Security protection policy generation method and device, equipment, storage medium and program product

Abstract

The present disclosure provides a security protection strategy generation method, which can be applied to the technical field of big data. The security protection strategy generation method comprises the following steps: collecting N sets of service running data in N historical time windows for a service mesh to be analyzed; determining a behavior mode and a data distribution rule of the N sets of service running data, wherein the data distribution rule comprises a first data distribution rule of the N sets of service running data in a first time period and a second data distribution rule of the N sets of service running data in a second time period; generating a running behavior reference baseline based on the behavior mode, the first data distribution rule and the second data distribution rule; determining abnormal running data based on the running behavior reference baseline and target service running data corresponding to a target time window; and generating a security protection strategy for the service mesh to be analyzed based on the abnormal running data. The present disclosure also provides a security protection strategy generation device, equipment, storage medium and program product.

Description

Methods, apparatus, equipment, storage media, and program products for generating security protection strategies Technical Field

[0001] This disclosure relates to the field of big data, and more specifically to a method, apparatus, device, storage medium, and program product for generating a security protection strategy. Background Technology

[0002] Service mesh is one of the key infrastructure components for enabling cloud-native applications. With the widespread adoption of microservice architecture and containerized deployment, service mesh is increasingly used in various cloud-native scenarios. During the operation of a service mesh, it may encounter certain abnormal operations that could affect its secure operation. These abnormal operations could include zero-day vulnerability attacks, malicious internal actions, etc.

[0003] In realizing the concept disclosed herein, the inventors discovered at least the following problems in the related technologies: Current service mesh security protection is mostly static and passive, typically responding only after abnormal operations occur. Therefore, it cannot proactively and in real-time respond to and predict dynamically changing mesh traffic, topology, and abnormal operations. Existing security protection strategies are usually based on fixed rules pre-configured according to human experience, lacking adaptability to complex environments and novel abnormal operations. Summary of the Invention

[0004] In view of the above problems, this disclosure provides methods, apparatus, equipment, media and program products for generating security protection strategies.

[0005] According to the first aspect of this disclosure, a method for generating a security protection strategy is provided, comprising: collecting N sets of service operation data for a service mesh to be analyzed within N historical time windows; determining the behavioral patterns and data distribution rules of the N sets of service operation data, wherein the data distribution rules include a first data distribution rule of the N sets of service operation data in a first time period and a second data distribution rule of the N sets of service operation data in a second time period, wherein the traffic volume of the service mesh to be analyzed in the first time period is greater than or equal to a first threshold, the traffic volume of the service mesh to be analyzed in the second time period is less than or equal to a second threshold, and the first threshold is greater than the second threshold; generating an operation behavior reference baseline based on the behavioral patterns, the first data distribution rules, and the second data distribution rules; determining abnormal operation data based on the operation behavior reference baseline and the target service operation data corresponding to the target time window; and generating a security protection strategy for the service mesh to be analyzed based on the abnormal operation data.

[0006] According to embodiments of this disclosure, generating a security protection strategy for a service mesh to be analyzed based on abnormal operation data includes: obtaining the architecture information of the service mesh to be analyzed; inputting the abnormal operation data and the architecture information of the service mesh to be analyzed into a decision engine, and outputting multiple initial security protection strategies; determining the correlation between the multiple initial security protection strategies, wherein the correlation is used to characterize whether there is a conflict between the multiple initial security protection strategies; and generating a security protection strategy for the service mesh to be analyzed based on the correlation between the multiple initial security protection strategies.

[0007] According to embodiments of this disclosure, generating a security protection strategy for the service mesh to be analyzed based on the correlation between multiple initial security protection strategies includes: in the event of a conflict between multiple initial security protection strategies, selecting at least one candidate security protection strategy from the multiple initial security protection strategies; and generating a security protection strategy for the service mesh to be analyzed based on the at least one candidate security protection strategy.

[0008] According to embodiments of this disclosure, generating a security protection strategy for the service mesh to be analyzed based on the correlation between multiple initial security protection strategies includes: generating a security protection strategy for the service mesh to be analyzed based on the multiple initial security protection strategies when there is no conflict between them.

[0009] According to embodiments of this disclosure, determining the behavior patterns and data distribution rules of N sets of service operation data includes: inputting N sets of service operation data into a behavior analysis model and outputting the behavior patterns and data distribution rules.

[0010] According to embodiments of this disclosure, determining abnormal operation data based on an operational behavior reference baseline and target service operation data corresponding to a target time window includes: reading historical abnormal operation data from a database; inputting the historical abnormal operation data, the operational behavior reference baseline, and target service operation data corresponding to a target time window into an anomaly identification model; and outputting abnormal operation data.

[0011] According to embodiments of this disclosure, the method for generating a security protection policy further includes: distributing the security protection policy to a policy execution component of the service mesh to be analyzed, so that the policy execution component executes the security protection policy.

[0012] According to embodiments of this disclosure, the method for generating a security protection strategy further includes: obtaining security protection strategy execution result data; and updating the security protection strategy based on the security protection strategy execution data.

[0013] The second aspect of this disclosure provides a security protection strategy generation apparatus, comprising: a data acquisition module for acquiring N sets of service operation data for a service mesh to be analyzed within N historical time windows; a first determination module for determining the behavioral patterns and data distribution rules of the N sets of service operation data, wherein the data distribution rules include a first data distribution rule of the N sets of service operation data in a first time period and a second data distribution rule of the N sets of service operation data in a second time period, wherein the traffic volume of the service mesh to be analyzed in the first time period is greater than or equal to a first threshold, the traffic volume of the service mesh to be analyzed in the second time period is less than or equal to a second threshold, and the first threshold is greater than the second threshold; a first generation module for generating an operation behavior reference baseline based on the behavioral patterns, the first data distribution rules, and the second data distribution rules; a second determination module for determining abnormal operation data based on the operation behavior reference baseline and the target service operation data corresponding to the target time window; and a second generation module for generating a security protection strategy for the service mesh to be analyzed based on the abnormal operation data.

[0014] A third aspect of this disclosure provides an electronic device comprising: one or more processors; and a memory for storing one or more computer programs, wherein the one or more processors execute the one or more computer programs to implement the steps of the method described above.

[0015] A fourth aspect of this disclosure also provides a computer-readable storage medium having a computer program or instructions stored thereon, which, when executed by a processor, implement the steps of the above-described method.

[0016] The fifth aspect of this disclosure also provides a computer program product, including a computer program or instructions that, when executed by a processor, implement the steps of the above-described method.

[0017] According to embodiments of this disclosure, an operational behavior reference baseline is generated based on behavioral patterns, a first data distribution pattern, and a second data distribution pattern. This baseline allows for a comprehensive and integrated analysis of the changing patterns of service operation data and the identification of normal fluctuations in service operation data over specific time periods. This accurately distinguishes between normal periodic changes and genuine abnormal operation data, avoiding misjudging normal periodic changes as abnormal operations. Consequently, a more precise operational behavior reference baseline can be constructed. Furthermore, based on detected abnormal operation data, a security protection strategy is determined for that abnormal operation data, rather than directly adopting a pre-configured security protection strategy based on human experience. This allows for the dynamic generation of security protection strategies to adapt to unknown abnormal operations, improving security protection effectiveness. Therefore, this approach at least partially overcomes the technical problems of existing security protection methods that can only passively wait for abnormal operations to occur before responding, and whose existing security protection strategies often rely solely on fixed rules configured based on human experience, lacking adaptability to complex environments and new attack methods. This achieves the technical effect of timely and proactively detecting abnormal operations, dynamically generating security protection strategies to adapt to unknown abnormal operations, and improving security protection effectiveness. Attached Figure Description

[0018] The foregoing contents, as well as other objects, features, and advantages of this disclosure, will become clearer from the following description of embodiments with reference to the accompanying drawings, in which:

[0019] Figure 1 schematically illustrates an application scenario of a method, apparatus, device, medium, and program product for generating a security protection strategy according to embodiments of the present disclosure;

[0020] Figure 2 schematically illustrates a flowchart of a method for generating a security protection strategy according to an embodiment of the present disclosure;

[0021] Figure 3 schematically illustrates a flowchart of a method for generating a security protection strategy according to another embodiment of the present disclosure;

[0022] Figure 4 schematically illustrates a flowchart of a method for generating a security protection strategy according to another embodiment of the present disclosure;

[0023] Figure 5 schematically illustrates a method for generating a security protection strategy according to another embodiment of the present disclosure;

[0024] Figure 6 schematically illustrates a structural block diagram of a security protection strategy generation apparatus according to an embodiment of the present disclosure; and

[0025] Figure 7 schematically illustrates a block diagram of an electronic device suitable for implementing a method for generating a security protection strategy according to an embodiment of the present disclosure. Detailed Implementation

[0026] The embodiments of the present disclosure will now be described with reference to the accompanying drawings. However, it should be understood that these descriptions are exemplary only and are not intended to limit the scope of the disclosure. In the following detailed description, numerous specific details are set forth to provide a thorough understanding of the embodiments of the present disclosure for ease of explanation. However, it will be apparent that one or more embodiments may be practiced without these specific details. Furthermore, descriptions of well-known structures and techniques are omitted in the following description to avoid unnecessarily obscuring the concepts of the present disclosure.

[0027] The terminology used herein is for the purpose of describing particular embodiments only and is not intended to limit this disclosure. The terms “comprising,” “including,” etc., as used herein indicate the presence of features, steps, operations, and / or components, but do not exclude the presence or addition of one or more other features, steps, operations, or components.

[0028] All terms used herein (including technical and scientific terms) have the meanings commonly understood by those skilled in the art, unless otherwise defined. It should be noted that the terms used herein are to be interpreted in a manner consistent with the context of this specification, and not in an idealized or overly rigid way.

[0029] When using expressions such as "at least one of A, B and C", they should generally be interpreted in accordance with the meaning that is commonly understood by those skilled in the art (e.g., "a system having at least one of A, B and C" should include, but is not limited to, a system having A alone, a system having B alone, a system having C alone, a system having A and B, a system having A and C, a system having B and C, and / or a system having A, B and C, etc.).

[0030] It should be noted that the method and apparatus for generating and determining the security protection strategy disclosed herein can be used in the field of big data technology, or in any field other than the field of big data technology. The application field of the method and apparatus for generating the security protection strategy disclosed herein is not limited.

[0031] It should be noted that in the embodiments disclosed herein, certain software, components, models, and other existing solutions in the industry may be mentioned. These should be considered as exemplary and are intended only to illustrate the feasibility of implementing the technical solutions disclosed herein. However, they do not mean that the applicant has used or necessarily used such solutions.

[0032] In the technical solution disclosed herein, the user information (including but not limited to user personal information, user image information, user device information, such as location information) and data (including but not limited to data used for analysis, stored data, and displayed data) involved are all information and data authorized by the user or fully authorized by all parties. Furthermore, the collection, storage, use, processing, transmission, provision, disclosure, and application of related data all comply with relevant laws, regulations, and standards, necessary confidentiality measures have been taken, and they do not violate public order and good morals. Corresponding operation entry points are provided for users to choose to authorize or refuse.

[0033] In scenarios involving automated decision-making using personal information, the methods, devices, and systems provided in this disclosure all offer users corresponding entry points for choosing to agree to or reject the automated decision-making results. If the user chooses to reject, the process proceeds to the expert decision-making stage. Here, "automated decision-making" refers to the activity of automatically analyzing and evaluating an individual's behavioral habits, interests, or economic, health, and credit status through computer programs, and then making a decision. Here, "expert decision-making" refers to the activity of making decisions by personnel who specialize in a particular field, possess specialized experience, knowledge, and skills, and have reached a certain level of professional expertise.

[0034] The security protection methods of related service meshes are mostly static and passive, and they mainly have the following problems: (1) Related security protection strategies are usually fixed rules pre-configured based on human experience, which lack the ability to adapt to complex environments and new abnormal operations. (2) Most related security protection methods passively wait for abnormal operations to occur and then respond passively based on pre-configured security protection strategies. However, in a highly dynamic service mesh environment, this delayed response cannot prevent and curb abnormal operations in a timely manner.

[0035] In view of this, embodiments of this disclosure provide a method for generating a security protection strategy, comprising: collecting N sets of service operation data for a service mesh to be analyzed within N historical time windows; determining the behavioral patterns and data distribution rules of the N sets of service operation data, wherein the data distribution rules include a first data distribution rule of the N sets of service operation data in a first time period and a second data distribution rule of the N sets of service operation data in a second time period, wherein the traffic volume of the service mesh to be analyzed in the first time period is greater than or equal to a first threshold, the traffic volume of the service mesh to be analyzed in the second time period is less than or equal to a second threshold, and the first threshold is greater than the second threshold; generating an operation behavior reference baseline based on the behavioral patterns, the first data distribution rules, and the second data distribution rules; determining abnormal operation data based on the operation behavior reference baseline and the target service operation data corresponding to the target time window; and generating a security protection strategy for the service mesh to be analyzed based on the abnormal operation data.

[0036] Figure 1 schematically illustrates an application scenario of a method, apparatus, device, medium, and program product for generating a security protection strategy according to embodiments of the present disclosure.

[0037] As shown in Figure 1, the application scenario 100 according to this embodiment may include a first terminal device 101, a second terminal device 102, a third terminal device 103, a network 104, and a server 105. The network 104 serves as a medium for providing a communication link between the first terminal device 101, the second terminal device 102, the third terminal device 103, and the server 105. The network 104 may include various connection types, such as wired or wireless communication links, or fiber optic cables, etc.

[0038] Users can use the first terminal device 101, the second terminal device 102, and the third terminal device 103 to interact with the server 105 via the network 104 to receive or send messages, etc. Various communication client applications can be installed on the first terminal device 101, the second terminal device 102, and the third terminal device 103, such as shopping applications, web browser applications, search applications, instant messaging tools, email clients, social media platform software, etc. (for example only).

[0039] The first terminal device 101, the second terminal device 102, and the third terminal device 103 can be various electronic devices with displays and support web browsing, including but not limited to smartphones, tablets, laptops, and desktop computers.

[0040] Server 105 can be a server that provides various services, such as a backend management server that supports websites browsed by users using the first terminal device 101, the second terminal device 102, and the third terminal device 103 (this is just an example). The backend management server can analyze and process data such as received user requests, and feed back the processing results (such as web pages, information, or data obtained or generated according to user requests) to the terminal devices.

[0041] It should be noted that the method for generating the security protection strategy provided in this embodiment can generally be executed by server 105. Correspondingly, the apparatus for generating the security protection strategy provided in this embodiment can generally be located in server 105. The method for generating the security protection strategy provided in this embodiment can also be executed by a server or server cluster that is different from server 105 and capable of communicating with the first terminal device 101, the second terminal device 102, the third terminal device 103, and / or server 105. Correspondingly, the apparatus for generating the security protection strategy provided in this embodiment can also be located in a server or server cluster that is different from server 105 and capable of communicating with the first terminal device 101, the second terminal device 102, the third terminal device 103, and / or server 105.

[0042] For example, a user can initiate a security protection policy generation request through any one of the first terminal device 101, the second terminal device 102, or the third terminal device 103 (e.g., the first terminal device 101, but not limited thereto). In response to the above request, the server 105 can be used to execute the security protection policy generation method of this disclosure embodiment, including: collecting N sets of service operation data for the service mesh to be analyzed within N historical time windows; determining the behavior patterns and data distribution rules of the N sets of service operation data, the data distribution rules including a first data distribution rule of the N sets of service operation data in a first time period and a second data distribution rule of the N sets of service operation data in a second time period, wherein the service volume of the service mesh to be analyzed in the first time period is greater than or equal to a first threshold, the service volume of the service mesh to be analyzed in the second time period is less than or equal to a second threshold, and the first threshold is greater than the second threshold; generating an operation behavior reference baseline based on the behavior pattern, the first data distribution rule, and the second data distribution rule; determining abnormal operation data based on the operation behavior reference baseline and the target service operation data corresponding to the target time window; and generating a security protection policy for the service mesh to be analyzed based on the abnormal operation data.

[0043] It should be understood that the number of terminal devices, networks, and servers shown in Figure 1 is merely illustrative. Depending on implementation needs, any number of terminal devices, networks, and servers can be included.

[0044] The following will describe in detail the method for generating the security protection strategy according to the embodiments of this disclosure, based on the scenario described in Figure 1 and with reference to Figures 2 to 5.

[0045] Figure 2 schematically illustrates a flowchart of a method for generating a security protection strategy according to an embodiment of the present disclosure.

[0046] As shown in Figure 2, the method for generating the security protection strategy in this embodiment includes operations S210 to S250.

[0047] In operation S210, N sets of service operation data for the service mesh to be analyzed are collected within N historical time windows.

[0048] In operation S220, the behavior patterns and data distribution rules of N sets of service operation data are determined. The data distribution rules include the first data distribution rule of N sets of service operation data in the first time period and the second data distribution rule of N sets of service operation data in the second time period. Among them, the service mesh to be analyzed has a business volume greater than or equal to a first threshold in the first time period, and the service mesh to be analyzed has a business volume less than or equal to a second threshold in the second time period. The first threshold is greater than the second threshold.

[0049] When operating S230, a reference baseline for operational behavior is generated based on behavioral patterns, the first data distribution pattern, and the second data distribution pattern.

[0050] In operation S240, based on the operational behavior reference baseline and the target service operation data corresponding to the target time window, abnormal operation data is determined.

[0051] When operating S250, a security protection policy is generated for the service mesh to be analyzed based on abnormal operation data.

[0052] According to embodiments of this disclosure, in operation S210, a service mesh is an infrastructure layer used to handle inter-service communication. The core components of a service mesh include a control plane and a data plane. The data plane is the data transmission layer of the service mesh, responsible for the actual communication between services. The control plane is the central controller of the service mesh, used to perform functions such as policy distribution, control, and optimization of inter-service communication. Service operation data can be collected from the data plane and control plane of the service mesh to be analyzed. Service operation data may include, for example, traffic logs, monitoring metrics, topology change data, etc.

[0053] According to embodiments of this disclosure, service operation data of the service mesh to be analyzed can be collected in real time during service mesh operation. N historical time windows can include the current moment, and N sets of service operation data can include service operation data generated at the current moment. Based on the real-time collected service operation data, a reference baseline for operational behavior is generated, and then a security protection strategy is generated. This allows for real-time detection of the current state of the service mesh, eliminating the need to passively wait for abnormal operations to occur before implementing protection, thereby achieving real-time security protection for the service mesh. Furthermore, the security protection strategy generated based on the real-time collected service operation data can be dynamically adjusted according to the real-time situation of the service mesh to adapt to rapid changes in the service mesh environment.

[0054] According to embodiments of this disclosure, during operations S220-S230, when the service mesh faces abnormal operations, its service operation data may exhibit abnormal changes. For example, for traffic logs, there may be a sudden surge in traffic or abnormal request patterns; for monitoring metrics, the error rate may increase, and the throughput may decrease. By analyzing the patterns and behaviors of N sets of service operation data, normal service operation data generated when the service mesh is not facing abnormal operations can be determined. Based on this normal service operation data, an operation behavior reference baseline can be generated. The operation behavior reference baseline can be used to determine whether the service mesh is facing abnormal operations at the current moment. For example, when the service mesh's service operation data deviates significantly from the operation behavior reference baseline, it indicates that the service mesh may be facing abnormal operations.

[0055] Specifically, in operating S220, the behavioral patterns of N sets of service operation data across different dimensions can be determined, including service-level behavioral patterns, workload-level behavioral patterns, and user-level behavioral patterns. Service-level behavioral patterns may include, for example, service response time, error rate, and availability; workload-level behavioral patterns may include, for example, the usage of resources such as CPU, memory, and network; and user-level behavioral patterns may include, for example, user behavior paths. By analyzing the behavioral patterns of service operation data across different dimensions, a comprehensive understanding of the operational rules of service operation data across multiple dimensions can be achieved, enabling accurate filtering of normal service operation data.

[0056] It can also determine the data distribution pattern of N sets of service operation data. The data distribution pattern is used to characterize the distribution pattern of service operation data in different time periods. For example, the data distribution pattern can include the first data distribution pattern of N sets of service operation data in the first time period, and the second data distribution pattern in the second time period. The first time period and the second time period can be different time periods of each day, or weekdays or rest days, but are not limited to these. They can also be other types of time periods, such as monthly or yearly scheduled dates, statutory holidays, the end of financial quarters, etc.

[0057] In the first time period, if the workload processed by the service mesh to be analyzed is greater than or equal to a preset first threshold, meaning the workload is excessively high, then the service operation data may exhibit abnormal changes during this period. For example, during weekday morning and evening rush hours, there may be peak traffic; at the end of each month, increased data processing tasks may lead to peak resource usage; and during holidays, the utilization rate of specific services may change due to a significant increase in workload. In these situations, although the service operation data may appear abnormal, these are merely normal periodic changes within a specific time period and do not necessarily indicate any abnormal operation of the service mesh. Therefore, when determining the baseline for operational behavior, it is necessary to fully consider the data distribution patterns of the service operation data within the first time period to avoid incorrectly identifying the service operation data within the first time period as abnormal service operation data.

[0058] In the second time period, the service mesh to be analyzed had a business volume less than or equal to the preset second threshold. In other words, the business volume that the service mesh to be analyzed needed to process in the second time period was relatively normal and there was no excessive business volume. Therefore, if the service operation data may also show abnormal changes in the second time period, it indicates that the service mesh may be facing abnormal operations.

[0059] According to embodiments of this disclosure, an operational behavior reference baseline is generated and determined based on behavioral patterns, a first data distribution pattern, and a second data distribution pattern. This allows for a comprehensive and integrated analysis of the changing patterns of service operation data and the identification of normal fluctuations in service operation data over specific time periods. This accurately distinguishes between normal periodic changes in service operation data and genuine abnormal operation data, avoiding misjudging normal periodic changes as abnormal operations and preventing certain abnormal operations from using specific time-varying trends to evade security detection. As a result, a more accurate operational behavior reference baseline can be constructed, thereby improving the accuracy of security protection strategies.

[0060] According to embodiments of this disclosure, in operation S240, the target time window may be, for example, the current moment. The target service operation data may be, for example, service operation data generated at the current moment. Abnormal operation data may be, for example, service operation data that undergoes abnormal changes when the service mesh is subjected to abnormal operation.

[0061] According to embodiments of this disclosure, based on a baseline of operational behavior and service mesh operational data generated at the current moment, abnormal operational data can be identified, and targeted security protection strategies can be generated for this abnormal operational data. Specifically, the abnormal operation received by the service mesh can be a known abnormal operation or an unknown abnormal operation. A known abnormal operation can be an abnormal operation that has occurred in the past. An unknown abnormal operation can be an abnormal operation that has not yet occurred, such as a zero-day exploit or internal malicious behavior.

[0062] According to an embodiment of this disclosure, in operation S250, abnormal operating data can be analyzed to generate a security protection strategy specifically targeting the abnormal operating data.

[0063] Existing security protection strategies are typically configured based on past experience in dealing with known anomalous operations. When a service mesh faces anomalous operations, pre-configured strategies are usually applied directly. However, these strategies may not be able to handle newly emerging unknown anomalous operations. By identifying the anomalous operational data corresponding to the target service's operational data and generating security protection strategies based on this data, the resulting strategies can specifically protect against the anomalous operations corresponding to the anomalous operational data. Even if the service mesh is attacked by unknown anomalous operations, the security protection strategies, generated based on the anomalous operational data resulting from that attack, can effectively counteract the attack.

[0064] Specifically, security protection strategies may include, for example, traffic control, isolation and mitigation, and vulnerability patching, but are not limited to these. Other types of strategies may also be employed, such as discarding abnormal traffic, triggering application scaling, or redirecting abnormal data to a pre-configured honeypot system. Traffic control may include, for example, rate limiting and redirection; isolation and mitigation may include isolating infected services; and vulnerability patching may include recommending or automatically executing security patches.

[0065] According to embodiments of this disclosure, a reference baseline for operational behavior is determined based on the collected service operation data, and a security protection strategy is determined based on the reference baseline for operational behavior. This allows for timely and proactive detection of abnormal operations. Instead of directly adopting a security protection strategy pre-configured based on human experience, a security protection strategy is determined based on the detected abnormal operational data. This allows for the dynamic generation of security protection strategies to adapt to unknown abnormal operations, thereby improving the effectiveness of security protection.

[0066] According to embodiments of this disclosure, generating a security protection strategy for the service mesh to be analyzed based on abnormal operation data includes operations 11 to 14.

[0067] In operation 11, obtain the service mesh architecture information to be analyzed.

[0068] In operation 12, abnormal operation data is input into the decision engine, which outputs multiple initial security protection policies.

[0069] In operation 13, the correlation between multiple initial security protection strategies is determined. The correlation is used to characterize whether there is a conflict between multiple initial security protection strategies.

[0070] In operation 14, a security protection policy for the service mesh to be analyzed is generated based on the correlation between multiple initial security protection policies.

[0071] According to embodiments of this disclosure, in operation 11, the service mesh architecture information to be analyzed may include the mesh topology information, application dependency information, and context information of the service mesh to be analyzed. Specifically, the structure and connection relationships of the service mesh to be analyzed can be obtained to obtain mesh topology information; the dependency relationships between various services and components in the service mesh to be analyzed can also be obtained to obtain application dependency information; and the system load, resource usage, etc., of the service mesh to be analyzed can also be obtained to obtain context information.

[0072] According to an embodiment of this disclosure, in operation 12, mesh topology information, application dependency information, context information, and abnormal operation data can be jointly input into the decision engine to determine the initial security protection strategy.

[0073] According to embodiments of this disclosure, inputting mesh topology information and application dependency information into the decision engine enables the security protection strategy determination process to fully consider the impact of the service mesh's structure and connectivity, as well as the dependencies between services and components, and to fully assess the overall state of the service mesh, so that the security protection strategy is more adapted to the service mesh's operating state. By inputting context information into the decision engine, the security protection strategy determination process can fully consider the actual operating conditions of the service mesh, thereby enabling the formulation of differentiated strategies based on different operating conditions.

[0074] According to embodiments of this disclosure, the decision engine can analyze the nature and severity of abnormal operations corresponding to the input abnormal operation data, evaluate the effectiveness and impact of different defense strategies, and weigh security requirements and business continuity to determine the initial security protection strategy.

[0075] The decision engine can output multiple initial security protection policies, as well as information such as the execution order and priority of these policies. It can also output the reasons for generating the initial security protection policies to support operations and maintenance personnel in understanding and reviewing the results of automated decisions.

[0076] According to embodiments of this disclosure, in operations 13 and 14, the security protection strategy can be one of multiple initial security protection strategies, or a combination of several initial security protection strategies. Specifically, conflicts may exist between the initial security strategies, which may affect the execution effect of the combined initial security strategies. The existence of conflicts between the initial security protection strategies can be determined based on the correlation between them, thereby determining the security protection strategy from among the multiple initial security protection strategies.

[0077] According to embodiments of this disclosure, based on abnormal operation data and service mesh architecture information to be analyzed, a decision engine dynamically generates security protection strategies for abnormal operation data, rather than directly applying security protection strategies pre-generated based on human experience. This allows for comprehensive consideration of the influence of multiple factors, quickly generating a better defense strategy for abnormal operation data, thereby improving the efficiency and accuracy of security response. Determining security protection strategies based on the decision engine eliminates the need for manual analysis of massive amounts of data and frequent reconfiguration of security strategies to address newly emerging abnormal operations, thus reducing manual workload, improving the accuracy of security protection strategies, and achieving automated configuration of security protection strategies. By inputting real-time generated abnormal operation data into the decision engine, the security protection strategy can be dynamically adjusted according to the real-time situation, adapting to rapid changes in the service mesh environment. This represents a shift from static rules to dynamic intelligent decision-making, enabling the handling of multi-dimensional decision-making problems in complex service mesh environments, better responding to complex and ever-changing security anomalies, and simultaneously balancing security requirements and business continuity, thereby providing adaptive security protection capabilities.

[0078] According to embodiments of this disclosure, specifically, generating a security protection strategy for the service mesh to be analyzed based on the correlation between multiple initial security protection strategies includes: in the event of a conflict between multiple initial security protection strategies, selecting at least one candidate security protection strategy from the multiple initial security protection strategies; and generating a security protection strategy for the service mesh to be analyzed based on the at least one candidate security protection strategy.

[0079] According to embodiments of this disclosure, conflicts between initial security protection strategies can be identified and analyzed, and multiple initial security protection strategies without conflicts can be selected as candidate security protection strategies from among multiple initial security protection strategies. The security protection strategy for the service mesh to be analyzed can be a combination of candidate security protection strategies.

[0080] According to embodiments of this disclosure, specifically, generating a security protection strategy for the service mesh to be analyzed based on the correlation between multiple initial security protection strategies may further include: generating a security protection strategy for the service mesh to be analyzed based on the multiple initial security protection strategies when there is no conflict between them.

[0081] According to embodiments of this disclosure, when there is no conflict between multiple initial security protection strategies, a combination of multiple initial security protection strategies can be used as a security protection strategy for the service mesh to be analyzed.

[0082] According to embodiments of this disclosure, the process of determining security protection strategies fully considers the conflicts between initial security protection strategies, making the generated security protection strategies more adaptable to the overall architecture and actual operation of the service mesh, and ensuring that the security protection strategies can be effectively implemented.

[0083] According to embodiments of this disclosure, determining the behavior patterns and data distribution rules of N sets of service operation data includes: inputting N sets of service operation data into a behavior analysis model and outputting the behavior patterns and data distribution rules.

[0084] According to embodiments of this disclosure, a behavioral analysis model can be constructed based on a recurrent neural network to capture complex time-related patterns. However, it is not limited to this; behavioral patterns and temporal trends of N sets of service operation data can also be determined based on time series analysis, periodic pattern recognition algorithms, etc. Furthermore, service operation data can be input into the behavioral analysis model in real time to generate a real-time operational behavior reference baseline.

[0085] According to embodiments of this disclosure, a behavioral analysis model can automatically generate an operational behavior reference baseline, improving its accuracy and reducing manual workload. By inputting service operation data into the behavioral analysis model in real time to generate the operational behavior reference baseline, abnormal operational data generated at the current moment can be identified in real time. This allows for proactive identification of potential abnormal operations, rather than passively waiting for security events to occur.

[0086] According to embodiments of this disclosure, based on a runtime behavior reference baseline and target service runtime data corresponding to a target time window, abnormal runtime data is determined to include operations 21 to 22.

[0087] In operation 21, historical abnormal operation data is read from the database.

[0088] In operation 22, historical abnormal operation data, operation behavior reference baseline, and target service operation data corresponding to the target time window are input into the abnormal identification model, and abnormal operation data are output.

[0089] According to embodiments of this disclosure, in operation 21, information on abnormal operations that have occurred within a historical time period, i.e., known abnormal operation information, can be collected, and abnormal operation data generated due to known abnormal operations can be collected to obtain historical abnormal operation data. Historical abnormal operation data can be read from a database.

[0090] According to embodiments of this disclosure, in operation 22, the target service operation data can be the service mesh operation data generated at the current moment. The service mesh operation data generated at the current moment can be collected in real time and continuously input into the anomaly detection model, thereby continuously outputting the abnormal operation data generated at the current moment. This enables real-time detection of abnormal operations for timely response.

[0091] According to embodiments of this disclosure, the target service operation data may include service operation data from multiple dimensions, such as network layer, application layer, and user behavior. By inputting multi-dimensional service operation data into an anomaly detection model, comprehensive detection of the service mesh environment can be achieved.

[0092] According to embodiments of this disclosure, since the abnormal operations faced by the service mesh may be abnormal operations that have occurred in the past, by inputting historical abnormal operation data into the anomaly identification model, the abnormal operations that have occurred can be fully referenced and matched, making the identification results more accurate.

[0093] According to embodiments of this disclosure, by inputting a runtime behavior reference baseline into an anomaly identification model, service runtime data that deviates from the runtime behavior reference baseline can be accurately identified, thereby enabling accurate output of abnormal runtime data.

[0094] According to embodiments of this disclosure, anomaly recognition models can be constructed based on artificial intelligence technology, such as supervised learning and unsupervised learning methods.

[0095] According to embodiments of this disclosure, abnormal operation data is determined simultaneously based on historical abnormal operation data, operational behavior reference baselines, and target service operation data. This not only allows for reference to existing experience with abnormal operations but also proactively identifies new and unknown abnormal operations, improving the security protection capabilities of the service mesh environment and enabling it to adapt to dynamic changes in the service mesh environment. Outputting abnormal operation data based on an anomaly identification model achieves intelligent anomaly operation identification. Determining abnormal operation data based on an anomaly identification model reduces manual workload and ensures accurate identification of abnormal operation data.

[0096] According to embodiments of this disclosure, the method for generating the security protection strategy further includes: distributing the security protection strategy to the policy execution component of the service mesh to be analyzed, so that the policy execution component executes the security protection strategy.

[0097] According to embodiments of this disclosure, the data plane of the service mesh consists of a set of lightweight network proxies, such as sidecar proxies (microservice sidecars). Each network proxy is responsible for handling inbound and outbound network requests from its adjacent application containers. Components of the control plane can work collaboratively with the network proxies to configure and manage security policies.

[0098] According to embodiments of this disclosure, the generated security protection policy can be distributed to a policy execution component in the data plane via an application programming interface (API) in the control plane or a custom controller. The policy execution component can be, for example, a network proxy or gateway in the data plane. Upon receiving the security protection policy, the policy execution component can perform security protection operations based on the policy. These operations may include, for example, discarding abnormal traffic, redirecting abnormal data to a pre-configured honeypot system, or triggering application scaling.

[0099] According to embodiments of this disclosure, the method for generating the above-mentioned security protection strategy further includes: obtaining security protection strategy execution result data; and updating the security protection strategy based on the security protection strategy execution data.

[0100] According to embodiments of this disclosure, the security protection policy execution data can be service operation data of the service mesh to be analyzed, generated after the security protection policy is executed. After executing the security protection policy, the impact of abnormal operations can be mitigated to some extent, thus the service operation data will change accordingly; for example, abnormal operation data will decrease. By analyzing the security protection policy execution result data, the execution effect of the security protection policy can be obtained.

[0101] According to embodiments of this disclosure, in order to continuously improve the protective effect of the security protection strategy, the security protection strategy execution data generated at the current moment can be continuously collected, thereby continuously improving and updating the security protection strategy.

[0102] According to embodiments of this disclosure, the decision engine, behavior analysis model, and anomaly detection model can also be updated based on security protection strategy execution data, thereby improving and updating the security protection strategy. Continuously improving each model through a feedback mechanism can enhance the protection capabilities of the security protection model.

[0103] According to embodiments of this disclosure, the database can also be updated based on security protection policy execution data. For example, if it is determined that the abnormal operation received by the service mesh to be analyzed is an unknown abnormal operation, the abnormal operation data corresponding to the unknown abnormal operation can be stored in the database. This allows for real-time updates of historical abnormal operation data in the database. When generating a security protection policy next time, it can fully reference abnormal operations that have occurred within the historical time period, thereby improving the security protection capability of the security protection policy and enhancing its ability to identify new abnormal operations.

[0104] According to the embodiments of this disclosure, most existing security protection methods can only cover one aspect of the security protection process, such as only the anomaly detection aspect or the strategy configuration aspect. Therefore, existing security protection methods lack integrity and closed-loop capability, resulting in the isolation of the functions of each security protection aspect and poor security protection efficiency and coordination.

[0105] By sequentially executing steps such as establishing a baseline for operational behavior, identifying abnormal operational data, implementing security protection strategies, and updating these strategies based on data, each stage of the security protection process can be tightly integrated to form an end-to-end closed-loop security protection process. Furthermore, continuously updating security protection strategies based on data execution enables continuous updates to each stage of the security protection process, forming a self-evolving intelligent security protection system and enhancing security protection capabilities.

[0106] Figure 3 schematically illustrates a flowchart of a method for generating a security protection strategy according to another embodiment of the present disclosure.

[0107] As shown in Figure 3, the method for generating the security protection strategy in this embodiment includes operations S310 to S370.

[0108] When operating S310, service operation data of the data plane and control plane are collected.

[0109] When operating S320, a reference baseline for operational behavior is determined based on a behavior analysis model.

[0110] When operating S330, abnormal operation data is output based on the anomaly identification model.

[0111] When operating the S340, abnormal operation data is input into the decision engine to determine the security protection strategy.

[0112] When operating the S350, the control plane distributes the security protection policy to the policy execution component.

[0113] When operating S360, security protection policies are implemented by the data plane.

[0114] The S370 is used to obtain the security protection policy execution result data, and the security protection policy is updated based on the security protection policy execution result data.

[0115] Figure 4 schematically illustrates a flowchart of a method for generating a security protection strategy according to another embodiment of the present disclosure.

[0116] As shown in Figure 4, the method for generating the security protection strategy in this embodiment includes operations S410 to S470.

[0117] When operating the S410, traffic mirroring and telemetry data are collected.

[0118] When operating the S420, the collected data is input into the behavior analysis model, and the operating behavior reference baseline is output.

[0119] When operating the S430, based on the operational behavior reference baseline, abnormal operational data is output through the anomaly identification model.

[0120] When operating the S440, a security protection strategy is determined through a decision engine based on abnormal operation data.

[0121] When operating the S450, security protection policies are distributed to the control plane through the policy manager.

[0122] When operating S460, the control plane distributes security protection policies to the data plane.

[0123] When operating S470, the data plane security protection policy takes effect, and security protection operations are performed on the service mesh.

[0124] According to embodiments of this disclosure, during operation S410, traffic mirroring and telemetry data can be collected from the control plane and data plane via components such as the Sidecar agent. After collecting the traffic mirroring and telemetry data, the network agent of the service mesh data plane can push the traffic mirroring and telemetry data to the traffic collector and telemetry collector, respectively. The traffic collector is used to capture and analyze data traffic transmitted through the network, while the telemetry collector is used to collect communication data between services. The traffic mirroring and telemetry data may include, for example, traffic logs, monitoring metrics, topology change data, etc.

[0125] According to embodiments of this disclosure, during operations S420-S440, the traffic collector and telemetry collector input the collected data into the behavior analysis model, thereby outputting an operational behavior reference baseline. Based on the operational behavior reference baseline, an anomaly identification model outputs abnormal operational data. Based on the abnormal operational data, a security protection strategy is determined by a decision engine.

[0126] According to an embodiment of this disclosure, in operation S450, a policy manager can be set in the service mesh, which is used to distribute security protection policies to the control plane.

[0127] According to an embodiment of this disclosure, in operation S460, the control plane can distribute security protection policies to the data plane for execution.

[0128] According to an embodiment of this disclosure, in operation S470, the security protection strategy of the data plane takes effect, and security protection operations are performed on the service mesh to form a security protection closed loop.

[0129] According to embodiments of this disclosure, most of the relevant security protection methods are only designed for monolithic architectures, making them difficult to extend and maintain in large-scale service mesh environments and unable to manage increasingly complex mesh topologies and states. Furthermore, existing security protection methods have low functional integration; for example, different security protection methods (such as intrusion prevention systems and threat detection) are typically provided by different vendors, and these methods cannot be efficiently coordinated and orchestrated within a unified framework, thus increasing integration and operational overhead.

[0130] By leveraging the native cloud architecture and injecting components such as policy managers into the data and control planes, and interfacing with the grid lifecycle interface, timely feedback can be obtained and security protection policies can be executed, forming a closed-loop protection system. Furthermore, based on a cloud-native architecture design, it achieves high elasticity and scalability. Adopting cloud-native architectural concepts such as microservices and containers, the security protection process possesses pluggable, dynamically scaled, and version-controlled characteristics, effectively managing and adapting to large-scale, dynamic grid environments.

[0131] Figure 5 schematically illustrates a method for generating a security protection strategy according to another embodiment of the present disclosure.

[0132] As shown in Figure 5, the method for generating the security protection strategy in this embodiment includes operations S510 to S560.

[0133] When operating the S510, traffic mirroring and telemetry data are sent from the data plane.

[0134] When operating S520, the behavioral analysis model determines the operational behavior reference baseline based on traffic mirroring and telemetry data.

[0135] When operating S530, the behavioral analysis model sends a running behavior reference baseline.

[0136] When operating the S540, after receiving the operational behavior reference baseline, the control plane deploys security protection policies.

[0137] When operating the S550, the control plane sends the security protection policy execution result data.

[0138] When operating S560, after receiving the security protection policy execution result data, the behavior analysis model updates the security protection policy.

[0139] According to embodiments of this disclosure, the data plane can continuously send traffic mirroring and telemetry data to the behavior analysis model, enabling the behavior analysis model to determine an operational behavior reference baseline based on the traffic mirroring and telemetry data, and then send the operational behavior reference baseline to the control plane. The control plane can generate and send a security protection policy to the data plane based on the received operational behavior reference baseline. After receiving the security protection policy execution result data returned by the data plane, the behavior analysis model can update the security protection policy based on the security protection policy execution result data.

[0140] Based on the above-described method for generating security protection strategies, this disclosure also provides a device for generating security protection strategies. The device will be described in detail below with reference to Figure 6.

[0141] Figure 6 schematically illustrates a structural block diagram of a security protection strategy generation apparatus according to an embodiment of the present disclosure.

[0142] As shown in Figure 6, the security protection strategy generation device 600 of this embodiment includes a data acquisition module 610, a first determination module 620, a first generation module 630, a second determination module 640, and a second generation module 650.

[0143] The acquisition module 610 is used to acquire N sets of service operation data for the service mesh to be analyzed within N historical time windows. In one embodiment, the acquisition module 610 can be used to perform the operation S210 described above, which will not be repeated here.

[0144] The first determining module 620 is used to determine the behavioral patterns and data distribution rules of N sets of service operation data. The data distribution rules include a first data distribution rule for the N sets of service operation data in a first time period and a second data distribution rule for the N sets of service operation data in a second time period. Specifically, the service mesh to be analyzed has a traffic volume greater than or equal to a first threshold in the first time period, and a traffic volume less than or equal to a second threshold in the second time period. The first threshold is greater than the second threshold. In one embodiment, the first determining module 620 can be used to execute the operation S220 described above, which will not be repeated here.

[0145] The first generation module 630 is used to generate a reference baseline for operational behavior based on behavioral patterns, a first data distribution pattern, and a second data distribution pattern. In one embodiment, the first generation module 630 can be used to perform the operation S230 described above, which will not be repeated here.

[0146] The second determining module 640 is used to determine abnormal operation data based on the operation behavior reference baseline and the target service operation data corresponding to the target time window. In one embodiment, the second determining module 620 can be used to perform the operation S240 described above, which will not be repeated here.

[0147] The second generation module 650 is used to generate a security protection strategy for the service mesh to be analyzed based on abnormal operation data. In one embodiment, the second generation module 650 can be used to perform the operation S250 described above, which will not be repeated here.

[0148] According to embodiments of this disclosure, the second generation module includes an acquisition submodule, a first input submodule, a determination submodule, and a generation submodule.

[0149] The acquisition submodule is used to acquire the service mesh architecture information to be analyzed. The first input submodule is used to input abnormal operation data and service mesh architecture information to be analyzed into the decision engine and output multiple initial security protection policies; the determination submodule is used to determine the correlation between multiple initial security protection policies, and the correlation is used to characterize whether there is a conflict between multiple initial security protection policies; the generation submodule is used to generate security protection policies for the service mesh to be analyzed based on the correlation between multiple initial security protection policies.

[0150] According to embodiments of this disclosure, the generation submodule includes a filtering unit and a first generation unit.

[0151] The filtering unit is used to select at least one candidate security protection strategy from multiple initial security protection strategies when there are conflicts among them; the first generation unit is used to generate a security protection strategy for the service mesh to be analyzed based on at least one candidate security protection strategy.

[0152] According to embodiments of this disclosure, the generation submodule includes a second generation unit.

[0153] The second generation unit is used to generate a security protection policy for the service mesh to be analyzed based on the multiple initial security protection policies, provided that there are no conflicts between them.

[0154] According to embodiments of this disclosure, the first determining module includes a second input submodule.

[0155] The second input submodule is used to input N sets of service operation data into the behavior analysis model and output behavior patterns and data distribution rules.

[0156] According to embodiments of this disclosure, the second determining module includes a reading submodule and an output submodule.

[0157] The reading submodule includes reading historical abnormal operation data from the database; the output submodule includes inputting historical abnormal operation data, operation behavior reference baseline, and target service operation data corresponding to the target time window into the abnormal identification model, and outputting abnormal operation data.

[0158] According to embodiments of this disclosure, the security protection strategy generation apparatus includes a distribution module.

[0159] The distribution module is used to distribute security protection policies to the policy execution components of the service mesh to be analyzed, so that the policy execution components can execute the security protection policies.

[0160] According to embodiments of this disclosure, the apparatus for generating a security protection strategy includes an acquisition module and an update module.

[0161] The acquisition module is used to acquire the execution result data of the security protection policy; the update module is used to update the security protection policy based on the execution data of the security protection policy.

[0162] According to embodiments of this disclosure, any plurality of modules among the acquisition module 610, the first determination module 620, the first generation module 630, the second determination module 640, and the second generation module 650 can be combined into one module, or any one of these modules can be split into multiple modules. Alternatively, at least part of the functionality of one or more of these modules can be combined with at least part of the functionality of other modules and implemented in one module. According to embodiments of this disclosure, at least one of the acquisition module 610, the first determination module 620, the first generation module 630, the second determination module 640, and the second generation module 650 can be at least partially implemented as hardware circuitry, such as a field-programmable gate array (FPGA), a programmable logic array (PLA), a system-on-a-chip, a system-on-a-substrate, a system-on-package, an application-specific integrated circuit (ASIC), or implemented in hardware or firmware by any other reasonable means of integrating or packaging the circuitry, or implemented in any one of the three implementation methods of software, hardware, and firmware, or in a suitable combination of any of these. Alternatively, at least one of the acquisition module 610, the first determination module 620, the first generation module 630, the second determination module 640, and the second generation module 650 can be at least partially implemented as a computer program module, which can perform corresponding functions when the computer program module is run.

[0163] Figure 7 schematically illustrates a block diagram of an electronic device suitable for implementing a method for generating a security protection strategy according to an embodiment of the present disclosure.

[0164] As shown in FIG. 7, an electronic device 700 according to an embodiment of the present disclosure includes a processor 701, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 702 or a program loaded from a storage portion 708 into a random access memory (RAM) 703. The processor 701 may include, for example, a general-purpose microprocessor (e.g., a CPU), an instruction set processor and / or an associated chipset and / or a special-purpose microprocessor (e.g., an application-specific integrated circuit (ASIC)), etc. The processor 701 may also include onboard memory for caching purposes. The processor 701 may include a single processing unit or multiple processing units for performing different actions of the method flow according to an embodiment of the present disclosure.

[0165] RAM 703 stores various programs and data required for the operation of electronic device 700. Processor 701, ROM 702, and RAM 703 are interconnected via bus 704. Processor 701 performs various operations of the method flow according to embodiments of the present disclosure by executing programs in ROM 702 and / or RAM 703. It should be noted that programs may also be stored in one or more memories other than ROM 702 and RAM 703. Processor 701 may also perform various operations of the method flow according to embodiments of the present disclosure by executing programs stored in one or more memories.

[0166] According to embodiments of this disclosure, the electronic device 700 may further include an input / output (I / O) interface 705, which is also connected to a bus 704. The electronic device 700 may also include one or more of the following components connected to the input / output (I / O) interface 705: an input section 706 including a keyboard, mouse, etc.; an output section 707 including a cathode ray tube (CRT), liquid crystal display (LCD), etc., and a speaker, etc.; a storage section 708 including a hard disk, etc.; and a communication section 709 including a network interface card such as a LAN card, modem, etc. The communication section 709 performs communication processing via a network such as the Internet. A drive 710 is also connected to the input / output (I / O) interface 705 as needed. A removable medium 711, such as a disk, optical disk, magneto-optical disk, semiconductor memory, etc., is installed on the drive 710 as needed so that computer programs read from it can be installed into the storage section 708 as needed.

[0167] This disclosure also provides a computer-readable storage medium, which may be included in the device / apparatus / system described in the above embodiments; or it may exist independently and not assembled into the device / apparatus / system. The computer-readable storage medium carries one or more programs that, when executed, implement the method according to the embodiments of this disclosure.

[0168] According to embodiments of this disclosure, the computer-readable storage medium can be a non-volatile computer-readable storage medium, such as including, but not limited to: portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof. In this disclosure, the computer-readable storage medium can be any tangible medium that contains or stores a program that can be used by or in conjunction with an instruction execution system, apparatus, or device. For example, according to embodiments of this disclosure, the computer-readable storage medium may include ROM 702 and / or RAM 703 and / or one or more memories other than ROM 702 and RAM 703 described above.

[0169] Embodiments of this disclosure also include a computer program product comprising a computer program containing program code for performing the methods shown in the flowchart. When the computer program product is run on a computer system, the program code is used to enable the computer system to implement the method for generating security protection strategies provided in the embodiments of this disclosure.

[0170] When the computer program is executed by the processor 701, it performs the functions defined in the system / apparatus of this disclosure embodiments. According to embodiments of this disclosure, the systems, apparatuses, modules, units, etc., described above can be implemented by computer program modules.

[0171] In one embodiment, the computer program may rely on a tangible storage medium such as an optical storage device or a magnetic storage device. In another embodiment, the computer program may also be transmitted and distributed in the form of signals over a network medium, and may be downloaded and installed via the communication section 709, and / or installed from a removable medium 711. The program code contained in the computer program can be transmitted using any suitable network medium, including but not limited to: wireless, wired, etc., or any suitable combination thereof.

[0172] In such an embodiment, the computer program can be downloaded and installed from a network via the communication section 709, and / or installed from the removable medium 711. When the computer program is executed by the processor 701, it performs the functions defined in the system of this disclosure embodiment. According to embodiments of this disclosure, the systems, devices, apparatuses, modules, units, etc., described above can be implemented by computer program modules.

[0173] According to embodiments of this disclosure, program code for executing the computer programs provided in embodiments of this disclosure can be written in any combination of one or more programming languages. Specifically, these computational programs can be implemented using high-level procedural and / or object-oriented programming languages, and / or assembly / machine languages. Programming languages ​​include, but are not limited to, languages ​​such as Java, C++, Python, "C", or similar programming languages. The program code can execute entirely on a user's computing device, partially on a user's device, partially on a remote computing device, or entirely on a remote computing device or server. In cases involving remote computing devices, the remote computing device can be connected to the user's computing device via any type of network, including a local area network (LAN) or a wide area network (WAN), or it can be connected to an external computing device (e.g., via the Internet using an Internet service provider).

[0174] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of this disclosure. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in a block diagram or flowchart, and combinations of blocks in a block diagram or flowchart, may be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.

[0175] Those skilled in the art will understand that the features described in the various embodiments of this disclosure can be combined and / or combined in various ways, even if such combinations or combinations are not explicitly described in this disclosure. In particular, the features described in the various embodiments of this disclosure can be combined and / or combined in various ways without departing from the spirit and teachings of this disclosure. All such combinations and / or combinations fall within the scope of this disclosure.

[0176] The embodiments of this disclosure have been described above. However, these embodiments are for illustrative purposes only and are not intended to limit the scope of this disclosure. Although various embodiments have been described above, this does not mean that the measures in the various embodiments cannot be used advantageously in combination. Various substitutions and modifications can be made by those skilled in the art without departing from the scope of this disclosure, and all such substitutions and modifications should fall within the scope of this disclosure.

Claims

1. A method for generating a security protection strategy, characterized in that, The method includes: collecting N sets of service operation data for the service mesh to be analyzed within N historical time windows; determining the behavioral patterns and data distribution rules of the N sets of service operation data, wherein the data distribution rules include a first data distribution rule of the N sets of service operation data in a first time period and a second data distribution rule of the N sets of service operation data in a second time period, wherein the service mesh to be analyzed has a business volume greater than or equal to a first threshold in the first time period, and a business volume of the service mesh to be analyzed in the second time period is less than or equal to a second threshold, the first threshold is greater than the second threshold, and the first time period includes at least one of the following: a scheduled date each month and / or year, or a holiday; and generating operational behavior based on the behavioral patterns, the first data distribution rules, and the second data distribution rules. A reference baseline is established; based on the operational behavior reference baseline and the target service operation data corresponding to the target time window, abnormal operation data is determined; based on the abnormal operation data, a security protection strategy for the service mesh to be analyzed is generated; wherein, generating a security protection strategy for the service mesh to be analyzed based on the abnormal operation data includes: obtaining the architecture information of the service mesh to be analyzed; inputting the abnormal operation data and the architecture information of the service mesh to be analyzed into a decision engine, and outputting multiple initial security protection strategies; determining the correlation between the multiple initial security protection strategies, wherein the correlation is used to characterize whether there is a conflict between the multiple initial security protection strategies; and generating a security protection strategy for the service mesh to be analyzed based on the correlation between the multiple initial security protection strategies.

2. The method according to claim 1, characterized in that, The step of generating a security protection strategy for the service mesh to be analyzed based on the correlation between the multiple initial security protection strategies includes: in the event of a conflict between the multiple initial security protection strategies, selecting at least one candidate security protection strategy from the multiple initial security protection strategies; and generating a security protection strategy for the service mesh to be analyzed based on the at least one candidate security protection strategy.

3. The method according to claim 1, characterized in that, The step of generating a security protection strategy for the service mesh to be analyzed based on the correlation between the multiple initial security protection strategies includes: generating a security protection strategy for the service mesh to be analyzed based on the multiple initial security protection strategies when there are no conflicts among them.

4. The method according to claim 1, characterized in that, Determining the behavior patterns and data distribution rules of the N sets of service operation data includes: inputting the N sets of service operation data into a behavior analysis model and outputting the behavior patterns and data distribution rules.

5. The method according to claim 1, characterized in that, The step of determining abnormal operation data based on the operation behavior reference baseline and the target service operation data corresponding to the target time window includes: reading historical abnormal operation data from the database; inputting the historical abnormal operation data, the operation behavior reference baseline, and the target service operation data corresponding to the target time window into the abnormal identification model, and outputting the abnormal operation data.

6. The method according to claim 1, characterized in that, The method further includes: distributing the security protection policy to the policy execution component of the service mesh to be analyzed, so that the policy execution component executes the security protection policy.

7. The method according to claim 6, characterized in that, The method further includes: obtaining security protection policy execution result data; and updating the security protection policy based on the security protection policy execution data.

8. A device for generating a security protection strategy, characterized in that, The device includes: a data acquisition module for acquiring N sets of service operation data for a service mesh to be analyzed within N historical time windows; a first determination module for determining the behavioral patterns and data distribution rules of the N sets of service operation data, wherein the data distribution rules include a first data distribution rule of the N sets of service operation data in a first time period and a second data distribution rule of the N sets of service operation data in a second time period, wherein the traffic volume of the service mesh to be analyzed in the first time period is greater than or equal to a first threshold, the traffic volume of the service mesh to be analyzed in the second time period is less than or equal to a second threshold, the first threshold is greater than the second threshold, and the first time period includes at least one of the following: a scheduled date each month and / or year, or a public holiday; and a first generation module for generating an operation behavior reference based on the behavioral patterns, the first data distribution rules, and the second data distribution rules. The system comprises: a baseline; a second determination module, which determines abnormal operation data based on the operational behavior reference baseline and the target service operation data corresponding to the target time window; and a second generation module, which generates a security protection strategy for the service mesh to be analyzed based on the abnormal operation data; wherein the second generation module includes: an acquisition submodule, used to acquire the architecture information of the service mesh to be analyzed; a first input submodule, used to input the abnormal operation data and the architecture information of the service mesh to be analyzed into a decision engine, and output multiple initial security protection strategies; a determination submodule, used to determine the correlation between the multiple initial security protection strategies, the correlation being used to characterize whether there is a conflict between the multiple initial security protection strategies; and a generation submodule, used to generate a security protection strategy for the service mesh to be analyzed based on the correlation between the multiple initial security protection strategies.

9. An electronic device, comprising: One or more processors; A memory for storing one or more computer programs, characterized in that the one or more processors execute the one or more computer programs to implement the steps of the method according to any one of claims 1 to 7.

10. A computer-readable storage medium having a computer program or instructions stored thereon, characterized in that, When the computer program or instructions are executed by a processor, they implement the steps of the method according to any one of claims 1 to 7.

11. A computer program product, comprising a computer program or instructions, characterized in that, When the computer program or instructions are executed by a processor, they implement the steps of the method according to any one of claims 1 to 7.

Images