A PaaS+SaaS architecture security risk identification method

Abstract

The present application relates to the field of electric digital data processing, and in particular to a PaaS+SaaS architecture security risk identification method, forming a training data set; generating a conditional weighted embedding vector of each configuration item; constructing an original feature matrix; obtaining a feature enhancement matrix; performing risk context feature extraction, gated residual feature enhancement, risk level prediction, calculating a loss function, performing parameter update based on dynamic weight decay, iterative training and stop iteration condition judgment, obtaining a trained identification model; deploying the trained identification model to a security analysis node of the PaaS+SaaS architecture, and the trained identification model outputs a risk state corresponding to new log data. The existing security risk identification method has low identification accuracy and low stability. The identification method provided by the present application has high identification accuracy and high stability.

Description

Technical Field

[0001] This invention relates to the field of electronic digital data processing, and specifically to a method for identifying security risks in a PaaS+SaaS architecture. Background Technology

[0002] Cloud computing is a service-based computing approach, where all IT resources, including hardware, software, and architecture, are sold as a service and charged accordingly. The main services offered by cloud computing are IaaS, PaaS, and SaaS. PaaS+SaaS solutions are an integrated service model that combines the flexibility of PaaS with the ease of use of SaaS. However, due to its inherent multi-tenancy, strong coupling, and high dynamism, it faces greater security risks. Therefore, security risk identification methods are used to monitor and identify the security risk status of PaaS+SaaS architectures. However, the massive scale and inconsistent formats of multi-source heterogeneous data, such as cloud platform logs, SaaS audit logs, authentication logs, and vulnerability scan logs, make conventional rule-based or keyword-matching detection methods ill-suited to this high-dimensional and dynamic security scenario. Attack chains often span different log sources, encompassing both temporal user operation sequences and spatial vulnerability distributions. Existing technologies often employ simple splicing or independent modeling methods, failing to effectively capture potential causal relationships under spatiotemporal misalignment. Existing security risk identification methods suffer from low accuracy and stability. Summary of the Invention

[0003] The technical problem to be solved by the present invention is to overcome the shortcomings of the prior art and provide a method for identifying security risks in PaaS+SaaS architecture with high accuracy and high stability.

[0004] To address the aforementioned technical problems, this invention provides a method for identifying security risks in a PaaS+SaaS architecture, comprising:

[0005] S1. Collect log data from the PaaS+SaaS architecture, preprocess it, label the risk status of the log data, and form a training dataset;

[0006] S2. Construct a set of constraint relationships for configuration items, calculate the conditional weight factor between two configuration items, and generate a conditional weighted embedding vector for each configuration item;

[0007] S3. Extract the temporal and spatial feature vectors, calculate the spatiotemporal alignment matrix, obtain the alignment fusion features of each time step, and construct the original feature matrix;

[0008] S4. Calculate the mutual information between each feature and the risk label in the original feature matrix, generate the selection weights of the features, and obtain the feature enhancement matrix;

[0009] S5. Perform risk context feature extraction, gated residual feature enhancement, risk level prediction, calculate loss function, perform parameter update based on dynamic weight decay, iterative training and stop iteration condition judgment to obtain the trained recognition model.

[0010] S6. Deploy the trained identification model on the security analysis node of the PaaS+SaaS architecture, collect new log data, execute S1 to S4, input the trained identification model, and the trained identification model outputs the risk status corresponding to the new log data.

[0011] As a further improvement of the present invention: step S2 includes:

[0012] S201. Parse the configuration items in each type of log, extract the explicit or implicit logical constraints between the configuration items, and form a set of constraints;

[0013] S202. Based on the number of constraint relationships in the constraint relationship set and the number of samples in the training samples that satisfy all constraint relationships, calculate the conditional weight factor between the two configuration items;

[0014] S203. Multiply the conditional weighting factor between two configuration items by the embedding matrix corresponding to the configuration item, and sum over all configuration items with logical constraints to obtain the conditional weighted embedding vector of each configuration item.

[0015] As a further improvement of the present invention: step S3 includes:

[0016] S301. Process the operation log and scan log separately. The operation log is input into the Long Short-Term Memory network to extract the time feature vector, and the scan log is extracted through the feedforward network to extract the spatial feature vector. The time feature vector is combined with the conditional weighted embedding vector of the configuration item.

[0017] S302. Based on the cosine similarity between the temporal feature vector and the spatial feature vector, and the exponential decay term of the spatiotemporal coordinate difference, calculate the correlation strength between each time step and each vulnerability to form a spatiotemporal alignment matrix;

[0018] S303. For each time step, extract the weight vector of the corresponding row from the spatiotemporal alignment matrix, and multiply the weight vector element-wise with the concatenated temporal features and aggregated spatial features to obtain the alignment fusion features of each time step.

[0019] S304. Stack the aligned and fused features of each time step in chronological order to form the original feature matrix.

[0020] As a further improvement of the present invention: step S4 includes:

[0021] S401. Calculate the mutual information between each feature and the risk label in the original feature matrix;

[0022] S402. The mutual information values ​​are nonlinearly mapped using the hyperbolic tangent function, and the discriminative power of the mutual information values ​​is enhanced by an amplification factor to obtain the selection weight of each feature;

[0023] S403. Multiply the feature selection matrix with the original feature matrix to enhance the weights of important features and suppress redundant features, thus obtaining the feature enhancement matrix.

[0024] As a further improvement of the present invention: step S5 includes:

[0025] S501. Construct the risk perception bias matrix, generate learnable adaptive bias terms, and calculate the risk perception attention weight matrix;

[0026] S502. Calculate the gating weight vector, feature projection transformation, and gating weighted fusion;

[0027] S503. The gated fusion feature vector is input into the fully connected neural network layer for nonlinear transformation and dimensionality reduction to generate an initial score for each risk level; the initial score for each risk level is normalized using the Softmax activation function and converted into a probability distribution form.

[0028] S504. Construct a weighted directed graph, calculate the shortest path distance between levels, and construct a loss function;

[0029] S505. Calculate the dynamic weight decay coefficient and perform adaptive parameter update;

[0030] S506. The mini-batch gradient descent strategy is used to iteratively optimize the parameters of the recognition model. A fixed number of samples are randomly sampled from the labeled dataset for each training batch. Forward propagation is performed sequentially to generate risk prediction results. The deviation between the predicted value and the true label is calculated based on the loss function constructed in S504. All trainable parameters are updated through the backpropagation algorithm.

[0031] Preferably, step S501 includes:

[0032] S5011. Construct a risk cause-effect graph based on prior safety knowledge to form a risk perception bias matrix;

[0033] S5012. Project the risk perception bias matrix through a trainable linear transformation matrix to obtain an adaptive bias term;

[0034] S5013. In standard attention calculation, the risk bias term is added to the attention score matrix and processed by a normalized exponential function to obtain the risk perception attention weight matrix.

[0035] Preferably, step S502 includes:

[0036] S5021. After concatenating the low-level feature matrix with the high-level feature matrix, a gated weight vector is generated through a fully connected layer and a Sigmoid activation function.

[0037] S5022. Use trainable weight matrices to perform linear transformations on low-level and high-level features respectively, mapping them to a unified feature space;

[0038] S5023. Use the gating weight vector to perform a weighted summation of the projected low-level and high-level features to generate a gating fusion feature vector.

[0039] Preferably, step S504 includes:

[0040] S5041. Define the directed propagation relationship between risk levels based on domain knowledge, and construct a weighted directed graph;

[0041] S5042. For any predicted level and the actual level, use the Dixtra algorithm on the risk propagation map to calculate the shortest path distance between the two levels.

[0042] S5043. The shortest path distance is used as the base coefficient of the exponential penalty term and combined with the focus loss to amplify the penalty for misjudgment between adjacent levels.

[0043] Preferably, step S505 includes:

[0044] S5051. Based on the mutual information value between features and risk labels, the dynamic weight decay coefficient of each feature is generated by normalizing and adjusting the basic decay rate using the hyperbolic tangent function.

[0045] S5052. During the parameter update process, a dynamic weight decay coefficient is applied to the parameters of the corresponding feature to achieve adaptive regularization.

[0046] The beneficial effects of the present invention are as follows: The security risk identification method for PaaS+SaaS architecture provided by the present invention has a high identification accuracy and high stability.

[0047] This method addresses the challenge of expressing semantic dependencies in multi-source heterogeneous logs by combining logical constraints and conditional weighting factors, avoiding the dimensionality explosion and semantic gaps common in conventional methods, and achieving more accurate configuration item representation. It proposes a spatiotemporal alignment matrix based on cosine similarity and exponential decay, effectively fusing time-series user operations with spatial vulnerability distribution, capturing spatiotemporal "delayed attack chains" and overcoming the misalignment problem caused by simple splicing. The method calculates weights based on feature-label mutual information, combining hyperbolic tangent and amplification factors to significantly enhance sparse high-risk features and suppress redundant features. Simultaneously, a dynamic weight decay mechanism adaptively protects key security signals, improving recognition accuracy and efficiency. The method employs a risk causal graph bias in its attention mechanism to guide the recognition model to focus on key events in potential causal chains. Furthermore, it improves the loss function through a risk propagation graph, enabling the recognition model to impose higher penalties for cross-level misjudgments of "high-risk to low-risk," more closely reflecting the actual propagation logic of security risks. Attached Figure Description

[0048] Figure 1 This is a schematic diagram of the principle of the present invention;

[0049] Figure 2 A comparison chart of the risk identification accuracy of different methods;

[0050] Figure 3 A comparative analysis chart of F1 scores for different risk levels;

[0051] Figure 4 A comparative analysis of ROC curves from different methods;

[0052] Figure 5 A comparative analysis chart showing the computational efficiency of different methods;

[0053] Figure 6 The graph shows the convergence rate for different loss functions. Detailed Implementation

[0054] The specific embodiments of the present invention will be described in further detail below with reference to the accompanying drawings.

[0055] Definitions of relevant terms used in this invention:

[0056] (1) IaaS: Infrastructure as a Service provides hardware resources, similar to CPU, memory and I / O in the traditional model;

[0057] (2) PaaS: Platform as a Service provides an environment for software to run, similar to the operating system and programming framework in traditional programming models;

[0058] (3)SaaS: Software as a Service, which provides application software functions, similar to application software in the traditional model;

[0059] (4) Object hashing: The unique fixed-length string digest calculated by a cryptographic hash algorithm (such as SHA-256) for the content of the target object being operated on (such as a file, a configuration block, a piece of code, a database entry, etc.), that is, the content is hashed and encrypted.

[0060] like Figure 1 As shown, the security risk identification method for PaaS+SaaS architecture provided by this invention includes:

[0061] S1. Collect log data from the PaaS+SaaS architecture, preprocess it, and then have technical experts in the field manually label the risk status of the log data in conjunction with the threat intelligence database and predefined risk rules to form a structured training dataset with time-series correlation and risk level identification.

[0062] Log data includes resource operation logs, audit logs, authentication logs, and scan logs;

[0063] Resource operation logs are captured in real time from the cloud platform infrastructure layer, including key fields such as timestamp, resource ID, operation type, and object hash.

[0064] Audit logs are obtained from the SaaS application layer and include user ID, operation code, operation object, and execution result;

[0065] The identity verification logs are collected from the identity management system and include identity tracking information such as user ID, authentication protocol, and permission vector.

[0066] Scan logs are generated periodically by vulnerability scanning tools and include spatial dimensions of security posture data such as vulnerability ID, threat score, and affected resources.

[0067] Preprocessing includes noise reduction and format normalization;

[0068] Risk status includes low risk (routine operation), medium risk (suspicious behavior), and high risk (clear threat event); risk status strictly corresponds to the three-level risk labeling system in subsequent risk identification tasks;

[0069] S2. Adaptive segmented encoding of heterogeneous log data: Construct a set of constraint relationships for configuration items, calculate the conditional weight factor between two configuration items, and generate a conditional weighted embedding vector for each configuration item;

[0070] S201. Parse the configuration items in each type of log, extract the explicit or implicit logical constraints between the configuration items, such as "require" indicating dependency and "conflict" indicating conflict, to form a set of constraint relationships;

[0071] Using C iR represents the set of all configuration item numbers that have a logical constraint with the i-th configuration item. ij Let r represent the set of specific constraints between the i-th configuration item and the j-th configuration item. k Represents set R ij The k-th constraint relationship in the table describes the semantic or logical dependency type between configuration items; i represents the configuration item number index, and j represents the index of another configuration item number that has a logical constraint relationship with the i-th configuration item.

[0072] S202. Based on the number of constraint relations in the constraint relation set and the number of samples in the training samples that satisfy all constraint relations, calculate the conditional weight factor between the two configuration items to quantify the degree of influence of constraint relations on the embedding representation, thereby suppressing the excessive influence of high-frequency constraints and balancing the contribution of different constraints to the embedding representation.

[0073] The conditional weighting factor w between the i-th configuration item and the j-th configuration item ij The calculation formula is:

[0074]

[0075] In the formula, log(·) is the logarithmic function, with the default base being the natural constant; |D ij | indicates that the set R is satisfied simultaneously in the training samples. ij The number of samples representing all constraint relationships reflects the frequency of occurrence of that constraint combination; |R ij | represents set R ij The total number of constraints included is used to measure constraint complexity; log(1+|D ij The |) term uses a logarithmic function to smooth out frequencies.

[0076] S203. Multiply the conditional weight factor between two configuration items with the embedding matrix corresponding to the configuration item, and sum over all configuration items with logical constraints to obtain the conditional weighted embedding vector of each configuration item, thus fusing the semantic dependencies between configuration items.

[0077] The condition-weighted embedding vector of the i-th configuration item represents the semantic embedding vector of the i-th configuration item, and it incorporates the semantic dependencies of configuration items with which it has logical constraints, such as "Enabling permission A necessarily accompanies opening port B"; the condition-weighted embedding vector of the i-th configuration item The calculation formula is:

[0078]

[0079] In the formula, w ijThis is the conditional weighting factor of the j-th configuration item to the i-th configuration item, used to adjust the semantic contribution strength of the j-th configuration item to the i-th configuration item; represents the embedding matrix corresponding to the j-th configuration item, used to map discrete configuration items to dense vectors, and is a trainable parameter;

[0080] In one embodiment, the i-th configuration item is "Open firewall port 80", and the set C of all configuration item numbers that have logical constraints on the i-th configuration item is... i The set R consists of the j-th configuration item "Enable HTTP Service" and the specific constraints between the i-th and j-th configuration items. ij ={"require"}, which simultaneously satisfies set R in the training samples. ij The number of samples of all constraints in the equation |D ij If |=90, then the conditional weight factor of the j-th configuration item on the i-th configuration item. Then the conditional weighted embedding vector of the i-th configuration item

[0081] In conditional weighting factor w ij In the calculation process, the number of samples |D| representing the frequency of the relationship is constrained. ij |Total number of constraints related to representation complexity|R ij The balancing calculation dynamically adjusts the semantic contribution strength of the embedding vector, making the conditionally weighted embedding vector... It can capture strong dependencies such as "permission A must be enabled along with port B being open", while avoiding the submergence of low-frequency critical constraints.

[0082] Cloud platform logs, SaaS audit logs, identity logs, and scan logs are multi-source and heterogeneous, containing various information such as timestamps, resource IDs, opcodes, user IDs, operation types, object hashes, authentication protocols, permission vectors, vulnerability IDs, and threat scores. Conventional processing methods such as one-hot encoding lead to an explosion of feature dimensions and fail to capture the semantic relationships between configuration items. Statistical encoding methods such as TF-IDF are also difficult to effectively represent such logical constraints. S2 constructs a set of logical constraints for configuration items and calculates conditional weight factors to generate a conditionally weighted embedding vector that integrates semantic dependencies, achieving adaptive encoding of heterogeneous logs.

[0083] S3. Spatiotemporal alignment fusion of multimodal logs: Extract temporal and spatial feature vectors, calculate the spatiotemporal alignment matrix, obtain the alignment fusion features of each time step, and construct the original feature matrix;

[0084] S301. Process operation logs and scan logs separately. Input operation logs into a long short-term memory network to extract time feature vectors. Extract scan logs into spatial feature vectors through a feedforward network. Combine the time feature vectors with the conditional weighted embedding vectors of the configuration items. Generate spatial feature vectors based on the original vulnerability features.

[0085] The time feature vector extracted from the operation log at time t represents the contextual information of the user's behavior at that time. The calculation formula is:

[0086]

[0087] In the formula, LSTM(·) represents a Long Short-Term Memory network with a hidden layer dimension of 128; The original characteristics of the operation log at time t can be defined as follows: ⊕ indicates a splicing operation; Indicates the i-th t The conditionally weighted embedding vector of each configuration item; i t This represents the index of the configuration item associated with the operation log event at time t. It is a time-dependent index that will map to a specific i-th configuration item at time t. For example, if the object hash of the operation event at time t=10 corresponds to the 3rd configuration item, then i... t =3;

[0088] The spatial feature vector extracted from the scan log of the s-th vulnerability represents the attribute and context information of the vulnerability. The calculation formula is:

[0089]

[0090] In the formula, FFN(·) represents a feedforward neural network, which can be a two-layer fully connected network used for nonlinear feature transformation; Let the original characteristics of the s-th vulnerability be defined as follows:

[0091] S302. Based on the cosine similarity between the temporal feature vector and the spatial feature vector, and the exponential decay term of the spatiotemporal coordinate difference, calculate the correlation strength between each time step and each vulnerability to form a spatiotemporal alignment matrix;

[0092] Spatiotemporal alignment matrix A st The values ​​of the elements in the t-th row and s-th column are between 0 and 1. Larger values ​​indicate a higher degree of alignment between the t-th time step and the s-th vulnerability. The spatiotemporal alignment matrix A... st The element in row t and column s of [A]st ] ts The calculation formula is:

[0093]

[0094] In the formula, A st It is a spatiotemporal alignment matrix, where s is the spatial vulnerability index, s∈{1,2,...,S}, S is the total number of spatial vulnerabilities, t is the time step index, t∈{1,2,...,T}, T is the total number of time steps, and A st The dimension is T×S; sig(·) is the Sigmoid activation function; <·,·> is the inner product operation of vectors; exp(·) is the natural exponential function; ΔT is the temporal resolution, representing the actual time interval between adjacent time steps in seconds; ΔS is the spatial resolution, representing the spatial scale or granularity represented by the vulnerability index; τ is the decay factor, preferably 0.5, used to control the decay rate of the influence of spatiotemporal distance on the association strength. The smaller the value, the greater the penalty for long-distance associations.

[0095] The term is the method for calculating cosine similarity. The term representation maps the cosine similarity calculation results to a range of 0 to 1, enhancing the interpretability of the weights. By calculating the cosine similarity, the semantic relevance of the temporal feature vector and the spatial feature vector is measured. The higher the cosine similarity, the closer the directions of the two vectors are, meaning that the temporal events and spatial vulnerabilities are more similar in the feature space, and therefore the stronger the association.

[0096] The term |tΔT-sΔS| represents the absolute difference between the time coordinates and the spatial coordinates. tΔT represents the actual time corresponding to time t, and sΔS represents the spatial location or index corresponding to the s-th vulnerability. |tΔT-sΔS| quantifies the absolute distance between the time event and the spatial vulnerability in physical spacetime. The greater the distance, the farther away the event and vulnerability are in spacetime, and the weaker the correlation. Therefore, exponential decay is used to penalize long-distance correlation.

[0097] The term quantifies feature orientation consistency as weights, while The term represents the physical distance penalty. The combination of the two is used to specifically solve the problem of cross-temporal and spatial causal association. For example, when the abnormal operation at a certain moment is "delete backup", and it is semantically strongly related to "storage vulnerability" at a certain location, although they are far apart in time and space, the matrix can still give high alignment weight, so that the recognition model can capture the "delayed attack chain" ignored by conventional methods. The ability to maintain semantic sensitivity under physical distance constraints is difficult to achieve by conventional spatiotemporal fusion methods.

[0098] S303. For each time step, extract the weight vector of the corresponding row from the spatiotemporal alignment matrix, and multiply the weight vector element-wise with the concatenated temporal features and aggregated spatial features to obtain the alignment fusion features of each time step.

[0099] The alignment and fusion feature at time t represents the feature vector after spatiotemporal alignment and fusion at time t. The calculation formula is:

[0100]

[0101] In the formula, A t It is the spatiotemporal alignment matrix A st The t-th row vector is a row vector whose elements represent the alignment weights with each vulnerability at time t; ⊙ represents element-wise multiplication, i.e., the Hadamard product; ⊕ represents the concatenation operation; Let be the aggregated spatial feature at time t, representing the comprehensive spatial feature of all spatial feature vectors aggregated after attention weighting at time t;

[0102] Features of the aggregate space at time t The calculation formula is:

[0103]

[0104] S304. Stack the aligned and fused features from each time step in chronological order to form the original feature matrix F. raw Where d represents the original feature matrix F raw Total dimensions;

[0105] In one embodiment, the total number of time steps T = 100, and the alignment fusion feature at time t... If it is a 256-dimensional vector, then F raw It is a 100×256 matrix.

[0106] Scan logs contain vulnerability distribution information in the spatial dimension, while operation logs contain user behavior sequences in the temporal dimension. Differences in their data sources and feature dimensions lead to spatiotemporal misalignment. Conventional techniques, which use simple feature vector concatenation for fusion, disrupt the spatiotemporal correlation between features, causing phase mismatch and failing to effectively characterize the potential connection between an operation at a specific moment and a vulnerability in a particular space. S3 quantifies the correlation strength between temporal events and spatial vulnerabilities by calculating a spatiotemporal alignment matrix and then weightedly fuses temporal and spatial features to form the original feature matrix.

[0107] S4. Risk-aware feature selection: Calculate the mutual information between each feature and the risk label in the original feature matrix, generate the feature selection weights, and obtain the feature enhancement matrix;

[0108] S401. Calculate the mutual information between each feature in the original feature matrix and the risk label, and quantify the amount of information provided by the feature for risk classification based on the log ratio of the joint probability and the marginal probability;

[0109] The m-th feature X m The mutual information between the feature and the risk label Y is used to measure the amount of information that the feature can provide for risk classification; a higher value indicates that the feature is more important. The m-th feature X... m Mutual information J(X) between risk label Y and risk label Y m The formula for calculating (Y) is:

[0110]

[0111] In the formula, X m The original characteristic matrix F raw The m-th feature in the matrix; m is the original feature matrix F. raw The feature dimension index; Y is the risk label, Y∈{1,2,3}, where 1 corresponds to low risk, 2 corresponds to medium risk, and 3 corresponds to high risk; y is the specific value of the risk label Y; x m For feature X m The specific value of X is a possible value on the m-th feature dimension. m When it is an operation type, x m It is either "DELETE" or "READ"; p(x m (,y) represents feature X m The value is x m Furthermore, the joint probability of the risk label Y taking the value y is obtained by statistically analyzing the feature X in the training samples. m The value is x m The frequency of label y is estimated by dividing by the total number of samples; p(x) m ) is a feature X m The value is x m The marginal probability is obtained by statistically analyzing the feature X in the training samples. m The value is x m The frequency of the risk label Y is divided by the total number of samples to estimate the probability; p(y) is the marginal probability of the risk label Y taking the value y, which is estimated by dividing the frequency of the risk label Y taking the value y by the total number of samples.

[0112] S402. The mutual information values ​​are nonlinearly mapped using the hyperbolic tangent function, and the discriminative power of the mutual information values ​​is enhanced by an amplification factor to obtain the selection weight of each feature;

[0113] The selection weight w of the m-th feature m The calculation formula is:

[0114] w m =tanh(λJ(X) m,Y)),

[0115] In the formula, tanh(·) is the hyperbolic tangent activation function; λ is the amplification factor, such as λ=5, used to amplify the mutual information J(X). m The numerical difference between ,Y) makes the weights of features that are more important to the classification task closer to 1, while the weights of unimportant features are closer to 0.

[0116] S403. Multiply the feature selection matrix with the original feature matrix to enhance the weight of important features and suppress redundant features, resulting in a feature enhancement matrix. The feature enhancement matrix represents the feature matrix output after risk-aware weighted selection, which enhances important features and suppresses redundant or irrelevant features.

[0117] Feature enhancement matrix F sel The calculation formula is:

[0118] F sel =M sel F raw ,

[0119] In the formula, M sel The feature selection matrix is ​​a diagonal matrix composed of the selection weights of each feature. Its diagonal elements are the selection weights of each feature, denoted as M. sel =diag([w1,w2,...,w m ,...,w d ]), diag(·) represents the operation of constructing a diagonal matrix using vectors, w1 represents the selection weight of the first feature, w2 represents the selection weight of the second feature, w d This represents the selection weight of the d-th feature, where d represents the original feature matrix F. raw Total dimension; F raw This represents the original feature matrix, where each row represents a sample and each column represents a feature.

[0120] J(X m ,Y) Quantitative features X m The correlation with risk label Y, tanh(λJ(X) m The term Y) uses the hyperbolic tangent function to compress mutual information to the interval [0,1). Combined with the amplification factor λ, the weights of sparse high-risk event features such as "abnormal access by privileged accounts" approach 1, while the weights of high-frequency low-risk features such as "regular login" approach 0. This has the ability to resist frequency bias. Even if there are very few high-risk event samples, their key features can still be significantly enhanced, avoiding the identification model being overwhelmed by a large number of normal events.

[0121] In the log data generated by the PaaS+SaaS architecture, most entries correspond to normal low-risk events, while truly high-risk security events are sparse and exhibit a long-tail distribution. Conventional dimensionality reduction methods such as principal component analysis aim to preserve the main variance in the data, which weakens the subtle feature signals that characterize rare but high-risk events, leading to a decrease in the detection capability of the identification model for key security threats. S4 generates selection weights by calculating feature-label mutual information and constructs a feature selection matrix to scale the original features, thereby enhancing important features and suppressing redundant features.

[0122] S5. Constructing a security risk identification model: extracting risk context features, strengthening gated residual features, predicting risk levels, calculating the loss function, updating parameters based on dynamic weight decay, iterating training and determining stopping conditions to obtain the trained identification model;

[0123] S501. Construct the risk perception bias matrix, generate learnable adaptive bias terms, and calculate the risk perception attention weight matrix;

[0124] S5011. Construct a risk causal graph based on prior safety knowledge. For event pairs in an event sequence, if they are connected in the causal graph, calculate the correlation strength based on path duration; otherwise, set it to zero, forming a risk perception bias matrix. The element in the a-th row and b-th column of the risk perception bias matrix [B risk ] a,b Quantify the strength or correlation of the impact of event a on event b, representing the strength of the risk association between event a and event b, and use it to guide attention mechanisms;

[0125] The element in the a-th row and b-th column of the risk perception bias matrix [B risk ] a,b The calculation formula is:

[0126]

[0127] In the formula, B risk Let be the risk perception bias matrix; a be the index of the a-th event in the event sequence; b be the index of the b-th event in the event sequence; e be the natural constant; γ be the risk perception bias matrix. c As the attenuation factor, γ can be set. c =0.3, which causes the association strength to decrease exponentially with increasing path duration; t ab This represents the duration of the shortest path from event a to event b in a predefined risk causal graph, used to measure causal distance;

[0128] The predefined risk causal graph is a directed graph constructed based on prior security knowledge such as historical attack patterns and expert rules. Nodes represent event types, edges represent causal relationships between events, and edge weights represent propagation duration or logical distance. For example, there might be an edge from an "abnormal login" event to a "data breach" event, with a duration set to 10 minutes. ab The shortest path duration from event a to event b is calculated using the Dixtro algorithm.

[0129] S5012. Project the risk perception bias matrix through a trainable linear transformation matrix to obtain the adaptive bias term U. b B risk This is used to adjust attention mechanisms;

[0130] Among them, U b This is the risk bias parameter matrix, which consists of trainable parameters. Its function is to apply the predefined risk perception bias matrix B... risk The representation can be further adjusted and optimized by converting it into a recognition model to better adapt to the current task and data distribution.

[0131] S5013. In standard attention calculation, the risk bias term is added to the attention score matrix and processed by the normalized exponential function to obtain the risk perception attention weight matrix. The risk perception attention weight matrix reflects the degree of attention the identification model pays to different event pairs in the sequence after combining the risk causal prior.

[0132] The formula for calculating the risk perception attention weight matrix Attn is:

[0133]

[0134] In the formula, soft(·) is the normalization exponential function used to form the probability distribution; Q A The query matrix is ​​obtained from the input sequence through a linear transformation; For K A transpose of; K A The key matrix is ​​obtained from the input sequence through a linear transformation; d k V is the dimension of the key vectors, that is, the length of each key vector in the key matrix; A The value matrix is ​​obtained from the input sequence through a linear transformation;

[0135] Query matrix Q A The calculation formula is:

[0136] Q A =F sel W Q ,

[0137] In the formula, W Q To query the matrix weight parameters, which are trainable parameters;

[0138] bond matrix K A The calculation formula is:

[0139] K A =F sel W K ,

[0140] In the formula, W K The key matrix weights are trainable parameters.

[0141] Value matrix V A The calculation formula is:

[0142] V A =F sel W V ,

[0143] In the formula, W V The weight parameters of the value matrix are trainable parameters;

[0144] U b B risk This approach transforms prior security knowledge into attention-guided signals. For example, the causal chain of "abnormal login → data leakage" serves as prior security knowledge, enabling the identification model to dynamically focus on event pairs with risk transmission paths. This achieves enhanced context awareness in complex attack chains, particularly when attack events are temporally dispersed but causally strongly correlated. The items retain their relevance, avoiding the loss of key context due to temporal distance.

[0145] In a PaaS+SaaS architecture, security risk events are typically triggered by multiple events across various log types in a specific causal order. Standard self-attention mechanisms, when processing event sequences, pay equal attention to events at all time steps, failing to prioritize key event pairs with potential risk propagation paths and ignoring causal relationships between events. This results in insufficient context awareness of complex attack chains. S501 improves attention computation by incorporating a risk perception bias term based on a risk causal graph, guiding the identification model to focus on causally related event pairs and enhancing risk context extraction.

[0146] S502. Calculate the gating weight vector, feature projection transformation, and gating weighted fusion;

[0147] S5021. After concatenating the low-level feature matrix with the high-level feature matrix, a gate weight vector is generated through a fully connected layer and a Sigmoid activation function. Each element of the gate weight vector takes a value between 0 and 1, which is used to dynamically adjust the fusion ratio of the low-level and high-level features.

[0148] The formula for calculating the gate weight vector G is:

[0149] G = sig(W) g [F low ⊕F high ]),

[0150] In the formula, W g F is the gate weight matrix, which consists of trainable parameters used to perform a linear transformation on the concatenated features; low It is a low-level feature matrix, extracted from the shallow layers of the network. It contains rich detailed information, but has a lot of noise.

[0151] In one embodiment, the feature enhancement matrix F sel As unattentionally weighted sequence features, they are considered as the low-level feature matrix F. low That is, F low =F sel ;F high The high-level feature matrix, extracted from the deep layers of the network, contains abstract semantic information. In one embodiment, the risk-aware attention weight matrix Attn serves as a context-aware representation of the sequence and is considered as the high-level feature matrix F. high That is, F high =Attn;

[0152] S5022. Use trainable weight matrices to perform linear transformations on low-level and high-level features respectively, mapping them to a unified feature space;

[0153] Low-level feature matrix of projection transformation The calculation formula is:

[0154]

[0155] In the formula, W low This represents the weight matrix used for low-level feature projection, and consists of trainable parameters.

[0156] High-level characteristic matrix of projection transformation The calculation formula is:

[0157]

[0158] In the formula, W high Let represent the trainable weight matrix used for high-level feature projection, and represent the trainable parameters.

[0159] S5023. Use the gating weight vector to perform a weighted summation of the projected low-level and high-level features to generate a gating fusion feature vector;

[0160] Gated fusion feature vector F out The calculation formula is:

[0161]

[0162] In the formula, 1 G This represents a vector of all 1s with the same dimension as the gate weight vector G;

[0163] 1 G -G represents the complementary gating vector used to adjust the weights of higher-level features. The gating weight vector G controls the contribution of lower-level features, while 1 G -G controls the contribution of high-level features. The recognition model can dynamically adjust the feature fusion ratio according to the input context. When low-level features contain important risk signals, G approaches an all-1 vector. G Strengthening low-level features, when high-level features are more reliable, 1 G -G is close to an all-1 vector. G This strengthens high-level features, avoids the shortcomings of fixed-weight fusion, and enhances the sensitivity of the recognition model to key features.

[0164] In the security risk classification of PaaS+SaaS architecture, there is a significant difference in the contribution of low-level features and high-level features to the final risk assessment. Conventional residual connections use fixed weights to fuse multi-level features, which cannot dynamically adjust the contribution ratio of different levels of features according to the context of the input data, resulting in key risk signals being drowned out or noise being excessively amplified. S502 calculates a gating weight vector to perform weighted fusion of projected low-level and high-level features, dynamically adjusting the contribution ratio of different levels of features to strengthen risk-related features.

[0165] S503. Gated and fused feature vector F out The input is fed into a fully connected neural network layer for nonlinear transformation and dimensionality reduction. This fully connected layer maps the high-dimensional feature vector to a low-dimensional space that matches the number of risk levels through a trainable weight matrix, generating an initial score for each risk level. The initial score for each risk level is normalized using the Softmax activation function, converting the initial score into a probability distribution. This probability distribution accurately represents the likelihood that the current input log sequence belongs to one of the three risk levels: low risk, medium risk, and high risk. The category with the highest probability value is the risk level predicted by the identification model.

[0166] S504. Construct a weighted directed graph, calculate the shortest path distance between levels, and construct a loss function;

[0167] S5041. Define the directed propagation relationship between risk levels based on domain knowledge, and construct a weighted directed graph G. sa =(V sa ,ε sa );

[0168] Weighted directed graph G sa Vertex set Vsa ={1,2,3}, corresponding to 3 risk levels, such as 1 for low risk, 2 for medium risk, and 3 for high risk;

[0169] Weighted directed graph G sa edge set ε sa The edge weight represents the possible propagation path between levels. For example, edge (1,2) indicates that low risk may propagate to medium risk, and the propagation probability corresponding to the edge weight is set to 0.6. Edge (2,3) indicates that medium risk may propagate to high risk, and the edge weight is set to 0.8.

[0170] S5042. For any predicted level and actual level, use the Dixtra algorithm on the risk propagation map to calculate the shortest path distance between the two levels. If the path is unreachable, set it to infinity.

[0171] d(l,y i y represents the true risk level label for the i-th sample. i The shortest path distance between the l-th predicted risk level and the risk propagation level in the risk propagation map.

[0172] S5043. The shortest path distance is used as the base coefficient of the exponential penalty term and combined with the focal loss to amplify the penalty for misjudgment between adjacent levels and improve the ability to perceive the risk propagation chain.

[0173] The loss function is the objective of model optimization. The formula for calculating the loss function (Loss) is:

[0174]

[0175] In the formula, N is the batch sample size, i.e., the total number of samples in a batch; n is the sample index, used to traverse each sample in the batch; l is the risk level, l∈{1,2,3}, traversing all possible prediction levels; p nl To identify the probability that the nth sample, as predicted by the model, belongs to the lth risk level; g se The hard sample focusing parameter is used to adjust the weight of hard samples in the loss. It can be set as g. se =2; β se The distance sensitivity coefficient controls the intensity of the penalty based on the shortest path distance; β can be set as... se =0.7; d(l,y n y represents the true risk level label for the nth sample. n The shortest path distance to the l-th predicted risk level in the risk propagation map is used to quantify the severity of misclassification; y n Let y be the true risk level label of the nth sample; if the true risk level label y of the nth sample is... n=1, and the probability that the nth sample predicted by the identification model belongs to the 3rd risk level is the highest, and the shortest path distance d(3,1)=2, then the penalty term is

[0176] |d(l,y n | represents the distance d(l,y) n The absolute value of the distance is used to quantify the severity of misclassification; the greater the distance, the greater the penalty.

[0177] In one embodiment, This approach incorporates the topological structure of the risk propagation map into the optimization objective, resulting in lighter penalties for misclassification to adjacent levels, such as d(l,y). n In the case where ) = 1, the penalty for cross-level misjudgment increases exponentially, such as d(l,y) n When ) = 2, the identification model becomes path-sensitive in risk escalation prediction, paying more attention to high-risk misjudgments that may trigger chain reactions, such as misjudging "high-risk vulnerabilities" as "low-risk" rather than the same level of deviation, while also enabling the identification model to perceive the evolution logic of the attack chain.

[0178] There is a transitivity between risk levels; for example, a low-level vulnerability may lead to a high-level intrusion, forming a directed risk propagation graph. Conventional cross-entropy loss functions treat all misclassifications equally, ignoring the topological correlation and propagation depth between different risk levels, which can easily lead to the identification model being insensitive to risk escalation paths. S504 incorporates the shortest path distance between risk levels as a penalty coefficient into the focal loss function, making the identification model sensitive to the propagation relationship between risk levels.

[0179] S505. Calculate the dynamic weight decay coefficient and perform adaptive parameter update;

[0180] S5051. Based on the mutual information value between features and risk labels, the hyperbolic tangent function is used to normalize and adjust the basic decay rate to generate the dynamic weight decay coefficient for each feature. Features with high importance have smaller dynamic weight decay coefficients.

[0181] The dynamic weight decay coefficient in the t-th iteration is related to feature X. m The associated recognition model parameters, used for adaptive regularization, and the dynamic weight decay coefficient in the t-th iteration. The calculation formula is:

[0182]

[0183] In the formula, λ0 is the basic attenuation coefficient, which controls the global regularization intensity, and can be set to λ0 = 0.01; J max The maximum value among all feature mutual information values ​​is used to calculate the mutual information J(X). mNormalize Y to eliminate the influence of dimensions.

[0184] S5052. During the parameter update process, a dynamic weight decay coefficient is applied to the parameters of the corresponding feature to achieve adaptive regularization;

[0185] t a All trainable parameters of the +1 iteration recognition model are in set form, and the t-th iteration... a +1 iterations to identify all trainable parameters of the model The calculation formula is:

[0186]

[0187] In the formula, η is the learning rate for training the recognition model, which controls the step size of each parameter update. η can be set to 0.001. For the tth a All trainable parameters of the next iteration identification model are in set form; t a This is an index for the number of training iterations; The loss function is Loss with respect to feature X. m The gradients of the associated identification model parameters indicate the direction of parameter updates;

[0188] Through J(X) m The normalization value of the term (Y) adjusts the attenuation intensity, making the dynamic weight attenuation coefficient of the high discriminative feature approach 0, while the dynamic weight attenuation coefficient of the redundant feature approach λ0, thereby achieving strong constraints, so that the parameters related to the key safety signal are not over-suppressed, while the noise feature is effectively constrained.

[0189] Different features have significantly different impacts on the stability and generalization ability of the recognition model. For example, sensitive operation features such as permission changes are more critical than statistical features such as the number of logs. Conventional fixed-weight decay applies the same constraint strength to all recognition model parameters, which can easily lead to the over-suppression of key features that contribute significantly to the discriminative power of the recognition model, while the noise impact of redundant features is not effectively constrained. S505 calculates a dynamic decay coefficient based on feature-label mutual information and implements adaptive regularization during parameter updates to protect key features and constrain redundant features.

[0190] S506. The mini-batch gradient descent strategy is used to iteratively optimize the parameters of the recognition model. A fixed number of samples are randomly sampled from the labeled dataset for each training batch. Forward propagation is performed sequentially to generate risk prediction results. The deviation between the predicted value and the true label is calculated based on the loss function constructed in S504. All trainable parameters are updated through the backpropagation algorithm.

[0191] During training, the risk identification accuracy and F1 score on the independent validation set are continuously monitored. When the validation set performance does not improve within a specified number of rounds (e.g., 10 rounds), the early stop mechanism is automatically triggered to terminate training and save a snapshot of the identification model parameters with the best validation performance.

[0192] S6. Deploy the trained identification model on the security analysis node of the PaaS+SaaS architecture, collect new log data, and after executing S1 to S4, input the trained identification model. The trained identification model outputs the risk status corresponding to the new log data (i.e., the judgment result of the risk level corresponding to the current system status). The judgment result is linked to the security operation and maintenance system to trigger graded response measures such as alarm notification, automatic blocking or vulnerability repair, so as to achieve closed-loop security protection.

[0193] This technique is compared with rule-based methods, conventional machine learning, LSTM benchmark methods (Long Short-Term Memory network benchmark methods), and Transformer methods.

[0194] By comparing the accuracy of risk identification of our proposed method with that of existing mainstream technologies, we obtain... Figure 2 , Figure 2 This is a box plot. Accuracy is a core metric for evaluating the performance of classification and recognition models, directly reflecting the model's ability to correctly identify risk events. For example... Figure 2 As shown, rule-based methods exhibit the lowest accuracy and greatest fluctuation, which is related to their reliance on manually preset rules and their difficulty in adapting to complex and ever-changing security scenarios. Conventional machine learning methods outperform rule-based methods, but still have significant limitations. LSTM and Transformer methods, as representatives of deep learning, show significant improvements in accuracy, demonstrating the value of temporal modeling and attention mechanisms in security data analysis. However, our proposed method achieves the best accuracy, with a significantly higher median than other methods and a more compact bin distribution with smaller gaps between the upper and lower edges, indicating higher stability and consistency in the identification model. Our proposed method effectively enhances the feature representation capabilities of multi-source heterogeneous log data through strategies such as adaptive segmented encoding, spatiotemporal alignment fusion, and risk-aware feature selection, thereby achieving more accurate security risk identification.

[0195] To analyze the performance differences of various methods at different risk levels (including low, medium, and high risk), the F1 scores (a metric that combines precision and recall, reflecting the model's ability to identify positive examples and exclude negative examples in a balanced way, and is an important indicator for evaluating the performance of classification models across different categories) of each method at different risk levels were compared. Figure 3 .like Figure 3As shown, all methods perform relatively well in low-risk identification because low-risk event patterns are relatively simple and the sample size is sufficient. As the risk level increases, the performance of all methods declines, but the proposed method shows the smallest decline, maintaining a significant advantage, especially in high-risk identification. Rule-based methods perform the worst in high-risk scenarios, indicating that fixed rules are insufficient to cope with complex and ever-changing high-risk attack patterns. While conventional machine learning methods outperform rule-based methods, they still cannot effectively handle the sparsity and diversity of high-risk events. The proposed method, through risk-aware feature selection and gated residual feature enhancement mechanisms, can better capture sparse but crucial high-risk features, avoiding the problem of important signals being overwhelmed by a large number of normal events, thus maintaining excellent performance across all risk levels.

[0196] A comparative analysis of ROC curves for different methods was conducted. Receiver operating characteristic curves were used to demonstrate the performance of each method at different decision thresholds, comprehensively evaluating the classification ability of the recognition model. Figure 4 . Figure 4 The larger the area under the ROC curve, the better the overall performance of the recognition model. The horizontal axis represents the false positive rate, which indicates the proportion of actual negative examples that are incorrectly identified as positive examples, and the vertical axis represents the proportion of actual positive examples that are correctly identified; both are percentage values. Figure 4 As shown, the ROC curve of the rule-based method is closest to the diagonal, and its performance is close to that of random guessing. The curves of conventional machine learning methods show a significant improvement, but are still far from ideal. The curves of the LSTM baseline method and the Transformer method show a good upward trend, but there is still room for improvement in the high true positive rate region. The ROC curve of the proposed method is closest to the upper left corner and is significantly higher than other curves in most regions, indicating that it can achieve a high true positive rate while maintaining a low false positive rate. This demonstrates that the spatiotemporal alignment fusion technology in this invention can effectively capture the potential correlation between temporal events and spatial vulnerabilities, solving the phase mismatch problem caused by spatiotemporal misalignment in conventional methods, thereby significantly improving the detection capability of the recognition model for complex attack chains.

[0197] A comparative analysis of the computational efficiency of different methods was conducted. From a practical application perspective, the efficiency of each method in processing samples with different risk levels was evaluated, and the results were obtained. Figure 5 Computational efficiency, measured in milliseconds (processing time), is a crucial factor in evaluating the practicality of risk identification systems, especially in security scenarios requiring real-time responses. For example... Figure 5As shown, rule-based methods are fastest when processing low-risk samples, but processing time increases significantly with increasing risk level because complex rules require more matching and inference time. Conventional machine learning methods have relatively stable processing time, but their overall efficiency is not high. LSTM and Transformer methods have significantly longer processing times due to the high complexity of their recognition models, especially when processing high-risk samples, requiring more computational resources. Our proposed method maintains high accuracy while having significantly shorter processing time than other deep learning methods, and the increase in processing time across different risk levels is relatively gradual. This indicates that the dynamic weight decay and adaptive regularization mechanism in this invention can implement differentiated parameter updates based on feature importance, protecting key features while constraining redundant features, thereby improving computational efficiency while ensuring the performance of the recognition model.

[0198] By comparing the convergence speeds of the loss function, cross-entropy loss, and focus loss in this technique, we can obtain... Figure 6 . Figure 6 In the diagram, the horizontal axis represents the number of training iterations, and the vertical axis represents the loss value. The loss function of this technique (green dotted line) converges rapidly to a stable value within 100 iterations, significantly faster than the focus loss (red dashed line) and cross-entropy loss (blue solid line). The blue solid line represents the conventional cross-entropy loss function, which has the highest initial loss value and the slowest convergence. Even after 100 iterations, its loss value remains significantly higher than other methods, and the curve still exhibits slight fluctuations in the later stages. The red dashed line represents the focus loss function, which has a lower initial loss value than the cross-entropy loss and a slightly faster convergence speed, but its rate of decline slows significantly after 80 iterations. The green dotted line represents the propagation-aware loss function proposed in this invention, which has the fastest convergence speed and a smooth, stable curve with minimal fluctuations. Experimental results verify that by using the shortest path distance between risk levels as an exponential penalty term, the gradient update direction is more accurately focused on key misclassified samples, avoiding the model wasting training resources on irrelevant samples, and providing training efficiency assurance for real-time detection of complex attack chains.

Claims

1. A method for identifying security risks in a PaaS+SaaS architecture, characterized in that, include: S1. Collect log data from the PaaS+SaaS architecture, preprocess it, label the risk status of the log data, and form a training dataset; S2. Construct a set of constraint relationships for configuration items, calculate the conditional weight factor between two configuration items, and generate a conditional weighted embedding vector for each configuration item; Conditional weighting factor between the i-th configuration item and the j-th configuration item The calculation formula is: ， In the formula, Number the configuration items with indexes, Number the index of another configuration item that has a logical constraint relationship with the i-th configuration item; To simultaneously satisfy the set in the training samples The number of samples containing all constraints; For set The total number of constraints contained therein; No. Conditional weighted embedding vector of each configuration item The calculation formula is: ， In the formula, The set of all configuration item numbers for which the i-th configuration item has logical constraints; This is the embedding matrix corresponding to the j-th configuration item; S3. Extract the temporal and spatial feature vectors, calculate the spatiotemporal alignment matrix, obtain the alignment fusion features of each time step, and construct the original feature matrix; S4. Calculate the mutual information between each feature and the risk label in the original feature matrix, generate the selection weights of the features, and obtain the feature enhancement matrix. ; S5. Perform risk context feature extraction, gated residual feature enhancement, risk level prediction, calculate loss function, perform parameter update based on dynamic weight decay, iterative training and stop iteration condition judgment to obtain the trained recognition model. S501. Construct the risk perception bias matrix, generate learnable adaptive bias terms, and calculate the risk perception attention weight matrix. ; The calculation formula is: ， In the formula, It is a normalized exponential function; For query matrix; for Transpose of; The key matrix; It is the dimension of the key vector; For adaptive bias terms; It is a value matrix; The calculation formula is: In the formula, To query the matrix weight parameters; The calculation formula is: In the formula, These are the weight parameters of the key matrix; The calculation formula is: In the formula, These are the weight parameters of the value matrix; S502. Calculate the gating weight vector, feature projection transformation, and gating weighted fusion; S503. The gated fusion feature vector is input into the fully connected neural network layer for nonlinear transformation and dimensionality reduction to generate an initial score for each risk level; the initial score for each risk level is normalized using the Softmax activation function and converted into a probability distribution form. S504. Construct a weighted directed graph, calculate the shortest path distance between levels, and construct a loss function; S505. Calculate the dynamic weight decay coefficient and perform adaptive parameter update; S506. The mini-batch gradient descent strategy is used to iteratively optimize the parameters of the identification model. A fixed number of samples are randomly sampled from the labeled dataset for each training batch. Forward propagation is performed sequentially to generate risk prediction results. The deviation between the predicted value and the true label is calculated based on the loss function constructed in S504. All trainable parameters are updated through the backpropagation algorithm. S6. Deploy the trained identification model on the security analysis node of the PaaS+SaaS architecture, collect new log data, and after executing S1~S4, input the trained identification model. The trained identification model outputs the risk status corresponding to the new log data.

2. The method for identifying security risks in a PaaS+SaaS architecture according to claim 1, characterized in that, The steps in S2 include: S201. Parse the configuration items in each type of log, extract the explicit or implicit logical constraints between the configuration items, and form a set of constraints; S202. Based on the number of constraint relationships in the constraint relationship set and the number of samples in the training samples that satisfy all constraint relationships, calculate the conditional weight factor between the two configuration items; S203. Multiply the conditional weighting factor between two configuration items by the embedding matrix corresponding to the configuration item, and sum over all configuration items with logical constraints to obtain the conditional weighted embedding vector of each configuration item.

3. The method for identifying security risks in a PaaS+SaaS architecture according to claim 1, characterized in that, Step S3 includes: S301. Process the operation log and scan log separately. The operation log is input into the Long Short-Term Memory network to extract the time feature vector, and the scan log is extracted through the feedforward network to extract the spatial feature vector. The time feature vector is combined with the conditional weighted embedding vector of the configuration item. exist Time feature vector extracted from operation logs at all times The calculation formula is: ， In the formula, For time step index, , This represents the total number of time steps. It is a long short-term memory network; for Original characteristics of the operation log at any given moment; For splicing operations; In order to be in At any given time, the index of the configuration item associated with the operation log event; No. The vulnerability is extracted from the spatial feature vector of the scan log. The calculation formula is: ， In the formula, For spatial vulnerability indexing, , The total number of spatial vulnerabilities; It is a feedforward neural network; For the first Original characteristics of the vulnerability; S302. Based on the cosine similarity between the temporal feature vector and the spatial feature vector, and the exponential decay term of the spatiotemporal coordinate difference, calculate the correlation strength between each time step and each vulnerability to form a spatiotemporal alignment matrix; S303. For each time step, extract the weight vector of the corresponding row from the spatiotemporal alignment matrix, and multiply the weight vector element-wise with the concatenated temporal features and aggregated spatial features to obtain the alignment fusion features of each time step. Moment alignment and fusion features The calculation formula is: ， In the formula, The first of the spatiotemporal alignment matrices Row vectors; For element-wise multiplication; for The spatial characteristics of aggregation at any given moment; The calculation formula is: ， In the formula, Spatiotemporal alignment matrix The Middle line, number Column elements; The calculation formula is: ， In the formula, Use the Sigmoid activation function; It is a natural exponential function; For time resolution; Spatial resolution; It is the attenuation factor; S304. Stack the aligned and fused features of each time step in chronological order to form the original feature matrix.

4. The method for identifying security risks in a PaaS+SaaS architecture according to claim 1, characterized in that, The steps in S4 include: S401. Calculate the mutual information between each feature and the risk label in the original feature matrix; No. Mutual information between features and risk labels The calculation formula is: ， In the formula, The first in the original feature matrix One feature; The feature dimension index of the original feature matrix; Risk label; for The specific value to be taken; for The specific value to be taken; express Values and Values The joint probability; for Values The marginal probability; for Values The marginal probability; S402. The mutual information values ​​are nonlinearly mapped using the hyperbolic tangent function, and the discriminative power of the mutual information values ​​is enhanced by an amplification factor to obtain the selection weight of each feature; No. Selection weights of each feature The calculation formula is: ， In the formula, The feature dimension index of the original feature matrix; It is the hyperbolic tangent activation function; Amplification factor; The first in the original feature matrix One feature; Risk label; S403. Multiply the feature selection matrix with the original feature matrix to enhance the weights of important features and suppress redundant features, thus obtaining the feature enhancement matrix; Feature enhancement matrix The calculation formula is: ， In the formula, Select a matrix for the features; This is the original feature matrix.

5. The method for identifying security risks in a PaaS+SaaS architecture according to claim 1, characterized in that, The steps in S501 include: S5011. Construct a risk cause-effect graph based on prior safety knowledge to form a risk perception bias matrix; S5012. Project the risk perception bias matrix through a trainable linear transformation matrix to obtain an adaptive bias term; S5013. In standard attention calculation, the risk bias term is added to the attention score matrix and processed by a normalized exponential function to obtain the risk perception attention weight matrix.

6. The method for identifying security risks in a PaaS+SaaS architecture according to claim 1, characterized in that, The steps in S502 include: S5021. After concatenating the low-level feature matrix with the high-level feature matrix, a gated weight vector is generated through a fully connected layer and a Sigmoid activation function. S5022. Use trainable weight matrices to perform linear transformations on low-level and high-level features respectively, mapping them to a unified feature space; S5023. Use the gating weight vector to perform a weighted summation of the projected low-level and high-level features to generate a gating fusion feature vector.

7. The method for identifying security risks in a PaaS+SaaS architecture according to claim 1, characterized in that, The steps in S504 include: S5041. Define the directed propagation relationship between risk levels based on domain knowledge, and construct a weighted directed graph; S5042. For any predicted level and the actual level, use the Dixtra algorithm on the risk propagation map to calculate the shortest path distance between the two levels. S5043. The shortest path distance is used as the base coefficient of the exponential penalty term and combined with the focus loss to amplify the penalty for misjudgment between adjacent levels.

8. The method for identifying security risks in a PaaS+SaaS architecture according to claim 1, characterized in that, The steps in S505 include: S5051. Based on the mutual information value between features and risk labels, the dynamic weight decay coefficient of each feature is generated by normalizing and adjusting the basic decay rate using the hyperbolic tangent function. S5052. During the parameter update process, a dynamic weight decay coefficient is applied to the parameters of the corresponding feature to achieve adaptive regularization.

Images