A distributed network security early warning method based on cloud computing

Abstract

The present invention discloses a distributed network security early warning method based on cloud computing, which relates to the field of network security technology, including: collecting and processing diversified data in real time and structuredly, constructing an entity relationship graph, combining graph neural network and machine learning model, accurately outputting potential attack early warning signals, dynamically adjusting honeypot strategies, automatically optimizing honeypot behaviors according to early warning levels, such as activity and simulation, to achieve graded response to network threats, introducing a DAG model to analyze the time correlation between nodes, calculating a comprehensive threat score, determining early warning priorities, and designing a response strategy scoring system to guide customized defense measures, thereby significantly enhancing the network security early warning capability and dynamic defense efficiency in a cloud computing environment, and having excellent early warning and response effects to complex and changeable network attacks.

Description

Technical Field

[0001] The present invention relates to the technical field of network security, and in particular to a distributed network security early warning method based on cloud computing. Background Art

[0002] In the context of the rapid development of information technology in recent years, cloud computing has become an indispensable key technology to support modern Internet services with its powerful data processing capabilities and flexible resource allocation advantages. Although the existing network security early warning technology has made certain progress, in the face of increasingly complex and changeable network attack methods, the existing technology has significant limitations. First, the intrusion detection system based on feature matching is susceptible to the attacker's evasion strategy and is difficult to deal with the threat of deformation attacks and zero-day vulnerabilities. Secondly, most existing solutions focus on single-dimensional data analysis and ignore the diversity and correlation of network behavior, resulting in insufficient early warning accuracy and timeliness. In addition, static defense strategies are difficult to adapt to the dynamic changes of attack methods, so that security protection measures often lag behind the development of attacks, reducing the effectiveness of defense. Summary of the invention

[0003] In view of the above existing problems, the present invention is proposed.

[0004] Therefore, the present invention provides a distributed network security early warning method based on cloud computing to solve the problem of effectively identifying and warning complex and changeable network attack behaviors in a cloud computing environment, and dynamically optimizing defense strategies to deal with new threats.

[0005] In order to solve the above technical problems, the present invention provides the following technical solutions:

[0006] In a first aspect, an embodiment of the present invention provides a distributed network security early warning method based on cloud computing, which includes:

[0007] Collect diversified data in real time and convert diversified data into structured data;

[0008] Build an entity relationship graph, combine network behavior analysis algorithms and machine learning models, and output warning signals of potential attack behaviors;

[0009] Dynamically adjust honeypot behavior and response strategies based on warning signals of potential attack behavior.

[0010] As a preferred solution of the distributed network security early warning method based on cloud computing described in the present invention, the diversified data includes system logs, access records and network communication packets.

[0011] As a preferred solution of the distributed network security early warning method based on cloud computing described in the present invention, wherein: constructing an entity relationship graph, the specific operation steps are as follows:

[0012] Extract multivariate data from the data warehouse for analysis, identify and label various entities in the network for interaction;

[0013] Define various types of relationships based on the interaction records between various entities;

[0014] For each specific interaction between a pair of entities, create an edge connecting the nodes of the two entities and give this edge a relationship type label;

[0015] Assign feature vectors to each node and edge, select appropriate data structures to store graph information, and form an entity relationship graph.

[0016] As a preferred solution of the distributed network security early warning method based on cloud computing described in the present invention, the specific operation steps are as follows: constructing a network behavior analysis algorithm and a machine learning model, and calculating anomaly scores:

[0017] Design a graph neural network model and propagate it, update node features, and the expression is:

[0018]

[0019] in, represents the hidden state vector of node v in the kth layer, σ represents the activation function, |N(v)| and |N(u)| represent the number of neighbor nodes of node v and node u respectively, represents the weight matrix of the kth layer for the edge u to v, represents the hidden state vector of the neighbor node u at the k-1th layer, represents the self-connection weight matrix of the kth layer, b k represents the bias term of the kth layer;

[0020] Based on the hidden state node vector of the kth layer, it is converted into anomaly score through linear transformation, and the expression is:

[0021]

[0022] Among them, S represents the abnormality score, W out represents the output layer weight, b out Represents the bias term that adjusts the linear transformation of the output layer.

[0023] As a preferred solution of the distributed network security early warning method based on cloud computing described in the present invention, based on the anomaly score, a DAG model is constructed to perform cross-layer correlation analysis, and a correlation calculation function is designed based on node v and node u, and the expression is:

[0024]

[0025] Among them, w uv represents the association weight between node v and node u, S v,t represents the abnormal score of node v at time t, S u,t represents the abnormal score of node u at time t, represents the average anomaly score of node v, represents the average anomaly score of node u, and T represents the time window length.

[0026] As a preferred solution of the distributed network security early warning method based on cloud computing described in the present invention, the comprehensive threat score of node v is calculated according to the correlation and anomaly score in the DAG model, and the priority of the early warning is determined. The expression is:

[0027]

[0028] Among them, B represents the comprehensive threat score, P(v) represents the set of all nodes of node v, I(v) represents the system importance of node v, represents the abnormal score of node u at time t, represents the direct anomaly score of node v at time t.

[0029] As a preferred solution of the distributed network security early warning method based on cloud computing described in the present invention, the honeypot behavior is dynamically adjusted based on the potential attack behavior early warning signal. The specific operation steps are as follows:

[0030] Low warning threshold (C <C low ): H1(C)=A1,E1,V1,R sen,1 ;

[0031] Among them, T low represents the minimum threshold, H1(C) represents the adjustment of the honeypot behavior parameters according to the early warning signal, A1 represents the minimum activity, E1 represents the simulation degree, V1 represents the trap diversity, and Rsen,1 represents the feedback sensitivity;

[0032] At the low warning threshold, the honeypot maintains the basic configuration without additional adjustments;

[0033] Medium warning zone (C low ≤C <C high ):

[0034] Among them, A2 represents medium activity, E2 represents medium simulation degree, V2 represents medium trap diversity, Rsen,2 represents medium feedback sensitivity, represents the base value at the medium warning level, tanh represents the nonlinear characteristics of controlling growth, represents the control growth rate parameter, T high represents the high warning threshold, ∈0 represents the starting point of fine-tuning growth;

[0035] In the medium warning interval, the honeypot behavior parameters are dynamically adjusted according to the severity T of the warning signal;

[0036] Above the extremely high warning threshold (C ≥ C high ): H3(C)=A max ,E max ,V max ,R sen,max ;

[0037] Among them, A max Indicates the highest activity of the honeypot, E max Indicates the highest simulation level of the honeypot, V max represents the maximum trap diversity, R sen,max Indicates the highest feedback sensitivity;

[0038] Above the very high warning threshold, the honeypot is set to maximum configuration to respond to extremely severe threats.

[0039] As a preferred solution of the distributed network security early warning method based on cloud computing described in the present invention, a response strategy is formulated based on the dynamically adjusted honeypot behavior, and the expression is:

[0040]

[0041] Where R(H(C)) represents the response strategy score based on the honeypot behavior adjustment result, and i represents the behavior parameters A, E, V, R s en, Q i represents the honeypot data feedback quality factor, μ represents the risk control coefficient, n represents the total number of behavior parameters, represents the mean value of the behavioral parameter;

[0042] Specific defense measures are formulated based on the calculated response strategy score.

[0043] In a second aspect, an embodiment of the present invention provides a computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: when the computer program is executed by the processor, any step of the distributed network security early warning method based on cloud computing as described in the first aspect of the present invention is implemented.

[0044] In a third aspect, an embodiment of the present invention provides a computer-readable storage medium having a computer program stored thereon, wherein: when the computer program is executed by a processor, any step of the distributed network security early warning method based on cloud computing as described in the first aspect of the present invention is implemented.

[0045] The beneficial effects of the present invention are as follows: by real-time collection and structured processing of diversified data, an entity relationship graph is constructed, and graph neural networks and machine learning models are combined to accurately output potential attack warning signals. By dynamically adjusting the honeypot strategy, the honeypot behavior is automatically optimized according to the warning level, such as activity and simulation degree, to achieve a graded response to network threats. The DAG model is introduced to analyze the time correlation between nodes, calculate the comprehensive threat score, determine the warning priority, and design a response strategy scoring system to guide customized defense measures, which significantly enhances the network security warning capability and dynamic defense efficiency in the cloud computing environment, and has excellent warning and response effects on complex and changeable network attacks. BRIEF DESCRIPTION OF THE DRAWINGS

[0046] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other accompanying drawings can be obtained based on these accompanying drawings without paying creative work.

[0047] Figure 1 This is a flow chart of the distributed network security early warning method based on cloud computing in Example 1.

[0048] Figure 2 This is the honeypot dynamic behavior warning adjustment diagram in Example 1. DETAILED DESCRIPTION

[0049] In order to make the above-mentioned objects, features and advantages of the present invention more obvious and easy to understand, the specific implementation methods of the present invention are described in detail below in conjunction with the accompanying drawings.

[0050] In the following description, many specific details are set forth to facilitate a full understanding of the present invention, but the present invention may also be implemented in other ways different from those described herein, and those skilled in the art may make similar generalizations without violating the connotation of the present invention. Therefore, the present invention is not limited to the specific embodiments disclosed below.

[0051] Secondly, the term "one embodiment" or "embodiment" as used herein refers to a specific feature, structure, or characteristic that may be included in at least one implementation of the present invention. The term "in one embodiment" that appears in different places in this specification does not necessarily refer to the same embodiment, nor does it refer to a separate or selective embodiment that is mutually exclusive with other embodiments.

[0052] Example 1, reference Figure 1 and Figure 2 , which is the first embodiment of the present invention, and provides a distributed network security early warning method based on cloud computing, comprising the following steps:

[0053] S1. Collect diversified data in real time and convert diversified data into structured data.

[0054] S1.1 Diversified data includes system logs, access records, and network communication packets.

[0055] S1.2 Design scripts to collect and summarize traffic data and security event records every minute;

[0056] Record the average, peak, minimum and event occurrences of traffic every minute, hour and day, and store them in a temporary database;

[0057] At the end of each week, the data statistics script is executed to calculate the average and standard deviation of traffic and events over the past seven days;

[0058] The threshold for dynamic adjustment is determined to be two times the standard deviation, which is used as the criterion for determining abnormal events;

[0059] Write automated scripts to compare current event frequency with thresholds in real time;

[0060] If the current value exceeds the threshold, the collection frequency is dynamically adjusted to a more frequent interval through the API command immediately;

[0061] If the current value remains below the threshold for a period of time (e.g., 2 consecutive hours), the collection frequency is gradually reduced until it returns to the basic setting;

[0062] Developed Python scripts to use regular expressions to extract key information from system logs, including timestamps, event IDs, and source IP addresses;

[0063] Encapsulate the parsed data in JSON format;

[0064] Design the database schema, including fields such as access time, user ID, and access resources;

[0065] Use ETL tools to map access records in different formats into a unified schema and store them in a relational database.

[0066] It should be noted that by collecting diversified data in real time and performing structured conversion, not only can comprehensive monitoring of the network environment and efficient data processing be achieved, but also by dynamically adjusting the collection frequency and data standardization processing, the flexibility of the early warning system, resource utilization and accuracy of anomaly detection are significantly improved, providing a powerful and economical solution for network security protection.

[0067] S2. Build an entity relationship graph, combine network behavior analysis algorithms and machine learning models, and output warning signals of potential attack behaviors.

[0068] S2.1 builds an entity relationship graph. The specific steps are as follows:

[0069] Extract multivariate data from the data warehouse for analysis, identify and label various entities in the network for interaction;

[0070] Define various types of relationships based on the interaction records between various entities;

[0071] For each specific interaction between a pair of entities, create an edge connecting the nodes of the two entities and give this edge a relationship type label;

[0072] Assign feature vectors to each node and edge, select appropriate data structures to store graph information, and form an entity relationship graph.

[0073] S2.2 Build a network behavior analysis algorithm and machine learning model to calculate the anomaly score. The specific steps are as follows:

[0074] Design a graph neural network model and propagate it, update node features, and the expression is:

[0075]

[0076] in, represents the hidden state vector of node v in the kth layer, σ represents the activation function, |N(v)| and |N(u)| represent the number of neighbor nodes of node v and node u respectively, represents the weight matrix of the kth layer for the edge u to v, represents the hidden state vector of the neighbor node u at the k-1th layer, represents the self-connection weight matrix of the kth layer, b k represents the bias term of the kth layer;

[0077] Based on the hidden state node vector of the kth layer, it is converted into anomaly score through linear transformation, and the expression is:

[0078]

[0079] Among them, S represents the abnormality score, W out represents the output layer weight, b out Represents the bias term that adjusts the linear transformation of the output layer.

[0080] S2.3 Based on the anomaly score, a DAG model is constructed to perform cross-layer correlation analysis. The correlation calculation function is designed based on node v and node u. The expression is:

[0081]

[0082] Among them, w uvrepresents the association weight between node v and node u, S v,t represents the abnormal score of node v at time t, S u,t represents the abnormal score of node u at time t, represents the average anomaly score of node v, represents the average anomaly score of node u, and T represents the time window length.

[0083] S2.4 calculates the comprehensive threat score of node v based on the correlation and anomaly score in the DAG model and determines the priority of the warning. The expression is:

[0084]

[0085] Where C represents the comprehensive threat score, P(v) represents the set of all nodes of node v, and I(v) represents the system importance of node v. represents the abnormal score of node u at time t, represents the direct anomaly score of node v at time t.

[0086] It should be noted that by constructing an entity relationship graph and combining it with an algorithm model, network behavior is analyzed and potential attack warnings are achieved. Entity interactions are mapped through the graph, anomalies are captured through the graph neural network, associations are analyzed through the DAG model, and warning priorities are determined through comprehensive scoring. This enhances anomaly detection accuracy and response speed, and optimizes network security defense.

[0087] S3. Dynamically adjust honeypot behavior and response strategies based on potential attack behavior warning signals.

[0088] S3.1 Dynamically adjust the honeypot behavior based on the potential attack behavior warning signal. The specific steps are as follows:

[0089] Low warning threshold (C <C low ): H1(C)=A1,E1,V1,R sen,1 ;

[0090] Among them, C low represents the minimum threshold, H1(C) represents the adjustment of the honeypot behavior parameters according to the early warning signal, A1 represents the minimum activity, E1 represents the simulation degree, V1 represents the trap diversity, and Rsen,1 represents the feedback sensitivity;

[0091] At the low warning threshold, the honeypot maintains the basic configuration without additional adjustments;

[0092] Medium warning zone (C low ≤C <C high ):

[0093] Among them, A2 represents medium activity, E2 represents medium simulation degree, V2 represents medium trap diversity, Rsen,2 represents medium feedback sensitivity, represents the base value at the medium warning level, tanh represents the nonlinear characteristics of controlling growth, represents the control growth rate parameter, T high represents the high warning threshold, ∈0 represents the starting point of fine-tuning growth;

[0094] In the medium warning interval, the honeypot behavior parameters are dynamically adjusted according to the severity T of the warning signal;

[0095] Above the extremely high warning threshold (C ≥ C high ): H3(C)=A max ,E max ,V max ,R sen,max ;

[0096] Among them, A max Indicates the highest activity of the honeypot, E max Indicates the highest simulation level of the honeypot, V max represents the maximum trap diversity, R sen,max Indicates the highest feedback sensitivity;

[0097] Above the very high warning threshold, the honeypot is set to maximum configuration to respond to extremely severe threats.

[0098] S3.1.1 Determine the low warning threshold C low =25%, high warning threshold C high =75%;

[0099] When C < 25%, it indicates that the current network environment is relatively safe and there is no significant sign of abnormal activity. At this time, the honeypot system adopts a conservative strategy, operates at the lowest activity, reduces unnecessary exposure to the outside world, and only maintains necessary monitoring functions;

[0100] When 25%≤C<75%, the honeypot behavior is dynamically adjusted according to the severity of the warning signal to adapt to the potential threats gradually emerging in the network environment. Nonlinear functions such as the tanh function are used to control the smooth growth of the honeypot behavior parameters. The activity and simulation degree of the honeypot are gradually enhanced as the warning signal increases, but the growth rate is finely controlled to avoid drastic fluctuations in resources.

[0101] When C ≥ 75%, it indicates that the network is facing extremely urgent and highly complex threats. At this time, the honeypot system immediately enters the highest alert state, and the configuration parameters are adjusted to maximum activity, maximum simulation degree, maximum trap diversity and highest feedback sensitivity. By simulating the real system to the greatest extent, it attracts and deeply analyzes the attacker's action patterns, quickly collects key information, and triggers the highest level of defense measures, providing the security team with sufficient time and detailed data to formulate response strategies to effectively contain or counter potential serious threats.

[0102] S3.2 calculates the arithmetic mean of the honeypot behavior parameters in real time as the benchmark value, and the expression is:

[0103]

[0104] S3.3 formulates a response strategy based on the dynamically adjusted honeypot behavior, expressed as:

[0105]

[0106] Where R(H(C)) represents the response strategy score based on the honeypot behavior adjustment result, and i represents the behavior parameters A, E, V, R s en, Q i represents the honeypot data feedback quality factor, μ represents the risk control coefficient, n represents the total number of behavior parameters, represents the mean value of the behavioral parameter;

[0107] Specific defense measures are formulated based on the calculated response strategy score.

[0108] It should be noted that according to the intensity of the early warning signal, the activity, simulation degree, trap diversity and feedback sensitivity parameters of the honeypot are intelligently adjusted to achieve dynamic response capabilities to network threats. Through comprehensive scoring, a quantitative evaluation of the effect of honeypot behavior adjustment is achieved, which promotes the precise customization of defense measures, enhances the systematicness and effectiveness of network defense, and improves the ability to respond to complex network threats.

[0109] This embodiment also provides a computer device, which is suitable for the distributed network security early warning method based on cloud computing, including: a memory and a processor; the memory is used to store computer executable instructions, and the processor is used to execute computer executable instructions to implement the distributed network security early warning method based on cloud computing proposed in the above embodiment.

[0110] The computer device may be a terminal, and the computer device includes a processor, a memory, a communication interface, a display screen and an input device connected via a system bus. The processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system and a computer program. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The communication interface of the computer device is used to communicate with an external terminal in a wired or wireless manner, and the wireless manner can be achieved through WIFI, an operator network, NFC (near field communication) or other technologies. The display screen of the computer device may be a liquid crystal display screen or an electronic ink display screen, and the input device of the computer device may be a touch layer covering the display screen, or a key, trackball or touchpad provided on the housing of the computer device, or an external keyboard, touchpad or mouse, etc.

[0111] This embodiment also provides a storage medium on which a computer program is stored. When the program is executed by a processor, the distributed network security early warning method based on cloud computing proposed in the above embodiment is implemented; the storage medium can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (Static Random Access Memory, referred to as SRAM), electrically erasable programmable read-only memory (Electrically Erasable Programmable Read-Only Memory, referred to as EEPROM), erasable programmable read-only memory (Erasable Programmable Read Only Memory, referred to as EPROM), programmable read-only memory (Programmable Red-Only Memory, referred to as PROM), read-only memory (Read-Only Memory, referred to as ROM), magnetic storage, flash memory, magnetic disk or optical disk.

[0112] In summary, the present invention constructs an entity relationship graph by real-time collection and structured processing of diversified data, combines graph neural networks and machine learning models, accurately outputs potential attack warning signals, dynamically adjusts the honeypot strategy, and automatically optimizes the honeypot behavior according to the warning level, such as activity and simulation degree, to achieve a graded response to network threats. The DAG model is introduced to analyze the time correlation between nodes, calculate the comprehensive threat score, determine the warning priority, and design a response strategy scoring system to guide customized defense measures, which significantly enhances the network security warning capability and dynamic defense efficiency in the cloud computing environment, and has excellent warning and response effects on complex and changeable network attacks.

[0113] Example 2

[0114] Referring to Table 1, which is the second embodiment of the present invention, in order to further verify the advancement of the present invention, experimental simulation data of a distributed network security early warning method based on cloud computing is provided.

[0115] First, we extracted and cleaned the above diversified data through the efficient query interface of the data warehouse to ensure the integrity and accuracy of the data. Then, we used advanced graph theory algorithms to identify 10 main entities in the network, recorded the interaction behaviors between them, and defined 20 different types of interaction relationships. Based on this, we constructed an entity relationship graph with 10,000 nodes and 200,000 edges, and each edge was assigned a corresponding interaction type label.

[0116] Next, we designed a 3-layer graph neural network model, in which the hidden layer dimension is set to 128 and the activation function σ adopts ReLU. Through multiple iterative propagation, the node features are updated, and finally the anomaly score is calculated based on the hidden state of the node.

[0117] On this basis, we constructed a directed acyclic graph (DAG) model to perform cross-layer association analysis and calculate the association weights based on the time series anomaly scores between nodes.

[0118] Subsequently, based on the DAG model and anomaly score, we calculated the comprehensive threat score of each node and determined the warning priority. In the experiment, we set a set of thresholds T_low = 0.6, T_high = 0.8 to divide the warning level, and dynamically adjust the honeypot behavior parameters accordingly.

[0119] Finally, based on the dynamic adjustment of honeypot behavior, we developed a response strategy to optimize the comprehensive score of honeypot behavior parameters to ensure the rationality and effectiveness of defense measures at different threat levels.

[0120] The details are shown in the following table:

[0121] Table 1 Experimental record table

[0122]

[0123]

[0124] It can be seen from the above data table that the present invention shows significant innovation and advantages in the simulated network environment. First, the abnormal node detection rate is maintained above 96.5% in different environments, with the highest reaching 98%, which shows that the early warning method has extremely high accuracy and reliability, which is significantly improved compared with the average detection rate of 80% in the prior art.

[0125] Secondly, the significance index of the association weight reflects the excellent ability of the present invention in identifying attack paths. For example, the association weight in environment A is 2.5 times higher than the average, which means that the system can accurately locate potential attack paths, which is crucial for taking timely defensive measures.

[0126] In terms of comprehensive threat scores, although the scores in different environments vary slightly, they remain at a high level overall (0.82-0.88), indicating that the early warning system can effectively distinguish the threat levels of different nodes, provide accurate early warning information to decision makers, and guide the allocation of security resources. The average early warning response time is maintained at around 2.2 seconds, showing a high degree of real-time performance and the ability to respond to threats in a short time. The average honeypot behavior adjustment efficiency is 0.92, proving that the dynamic adjustment strategy can quickly adapt to different warning levels and effectively improve defense efficiency.

Claims

1. A distributed network security early warning method based on cloud computing, characterized in that: include, Collect diversified data in real time and convert diversified data into structured data; Build an entity relationship graph, combine network behavior analysis algorithms and machine learning models, and output warning signals of potential attack behaviors; Dynamically adjust honeypot behavior and response strategies based on warning signals of potential attack behaviors; The specific steps of constructing the entity relationship graph are as follows: Extract multivariate data from the data warehouse for analysis, identify and label various entities in the network for interaction; Define various types of relationships based on the interaction records between various entities; For each specific interaction between a pair of entities, create an edge connecting the nodes of the two entities and give this edge a relationship type label; Assign feature vectors to each node and edge, select appropriate data structures to store graph information, and form an entity relationship graph; Build a network behavior analysis algorithm and machine learning model to calculate anomaly scores. The specific steps are as follows: Design a graph neural network model and propagate it, update node features, and the expression is: in, represents the hidden state vector of node v in the kth layer, σ represents the activation function, |N(v)| and |N(u)| represent the number of neighbor nodes of node v and node u respectively, represents the weight matrix of the kth layer for the edge u to v, represents the hidden state vector of the neighbor node u at the k-1th layer, represents the self-connection weight matrix of the kth layer, b k represents the bias term of the kth layer; Based on the hidden state node vector of the kth layer, it is converted into anomaly score through linear transformation, and the expression is: Among them, S represents the abnormality score, W out represents the output layer weight, b out Represents the bias term that adjusts the linear transformation of the output layer; Based on the anomaly score, a DAG model is constructed to perform cross-layer correlation analysis. The correlation calculation function is designed based on node v and node u. The expression is: Among them, w uv represents the association weight between node v and node u, S v,t represents the abnormal score of node v at time t, S u,t represents the abnormal score of node u at time t, represents the average anomaly score of node v, represents the average anomaly score of node u, and T represents the length of the time window; According to the correlation and anomaly score in the DAG model, the comprehensive threat score of node v is calculated to determine the priority of the warning. The expression is: Among them, B represents the comprehensive threat score, P(v) represents the set of all nodes of node v, I(v) represents the system importance of node v, represents the abnormal score of node u at time t, represents the direct anomaly score of node v at time t; Based on the warning signals of potential attack behaviors, dynamically adjust the honeypot behavior. The specific steps are as follows: Low warning threshold (C <C low ): H1(C)=A1,E1,V1,R sen,1 ; Among them, T low represents the minimum threshold, H1(C) represents the adjustment of the honeypot behavior parameters according to the early warning signal, A1 represents the minimum activity, E1 represents the simulation degree, V1 represents the trap diversity, and Rsen,1 represents the feedback sensitivity; At the low warning threshold, the honeypot maintains the basic configuration without additional adjustments; Medium warning zone (C low ≤C <C high ): Among them, A2 represents medium activity, E2 represents medium simulation degree, V2 represents medium trap diversity, Rsen,2 represents medium feedback sensitivity, represents the base value at the medium warning level, tanh represents the nonlinear characteristics of controlling growth, represents the control growth rate parameter, T high represents the high warning threshold, ∈0 represents the starting point of fine-tuning growth; In the medium warning interval, the honeypot behavior parameters are dynamically adjusted according to the severity T of the warning signal; Above the extremely high warning threshold (C ≥ C high ): H3(C)=A max ,E max ,V max ,R sen,max ; Among them, A max Indicates the highest activity of the honeypot, E max Indicates the highest simulation level of the honeypot, V max represents the maximum trap diversity, R sen,max Indicates the highest feedback sensitivity; Above the extremely high warning threshold, the honeypot uses the maximum configuration to deal with extremely serious threats; Based on the dynamically adjusted honeypot behavior, a response strategy is formulated, which is expressed as: Where r(H(C)) represents the response strategy score based on the honeypot behavior adjustment result, and i represents the behavior parameters A, E, V, R s en, Q i represents the honeypot data feedback quality factor, μ represents the risk control coefficient, n represents the total number of behavior parameters, represents the mean value of the behavioral parameter; Specific defense measures are formulated based on the calculated response strategy score.

2. The distributed network security early warning method based on cloud computing according to claim 1, characterized in that: The diversified data includes system logs, access records and network communication packets.

3. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the distributed network security early warning method based on cloud computing described in any one of claims 1 to 2 are implemented.

4. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the distributed network security early warning method based on cloud computing described in any one of claims 1 to 2 are implemented.

Images