A cloud security-based network security vulnerability detection method and system

Abstract

The application discloses a network security vulnerability detection method and system based on cloud security, comprising the following steps: generating a cloud security standard data set; performing heterogeneous hypergraph topology shaping to generate a cloud resource security relationship graph; generating a cloud resource vulnerability feature set; determining the cloud resources and the cloud resource association relationship corresponding to each vulnerability feature to generate a cloud security vulnerability candidate set; performing task collaborative reasoning by using an improved MTLPT model to generate a cloud security vulnerability recognition result; performing cascade instability deduction to generate a cloud security vulnerability association result; calculating a vulnerability risk value and determining a vulnerability risk level to generate a network security vulnerability detection result, and the application improves the accuracy and integrity of network security vulnerability recognition, cloud resource positioning, propagation path analysis and risk classification in a cloud environment.

Description

Technical Field

[0001] This invention relates to the fields of cloud computing security and network security vulnerability detection, and in particular to a network security vulnerability detection method and system based on cloud security. Background Technology

[0002] With the continuous development of cloud computing technology, cloud hosts, virtual machines, containers, cloud storage, virtual networks, and cloud application services are widely deployed in various information systems. Compared to traditional physical network environments, computing, storage, and network resources in cloud computing environments are characterized by dynamic creation, elastic scaling, cross-node migration, and multi-tenant sharing. Furthermore, complex communication, invocation, access, and dependency relationships exist between cloud resources. When cloud resources are improperly configured, service components are defective, access permissions are abnormally set, or abnormal interactions occur between cloud resources, network security vulnerabilities can easily form and may spread to other cloud resources along the interaction relationships between them. Therefore, accurate identification and correlation analysis of network security vulnerabilities in cloud computing environments has become an important research area in the field of cloud security technology.

[0003] Existing cloud vulnerability detection methods typically use vulnerability scanners to collect data on cloud host ports, service versions, component versions, and system configurations. The collected data is then matched against vulnerability signature databases to identify potential vulnerabilities. Some methods also incorporate network traffic data or security log data to identify abnormal access behavior and output risk levels based on vulnerability severity or vulnerability scores. However, security data in cloud computing environments comes from multiple sources, typically including cloud resource asset data, cloud resource configuration data, cloud resource operational data, network traffic data, and security log data. These different security data types vary in their collection cycles, field structures, time bases, and data granularity. Most existing methods analyze single types of data independently or simply summarize data from multiple sources, making it difficult to establish a unified, continuous, and mutually corresponding data foundation. This results in the inaccurate correlation of the status information of the same cloud resource across different data sources, thus affecting the complete extraction of vulnerability features. Summary of the Invention

[0004] One objective of this invention is to propose a network security vulnerability detection method and system based on cloud security. This invention fully utilizes multi-source heterogeneous security data processing, heterogeneous hypergraph topology shaping, multi-scale state slicing, state ridge tracing, and improved MTLPT model techniques, possessing advantages such as high vulnerability identification accuracy, strong cloud resource correlation capabilities, clear propagation path localization, and comprehensive risk assessment.

[0005] An image quality improvement method based on a liquid crystal microlens array according to an embodiment of the present invention includes the following steps: Collect and preprocess multi-source heterogeneous security data from cloud computing environments to generate cloud security standard datasets; Cloud resource information and cloud resource interaction relationships are extracted from the cloud security standard dataset. The cloud resources corresponding to the cloud resource information are used as resource nodes, and the cloud resource interaction relationships are used as relationship hyperedges. Heterogeneous hypergraph topology shaping is performed on the resource nodes and relationship hyperedges to generate a cloud resource security relationship graph. Multi-scale state slicing is performed on the cloud security standard dataset, the security state offset between adjacent state slices is calculated, state ridge tracing is used to identify continuous abnormal change segments, and abnormal transmission chains and corresponding vulnerability features between cloud resources are extracted along the continuous abnormal change segments to generate a cloud resource vulnerability feature set. Vulnerability feature matching is performed on the cloud resource vulnerability feature set, and the cloud resources and their relationships are determined based on the cloud resource security relationship graph to generate a cloud security vulnerability candidate set. The candidate set of cloud security vulnerabilities is input into the improved MTLPT model for task collaborative reasoning to generate cloud security vulnerability identification results. Cascaded instability simulation is performed on the cloud security vulnerability identification results to determine the cloud resources associated with the vulnerability, the vulnerability propagation path, and the scope of the vulnerability's impact, and to generate cloud security vulnerability association results. The vulnerability risk value is calculated based on the cloud security vulnerability correlation results, and the vulnerability risk level is determined based on the vulnerability risk value to generate network security vulnerability detection results.

[0006] Optionally, the multi-source heterogeneous security data includes cloud resource asset data, cloud resource configuration data, cloud resource operation data, network traffic data, and security log data. The preprocessing includes time alignment, field unification, duplicate data removal, and missing data completion.

[0007] Optionally, the generation of the cloud resource security relationship graph specifically includes: Extract cloud resource information from the cloud security standard dataset, set the cloud resources corresponding to the cloud resource information as resource nodes, and generate a set of resource nodes. Extract cloud resource interaction relationships from the cloud security standard dataset, connect resource nodes participating in the same interaction process into relationship hyperedges, and generate a set of relationship hyperedges; Based on the set of resource nodes and the set of relational hyperedges, the attribution relationship between each resource node and each relational hyperedge is determined, and the association status between each resource node and each relational hyperedge is recorded according to the attribution relationship, generating a node-hyperedge association matrix; Based on the node hyperedge association matrix, the number of interactions, duration of interactions, and number of connected resource nodes corresponding to each relation hyperedge are counted and normalized to obtain the hyperedge weights corresponding to each relation hyperedge, and a hyperedge weight set is generated. Based on the resource node set, relation hyperedge set, node hyperedge association matrix, and hyperedge weight set, heterogeneous hypergraph topology shaping is performed on resource nodes and relation hyperedges to generate a cloud resource security relation graph.

[0008] Optionally, the generation of the cloud resource vulnerability feature set specifically includes: The cloud security standard dataset is continuously divided to generate a multi-scale state slice sequence. The safe state data corresponding to each state slice is extracted from the multi-scale state slice sequence, and the difference is calculated to obtain the safe state offset, thus generating a safe state offset sequence. The direction of change of the safety state offset is tracked along the time sequence of the safety state offset sequence. Safety state offsets with the same direction of change and continuous time are connected to form a state ridge. The continuous abnormal change segment is determined according to the starting state slice and ending state slice corresponding to the state ridge. Extract cloud resource interaction relationships within continuously abnormal change segments from the cloud security standard dataset, connect the corresponding cloud resources according to the occurrence time and interaction direction of the cloud resource interaction relationships, and associate the state ridge lines with the corresponding cloud resources after connection to generate an anomaly propagation chain; The security state offset, transmission order, and transmission direction of each cloud resource are determined along the anomaly transmission chain. The security state offset is used as the degree of anomaly change of each cloud resource, and the transmission order and transmission direction are used as the transmission relationship of anomaly change between cloud resources. The degree of anomaly change and the transmission relationship are combined into the vulnerability features of each cloud resource to generate a cloud resource vulnerability feature set.

[0009] Optionally, the generation of the cloud security vulnerability candidate set specifically includes: Obtain historical vulnerability sample data, extract vulnerability features corresponding to each vulnerability category from the historical vulnerability sample data, and generate a vulnerability feature baseline set; Each vulnerability feature in the cloud resource vulnerability feature set is compared field by field with each vulnerability feature in the vulnerability feature benchmark set to generate a vulnerability feature comparison result set. Based on the vulnerability feature comparison result set, generate vulnerability feature matching results; Based on the vulnerability feature matching results, determine the cloud resources corresponding to each vulnerability feature, and retrieve the cloud resource association path corresponding to the cloud resource in the cloud resource security relationship graph to generate cloud resource association results; The cloud resource association results are written into the same vulnerability candidate record, and the vulnerability candidate records are aggregated to generate a cloud security vulnerability candidate set.

[0010] Optionally, the generation of the cloud security vulnerability identification result specifically includes: The improved MTLPT model inputs a cloud security vulnerability candidate set into a task-based collaborative reasoning model. This improved model includes a vulnerability evidence context folding module, a hyperedge propagation state injection module, a cross-task causal collaborative reasoning module, and a task imbalance self-calibration module. The improvements are as follows: the traditional MTLPT model extracts input sequence features using a lightweight Transformer and employs multi-task learning to predict vulnerability categories and output related tasks. The improved MTLPT model, however, performs path compression and loop closure resolution on vulnerability features and cloud resource association paths in the cloud security vulnerability candidate set to form a vulnerability evidence context sequence. A Hodge decomposition mechanism is introduced to separate the vulnerability propagation flow into gradient propagation flow, curl propagation flow, and harmonic propagation flow. Counterfactual perturbation is used to determine the task contribution of each propagation flow to different tasks. Based on the vulnerability confidence calculation results, task weights are calibrated for the vulnerability category identification results and vulnerability resource location results to generate cloud security vulnerability identification results. In the vulnerability evidence context folding module, based on the cloud resource association paths corresponding to each vulnerability feature in the cloud security vulnerability candidate set, the corresponding vulnerability features are arranged according to the cloud resource arrangement order in the cloud resource association path. The cloud resource association paths with the same cloud resources are compressed, the duplicate cloud resources in the cloud resource association path are looped and eliminated, and the corresponding vulnerability features are folded according to the cloud resource arrangement order after path compression to generate a vulnerability evidence context sequence. In the hyperedge propagation state injection module, the resource nodes corresponding to the vulnerability evidence context sequence are determined based on the cloud resource security relationship graph, and the vulnerability propagation flow is constructed according to the vulnerability feature differences of adjacent resource nodes. The Hodge decomposition mechanism is used to decompose the vulnerability propagation flow into gradient propagation flow, curl propagation flow and harmonic propagation flow, and write them into the vulnerability evidence context sequence to generate the hyperedge propagation state sequence. In the cross-task causal collaborative reasoning module, the hyperedge propagation state sequence is input into the lightweight Transformer, and counterfactual perturbations are performed on the gradient propagation flow, curl propagation flow, and harmonic propagation flow respectively. The differences in task output before and after the perturbation are compared to determine the task contribution of each propagation flow. Based on the task contribution, the vulnerability category identification result, vulnerability resource location result, and vulnerability confidence calculation result are obtained to generate the task reasoning result. In the task imbalance self-calibration module, the task weights of the vulnerability category identification results and vulnerability resource location results are adjusted based on the vulnerability confidence calculation results in the task inference results, and calibration is performed to generate cloud security vulnerability identification results.

[0011] Optionally, the generation of the cloud security vulnerability association results specifically includes: Extract vulnerability category, corresponding cloud resource and vulnerability confidence from cloud security vulnerability identification results. Locate the resource node corresponding to the cloud resource in the cloud resource security relationship graph. Determine the resource node as the initial unstable resource node. Determine the vulnerability confidence as the unstable value. Generate initial unstable result. Based on the initial instability results, determine the relational hyperedge to which the initially unstable resource node belongs and the resource nodes connected by the relational hyperedge. Based on the corresponding hyperedge weight, the instability value is passed to the resource node, and the passing relationship is recorded to generate the instability passing result. The resource node that receives the instability value in the instability propagation result is determined as the current instability resource node. The instability value is repeatedly propagated according to the weight of the hyperedge of the relationship hyperedge to which the current instability resource node belongs, generating a cascaded instability result. Connect the corresponding resource nodes based on the transmission relationship in the cascading instability results, generate the vulnerability propagation path, determine the cloud resources corresponding to the resource nodes covered by the vulnerability propagation path as the vulnerability-associated cloud resources, and determine the interaction relationship of the cloud resources covered by the vulnerability propagation path as the vulnerability impact range. The vulnerability is associated with cloud resources, the vulnerability propagation path, and the scope of the vulnerability's impact to generate cloud security vulnerability association results.

[0012] Optionally, the generation of the network security vulnerability detection results specifically includes: Based on the cloud security vulnerability association results, the number of cloud resources corresponding to the vulnerability-associated cloud resources, the number of resource nodes covered by the vulnerability propagation path, and the number of cloud resource interaction relationships covered by the vulnerability impact scope are counted to generate a vulnerability risk parameter set. The vulnerability risk parameter set is normalized to generate a standardized vulnerability risk parameter set, and the corresponding risk weights are determined to generate a vulnerability risk weight set. Based on the vulnerability risk weight set, generate the vulnerability risk value corresponding to each vulnerability; The vulnerability risk values ​​corresponding to each vulnerability are clustered in an ordered manner, and the vulnerability risk level of each cluster is determined according to the order of the vulnerability risk values ​​corresponding to each cluster center from small to large. The vulnerability risk value and vulnerability risk level are written into the corresponding vulnerability detection record, and the vulnerability detection records are aggregated to generate network security vulnerability detection results.

[0013] A cloud-based network security vulnerability detection system according to an embodiment of the present invention includes: The data processing module is used to collect multi-source heterogeneous security data in the cloud computing environment and preprocess it to generate a cloud security standard dataset. The relational graph construction module is used to extract cloud resource information and cloud resource interaction relationships from the cloud security standard dataset and generate a cloud resource security relational graph. The vulnerability feature extraction module is used to perform multi-scale state slicing and state ridge tracing on the cloud security standard dataset, extract the abnormal propagation chain and corresponding vulnerability features, and generate a cloud resource vulnerability feature set. The vulnerability candidate generation module is used to perform vulnerability feature matching on the cloud resource vulnerability feature set and generate a cloud security vulnerability candidate set by combining the cloud resource security relationship graph. The vulnerability identification module is used to input the candidate set of cloud security vulnerabilities into the improved MTLPT model for task collaborative reasoning and generate cloud security vulnerability identification results. The vulnerability association analysis module is used to perform cascade instability simulation on cloud security vulnerability identification results, determine the cloud resources associated with the vulnerability, the vulnerability propagation path and the scope of the vulnerability's impact, and generate cloud security vulnerability association results. The risk detection module is used to calculate vulnerability risk values ​​based on cloud security vulnerability correlation results, determine vulnerability risk levels, and generate network security vulnerability detection results.

[0014] The beneficial effects of this invention are: This invention generates a cloud resource security relationship graph by setting cloud resources as resource nodes, setting cloud resource interaction relationships as relationship hyperedges, and performing heterogeneous hypergraph topology shaping. This allows multiple cloud resources involved in the same interaction process to be expressed in the same relationship structure, avoiding the loss of associated information caused by the traditional binary relationship structure splitting complex interaction processes. This enhances the ability to express resource ownership, communication, invocation, access, and dependency relationships between cloud resources.

[0015] This invention performs multi-scale state slicing on a cloud security standard dataset, calculates the security state offset between adjacent state slices, and uses state ridge tracing to determine continuous abnormal change segments. This enables the identification of continuous changes in the security state of cloud resources at different time scales. Furthermore, by combining cloud resource interaction relationships to extract abnormal propagation chains and corresponding vulnerability features, isolated abnormal data is transformed into vulnerability features with time sequence and propagation direction, thereby improving the ability to identify persistent and chained anomalies.

[0016] This invention compares cloud resource vulnerability features with historical vulnerability sample data field by field, and combines cloud resource security relationship graphs to determine the cloud resources and cloud resource association paths corresponding to the vulnerability features, generating a cloud security vulnerability candidate set. This ensures that the vulnerability candidate results simultaneously include vulnerability category information and cloud resource association information, avoiding the problem of inaccurate resource location caused by relying solely on single feature matching results for vulnerability judgment.

[0017] This invention utilizes an improved MTLPT model to perform task-based collaborative reasoning on a candidate set of cloud security vulnerabilities. Through vulnerability evidence context folding, Hodge decomposition, counterfactual perturbation, and task weight calibration, it jointly identifies vulnerability categories, corresponding cloud resources, and vulnerability confidence levels. This allows vulnerability characteristics, cloud resource association paths, and vulnerability propagation status to be utilized in the same reasoning process, thereby improving the completeness of vulnerability identification results in complex cloud environments.

[0018] This invention further determines the associated cloud resources, propagation path, and scope of impact of vulnerabilities through cascading instability simulation, and calculates the vulnerability risk value and determines the vulnerability risk level based on the cloud security vulnerability association results. It realizes continuous processing from vulnerability identification, resource location, propagation analysis to risk classification, and can provide clear data basis for the vulnerability handling sequence, associated resource investigation and security protection in the cloud computing environment. Attached Figure Description

[0019] The accompanying drawings are provided to further illustrate the invention and form part of the specification. They are used in conjunction with embodiments of the invention to explain the invention and do not constitute a limitation thereof. In the drawings: Figure 1 This is an overall flowchart of a cloud-based network security vulnerability detection method and system proposed in this invention; Figure 2 This is a schematic diagram illustrating the construction of a cloud resource vulnerability feature set for a network security vulnerability detection method and system based on cloud security proposed in this invention. Figure 3 This is a schematic diagram of the structure of an improved MTLPT model for a cloud-based network security vulnerability detection method and system proposed in this invention. Detailed Implementation

[0020] The present invention will now be described in further detail with reference to the accompanying drawings. These drawings are simplified schematic diagrams, illustrating only the basic structure of the invention, and therefore only show the components relevant to the invention.

[0021] refer to Figures 1-3 A cloud-based network security vulnerability detection method includes the following steps: Collect and preprocess multi-source heterogeneous security data from cloud computing environments to generate cloud security standard datasets; Cloud resource information and cloud resource interaction relationships are extracted from the cloud security standard dataset. The cloud resources corresponding to the cloud resource information are used as resource nodes, and the cloud resource interaction relationships are used as relationship hyperedges. Heterogeneous hypergraph topology shaping is performed on the resource nodes and relationship hyperedges to generate a cloud resource security relationship graph. Multi-scale state slicing is performed on the cloud security standard dataset, the security state offset between adjacent state slices is calculated, state ridge tracing is used to identify continuous abnormal change segments, and abnormal transmission chains and corresponding vulnerability features between cloud resources are extracted along the continuous abnormal change segments to generate a cloud resource vulnerability feature set. Vulnerability feature matching is performed on the cloud resource vulnerability feature set, and the cloud resources and their relationships are determined based on the cloud resource security relationship graph to generate a cloud security vulnerability candidate set. The candidate set of cloud security vulnerabilities is input into the improved MTLPT model for task collaborative reasoning to generate cloud security vulnerability identification results. Cascaded instability simulation is performed on the cloud security vulnerability identification results to determine the cloud resources associated with the vulnerability, the vulnerability propagation path, and the scope of the vulnerability's impact, and to generate cloud security vulnerability association results. The vulnerability risk value is calculated based on the cloud security vulnerability correlation results, and the vulnerability risk level is determined based on the vulnerability risk value to generate network security vulnerability detection results.

[0022] In this embodiment, the multi-source heterogeneous security data includes cloud resource asset data, cloud resource configuration data, cloud resource operation data, network traffic data, and security log data. Cloud resource asset data is obtained by calling the cloud platform resource management interface to read asset information of cloud hosts, virtual machines, containers, storage resources, and network resources. Cloud resource configuration data is obtained by calling the cloud platform configuration management interface and security policy interface to read resource configuration parameters, network access rules, and permission configuration information. Cloud resource operation data is obtained by monitoring the processor utilization rate, memory utilization rate, storage utilization rate, process status, and service status of cloud resources. Network traffic data is obtained by collecting communication packets and session records through cloud switching devices, virtual network interfaces, and traffic probes. Security log data is obtained by receiving cloud platform logs, operating system logs, application logs, access control logs, and security device alarm logs. Preprocessing includes time alignment, field unification, duplicate data removal, and missing data completion.

[0023] In this embodiment, the generation of the cloud resource security relationship graph specifically includes: Extract cloud resource information from the cloud security standard dataset, set the cloud resources corresponding to the cloud resource information as resource nodes, and generate a set of resource nodes. The specific process of generating the resource node set is as follows: read the data records corresponding to each cloud resource from the cloud security standard dataset, identify the cloud resources pointed to by each data record based on the data items that distinguish cloud resources in the data records, merge the data records pointing to the same cloud resource into a group of cloud resource information, set the cloud resource corresponding to each group of cloud resource information as a resource node, arrange the resource nodes according to the one-to-one correspondence between the resource nodes and the corresponding cloud resource information, and generate the resource node set. Extract cloud resource interaction relationships from the cloud security standard dataset, connect resource nodes participating in the same interaction process into relationship hyperedges, and generate a set of relationship hyperedges; The specific process of generating the set of relational hyperedges is as follows: Read data records that record the communication, calling, access or dependency processes between resource nodes from the cloud security standard dataset; identify the same interaction process according to the occurrence time, interaction direction and participating resource nodes corresponding to the data records; form a set of cloud resource interaction relationships by forming the data records corresponding to the same interaction process; connect all resource nodes participating in the interaction process together into a relational hyperedge; arrange the relational hyperedges according to the one-to-one correspondence between each relational hyperedge and the corresponding interaction process to generate the set of relational hyperedges; Based on the set of resource nodes and the set of relational hyperedges, the attribution relationship between each resource node and each relational hyperedge is determined, and the association status between each resource node and each relational hyperedge is recorded according to the attribution relationship, generating a node-hyperedge association matrix; The specific process of generating the node hyperedge association matrix is ​​as follows: traverse each resource node in the resource node set and each relation hyperedge in the relation hyperedge set, read the resource nodes included in the interaction process corresponding to each relation hyperedge, and match the resource nodes with the participating resource nodes recorded in the relation hyperedge item by item. When a resource node participates in the corresponding interaction process, the attribution relationship between the resource node and the relation hyperedge is recorded as association state value one. When a resource node is outside the corresponding interaction process, the attribution relationship between the resource node and the relation hyperedge is recorded as association state value zero. Set the matrix rows according to the arrangement order of the resource nodes, set the matrix columns according to the arrangement order of the relation hyperedges, and write each association state value into the corresponding matrix position to generate the node hyperedge association matrix. Based on the node hyperedge association matrix, the number of interactions, duration of interactions, and number of connected resource nodes corresponding to each relation hyperedge are counted and normalized to obtain the hyperedge weights corresponding to each relation hyperedge, and a hyperedge weight set is generated. The specific process of generating the hyperedge weight set is as follows: Based on the matrix columns corresponding to each relation hyperedge in the node hyperedge association matrix, the number of connected resource nodes of the corresponding relation hyperedge is determined according to the number of occurrences of the association state value of one in the matrix column; the number of interactions is determined according to the number of records of the corresponding interaction process in the cloud security standard dataset; and the duration of the interaction is determined according to the difference between the earliest and latest occurrence times of the corresponding interaction process. Normalization is performed according to the value range of the number of interactions, the duration of the interaction, and the number of connected resource nodes corresponding to all relation hyperedges. The normalized number of interactions, the duration of the interaction, and the number of connected resource nodes are weighted and summed to obtain the hyperedge weight corresponding to each relation hyperedge. The hyperedge weights are then aggregated according to the order of the relation hyperedges to generate the hyperedge weight set. Based on the resource node set, relation hyperedge set, node hyperedge association matrix, and hyperedge weight set, heterogeneous hypergraph topology shaping is performed on resource nodes and relation hyperedges to generate a cloud resource security relation graph. The specific process of generating the cloud resource security relationship graph is as follows: Read the resource node set, relationship hyperedge set, node hyperedge association matrix, and hyperedge weight set. Use each resource node in the resource node set as a node in the heterogeneous hypergraph, and each relationship hyperedge in the relationship hyperedge set as a hyperedge simultaneously connecting resource nodes. According to the affiliation recorded in the node hyperedge association matrix, configure each resource node to its corresponding relationship hyperedge, and assign the weights of each hyperedge in the hyperedge weight set to the corresponding relationship hyperedge. Based on the number of resource nodes participating in each relationship hyperedge, the number of resource nodes connected to each relationship hyperedge, and the corresponding hyperedge weights, organize the topological positions and association order of resource nodes and relationship hyperedges. This ensures that the same relationship hyperedge connects resource nodes participating in the same interaction process, and that different relationship hyperedges form continuous associations through jointly participating resource nodes, thus generating the cloud resource security relationship graph.

[0024] In this embodiment, the generation of the cloud resource vulnerability feature set specifically includes: The cloud security standard dataset is continuously divided to generate a multi-scale state slice sequence. The process of generating a multi-scale state slice sequence is as follows: Based on the collection time and cloud resources corresponding to each data in the cloud security standard dataset, the data belonging to the same cloud resource are arranged in the order of collection time. The arranged data are divided into continuous time ranges of different time lengths. Data within the same time range are set as a state slice. The state slices are arranged from first to last according to the time range corresponding to each state slice. The state slices formed under different time lengths are grouped according to their corresponding time lengths to generate a multi-scale state slice sequence. The safe state data corresponding to each state slice is extracted from the multi-scale state slice sequence, and the difference is calculated to obtain the safe state offset, thus generating a safe state offset sequence. The specific process for generating the safety state offset sequence is as follows: Based on the safety state data corresponding to each state slice in the multi-scale state slice sequence, the safety state data are aligned item by item according to the same data arrangement order. Two state slices with the same time length and adjacent time are selected, and the difference between the safety state data of the latter state slice and the safety state data of the former state slice is calculated respectively. The absolute values ​​of each difference are collected to obtain the safety state offset between the two state slices. The safety state offset between all adjacent state slices is calculated sequentially according to the time order corresponding to each state slice, and the safety state offsets are arranged according to the time order of the corresponding state slices to generate the safety state offset sequence. The direction of change of the safety state offset is tracked along the time sequence of the safety state offset sequence. Safety state offsets with the same direction of change and continuous time are connected to form a state ridge. The continuous abnormal change segment is determined according to the starting state slice and ending state slice corresponding to the state ridge. The process of determining the continuous abnormal change segment is as follows: Read the numerical changes and time positions corresponding to each safety state offset in the safety state offset sequence, compare the changing directions of adjacent safety state offsets in turn, and when adjacent safety state offsets show continuous increase, continuous decrease or keep changing in the same direction, connect the corresponding safety state offsets in time order to form a state ridge line; take the first state slice corresponding to the state ridge line as the starting state slice, take the last state slice corresponding to the state ridge line as the ending state slice, and determine the continuous time range covered between the starting state slice and the ending state slice as the continuous abnormal change segment. Extract cloud resource interaction relationships within continuously abnormal change segments from the cloud security standard dataset, connect the corresponding cloud resources according to the occurrence time and interaction direction of the cloud resource interaction relationships, and associate the state ridge lines with the corresponding cloud resources after connection to generate an anomaly propagation chain; The specific process of generating the anomaly propagation chain is as follows: read the start and end times corresponding to the continuous anomaly change segments, filter cloud resource interaction relationships whose occurrence time is between the start and end times from the cloud security standard dataset, sort them according to the occurrence time of each cloud resource interaction relationship, and determine the transmission order between cloud resources according to the interaction direction of each cloud resource interaction relationship; continuously connect the cloud resource pointed to by the previous interaction direction in the adjacent cloud resource interaction relationship with the cloud resource starting from the next interaction direction, and associate the time position corresponding to the state ridge line with the connected cloud resource, arrange each cloud resource and cloud resource interaction relationship according to the occurrence time and transmission order to generate the anomaly propagation chain; The security state offset, transmission order, and transmission direction of each cloud resource are determined along the anomaly transmission chain. The security state offset is used as the degree of anomaly change of each cloud resource, and the transmission order and transmission direction are used as the transmission relationship of anomaly change between cloud resources. The degree of anomaly change and the transmission relationship are combined into the vulnerability features of each cloud resource to generate a cloud resource vulnerability feature set. The specific process for generating a cloud resource vulnerability feature set is as follows: Read the cloud resources arranged sequentially in the anomaly propagation chain and their corresponding propagation positions; write the security state offset of each cloud resource in the security state offset sequence into the anomaly change degree field; write the propagation order field according to the position of each cloud resource in the anomaly propagation chain; and write the propagation direction field according to the interaction between each cloud resource and adjacent cloud resources. Using the same cloud resource as a data index, write the corresponding field values ​​into the same vulnerability feature record according to the fixed arrangement order of the anomaly change degree field, propagation order field, and propagation direction field, forming the vulnerability features corresponding to each cloud resource. Arrange the vulnerability features according to the propagation order to generate a cloud resource vulnerability feature set.

[0025] In this embodiment, the generation of the cloud security vulnerability candidate set specifically includes: Obtain historical vulnerability sample data, extract vulnerability features corresponding to each vulnerability category from the historical vulnerability sample data, and generate a vulnerability feature baseline set; The specific process of generating the vulnerability feature benchmark set is as follows: read the vulnerability category and vulnerability feature field corresponding to each vulnerability sample in the historical vulnerability sample data, classify the historical vulnerability sample data according to the vulnerability category, and divide the vulnerability samples belonging to the same vulnerability category into the same vulnerability sample group; arrange the vulnerability feature fields in each vulnerability sample group item by item according to a unified field order, and count the value of the same field in the vulnerability sample group; write the values ​​corresponding to each field into the same vulnerability feature benchmark record according to a unified field order to form the vulnerability feature benchmark record corresponding to each vulnerability category; collect all vulnerability feature benchmark records to generate the vulnerability feature benchmark set. Each vulnerability feature in the cloud resource vulnerability feature set is compared field by field with each vulnerability feature in the vulnerability feature benchmark set to generate a vulnerability feature comparison result set. The specific process of generating the vulnerability feature comparison result set is as follows: read each vulnerability feature in the cloud resource vulnerability feature set and each vulnerability feature benchmark record in the vulnerability feature benchmark set, align the fields to be compared item by item according to the same field arrangement order, and compare the field values ​​of the corresponding fields in turn; when the field values ​​of the corresponding fields are the same, the field is recorded as a field matching state; when the field values ​​of the corresponding fields are different, the field is recorded as a field difference state, and the field matching state and field difference state corresponding to each field are collected according to the field arrangement order to form a vulnerability feature comparison record between each vulnerability feature and each vulnerability feature benchmark record. Collect all vulnerability feature comparison records to generate a vulnerability feature comparison result set. Based on the vulnerability feature comparison result set, generate vulnerability feature matching results; The specific process for generating vulnerability feature matching results is as follows: Read each vulnerability feature comparison record in the vulnerability feature comparison result set, count the number of field matching states and the total number of fields in each vulnerability feature comparison record, and determine the ratio of the number of field matching states to the total number of fields as the vulnerability feature matching degree between the corresponding vulnerability feature and the corresponding vulnerability feature baseline record; for each vulnerability feature in the cloud resource vulnerability feature set, arrange the corresponding vulnerability feature baseline records in descending order of vulnerability feature matching degree, determine the vulnerability category corresponding to the vulnerability feature corresponding to the vulnerability feature of the vulnerability feature baseline record with the highest vulnerability feature matching degree, and when multiple vulnerability feature baseline records have the same vulnerability feature matching degree, retain the vulnerability categories corresponding to multiple vulnerability feature baseline records, and record each vulnerability feature, corresponding vulnerability category, and vulnerability feature matching degree to generate the vulnerability feature matching result; Based on the vulnerability feature matching results, determine the cloud resources corresponding to each vulnerability feature, and retrieve the cloud resource association paths corresponding to the cloud resources in the cloud resource security relationship graph to generate cloud resource association results; The specific process for generating cloud resource association results is as follows: Read each vulnerability feature and its corresponding vulnerability category from the vulnerability feature matching results; determine the corresponding cloud resource based on the data index of each vulnerability feature in the cloud resource vulnerability feature set; and locate the resource node corresponding to the cloud resource in the cloud resource security relationship graph. Starting from the resource node, sequentially retrieve the relationship hyperedges that have a hierarchical relationship with the resource node and the resource nodes connected by the relationship hyperedges; form the cloud resource association path corresponding to the cloud resource according to the association order of the relationship hyperedges; write the vulnerability category, cloud resource, and cloud resource association path corresponding to each vulnerability feature into the same cloud resource association record; and aggregate all cloud resource association records to generate the cloud resource association result. The cloud resource association results are written into the same vulnerability candidate record, and the vulnerability candidate records are aggregated to generate a cloud security vulnerability candidate set.

[0026] In this embodiment, the generation of cloud security vulnerability identification results specifically includes: The improved MTLPT model inputs a cloud security vulnerability candidate set into a task-based collaborative reasoning model. This improved model includes a vulnerability evidence context folding module, a hyperedge propagation state injection module, a cross-task causal collaborative reasoning module, and a task imbalance self-calibration module. The improvements are as follows: the traditional MTLPT model extracts input sequence features using a lightweight Transformer and employs multi-task learning to predict vulnerability categories and output related tasks. The improved MTLPT model, however, performs path compression and loop closure resolution on vulnerability features and cloud resource association paths in the cloud security vulnerability candidate set to form a vulnerability evidence context sequence. A Hodge decomposition mechanism is introduced to separate the vulnerability propagation flow into gradient propagation flow, curl propagation flow, and harmonic propagation flow. Counterfactual perturbation is used to determine the task contribution of each propagation flow to different tasks. Based on the vulnerability confidence calculation results, task weights are calibrated for the vulnerability category identification results and vulnerability resource location results to generate cloud security vulnerability identification results. The improved MTLPT model sequentially connects the vulnerability evidence context folding module, the hyperedge propagation state injection module, the cross-task causal collaborative reasoning module, and the task imbalance self-calibration module. The cloud security vulnerability candidate set is input into the vulnerability evidence context folding module and converted into a two-dimensional vulnerability evidence context sequence arranged according to cloud resource association paths. This two-dimensional vulnerability evidence context sequence is then input into the hyperedge propagation state injection module, which adds gradient propagation flow, curl propagation flow, and harmonic propagation flow to form a hyperedge propagation state sequence containing vulnerability feature dimensions and propagation state dimensions. The hyperedge propagation state sequence is input into the cross-task causal collaborative reasoning module, and after unified dimensional projection, outputs vulnerability category identification results, vulnerability resource location results, and vulnerability confidence calculation results, respectively. These results are then input into the task imbalance self-calibration module, where task weights are calibrated according to the same vulnerability candidate data, and the cloud security vulnerability identification result is output. The training data for the improved MTLPT model comes from historical vulnerability sample data, cloud security standard datasets, cloud resource security relationship graphs, and cloud resource vulnerability feature sets. A correspondence is established between the same cloud resource and the same vulnerability sample, and vulnerability categories, corresponding cloud resources, and vulnerability confidence levels are labeled. Vulnerability categories are labeled with category numbers, corresponding cloud resources with resource node numbers, and vulnerability confidence levels with continuous values ​​ranging from zero to one. Model training uses a joint loss function consisting of vulnerability category identification loss, vulnerability resource location loss, and vulnerability confidence calculation loss. Vulnerability category identification loss uses cross-entropy loss, vulnerability resource location loss uses cross-entropy loss, and vulnerability confidence calculation loss uses mean squared error loss. The three losses are first multiplied by their respective task weights, and then the weighted results are summed to obtain the joint loss. The sum of the three task weights is one, and the task weights are adjusted based on the percentage decrease in loss for each task over two consecutive training rounds. The improved MTLPT model was trained using the AdamW optimizer with an initial learning rate of 0.00001, a weight decay coefficient of 0.0001, a batch size of 32, 200 training epochs, a lightweight Transformer with a hidden dimension of 128, a feedforward layer dimension of 256, 4 encoding layers, 4 attention heads, and a random deactivation ratio of 0.1. The learning rate was multiplied by 0.9 every 5 training epochs. Training was stopped and the parameters of the improved MTLPT model with the minimum joint loss were saved when the decrease in joint loss was less than 0.0001 over 10 consecutive training epochs, or when the vulnerability category identification accuracy, vulnerability resource location accuracy, and vulnerability confidence mean square error remained unchanged over 10 consecutive training epochs. In the vulnerability evidence context folding module, based on the cloud resource association paths corresponding to each vulnerability feature in the cloud security vulnerability candidate set, the corresponding vulnerability features are arranged according to the cloud resource arrangement order in the cloud resource association path. The cloud resource association paths with the same cloud resources are compressed, the duplicate cloud resources in the cloud resource association path are looped and eliminated, and the corresponding vulnerability features are folded according to the cloud resource arrangement order after path compression to generate a vulnerability evidence context sequence. The generation process of the vulnerability evidence context sequence is as follows: Based on the cloud resource association paths corresponding to each vulnerability feature in the cloud security vulnerability candidate set, a path position sequence is established according to the order of cloud resources in each cloud resource association path, and each vulnerability feature is written into the path position where the corresponding cloud resource is located; when different cloud resource association paths contain the same cloud resource, the same cloud resource is used as the path intersection position, and the different cloud resource association paths are aligned at the path intersection position, and the cloud resources before and after the intersection position are connected according to the order of each cloud resource in the cloud resource association path to complete path compression; when the same cloud resource appears repeatedly in the compressed cloud resource association path, the path position of the first appearance of the cloud resource is retained, and the vulnerability feature corresponding to the repeated path position is written into the path position of the first appearance to complete loop elimination; according to the order of cloud resources after path compression and loop elimination, the vulnerability features corresponding to each path position are arranged continuously to generate the vulnerability evidence context sequence. In the hyperedge propagation state injection module, the resource nodes corresponding to the vulnerability evidence context sequence are determined based on the cloud resource security relationship graph, and the vulnerability propagation flow is constructed according to the vulnerability feature differences of adjacent resource nodes. The Hodge decomposition mechanism is used to decompose the vulnerability propagation flow into gradient propagation flow, curl propagation flow and harmonic propagation flow, and write them into the vulnerability evidence context sequence to generate the hyperedge propagation state sequence. The generation process of the hyperedge propagation state sequence is as follows: Based on the vulnerability features arranged sequentially in the vulnerability evidence network sequence, the resource nodes corresponding to each vulnerability feature are located in the cloud resource security relationship graph. Directed node connections are set according to the arrangement direction between adjacent resource nodes. The vulnerability propagation quantity corresponding to each directed node connection is formed according to the numerical difference between adjacent vulnerability features. All vulnerability propagation quantities are arranged into a vulnerability propagation flow according to the arrangement order of the directed node connections. The Hodge decomposition mechanism is adopted to construct a node edge association matrix based on the starting and ending resource nodes of each directed node connection. The vulnerability propagation flow is then calculated by solving the vulnerability... The gradient transmission flow is obtained by projecting the transmission flow onto the column space of the node edge association matrix. A loop edge association matrix is ​​constructed based on the closed path formed by the directed node connections in the cloud resource security relationship graph. The curl transmission flow is obtained by projecting the vulnerability transmission flow (after deducting the gradient transmission flow) onto the column space of the loop edge association matrix. The remaining component of the vulnerability transmission flow after deducting the gradient transmission flow and the curl transmission flow is determined as the harmonic transmission flow. According to the arrangement order of the directed node connections, the gradient transmission flow, the curl transmission flow, and the harmonic transmission flow are written between the corresponding adjacent vulnerability features in the vulnerability evidence context sequence to generate a hyperedge transmission state sequence. In the cross-task causal collaborative reasoning module, the hyperedge propagation state sequence is input into the lightweight Transformer, and counterfactual perturbations are performed on the gradient propagation flow, curl propagation flow, and harmonic propagation flow respectively. The differences in task output before and after the perturbation are compared to determine the task contribution of each propagation flow. Based on the task contribution, the vulnerability category identification result, vulnerability resource location result, and vulnerability confidence calculation result are obtained to generate the task reasoning result. The specific process for generating the task inference results is as follows: The vulnerability features and their corresponding gradient, curl, and harmonic flows in the hyperedge propagation state sequence are arranged in the order of the vulnerability evidence context sequence to form an input sequence, which is then input into a lightweight Transformer. The lightweight Transformer employs a shared feature extraction layer and three task output layers. The shared feature extraction layer converts the input sequence into a sequence representation of a unified dimension through linear projection and extracts the correlation representation between each vulnerability feature and the gradient, curl, and harmonic flows through a multi-layer feedforward transform. The gradient, curl, and harmonic flows are then set to zero from the input sequence to form three sets of counterfactual perturbation sequences, which are then input into the lightweight Transformer. The rmer algorithm is used to obtain the corresponding counterfactual task output. The task output corresponding to the original input sequence is then compared with the three sets of counterfactual task outputs to calculate the difference, resulting in the contribution of the gradient propagation flow, curl propagation flow, and harmonic propagation flow to vulnerability category identification, vulnerability resource location, and vulnerability confidence calculation. The association representation of the shared feature extraction layer output is weighted according to the task contribution of each propagation flow and then input into the vulnerability category identification task output layer, the vulnerability resource location task output layer, and the vulnerability confidence calculation task output layer, respectively, to obtain the vulnerability category identification result, the vulnerability resource location result, and the vulnerability confidence calculation result. The vulnerability category identification result, the vulnerability resource location result, and the vulnerability confidence calculation result are then aggregated according to the correspondence of the same vulnerability candidate data to generate the task inference result. In the task imbalance self-calibration module, the task weights of the vulnerability category identification results and vulnerability resource location results are adjusted based on the vulnerability confidence calculation results in the task inference results, and calibration is performed to generate cloud security vulnerability identification results. The specific process for generating cloud security vulnerability identification results is as follows: Based on the vulnerability category identification results, vulnerability resource location results, and vulnerability confidence calculation results in the task inference results, a corresponding relationship is established according to the same vulnerability candidate data; the category output value corresponding to each vulnerability category is extracted from the vulnerability category identification results, and the category output value with the largest value is multiplied by the corresponding vulnerability confidence calculation result to obtain the category task calibration value; the location output value corresponding to each cloud resource is extracted from the vulnerability resource location results, and the location output value with the largest value is multiplied by the corresponding vulnerability confidence calculation result to obtain the location task calibration value; the ratio of the category task calibration value to the location task calibration value is calculated. The ratio of the category task calibration value to the sum of the values ​​is determined as the task weight corresponding to the vulnerability category identification result, and the ratio of the location task calibration value to the sum of the values ​​is determined as the task weight corresponding to the vulnerability resource location result. The vulnerability category identification result and the vulnerability resource location result are weighted according to the corresponding task weights, and the weighted vulnerability category identification result and the weighted vulnerability resource location result are normalized to determine the vulnerability category and the corresponding cloud resource for each vulnerability candidate data. The vulnerability category, the corresponding cloud resource, and the corresponding vulnerability confidence calculation results are aggregated according to the correspondence of the same vulnerability candidate data to generate the cloud security vulnerability identification result.

[0027] In this embodiment, the generation of cloud security vulnerability association results specifically includes: Extract vulnerability category, corresponding cloud resource and vulnerability confidence from cloud security vulnerability identification results. Locate the resource node corresponding to the cloud resource in the cloud resource security relationship graph. Determine the resource node as the initial unstable resource node. Determine the vulnerability confidence as the unstable value. Generate initial unstable result. The generation of the initial instability result is as follows: read the vulnerability category, the cloud resource corresponding to the vulnerability, and the vulnerability confidence level from the cloud security vulnerability identification results; locate the corresponding resource node in the cloud resource security relationship graph according to the cloud resource corresponding to the vulnerability, and record the resource node as the initial instability resource node; according to the correspondence of the same vulnerability, write the vulnerability category, the cloud resource corresponding to the vulnerability, the initial instability resource node, and the vulnerability confidence level into the same initial instability record, use the vulnerability confidence level as the instability value corresponding to the initial instability resource node, and collect all the initial instability records to generate the initial instability result; Based on the initial instability results, determine the relational hyperedge to which the initially unstable resource node belongs and the resource nodes connected by the relational hyperedge. Based on the corresponding hyperedge weight, the instability value is passed to the resource node, and the passing relationship is recorded to generate the instability passing result. The specific process for generating the instability propagation result is as follows: Based on the initial unstable resource node and corresponding unstable value in the initial instability result, the relational hyperedge to which the initial unstable resource node belongs is retrieved in the cloud resource security relation graph, and the resource nodes connected by each relational hyperedge are determined; the ratio of the hyperedge weight corresponding to each relational hyperedge to the sum of the hyperedge weights of all relational hyperedges to which the initial unstable resource node belongs is calculated to obtain the instability allocation ratio corresponding to each relational hyperedge; the unstable value is multiplied by each instability allocation ratio to obtain the instability propagation value transmitted through the corresponding relational hyperedge; the instability propagation value is allocated to the corresponding resource node according to the number of resource nodes connected by each relational hyperedge; the initial unstable resource node, relational hyperedge, resource node receiving the instability propagation value, and corresponding instability propagation value are written into the same instability propagation record, and all instability propagation records are aggregated to generate the instability propagation result; The resource node that receives the instability value in the instability propagation result is determined as the current instability resource node. The instability value is repeatedly propagated according to the weight of the hyperedge of the relationship hyperedge to which the current instability resource node belongs, generating a cascaded instability result. The specific process for generating cascaded instability results is as follows: The resource node receiving the instability value and its corresponding instability propagation value are read from the instability propagation result. The resource node is identified as the currently unstable resource node, and the instability propagation value is identified as the instability value corresponding to the currently unstable resource node. In the cloud resource security relationship graph, the relationship hyperedge to which the currently unstable resource node belongs and the resource nodes connected by each relationship hyperedge are retrieved. The instability allocation ratio is calculated based on the hyperedge weights corresponding to each relationship hyperedge, and the instability value corresponding to the currently unstable resource node is propagated to each relationship hyperedge according to the instability allocation ratio. Connected resource nodes; when the same resource node receives multiple unstable transmission values ​​through different relational hyperedges, the multiple unstable transmission values ​​are accumulated into the unstable value corresponding to the resource node, and the resource node is determined as the current unstable resource node in the next round; relational hyperedge retrieval, unstable allocation ratio calculation, unstable value transmission, and unstable value accumulation are executed sequentially until no new current unstable resource node is generated in the current round of unstable value transmission; the current unstable resource nodes, relational hyperedges, resource nodes receiving unstable values, and corresponding unstable values ​​in each round are collected in the transmission order to generate cascaded instability results; Connect the corresponding resource nodes based on the transmission relationship in the cascading instability results, generate the vulnerability propagation path, determine the cloud resources corresponding to the resource nodes covered by the vulnerability propagation path as the vulnerability-associated cloud resources, and determine the interaction relationship of the cloud resources covered by the vulnerability propagation path as the vulnerability impact range. The process of determining the associated cloud resources, propagation path, and scope of vulnerability impact is as follows: Read the currently unstable resource node, relational hyperedges, resource node receiving the unstable value, and corresponding unstable value recorded in the cascading instability results according to the transmission order. Using the initial unstable resource node as the path starting point, connect the currently unstable resource node and the resource node receiving the unstable value sequentially through corresponding relational hyperedges according to the order of transmission of each unstable value, forming the vulnerability propagation path corresponding to each vulnerability. Extract all resource nodes covered by the vulnerability propagation path, and determine the cloud resources corresponding to each resource node based on the correspondence between resource nodes and cloud resources in the cloud resource security relationship graph, aggregating the cloud resources into vulnerability-associated cloud resources. Extract all relational hyperedges covered by the vulnerability propagation path, and determine the cloud resource interaction relationships involved in the vulnerability propagation path based on the cloud resource interaction relationships corresponding to each relational hyperedge, defining the scope of cloud resources corresponding to the cloud resource interaction relationships as the scope of vulnerability impact. The vulnerability is associated with cloud resources, vulnerability propagation path, and vulnerability impact scope to generate cloud security vulnerability association results; The process of generating cloud security vulnerability association results is as follows: read the cloud resources associated with the vulnerability, the vulnerability propagation path, and the vulnerability impact scope corresponding to the same vulnerability; use the cloud resources corresponding to the vulnerability as the association index; write the corresponding content into the same vulnerability association record according to the fixed field order of the cloud resources associated with the vulnerability, the vulnerability propagation path, and the vulnerability impact scope; arrange the vulnerability association records according to the order of each vulnerability in the cloud security vulnerability identification results; collect all vulnerability association records; and generate cloud security vulnerability association results.

[0028] In this embodiment, the generation of network security vulnerability detection results specifically includes: Based on the cloud security vulnerability association results, the number of cloud resources corresponding to the vulnerability-associated cloud resources, the number of resource nodes covered by the vulnerability propagation path, and the number of cloud resource interaction relationships covered by the vulnerability impact scope are counted to generate a vulnerability risk parameter set. The specific process for generating the vulnerability risk parameter set is as follows: Read the vulnerability-associated cloud resources, vulnerability propagation paths, and vulnerability impact range corresponding to each vulnerability in the cloud security vulnerability association results, and establish data correspondence relationships according to the same vulnerability; count the number of cloud resources in the vulnerability-associated cloud resources to obtain the number of cloud resources; count the number of resource nodes in the vulnerability propagation path to obtain the number of resource nodes; count the number of cloud resource interaction relationships in the vulnerability impact range to obtain the number of cloud resource interaction relationships; according to the fixed field order of the number of cloud resources, the number of resource nodes, and the number of cloud resource interaction relationships, write the quantities corresponding to the same vulnerability into the same vulnerability risk parameter record, and aggregate all vulnerability risk parameter records to generate the vulnerability risk parameter set. The vulnerability risk parameter set is normalized to generate a standardized vulnerability risk parameter set, and the corresponding risk weights are determined to generate a vulnerability risk weight set. The specific process for generating the vulnerability risk weight set is as follows: Read the number of cloud resources, resource nodes, and cloud resource interaction relationships from the vulnerability risk parameter set; determine the maximum and minimum values ​​of each vulnerability risk parameter in all vulnerabilities; and normalize the parameters by dividing the difference between each vulnerability risk parameter and its corresponding minimum value by the difference between its corresponding maximum and minimum value to generate a standardized vulnerability risk parameter set. Based on the standardized vulnerability risk parameter set, calculate the percentage of each standardized vulnerability risk parameter in all vulnerabilities, and calculate the corresponding information entropy based on the parameter percentage. The difference between the information entropy and 1 is determined as the difference coefficient of the corresponding standardized vulnerability risk parameter. Divide each difference coefficient by the sum of all difference coefficients to obtain the risk weights corresponding to the number of cloud resources, resource nodes, and cloud resource interaction relationships. Arrange the risk weights in the order of the fields: number of cloud resources, resource nodes, and cloud resource interaction relationships to generate the vulnerability risk weight set. Based on the vulnerability risk weight set, generate the vulnerability risk value corresponding to each vulnerability; The specific process for generating vulnerability risk values ​​is as follows: Based on the standardized vulnerability risk parameter set and vulnerability risk weight set, following the same field order, the standardized cloud resource quantity, standardized resource node quantity, and standardized cloud resource interaction quantity corresponding to each vulnerability are multiplied by the corresponding risk weight in the vulnerability risk weight set to obtain the cloud resource quantity risk component, resource node quantity risk component, and cloud resource interaction quantity risk component; the cloud resource quantity risk component, resource node quantity risk component, and cloud resource interaction quantity risk component are added together to obtain the vulnerability risk value of the corresponding vulnerability, and the vulnerability risk values ​​are recorded according to the order of each vulnerability in the cloud security vulnerability association results; The vulnerability risk values ​​corresponding to each vulnerability are clustered in an ordered manner, and the vulnerability risk level of each cluster is determined according to the order of the vulnerability risk values ​​corresponding to each cluster center from small to large. The process for determining the vulnerability risk level is as follows: First, read the vulnerability risk value corresponding to each vulnerability and arrange them in ascending order of risk value. Second, select different vulnerability risk values ​​as initial cluster centers, calculate the numerical distance between each vulnerability risk value and each initial cluster center, assign each vulnerability risk value to the cluster with the smallest numerical distance, and update the corresponding cluster center based on the average value of the vulnerability risk values ​​in each cluster. Third, repeat the vulnerability risk value division and cluster center update until the cluster to which each vulnerability risk value belongs remains unchanged, resulting in multiple risk clusters. Fourth, arrange the risk clusters in ascending order of their corresponding cluster centers, determining the risk cluster with the smallest cluster center as the lowest vulnerability risk level, and the risk cluster with the largest cluster center as the highest vulnerability risk level. Then, determine the intermediate vulnerability risk levels according to the order of the remaining risk clusters. Finally, determine the vulnerability risk level of the corresponding risk cluster as the vulnerability risk level of the vulnerability corresponding to the vulnerability risk value. The vulnerability risk value and vulnerability risk level are written into the corresponding vulnerability detection record, and the vulnerability detection records are aggregated to generate network security vulnerability detection results.

[0029] A cloud-based network security vulnerability detection system includes: The data processing module is used to collect multi-source heterogeneous security data in the cloud computing environment and preprocess it to generate a cloud security standard dataset. The relational graph construction module is used to extract cloud resource information and cloud resource interaction relationships from the cloud security standard dataset and generate a cloud resource security relational graph. The vulnerability feature extraction module is used to perform multi-scale state slicing and state ridge tracing on the cloud security standard dataset, extract the abnormal propagation chain and corresponding vulnerability features, and generate a cloud resource vulnerability feature set. The vulnerability candidate generation module is used to perform vulnerability feature matching on the cloud resource vulnerability feature set and generate a cloud security vulnerability candidate set by combining the cloud resource security relationship graph. The vulnerability identification module is used to input the candidate set of cloud security vulnerabilities into the improved MTLPT model for task collaborative reasoning and generate cloud security vulnerability identification results. The vulnerability association analysis module is used to perform cascade instability simulation on cloud security vulnerability identification results, determine the cloud resources associated with the vulnerability, the vulnerability propagation path and the scope of the vulnerability's impact, and generate cloud security vulnerability association results. The risk detection module is used to calculate vulnerability risk values ​​based on cloud security vulnerability correlation results, determine vulnerability risk levels, and generate network security vulnerability detection results.

[0030] Example 1: Using a private cloud platform of an enterprise as an application scenario. The private cloud platform deploys cloud hosts, virtual machines, containers, databases, cloud storage, virtual network devices, and multiple cloud-based business systems. Communication, invocation, access, and dependencies exist between different cloud resources. Because some cloud resources are dynamically expanded, migrated, and redeployed based on business load, the interaction relationships between cloud resources are constantly changing. Traditional vulnerability detection methods mainly rely on matching ports, component versions, and vulnerability rules, which can identify some known vulnerabilities. However, for vulnerabilities caused by abnormal access, configuration discrepancies, and resource dependencies, problems easily arise such as scattered vulnerability features, inaccurate location of the corresponding cloud resources, and difficulty in determining the vulnerability propagation path.

[0031] In this scenario, multi-source heterogeneous security data is acquired through cloud platform resource management interfaces, configuration management interfaces, virtual network interfaces, operation monitoring components, and log collection components. This multi-source heterogeneous security data includes cloud resource asset data, cloud resource configuration data, cloud resource operation data, network traffic data, and security log data. Time alignment, field unification, duplicate data removal, and missing data completion are performed on the multi-source heterogeneous security data to generate a cloud security standard dataset. This embodiment continuously collects data for seven days, involving 486 cloud resources, resulting in approximately 13 million network session records, 8.2 million security log records, and 6.4 million cloud resource operation records.

[0032] Cloud resource information and interaction relationships are extracted from the cloud security standard dataset. Each cloud resource is set as a resource node, and the same communication, invocation, access, or dependency process is set as a relationship hyperedge. Based on the affiliation between resource nodes and relationship hyperedges and the corresponding hyperedge weights, heterogeneous hypergraph topology shaping is performed on the resource nodes and relationship hyperedges to generate a cloud resource security relationship graph. This embodiment generates 486 resource nodes and 1,927 relationship hyperedges, enabling interface gateways, application containers, databases, and cloud storage involved in a single business interaction to be associated through the same relationship hyperedge.

[0033] The cloud security standard dataset is sliced ​​into state segments at multiple scales, forming state segments of different time lengths, and the security state offset between adjacent state segments is calculated. Security state offsets with the same direction of change and continuous time are traced along the security state offset sequence to form state ridges, and continuous anomalous change segments are identified based on these ridges. During a detection process, the external access frequency of a certain application container continuously increases, while the number of calls to the database from the application container and the number of writes to cloud storage from the database also increase synchronously. Based on this, the system extracts the anomalous propagation chain consisting of the interface gateway, application container, database, and cloud storage, and generates a cloud resource vulnerability feature set based on the security state offset, propagation order, and propagation direction corresponding to each cloud resource.

[0034] The vulnerability feature set of cloud resources is compared field-by-field with the vulnerability feature benchmark set formed by historical vulnerability sample data to determine the vulnerability category corresponding to each vulnerability feature. The cloud resource association paths corresponding to each vulnerability feature are then retrieved from the cloud resource security relationship graph to generate a cloud security vulnerability candidate set. This candidate set is input into an improved MTLPT model to perform path compression and loop closure resolution on the cloud resource association paths, generating a vulnerability evidence context sequence. Vulnerability propagation flows are constructed based on the vulnerability features corresponding to adjacent resource nodes, and the Hodge decomposition mechanism is used to decompose these flows into gradient propagation flows, curl propagation flows, and harmonic propagation flows. Counterfactual perturbation is used to determine the task contribution of different propagation flows, and the vulnerability category identification results, vulnerability resource location results, and vulnerability confidence calculation results are output to generate the cloud security vulnerability identification results.

[0035] Based on the cloud security vulnerability identification results, the resource nodes of the corresponding cloud resources in the cloud resource security relationship graph are identified as the initial unstable resource nodes. The vulnerability confidence level is used as the instability value, and the instability value is propagated to the associated resource nodes according to the weight of the hyperedges in the relationship. Through multiple rounds of instability value propagation, a cascading instability result is formed, thereby determining the vulnerability propagation path, the cloud resources associated with the vulnerability, and the scope of the vulnerability's impact. Finally, based on the number of cloud resources corresponding to the vulnerability's associated cloud resources, the number of resource nodes covered by the vulnerability propagation path, and the number of cloud resource interaction relationships covered by the vulnerability's impact scope, the vulnerability risk value is calculated and the vulnerability risk level is determined, generating a network security vulnerability detection result.

[0036] To verify the detection effectiveness of this invention, under the same data conditions, the method of this invention was compared with traditional rule matching methods and ordinary relationship graph methods. The verification data included 120 manually reviewed vulnerability events, including component vulnerabilities, permission configuration vulnerabilities, abnormal access vulnerabilities, and cross-resource propagation vulnerabilities. The verification results are shown in Table 1.

[0037] Table 1 Comparison of Core Detection Results of Different Vulnerability Detection Methods

[0038] As shown in Table 1, in the verification data containing 120 vulnerability events, the rule matching method correctly identified 91 vulnerability events, the ordinary relationship graph method correctly identified 103 vulnerability events, and the method of this invention correctly identified 114 vulnerability events. The number of missed detections by the method of this invention is 6, which is 23 and 11 fewer than the rule matching method and the ordinary relationship graph method, respectively; the number of false positives is 7, which is 17 and 8 fewer than the rule matching method and the ordinary relationship graph method, respectively.

[0039] In terms of vulnerability identification, the method of this invention achieves an accuracy rate of 94.21%, which is higher than the 79.13% of the rule matching method and the 87.29% of the ordinary relationship graph method. This invention, through multi-scale state slicing and state ridge tracing of the cloud security standard dataset, can identify continuous abnormal change segments formed by continuous changes in security status. Furthermore, it preserves the transmission relationship of anomalies between different cloud resources through anomaly propagation chains, thereby reducing missed detections and false alarms caused by relying solely on port, component version, or single anomaly data for vulnerability judgment.

[0040] In terms of cloud resource location, the method of this invention achieves a cloud resource location accuracy of 95.83%, which is higher than the 72.50% of the rule matching method and the 86.67% of the ordinary relationship graph method. This invention records resource nodes, relationship hyperedges, and cloud resource association paths through a cloud resource security relationship graph, and associates vulnerability feature matching results with corresponding cloud resources, enabling the detection results to locate specific cloud resources and reducing the location deviation caused when multiple cloud resources have similar vulnerability features.

[0041] In terms of vulnerability propagation path identification, the method of this invention achieves an accuracy rate of 92.50%, which is higher than the 48.33% of the rule matching method and the 78.33% of the ordinary relationship graph method. This invention decomposes the vulnerability propagation flow into gradient propagation flow, curl propagation flow, and harmonic propagation flow through Hodge decomposition, and records the transmission relationship of instability values ​​between resource nodes through cascaded instability deduction. This determines the vulnerability propagation path, the cloud resources associated with the vulnerability, and the scope of the vulnerability's impact, enabling the vulnerability detection results to reflect the propagation process of the vulnerability among cloud resources.

[0042] The above are merely preferred embodiments of the present invention, but the scope of protection of the present invention is not limited thereto. Any equivalent substitutions or modifications made by those skilled in the art within the scope of the technology disclosed in the present invention, based on the technical solution and inventive concept of the present invention, should be covered within the scope of protection of the present invention.

Claims

1. A network security vulnerability detection method based on cloud security, characterized in that, Includes the following steps: Collect and preprocess multi-source heterogeneous security data from cloud computing environments to generate cloud security standard datasets; Cloud resource information and cloud resource interaction relationships are extracted from the cloud security standard dataset. The cloud resources corresponding to the cloud resource information are used as resource nodes, and the cloud resource interaction relationships are used as relationship hyperedges. Heterogeneous hypergraph topology shaping is performed on the resource nodes and relationship hyperedges to generate a cloud resource security relationship graph. Multi-scale state slicing is performed on the cloud security standard dataset, the security state offset between adjacent state slices is calculated, state ridge tracing is used to identify continuous abnormal change segments, and abnormal transmission chains and corresponding vulnerability features between cloud resources are extracted along the continuous abnormal change segments to generate a cloud resource vulnerability feature set. Vulnerability feature matching is performed on the cloud resource vulnerability feature set, and the cloud resources and their relationships are determined based on the cloud resource security relationship graph to generate a cloud security vulnerability candidate set. The candidate set of cloud security vulnerabilities is input into the improved MTLPT model for task collaborative reasoning to generate cloud security vulnerability identification results. Cascaded instability simulation is performed on the cloud security vulnerability identification results to determine the cloud resources associated with the vulnerability, the vulnerability propagation path, and the scope of the vulnerability's impact, and to generate cloud security vulnerability association results. The vulnerability risk value is calculated based on the cloud security vulnerability correlation results, and the vulnerability risk level is determined based on the vulnerability risk value to generate network security vulnerability detection results.

2. The image quality improvement method based on a liquid crystal microlens array according to claim 1, characterized in that, The multi-source heterogeneous security data includes cloud resource asset data, cloud resource configuration data, cloud resource operation data, network traffic data, and security log data. The preprocessing includes time alignment, field unification, duplicate data removal, and missing data completion.

3. The network security vulnerability detection method based on cloud security according to claim 1, characterized in that, The generation of the cloud resource security relationship graph specifically includes: Extract cloud resource information from the cloud security standard dataset, set the cloud resources corresponding to the cloud resource information as resource nodes, and generate a set of resource nodes. Extract cloud resource interaction relationships from the cloud security standard dataset, connect resource nodes participating in the same interaction process into relationship hyperedges, and generate a set of relationship hyperedges; Based on the set of resource nodes and the set of relational hyperedges, the attribution relationship between each resource node and each relational hyperedge is determined, and the association status between each resource node and each relational hyperedge is recorded according to the attribution relationship, generating a node-hyperedge association matrix; Based on the node hyperedge association matrix, the number of interactions, duration of interactions, and number of connected resource nodes corresponding to each relation hyperedge are counted and normalized to obtain the hyperedge weights corresponding to each relation hyperedge, and a hyperedge weight set is generated. Based on the resource node set, relation hyperedge set, node hyperedge association matrix, and hyperedge weight set, heterogeneous hypergraph topology shaping is performed on resource nodes and relation hyperedges to generate a cloud resource security relation graph.

4. The network security vulnerability detection method based on cloud security according to claim 1, characterized in that, The generation of the cloud resource vulnerability feature set specifically includes: The cloud security standard dataset is continuously divided to generate a multi-scale state slice sequence. The safe state data corresponding to each state slice is extracted from the multi-scale state slice sequence, and the difference is calculated to obtain the safe state offset, thus generating a safe state offset sequence. The direction of change of the safety state offset is tracked along the time sequence of the safety state offset sequence. Safety state offsets with the same direction of change and continuous time are connected to form a state ridge. The continuous abnormal change segment is determined according to the starting state slice and ending state slice corresponding to the state ridge. Extract cloud resource interaction relationships within continuously abnormal change segments from the cloud security standard dataset, connect the corresponding cloud resources according to the occurrence time and interaction direction of the cloud resource interaction relationships, and associate the state ridge lines with the corresponding cloud resources after connection to generate an anomaly propagation chain; The security state offset, transmission order, and transmission direction of each cloud resource are determined along the anomaly transmission chain. The security state offset is used as the degree of anomaly change of each cloud resource, and the transmission order and transmission direction are used as the transmission relationship of anomaly change between cloud resources. The degree of anomaly change and the transmission relationship are combined into the vulnerability features of each cloud resource to generate a cloud resource vulnerability feature set.

5. The network security vulnerability detection method based on cloud security according to claim 1, characterized in that, The generation of the cloud security vulnerability candidate set specifically includes: Obtain historical vulnerability sample data, extract vulnerability features corresponding to each vulnerability category from the historical vulnerability sample data, and generate a vulnerability feature baseline set; Each vulnerability feature in the cloud resource vulnerability feature set is compared field by field with each vulnerability feature in the vulnerability feature benchmark set to generate a vulnerability feature comparison result set. Based on the vulnerability feature comparison result set, generate vulnerability feature matching results; Based on the vulnerability feature matching results, determine the cloud resources corresponding to each vulnerability feature, and retrieve the cloud resource association path corresponding to the cloud resource in the cloud resource security relationship graph to generate cloud resource association results; The cloud resource association results are written into the same vulnerability candidate record, and the vulnerability candidate records are aggregated to generate a cloud security vulnerability candidate set.

6. The network security vulnerability detection method based on cloud security according to claim 1, characterized in that, The generation of the cloud security vulnerability identification results specifically includes: The improved MTLPT model inputs a cloud security vulnerability candidate set into a task-based collaborative reasoning model. This improved model includes a vulnerability evidence context folding module, a hyperedge propagation state injection module, a cross-task causal collaborative reasoning module, and a task imbalance self-calibration module. The improvements are as follows: the traditional MTLPT model extracts input sequence features using a lightweight Transformer and employs multi-task learning to predict vulnerability categories and output related tasks. The improved MTLPT model, however, performs path compression and loop closure resolution on vulnerability features and cloud resource association paths in the cloud security vulnerability candidate set to form a vulnerability evidence context sequence. A Hodge decomposition mechanism is introduced to separate the vulnerability propagation flow into gradient propagation flow, curl propagation flow, and harmonic propagation flow. Counterfactual perturbation is used to determine the task contribution of each propagation flow to different tasks. Based on the vulnerability confidence calculation results, task weights are calibrated for the vulnerability category identification results and vulnerability resource location results to generate cloud security vulnerability identification results. In the vulnerability evidence context folding module, based on the cloud resource association paths corresponding to each vulnerability feature in the cloud security vulnerability candidate set, the corresponding vulnerability features are arranged according to the cloud resource arrangement order in the cloud resource association path. The cloud resource association paths with the same cloud resources are compressed, the duplicate cloud resources in the cloud resource association path are looped and eliminated, and the corresponding vulnerability features are folded according to the cloud resource arrangement order after path compression to generate a vulnerability evidence context sequence. In the hyperedge propagation state injection module, the resource nodes corresponding to the vulnerability evidence context sequence are determined based on the cloud resource security relationship graph, and the vulnerability propagation flow is constructed according to the vulnerability feature differences of adjacent resource nodes. The Hodge decomposition mechanism is used to decompose the vulnerability propagation flow into gradient propagation flow, curl propagation flow and harmonic propagation flow, and write them into the vulnerability evidence context sequence to generate the hyperedge propagation state sequence. In the cross-task causal collaborative reasoning module, the hyperedge propagation state sequence is input into the lightweight Transformer, and counterfactual perturbations are performed on the gradient propagation flow, curl propagation flow, and harmonic propagation flow respectively. The differences in task output before and after the perturbation are compared to determine the task contribution of each propagation flow. Based on the task contribution, the vulnerability category identification result, vulnerability resource location result, and vulnerability confidence calculation result are obtained to generate the task reasoning result. In the task imbalance self-calibration module, the task weights of the vulnerability category identification results and vulnerability resource location results are adjusted based on the vulnerability confidence calculation results in the task inference results, and calibration is performed to generate cloud security vulnerability identification results.

7. The network security vulnerability detection method based on cloud security according to claim 1, characterized in that, The generation of the cloud security vulnerability association results specifically includes: Extract vulnerability category, corresponding cloud resource and vulnerability confidence from cloud security vulnerability identification results. Locate the resource node corresponding to the cloud resource in the cloud resource security relationship graph. Determine the resource node as the initial unstable resource node. Determine the vulnerability confidence as the unstable value. Generate initial unstable result. Based on the initial instability results, determine the relational hyperedge to which the initially unstable resource node belongs and the resource nodes connected by the relational hyperedge. Based on the corresponding hyperedge weight, the instability value is passed to the resource node, and the passing relationship is recorded to generate the instability passing result. The resource node that receives the instability value in the instability propagation result is determined as the current instability resource node. The instability value is repeatedly propagated according to the weight of the hyperedge of the relationship hyperedge to which the current instability resource node belongs, generating a cascaded instability result. Connect the corresponding resource nodes based on the transmission relationship in the cascading instability results, generate the vulnerability propagation path, determine the cloud resources corresponding to the resource nodes covered by the vulnerability propagation path as the vulnerability-associated cloud resources, and determine the interaction relationship of the cloud resources covered by the vulnerability propagation path as the vulnerability impact range. The vulnerability is associated with cloud resources, the vulnerability propagation path, and the scope of the vulnerability's impact to generate cloud security vulnerability association results.

8. The network security vulnerability detection method based on cloud security according to claim 1, characterized in that, The generation of the network security vulnerability detection results specifically includes: Based on the cloud security vulnerability association results, the number of cloud resources corresponding to the vulnerability-associated cloud resources, the number of resource nodes covered by the vulnerability propagation path, and the number of cloud resource interaction relationships covered by the vulnerability impact scope are counted to generate a vulnerability risk parameter set. The vulnerability risk parameter set is normalized to generate a standardized vulnerability risk parameter set, and the corresponding risk weights are determined to generate a vulnerability risk weight set. Based on the vulnerability risk weight set, generate the vulnerability risk value corresponding to each vulnerability; The vulnerability risk values ​​corresponding to each vulnerability are clustered in an ordered manner, and the vulnerability risk level of each cluster is determined according to the order of the vulnerability risk values ​​corresponding to each cluster center from small to large. The vulnerability risk value and vulnerability risk level are written into the corresponding vulnerability detection record, and the vulnerability detection records are aggregated to generate network security vulnerability detection results.

9. A cloud-based network security vulnerability detection system, comprising executing the cloud-based network security vulnerability detection method according to any one of claims 1 to 8, characterized in that, include: The data processing module is used to collect multi-source heterogeneous security data in the cloud computing environment and preprocess it to generate a cloud security standard dataset. The relational graph construction module is used to extract cloud resource information and cloud resource interaction relationships from the cloud security standard dataset and generate a cloud resource security relational graph. The vulnerability feature extraction module is used to perform multi-scale state slicing and state ridge tracing on the cloud security standard dataset, extract the abnormal propagation chain and corresponding vulnerability features, and generate a cloud resource vulnerability feature set. The vulnerability candidate generation module is used to perform vulnerability feature matching on the cloud resource vulnerability feature set and generate a cloud security vulnerability candidate set by combining the cloud resource security relationship graph. The vulnerability identification module is used to input the candidate set of cloud security vulnerabilities into the improved MTLPT model for task collaborative reasoning and generate cloud security vulnerability identification results. The vulnerability association analysis module is used to perform cascade instability simulation on cloud security vulnerability identification results, determine the cloud resources associated with the vulnerability, the vulnerability propagation path and the scope of the vulnerability's impact, and generate cloud security vulnerability association results. The risk detection module is used to calculate vulnerability risk values ​​based on cloud security vulnerability correlation results, determine vulnerability risk levels, and generate network security vulnerability detection results.

Images