Network security and data hosting integrated cloud service system and method

Abstract

The invention relates to the technical field of cloud computing and information security services, and particularly discloses a network security and data hosting integrated cloud service system and method, and the method comprises the steps: obtaining a multi-dimensional behavior data flow of a user, and generating a user feature vector; inputting the user feature vector into an incremental clustering algorithm, calculating the distance between the feature vector and a clustering center, performing user classification according to a distance threshold, and generating a user type tag; calculating a user reputation score based on the historical behavior statistical data of the category to which the user belongs; a sliding window algorithm is adopted to collect a data packet arrival time interval sequence, a jitter value in a window is calculated, a jitter value at the next moment is predicted, the number of packet loss in the window is counted, and a packet loss rate estimation value is calculated; and inputting the user type label, the reputation score, the jitter prediction value and the packet loss rate estimation value into a QoS decision engine. According to the invention, the problem of poor high-value user experience caused by unreasonable resource allocation is solved.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of cloud computing and information security services, more particularly to a network security and data hosting integrated cloud service system and method. BACKGROUND

[0002] In the cloud service environment of large-scale live streaming platforms, differentiated service quality guarantees need to be provided for different types of users (such as paying members, active fans, and ordinary viewers). The traditional quality of service (QoS) strategy adopts a static configuration method, which only allocates resources according to preset service levels, and cannot dynamically adapt to changes in user behavior characteristics and fluctuations in real-time network status. This static strategy has the following technical defects: first, it cannot identify the actual value and demand differences of users, resulting in high-value users not being given priority protection during network congestion; second, it lacks the ability to predict network jitter and packet loss, and cannot adjust the buffering strategy in advance to avoid playback stuttering; third, it cannot detect and protect against abnormal behavior of malicious users, and has security risks. Therefore, a dynamic quality of service management method that can integrate user behavior characteristics, real-time network status, and security needs is needed. SUMMARY

[0003] The present application provides a network security and data hosting integrated cloud service system and method, which solves the technical problems of being unable to identify the actual value and demand differences of users, resulting in high-value users not being given priority protection during network congestion; lacking the ability to predict network jitter and packet loss, and being unable to adjust the buffering strategy in advance to avoid playback stuttering; and being unable to detect and protect against abnormal behavior of malicious users, and having security risks.

[0004] The present application provides a network security and data hosting integrated cloud service method, comprising:

[0005] Obtaining user multi-dimensional behavior data stream, standardizing continuous numerical data, and numerically encoding classification data to generate user feature vector;

[0006] Inputting the user feature vector into the incremental clustering algorithm, calculating the distance between the feature vector and the clustering center, classifying the users according to the distance threshold, and generating user type labels; based on the historical behavior statistical data of the user's category, calculating the user reputation score by weighted summation of the normalized paying contribution, activity level, and historical reputation value;

[0007] Using a sliding window algorithm to collect data packet arrival time interval sequences, calculating the jitter value within the window, predicting the jitter value at the next moment using the exponential weighted moving average method, and calculating the packet loss rate estimate value by counting the number of packet losses within the window;

[0008] The user type label, the reputation score, the jitter prediction value and the packet loss rate estimation value are input into a QoS decision engine, and a personalized service parameter set including a buffer size, a transmission priority and a code rate parameter is generated based on a preset rule;

[0009] Buffer resource is dynamically allocated according to the service parameter set, a buffer strategy configuration is adjusted based on a network state, data packets are sorted according to a transmission priority, and an optimized transmission sequence is output;

[0010] User behavior change and transmission quality feedback are detected, and a risk control instruction is generated for an abnormal behavior mode.

[0011] The incremental clustering algorithm classifies by calculating the distance between a new user feature vector and an existing cluster center, and the user is classified into a corresponding category when the minimum distance is less than a preset threshold, otherwise a new cluster is created; the sliding window algorithm continuously monitors the network state through a fixed-size time window, and the smoothing coefficient of the exponential weighted moving average method determines the weight distribution of historical data and current data.

[0012] In a preferred embodiment, the standardization processing of continuous numerical data specifically includes: calculating the mean μ and the standard deviation σ through a sliding window method, and using the Z-score standardization method, the calculation formula is z=(x-μ) / σ, wherein x is an original data value; when the standard deviation σ is less than or equal to a minimum threshold, the standardized value is set to 0;

[0013] The numerical encoding of the classification data specifically includes: for a classification feature containing K different values, a K-dimensional binary vector is created, and only the corresponding category position is set to 1, and the remaining positions are 0.

[0014] In a preferred embodiment, the preset threshold θ of the incremental clustering algorithm is dynamically determined according to the dimension of the feature space, and the calculation method is θ=κ×√n, wherein κ is a threshold coefficient, the value range is [0.5, 2.0], and n is the dimension of the feature vector;

[0015] When a new user is added to a certain cluster, the cluster center is updated according to the formula: new cluster center=(user number×original cluster center+new user feature vector) / (user number+1).

[0016] In a preferred embodiment, the calculation of the user reputation score specifically includes:

[0017] First, the payment contribution, the activity level and the historical reputation value are normalized in the [0, 1] interval, and the normalization formula is: normalized value=(original value-minimum value) / (maximum value-minimum value);

[0018] Then the user reputation score is calculated: Reputation Score = α × Normalized Payment Contribution + β × Normalized Activity + γ × Normalized Historical Reputation Value, where α, β, γ are weight coefficients and satisfy α + β + γ = 1.

[0019] In a preferred embodiment, in the sliding window algorithm, the jitter value in the window is calculated according to the formula: Jitter Value = Average of Absolute Values of Differences between Actual Arrival Time Intervals of Adjacent Data Packets and Theoretical Transmission Intervals.

[0020] In a preferred embodiment, in the exponential weighted moving average method, the predicted jitter value at the next time is calculated according to the formula: Predicted Jitter Value = λ × Current Jitter Value + (1- λ) × Historical Predicted Value, where λ is a smoothing coefficient, and its value range is (0, 1).

[0021] Packet Loss Rate Estimate = Number of Lost Packets in the Window / Total Number of Data Packets that Should be Received in the Window.

[0022] In a preferred embodiment, the process of generating a set of service parameters by the QoS decision engine includes:

[0023] A three-dimensional lookup table is established, including the dimensions of user type, network state, and service parameters.

[0024] The buffer size is calculated according to the formula: Buffer Size = Base Buffer Size × (1 + User Level Coefficient + Network State Coefficient).

[0025] The transmission priority is calculated according to the user level and the network state level.

[0026] The code rate parameter is dynamically adjusted according to the network state, and the calculation formula is: Code Rate Parameter = Base Code Rate × (1 - Network State Adjustment Coefficient).

[0027] In a preferred embodiment, dynamically allocating buffer resources includes:

[0028] According to the buffer size parameter and the network state, the initial size, upper limit, and lower limit of the buffer are calculated.

[0029] Buffer Initial Size = Buffer Size Parameter × (1 - Packet Loss Rate Estimate).

[0030] Buffer Upper Limit = Buffer Size Parameter × (1 + Jitter Prediction Value / Theoretical Transmission Interval).

[0031] Buffer Lower Limit = Buffer Size Parameter × 0.5.

[0032] When the buffer occupancy rate exceeds 80%, temporarily increase the transmission priority of the user; when the buffer occupancy rate is less than 20%, appropriately reduce the code rate.

[0033] In a preferred embodiment, the detection of abnormal behavior patterns includes:

[0034] A user behavior baseline model is established, a distance between a new user behavior feature vector and the baseline is calculated, and when the distance exceeds a product of a threshold and a standard deviation of the baseline, it is determined that there is a significant change;

[0035] The anomaly detection rules include request frequency anomaly detection, data access pattern anomaly detection, and geographic location anomaly detection;

[0036] According to the anomaly type and severity, corresponding risk control instructions are generated, including temporary flow limiting, identity verification enhancement, and access privilege degradation.

[0037] In a preferred embodiment, the method further comprises the step of interacting with the user terminal using an adaptive negotiation protocol:

[0038] The server sends a negotiation request containing a set of candidate service parameters to the user terminal;

[0039] The user terminal calculates a device capability score based on local device capabilities, selects an appropriate parameter set, and sends a confirmation;

[0040] The server sets the selected parameter set as the final service level agreement parameters.

[0041] The present application provides a system comprising:

[0042] A data acquisition module, a user portrait generation module, a network state monitoring module, a QoS decision module, a resource allocation module, and a security protection module;

[0043] The data acquisition module is used to acquire and preprocess user behavior data;

[0044] The user portrait generation module uses an incremental clustering algorithm to dynamically generate user types and reputation scores;

[0045] The network state monitoring module predicts network state parameters based on a sliding window algorithm;

[0046] The QoS decision module fuses user portraits and network state information to generate service parameters;

[0047] The resource allocation module dynamically allocates system resources according to the service parameters;

[0048] The security protection module detects abnormal behavior and generates risk control instructions.

[0049] The present application has the following advantages:

[0050] The method overcomes the defects of the traditional static QoS strategy that cannot adapt to user differences and network changes by introducing a dynamic user portrait generation technology based on incremental clustering and a network state prediction technology based on a sliding window, and solves the problem of poor experience of high-value users caused by unreasonable resource allocation.

[0051] Specifically, the incremental clustering algorithm can update user classification in real time, so that the system can timely identify changes in user value; the sliding window algorithm predicts network jitter and packet loss rate, so that the system can adjust the buffering strategy in advance to avoid playback lag; and the QoS decision engine realizes personalized service parameter configuration by fusing user portrait and network state information. This multi-dimensional information fusion decision method enables high-value users to obtain priority protection when the network is congested, and provides security protection capability through abnormal behavior detection. BRIEF DESCRIPTION OF DRAWINGS

[0052] Figure 1 is a flowchart of a network security and data hosting integrated cloud service method of the present application. DETAILED DESCRIPTION

[0053] The subject matter described herein will now be discussed with reference to example implementations. It should be understood that discussions of these implementations are merely provided to enable those skilled in the art to better understand and thus implement the subject matter described herein, and the functions and arrangements of the elements discussed can be changed without departing from the scope of the content of this specification. Various processes or components can be omitted, substituted, or added according to various examples. In addition, features described in some examples can be combined in other examples.

[0054] At least one embodiment of the present application discloses a network security and data hosting integrated cloud service method, as shown in Figure 1 comprising the following steps:

[0055] Step 1: Obtain user multi-dimensional behavior data stream and generate feature vector;

[0056] This step obtains real-time data stream from the user behavior log of the live platform, including multi-dimensional information such as user viewing time, interaction frequency, payment record, historical network quality, etc. Since different dimensional data has different dimensions and numerical ranges, data preprocessing must be performed to eliminate the influence of dimensional differences on subsequent calculations:

[0057] Data preprocessing steps:

[0058] Continuous numerical data standardization processing: Z-score standardization method is used for continuous numerical data such as viewing time (unit: minutes), payment record (unit: yuan), network quality score, etc., and the calculation formula is The data of different dimensions are uniformly converted into dimensionless standardized values, ensuring that the dimensional data is in the same numerical range for subsequent operations;

[0059] Classification data encoding processing: the classification data such as user type (VIP member, paid user, ordinary user), device type (mobile terminal, PC terminal, tablet terminal) is converted into numerical type data by using one-hot encoding, so as to avoid the misleading of the numerical size of the classification label to the algorithm;

[0060] Time series data normalization processing: the time-related features (such as active period, viewing frequency) are normalized in the interval [0, 1] to eliminate the influence of time unit difference.

[0061] After the above data preprocessing, the user feature vector x is combined i =[x i1 , x i2 ,..., x in ], wherein x ij represents the j-th standardized feature value of the i-th user, n is the feature dimension, and all feature values are dimensionless values.

[0062] Further, the mean μ and the standard deviation σ in the Z-score standardization are obtained by sliding window calculation: a data window with a size of M (the value range of M is [1000, 10000], and the default value is 5000) is set, and the mean and the standard deviation The specific implementation method of one-hot encoding is: for a classification feature containing K different values, a K-dimensional binary vector is created, which is set to 1 only at the corresponding category position, and the other positions are 0. For example, the user type contains "paid member, ordinary user, VIP user" three kinds, and is encoded in the form of [1, 0, 0], [0, 1, 0], [0, 0, 1].

[0063] Further, in the Z-score standardization processing, in order to avoid the calculation abnormality caused by the zero standard deviation, when the standard deviation σ of a certain dimension data is less than or equal to δ (wherein δ = 10 -8 is a minimum threshold value), the standardized value of the dimension is set to 0, that is, z = 0. At the same time, in order to ensure the dimension consistency of the feature vector, the value range of the feature dimension n is [5, 20], and in the embodiment of the present application, a 10-dimensional feature vector is recommended, which includes viewing time, interaction frequency, payment record, historical network quality, user activity, geographic location, device type, viewing preference, social index, reputation history and other dimensions.

[0064] Further, the specific calculation formula of each feature value is:

[0065] Viewing time feature value:

[0066]

[0067] wherein T watch，i is the cumulative watching time of user i in the time window ΔT (unit: minute) ;

[0068] is the average watching time of all users, and N is the total number of users;

[0069] Interaction frequency feature value wherein I total，i = I comment，i + 2·I like，i + 5·I gift，i is the weighted total number of interactions, I comment，i , I like,i , I gift，i are respectively the number of bullet screen, the number of likes, and the number of rewards, and the weight coefficients are respectively 1, 2, and 5;

[0070] Paid record feature value wherein A pay，i is the cumulative payment amount of user i, A max is the maximum payment amount among all users, F pay，i is the payment frequency of user i, F max is the maximum payment frequency, and the weight coefficients w1 = 0.7 and w2 = 0.3 satisfy the constraint condition w1 + w2 = 1.

[0071] Step 2: analyze the feature vector by using the incremental clustering algorithm to generate user type labels and reputation scores;

[0072] The feature vector obtained in step 1 is input into the incremental clustering algorithm for real-time user classification. The incremental clustering algorithm adopts the following processing flow:

[0073] Step 201: calculate the distance d ik = ||x i -c k || between the feature vector of the new user and the existing clustering center, wherein c k is the kth clustering center;

[0074] Step 202: determine whether the minimum distance is less than the preset threshold θ, if yes, the user is classified into the corresponding category, otherwise a new cluster is created;

[0075] Further, the value of the preset threshold θ is dynamically determined according to the dimension of the feature space, and the calculation method is Where κ is the threshold coefficient, with a value ranging from [0.5, 2.0], and n is the dimension of the feature vector. Smaller values ​​of κ result in finer clustering, while larger values ​​result in coarser clustering. In this embodiment, the default value of κ is 1.0.

[0076] Furthermore, to ensure the reasonableness of the threshold setting, the value of θ must satisfy the constraint: θ>0 and θ≤θ max ,in The threshold θ is set to the maximum allowable threshold to prevent overly coarse clustering that would result in all users being grouped into the same category. Furthermore, the threshold θ needs to be adjusted accordingly to maintain consistency in clustering results when the feature vector dimension n changes.

[0077] Furthermore, the initialization process of the incremental clustering algorithm is as follows: upon initial startup, an empty set of cluster centers C is created. When the first user feature vector is received, it is set as the first cluster center c1 = x1, and the number of users in this cluster is initialized to m1 = 1. Distance calculation uses Euclidean distance, i.e. When creating a new cluster, the new cluster centers are directly assigned the current user's feature vector, i.e., C. new =x i .

[0078] Step 203: Calculate the user's reputation score based on historical behavioral statistics of the user's category. To eliminate the influence of different metrics, first, the paid contribution P... i Activity A i Historical reputation score H i Normalization is performed on the interval [0,1], and the calculation formula is as follows: A i and H i The same process is used. Then, the user reputation score is calculated. in Let α be the normalized dimensionless index value, and let α, β, and γ be weighting coefficients that satisfy α + β + γ = 1.

[0079] Furthermore, to avoid division by zero errors during normalization, when P max -P min When ≤∈ (where∈=10) -6 (As the minimum threshold), using A is handled in this way. i and H i The same outlier handling method is used. The specific values ​​of the weighting coefficients are determined according to the business scenario: for commercial platforms that mainly focus on paid services, α = 0.5, β = 0.3, γ = 0.2; for social platforms that mainly focus on interaction, α = 0.3, β = 0.5, γ = 0.2; for platforms that emphasize users' historical reputation, α = 0.2, β = 0.3, γ = 0.5.

[0080] In the embodiments of the present application, in order to improve the accuracy and real-time performance of clustering, the incremental clustering algorithm further comprises dynamic updating of the cluster center: when a new user is added to a certain cluster, the cluster center is updated according to where m is the number of users in the cluster. k

[0081] The foregoing incremental clustering algorithm is a conventional clustering algorithm, and the input of the incremental clustering algorithm is the user feature vector x generated in step 1 i =[x i1 , x i2 ,..., x in ], and the output is the user type label T i and the reputation score S i . The dynamic updating of the cluster center of the incremental clustering algorithm adopts an incremental average manner, and the real-time adjustment of the cluster center is achieved by weighting and averaging the new user feature vector and the original cluster center according to the number of users, thereby avoiding the defect that the traditional batch clustering algorithm needs to recalculate all data.

[0082] Further, the specific implementation steps of the incremental clustering algorithm are as follows:

[0083] Initialization stage: create an empty cluster center list C = [] and a corresponding user count list M = [];

[0084] Feature vector processing stage: for the newly arrived user feature vector x i , calculate the Euclidean distance between x i and all existing cluster centers

[0085] Clustering determination stage: find the minimum distance d min =min k d ik , if d min ≤θ, then the user is classified into the corresponding cluster and the cluster center is updated, otherwise a new cluster is created;

[0086] Cluster center updating stage: for the user classified into the existing cluster, the cluster center is updated according to the formula , and the user count m k =m k +1 is updated.

[0087] Step 3: calculate the real-time network jitter parameter based on the sliding window algorithm, and output the jitter prediction value and the packet loss rate estimate;

[0088] In this step, the sliding window algorithm is used to monitor and predict the network transmission quality in real time. A time window with a fixed size W is set, and the arrival time interval sequence t1, t2,..., t W of data packets is collected in the window.

[0089] Further, the sliding window size W is in the range of [10, 100], and the default value is 50. When the network environment is stable, a larger window size can be selected to improve the prediction accuracy; when the network environment changes rapidly, a smaller window size should be selected to improve the response speed. To ensure the effectiveness of the calculation, W ≥ 3 is required.

[0090] Further, the selection of the window size W must satisfy the constraint condition: 3 ≤ W ≤ 100 and W is a positive integer. When W < 3, the statistical sample is too small, resulting in inaccurate jitter calculation; when W > 100, the window is too large, reducing the sensitivity to network state changes. At the same time, the adjustment of the window size should follow the gradual principle, that is, the window size at adjacent time points should not change by more than ΔW max = 10 to avoid dramatic fluctuations in the prediction results.

[0091] Step 301: Calculate the jitter value in the window Wherein - t is the theoretical transmission interval;

[0092] Further, the theoretical transmission interval - t is calculated as follows: Wherein L pocket is the average size of the data packet (unit: bytes), which is obtained by statistically averaging the historical data packet size, R target is the target transmission rate (unit: bytes / second), which is determined according to the user's service level agreement. To ensure dimensional consistency, the numerator L packet (bytes) and the denominator R target (bytes / second) in the formula match the dimensions, and the calculation result - t has the dimension of seconds, which is consistent with the time interval dimension in the subsequent jitter calculation. When there is a lack of historical statistical data, - t can use the initial estimated value: 33.3 milliseconds for high-definition live (corresponding to 30 FPS frame rate), and 40 milliseconds for standard-definition live (corresponding to 25 FPS frame rate).

[0093] Step 302: Use the exponential weighted moving average method to predict the jitter value at the next time point:

[0094] J w+1 = λ · J w + (1 - λ) · J w

[0095] Wherein λ is the smoothing coefficient.

[0096] Further, the smoothing coefficient λ is in the range of (0, 1), and the specific value is determined according to the severity of the network change:

[0097] When the network state changes slowly, λ is set to [0.1, 0.3] to maintain the stability of the prediction; when the network state changes quickly, λ is set to [0.7, 0.9] to improve the sensitivity to changes; in general, the recommended value of λ is 0.5.

[0098] Further, the smoothing coefficient λ must satisfy the strict constraint condition: 0 < λ < 1, when λ = 0, the prediction value completely depends on the historical data and ignores the current observation, when λ = 1, the prediction value completely depends on the current observation and loses the smoothing effect. In order to ensure the convergence of the prediction algorithm, the adjustment step of λ should not exceed Δλ max = 0.1, and the adjustment frequency should not exceed once per minute to avoid system shock.

[0099] Step 303: Count the number of lost packets L in the statistical window w , calculate the packet loss rate estimate where N w is the total number of data packets received in the window.

[0100] Further, to avoid division by zero error, when N w = 0, set P loss = 0; at the same time, in order to ensure the reasonableness of the packet loss rate, the boundary constraint is performed on the calculation result: P loss ∈ [0, 1], when the calculation result exceeds this range, the truncation processing is performed.

[0101] The sliding window algorithm described above is a conventional time series data processing algorithm, the input of which is the sequence of data packet arrival time intervals t1, t2,..., t W , and the output is the jitter prediction value J w+1 and the packet loss rate estimate P loss . The sliding window algorithm realizes continuous monitoring of the network state through a fixed-size time window, where the smoothing coefficient λ of the exponential weighted moving average method determines the weight distribution of historical data and current data, the larger the value of λ, the higher the weight of current data, the faster the response speed but the lower the stability.

[0102] Further, the specific implementation steps of the sliding window algorithm are: data collection phase: maintain a circular buffer Buffer[W] with a size of W, collect data packet arrival timestamps timestamp i in real time, calculate the time interval t i = timestamp i - timestamp i-1Window sliding phase: When the buffer is full, a first-in, first-out (FIFO) strategy is adopted, with new data overwriting the oldest data, keeping the window size constant; Jitter calculation phase: All time intervals within the window are traversed, the absolute deviation from the theoretical transmission interval is calculated, and the average value is used to obtain the current jitter value J. w Prediction Update Phase: The jitter prediction value is updated using the exponentially weighted moving average formula, where the historical prediction value J... w Saved via memory variables; Packet loss statistics phase: By checking the continuity of packet sequence numbers, the number of lost packets J in the statistics window is counted. w Calculate the estimated packet loss rate.

[0103] Step 4: Input user type tags, reputation scores, and network status parameters into the QoS decision engine to calculate the personalized service parameter set;

[0104] This step will use the user type label T obtained in step 2. i And reputation score S i and the jitter prediction value J obtained in step 3 w+1 and packet loss rate estimate P loss As input, the personalized service parameter set Q is calculated by the QoS decision engine. i =B i P i R i B i P is the buffer size. i For transmission priority, R i This is the bitrate parameter.

[0105] Furthermore, the method for constructing the preset parameter configuration table is as follows: Establish a three-dimensional lookup table Table[U][N][Q], where U represents the user type dimension (including 3 levels: VIP user, paid user, and regular user), N represents the network status dimension (including 3 levels: good, average, and poor), and Q represents the service parameter dimension (including buffer size, transmission priority, and bitrate parameters). The specific configuration rule is: Buffer size B... i The calculation formula is:

[0106] B i =B base ·(1+0.3·U level +0.5·N level B base =2MB as the base buffer size, U level ∈0, 1, 2 represent user levels, N level ∈0, 1, 2 represent network status levels; transmission priority P i Through formula P i =min(10, 3+2·U)level +N level ) is calculated; the code rate parameter R i is determined according to the formula R i = R base ·(1-0.1·N level ), where R base is the basic code rate.

[0107] Further, the mapping relationship between the user level U level and the network state level N level must be clearly defined: U level = 0 corresponds to a normal user (reputation score S i ∈ [0, 0.4)), U level = 1 corresponds to a paid user (reputation score S i ∈ [0.4, 0.7)), and U level = 2 corresponds to a VIP user (reputation score S i ∈ [0.7, 1.0]); N level = 0 corresponds to a good network (packet loss rate P loss < 0.01 and jitter J w+1 < 10 ms), N level = 1 corresponds to a general network (0.01 ≤ P loss < 0.05 or 10 ≤ J w+1 < 30 ms), and N level = 2 corresponds to a poor network (P loss ≥ 0.05 or J w+1 ≥ 30 ms).

[0108] Further, the definition and calculation method of the basic code rate R base is as follows: R base = f(V resolution , F framerate ), where V resolution is the video resolution and F framerate is the frame rate. The specific values are as follows: when the resolution is 1920×1080 and the frame rate is 30 fps, R base = 3.0 Mbps; when the resolution is 1280×720 and the frame rate is 30 fps, R base = 1.5 Mbps; and when the resolution is 854×480 and the frame rate is 25 fps, R base = 0.8 Mbps. The code rate parameter must satisfy the constraint condition: R min ≤ R i ≤ R max , where R min = 0.2·R base is the minimum allowed code rate and R max = 2.0·Rbase The maximum allowed bit rate to ensure the video quality within an acceptable range.

[0109] Output parameter decoding conversion description:

[0110] Output service parameter set Q i = B i , P i , R i Need to be converted into specific system execution parameters by the following decoding conversion process:

[0111] Buffer size parameter decoding: buffer size B i , unit: MB, decoding conversion to system memory allocation parameters, the specific implementation is to call the system memory allocation interface:

[0112] allocateBuffer(userId, bufferSize_MB)

[0113] Where bufferSize_MB = B_i, the system allocates a video buffer of corresponding size for the user according to the parameter;

[0114] Transmission priority parameter decoding:

[0115] Transmission priority P i is an integer value (value range 1-10), decoding conversion to network transmission queue priority level, mapping relationship:

[0116] P i ∈[1, 3] corresponds to a low priority queue, P i ∈[4, 7] corresponds to a medium priority queue, P i ∈[8, 10] corresponds to a high priority queue, through the call network scheduling interface setTransmissionPriority(userId, priorityLevel) implementation;

[0117] Bit rate parameter decoding:

[0118] Bit rate parameter R i , unit: Mbps, decoding conversion to video encoder bit rate setting parameters, through the call encoder parameter adjustment interface:

[0119] setEncodingBitrate(userId, bitrate_Mbps)

[0120] Set the video encoding bit rate, where bitrate_Mbps = R_i, the encoder adjusts the video compression ratio and quality according to the parameter.

[0121] The rule-based decision method of the aforementioned QoS decision engine, with inputs of user type label T i , reputation score S i , jitter prediction value J w+1 and packet loss rate estimation value P loss , outputs personalized service parameter set Q i = (B i , P i , R i ). The rule-based decision method realizes parameter configuration through a predefined rule mapping table, where buffer size B i is in direct proportion to network jitter value, transmission priority P i is positively correlated with user reputation score, and code rate parameter R i is dynamically adjusted according to packet loss rate to ensure transmission quality.

[0122] Further, the specific implementation steps of the QoS decision engine are as follows: input parameter preprocessing stage: map reputation score S i to user level U level , and map network parameters (J w+1 , P loss ) to network state level N level ; rule table query stage: according to the combination of (U level , N level ), retrieve the corresponding basic parameter configuration from the three-dimensional lookup table Table[U][N][Q]; parameter calculation stage: calculate specific parameter values including buffer size, transmission priority and code rate parameter using predefined formulas; constraint checking stage: perform boundary constraint checking on the calculation results to ensure that the parameter values are within a reasonable range; parameter output stage: output the verified parameter set Q i to the subsequent processing module. Wherein, the user level mapping is realized through a segmented function:

[0123]

[0124] Further, the optimization objective function of the QoS decision engine considers the time dimension of system performance, which is defined as a time series optimization problem:

[0125]

[0126] Where T is the optimization time window length (value range is [10, 60] minutes, default value is 30 minutes), N is the number of online users at the same time, QoE i (t) is the experience quality score of user i at time t, and the calculation formula is QoE i (t) = 1 - P loss，i (t) - 0.1·J w+1，i (t) / - t. To ensure dimensional consistency, each term in the formula is a dimensionless value: the packet loss rate P loss，i (t) is a dimensionless ratio, the jitter ratio J w+1，i (t) - t. The dimensionless value is obtained by dividing the same time dimension, and the constant term 1 and the coefficient 0.1 are both dimensionless, so the entire QoE score is a dimensionless value in the interval [0, 1]. U i (t) is the resource utilization of user i at time t, C i (t) is the system cost, the weight coefficients ω1=0.6, ω2=0.2, ω3=0.2, and satisfy the constraint condition ω1+ω2+ω3=1. The constraint conditions include:

[0127] Resource constraints (where B total is the total buffer capacity of the system);

[0128] Bandwidth constraints (where R total is the total bandwidth capacity of the system), quality of service constraints QoE i (t)≥QoE min =0.7.

[0129] Further, the specific embodiment of the time dimension in the optimization objective function includes: time window division: dividing the continuous time axis into discrete time slices with length Δt, where Δt=1 minute, and the total optimization time window T contains T / Δt time slices; Time-dependent parameter update: the user reputation score S i (t) is updated in real time according to the user behavior data in time slice t, and the update frequency is once calculation at the end of each time slice; Time decay factor: a time decay factor γ T-t (where γ=0.95 is the decay coefficient), so that the contribution weight of earlier time slices gradually decreases, and the corrected objective function is

[0130] Time continuity constraints:

[0131] The parameter changes of adjacent time slices must satisfy the smoothness requirement, that is, ||Q i (t+1)-Q i (t)||≤∈ smooth , where ∈ smooth =0.1 is the smoothness threshold, which ensures the time continuity of the service parameters.

[0132] Step 5: dynamically allocate buffer resources according to the service parameter set to generate differentiated buffer strategy configuration;

[0133] According to the buffer size parameter Bi This dynamically allocates appropriate buffer resources to each user. The buffer strategy configuration includes: initial buffer size B. init =B i ·(1-P loss ), Buffer limit B max =B i ·(1+J w+1 / - t), and the lower bound of the buffer B min =B i • 0.5. Wherein, to ensure dimensional consistency, the jitter prediction value J... w+1 (Unit: milliseconds) and theoretical transmission interval - t (unit: millisecond) has the same time dimension, therefore the ratio J w+1 / - t is a dimensionless value, related to the packet loss rate P. loss (Dimensionless) maintains dimensional consistency in mathematical operations.

[0134] Furthermore, to ensure the rationality of the buffer parameters, constraints are applied to the calculation results: when B init ≤0.1·B i When, set B init =0.1·B i When B max >2.0·B i When, set B max =2.0·B i ; Buffer lower limit B min Keep as B i • Keep 0.5 unchanged to ensure basic buffer requirements. Meanwhile, B is required to... min ≤B init ≤B max The relationship always holds; when it is not satisfied, follow B. min =0.5·B init B max =2.0·B init The method was readjusted.

[0135] Furthermore, the system cost C i (t) and resource utilization rate U i The specific formula for calculating (t) is: System cost C i (t)=c1·B i (t)+c2·R i (t)+c3·P i(t), where cl=0.01 is the buffer cost coefficient (unit: yuan / MB·sec), c2=0.1 is the bandwidth cost coefficient (unit: yuan / Mbps·sec), and c3=0.005 is the priority processing cost coefficient (unit: yuan / level·sec); resource utilization where B max，i is the maximum allocable buffer for user i, R max，i is the maximum allocable bandwidth for user i. The constraint condition is further refined as: time continuity constraint |Q i (t+1)-Q i (t)|≤Δ max , where Δ max is the maximum allowed amplitude of parameter change to ensure smooth transition of service.

[0136] Further, the explicit definition of each parameter in the system cost and resource utilization formula is: the maximum allocable buffer B max，i is determined according to the user level, and the calculation formula is B max，i =B system ·α level , where B system =1000 MB is the total buffer capacity of the system, and α level is the level allocation coefficient (VIP user α level =0.1, paid user α level =0.05, and ordinary user α level =0.02); the maximum allocable bandwidth R max，i is calculated as R max，i =R system ·β level , where R system =10000 Mbps is the total bandwidth capacity of the system, and β level is the bandwidth allocation coefficient (VIP user β level =0.05, paid user β level =0.02, and ordinary user β level =0.01); the specific definition of the maximum allowed amplitude of parameter change Δ max is as follows:

[0137] the buffer size change |B i (t+1)-B i (t)|≤0.5 MB;

[0138] the transmission priority change |P i (t+1)-P i (t)|≤2 levels;

[0139] the code rate parameter change |R i (t+1)-R i|t|≤0.3 Mbps, ensuring the smoothness of service parameter adjustment and the continuity of user experience.

[0140] Step 6: Sort the encrypted data packets according to priority and buffer strategy, output the optimized transmission sequence.

[0141] This step sorts the encrypted data packets to be transmitted. First, according to the transmission priority P i Group the data packets of different users, and then arrange them in timestamp order within each priority group to generate the optimized transmission sequence.

[0142] It should be noted that the generation of the transmission sequence also takes into account the constraints of the buffer strategy: for users whose buffer is about to overflow, their data packets will be temporarily promoted in priority; for users with sufficient buffer, the transmission of their non-critical frames can be appropriately delayed.

[0143] Further, the objective function of transmission sequence optimization is defined as minimizing the time-weighted sum of total transmission delay:

[0144] where K i is the number of data packets for user i, w ik is the weight of the data packet (critical frame weight is 5, non-critical frame weight is 1), t finish，ik is the transmission completion time of data packet k, t arrive，ik is the arrival time of data packet k. The constraints include:

[0145] Transmission order constraint t start，ik ≥t finish，i (k-1) (data packets of the same user are transmitted in order), buffer capacity constraint (total buffer occupancy at any time does not exceed the capacity), delay constraint t finish，ik -t arrive，ik ≤D max，i (where D max，i is the maximum allowed delay for user i, VIP user is 100 ms, and ordinary user is 300 ms).

[0146] Further, the specific implementation steps of transmission sequence optimization are as follows: Data packet classification phase: according to the transmission priority P i classify all data packets to be transmitted into high, medium and low priority queues, and sort them in arrival timestamp order within each queue; scheduling decision phase: use priority preemptive scheduling algorithm to process data packets in high priority queue first, and dynamically adjust according to buffer status; transmission time calculation phase: calculate transmission time according to data packet size Size ik and current available bandwidth BW available ​ Further determine the transmission completion time t finish，ik = t start，ik + T trans，ik ; constraint verification phase: check whether the transmission scheme meets all constraint conditions, and adjust the transmission order or delay part of the data packet if the constraint is violated; sequence output phase: generate the final transmission sequence, including the transmission start time and expected completion time of each data packet.

[0147] Further, the parameter definition and calculation method of the transmission sequence optimization constraint condition are: the data packet size Size ik The value range is [500, 1500] bytes, wherein the average size of I frame data packet is 1200 bytes, the average size of P frame data packet is 800 bytes, and the average size of B frame data packet is 600 bytes; the current available bandwidth BW available Is obtained by monitoring the network state in real time, and the calculation formula is Wherein BW total is the total bandwidth of the system, The total bandwidth occupied by the current active transmission; B total In the buffer capacity constraint is defined as the total capacity of the system physical buffer, the value is 1000MB, and the constraint condition ensures that the total buffer occupation of all users at any time does not exceed this limit; the maximum allowed delay D max，i In the delay constraint is determined according to the user level and service type: the real-time service of VIP user D max，i = 50ms, the non-real-time service of VIP user D max，i = 100ms, the real-time service of ordinary user D max，i = 200ms, the non-real-time service of ordinary user D max，i = 300ms.

[0148] Step 7: use the adaptive negotiation protocol to interact with the user end to determine the service level agreement;

[0149] Through the adaptive negotiation protocol, the parameter negotiation is carried out with the user end, and the service parameter set generated in step 4 is fine-tuned according to the device capability and network condition of the user end, to determine the final service level agreement (SLA).

[0150] Further, the specific implementation method of the adaptive negotiation protocol is: first, the server end sends a negotiation request packet to the user end, including the candidate service parameter set Q i1 , Q i2 , Q i3 , wherein each parameter set corresponds to different service quality level; the user end calculates the device capability score according to the CPU load, memory usage, network bandwidth and other parameters of the local device after receiving Where each parameter is normalized to the interval [0, 1]; the user end selects the appropriate parameter set according to the device capability score and sends a confirmation package to the server end; after receiving the confirmation package, the server end takes the selected parameter set as the final SLA parameter and starts providing services according to the parameter.

[0151] Further, the specific implementation steps of the adaptive negotiation protocol are as follows: negotiation initialization stage: the server end generates three candidate parameter sets according to the user reputation score and the current network state, corresponding to high, medium and low service quality levels respectively; parameter set transmission stage: the candidate parameter sets are encapsulated into negotiation request packages and sent to the user end through a reliable transmission protocol, including a timeout retransmission mechanism to ensure successful transmission; device capability evaluation stage: the user end obtains real-time device status through system API, including CPU usage (read through / proc / stat file), memory usage (calculated through / proc / meminfo file), and network bandwidth (estimated through network speed measurement algorithm); parameter set selection stage: according to the device capability score C device The most suitable parameter set is selected, and the selection rule is: C device ≥ 0.7 to select a high-quality parameter set, 0.4 ≤ C device < 0.7 to select a medium-quality parameter set, C device < 0.4 to select a low-quality parameter set; confirmation feedback stage: the user end encapsulates the selection result into a confirmation package and sends it to the server end, and the server end updates the user's SLA configuration after receiving it and starts execution.

[0152] Step 8: Detect transmission quality feedback and user behavior changes, and dynamically update user portrait;

[0153] Real-time monitoring of user transmission quality feedback information, including the number of stalls, retransmission requests, etc., while detecting changes in user behavior patterns. When significant changes are detected, return to step 2 to reclassify and calculate the reputation score.

[0154] Further, the specific implementation method of user behavior change detection is as follows: establish a user behavior baseline model, record the user's behavior feature vector x i，t-T+1 , x i，t-T+2 ,..., x i，t .

[0155] Calculate the behavior baseline vector

[0156] When a new user behavior feature vector x i，ew is received, calculate the Euclidean distance d change = ||x i，new -x baseline || from the baseline; if d change > τ·σbaseline (where τ = 2.0 is the change detection threshold, σ baseline is the standard deviation of the baseline vector), a significant change is determined, triggering the user profile update procedure. The quality of transmission feedback is detected by calculating the quality change rate and when |Q change | > 0.2 triggers the parameter recalculation.

[0157] Further, the value of the change detection threshold τ must satisfy the statistical rationality constraint: τ ∈ [1.5, 3.0], where τ = 2.0 corresponds to an abnormality detection with a 95% confidence level. When τ < 1.5, too many false positives will be generated, and when τ > 3.0, real behavior changes will be missed. The quality change rate threshold 0.2 is set based on empirical statistics, indicating that when the quality change exceeds 20%, it is considered necessary to adjust the parameters. The reasonable range of this threshold is [0.1, 0.3], which can be adjusted according to business needs.

[0158] Further, the calculation formula of the baseline standard deviation σ baseline is as follows:

[0159]

[0160] The value of the time window T is in the range [5, 20], with a default value of 10. The quality score Q current is defined as the comprehensive service quality score at the current time: To ensure dimensional consistency, each term in the formula is a dimensionless value: the packet loss rate P loss is a dimensionless ratio, the jitter ratio is a dimensionless value obtained by dividing the same time dimension (milliseconds), and the code rate ratio is a dimensionless value obtained by dividing the same code rate dimension (Mbps). Therefore, the entire quality score is a dimensionless value. Among them, α q = 0.4, β q = 0.3, and γ q = 0.3 are quality weight coefficients, R actual is the actual transmission code rate, R target is the target code rate, and the constraint conditions are α q + β q + γ q = 1 and Q current ∈ [0, 1]. The triggering condition of the user profile update is further refined as follows: only when the number of continuous abnormal detections exceeds the threshold N anomaly = 3 does the update execute, in order to avoid false positives caused by occasional fluctuations.

[0161] Step 9: Trigger security protection for the detected abnormal behavior pattern, and generate risk control instructions.

[0162] Analyzing user behavior data, when detecting abnormal patterns (such as a large number of requests in a short time, abnormal data access patterns, etc.), generating corresponding risk control instructions, including flow limiting, identity verification enhancement and other measures.

[0163] Further, the specific implementation method of abnormal behavior pattern detection is to establish an abnormal detection rule set, including the following detection items: request frequency abnormality detection: count the number of requests N of a user in a time window ΔT req , when N req > N threshold , where N threshold is set according to user type, 1000 times / minute for VIP users and 100 times / minute for ordinary users, triggering frequency abnormality alarm; data access pattern abnormality detection: calculate the entropy value H of user access resources , where p r is the probability of accessing resource r, and when H < H min (H min = 0.5), it is determined that the access pattern is too concentrated; geographic location abnormality detection: when the distance between the user login geographic location and the historical location exceeds 500 kilometers and the time interval is less than 1 hour, triggering geographic location abnormality. The risk control instruction generation method is: generating corresponding control instructions according to the abnormal type and severity, including temporary flow limiting (reducing user request processing priority by 50%), identity verification enhancement (requiring secondary verification), access privilege downgrade (prohibiting access to sensitive resources), and other measures. Each measure corresponds to specific system execution parameters and duration.

[0164] Further, the setting of abnormal detection threshold must be based on statistical principles and business actual needs: the request frequency threshold N threshold is set based on the 95th percentile of normal user behavior, and the VIP user threshold 1000 times / minute corresponds to the reasonable upper limit of high active users, and the ordinary user threshold 100 times / minute prevents malicious volume behavior; The access entropy threshold H min = 0.5 is based on information theory principles, when the entropy value is less than 0.5, it indicates that the user access is too concentrated and may be abnormal, and the reasonable range of this threshold is [0.3, 0.8]; The 500-kilometer distance threshold and 1-hour time threshold of geographic location abnormality are based on physical accessibility constraints, considering the maximum moving ability of high-speed transportation tools.

[0165] Further, the calculation formula of abnormal behavior comprehensive score is:

[0166] Risk score = w f ·f(N req )+w e ·g(H)+w g ·h(dgeo )

[0167] wherein is the frequency anomaly scoring function;

[0168] is the entropy anomaly scoring function;

[0169] is the geographic location anomaly scoring function (d geo is the geographic location change distance, d threshold = 500 kilometers), the weight coefficients w f = 0.5, w e = 0.3, w g = 0.2, satisfying the constraint condition w f + w e + w g = 1.

[0170] Further, the specific definition and constraint conditions of each parameter in the abnormal behavior comprehensive scoring formula are as follows:

[0171] The statistical time window ΔT of the request number N req is fixed at 1 minute, and the counting range includes all HTTP requests, API calls and data transmission requests, with the constraint condition that N req ≥ 0 and is a non-negative integer;

[0172] The calculation of the access entropy value H is based on the different resource types accessed by the user within the statistical period, and the resource categories include video streaming, chat messages, user information, payment interfaces, etc., with the constraint condition that H ≥ 0 and H ≤ log2(R total ), where R total is the total number of resource types in the system;

[0173] The geographic location change distance d geo is calculated by GPS coordinates, and the calculation formula is:

[0174] d geo = R earth · arccos (sin (φ1) sin (φ2) + cos (φ1) cos (φ2) cos (△λ))

[0175] where R earth = 6371 kilometers is the radius of the earth, φ1, φ2 are the latitudes, and Δλ is the longitude difference, with the constraint condition that 0 ≤ d geo ≤ 20,000 kilometers (the maximum distance on the earth's surface);

[0176] The value range of the comprehensive risk score Risk score is strictly limited in the interval [0, 1], and boundary clipping processing is performed when the calculation result exceeds this range.

[0177] Risk Control Instruction Decoding and Conversion Description:

[0178] Risk Level Determination Rule: When Risk score ≥ 0.8, it is high risk (perform flow limiting + authentication enhancement + access privilege degradation), when 0.5 ≤ Risk score < 0.8, it is medium risk (perform flow limiting + authentication enhancement), when 0.3 ≤ Risk score < 0.5, it is low risk (only perform flow limiting). The generated risk control instruction needs to be decoded and converted into specific system execution operations:

[0179] Further, the setting of risk level determination threshold is based on the principle of layered security protection: the low risk threshold 0.3 corresponds to slight abnormality requiring basic protection, the medium risk threshold 0.5 corresponds to obvious abnormality requiring enhanced protection, and the high risk threshold 0.8 corresponds to serious abnormality requiring comprehensive protection. The setting of these thresholds ensures complete coverage of Risk score ∈ [0, 1], and there is no overlap or omission between each risk level, satisfying 0 ≤ Risk score < 0.3 (normal), 0.3 ≤ Risk score < 0.5 (low risk), 0.5 ≤ Risk score < 0.8 (medium risk), 0.8 ≤ Risk score ≤ 1.0 (high risk) complete classification.

[0180] Flow limiting instruction decoding: flow limiting duration T limit = 60·Risk score seconds, decoded and converted into system flow limiting parameters by calling the flow control interface.

[0181] Authentication enhancement instruction decoding: decoded and converted into authentication system parameters by calling the security verification interface.

[0182] Access privilege degradation instruction decoding: priority reduction amplitude Access privilege recovery time T recovery = 300·Risk score seconds, decoded and converted into privilege management system parameters by calling the privilege control interface.

[0183] Further, the constraint conditions and calculation ranges of each parameter in risk control instruction decoding and conversion are: the value range of flow limiting duration T limit is [18, 60] seconds (corresponding to risk score 0.3-1.0), when Risk scoreWhen the risk score is less than 0.3, no flow limiting operation is performed, the flow limiting ratio rateLimitPercent is fixed at 50%, indicating that the user request processing speed is reduced to 50% of the normal speed; the validity period validityPeriod is fixed at 300 seconds (5 minutes), and the authentication type authType supports three modes of "SMS_CODE" (short message verification code), "EMAIL_CODE" (email verification code) and "TOTP" (time dynamic password), which are automatically selected according to user settings; the value range of the authority degradation amplitude ΔP is [3, 10] levels, which corresponds to the linear mapping of the risk score 0.3-1.0, and the authority recovery time T recovery The value range of the authority recovery time T is [90, 300] seconds, which ensures that the user authority can be recovered in time after the risk is eliminated, avoiding excessive restriction of the use experience of normal users.

[0184] A large game live broadcast platform has 5 million simultaneous online users during the evening peak period (19:00-23:00), including different types of users: 15% are paid member users, 35% are active free users, and 50% are ordinary spectators. The platform needs to provide differentiated service quality for different users under limited bandwidth resources (total bandwidth capacity of 50 Gbps) to ensure the viewing experience of high-value users.

[0185] At 21:00 in the evening, the system detects that the network fluctuates, and some users in some areas have increased network jitter and slight packet loss. At this time, it is necessary to dynamically adjust the service parameters of various users to respond to network state changes.

[0186] The system can dynamically adjust the service parameters according to the real-time behavior characteristics of the user and the network state. High-value users (such as U004) obtain the highest priority and the largest buffer resource, while ordinary users appropriately reduce the service quality when the network state is poor. At the same time, the system detects that user U005 has an abnormal behavior pattern, and timely triggers multiple security protection measures.

[0187] The above describes embodiments of the present application, but the embodiments are not limited to the specific implementation described above, which is only illustrative and not limiting. Those skilled in the art can make more forms of equivalent embodiments under the inspiration of the embodiments, which are all within the protection scope of the embodiments.

Claims

1. A cloud service method integrating network security and data hosting, characterized in that, Includes the following steps: Acquire multi-dimensional user behavior data streams, standardize continuous numerical data, numerically encode categorical data, and generate user feature vectors; The user feature vector is input into the incremental clustering algorithm to calculate the distance between the feature vector and the cluster center. Based on the distance threshold, the user is classified and user type labels are generated. Based on the historical behavioral statistics of the user's category, the user's reputation score is calculated by weighting and summing the normalized paid contribution, activity level, and historical reputation score. The sliding window algorithm is used to collect the data packet arrival time interval sequence, calculate the jitter value within the window, use the exponentially weighted moving average method to predict the jitter value at the next moment, and count the number of lost packets within the window to calculate the estimated packet loss rate. Input user type tags, reputation scores, jitter prediction values, and packet loss rate estimates into the QoS decision engine, and generate a personalized service parameter set containing parameters such as buffer size, transmission priority, and bit rate based on preset rules; The buffer resources are dynamically allocated based on the service parameter set, the buffer strategy configuration is adjusted based on the network status, the data packets are sorted according to the transmission priority, and the optimized transmission sequence is output. It detects changes in user behavior and transmission quality feedback, and generates risk control instructions for abnormal behavior patterns. Among them, the incremental clustering algorithm classifies users by calculating the distance between the feature vector of a new user and the existing cluster centers. When the minimum distance is less than a preset threshold, the user is assigned to the corresponding category; otherwise, a new cluster is created. The sliding window algorithm continuously monitors the network status through a fixed-size time window, where the smoothing coefficient of the exponentially weighted moving average method determines the weight allocation of historical and current data.

2. The integrated cloud service method for network security and data hosting according to claim 1, characterized in that, Standardization of continuous numerical data includes: calculating the mean μ and standard deviation σ using a sliding window method, employing the Z-score standardization method, with the formula z = (x - μ) / σ, where x is the original data value; and setting the standardized value to 0 when the standard deviation σ is less than or equal to the minimum threshold. Numerical encoding of categorical data involves creating a K-dimensional binary vector for each categorical feature with K different values, setting the vector to 1 only at the corresponding category position and 0 at the rest.

3. The integrated cloud service method for network security and data hosting according to claim 1, characterized in that, The preset threshold θ of the incremental clustering algorithm is dynamically determined based on the dimension of the feature space. The calculation method is θ=κ×√n, where κ is the threshold coefficient, with a value range of [0.5,2.0], and n is the dimension of the feature vector. When a new user is added to a cluster, the cluster center is updated according to the formula: New cluster center = (Number of users × Original cluster center + New user feature vector) / (Number of users + 1).

4. The integrated cloud service method for network security and data hosting according to claim 1, characterized in that, The calculation of user credit score specifically includes: First, the paid contribution, activity level, and historical reputation value are normalized in the range [0,1]. The normalization formula is: Normalized value = (original value - minimum value) / (maximum value - minimum value); Then calculate the user's reputation score: Reputation score = α × Normalized paid contribution + β × Normalized activity + γ × Normalized historical reputation value, where α, β, and γ are weighting coefficients and satisfy α + β + γ = 1.

5. The integrated cloud service method for network security and data hosting according to claim 1, characterized in that, In the sliding window algorithm, the jitter value within the window is calculated as follows: Jitter value = the average of the absolute values ​​of the differences between the arrival time intervals of adjacent data packets within the window and the theoretical transmission interval; The formula for predicting the jitter value at the next moment using the exponentially weighted moving average method is: predicted jitter value = λ × current jitter value + (1-λ) × historical predicted value, where λ is the smoothing coefficient and its value ranges from (0,1). Packet loss rate estimate = number of packets lost within the window / total number of data packets that should be received within the window.

6. The integrated cloud service method for network security and data hosting according to claim 1, characterized in that, The process by which the QoS decision engine generates a service parameter set includes: Establish a three-dimensional lookup table, including user type dimension, network status dimension, and service parameter dimension; The buffer size is calculated using the formula: Buffer size = Base buffer size × (1 + User level coefficient + Network status coefficient); Transmission priority is calculated based on user level and network status level; The bitrate parameter is dynamically adjusted according to the network status. The calculation formula is: Bitrate parameter = Base bitrate × (1 - Network status adjustment coefficient).

7. The integrated cloud service method for network security and data hosting according to claim 1, characterized in that, Dynamically allocated buffer resources include: Calculate the initial size, upper limit, and lower limit of the buffer based on the buffer size parameter and network status; Initial buffer size = buffer size parameter × (1 - estimated packet loss rate); Buffer limit = Buffer size parameter × (1 + jitter prediction value / theoretical transmission interval); The lower limit of the buffer is equal to the buffer size parameter multiplied by 0.

5. When the buffer occupancy rate exceeds 80%, the user's transmission priority is temporarily increased; when the buffer occupancy rate is below 20%, the bitrate is appropriately reduced.

8. The integrated cloud service method for network security and data hosting according to claim 1, characterized in that, Abnormal behavior pattern detection includes: Establish a user behavior baseline model, calculate the distance between the new user behavior feature vector and the baseline, and determine a significant change when the distance exceeds the product of a threshold and the baseline standard deviation; Anomaly detection rules include: anomaly detection of request frequency, anomaly detection of data access patterns, and anomaly detection of geographical location; Based on the anomaly type and severity, corresponding risk control instructions are generated, including temporary rate limiting, authentication enhancement, and access permission downgrading.

9. The integrated cloud service method for network security and data hosting according to any one of claims 1 to 8, characterized in that, It also includes steps for interacting with the user client using an adaptive negotiation protocol: The server sends a negotiation request containing a set of candidate service parameters to the client. The user terminal calculates the device capability score based on the local device capabilities, selects the appropriate parameter set, and sends a confirmation. The server will use the selected set of parameters as the final service level agreement parameters.

10. A system for executing the integrated cloud service method for network security and data hosting as described in any one of claims 1-9, characterized in that, It includes a data acquisition module, a user profile generation module, a network status monitoring module, a QoS decision-making module, a resource allocation module, and a security protection module; The data acquisition module is used to acquire and preprocess user behavior data; The user profile generation module uses an incremental clustering algorithm to dynamically generate user types and reputation scores; The network status monitoring module predicts network status parameters based on the sliding window algorithm; The QoS decision module integrates user profiles and network status information to generate service parameters; The resource allocation module dynamically allocates system resources based on service parameters; The security protection module detects abnormal behavior and generates risk control instructions.

Images