Network security vulnerability detection method and system based on distributed cloud computing

Abstract

The present invention relates to the technical field of network security vulnerabilities, and specifically to a network security vulnerability detection method and system based on distributed cloud computing, comprising the following steps: S1, dynamic resource monitoring and configuration: real-time monitoring of resource usage in a distributed cloud computing environment; S2, security data collection and normalization processing: normalization of the collected data; S3, distributed threat detection model deployment: identifying potential security threats and vulnerabilities in the data; S4, real-time security event processing and environment perception recovery mechanism: developing a comprehensive security event processing mechanism; S5, vulnerability repair and defense strategy optimization: generating vulnerability repair solutions and optimized defense strategies; S6, continuous learning and model updating: continuously updating and optimizing threat detection models. The present invention strengthens resilience and effectiveness in the face of new and complex threats, and reduces the interference of security events on business operations.

Description

Technical Field

[0001] The present invention relates to the technical field of network security vulnerabilities, and in particular to a network security vulnerability detection method and system based on distributed cloud computing. Background Art

[0002] With the rapid development and widespread application of cloud computing technology, distributed cloud computing environment has become an indispensable part of the daily operations of enterprises and organizations. This environment is favored for its high flexibility, scalability and cost-effectiveness. However, it is accompanied by an increasing number of security threats, including data leakage, malicious attacks, system vulnerabilities, etc. These problems pose a serious threat to business continuity and data security.

[0003] In this context, the importance of network security vulnerability detection technology has become increasingly prominent. Traditional security detection methods often rely on static rule matching and known signature databases. These methods are powerless in the face of ever-changing attack methods and are unable to cope with the rapidly changing network environment and new security threats. In addition, traditional methods lack flexibility and adaptability in resource allocation and utilization, which often leads to waste of resources or inability to effectively respond to security incidents at critical moments due to insufficient resources. Summary of the invention

[0004] Based on the above objectives, the present invention provides a network security vulnerability detection method and system based on distributed cloud computing.

[0005] The network security vulnerability detection method based on distributed cloud computing includes the following steps:

[0006] S1, dynamic resource monitoring and configuration: real-time monitoring of resource usage in distributed cloud computing environments, and dynamic adjustment of resource configuration based on current security detection requirements;

[0007] S2, security data collection and normalization processing: collect various security-related data from the distributed cloud environment and normalize the collected data;

[0008] S3, distributed threat detection model deployment: deploy threat detection models in a distributed cloud computing environment to identify potential security threats and vulnerabilities in the data;

[0009] S4, Real-time security incident processing and environment-aware recovery mechanism: Develop a comprehensive security incident processing mechanism. While analyzing and identifying security incidents in real time, the security incident processing mechanism automatically performs resource isolation and recovery operations based on the specific conditions of the distributed cloud environment, integrating real-time analysis, rapid response, resource isolation, and intelligent recovery.

[0010] S5, vulnerability repair and defense strategy optimization: Generate vulnerability repair solutions and optimized defense strategies based on security incident analysis results, and automatically apply defense strategies to distributed cloud environments;

[0011] S6, Continuous Learning and Model Update: Adopt a continuous learning mechanism to continuously update and optimize the threat detection model based on new security threats and vulnerability information.

[0012] Furthermore, the dynamic resource monitoring and configuration in S1 includes:

[0013] S11, Real-time monitoring: Deploy a real-time monitoring solution to continuously track and evaluate resource usage in a distributed cloud computing environment, including computing power, storage space, and network bandwidth;

[0014] S12, data analysis: by analyzing the monitored data, the usage status and performance indicators of various resources are evaluated in real time, and predefined thresholds are used to identify abnormal patterns or potential bottlenecks in resource usage;

[0015] S13, security requirements identification: Combined with the current security detection task requirements, evaluate the required resource configuration, including the complexity of the computing task, the requirements for data processing and analysis, and the requirements for network communication;

[0016] S14, resource optimization and adjustment: Based on the evaluation results, automatically adjust resource configuration to meet the needs of security detection, including increasing or decreasing computing resource allocation, expanding or compressing storage capacity, and optimizing network bandwidth usage.

[0017] Furthermore, the security data collection and normalization processing in S2 includes:

[0018] S21, data collection: deploying data collection agents on various nodes in the distributed cloud computing environment to collect security-related data in real time, the security-related data including log files, network traffic data and operation call information, wherein the log files include operation logs, application logs and security event logs, the network traffic data includes the source address, destination address, transmission protocol and size information of the network packet, and the operation call information includes access requests to resources, commands executed by users and calls to applications;

[0019] S22, data normalization processing: convert the collected heterogeneous data into a unified format to eliminate the differences between different data sources. For normalized numerical data, the Min-Max normalization method is used, and the calculation formula is:

[0020] Where x is the original data, min(x) and max(x) are the minimum and maximum values ​​of the original data type in all collected data, and x′ is the normalized data.

[0021] Furthermore, the threat detection model in S3 adopts a contrastive learning model, which captures complex attack patterns and identifies abnormal behaviors through dynamic negative sample selection, time correlation encoding, and multimodal feature fusion. The model is expressed as:

[0022]

[0023] in, represents the contrast loss at time step t, x t is the input data at time step t, is with x t Positive data at the same time step, is a dynamically selected negative data set at time step t, f(·) is the encoder function, sim(u,v) is a similarity function between two feature vectors u and v, using cosine similarity, and τ is a temperature parameter.

[0024] Furthermore, the real-time security event processing and environment perception recovery mechanism in S4 includes:

[0025] S41, Intelligent Event Identification: Analyzes collected data in real time, automatically identifies signs of security incidents, and distinguishes normal operations from abnormal behaviors;

[0026] S42, Dynamic Resource Isolation: If a potential security threat is detected, the resource isolation protocol is immediately triggered, and the scope and depth of isolation are dynamically adjusted according to the nature and severity of the incident;

[0027] S43, context-aware recovery: intelligently formulate and execute repair strategies by analyzing the context information and environmental dependencies of isolated resources;

[0028] S44, Strategy Optimization and Feedback: After responding to security incidents, collect feedback and optimize threat detection models and response strategies.

[0029] Furthermore, the intelligent event recognition in S41 includes:

[0030] S411, data collection: collect real-time operation data from each node in the distributed cloud environment. The real-time operation data includes network traffic, operation logs, user activities and application interactions;

[0031] S412, feature extraction: extract key features from the collected real-time operation data. The key features include request frequency, login attempts, and file access patterns. The key features are represented by F(x), where x is the original data point.

[0032] S413, Abnormal Behavior Modeling: Using Graph Neural Networks (GNN) to Model Normal Behavior normal , and updates in real time to capture behavioral changes;

[0033] S414, similarity calculation: use cosine similarity and other metrics to calculate the similarity between the real-time data features and the normal behavior model. The calculation formula is:

[0034] S415, threshold determination: set a threshold θ, compare the similarity score S(x) with θ to identify abnormal behavior, when S(x)<θ, the data point is marked as abnormal;

[0035] S416, Security Event Marking: Mark the data points identified as abnormal as potential security events and record detailed information for analysis.

[0036] Furthermore, the normal behavior model M normal include:

[0037] Space-time graph construction: Create a space-time graph G st =(V,E,T), where V represents the entities in the cloud environment, E represents the communication or data flow between entities, and T represents the time dimension;

[0038] Dynamic feature representation: Introducing dynamic feature vectors To represent the state of node v at time t;

[0039] Time-aware graph convolution: In order to capture the dynamic characteristics of time series data, a time-aware mechanism is added to the graph convolution. The calculation formula is:

[0040]

[0041] in, are the neighbors of node v at time t, is the feature representation of node u at time t-1, ReLU is the activation function, and AGGREGATEt is the aggregation function that takes time into account;

[0042] The time-considered aggregation function AGGREGATEt uses weighted average as the aggregation function, taking time decay into consideration, and is expressed as:

[0043] in, is the time decay weight, λ is the decay rate, t uv is the time of the last interaction between u and v;

[0044] Dynamic adjustment of edge weights: The edge weights are dynamically adjusted according to the time and intensity of the interactions between nodes. The calculation formula is:

[0045] Among them, f is the learning function, interaction uv is the interaction history and timing characteristics between nodes u and v;

[0046] Multi-scale feature learning: For each node in the graph, learn features at different time scales, expressed as:

[0047] in, represents the concatenation of features, T is the size of the time window;

[0048] Abnormal score calculation: In the last layer of the normal behavior model, the abnormal score is calculated by combining the spatiotemporal feature representation of the node:

[0049] Where g is the mapping function.

[0050] Furthermore, the vulnerability repair and defense strategy optimization in S5 include:

[0051] S51, Security Event Analysis: Automatically collect and analyze security event data in distributed cloud environments to identify event types and related vulnerabilities;

[0052] S52, vulnerability repair solution generation: for each identified vulnerability, automatically generate repair steps or patch application guide;

[0053] S53, defense strategy optimization: Based on the analysis results of security events and the current environment status, optimize the existing defense strategy, including adjusting security configuration, updating access control lists, and enhancing intrusion detection rules;

[0054] S54, automatic policy application: automatically deploying repair solutions and optimized defense policies to relevant components and nodes in the distributed cloud environment.

[0055] Furthermore, the continuous learning and model updating in S6 includes:

[0056] S61, Model Training and Fine-tuning: Incrementally train or fine-tune threat detection models using newly collected data;

[0057] S62, Model Evaluation and Validation: Evaluate the performance of the updated threat detection model through precision, recall, and F1 score;

[0058] S63, strategy update and deployment: Update the threat detection strategy based on the evaluation results of the threat detection model, and deploy the optimized threat detection model to the production environment.

[0059] The network security vulnerability detection system based on distributed cloud computing is used to implement the above-mentioned network security vulnerability detection method based on distributed cloud computing, and includes the following modules:

[0060] Dynamic resource monitoring and configuration module: responsible for real-time monitoring of resource usage in the distributed cloud computing environment. The dynamic resource monitoring and configuration module dynamically adjusts resource configuration according to current security detection requirements.

[0061] Security data collection and normalization processing module: collects various security-related data from the distributed cloud environment, and the collected data is normalized;

[0062] Distributed threat detection model deployment module: deploys threat detection models in a distributed cloud computing environment to identify potential security threats and vulnerabilities in the data;

[0063] Real-time security incident processing and environment-aware recovery module: Develop a comprehensive security incident processing mechanism that analyzes and identifies security incidents in real time and automatically performs resource isolation and recovery operations based on the specific conditions of the distributed cloud environment;

[0064] Vulnerability repair and defense strategy optimization module: Generate vulnerability repair solutions and optimized defense strategies based on security incident analysis results, and automatically apply defense strategies to distributed cloud environments;

[0065] Continuous learning and model update module: Adopts a continuous learning mechanism to continuously update and optimize threat detection models based on new security threats and vulnerability information.

[0066] Beneficial effects of the present invention:

[0067] The present invention, through the implementation of dynamic resource monitoring and configuration, security data collection and normalization processing, and distributed threat detection model deployment, can realize real-time monitoring and dynamic adjustment of resource usage in a distributed cloud computing environment, as well as effective collection and processing of various security-related data, thereby ensuring the accuracy and efficiency of security detection, improving the system's ability to detect potential security threats and vulnerabilities, while optimizing resource utilization efficiency and cost-effectiveness, and providing strong data support and resource guarantees for security detection tasks.

[0068] The present invention develops a comprehensive security incident handling mechanism by implementing real-time security incident handling and environment-aware recovery mechanisms, vulnerability repair and defense strategy optimization. This mechanism can not only automatically perform resource isolation and recovery operations while analyzing and identifying security incidents in real time, but can also generate targeted vulnerability repair solutions and optimized defense strategies based on the security incident analysis results, thereby ensuring the efficiency and effectiveness of the system in the face of security threats, enhancing the resilience and effectiveness of the entire system in the face of new and complex threats, and reducing the interference of security incidents on business operations.

[0069] The present invention adopts a continuous learning mechanism through continuous learning and model updating, and continuously updates and optimizes the threat detection model according to new security threats and vulnerability information. This process not only improves the adaptability of the threat detection model, ensuring that the detection method can adapt to changes in network environment and threat patterns, but also continuously improves the system's ability to detect new and complex security threats. BRIEF DESCRIPTION OF THE DRAWINGS

[0070] In order to more clearly illustrate the technical solutions in the present invention or the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings in the following description are only for the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0071] Figure 1 A schematic diagram of a detection method flow chart of an embodiment of the present invention;

[0072] Figure 2 Schematic diagram of system function modules according to an embodiment of the present invention. DETAILED DESCRIPTION

[0073] In order to make the objectives, technical solutions and advantages of the present invention more clearly understood, the present invention is further described in detail below in conjunction with specific embodiments.

[0074] It should be noted that, unless otherwise defined, the technical terms or scientific terms used in the present invention should be understood by people with ordinary skills in the field to which the present invention belongs. The "first", "second" and similar words used in the present invention do not indicate any order, quantity or importance, but are only used to distinguish different components. "Include" or "comprise" and similar words mean that the elements or objects appearing before the word include the elements or objects listed after the word and their equivalents, without excluding other elements or objects. "Connect" or "connected" and similar words are not limited to physical or mechanical connections, but may include electrical connections, whether direct or indirect. "Up", "down", "left", "right" and the like are only used to indicate relative positional relationships. When the absolute position of the described object changes, the relative positional relationship may also change accordingly.

[0075] like Figure 1 As shown, a network security vulnerability detection method and system based on distributed cloud computing includes the following steps:

[0076] S1, Dynamic Resource Monitoring and Configuration: Real-time monitoring of resource usage in distributed cloud computing environments, dynamic adjustment of resource configuration according to current security detection needs, ensuring effective use of resources and rapid response to security threats;

[0077] S2, security data collection and normalization: collect various security-related data from the distributed cloud environment and normalize the collected data to facilitate subsequent analysis and detection;

[0078] S3, distributed threat detection model deployment: deploy threat detection models in a distributed cloud computing environment to identify potential security threats and vulnerabilities in data and improve detection accuracy and efficiency;

[0079] S4, Real-time security incident processing and environment-aware recovery mechanism: Develop a comprehensive security incident processing mechanism. While analyzing and identifying security incidents in real time, the security incident processing mechanism automatically performs resource isolation and recovery operations according to the specific conditions of the distributed cloud environment. It integrates real-time analysis, rapid response, resource isolation and intelligent recovery to ensure the efficiency and effectiveness of the system in the face of security threats.

[0080] S5, vulnerability repair and defense strategy optimization: Based on the security incident analysis results, vulnerability repair solutions and optimized defense strategies are generated, and the defense strategies are automatically applied to the distributed cloud environment to prevent the recurrence of security threats;

[0081] S6, Continuous Learning and Model Update: Adopt a continuous learning mechanism to continuously update and optimize threat detection models based on new security threats and vulnerability information, ensure that detection methods can adapt to changes in network environments and threat patterns, and continuously improve detection capabilities;

[0082] Through the comprehensive application of the above steps, the needs for rapid response and effective recovery to security threats in complex and changing distributed cloud environments are solved, and the resilience and effectiveness of the entire system in the face of new and complex threats are enhanced.

[0083] Dynamic resource monitoring and configuration in S1 include:

[0084] S11, Real-time monitoring: Deploy real-time monitoring solutions to continuously track and evaluate resource usage in distributed cloud computing environments, including computing power (such as CPU usage, processing speed), storage space (such as disk usage, I / O operation speed), and network bandwidth (such as data transmission speed and network latency);

[0085] S12, data analysis: by analyzing the monitored data, the usage status and performance indicators of various resources are evaluated in real time, and predefined thresholds are used to identify abnormal patterns or potential bottlenecks in resource usage;

[0086] S13, security requirements identification: Combined with the current security detection task requirements, evaluate the required resource configuration, including the complexity of the computing task, the requirements for data processing and analysis, and the requirements for network communication;

[0087] S14, Resource Optimization and Adjustment: Based on the evaluation results, automatically adjust resource configuration to meet the needs of security detection, including increasing or decreasing computing resource allocation, expanding or compressing storage capacity, and optimizing network bandwidth usage, to ensure efficient execution of security detection tasks, while optimizing resource utilization and reducing unnecessary cost overhead;

[0088] Through the above steps, it can be ensured that the resources in the distributed cloud computing environment are efficiently and dynamically managed and configured to cope with the ever-changing security detection needs, ensure the security and stability of the system, and optimize the efficiency and cost-effectiveness of resource utilization.

[0089] The security data collection and normalization processing in S2 includes:

[0090] S21, data collection: deploying data collection agents on each node of the distributed cloud computing environment to collect security-related data in real time. The security-related data includes log files, network traffic data, and operation call information. The log files include operation logs, application logs, and security event logs. The network traffic data includes the source address, destination address, transmission protocol, and size information of the network packet. The operation call information includes access requests to resources, commands executed by users, and calls to applications.

[0091] S22, data normalization processing: convert the collected heterogeneous data into a unified format to eliminate the differences between different data sources. For normalized numerical data, the Min-Max normalization method is used, and the calculation formula is:

[0092] Where x is the original data, min(x) and max(x) are the minimum and maximum values ​​of the original data type in all collected data, and x′ is the normalized data;

[0093] Through the above method, security-related data can be effectively collected and normalized from a distributed cloud computing environment, providing a set of standardized and comparable data foundations for subsequent security analysis and threat detection. Normalization processing not only improves the efficiency of data processing, but also enhances the accuracy and reliability of data analysis, thereby providing strong data support for efficient detection and response to network security vulnerabilities.

[0094] The threat detection model in S3 adopts a contrastive learning model. The contrastive learning model captures complex attack patterns and identifies abnormal behaviors through dynamic negative sample selection, time correlation encoding, and multimodal feature fusion. The model is expressed as:

[0095]

[0096] in, represents the contrast loss at time step t, x t is the input data at time step t, which can be multimodal, i.e. composed of multiple types of safety-related data, is with x t Positive data at the same time step, usually the same as x t Similar or related, is a dynamically selected negative data set at time step t, with negative examples and x tObviously different or unrelated, and is dynamically updated according to the latest threat intelligence, f(·) is the encoder function, which is used to convert the input data into feature representation, sim(u,v) is the similarity function between two feature vectors u and v, using cosine similarity, τ is the temperature parameter, which is used to adjust the scaling of the similarity score, affecting the model's response to positive and negative examples. Spend;

[0097] In this way, the contrastive learning model can not only learn the behavioral patterns of current data points, but also adapt to changes in data over time, thereby improving the ability to detect new and complex attacks. In particular, through dynamic negative sample selection, the model can continuously adapt to the latest attack trends, while time-correlation encoding gives the model the ability to capture behavioral characteristics during the development of an attack. Multimodal feature fusion utilizes information from different sources to enhance the comprehensiveness of detection, making the model more powerful and effective in the application of real-time network security threat detection.

[0098] The encoder function f(·) is calculated as follows:

[0099] Assume input data x t Contains M modes, x t,m Represents the data of the mth mode;

[0100] Feature extraction: For each modality m of data, features are extracted through a separate neural network layer, and the calculation formula is: m =ReLU(W m x t,m +b m );

[0101] Among them, W m is the weight matrix, b m is the bias term, ReLU is the activation function;

[0102] Feature fusion: The features of all modalities are fused by weighted averaging. The calculation formula is:

[0103] Among them, α m It is the weight learned through training that determines the contribution of each modal feature;

[0104] Time series modeling: associate the fused features with the time dimension and use GRU to handle time dependency. The calculation formula is: h t =GRU(h t-1 ,f fused );

[0105] Among them, h t is the hidden state of the current time step, h t-1is the hidden state of the previous time step, and the update of GRU is expressed as:

[0106] Update gate z t :z t =σ(W z ·[h t-1 ,f fused ]+b z );

[0107] Reset Gate t :r t =σ(W r ·[h t-1 ,f fused ]+b r );

[0108] Candidate hidden states

[0109] The final hidden state h t :

[0110] Among them, W z is the weight matrix of the update gate, W r is the weight matrix of the reset gate, W h is the weight matrix of the candidate hidden state, b z is the bias vector of the update gate, b r is the bias vector for the reset gate, b h is the bias vector of the candidate hidden state, σ is the sigmoid activation function, which is used for the nonlinear activation of the update gate and the reset gate, and tanh is the hyperbolic tangent activation function, which is used for the nonlinear activation of the candidate hidden state;

[0111] In this encoder, the data of each modality is first converted into a set of features through a feature extraction layer, and then these features are fused together and finally passed through a GRU module to consider their dynamic changes in time.

[0112] The real-time security event processing and environment-aware recovery mechanisms in S4 include:

[0113] S41, Intelligent Event Identification: Analyzes collected data in real time, automatically identifies signs of security incidents, and distinguishes normal operations from abnormal behaviors;

[0114] S42, Dynamic Resource Isolation: If a potential security threat is detected, the resource isolation protocol is immediately triggered, and the scope and depth of isolation are dynamically adjusted according to the nature and severity of the incident to minimize interference with business operations;

[0115] S43, Context-Aware Recovery: Intelligently formulates and executes repair strategies by analyzing the context information and environmental dependencies of isolated resources to ensure the effectiveness and safety of recovery actions;

[0116] S44, Strategy Optimization and Feedback: After responding to security incidents, collect feedback and optimize threat detection models and response strategies to improve prevention capabilities and resilience;

[0117] These steps ensure a quick and intelligent response to security incidents in a distributed cloud computing environment, while providing an adaptive and continuously optimized security assurance mechanism.

[0118] Intelligent event recognition in S41 includes:

[0119] S411, data collection: collect real-time operation data from each node in the distributed cloud environment. The real-time operation data includes network traffic, operation logs, user activities and application interactions;

[0120] S412, feature extraction: extract key features from the collected real-time operation data. The key features include request frequency, login attempts, and file access patterns. The key features are represented by F(x), where x is the original data point.

[0121] S413, Abnormal Behavior Modeling: Using Graph Neural Networks (GNN) to Model Normal Behavior normal , and updates in real time to capture behavioral changes;

[0122] S414, similarity calculation: use cosine similarity and other metrics to calculate the similarity between the real-time data features and the normal behavior model. The calculation formula is:

[0123] S415, threshold determination: set a threshold θ, compare the similarity score S(x) with θ to identify abnormal behavior, when S(x)<θ, the data point is marked as abnormal;

[0124] S416, security event marking: marking data points identified as abnormal as potential security events and recording detailed information for analysis;

[0125] Through the above steps, security incidents can be analyzed and responded to in real time, normal operations can be effectively distinguished from abnormal behaviors, and necessary security measures can be automatically executed to ensure the continuous and secure operation of the distributed cloud computing environment.

[0126] Model of normal behavior M normal include:

[0127] Space-time graph construction: Create a space-time graph G st=(V,E,T), where V represents entities in the cloud environment (such as hosts, applications, etc.), E represents the communication or data flow between entities, and T represents the time dimension, allowing the topology of the graph to change over time;

[0128] Dynamic feature representation: Introducing dynamic feature vectors To represent the state of node v at time t, including recent activities, interactions, and transactions;

[0129] Time-aware graph convolution: In order to capture the dynamic characteristics of time series data, a time-aware mechanism is added to the graph convolution. The calculation formula is:

[0130]

[0131] in, are the neighbors of node v at time t, is the feature representation of node u at time t-1, ReLU is the activation function, expressed as: ReLU(x)=max(0,x), AGGREGATE t is an aggregation function that takes time into account;

[0132] Aggregate function that takes time into account t The weighted average is used as the aggregation function, considering time decay, which is expressed as:

[0133] in, is the time decay weight, λ is the decay rate, t uv is the time of the last interaction between u and v;

[0134] Dynamic adjustment of edge weights: The edge weights are dynamically adjusted according to the time and intensity of the interactions between nodes. The calculation formula is:

[0135] Among them, f is the learning function, interaction uv is the interaction history and timing characteristics between nodes u and v;

[0136] The learning function is updated by time-dependent exponential decay, calculated as:

[0137] Multi-scale feature learning: For each node in the graph, features at different time scales are learned to capture short-term and long-term behavior patterns, expressed as:

[0138] in, represents the concatenation of features, T is the size of the time window;

[0139] Abnormal score calculation: In the last layer of the normal behavior model, the abnormal score is calculated by combining the spatiotemporal feature representation of the node:

[0140] Where g is a mapping function used to map multi-scale feature representations to anomaly scores;

[0141] The mapping function uses a neural network layer and is expressed as:

[0142] Among them, σ is the sigmoid function, which is used to map the score to the range of (0,1), indicating the probability of abnormality, w is the weight vector, and b is the bias term;

[0143] The normal behavior model can not only capture the spatiotemporal dynamic behavior of nodes, but also adapt to the continuous changes in the distributed environment and provide more accurate anomaly detection capabilities. The normal behavior model is suitable for distributed cloud computing environments that require real-time monitoring and rapid response.

[0144] Vulnerability fixes and defense strategy optimizations in S5 include:

[0145] S51, Security Event Analysis: Automatically collect and analyze security event data in distributed cloud environments to identify event types and related vulnerabilities;

[0146] S52, vulnerability repair solution generation: for each identified vulnerability, automatically generate repair steps or patch application guide;

[0147] S53, defense strategy optimization: Based on the analysis results of security events and the current environment status, optimize the existing defense strategy, including adjusting security configuration, updating access control lists, and enhancing intrusion detection rules;

[0148] S54, automatic policy application: Automatically deploy remediation solutions and optimized defense policies to relevant components and nodes in the distributed cloud environment, using automated tools and scripts to ensure fast and consistent policy implementation and minimize human errors;

[0149] Through the above steps, we can quickly respond to security incidents, provide targeted vulnerability repair solutions and defense strategies, and ensure the continuous optimization of the security performance of the distributed cloud environment, effectively reducing security risks.

[0150] Continuous learning and model updating in S6 include:

[0151] S61, Model Training and Fine-tuning: Incrementally train or fine-tune threat detection models using newly collected data to ensure that the models can identify emerging security threats and vulnerabilities;

[0152] S62, Model Evaluation and Verification: Evaluate the performance of the updated threat detection model through accuracy, recall, and F1 score, verify the effectiveness of the model in an isolated environment, and ensure that the introduction of the new model will not have a negative impact on the existing system;

[0153] S63, strategy update and deployment: update the threat detection strategy according to the evaluation results of the threat detection model, and deploy the optimized threat detection model to the production environment;

[0154] Through continuous learning and model updating methods, we can ensure that the threat detection model is always kept up to date, improve the detection capabilities of new and complex security threats, and provide strong security protection for distributed cloud computing environments.

[0155] like Figure 2 As shown, the network security vulnerability detection system based on distributed cloud computing is used to implement the above-mentioned network security vulnerability detection method based on distributed cloud computing, and includes the following modules:

[0156] Dynamic resource monitoring and configuration module: responsible for real-time monitoring of resource usage in the distributed cloud computing environment. The dynamic resource monitoring and configuration module dynamically adjusts resource configuration according to current security detection requirements.

[0157] Security data collection and normalization processing module: collects various security-related data from the distributed cloud environment, and the collected data is normalized;

[0158] Distributed threat detection model deployment module: deploys threat detection models in a distributed cloud computing environment to identify potential security threats and vulnerabilities in the data;

[0159] Real-time security incident processing and environment-aware recovery module: Develop a comprehensive security incident processing mechanism that analyzes and identifies security incidents in real time and automatically performs resource isolation and recovery operations based on the specific conditions of the distributed cloud environment;

[0160] Vulnerability repair and defense strategy optimization module: Generate vulnerability repair solutions and optimized defense strategies based on security incident analysis results, and automatically apply defense strategies to distributed cloud environments;

[0161] Continuous learning and model update module: Adopts a continuous learning mechanism to continuously update and optimize threat detection models based on new security threats and vulnerability information.

[0162] Those skilled in the art should understand that the discussion of any of the above embodiments is merely illustrative and is not intended to imply that the scope of the present invention is limited to these examples. Under the concept of the present invention, the technical features in the above embodiments or different embodiments may be combined, the steps may be implemented in any order, and there are many other variations of the different aspects of the present invention as described above, which are not provided in detail for the sake of simplicity.

[0163] The present invention is intended to cover all such substitutions, modifications and variations that fall within the broad scope of the claims. Therefore, any omissions, modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention should be included in the protection scope of the present invention.

Claims

1. A network security vulnerability detection method based on distributed cloud computing, characterized in that: The following steps are involved: S1, Dynamic Resource Monitoring and Configuration: Real-time monitoring of resource usage in the distributed cloud computing environment, and dynamic adjustment of resource configuration according to current security detection requirements, including: S11, Real-time monitoring: Deploy a real-time monitoring solution to continuously track and evaluate resource usage in a distributed cloud computing environment, including computing power, storage space, and network bandwidth; S12, data analysis: by analyzing the monitored data, the usage status and performance indicators of various resources are evaluated in real time, and predefined thresholds are used to identify abnormal patterns or potential bottlenecks in resource usage; S13, security requirements identification: Combined with the current security detection task requirements, evaluate the required resource configuration, including the complexity of the computing task, the requirements for data processing and analysis, and the requirements for network communication; S14, Resource Optimization and Adjustment: Based on the evaluation results, automatically adjust resource configuration to meet the needs of security detection, including increasing or decreasing computing resource allocation, expanding or compressing storage capacity, and optimizing network bandwidth usage; S2, security data collection and normalization processing: collect various security-related data from the distributed cloud environment and normalize the collected data; S3, distributed threat detection model deployment: deploy threat detection models in a distributed cloud computing environment to identify potential security threats and vulnerabilities in the data; S4, Real-time security incident processing and environment-aware recovery mechanism: Develop a comprehensive security incident processing mechanism. While analyzing and identifying security incidents in real time, the security incident processing mechanism automatically performs resource isolation and recovery operations based on the specific conditions of the distributed cloud environment, integrating real-time analysis, rapid response, resource isolation, and intelligent recovery. S5, vulnerability repair and defense strategy optimization: Generate vulnerability repair solutions and optimized defense strategies based on security incident analysis results, and automatically apply defense strategies to distributed cloud environments; S6, Continuous Learning and Model Update: Adopt a continuous learning mechanism to continuously update and optimize the threat detection model based on new security threats and vulnerability information.

2. The network security vulnerability detection method based on distributed cloud computing according to claim 1 is characterized in that: The security data collection and normalization processing in S2 includes: S21, data collection: deploying data collection agents on various nodes in the distributed cloud computing environment to collect security-related data in real time, the security-related data including log files, network traffic data and operation call information, wherein the log files include operation logs, application logs and security event logs, the network traffic data includes the source address, destination address, transmission protocol and size information of the network packet, and the operation call information includes access requests to resources, commands executed by users and calls to applications; S22, data normalization processing: convert the collected heterogeneous data into a unified format to eliminate the differences between different data sources. For normalized numerical data, the Min-Max normalization method is used, and the calculation formula is: Where x is the original data, min(x) and max(x) are the minimum and maximum values ​​of the original data type in all collected data, and x′ is the normalized data.

3. The network security vulnerability detection method based on distributed cloud computing according to claim 2 is characterized in that: The threat detection model in S3 adopts a contrastive learning model. The contrastive learning model captures complex attack patterns and identifies abnormal behaviors through dynamic negative sample selection, time correlation encoding, and multimodal feature fusion. The model is expressed as: in, represents the contrast loss at time step t, x t is the input data at time step t, is with x t Positive data at the same time step, is a dynamically selected negative data set at time step t, f(·) is the encoder function, sim(u,v) is a similarity function between two feature vectors u and v, using cosine similarity, and τ is a temperature parameter.

4. The network security vulnerability detection method based on distributed cloud computing according to claim 3 is characterized in that: The real-time security event processing and environment perception recovery mechanism in S4 includes: S41, Intelligent Event Identification: Analyzes collected data in real time, automatically identifies signs of security incidents, and distinguishes normal operations from abnormal behaviors; S42, Dynamic Resource Isolation: If a potential security threat is detected, the resource isolation protocol is immediately triggered, and the scope and depth of isolation are dynamically adjusted according to the nature and severity of the incident; S43, context-aware recovery: intelligently formulate and execute repair strategies by analyzing the context information and environmental dependencies of isolated resources; S44, Strategy Optimization and Feedback: After responding to security incidents, collect feedback and optimize threat detection models and response strategies.

5. The network security vulnerability detection method based on distributed cloud computing according to claim 4 is characterized in that: The intelligent event recognition in S41 includes: S411, data collection: collect real-time operation data from each node in the distributed cloud environment. The real-time operation data includes network traffic, operation logs, user activities and application interactions; S412, feature extraction: extract key features from the collected real-time operation data. The key features include request frequency, login attempts, and file access patterns. The key features are represented by F(x), where x is the original data point. S413, Abnormal Behavior Modeling: Using Graph Neural Networks to Model Normal Behavior normal , and updates in real time to capture behavioral changes; S414, similarity calculation: use cosine similarity and other metrics to calculate the similarity between the real-time data features and the normal behavior model. The calculation formula is: S415, threshold determination: set a threshold θ, compare the similarity score S(x) with θ to identify abnormal behavior, when S(x)<θ, the data point is marked as abnormal; S416, Security Event Marking: Mark the data points identified as abnormal as potential security events and record detailed information for analysis.

6. The network security vulnerability detection method based on distributed cloud computing according to claim 5 is characterized in that: The model of normal behavior M normal include: Space-time graph construction: Create a space-time graph G st =(V,E,T), where V represents the entities in the cloud environment, E represents the communication or data flow between entities, and T represents the time dimension; Dynamic feature representation: Introducing dynamic feature vectors To represent the state of node v at time t; Time-aware graph convolution: In order to capture the dynamic characteristics of time series data, a time-aware mechanism is added to the graph convolution. The calculation formula is: in, are the neighbors of node v at time t, is the feature representation of node u at time t-1, ReLU is the activation function, AGGREGATE t is an aggregation function that takes time into account; The aggregate function AGGREGATE considering time t The weighted average is used as the aggregation function, considering time decay, which is expressed as: in, is the time decay weight, λ is the decay rate, t uv is the time of the last interaction between u and v; Dynamic adjustment of edge weights: The edge weights are dynamically adjusted according to the time and intensity of the interactions between nodes. The calculation formula is: Among them, f is the learning function, interaction uv is the interaction history and timing characteristics between nodes u and v; Multi-scale feature learning: For each node in the graph, learn features at different time scales, expressed as: in, represents the concatenation of features, T is the size of the time window; Abnormal score calculation: In the last layer of the normal behavior model, the abnormal score is calculated by combining the spatiotemporal feature representation of the node: Where g is the mapping function.

7. The network security vulnerability detection method based on distributed cloud computing according to claim 6 is characterized in that: The vulnerability repair and defense strategy optimization in S5 include: S51, Security Event Analysis: Automatically collect and analyze security event data in distributed cloud environments to identify event types and related vulnerabilities; S52, vulnerability repair solution generation: for each identified vulnerability, automatically generate repair steps or patch application guide; S53, defense strategy optimization: Based on the analysis results of security events and the current environment status, optimize the existing defense strategy, including adjusting security configuration, updating access control lists, and enhancing intrusion detection rules; S54, automatic policy application: automatically deploying repair solutions and optimized defense policies to relevant components and nodes in the distributed cloud environment.

8. The network security vulnerability detection method based on distributed cloud computing according to claim 7 is characterized in that: The continuous learning and model updating in S6 includes: S61, Model Training and Fine-tuning: Incrementally train or fine-tune threat detection models using newly collected data; S62, Model Evaluation and Validation: Evaluate the performance of the updated threat detection model through precision, recall, and F1 score; S63, strategy update and deployment: Update the threat detection strategy based on the evaluation results of the threat detection model, and deploy the optimized threat detection model to the production environment.

9. A network security vulnerability detection system based on distributed cloud computing, used to implement the network security vulnerability detection method based on distributed cloud computing as claimed in any one of claims 1 to 8, characterized in that: Includes the following modules: Dynamic resource monitoring and configuration module: responsible for real-time monitoring of resource usage in the distributed cloud computing environment. The dynamic resource monitoring and configuration module dynamically adjusts resource configuration according to current security detection requirements. Security data collection and normalization processing module: collects various security-related data from the distributed cloud environment, and the collected data is normalized; Distributed threat detection model deployment module: deploys threat detection models in a distributed cloud computing environment to identify potential security threats and vulnerabilities in the data; Real-time security incident processing and environment-aware recovery module: Develop a comprehensive security incident processing mechanism that analyzes and identifies security incidents in real time and automatically performs resource isolation and recovery operations based on the specific conditions of the distributed cloud environment; Vulnerability repair and defense strategy optimization module: Generate vulnerability repair solutions and optimized defense strategies based on security incident analysis results, and automatically apply defense strategies to distributed cloud environments; Continuous learning and model update module: Adopts a continuous learning mechanism to continuously update and optimize threat detection models based on new security threats and vulnerability information.

Images