standardized feature vector transformed from the decision boundary model, groups the data based on the standardized feature vector, and extracts the baseline. The security policy generation module is used to generate security policies through data analysis, and to dynamically update and continuously monitor the data.

9. An electronic device, comprising: Memory and processor; The memory is used to store computer-executable instructions, and the processor is used to execute the computer-executable instructions, which, when executed by the processor, implement the steps of the security baseline setting method based on clustering decision as described in any one of claims 1 to 7.

10. A computer-readable storage medium storing computer-executable instructions that, when executed by a processor, implement the steps of the security baseline setting method based on clustering decision as described in any one of claims 1 to 7.

Images