Cloud security protection solution generation method, device, equipment and storage medium

Abstract

The application relates to a cloud security protection solution generation method and device, equipment and a storage medium, and relates to the technical field of cloud security. The method comprises the following steps: obtaining a first training sample set, wherein the first training sample set comprises historical scheme generation requests corresponding to a new cloud tenant type and historical cloud security protection solutions corresponding to the historical scheme generation requests; determining a to-be-migrated model based on the historical scheme generation requests of the new cloud tenant type and the scheme generation models corresponding to the existing cloud tenant types by using a migration selection model; training a scheme generation model corresponding to the new cloud tenant type by using the to-be-migrated model and the first training sample set; and the scheme generation model corresponding to the new cloud tenant type is used to generate a corresponding cloud security protection solution in response to a corresponding scheme generation request. Through the above method, the generation efficiency and accuracy of the cloud security protection solution can be improved.

Description

TECHNICAL FIELD

[0001] Embodiments of the present application relate to the technical field of cloud security, and particularly relate to a cloud security protection solution generation method and device, equipment and a storage medium. BACKGROUND

[0002] With the increasingly severe security situation, cloud tenants on a cloud service platform urgently need to determine a cloud security integrated solution suitable for their actual situation.

[0003] In related technologies, cloud tenants need to determine the required security products, security services, security policies, etc. by themselves, which are mainly decided by artificial or experts. However, this way is low in efficiency and prone to judgment errors, so that the determined cloud security integrated solution cannot accurately protect the cloud tenants, resulting in security risks for the cloud tenants. SUMMARY

[0004] Embodiments of the present application provide a cloud security protection solution generation method, device, equipment and storage medium, which can realize the automation of cloud security protection solution generation, improve the generation efficiency and accuracy of cloud security protection solution, and the technical solution is as follows.

[0005] On the one hand, a cloud security protection solution generation method is provided, and the method comprises:

[0006] obtaining a first training sample set of a to-be-trained solution generation model corresponding to a new cloud tenant type, the first training sample set containing each historical solution generation request corresponding to the new cloud tenant type and a historical cloud security protection solution corresponding to each historical solution generation request;

[0007] determining a to-be-migrated model based on the historical solution generation request of the new cloud tenant type and the existing solution generation models corresponding to each cloud tenant type by a migration selection model;

[0008] training a solution generation model corresponding to the new cloud tenant type based on the to-be-migrated model and the first training sample set by transfer learning; the solution generation model corresponding to the new cloud tenant type is used to generate a corresponding cloud security protection solution in response to a solution generation request of the new cloud tenant type.

[0009] On the other hand, a cloud security protection solution generation device is provided, and the device comprises:

[0010] The first sample set acquisition module is configured to acquire a first training sample set of a scheme generation model to be trained corresponding to a new cloud tenant type, the first training sample set including historical scheme generation requests corresponding to the new cloud tenant type and historical cloud security protection solutions corresponding to the historical scheme generation requests;

[0011] The model determination module is configured to determine a model to be migrated by the migration selection model based on the historical scheme generation requests of the new cloud tenant type and the scheme generation models corresponding to the existing cloud tenant types.

[0012] The first model training module is configured to train the scheme generation model corresponding to the new cloud tenant type by the transfer learning based on the model to be migrated and the first training sample set, and the scheme generation model corresponding to the new cloud tenant type is configured to generate a corresponding cloud security protection solution in response to a scheme generation request of the new cloud tenant type.

[0013] In a possible implementation, the model training module comprises:

[0014] The transfer learning submodule is configured to migrate part of the model weights of the model to be migrated to the scheme generation model to be trained as initial model weights of the scheme generation model to be trained.

[0015] The model training submodule is configured to train other model weights of the scheme generation model to be trained except the initial weights based on the first training sample set, to obtain the scheme generation model corresponding to the new cloud tenant type.

[0016] In a possible implementation, the apparatus further comprises:

[0017] The second sample set acquisition module is configured to acquire a second training sample set, the second training sample set including historical scheme generation requests corresponding to each cloud tenant type and scheme generation models corresponding to each cloud tenant type.

[0018] The second model training module is configured to iteratively train the transfer selection model to be trained based on the second training sample set, to obtain the transfer selection model.

[0019] In each iteration training process, the transfer selection model to be trained is configured to:

[0020] predict, by the transfer selection model to be trained, matching degrees between the historical scheme generation requests of the first cloud tenant type and the scheme generation models of each second cloud tenant type corresponding to the historical scheme generation requests of the first cloud tenant type, the second cloud tenant type being each cloud tenant type except the first cloud tenant type.

[0021] The matching degrees between the historical solution generation request of the first cloud tenant type and the solution generation models of each second cloud tenant type and the similarity between the solution generation model of the first cloud tenant type and the solution generation models of the second cloud tenant type are determined, and the migration selection model to be trained is trained.

[0022] In a possible implementation, the cloud tenant description in the historical solution generation request includes a cloud tenant status description and a cloud tenant demand description.

[0023] The model determination module includes:

[0024] The preprocessing submodule is configured to perform text preprocessing on the cloud tenant description in the historical solution generation request of the new cloud tenant type and the model information of each existing solution generation model, to obtain a first feature vector set corresponding to the cloud tenant description and a second feature vector set including a feature vector corresponding to each existing solution generation model. The first feature vector set includes a feature vector corresponding to the cloud security status description and a feature vector corresponding to the cloud security demand description.

[0025] The matching degree generation submodule is configured to input the first feature vector set and the second feature vector set into the migration selection model, to obtain the matching degrees between the historical solution generation request of the new cloud tenant type and each existing solution generation model output by the migration selection model.

[0026] The model determination submodule is configured to determine the model to be migrated based on the matching degrees between the historical solution generation request of the new cloud tenant type and each existing solution generation model.

[0027] In a possible implementation, the model determination submodule is configured to sort each existing solution generation model based on the matching degree corresponding to each existing solution generation model, to obtain a sorting result.

[0028] Based on the sorting result, the first N solution generation models with the highest matching degrees are determined as the model to be migrated, where N is a positive integer.

[0029] In a possible implementation, the apparatus further includes:

[0030] The type acquisition module is configured to acquire the cloud tenant type of a target cloud tenant in a case where a solution generation request initiated by the target cloud tenant is received.

[0031] The sample set creation module is configured to, in a case where it is determined that the cloud tenant type of the target cloud tenant does not exist in the existing cloud tenant types, create a first training sample set corresponding to a newly created cloud tenant type, the newly created cloud tenant type being the cloud tenant type of the target cloud tenant.

[0032] The first model training module is configured to, in a case where the sample quantity in the first training sample set reaches a quantity threshold, train the scheme generation model corresponding to the newly created cloud tenant type.

[0033] In a possible implementation, the apparatus further includes:

[0034] The model obtaining module is configured to, in a case where it is determined that the cloud tenant type of the target cloud tenant exists in the existing cloud tenant types, obtain a target scheme generation model corresponding to the cloud tenant type of the target cloud tenant.

[0035] The scheme generation module is configured to input the cloud tenant description in the scheme generation request into the target scheme generation model to obtain the cloud security protection solution generated by the target scheme generation model.

[0036] In another aspect, a computer device is provided, which includes a processor and a memory, the memory storing at least one computer program, the at least one computer program being loaded and executed by the processor to implement the cloud security protection solution generation method described above.

[0037] In another aspect, a computer readable storage medium is provided, which stores at least one computer program, the computer program being loaded and executed by a processor to implement the cloud security protection solution generation method described above.

[0038] In another aspect, a computer program product is provided, which includes at least one computer program, the computer program being loaded and executed by a processor to implement the cloud security protection solution generation method provided in various optional implementation manners described above.

[0039] The technical solution provided in the present application can include the following beneficial effects:

[0040] The cloud security protection solution generation method provided by the embodiment of the present application can determine a to-be-migrated model from the existing scheme generation model corresponding to each cloud tenant type when there is a demand for a newly created scheme generation model, train the scheme generation model of the newly created cloud tenant type by using the existing to-be-migrated model and a first training sample set with a small sample quantity through transfer learning, and generate a cloud security protection solution corresponding to the scheme request of the newly created cloud tenant type through the scheme generation model of the newly created cloud tenant type. Through the above method, the generation of the cloud security protection solution can be automated, and the generation efficiency and accuracy of the cloud security protection solution can be improved. Meanwhile, in the training process of the scheme generation model, the newly created scheme generation model is trained through the transfer learning of the existing scheme generation model, so that the model training efficiency can be improved while ensuring the model training effect.

[0041] It should be understood that the foregoing general description and the following detailed description are only exemplary and explanatory, and are not limiting to the present application. BRIEF DESCRIPTION OF DRAWINGS

[0042] The accompanying drawings, which are incorporated in and constitute a part of the specification, illustrate embodiments consistent with the present application and, together with the description, serve to explain the principles of the present application.

[0043] Figure 1 A flowchart of a cloud security protection solution generation method provided by an exemplary embodiment of the present application is shown;

[0044] Figure 2 A flowchart of a cloud security protection solution generation method provided by an exemplary embodiment of the present application is shown;

[0045] Figure 3 A flowchart of a training process of a transfer selection model provided by an exemplary embodiment of the present application is shown;

[0046] Figure 4 A schematic diagram of a training process of a transfer model provided by an exemplary embodiment of the present application is shown;

[0047] Figure 5 A structural schematic diagram of a scheme generation model provided by an exemplary embodiment of the present application is shown;

[0048] Figure 6 A flowchart of a cloud security protection solution generation method provided by an exemplary embodiment of the present application is shown;

[0049] Figure 7 A block diagram of a cloud security protection solution generation device provided by an exemplary embodiment of the present application is shown;

[0050] Figure 8 is a structural block diagram of a computer device according to an exemplary embodiment. DETAILED DESCRIPTION

[0051] The exemplary embodiments will be described in detail with reference to the drawings. The following description is directed to the exemplary embodiments, but is not meant to limit the scope of the application. Rather, the following description is intended to explain the exemplary embodiments and their best mode for the practice in accordance with the application as claimed.

[0052] First, the terms related to the present application are explained:

[0053] 1) Cloud Tenant

[0054] Cloud Tenant refers to an independent organization or individual user using cloud services in a cloud computing environment. Each cloud tenant has an isolated virtual resource environment and isolated permissions, and can run its applications and services on the shared infrastructure provided by the cloud service.

[0055] 2) Transfer Learning

[0056] Transfer learning refers to the problem of overfitting caused by small sample data sets. The weights and parameters of the model network layer are frozen and transferred to the small-scale target domain and retrained the last fully connected layer of the model. Then save the parameters after training. In transfer learning, the knowledge we already have is called the source domain, and the new knowledge to be learned is called the target domain. The reason for transfer learning is that it is difficult to obtain data labels. When the data labels of some tasks are difficult to obtain, transfer learning can be used to learn from other tasks with easy-to-obtain labels and similar tasks.

[0057] The strict definition of transfer learning is: given the source domain Ds={Xs,Fs(X)} and the learning task Ts, the target domain Dt={Xt,Ft(X)} and the learning task Tt, transfer learning aims to use the knowledge obtained from the learning task Ts and the source domain Ds={Xs,Fs(X)} to help learn the prediction function Ft(X) of the target domain Dt under the condition that the source domain is different from the target domain or the learning task Tt is different from the learning task Ts.

[0058] In order to realize the automation of the generation of the cloud security protection solution, improve the accuracy of the generation of the cloud security protection solution, and reduce the security risks of the cloud tenants, an embodiment of the present application provides a cloud security protection solution generation method based on a machine learning model. The method can train a scheme generation model corresponding to a cloud tenant type, so as to generate a corresponding cloud security protection solution when receiving a scheme generation request initiated by a cloud tenant of the corresponding cloud tenant type. In the model training process, in order to improve the training efficiency of the model, when there is a new model building requirement, the closest existing scheme generation model of the new cloud tenant type can be used as the migration object of the new scheme generation model in the embodiment of the present application by using a migration selection model, and then the model weight of the closest scheme generation model of the new cloud tenant type is used as the initial weight of the new scheme generation model by using the transfer learning, so as to perform model training on this basis. Figure 1 A flowchart of a cloud security protection solution generation method provided by an example embodiment of the present application is shown. The method can be executed by a cloud platform. The cloud platform can be implemented as a server, as shown in Figure 1 The cloud security protection solution generation method can include the following steps:

[0059] In step 110, a first training sample set of a scheme generation model to be trained corresponding to a new cloud tenant type is obtained. The first training sample set includes each historical scheme generation request corresponding to the new cloud tenant type and a historical cloud security protection solution corresponding to each historical scheme generation request.

[0060] A cloud tenant refers to an entity that uses cloud resources and services in a cloud computing service model by leasing. In the embodiment of the present application, the cloud tenant can refer to an entity that invokes resources and services in a cloud platform. The cloud platform can include a government affairs cloud platform, an Internet of Things cloud platform, an Internet cloud platform, a communication cloud platform, and the like based on different application scenarios. The present application does not limit the cloud platform. The cloud tenant type is divided based on actual needs. In a possible implementation manner, the cloud platform can divide the cloud tenant type into police affairs, law enforcement supervision, group organization, school, and the like based on the functions or social attributes of the cloud tenant. The present application does not limit the division of the cloud tenant type.

[0061] The first training sample set is a small sample data set, that is, the number of samples in the first training sample set is small. The historical cloud security protection solution of each historical scheme generation request of the new cloud tenant type can be artificially prepared.

[0062] The cloud security status description refers to a description text of information related to cloud tenant security, wherein the information related to cloud tenant security can include a security component currently subscribed by the cloud tenant, a security service used, a number of vulnerabilities, an attack frequency, a security incident situation, and the like. The cloud tenant demand description can refer to a description text of security demand information currently required by the cloud tenant. The cloud tenant demand description can be a description text customized based on actual demand, such as how to further reduce the risk of being attacked, and the like.

[0063] In step 120, a migration selection model determines a to-be-migrated model based on the historical scheme generation request of the new cloud tenant type and the scheme generation model corresponding to each of the existing cloud tenant types.

[0064] Since the number of samples in the first training sample set corresponding to the new cloud tenant type is small, in order to reduce the overfitting problem caused by the small sample data set, the application embodiment trains the scheme generation model of the new cloud tenant type in a manner of transfer learning. On this basis, it is necessary to determine the to-be-migrated model of the current transfer learning. In the application embodiment, the migration selection model can determine the relevance or matching degree between the historical scheme generation request of the new cloud tenant type and the scheme generation model corresponding to each of the existing cloud tenant types, so as to select the to-be-migrated model from the scheme generation model corresponding to each of the existing cloud tenant types.

[0065] In a possible implementation manner, the cloud platform can randomly select one of the historical scheme generation requests of the new cloud tenant type as a reference, and determine the to-be-migrated model based on the matching degree between the historical scheme generation request and the scheme generation model corresponding to each of the existing cloud tenant types.

[0066] In another possible implementation manner, the cloud platform can determine a candidate to-be-migrated model based on each of the historical scheme generation requests of the new cloud tenant type, and then count the number of the candidate to-be-migrated models, and determine one or several to-be-migrated models with the largest number.

[0067] In step 130, the scheme generation model corresponding to the new cloud tenant type is trained by transfer learning based on the to-be-migrated model and the first training sample set. The scheme generation model of the new cloud tenant type is used to generate a corresponding cloud security protection solution in response to a scheme generation request of the new cloud tenant type.

[0068] In the transfer learning, the cloud platform can freeze the weight parameters of part of the network layers of the model trained in the large-scale source domain, transfer to the small-scale target domain, and retrain the network layers of the model that are not frozen, corresponding to the embodiment of the present application, the cloud platform can migrate the model parameters of part of the network layers in the network to be migrated to the newly created cloud tenant type scheme generation model and freeze them, and train the network layers of the newly created cloud tenant type scheme generation model that are not frozen in the first training sample set to obtain the scheme generation model corresponding to the newly created cloud tenant type.

[0069] After obtaining the scheme generation model corresponding to the newly created cloud tenant type, if the cloud platform receives a scheme generation request initiated by the cloud tenant corresponding to the newly created cloud tenant type again, the scheme generation model corresponding to the cloud tenant type can be called to generate the corresponding cloud security protection solution. The cloud security protection solution can include security product recommendation, security service recommendation, security policy formulation, or a combination of the above items, etc., which are not limited by the present application.

[0070] In summary, the cloud security protection solution method provided by the embodiment of the present application can determine the model to be migrated from the scheme generation model corresponding to each existing cloud tenant type through the historical scheme generation request of the newly created cloud tenant type when there is a demand for a newly created scheme generation model, and train the scheme generation model of the newly created cloud tenant type by using the existing model to be migrated and the first training sample set with a small number of samples through transfer learning, so as to generate the cloud security protection solution corresponding to the scheme request of the newly created cloud tenant type through the scheme generation model of the newly created cloud tenant type. Through the above method, the generation of the cloud security protection solution can be automated, and the generation efficiency and accuracy of the cloud security protection solution can be improved. At the same time, in the training process of the scheme generation model, the newly created scheme generation model is trained by using the existing scheme generation model through transfer learning, which can improve the efficiency of model training while ensuring the training effect of the model.

[0071] The cloud security protection solution generation method provided by the present application can include a model training phase and a model application phase, wherein in the model training phase, Figure 2 A flow chart of the cloud security protection solution generation method provided by an exemplary embodiment of the present application is shown, which can be executed by a cloud platform. The cloud platform can be implemented as a server, such as Figure 2 As shown, the cloud security protection solution generation method can include the following steps:

[0072] In step 210, a first training sample set of the to-be-trained scheme generation model corresponding to the new cloud tenant type is obtained, and the first training sample set includes each historical scheme generation request corresponding to the new cloud tenant type and a historical cloud security protection solution corresponding to each historical scheme generation request.

[0073] In the embodiments of the present application, the cloud platform can determine whether to train a new scheme generation request based on the cloud tenant type of the cloud tenant corresponding to the newly received scheme generation request. The process can be implemented as follows:

[0074] In the case of receiving a scheme generation request initiated by a target cloud tenant, the cloud tenant type of the target cloud tenant is obtained.

[0075] In the case where the cloud tenant type of the target cloud tenant does not exist in the existing cloud tenant types, a first training sample set corresponding to a new cloud tenant type is created, and the new cloud tenant type is the cloud tenant type of the target cloud tenant.

[0076] In the case where the sample quantity in the first training sample set reaches a quantity threshold, the scheme generation model corresponding to the new cloud tenant type is trained.

[0077] That is, in the case where the cloud tenant type of the cloud tenant corresponding to the scheme generation request received by the cloud platform is first seen, there is no scheme generation model corresponding to the cloud tenant type in the current cloud platform. In this case, the cloud platform can notify relevant personnel to process the scheme generation request, that is, to manually generate a cloud security protection solution corresponding to the scheme generation request, and store the cloud tenant type of the cloud tenant corresponding to the scheme generation request and the corresponding cloud security protection solution, so as to constitute a training sample set (that is, a first training sample set) corresponding to the cloud tenant type when creating the scheme generation model corresponding to the cloud tenant type. The quantity threshold can be set based on actual conditions, and the present application does not limit this.

[0078] In the case where it is determined that the scheme generation model corresponding to the new cloud tenant type needs to be trained, the cloud platform can extract each historical scheme generation request corresponding to the new cloud tenant type and a historical cloud security protection solution corresponding to each historical scheme generation request from the database to constitute the first training sample set. The historical scheme generation request includes a cloud tenant description, and the cloud tenant description includes a cloud tenant status description and a cloud tenant demand description. In addition, the cloud platform can also extract the scheme generation models corresponding to the existing cloud tenant types from the database.

[0079] In step 220, a to-be-migrated model is determined based on the historical scheme generation request of the new cloud tenant type and the scheme generation models corresponding to the existing cloud tenant types by using the migration selection model.

[0080] In the embodiments of the present application, the process of determining the to-be-migrated model based on the historical scheme generation request of the newly-built cloud tenant type and the existing scheme generation models corresponding to the respective cloud tenant types can be implemented as follows:

[0081] The cloud tenant description in the historical scheme generation request of the newly-built cloud tenant type and the model information of each existing scheme generation model are subjected to text preprocessing to obtain a first feature vector set corresponding to the cloud tenant description and a second feature vector set containing the feature vectors corresponding to each existing scheme generation model; the first feature vector set contains a feature vector corresponding to the cloud security status description and a feature vector corresponding to the cloud security requirement description;

[0082] The first feature vector set and the second feature vector set are input into the migration selection model to obtain the matching degrees between the historical scheme generation request of the newly-built cloud tenant type and each existing scheme generation model output by the migration selection model;

[0083] The to-be-migrated model is determined based on the matching degrees between the historical scheme generation request of the newly-built cloud tenant type and each existing scheme generation model.

[0084] In the process of inputting the first feature vector set into the migration selection model, the feature vector corresponding to the cloud security status description and the feature vector corresponding to the cloud security requirement description in the first feature vector set are respectively input into the migration selection model through different input layers; the second feature vector set is input into the migration selection model through another input layer.

[0085] In a possible implementation, the cloud platform determines the to-be-migrated model based on the matching degree between one of the historical scheme generation requests of the newly-built cloud tenant type and each existing scheme generation model as a reference, and the process can be implemented as follows:

[0086] The existing scheme generation models are sorted based on the matching degrees corresponding to the respective existing scheme generation models to obtain a sorting result;

[0087] Based on the sorting result, the top N scheme generation models with the highest matching degrees are determined as the to-be-migrated models, where N is a positive integer.

[0088] Illustratively, the value of N is 1, that is, the cloud platform determines the to-be-migrated model as the one with the highest matching degree.

[0089] In another possible implementation, the cloud platform determines multiple candidate to-be-migrated models based on the historical scheme generation requests of the newly-built cloud tenant through the above method, and determines the top N ones with the highest number of times of being determined as the candidate to-be-migrated models as the to-be-migrated models, for example, determines the one with the highest number of times of being determined as the candidate to-be-migrated model as the to-be-migrated model.

[0090] In the embodiments of the present application, a pre-trained migration selection model can be configured in the cloud platform, where the process of the migration selection model can be performed in the cloud platform, or can also be performed on other model training devices. Figure 3 A flowchart of the training process of the migration selection model provided by an example embodiment of the present application is shown in FIG. 3. Figure 3 As shown in FIG. 3, the training process of the migration selection model can include:

[0091] S310, obtaining a second training sample set, where the second training sample set includes historical scheme generation requests corresponding to each cloud tenant type, and scheme generation models corresponding to each cloud tenant type.

[0092] Taking the process of the migration selection model in the cloud platform as an example, the cloud platform obtains historical scheme generation requests corresponding to each cloud tenant type, and scheme generation models corresponding to each cloud tenant type from the database.

[0093] S320, iteratively training the migration selection model to be trained based on the second training sample set, to obtain the migration selection model.

[0094] In each iteration training process:

[0095] S321, predicting, by the migration selection model to be trained, matching degrees between historical scheme generation requests of a first cloud tenant type and scheme generation models of each second cloud tenant type based on the historical scheme generation requests of the first cloud tenant type and the scheme generation models corresponding to the second cloud tenant type; the second cloud tenant type is each cloud tenant type other than the first cloud tenant type.

[0096] In the iteration training process, the cloud platform randomly selects one cloud tenant type as the first cloud tenant type, and determines other cloud tenant types as the second cloud tenant type; then, the cloud platform performs text preprocessing on cloud tenant descriptions in each historical scheme generation request of the first cloud tenant type and model information of the scheme generation models corresponding to the second cloud tenant type, to obtain a third feature vector set and a fourth feature vector set corresponding to each historical scheme generation request, where the third feature vector set corresponding to each historical scheme generation request includes a feature vector corresponding to the cloud security status description and a feature vector corresponding to the cloud security requirement description; the fourth feature vector set includes feature vector sets corresponding to each scheme generation model in the second cloud tenant type; then, the corresponding third feature vector and fourth feature vector set are input into the migration selection model to be trained in units of historical scheme generation requests, to predict the matching degrees between each historical scheme generation request of the first cloud tenant type and each scheme generation model of the second cloud tenant type.

[0097] Schematic, the set of feature vectors describing the current state of cloud security generated by various historical schemes can be represented as: V = {v1, v2, ..., v...} N}, where v n This is the feature vector describing the current cloud security status of the nth cloud tenant; the set of feature vectors describing cloud security requirements generated by each historical scheme can be represented as: Q = {q1, q2, ..., q...} T}, where q t Let S be the feature vector describing the cloud security requirements of the t-th cloud tenant. The fourth feature vector set can be represented as S = {s1, s2, ..., s...} M}, where a m It is the feature vector of the model information generated by the m-th scheme.

[0098] The text preprocessing process can include text cleaning and text serialization; illustratively, text cleaning can include unifying letter sizes, converting uppercase letters to lowercase (or lowercase letters to uppercase); text serialization can refer to converting each word in the data into a sequence of integers based on a predefined mapping table, such as: ["qci":40, "imsi":105, "info":8, "update":278, "on":89, "agent":164, "modify":59, "the":21, "type":303, "storage":231,...].

[0099] Furthermore, after obtaining the third and fourth feature vector sets, the cloud platform can use the longest text in the feature vector set corresponding to the description of the current cloud security status as the encoding sequence length SafePresent_length; the longest text in the feature vector set corresponding to the description of cloud security requirements as the encoding sequence length SafeDemand_length; and the longest text in the fourth feature vector set as the encoding sequence length SafeSolution_length.

[0100] Through the above processing, the total dataset for model training can be obtained. When training the model, the total dataset can be divided into a training set and a test set, where the training set is used to train the model and the test set is used to test the training effect of the model. For example, 90% of the total dataset can be divided into a training set and 10% into a test set. This application does not impose any restrictions on the division of the training set and the test set.

[0101] S322, model training is performed on the migration selection model to be trained based on the matching degree between the historical solution generation request of the first cloud tenant type and the solution generation model of each second cloud tenant type and the similarity between the solution generation model of the first cloud tenant type and the solution generation model of the second cloud tenant type.

[0102] In a possible implementation, the migration selection model is a multi-branch deep neural network model built based on a deep learning framework.

[0103] The similarity between the solution generation model of the first cloud tenant type and the solution generation model of the second cloud tenant type can be obtained by manually scoring the similarity of the model-related information of the two, or the similarity between the solution generation model of the first cloud tenant type and the solution generation model of the second cloud tenant type can be obtained by similarity calculation based on the model-related information of the two, where the similarity calculation method can include but is not limited to Euclidean distance, cosine similarity, Manhattan distance, etc.

[0104] During the training process of the migration selection model, the similarity between the models is used as a sample label to train the migration selection model; when the first cloud tenant type has multiple historical solution generation requests, the cloud platform performs model training based on the multiple historical solution generation requests in the first cloud tenant type in turn, and takes one model training iteration process as an example, Figure 4 a schematic diagram of the training process of the migration model provided by an example embodiment of the present application is shown, as shown in Figure 4 After the third feature vector set and the fourth feature vector set of the historical solution generation request are obtained, the feature vectors corresponding to the cloud security status description and the feature vectors corresponding to the cloud security demand description in the third feature vector set and the fourth feature vector set are respectively converted into multiple spatial vectors through the word embedding layer, the feature vectors input after the two are extracted and merged by using the dense layer (Dense) and the dropout layer (Dropout), the similarity between the two is automatically extracted, and finally the predicted matching degree score y i between the historical solution generation request and each existing solution generation model is output; the migration selection model to be trained is model trained based on the request-model matching degree and the model-model similarity, and the model converged after training is used as the model migration selection model in the cloud security protection solution generation method. As shown in Figure 4 The migration selection model includes three parallel input layers, three parallel word embedding layers (embedding), three parallel reshape layers, a merge layer (concatenate), a hidden layer, and an output layer.

[0105] Among them, three parallel input layers input the encoded cloud security status description v of cloud tenant k respectively k , cloud security demand description q of cloud tenant k k , feature vector s of model information of the scheme generation model of each existing cloud tenant type i , that is, the fourth feature vector set;

[0106] Three parallel word embedding layers (embedding), the input data dimensions are set to SafePresent_length, SafeDemand_length, and SafeSolution_length respectively, and the output is set to the size of the vector space that needs to be converted from words, such as 128 dimensions. The role of this layer is to map each word in the input text to a vector (word embeddings), that is, to convert the integer sequence of each word in the text into a fixed shape vector, such as a 128-dimensional vector;

[0107] Three parallel reshape layers are used to convert the data shape from (batch_size, input_length, embedding_size) to (batch_size, embedding_size).

[0108] The merging layer is used to concatenate the space vectors of the three types of data by column dimension.

[0109] The hidden layer includes several fully connected layers and dropout layers, and the neurons in different fully connected layers can be different. Optionally, the activation function used in the fully connected layer can be the "relu" function. A dropout layer is introduced after each fully connected layer to effectively avoid overfitting. Illustratively, the Dropout layer can discard neurons with a probability p and let other neurons remain with a probability q = 1-p. For example, set the discard probability = 0.2, that is, randomly ignore 20% of the neurons to make them ineffective, so as to achieve the effect of avoiding overfitting.

[0110] The output layer contains 1 Dense neuron, and the activation function is set to the "relu" function. After processing the information output by the hidden layer, the matching degree between the predicted scheme generation request of cloud tenant k and each existing scheme generation model can be output.

[0111] In the model training, the cloud platform can calculate the first loss function by the matching degree between the historical scheme generation request of the first cloud tenant type and each scheme generation model of the second cloud tenant type, and the similarity between the scheme generation model of the first cloud tenant type and the scheme generation model of the second cloud tenant type, and adjust the parameters of the migration selection model to be trained based on the function value of the first loss function; illustratively, the first loss function can be a mean squared error (MSE) loss function, which calculates the error between the predicted matching degree and the correct similarity, and the training target is to minimize the error; the first loss function can be represented as:

[0112]

[0113] wherein y i represents the predicted matching degree, i.e. the matching degree between the i th existing scheme generation model and the historical scheme generation request; represents the correct similarity, i.e. the similarity between the i th existing scheme generation model and the scheme generation model corresponding to the historical scheme generation request.

[0114] In the parameter updating of the migration learning selection model, the parameter updating can be performed by a gradient descent optimization algorithm, and illustratively, the gradient descent optimization algorithm can select an adam optimizer for improving the learning speed of the traditional gradient descent. The neural network can find the optimal weight value that minimizes the first loss function by gradient descent, and as the number of training rounds increases, the training error also gradually decreases, and the model gradually converges. After offline training is completed, the calculated neural network weight is exported to obtain the trained migration selection model.

[0115] In step 230, part of the model weights of the model to be migrated are migrated to the scheme generation model to be trained as the initial model weights of the scheme generation model to be trained.

[0116] Illustratively, in the model migration, the cloud platform can migrate the model weights of the model to be migrated except the last fully connected layer to the scheme generation model to be trained as the initial weights of the scheme generation model to be trained, and only the last fully connected layer of the scheme generation model needs to be trained in the subsequent training process; it should be noted that the migration mode of the model weights migrated from the model to be migrated to the scheme generation model to be trained can have different designs based on different training designs, such as migrating the model weights except the last two fully connected layers to the scheme generation model to be trained, etc., which are not limited in the present application.

[0117] In step 240, based on the first training sample set, the model weights of the to-be-trained solution generation model except the initial weights are trained to obtain a solution generation model corresponding to the new cloud tenant type.

[0118] The solution generation model in the embodiments of the present application can be an attention mechanism neural network model built through a deep learning framework. Figure 5 A structural schematic diagram of the solution generation model provided by an example embodiment of the present application is shown in FIG. 5. Figure 5 As shown in FIG. 5, the solution generation model can include a cloud tenant security status feature extractor 510, a cloud tenant security demand feature extractor 520, and a cloud security protection solution generator 530.

[0119] The cloud security status feature extractor 510 extracts features from the cloud security status description obtained from the cloud tenant side by using LSTM; the cloud tenant security demand feature extractor 520 extracts features from the cloud security demand description obtained from the cloud tenant side by using LSTM; and the cloud tenant security protection solution generator 530 focuses on the security demand and security status of the cloud tenant by using an attention neural network.

[0120] For the cloud security status feature extractor 510, the indexed cloud tenant security status description text is input, and each index sequence has a length of SafePresent_length. The shape of the output data of this layer is (None, SafePresent_length). First, the word embedding layer is used to convert each word into a vector. The input data dimension is SafePresent_vocab_size, and the output is set to a certain dimension of spatial vector. The input sequence length is SafePresent_length. Taking 128 dimensions as an example, the shape of the output data of this layer is (None, SafePresent_length, 128). The role of this layer is to map the input words to a certain dimension of fixed shape vector, and convert the index of each word into a certain dimension of fixed shape vector. Then, a plurality of LSTM layers (each layer includes a plurality of LSTM neurons, and the activation function is relu) and a plurality of dropout layers corresponding to the LSTM layers are used to extract the feature vector V of the cloud tenant security status description text.

[0121] For the cloud tenant security demand feature extractor 520, the indexed cloud tenant security demand description text is input, and each index sequence has a length of SafeDemand_length. The shape of the output data of this layer is (None, SafeDemand_length). First, the word embedding layer is used to convert each word into a vector. The input data dimension is SafePresent_vocab_size, and the output is set to convert the word into a certain dimension space vector. The input sequence length is SafeDemand_vocab_size. Taking 128 dimensions as an example, the shape of the output data of this layer is (None, SafeDemand_length, 128). The role of this layer is to map the input word to a certain dimension fixed shape vector, and convert the index of each word into a certain dimension fixed shape vector. Then, a plurality of LSTM layers (each layer contains a plurality of LSTM neurons, and the activation function is relu) and a plurality of dropout layers corresponding to the LSTM layers are used to extract the feature vector Q of the cloud tenant security demand description text.

[0122] For the cloud security protection solution generator 530, the attention mechanism combines the information of the cloud security status and the cloud security demand of the cloud tenant, generates an attention weight for each state attribute of the user, and weights the state attribute information, so as to focus on a specific cloud security demand, and link the cloud security status and the cloud security demand. The model learns to assign greater attention weights to those security statuses that are more relevant to the security demand. The introduction of the attention mechanism enables the model to focus on the relevant part of the input sequence as needed. The attention network assigns an attention weight to each input. The more relevant the input is to the current operation, the closer the attention weight is to 1, and vice versa. These attention weights are recalculated at each output step.

[0123] The cloud security protection solution generator 530 includes two fully connected attention layers. The operation of each layer is as follows: first, the feature vector V of the cloud tenant security status description text and the feature vector Q of the cloud tenant security demand description text are added and input into the fully connected neural network layer, and finally h a is output. a h v is input into the softmax function, and the attention distribution attention v of the cloud tenant security status is output. The formula corresponding to this process is as follows:

[0124]

[0125] attebtion=softmax(W+bh)

[0126] The attention weights are calculated according to the distribution of the attention weights attention i a product of the cloud tenant security status feature vector v i

[0127]

[0128] The output layer is a fully connected (Dense) layer, which contains a number of Dense fully connected neurons equal to SafeSolution_vocab_size, and the activation function is set to "softmax". The softmax output is sent to the multi-class cross-entropy loss function. The shape of the output data of this layer is (None, SafeSolution_vocab_size), which converts the output shape of the attention decoding layer to the final output dimension.

[0129] During the training of the newly created solution generation model, the model weights of each level migrated from the to-be-migrated model are frozen, and the model weights of the unfrozen levels are trained using the first training sample set, i.e.

[0130] The cloud tenant status description and cloud tenant demand description in each historical solution generation request corresponding to the new cloud tenant type are input into the solution generation model to obtain the predicted output of the to-be-trained solution generation model corresponding to each historical solution generation request.

[0131] Based on the predicted output of the cloud security protection solution corresponding to each historical solution generation request and the second loss function corresponding to each historical solution generation request, the model weights other than the initial weights in the to-be-trained solution generation model are trained according to the function value of the second loss function.

[0132] Optionally, the second loss function can be a multi-class cross-entropy (categorical cross-entropy) loss function. The adam optimizer is used to improve the learning speed of traditional gradient descent through gradient descent optimization. The neural network can find the optimal weight value that minimizes the objective function through gradient descent. The neural network learns the weight value autonomously through training. After the model converges, the weight of the model is derived, thereby obtaining a solution generation model corresponding to the new cloud tenant. The solution generation model of the new cloud tenant type is used to generate a corresponding cloud security protection solution in response to a solution generation request of the new cloud tenant type.

[0133] ​In summary, the cloud security protection solution provided by the embodiment of the present application can, when there is a demand for generating a new scheme model, determine a to-be-migrated model from the scheme generation models corresponding to the existing cloud tenant types of the new cloud tenant type through a historical scheme generation request of the new cloud tenant type, train the scheme generation model of the new cloud tenant type by using the to-be-migrated model and a first training sample set with a small sample quantity through transfer learning, and generate a cloud security protection solution corresponding to the scheme request of the new cloud tenant type through the scheme generation model of the new cloud tenant type. Through the above method, the generation of the cloud security protection solution can be automated, and the generation efficiency and accuracy of the cloud security protection solution can be improved. Meanwhile, in the training process of the scheme generation model, the new scheme generation model can be trained through the transfer learning of the existing scheme generation model, so that the model training efficiency can be improved while ensuring the model training effect.

[0134] In the model application stage, Figure 6 A flowchart of a cloud security protection solution provided by an example embodiment of the present application is shown, which can be executed by a cloud platform. The cloud platform can be implemented as a server, as shown in Figure 6 The process can include:

[0135] Step 610, in the case where the target cloud tenant receives the scheme generation request initiated by the target cloud tenant, the cloud tenant type of the target cloud tenant is obtained.

[0136] Step 620, in the case where the cloud tenant type of the target cloud tenant does not exist in the existing cloud tenant types, the scheme generation model corresponding to the cloud tenant type is determined to be trained.

[0137] Step 630, in the case where the cloud tenant type of the target cloud tenant exists in the existing cloud tenant types, the target scheme generation model corresponding to the cloud tenant type of the target cloud tenant is obtained.

[0138] In the case where the cloud tenant type of the target cloud tenant exists in the existing cloud tenant types, the cloud platform can search whether there is a corresponding scheme generation model in the cloud platform by taking the cloud tenant type as an index. Further, if there is, the found scheme generation model is obtained as the target scheme generation model, and if there is not, it can be because the scheme generation model of the cloud tenant type has not been established, such as not reaching the training start condition due to insufficient sample quantity. In this case, the sample accumulation of the cloud tenant type can be continued.

[0139] Step 640, the cloud tenant description in the scheme generation request is input into the target scheme generation model, and the cloud security protection solution generated by the target scheme generation model is obtained.

[0140] That is, in the model application process, when the cloud tenant type of the cloud tenant corresponding to the scheme generation request received by the cloud platform is first appeared, there is no scheme generation model corresponding to the cloud tenant type in the current cloud platform, in this case, the cloud platform can notify the relevant personnel to process the scheme generation request, that is, manually generate the cloud security protection solution corresponding to the scheme generation request, and store the cloud tenant type of the cloud tenant corresponding to the scheme generation request and the corresponding cloud security protection solution, so as to constitute the training sample set corresponding to the cloud tenant type when creating the scheme generation model corresponding to the cloud tenant type; when the cloud tenant type of the cloud tenant corresponding to the scheme generation request received by the cloud platform is not first appeared, and there is a scheme generation model corresponding to the cloud tenant type, the corresponding scheme generation model can be called to automatically generate the cloud security protection solution corresponding to the scheme generation request, thereby improving the generation efficiency of the cloud security protection solution.

[0141] In summary, the cloud security protection solution provided by the embodiment of the application can determine whether there is a scheme generation model corresponding to the cloud tenant type of the cloud tenant when receiving the scheme generation request initiated by the cloud tenant, and automatically generate the corresponding cloud security protection solution by using the scheme generation model when determining that there is a scheme generation model; when determining that there is no scheme generation model, it is determined that the scheme generation model corresponding to the cloud tenant type needs to be trained so as to automatically generate the corresponding cloud security protection solution when subsequently receiving the scheme generation request of the cloud tenant type; by the above method, the generation of the cloud security protection solution can be automated, and the generation efficiency and accuracy of the cloud security protection solution can be improved.

[0142] Figure 7 A block diagram of a cloud security protection solution generation device provided by an example embodiment of the application is shown, which can execute all or part of the steps of any of the embodiments shown in Figure 1 or Figure 2 the above, the device includes: Figure 7

[0143] The first sample set acquisition module 710 is configured to acquire a first training sample set of a scheme generation model to be trained corresponding to a newly created cloud tenant type, and the first training sample set includes each historical scheme generation request corresponding to the newly created cloud tenant type and a historical cloud security protection solution corresponding to each historical scheme generation request.

[0144] The model determination module 720 is configured to determine a model to be migrated by migrating the model based on the historical scheme generation request of the newly created cloud tenant type and the scheme generation model corresponding to each existing cloud tenant type.

[0145] ​The first model training module 730 is configured to train a scheme generation model corresponding to the new cloud tenant type by transfer learning based on the to-be-migrated model and the first training sample set; and the scheme generation model corresponding to the new cloud tenant type is configured to generate a corresponding cloud security protection solution in response to a scheme generation request of the new cloud tenant type.

[0146] In a possible implementation, the model training module comprises:

[0147] The transfer learning sub-module is configured to migrate part of the model weights of the to-be-migrated model to the to-be-trained scheme generation model as initial model weights of the to-be-trained scheme generation model.

[0148] The model training sub-module is configured to train other model weights of the to-be-trained scheme generation model except the initial model weights based on the first training sample set, to obtain the scheme generation model corresponding to the new cloud tenant type.

[0149] In a possible implementation, the apparatus further comprises:

[0150] The second sample set obtaining module is configured to obtain a second training sample set, wherein the second training sample set comprises historical scheme generation requests corresponding to each cloud tenant type and scheme generation models corresponding to each cloud tenant type.

[0151] The second model training module is configured to iteratively train the to-be-trained transfer selection model based on the second training sample set, to obtain the transfer selection model.

[0152] In each iteration training process, the to-be-trained transfer selection model is configured to:

[0153] predict matching degrees between the historical scheme generation request of the first cloud tenant type and each scheme generation model corresponding to a second cloud tenant type based on the historical scheme generation request of the first cloud tenant type and the scheme generation model corresponding to the second cloud tenant type, wherein the second cloud tenant type is each cloud tenant type except the first cloud tenant type.

[0154] train the to-be-trained transfer selection model based on the matching degrees between the historical scheme generation request of the first cloud tenant type and each scheme generation model corresponding to a second cloud tenant type and the similarity between the scheme generation model of the first cloud tenant type and the scheme generation model of the second cloud tenant type.

[0155] In a possible implementation, the historical scheme generation request comprises a cloud tenant description, and the cloud tenant description comprises a cloud tenant status description and a cloud tenant demand description.

[0156] The model determination module 720 comprises:

[0157] A preprocessing submodule is configured to perform text preprocessing on the cloud tenant description in the historical scheme generation request of the new cloud tenant type and model information of each existing scheme generation model, to obtain a first feature vector set corresponding to the cloud tenant description and a second feature vector set containing feature vectors corresponding to each existing scheme generation model; the first feature vector set contains a feature vector corresponding to the cloud security status description and a feature vector corresponding to the cloud security requirement description;

[0158] A matching degree generation submodule is configured to input the first feature vector set and the second feature vector set into the migration selection model, to obtain a matching degree between the historical scheme generation request of the new cloud tenant type and each existing scheme generation model output by the migration selection model.

[0159] A model determination submodule is configured to determine the to-be-migrated model based on the matching degree between the historical scheme generation request of the new cloud tenant type and each existing scheme generation model.

[0160] In a possible implementation, the model determination submodule is configured to sort each existing scheme generation model based on the matching degree corresponding to each existing scheme generation model, to obtain a sorting result.

[0161] Based on the sorting result, the top N scheme generation models with the highest matching degrees are determined as the to-be-migrated models, where N is a positive integer.

[0162] In a possible implementation, the apparatus further comprises:

[0163] A type acquisition module is configured to acquire a cloud tenant type of a target cloud tenant in a case where a scheme generation request initiated by the target cloud tenant is received.

[0164] A sample set creation module is configured to create a first training sample set corresponding to a new cloud tenant type in a case where it is determined that the cloud tenant type of the target cloud tenant does not exist in existing cloud tenant types, the new cloud tenant type being the cloud tenant type of the target cloud tenant.

[0165] The first model training module 730 is configured to train a scheme generation model corresponding to the new cloud tenant type in a case where a sample quantity in the first training sample set reaches a quantity threshold.

[0166] In a possible implementation, the apparatus further comprises:

[0167] The model obtaining module is configured to, in a case where it is determined that the cloud tenant type of the target cloud tenant exists in the existing cloud tenant types, obtain a target scheme generation model corresponding to the cloud tenant type of the target cloud tenant;

[0168] The scheme generation module is configured to input the cloud tenant description in the scheme generation request into the target scheme generation model to obtain the cloud security protection solution generated by the target scheme generation model.

[0169] In summary, the cloud security protection solution device provided by the embodiments of the present application can, when there is a demand for newly creating a scheme generation model, determine a to-be-migrated model from the respective scheme generation models of the existing cloud tenant types through a historical scheme generation request of a newly created cloud tenant type, train the scheme generation model of the newly created cloud tenant type by using the existing to-be-migrated model and a first training sample set with a small number of samples through transfer learning, and generate a cloud security protection solution corresponding to a scheme request of the newly created cloud tenant type through the scheme generation model of the newly created cloud tenant type. The cloud security protection solution device can realize the automation of generating a cloud security protection solution, improve the generation efficiency and accuracy of the cloud security protection solution, and train the newly created scheme generation model through the existing scheme generation model by using the transfer learning method in the training process of the scheme generation model, thereby improving the training efficiency of the model while ensuring the training effect of the model.

[0170] Figure 8 A structural block diagram of a computer device 800 is shown, which is used to illustrate the computer device 800 according to an example embodiment of the present application. The computer device can be implemented as the cloud platform in the above-mentioned schemes of the present application. The computer device 800 includes a central processing unit (CPU) 801, a system memory 804 including a random access memory (RAM) 802 and a read-only memory (ROM) 803, and a system bus 805 connecting the system memory 804 and the central processing unit 801. The computer device 800 further includes a mass storage device 806 for storing an operating system 809, application programs 810 and other program modules 811.

[0171] Without loss of generality, the computer readable medium can include computer storage media and communication media. Computer storage media includes volatile and non-volatile, removable and non-removable media implemented in any method or technology for storage of information such as computer readable instructions, data structures, program modules or other data. Computer storage media includes RAM, ROM, Erasable Programmable Read Only Memory (EPROM), Electrically-Erasable Programmable Read-Only Memory (EEPROM), flash memory or other solid state memory technology, CD-ROM, Digital Versatile Disc (DVD), or other optical disk storage, magnetic cassettes, magnetic tape, magnetic disk storage or other magnetic storage devices. It should be understood by those skilled in the art that computer storage media does not limit to the above-mentioned several types. The system memory 804 and the mass storage device 806 mentioned above can be collectively referred to as memory.

[0172] According to various embodiments of the present disclosure, the computer device 800 can also run on a remote computer connected to a network such as the Internet. That is, the computer device 800 can be connected to a network 808 through a network interface unit 807 connected to the system bus 805, or can be connected to other types of networks or remote computer systems (not shown) using the network interface unit 807.

[0173] The memory further includes at least one instruction, at least one program, a code set or an instruction set, which are stored in the memory, and the central processing unit 801 implements all or part of the steps of the cloud security protection solution generation method shown in the various embodiments by executing the at least one instruction, at least one program, code set or instruction set.

[0174] In an exemplary embodiment, a computer readable storage medium is also provided, in which at least one computer program is stored, the computer program is loaded and executed by the processor to implement all or part of the steps of the cloud security protection solution generation method. For example, the computer readable storage medium can be a Read-Only Memory (ROM), a Random Access Memory (RAM), a Compact Disc Read-Only Memory (CD-ROM), a magnetic tape, a floppy disk and an optical data storage device, etc.

[0175] In an exemplary embodiment, there is also provided a computer program product comprising a computer program stored on a non-transitory computer-readable storage medium, the computer program comprising program instructions that, when executed by a computer, cause the computer to carry out the above-described method. Figure 1 or Figure 2 all or part of the steps of the cloud security protection solution generation method shown in any embodiment.

[0176] Other embodiments of the application will be apparent to those skilled in the art from consideration of the specification and practice of the application disclosed herein. It is intended that the specification and examples be considered as exemplary only, with the true scope and spirit of the application being indicated by the following claims.

[0177] It is to be understood that the application is not limited to the precise details of construction and the exemplary embodiments described above and illustrated in the drawings. Various modifications and changes can be made thereunto without departing from the scope of the application. The scope of the application is indicated by the appended claims, rather than by the embodiments disclosed above.

Claims

1. A cloud security protection solution generation method, characterized by, The method comprises: obtaining a first training sample set of a to-be-trained scheme generation model corresponding to a newly-built cloud tenant type, the first training sample set containing each historical scheme generation request corresponding to the newly-built cloud tenant type and a historical cloud security protection solution corresponding to each historical scheme generation request; determining a to-be-migrated model based on the historical scheme generation request of the newly-built cloud tenant type and the scheme generation models corresponding to the existing cloud tenant types respectively through a migration selection model, the historical scheme generation request containing a cloud tenant description, the cloud tenant description containing a cloud tenant status description and a cloud tenant demand description; training the scheme generation model corresponding to the newly-built cloud tenant type based on the to-be-migrated model and the first training sample set through transfer learning; the scheme generation model corresponding to the newly-built cloud tenant type is used to generate a corresponding cloud security protection solution in response to a scheme generation request of the newly-built cloud tenant type; wherein, the determining of the to-be-migrated model based on the historical scheme generation request of the newly-built cloud tenant type and the scheme generation models corresponding to the existing cloud tenant types respectively through the migration selection model comprises: performing text preprocessing on the cloud tenant description in the historical scheme generation request of the newly-built cloud tenant type and model information of each existing scheme generation model to obtain a first feature vector set corresponding to the cloud tenant description and a second feature vector set containing feature vectors corresponding to each existing scheme generation model; the first feature vector set contains a feature vector corresponding to the cloud security status description and a feature vector corresponding to the cloud security demand description; inputting the first feature vector set and the second feature vector set into the migration selection model to obtain a matching degree between the historical scheme generation request of the newly-built cloud tenant type and each existing scheme generation model output by the migration selection model; determining the to-be-migrated model based on the matching degree between the historical scheme generation request of the newly-built cloud tenant type and each existing scheme generation model.

2. The method of claim 1, wherein, The training of the scheme generation model corresponding to the newly-built cloud tenant type based on the to-be-migrated model and the first training sample set through transfer learning comprises: migrating part of the model weights of the to-be-migrated model to the to-be-trained scheme generation model as initial model weights of the to-be-trained scheme generation model; training other model weights of the to-be-trained scheme generation model except the initial weights based on the first training sample set to obtain the scheme generation model corresponding to the newly-built cloud tenant type.

3. The method of claim 2, wherein, The method further comprises: obtaining a second training sample set, the second training sample set containing historical scheme generation requests corresponding to each cloud tenant type and scheme generation models corresponding to each cloud tenant type; iteratively training the to-be-trained migration selection model based on the second training sample set to obtain the migration selection model; wherein, in the process of each iterative training: predicting, by the migration selection model to be trained, degrees of matching between the historical scheme generation requests of the first cloud tenant type and the scheme generation models corresponding to the second cloud tenant types respectively; the second cloud tenant types are other cloud tenant types than the first cloud tenant type among the cloud tenant types; training the migration selection model to be trained based on the degrees of matching between the historical scheme generation requests of the first cloud tenant type and the scheme generation models corresponding to the second cloud tenant types respectively, and the degrees of similarity between the scheme generation model of the first cloud tenant type and the scheme generation models of the second cloud tenant types.

4. The method of claim 1, wherein, The determining the migration model to be trained based on the degrees of matching between the historical scheme generation requests of the new cloud tenant type and the existing scheme generation models comprises: ordering the existing scheme generation models based on the degrees of matching corresponding to the existing scheme generation models to obtain an ordering result; determining the first N scheme generation models with the highest degrees of matching as the migration model to be trained based on the ordering result, N being a positive integer.

5. The method of claim 1, wherein, The method further comprises: in a case where a scheme generation request initiated by a target cloud tenant is received, obtaining a cloud tenant type of the target cloud tenant; in a case where it is determined that the cloud tenant type of the target cloud tenant does not exist in the existing cloud tenant types, creating a first training sample set corresponding to a new cloud tenant type, the new cloud tenant type being the cloud tenant type of the target cloud tenant; in a case where a sample quantity in the first training sample set reaches a quantity threshold, training a scheme generation model corresponding to the new cloud tenant type.

6. The method of claim 5, wherein, The method further comprises: in a case where it is determined that the cloud tenant type of the target cloud tenant exists in the existing cloud tenant types, obtaining a target scheme generation model corresponding to the cloud tenant type of the target cloud tenant; inputting a cloud tenant description in the scheme generation request into the target scheme generation model to obtain the cloud security protection solution generated by the target scheme generation model.

7. A cloud security protection solution generation apparatus characterized by comprising: The apparatus comprises: a first sample set obtaining module configured to obtain a first training sample set of a scheme generation model to be trained corresponding to a new cloud tenant type, the first training sample set containing historical scheme generation requests corresponding to the new cloud tenant type and historical cloud security protection solutions corresponding to the historical scheme generation requests; a model determining module configured to determine a migration model to be trained by a migration selection model based on historical scheme generation requests of the new cloud tenant type and scheme generation models corresponding to the existing cloud tenant types respectively; the historical scheme generation requests contain cloud tenant descriptions, and the cloud tenant descriptions contain cloud tenant status descriptions and cloud tenant demand descriptions; The first model training module is configured to train a scheme generation model corresponding to the new cloud tenant type by transfer learning based on the to-be-migrated model and the first training sample set; and the scheme generation model corresponding to the new cloud tenant type is configured to generate a corresponding cloud security protection solution in response to a scheme generation request of the new cloud tenant type. The model determination module includes: The preprocessing submodule is configured to perform text preprocessing on cloud tenant descriptions in historical scheme generation requests of the new cloud tenant type and model information of each existing scheme generation model to obtain a first feature vector set corresponding to the cloud tenant descriptions and a second feature vector set containing feature vectors corresponding to each existing scheme generation model; the first feature vector set contains a feature vector corresponding to the cloud security status description and a feature vector corresponding to the cloud security requirement description; The matching degree generation submodule is configured to input the first feature vector set and the second feature vector set into the transfer selection model to obtain matching degrees between the historical scheme generation request of the new cloud tenant type and each existing scheme generation model output by the transfer selection model. The model determination submodule is configured to determine the to-be-migrated model based on the matching degrees between the historical scheme generation request of the new cloud tenant type and each existing scheme generation model.

8. A computer device, comprising: The computer device includes a processor and a memory, and the memory stores at least one computer program, which is loaded and executed by the processor to implement the cloud security protection solution generation method according to any one of claims 1 to 6.

9. A computer-readable storage medium, characterized in that, The computer readable storage medium stores at least one computer program, which is loaded and executed by the processor to implement the cloud security protection solution generation method according to any one of claims 1 to 6.

10. A computer program product, characterised in that, The computer program product includes a computer program stored on a non-transitory computer readable storage medium, and the computer program includes program instructions, which, when executed by a computer, cause the computer to implement the cloud security protection solution generation method according to any one of claims 1 to 6.

Images