Network and content security method and system for cloud-network integration

Abstract

The present invention provides a network and content security method and system for cloud-network integration, which collects the traffic of cloud services and network services in real time, splits the data into data segments after data association, finds possible abnormal data segments, and allocates edge computing pairs on the cloud to perform grayscale image feature matching and word component matching on the abnormal data segments respectively. The optimal attack propagation route is calculated based on the matching results, the source point and path point information is obtained, the source point relationship model is established and trained, and the model-based continuous monitoring of the source point is realized, which solves the problem that the existing cloud-network integration requires integrated monitoring and control.

Description

Technical Field

[0001] The present application relates to the field of network security technology, and in particular to a network and content security method and system for cloud-network integration. Background Art

[0002] Cloud-network integration has connected the original independent security architectures of cloud, network, edge, and end, and is one of the current development directions of cloud computing. Function deployment and resource management are vertically sunk to the network layer for unified scheduling and control. However, security risks in the process of data storage, cloud computing, and network transmission need to be monitored and controlled in an integrated manner.

[0003] Therefore, there is an urgent need for a targeted cloud-network integrated network and content security method and system. Summary of the invention

[0004] The purpose of the present invention is to provide a network and content security method and system for cloud-network integration to solve the problem that the existing cloud-network integration requires integrated monitoring and control.

[0005] In a first aspect, the present application provides a network and content security method for cloud-network integration, the method comprising:

[0006] Collect the traffic of cloud services and network services in real time, and perform in-depth data association on the collected traffic from two dimensions: time series and spatial connection;

[0007] Splitting the traffic after data association into a plurality of data segments, storing the data segments in a container array according to the service identifier or user identifier to which the service belongs, analyzing the data segments using a logical analysis model, finding abnormal data segments that may exist therein, sending the abnormal data segments to the cloud for matching, and the cloud specifies an edge computing pair to perform a matching operation according to the metadata and load conditions of the abnormal data segments, wherein the edge computing pair includes two edge computing units;

[0008] An edge computing unit in the edge computing pair discretizes the abnormal data segment, samples it according to time domain continuity, converts it to obtain a grayscale image, extracts image features of the grayscale image, matches the image features with reference features stored in a cloud database, and obtains a first matching result;

[0009] Another edge computing unit in the edge computing pair extracts a sentence from the abnormal data segment, inputs the sentence into a syntactic model, performs preliminary sentence segmentation to obtain word components, and matches the word components with keywords stored in a cloud database to obtain a second matching result;

[0010] The first matching result and the second matching result are combined to perform a scheduling operation, a scheduling calculation function and a state chain model, and a probability density parameter is introduced to obtain a conditional probability formula of the abnormal data fragment to propagate the attack, and the conditional probability formula is calculated through a neural network model to calculate the optimal attack propagation route; the synthesis at least includes performing an XOR operation on the first matching result and the second matching result, or accumulating the first matching result and the second matching result in proportion;

[0011] According to the optimal attack propagation route, information of the source point and the path point is obtained, network behaviors of the source point and the path point are simulated according to the recorded network parameters, characteristic attributes are extracted therefrom, and a source point relationship model is established and trained;

[0012] The source point relationship model includes the business, users and corresponding weight values ​​involved in the source point, regularly collects the business information, user identity and operation of the source point, and trains the source point relationship model according to the set weight values;

[0013] Acquire new services or new users logging into the source point, continuously monitor the service trends or user operations of the source point, input the source point relationship model, and determine whether the service trends or user operations will trigger an exception;

[0014] Upload the above judgment results to the cloud.

[0015] In a second aspect, the present application provides a network and content security system that integrates cloud and network, the system comprising:

[0016] A collection unit, used to collect the traffic of cloud services and network services in real time, and perform in-depth data association on the collected traffic from two dimensions: time series and spatial connection;

[0017] An analysis unit is used to split the traffic after the data association into a plurality of data fragments, store the data fragments in a container array according to the business identifier or user identifier of the service, analyze the data fragments using a logical analysis model, find abnormal data fragments that may exist therein, and send the abnormal data fragments to the cloud for matching. The cloud specifies an edge computing pair to perform a matching operation according to the metadata and load conditions of the abnormal data fragments, and the edge computing pair includes two edge computing units;

[0018] A first edge computing unit, which belongs to one edge computing unit in the edge computing pair, is used to discretize the abnormal data segment, sample it according to time domain continuity, convert it to obtain a grayscale image, extract image features of the grayscale image, match the image features with reference features stored in a cloud database, and obtain a first matching result;

[0019] a second edge computing unit, which belongs to another edge computing unit in the edge computing pair, and is used to extract a sentence from the abnormal data segment, input the sentence into a syntactic model, perform preliminary sentence segmentation, obtain word components, and match the word components with keywords stored in a cloud database to obtain a second matching result;

[0020] A comprehensive scheduling unit is used to perform a scheduling operation by comprehensively analyzing the first matching result and the second matching result, a scheduling calculation function and a state chain model, introduce a probability density parameter, obtain a conditional probability formula of the abnormal data fragment to propagate the attack, calculate the conditional probability formula through a neural network model, and calculate the optimal attack propagation route; the synthesis at least includes performing an XOR operation on the first matching result and the second matching result, or accumulating the first matching result and the second matching result in proportion;

[0021] A model building unit is used to obtain information about source points and pathway points according to the optimal attack propagation route, simulate the network behaviors of the source points and pathway points according to the recorded network parameters, extract characteristic attributes therefrom, and build and train a source point relationship model; wherein the source point relationship model includes the business, users and corresponding weight values ​​involved in the source point, regularly collects the business information, user identity and operation of the source point, and trains the source point relationship model according to the set weight values;

[0022] The monitoring unit is used to obtain new services or new users logging into the source point, continuously monitor the business trends or user operations of the source point, input the source point relationship model, and determine whether the business trends or user operations will trigger an exception; upload the results of the above judgment to the cloud.

[0023] In a third aspect, the present application provides a network and content security system that integrates cloud and network, the system comprising a processor and a memory:

[0024] The memory is used to store program code and transmit the program code to the processor;

[0025] The processor is used to execute any one of the four possible methods of the first aspect according to the instructions in the program code.

[0026] In a fourth aspect, the present application provides a computer-readable storage medium, wherein the computer-readable storage medium is used to store program code, and the program code is used to execute any one of the four possible methods in the first aspect.

[0027] Beneficial Effects

[0028] The present invention provides a network and content security method and system for cloud-network integration, which collects the traffic of cloud services and network services in real time, splits the data into data segments after data association, finds possible abnormal data segments, and allocates edge computing pairs on the cloud to perform grayscale image feature matching and word component matching on the abnormal data segments respectively. The optimal attack propagation route is calculated based on the matching results, the source point and path point information is obtained, the source point relationship model is established and trained, and the model-based continuous monitoring of the source point is realized, which solves the problem that the existing cloud-network integration requires integrated monitoring and control. BRIEF DESCRIPTION OF THE DRAWINGS

[0029] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the drawings required for use in the embodiments are briefly introduced below. Obviously, for ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0030] Figure 1 A general flow chart of the network and content security method for cloud-network integration of the present invention;

[0031] Figure 2 This is an architecture diagram of the network and content security system of the cloud-network integration of the present invention. DETAILED DESCRIPTION

[0032] The preferred embodiments of the present invention are described in detail below in conjunction with the accompanying drawings so that the advantages and features of the present invention can be more easily understood by those skilled in the art, thereby making a clearer and more definite definition of the protection scope of the present invention.

[0033] Figure 1 A general flow chart of the network and content security method for cloud-network integration provided in this application, the method comprising:

[0034] Collect the traffic of cloud services and network services in real time, and perform in-depth data association on the collected traffic from two dimensions: time series and spatial connection;

[0035] Splitting the traffic after data association into a plurality of data segments, storing the data segments in a container array according to the service identifier or user identifier to which the service belongs, analyzing the data segments using a logical analysis model, finding abnormal data segments that may exist therein, sending the abnormal data segments to the cloud for matching, and the cloud specifies an edge computing pair to perform a matching operation according to the metadata and load conditions of the abnormal data segments, wherein the edge computing pair includes two edge computing units;

[0036] An edge computing unit in the edge computing pair discretizes the abnormal data segment, samples it according to time domain continuity, converts it to obtain a grayscale image, extracts image features of the grayscale image, matches the image features with reference features stored in a cloud database, and obtains a first matching result;

[0037] Another edge computing unit in the edge computing pair extracts a sentence from the abnormal data segment, inputs the sentence into a syntactic model, performs preliminary sentence segmentation to obtain word components, and matches the word components with keywords stored in a cloud database to obtain a second matching result;

[0038] The first matching result and the second matching result are combined to perform a scheduling operation, a scheduling calculation function and a state chain model, and a probability density parameter is introduced to obtain a conditional probability formula of the abnormal data fragment to propagate the attack, and the conditional probability formula is calculated through a neural network model to calculate the optimal attack propagation route; the synthesis at least includes performing an XOR operation on the first matching result and the second matching result, or accumulating the first matching result and the second matching result in proportion;

[0039] According to the optimal attack propagation route, information of the source point and the path point is obtained, network behaviors of the source point and the path point are simulated according to the recorded network parameters, characteristic attributes are extracted therefrom, and a source point relationship model is established and trained;

[0040] The source point relationship model includes the business, users and corresponding weight values ​​involved in the source point, regularly collects the business information, user identity and operation of the source point, and trains the source point relationship model according to the set weight values;

[0041] Acquire new services or new users logging into the source point, continuously monitor the service trends or user operations of the source point, input the source point relationship model, and determine whether the service trends or user operations will trigger an exception;

[0042] Upload the above judgment results to the cloud.

[0043] In some preferred embodiments, when it is determined that the business trend or user operation will trigger an exception, the business or user is marked and all access behaviors of the business or user are denied.

[0044] In some preferred embodiments, the searching for possible abnormal data segments includes: judging in combination with the previous and next data segments of the current data segment, and when the business of the current data segment has no correlation with the business of the previous data segment or the next data segment, it is determined that the current data segment is abnormal.

[0045] In some preferred embodiments, the deep data association includes: performing deep data association on the collected traffic from two dimensions: time series and spatial connection, establishing a rule base, comparing the source point information of the suspected attack with the information in the rule base, and constructing a traceability graph through propagation query and tracing query.

[0046] Figure 2 The architecture diagram of the cloud-network integrated network and content security system provided in this application includes:

[0047] A collection unit, used to collect the traffic of cloud services and network services in real time, and perform in-depth data association on the collected traffic from two dimensions: time series and spatial connection;

[0048] An analysis unit is used to split the traffic after the data association into a plurality of data fragments, store the data fragments in a container array according to the business identifier or user identifier of the service, analyze the data fragments using a logical analysis model, find abnormal data fragments that may exist therein, and send the abnormal data fragments to the cloud for matching. The cloud specifies an edge computing pair to perform a matching operation according to the metadata and load conditions of the abnormal data fragments, and the edge computing pair includes two edge computing units;

[0049] A first edge computing unit, which belongs to one edge computing unit in the edge computing pair, is used to discretize the abnormal data segment, sample it according to time domain continuity, convert it to obtain a grayscale image, extract image features of the grayscale image, match the image features with reference features stored in a cloud database, and obtain a first matching result;

[0050] a second edge computing unit, which belongs to another edge computing unit in the edge computing pair, and is used to extract a sentence from the abnormal data segment, input the sentence into a syntactic model, perform preliminary sentence segmentation, obtain word components, and match the word components with keywords stored in a cloud database to obtain a second matching result;

[0051] A comprehensive scheduling unit is used to perform a scheduling operation by comprehensively analyzing the first matching result and the second matching result, a scheduling calculation function and a state chain model, introduce a probability density parameter, obtain a conditional probability formula of the abnormal data fragment to propagate the attack, calculate the conditional probability formula through a neural network model, and calculate the optimal attack propagation route; the synthesis at least includes performing an XOR operation on the first matching result and the second matching result, or accumulating the first matching result and the second matching result in proportion;

[0052] A model building unit is used to obtain information about source points and pathway points according to the optimal attack propagation route, simulate the network behaviors of the source points and pathway points according to the recorded network parameters, extract characteristic attributes therefrom, and build and train a source point relationship model; wherein the source point relationship model includes the business, users and corresponding weight values ​​involved in the source point, regularly collects the business information, user identity and operation of the source point, and trains the source point relationship model according to the set weight values;

[0053] The monitoring unit is used to obtain new services or new users logging into the source point, continuously monitor the business trends or user operations of the source point, input the source point relationship model, and determine whether the business trends or user operations will trigger an exception; upload the results of the above judgment to the cloud.

[0054] The present application provides a network and content security system that integrates cloud and network, the system comprising: the system comprising a processor and a memory:

[0055] The memory is used to store program code and transmit the program code to the processor;

[0056] The processor is used to execute the method described in any one of all embodiments of the first aspect according to the instructions in the program code.

[0057] The present application provides a computer-readable storage medium, wherein the computer-readable storage medium is used to store program code, and the program code is used to execute the method described in any one of the embodiments of the first aspect.

[0058] In a specific implementation, the present invention further provides a computer storage medium, wherein the computer storage medium may store a program, and when the program is executed, the program may include some or all of the steps in each embodiment of the present invention. The storage medium may be a disk, an optical disk, a read-only storage memory (abbreviated as: ROM) or a random access memory (abbreviated as: RAM), etc.

[0059] Those skilled in the art can clearly understand that the technology in the embodiments of the present invention can be implemented by means of software plus a necessary general hardware platform. Based on this understanding, the technical solution in the embodiments of the present invention is essentially or the part that contributes to the prior art can be embodied in the form of a software product, which can be stored in a storage medium such as ROM / RAM, a disk, an optical disk, etc., and includes several instructions for enabling a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in each embodiment of the present invention or some parts of the embodiments.

[0060] The same and similar parts between the various embodiments of this specification can be referred to each other. In particular, for the embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the description in the method embodiment.

[0061] The above-described embodiments of the present invention do not limit the protection scope of the present invention.

Claims

1. A network and content security method for cloud-network integration, characterized in that: The method comprises: Collect the traffic of cloud services and network services in real time, and perform in-depth data association on the collected traffic from two dimensions: time series and spatial connection; Splitting the traffic after data association into a plurality of data segments, storing the data segments in a container array according to the service identifier or user identifier to which the service belongs, analyzing the data segments using a logical analysis model, finding abnormal data segments that may exist therein, sending the abnormal data segments to the cloud for matching, and the cloud specifies an edge computing pair to perform a matching operation according to the metadata and load conditions of the abnormal data segments, wherein the edge computing pair includes two edge computing units; An edge computing unit in the edge computing pair discretizes the abnormal data segment, samples it according to time domain continuity, converts it to obtain a grayscale image, extracts image features of the grayscale image, matches the image features with reference features stored in a cloud database, and obtains a first matching result; Another edge computing unit in the edge computing pair extracts a sentence from the abnormal data segment, inputs the sentence into a syntactic model, performs preliminary sentence segmentation to obtain word components, and matches the word components with keywords stored in a cloud database to obtain a second matching result; The first matching result and the second matching result are combined to perform a scheduling operation, a scheduling calculation function and a state chain model, and a probability density parameter is introduced to obtain a conditional probability formula of the abnormal data fragment to propagate the attack, and the conditional probability formula is calculated through a neural network model to calculate the optimal attack propagation route; the synthesis at least includes performing an XOR operation on the first matching result and the second matching result, or accumulating the first matching result and the second matching result in proportion; According to the optimal attack propagation route, information of the source point and the path point is obtained, network behaviors of the source point and the path point are simulated according to the recorded network parameters, characteristic attributes are extracted therefrom, and a source point relationship model is established and trained; The source point relationship model includes the business, users and corresponding weight values ​​involved in the source point, regularly collects the business information, user identity and operation of the source point, and trains the source point relationship model according to the set weight values; Acquire new services or new users logging into the source point, continuously monitor the service trends or user operations of the source point, input the source point relationship model, and determine whether the service trends or user operations will trigger an exception; Upload the above judgment results to the cloud.

2. The method according to claim 1, characterized in that: When it is determined that the business trend or user operation will trigger an exception, the business or user is marked and all access behaviors of the business or user are denied.

3. The method according to claim 1, characterized in that: The searching for possible abnormal data segments includes: judging in combination with the previous and next data segments of the current data segment, and when the business of the current data segment has no correlation with the business of the previous data segment or the next data segment, determining that the current data segment is abnormal.

4. The method according to any one of claims 2 or 3, characterized in that: The deep data association includes: performing deep data association on the collected traffic from two dimensions: time series and spatial connection, establishing a rule base, comparing the source point information of the suspected attack with the information in the rule base, and constructing a traceability graph through propagation query and tracing query.

5. A cloud-network integrated network and content security system, characterized in that: The system comprises: A collection unit, used to collect the traffic of cloud services and network services in real time, and perform in-depth data association on the collected traffic from two dimensions: time series and spatial connection; An analysis unit is used to split the traffic after the data association into a plurality of data fragments, store the data fragments in a container array according to the business identifier or user identifier of the service, analyze the data fragments using a logical analysis model, find abnormal data fragments that may exist therein, and send the abnormal data fragments to the cloud for matching. The cloud specifies an edge computing pair to perform a matching operation according to the metadata and load conditions of the abnormal data fragments, and the edge computing pair includes two edge computing units; A first edge computing unit, which belongs to one edge computing unit in the edge computing pair, is used to discretize the abnormal data segment, sample it according to time domain continuity, convert it to obtain a grayscale image, extract image features of the grayscale image, match the image features with reference features stored in a cloud database, and obtain a first matching result; a second edge computing unit, which belongs to another edge computing unit in the edge computing pair, and is used to extract a sentence from the abnormal data segment, input the sentence into a syntactic model, perform preliminary sentence segmentation, obtain word components, and match the word components with keywords stored in a cloud database to obtain a second matching result; A comprehensive scheduling unit is used to perform a scheduling operation by comprehensively analyzing the first matching result and the second matching result, a scheduling calculation function and a state chain model, introduce a probability density parameter, obtain a conditional probability formula of the abnormal data fragment to propagate the attack, calculate the conditional probability formula through a neural network model, and calculate the optimal attack propagation route; the synthesis at least includes performing an XOR operation on the first matching result and the second matching result, or accumulating the first matching result and the second matching result in proportion; A model building unit is used to obtain information about source points and pathway points according to the optimal attack propagation route, simulate the network behaviors of the source points and pathway points according to the recorded network parameters, extract characteristic attributes therefrom, and build and train a source point relationship model; wherein the source point relationship model includes the business, users and corresponding weight values ​​involved in the source point, regularly collects the business information, user identity and operation of the source point, and trains the source point relationship model according to the set weight values; The monitoring unit is used to obtain new services or new users logging into the source point, continuously monitor the business trends or user operations of the source point, input the source point relationship model, and determine whether the business trends or user operations will trigger an exception; upload the results of the above judgment to the cloud.

6. A cloud-network integrated network and content security system, characterized in that: The system comprises a processor and a memory: The memory is used to store program code and transmit the program code to the processor; The processor is used to execute the method according to any one of claims 1 to 4 according to the instructions in the program code.

7. A computer-readable storage medium, characterized in that: The computer-readable storage medium is used to store program codes, and the program codes are used to execute the method according to any one of claims 1 to 4.

Images