Cloud platform information digital monitoring system and method based on big data

Abstract

The invention discloses a cloud platform information digital monitoring system and method based on big data, and relates to the technical field of digital monitoring, the system comprises a data acquisition module, a cloud platform, a data analysis module and a security module; the data acquisition module is used for acquiring feature data of a security event; the cloud platform is used for storing feature data of historical security events, non-occurring security events serve as special security events, and the feature data are also stored in the cloud platform; the data analysis module analyzes the type of the security event; the security module processes the security event; by presenting the occurrence probability of various security events, a manager is helped to better understand the security condition of the cloud platform, a basis is provided for processing the security events, the direction of tracking and processing the security events is given to the manager, and potential security problems can be found and solved in time; and processing measures are taken according to different types of security events, so that the security and the stability of the cloud platform are improved.

Description

Technical Field

[0001] The present invention relates to the field of digital monitoring technology, and in particular to a cloud platform information digital monitoring system and method based on big data. Background Art

[0002] A cloud platform is a service platform based on cloud computing technology, which provides various cloud services, including infrastructure, virtualization, cloud platform management system, developer environment, user interface, data storage, security mechanism, etc.; cloud platform can easily help developers, enterprises, etc. to quickly build and manage their own cloud environment and realize resource sharing and optimization; cloud platform has the characteristics of elasticity, scalability, security, stability, and easy management, which can meet the needs of different users; cloud platform security incidents refer to various security issues that occur during the operation of cloud platform, including but not limited to network attacks, system failures, data leakage, etc. Cloud platform security incidents may cause losses to user data and business, so they need to be discovered and resolved in time, and different security incidents have different processing methods. Therefore, how to speed up the identification of cloud platform security incident types has become a problem that needs to be solved. Summary of the invention

[0003] The purpose of the present invention is to provide a cloud platform information digital monitoring system and method based on big data to solve the problems raised in the above background technology.

[0004] In one aspect of the present invention, there is provided a cloud platform information digital monitoring system based on big data, comprising: a data acquisition module, a cloud platform, a data analysis module and a security module; the output end of the data acquisition module is interconnected with the input end of the cloud platform and the data analysis module, so as to obtain characteristic data of security events; the cloud platform and the data analysis module are interconnected to store characteristic data of historical security events, and the characteristic data of a special security event in which no security event has occurred is also stored in the cloud platform; the output end of the data analysis module is interconnected with the input end of the security module, and the type of security event is analyzed based on the characteristic data of the security event, and the analysis result is fed back to the security module; the security module processes the security event according to the type of the security event.

[0005] Specifically, the cloud platform also includes: an infrastructure layer, a virtualization layer, a development layer, an interaction layer, a data layer and a security mechanism layer. The infrastructure layer includes physical hardware resources and software for managing physical hardware; the virtualization layer is used to convert physical hardware resources into virtual resources and run them on the cloud platform; the development layer is used to provide a development environment for various programming languages; the interaction layer is used to interact with users, and users manage their cloud platform accounts through the interaction layer; the data layer is used to store user data and characteristic data of security events; and the security mechanism layer is used to provide a security mechanism to ensure the security of user data.

[0006] Specifically, the data analysis module uses the judgment success rate P{B|C} of all security events as an evaluation indicator, finds the optimal combination of the minimum number of points and the neighborhood radius in the feature data of historical security events through a grid search method, clusters the feature data of current security events using the DBSCAN algorithm, and classifies the probability of occurrence of various types of security events.

[0007] Specifically, the security module also stores processing records of various security events. When the security module receives the analysis results generated by the data analysis module, it finds the identification, tracking and processing methods of the corresponding security events from the processing records.

[0008] In another aspect of the present invention, a method for digital monitoring of cloud platform information based on big data is provided, comprising the following steps:

[0009] S5-1, obtain characteristic data of security events from the cloud platform in real time;

[0010] S5-2, clustering the characteristic data of the current security event based on the characteristic data of the security event;

[0011] S5-3, if the characteristic data of the current security event is an outlier, a full range of detection and processing methods are adopted to process all and return to step S5-1; if the characteristic data of the current security event is not an outlier, the probability of correctly predicting the occurrence of various types of security events is determined based on the clustering results, and the security module identifies them one by one in order of probability from high to low, and executes different processing methods for different security events, and returns to step S5-1.

[0012] In step S5-2, clustering the characteristic data of the current security event specifically includes the following steps:

[0013] S6-1, the characteristics of security events are recorded as A1, A2, ...A n , n is the number of security event features;

[0014] S6-2, set the search range of the minimum number of points MinPts and the neighborhood radius Eps required by the DBSCAN algorithm, and use the grid search method to find the best combination of the minimum number of points and the neighborhood radius in the search range of the minimum number of points and the neighborhood radius. Evaluate the combination effect; where the value range of j is a positive integer between the interval [1, v], and v is the number of feature data of security events in the historical data; for the jth feature data of security events in the historical data, It indicates that the i-th security event will occur, C i Indicates that the i-th security event occurs; It represents the probability of the occurrence of the i-th security event and the successful prediction of the i-th security event. The value range of i is a positive integer between the interval [0, m], and m is the total number of security event types. It indicates that the security incident is predicted not to occur, and C0 indicates that the security incident has not occurred; It indicates the probability that a security incident will not actually occur after the security incident is predicted not to occur. The non-occurrence of a security incident is regarded as a special security incident and analyzed together with all security incidents.

[0015] S6-3, with A1, A2, ...A n As input, the optimal minimum number of points and neighborhood radius combination are used as parameters, and the DBSCAN algorithm is used to cluster the feature data of current security events.

[0016] In step S6-2, evaluating the combination effect specifically includes the following steps:

[0017] S7-1, determine the characteristic data D of security events occurring in v historical data j The cluster to which it belongs;

[0018] S7-2, for each characteristic data D of S7-1 j , calculate the other feature data in the cluster and D j The Euclidean distance between The value range of k A positive integer between is the characteristic data D j In the cluster, except for D j The total number of other characteristic data other than ;

[0019] The feature data in the same cluster are highly similar, but not completely the same. The other feature data in the cluster are similar to the feature data D j The smaller the distance, the higher the similarity, and the greater the impact on the security incident judgment result;

[0020] S7-3, calculation k0, k1, ... k m The value range is the interval subintervals, k1, …k m There is no overlap with the value range of k0, k1, ...k m The value range within is allowed to overlap; Indicates characteristic data D j The characteristic data of the clusters to which no security incidents occurred and D j The Euclidean distance between Represents the characteristic data D j The characteristic data of the first to mth security events in the cluster to which it belongs and D j The Euclidean distance between

[0021] The characteristic data of no security incidents and the characteristic data of security incidents are mutually exclusive and there is no possibility of overlap; and when multiple security incidents occur at the same time, only one characteristic data will be generated. j may be related to multiple security events, so k1, …k m The value range within is allowed to overlap;

[0022] S7-4, calculate It indicates the probability of predicting the occurrence of the i-th security event. represents the probability that the i-th security incident actually occurs, It indicates the probability of predicting the occurrence of the i-th security event and the i-th security event actually occurring; Determined by historical data, its value is the ratio of the number of characteristic data of the i-th security event occurring in the historical data to the total number of characteristic data in the historical data;

[0023] When analyzing a feature data, the security events corresponding to the other v-1 feature data are known, and the feature data being analyzed is unknown. It is necessary to use other feature data to determine the probability of occurrence of each security event based on the clustering results;

[0024] S7-5, all v characteristic data corresponding to the security event Take the average value and get the judgment success rate P{B i |C i}, the judgment success rate P{B i |C i} Take the average value to get the judgment success rate P{B|C} of all security events, which is used as the evaluation index of clustering results;

[0025] Each feature data has a success rate for the i-th security event The average value is taken to get the overall judgment success rate of all feature data; each security event has a judgment success rate, and the average value is taken to get the judgment success rate of all security events;

[0026] In step S7-4, Determined by:

[0027] S8-1, for each feature data WD of all classification clusters b , b is the interval [1,Q D ] positive integer, Q D is the total number of feature data in all classification clusters, WD b Instead of D j Execute steps S7-1, S7-2 and S7-3, and follow the steps in step S7-4. The calculation formula is calculated

[0028] S8-2, calculate Y b The value is 0 or 1. When the characteristic data WD b If it is indeed the characteristic data of the i-th security event, Y b is 1, otherwise Y b is 0; when When it is less than the threshold, Set to zero and do not substitute into the formula for calculation;

[0029] Usually calculated The formula is y1 / y2, y2 is the number of feature data that predicts the occurrence of the i-th security event, and y1 is the number of feature data that actually occurs in the feature data that predicts the occurrence of the i-th security event; in the present invention, the occurrence rate of security events is represented by probability, and a simple yes or no judgment is not used, so the formula is used Calculate, each characteristic data gives the probability of occurrence of the i-th security event Add all the probabilities together to get the denominator. If a security incident does occur, add the probability of the security incident to the numerator, rather than adding one to the numerator every time a correct prediction is made.

[0030] when When it is less than the threshold, it is not substituted into the formula for calculation. At this time, for the ith security event, the clustering distinction effect is better. For example, in a cluster with 1000 feature data, there is only one feature data of the ith security event, which means that the clustering model at this time distinguishes the feature data of the ith security event better. At this time, the probability of the ith security event calculated for other feature data in the same cluster will be very low, which will make The calculation result becomes worse, so when When it is less than the threshold, it is not substituted into the formula for calculation.

[0031] S9-1, take k=2n-1, calculate the distance from each feature data point to other data points, find the distance from each feature data point to the point closest to it, sort these distances from large to small, and plot them in a rectangular coordinate system to obtain a kdistance graph, where the ordinate is the calculated distance and the abscissa represents the order of the calculated distances;

[0032] S9-2, find the ordinate corresponding to the inflection point in the graph as the initial value Eps0 of the neighborhood radius; take k+1 as the initial value MinPts0 of the minimum number of points;

[0033] S9-3, expand the interval with Eps0 and MinPts0 as the midpoints to obtain two expanded intervals as the search range of the minimum number of points MinPts and the neighborhood radius Eps.

[0034] The grid search method is used to find the optimal combination of the minimum number of points and the neighborhood radius in the search range of the minimum number of points and the neighborhood radius, which specifically includes the following steps:

[0035] S91, within the search range of the minimum number of points MinPts and the neighborhood radius Eps, determine all possible combinations of the minimum number of points and the neighborhood radius, where the minimum number of points is a positive integer within the search range of the minimum number of points; take Eps0 as the base point, and gradually move toward the upper and lower bounds of the search range of the neighborhood radius according to the set step size to obtain all values ​​of the neighborhood radius;

[0036] S92, for different combinations of minimum number of points and neighborhood radius, using the characteristic data of historical security events as input, executing the DBSCAN algorithm, and using the judgment success rate P{B|C} of all security events as the evaluation standard of the combination effect;

[0037] S93, selecting the combination of the minimum number of points and the neighborhood radius with the highest judgment success rate P{B|C} value of all security events as the best combination.

[0038] In step S5-3, the probability of correctly predicting the occurrence of various security events is determined based on the clustering results, including the following steps:

[0039] The feature data of the current security event is recorded as x, and taken together with the feature data of the historical security events as input, DBSCAN clustering is performed with the optimal combination parameters of the minimum number of points and the neighborhood radius;

[0040] Replace D with x j Execute steps S7-1, S7-2, S7-3 and S7-4 to calculate It means that the i-th security event currently occurs, and the characteristic data x is generated. The probability of the i-th security event occurring is successfully determined through the characteristic data x of the current security event.

[0041] Compared with the prior art, the beneficial effects achieved by the present invention are: by presenting the probability of occurrence of various security incidents, it helps managers to better understand the security status of the cloud platform, so as to timely discover and solve potential security problems; it provides a basis for the handling of security incidents, gives administrators the direction to track and handle security incidents, and is conducive to timely discovering and solving potential security problems; according to different types of security incidents, corresponding processing measures are taken in a timely manner to improve the security and stability of the cloud platform; through the analysis and classification of security incidents, outliers may be caused by new security issues, which is conducive to discovering new security problems and technical challenges, and providing a more targeted direction for security research and development. BRIEF DESCRIPTION OF THE DRAWINGS

[0042] The accompanying drawings are used to provide a further understanding of the present invention and constitute a part of the specification. Together with the embodiments of the present invention, they are used to explain the present invention and do not constitute a limitation of the present invention. In the accompanying drawings:

[0043] Figure 1 It is a structural schematic diagram of a cloud platform information digital monitoring system based on big data according to an embodiment of the present invention. DETAILED DESCRIPTION

[0044] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0045] In the embodiments of the present invention, please refer to Figure 1 , provides a cloud platform information digital monitoring system based on big data, including: a data acquisition module, a cloud platform, a data analysis module and a security module; the output end of the data acquisition module is interconnected with the input end of the cloud platform and the data analysis module to obtain characteristic data of security events; the cloud platform and the data analysis module are interconnected to store characteristic data of historical security events, and the absence of security events is regarded as a special security event, and the characteristic data is also stored in the cloud platform; the output end of the data analysis module is interconnected with the input end of the security module, and the type of security events is analyzed based on the characteristic data of the security events, and the analysis results are fed back to the security module; the security module performs processing on the security events according to the type of the security events.

[0046] The cloud platform also includes: an infrastructure layer, a virtualization layer, a development layer, an interaction layer, a data layer, and a security mechanism layer. The infrastructure layer includes physical hardware resources and software for managing physical hardware; the virtualization layer is used to convert physical hardware resources into virtual resources and run them on the cloud platform; the development layer is used to provide a development environment for various programming languages; the interaction layer is used to interact with users, and users manage cloud platform accounts through the interaction layer; the data layer is used to store user data and feature data of security events; the security mechanism layer is used to provide a security mechanism to ensure the security of user data;

[0047] The data analysis module uses the judgment success rate P{B|C} of all security events as the evaluation index, finds the optimal combination of the minimum number of points and the neighborhood radius through the grid search method in the feature data of historical security events, clusters the feature data of current security events with the DBSCAN algorithm, and classifies the probability of occurrence of various security events;

[0048] The security module also stores processing records of various security events. When the security module receives the analysis results generated by the data analysis module, it finds the identification, tracking and processing methods of the corresponding security events from the processing records.

[0049] In an embodiment of the present invention, a method for digital monitoring of cloud platform information based on big data is provided, comprising the following steps:

[0050] S5-1, the analysis module obtains characteristic data of security events from the cloud platform in real time;

[0051] S5-2, clustering the characteristic data of the current security event based on the characteristic data of the security event; specifically comprising the following steps:

[0052] The characteristics of security events are recorded as A1, A2, ...A n , n is the number of security event features, the features of security events include but are not limited to the number of unauthorized accesses A1, network traffic A2, the number of unauthorized processes A3, the network connection speed A4 and the device response speed A5; since the DBSCAN algorithm is not suitable for processing high-dimensional data, when the number of features of security events is large, the features can be reduced in dimension by using data dimensionality reduction methods such as principal component analysis and discriminant analysis; the number of unauthorized accesses A1, network traffic A2, the number of unauthorized processes A3, the network connection speed A4 and the device response speed A5 are normalized respectively as the input of the algorithm; the types of security events include but are not limited to network attack events, system failure events and user behavior events;

[0053] Set the search range of the minimum number of points MinPts and neighborhood radius Eps required by the DBSCAN algorithm, and use the grid search method to find the best combination of the minimum number of points and neighborhood radius in the search range of the minimum number of points and neighborhood radius. Evaluate the combination effect; where the value range of j is a positive integer between the interval [1, v], and v is the number of feature data of security events in the historical data; for the jth feature data of security events in the historical data, It indicates that the i-th security event will occur, C i Indicates that the i-th security event occurs; It represents the probability of the occurrence of the i-th security event and the successful prediction of the i-th security event. The value range of i is a positive integer between the interval [0,3]. It indicates that the security incident is predicted not to occur, and C0 indicates that the security incident has not occurred; It indicates the probability that a security incident will not actually occur after the security incident is predicted not to occur. The non-occurrence of a security incident is regarded as a special security incident and analyzed together with all security incidents.

[0054] With A1, A2, ...A5 as input and the optimal minimum number of points and neighborhood radius combination as parameters, the DBSCAN algorithm is used to cluster the feature data of the current security event;

[0055] Setting the minimum number of points MinPts and the search range of the neighborhood radius Eps required by the DBSCAN algorithm also includes the following steps:

[0056] S9-1, take k=9, calculate the distance from each feature data point to other data points, find the distance from each feature data point to the 9th closest point, sort these distances from large to small, and plot them in a rectangular coordinate system to obtain a kdistance graph, where the ordinate is the calculated distance and the abscissa represents the order of the calculated distances;

[0057] S9-2, find the ordinate corresponding to the inflection point in the figure as the initial value Eps0 of the neighborhood radius; take 10 as the initial value MinPts0 of the minimum number of points;

[0058] S9-3, expand the interval with Eps0 and MinPts0 as the midpoints to obtain two expanded intervals as the search ranges of the minimum number of points MinPts and the neighborhood radius Eps; the search range of the neighborhood radius can be taken as [0.5Eps0,1.5Eps0], and the search range of the minimum number of points MinPts can be taken as [5,15]. The search range can be adjusted according to actual needs;

[0059] The grid search method includes the following steps:

[0060] S91, within the search range of the minimum number of points MinPts and the neighborhood radius Eps, determine all possible combinations of the minimum number of points and the neighborhood radius, the minimum number of points is all positive integers within the minimum number of points search range; take Eps0 as the base point, gradually move toward the upper and lower bounds of the search range of the neighborhood radius according to the set step size, and obtain all values ​​of the neighborhood radius. When the step size is set to 0.1Eps0, the value range of the neighborhood radius is {0.5Eps0, 0.6Eps0, ... 1.5Eps0};

[0061] S92, for different combinations of minimum number of points and neighborhood radius, using the characteristic data of historical security events as input, executing the DBSCAN algorithm, and using the judgment success rate P{B|C} of all security events as the evaluation standard of the combination effect;

[0062] S93, selecting a combination of the minimum number of points and the neighborhood radius with the highest judgment success rate P{B|C} value of all security events as the best combination;

[0063] The judgment success rate P{B|C} of all security events is determined in the following way:

[0064] S7-1, determine the characteristic data D of security events occurring in v historical data j The cluster to which it belongs;

[0065] S7-2, for each characteristic data D of S7-1 j , calculate the other feature data in the cluster and D j The Euclidean distance between The value range of k A positive integer between is the characteristic data D j In the cluster, except for D j The total number of other characteristic data other than ;

[0066] S7-3, calculation k0, k1, ... k m The value range is the interval subintervals, k1, …k m There is no overlap with the value range of k0, k1, ...k m The value range within is allowed to overlap; Indicates characteristic data D j The characteristic data of the clusters to which no security incidents occurred and D j The Euclidean distance between Represents the characteristic data D j The characteristic data of the first to mth security events in the cluster to which it belongs and D j The Euclidean distance between

[0067] S7-4, calculate It indicates the probability of predicting the occurrence of the i-th security event. represents the probability that the i-th security incident actually occurs, It indicates the probability of predicting the occurrence of the i-th security event and the i-th security event actually occurring; Determined by historical data, its value is the ratio of the number of feature data of the i-th security incident in the historical data to the total number of feature data in the historical data; if there are 1000 security feature data in the cloud platform, of which 5 security feature data are generated when the i-th security incident occurs, then

[0068] Determined by the following steps S8-1 and S8-2,

[0069] S8-1, for each feature data WD of all classification clusters b , b is the interval [1,Q D ] positive integer, Q D is the total number of feature data in all classification clusters, WD b Instead of D j Execute steps S7-1, S7-2 and S7-3, and follow the steps in step S7-4. The calculation formula is calculated

[0070] If there are 3 clusters, and each cluster has 100 feature data, then Q D is 300, and the value range of b is [1,300]. For the first feature data in the first cluster, b is 1 at this time. The Euclidean distance between the other 99 feature data in the first cluster and the first feature data is calculated to obtain dis(1), dis(2), ... dis(99). If among these 99 feature data, feature data 1-80 are generated when a network attack occurs, feature data 81-90 are generated when a system failure occurs, and feature data 91-99 are generated when a user behavior occurs, then the calculated values ​​are respectively Then calculate and For all the feature data in the three clusters, calculate in a similar way and

[0071] S8-2, calculate Y bThe value is 0 or 1. When the characteristic data WD b If it is indeed the characteristic data of the i-th security event, Y b is 1, otherwise Y b is 0; when When it is less than the threshold, Set to zero and do not substitute into the formula for calculation; the threshold is set to a smaller number according to the situation;

[0072] S7-5, all v characteristic data corresponding to the security event Take the average value and get the judgment success rate P{B i |C i}, the judgment success rate P{B i |C i} Take the average value to get the judgment success rate P{B|C} of all security events, which is used as the evaluation index of clustering results;

[0073] S5-3, if the characteristic data of the current security event is an outlier, a comprehensive detection and processing method is adopted, and all processing is returned to step S5-1; if the characteristic data of the current security event is not an outlier, the probability of correctly predicting the occurrence of various security events is determined according to the clustering result, and the security module identifies them one by one in order from high to low probability, and performs different processing methods for different security events, and returns to step S5-1;

[0074] The feature data of the current security event is recorded as x, and taken together with the feature data of historical security events as input, DBSCAN clustering is performed with the optimal combination parameters of the minimum number of points and neighborhood radius;

[0075] Replace D with x j Execute steps S7-1, S7-2, S7-3 and S7-4 to calculate It means that the i-th security event has occurred, and the characteristic data x is generated. The probability of the i-th security event occurring is successfully determined through the characteristic data x of the current security event. It has nothing to do with x, but only with j and the data distribution in the cloud platform; and The same, has nothing to do with x or j, only with i, because and is obtained through all feature data in the cloud platform; after obtaining the cluster to which x belongs through DBSCAN clustering, calculate You can get The calculation method of same.

[0076] It should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device.

[0077] Finally, it should be noted that the above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art can still modify the technical solutions described in the aforementioned embodiments or replace some of the technical features therein by equivalents. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention shall be included in the protection scope of the present invention.

Claims

1. A cloud platform information digital monitoring system based on big data, characterized in that: It includes a data acquisition module, a cloud platform, a data analysis module and a security module; the output end of the data acquisition module is interconnected with the input end of the cloud platform and the data analysis module to obtain characteristic data of security events; the cloud platform and the data analysis module are interconnected to store characteristic data of historical security events, and the characteristic data of a security event that has not occurred is also stored in the cloud platform as a special security event; the output end of the data analysis module is interconnected with the input end of the security module, and the type of security event is analyzed based on the characteristic data of the security event, and the analysis result is fed back to the security module; The security module processes the security event according to the type of the security event.

2. According to the big data-based cloud platform information digital monitoring system according to claim 1, it is characterized in that: The cloud platform also includes: an infrastructure layer, a virtualization layer, a development layer, an interaction layer, a data layer and a security mechanism layer. The infrastructure layer includes physical hardware resources and software for managing physical hardware; the virtualization layer is used to convert physical hardware resources into virtual resources and run them on the cloud platform; the development layer is used to provide a development environment for various programming languages; the interaction layer is used to interact with users, and users manage their cloud platform accounts through the interaction layer; the data layer is used to store user data and characteristic data of security events; and the security mechanism layer is used to provide a security mechanism to ensure the security of user data.

3. The cloud platform information digital monitoring system based on big data according to claim 1 is characterized in that: The data analysis module uses the judgment success rate P{B|C} of all security events as an evaluation indicator, finds the optimal combination of the minimum number of points and the neighborhood radius in the feature data of historical security events through the grid search method, clusters the feature data of current security events with the DBSCAN algorithm, and classifies the probability of occurrence of various types of security events.

4. The cloud platform information digital monitoring system based on big data according to claim 1 is characterized in that: The security module also stores processing records of various security events. When the security module receives the analysis results generated by the data analysis module, it finds the identification, tracking and processing methods of the corresponding security events from the processing records.

5. A cloud platform information digital monitoring method based on big data, characterized in that: The following steps are involved: S5-1, obtain characteristic data of security events from the cloud platform in real time; S5-2, clustering the characteristic data of the current security event based on the characteristic data of the security event; S5-3, if the characteristic data of the current security event is an outlier, a full range of detection and processing methods are adopted to process all and return to step S5-1; if the characteristic data of the current security event is not an outlier, the probability of correctly predicting the occurrence of various types of security events is determined based on the clustering results, and the security module identifies them one by one in order of probability from high to low, and executes different processing methods for different security events, and returns to step S5-1.

6. The method for digital monitoring of cloud platform information based on big data according to claim 5 is characterized in that: In step S5-2, clustering the characteristic data of the current security event specifically includes the following steps: S6-1, the characteristics of security events are recorded as A1, A2, ...A n , n is the number of security event features; S6-2, set the search range of the minimum number of points MinPts and the neighborhood radius Eps required by the DBSCAN algorithm, and use the grid search method to find the best combination of the minimum number of points and the neighborhood radius in the search range of the minimum number of points and the neighborhood radius. Evaluate the combination effect; where the value range of j is a positive integer between the interval [1, v], and v is the number of feature data of security events in the historical data; for the jth feature data of security events in the historical data, It indicates that the i-th security event will occur, C i Indicates that the i-th security event occurs; It represents the probability of the occurrence of the i-th security event and the successful prediction of the i-th security event. The value range of i is a positive integer between the interval [0, m], and m is the total number of security event types. It indicates that the security incident is predicted not to occur, and C0 indicates that the security incident has not occurred; It indicates the probability that a security incident will not actually occur after the security incident is predicted not to occur. The non-occurrence of a security incident is regarded as a special security incident and analyzed together with all security incidents. S6-3, with A1, A2, ...A n As input, the optimal minimum number of points and neighborhood radius combination are used as parameters, and the DBSCAN algorithm is used to cluster the feature data of current security events.

7. The method for digital monitoring of cloud platform information based on big data according to claim 6 is characterized in that: In step S6-2, evaluating the combination effect includes the following steps: S7-1, determine the characteristic data D of security events occurring in v historical data j The cluster to which it belongs; S7-2, for each characteristic data D of S7-1 j , calculate the other feature data in the cluster and D j The Euclidean distance between The value range of k A positive integer between is the characteristic data D j In the cluster, except for D j The total number of other characteristic data other than ; S7-3, calculation k0, k1, ... k m The value range is the interval subintervals, k1, …k m There is no overlap with the value range of k0, k1, ...k m The value range within is allowed to overlap; Indicates characteristic data D j The characteristic data of the clusters to which no security incidents occurred and D j The Euclidean distance between Represents the characteristic data D j The characteristic data of the first to mth security events in the cluster to which it belongs and D j The Euclidean distance between S7-4, calculate It indicates the probability of predicting the occurrence of the i-th security event. represents the probability that the i-th security incident actually occurs, It indicates the probability of predicting the occurrence of the i-th security event and the i-th security event actually occurring; Determined by historical data, its value is the ratio of the number of characteristic data of the i-th security event occurring in the historical data to the total number of characteristic data in the historical data; S7-5, all v characteristic data corresponding to the security event Take the average value and get the judgment success rate P{B i |C i }, the judgment success rate P{B i |C i } and take the average value to obtain the judgment success rate P{B|C} of all security events, which is used as the evaluation indicator of clustering results.

8. The method for digital monitoring of cloud platform information based on big data according to claim 7 is characterized in that: In step S7-4, Determined by: S8-1, for each feature data WD of all classification clusters b , b is the interval [1,Q D ] positive integer, Q D is the total number of feature data in all classification clusters, WD b Instead of D j Execute steps S7-1, S7-2 and S7-3, and follow the steps in step S7-4. The calculation formula is calculated S8-2, calculated Y b The value is 0 or 1. When the characteristic data WD b If it is indeed the characteristic data of the i-th security event, Y b is 1, otherwise Y b is 0; when When it is less than the threshold, Set to zero and do not substitute into the formula for calculation.

9. The method for digital monitoring of cloud platform information based on big data according to claim 8 is characterized in that: In step S6-2, the setting of the search range of the minimum number of points MinPts and the neighborhood radius Eps required by the DBSCAN algorithm also includes the following steps: S9-1, take k=2n-1, calculate the distance from each feature data point to other data points, find the distance from each feature data point to the point closest to it, sort these distances from large to small, and plot them in a rectangular coordinate system to obtain a kdistance graph, where the ordinate is the calculated distance and the abscissa represents the order of the calculated distances; S9-2, find the ordinate corresponding to the inflection point in the graph as the initial value Eps0 of the neighborhood radius; take k+1 as the initial value MinPts0 of the minimum number of points; S9-3, expand the interval with Eps0 and MinPts0 as the midpoints to obtain two expanded intervals as the search range of the minimum number of points MinPts and the neighborhood radius Eps. The grid search method is used to find the optimal combination of the minimum number of points and the neighborhood radius in the search range of the minimum number of points and the neighborhood radius, which specifically includes the following steps: S91, within the search range of the minimum number of points MinPts and the neighborhood radius Eps, determine all possible combinations of the minimum number of points and the neighborhood radius, where the minimum number of points is a positive integer within the search range of the minimum number of points; take Eps0 as the base point, and gradually move toward the upper and lower bounds of the search range of the neighborhood radius according to the set step size to obtain all values ​​of the neighborhood radius; S92, for different combinations of minimum number of points and neighborhood radius, using the characteristic data of historical security events as input, executing the DBSCAN algorithm, and using the judgment success rate P{B|C} of all security events as the evaluation standard of the combination effect; S93, selecting the combination of the minimum number of points and the neighborhood radius with the highest judgment success rate P{B|C} value of all security events as the best combination.

10. The method for digital monitoring of cloud platform information based on big data according to claim 9, characterized in that: In step S5-3, determining the probability of correctly predicting the occurrence of various security events according to the clustering results includes the following steps: The feature data of the current security event is recorded as x, and taken together with the feature data of historical security events as input, DBSCAN clustering is performed with the optimal combination parameters of the minimum number of points and neighborhood radius; Replace D with x j Execute steps S7-1, S7-2, S7-3 and S7-4 to calculate It means that the i-th security event currently occurs, and the characteristic data x is generated. The probability of the i-th security event occurring is successfully determined through the characteristic data x of the current security event.

Images