Self-adaptive security method, system, medium and equipment based on integrated test platform

Abstract

The invention provides a self-adaptive security method and system based on an integrated test platform, a medium and equipment. The method comprises the following steps: collecting and storing sample data of a container deployed in the integrated test platform; the collected sample data are preprocessed; extracting features from the sample data to describe normal behaviors and potential threats in the environment, and establishing a model based on the extracted features to distinguish normal behaviors and abnormal behaviors of the container; carrying out model training and optimization by using an XGBoost method; and applying the trained model to a real-time data stream for monitoring and predicting potential threats in real time. According to the method, key links such as data processing, feature engineering, model training and optimization, real-time monitoring and prediction and the like are optimized aiming at the self-adaptive safety problem in the integrated test platform, the system performance, stability and safety are improved, emerging threats can be identified and coped with more accurately, and powerful technical support is provided for guaranteeing the safety of the environment.

Description

Technical Field

[0001] The present invention belongs to the field of adaptive security technology, and in particular relates to an adaptive security method, system, medium and equipment based on an integrated test platform. Background Art

[0002] Adaptive security technology is an innovative solution to security challenges in an evolving environment. With the rise of cloud computing, containerization, and microservices, applications have become a key driver of digital transformation and innovation in enterprises. Adaptive security technology is mainly used in areas such as cloud computing, containerization, and microservices. It can protect applications and infrastructure from various security threats, including data leakage, malicious code injection, cross-tenant attacks, etc. By using adaptive security technology, organizations can achieve higher levels of data isolation, access control, and auditing capabilities to ensure the integrity, availability, and confidentiality of applications. In addition, adaptive security technology can also provide real-time monitoring and automated response capabilities, as well as security auditing and vulnerability management in the continuous integration and continuous delivery process, thereby providing enterprises with a more secure and reliable environment.

[0003] The background of adaptive security technology can be summarized from the following aspects. First, the architecture and deployment method of applications are very different from traditional monolithic applications. Applications use microservice architecture, which splits applications into multiple independent service units and deploys them through containerization technology. The flexibility and scalability of this architecture provide applications with higher efficiency and elasticity, but it also brings new challenges to security, such as container isolation, inter-service communication, and identity authentication.

[0004] The dynamics and diversity of the environment increase the complexity of security. In the environment, container orchestration systems (such as Kubernetes) are widely used to automatically manage and schedule large-scale container clusters. This makes application deployment and scaling more flexible, but also brings challenges to security monitoring and defense. Traditional security tools have difficulty tracking and protecting rapidly changing container environments, and in multi-cloud and hybrid cloud deployments, the security mechanisms and configurations of different cloud service providers also vary.

[0005] Security in the continuous delivery and continuous integration of applications has also become an important issue. The development model focuses on rapid iteration and frequent release of new features, but this also means increased pressure on security audits and vulnerability management. Traditional security testing methods and processes cannot meet the needs of rapid deployment and update of applications, so more automated security technologies are needed to improve the security awareness and capabilities of development teams.

[0006] To address these challenges, adaptive security technology proposes a new approach based on machine learning and adaptive policies. By analyzing large-scale real-time data and behavior patterns, the technology can identify emerging threats and attack vectors, and dynamically adjust security policies to cope with changing environments. It can achieve container-level security isolation and access control, monitor and prevent malicious code injection, cross-tenant attacks and other attack behaviors, and provide real-time response and repair capabilities.

[0007] The background and development of adaptive security technology stems from the urgent need for environmental security. With the widespread application and rapid development of applications, adaptive security technology will continue to evolve and improve to cope with the ever-changing security threats and challenges, and provide enterprises with a more powerful security and trusted environment.

[0008] However, the shortcoming of existing security technologies is their limited adaptability to emerging technologies and complex environments. Due to the rapid development of applications and the ever-changing technology stack, existing security technologies may not be able to effectively respond to emerging threats and attack vectors. In particular, when faced with complex container orchestration systems, multi-cloud environments, and hybrid cloud and edge computing deployments, existing security technologies may face challenges and fail to provide comprehensive protection and monitoring capabilities. Summary of the invention

[0009] The present invention aims at the deficiencies in the prior art and provides an adaptive security method, system, medium and device based on an integrated test platform. The present invention can use large-scale data analysis and pattern recognition to monitor and predict emerging threats and attack vectors, analyze behavioral patterns and abnormal activities in the environment, update and adjust security policies in real time, and provide more accurate threat detection and defense capabilities. In addition, the present invention can also be integrated with an automated response system to achieve real-time threat response and vulnerability repair, thereby enhancing the security and resilience of the environment.

[0010] To achieve the above object, the present invention adopts the following technical solutions:

[0011] The adaptive security method based on the integrated test platform is characterized by comprising:

[0012] Collect and store sample data of containers deployed in the integrated test platform;

[0013] Preprocess the collected sample data;

[0014] Extract features from sample data to describe normal behaviors and potential threats in the environment, and build a model based on the extracted features to distinguish normal and abnormal behaviors of containers.

[0015] Use XGBoost method for model training and optimization;

[0016] Apply trained models to live data streams for real-time monitoring and prediction of potential threats.

[0017] To optimize the above technical solutions, the specific measures taken also include:

[0018] Furthermore, the sample data includes container startup and destruction log information and network traffic information of inter-container communication.

[0019] Furthermore, the extracted features include features related to container startup time, network communication frequency, CPU and memory usage.

[0020] Furthermore, the collecting and storing of sample data of containers deployed in the integrated test platform is specifically as follows:

[0021] The data acquisition function G(x) and storage function S(x) are introduced, where x represents sample data, G(x) is responsible for collecting data, S(x) is responsible for storing data, and the stored data set D = {(x1, y1), (x2, y2), ..., (xn, yn)}, where xi represents the feature vector of the i-th sample, yi represents the label of the i-th sample, i = 1, ..., n, and n is the size of the data set.

[0022] Furthermore, the extracting of features from the sample data is specifically as follows:

[0023] Introduce the feature extraction function F(x), input the sample data x into the feature extraction function F(x), and obtain the feature vector xi=F(x)=(xi1, xi2, ..., xim), where i is the sample index and m is the number of features.

[0024] Furthermore, the XGBoost method is used to train and optimize the model, specifically:

[0025] Introduce the objective function obj(Θ) for optimization:

[0026] obj(Θ)=L(Θ)+λ*Ω(Θ);

[0027] Where L(Θ) represents the loss function, λ is the regularization parameter, Ω(Θ) represents the regularization term, and Θ is the model parameter;

[0028]

[0029] in, represents the prediction loss of sample yi, γ(Θ) represents the model complexity penalty term;

[0030] Introducing model update function Update model parameters according to the gradient descent method:

[0031]

[0032] Among them, Θ^(t+1) is the model parameter after the t+1th iteration, Θ^t is the model parameter after the tth iteration, η is the learning rate, is the gradient of the objective function obj(Θ) with respect to Θ at Θ^t.

[0033] Furthermore, the real-time monitoring and prediction of potential threats are specifically as follows:

[0034] Introduce the prediction function P(xnew, Θ), input the new container data xnew and model parameter Θ into the prediction function P(xnew, Θ), and obtain the prediction probability p = P(xnew, Θ);

[0035] A safety judgment function R(p, threshold) is introduced to determine whether the predicted probability p exceeds the threshold threshold; if p>threshold, the safety response mechanism is triggered; otherwise, it indicates that the container behavior is normal.

[0036] Accordingly, the present invention proposes an adaptive safety system based on an integrated test platform, which is characterized by comprising:

[0037] A data collection module is used to collect and store sample data of containers deployed in the integrated test platform;

[0038] A data preprocessing module, used for preprocessing the collected sample data;

[0039] Feature engineering module, which is used to extract features from sample data to describe normal behaviors and potential threats in the environment, and to build models based on the extracted features to distinguish normal and abnormal behaviors of containers;

[0040] Model training and optimization module, used for model training and optimization using XGBoost method;

[0041] The threat detection and prediction module is used to apply the trained model to real-time data streams for real-time monitoring and prediction of potential threats.

[0042] Accordingly, the present invention proposes a computer-readable storage medium storing a computer program, characterized in that the computer program enables a computer to execute the adaptive security method based on the integrated testing platform as described above.

[0043] Accordingly, the present invention proposes an electronic device, characterized in that it includes: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the computer program, it implements the adaptive security method based on the integrated test platform as described in any one of claims 1-8.

[0044] The beneficial effects of the present invention are:

[0045] 1) The present invention introduces data collection and storage functions to more carefully define the data collection and storage process, and enhances the system's data management and security; introduces a feature extraction function to better handle complex features in the integrated test platform and improve the model's ability to identify threats; introduces a regularization parameter to balance the complexity and performance of the model, avoid overfitting problems, and improve the generalization ability of the model; introduces a model update function to more flexibly update the model parameters and optimize the performance and stability of the model; introduces a security judgment function to make security judgments based on predicted probabilities and thresholds, and improve the system's ability to respond to potential threats.

[0046] 2) The present invention optimizes system performance, stability and security, and provides a more accurate model training and prediction method. In the integrated test platform, the innovation of the present invention is to combine the XGBoost method and environmental characteristics to achieve the monitoring and prediction of emerging threats and attack vectors. Compared with the prior art, the improvement is the introduction of more sophisticated data processing, feature engineering, model optimization and security judgment mechanism, which improves the overall performance and security of the system.

[0047] 3) The present invention can effectively improve the security of the integrated test platform by constructing a suitable data set, extracting key features, using XGBoost for model training and optimization, and real-time application of the model for monitoring and prediction, and timely respond to emerging threats and attack vectors to ensure overall system security. The intelligent threat detection and prediction mechanism provided by the present invention can quickly identify potential threats and then take appropriate security response measures to ensure the safety and stability of the environment. BRIEF DESCRIPTION OF THE DRAWINGS

[0048] Figure 1 It is a flow chart of the adaptive security approach based on the integrated test platform.

[0049] Figure 2 It is a framework diagram of an adaptive safety system based on an integrated test platform. DETAILED DESCRIPTION

[0050] The technical solutions in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application.

[0051] In one embodiment, the present invention proposes an adaptive security method based on an integrated test platform, the process of which is as follows: Figure 1 As shown, the specific steps include the following steps.

[0052] S101: Data collection.

[0053] First, it is necessary to establish an appropriate data collection and storage mechanism. The threat detection and prediction process begins with the data collection stage, which collects various data in the environment in real time, including container startup and destruction logs, network traffic for communication between containers, and other information. These data come from various components and systems in the cloud platform and are obtained in real time. Through reasonable data collection and storage, a data set containing rich information is constructed.

[0054] Data collection and storage:

[0055] Dataset: D = {(x1, y1), (x2, y2), ..., (xn, yn)};

[0056] Among them, xi represents the feature vector of the i-th sample, yi represents the label of the i-th sample, and n is the size of the data set.

[0057] In this embodiment, a data acquisition function G(x) and a storage function S(x) may be further introduced, where x represents data in the integrated test platform, G(x) is responsible for collecting data, and S(x) is responsible for storing data.

[0058] S102: Data preprocessing.

[0059] After data collection, the collected data needs to go through a preprocessing step. This stage includes operations such as cleaning and normalizing the data to ensure the quality and consistency of the data. Cleaning operations can remove noise, outliers, and duplicates in the data to improve the accuracy of subsequent analysis. Normalization operations can transform data into a consistent range and eliminate dimensional differences between different features to facilitate feature engineering and model training.

[0060] S103: Feature engineering.

[0061] After data preprocessing, feature engineering is performed to extract distinguishing features from the raw data to describe normal behavior and potential threats in the environment. Feature engineering can include operations such as feature selection, dimensionality reduction, and construction of new features. By selecting the most relevant features, reducing redundant features, and building new features, the characteristics of the data and the potential patterns of threats can be better represented. For example, features related to container startup time, network communication frequency, CPU and memory usage, etc. can be extracted. These features can be used to build models to distinguish normal behavior from abnormal behavior.

[0062] Feature extraction: Perform feature extraction on each sample to obtain a feature vector xi = (xi1, xi2, ..., xim), where m is the number of features.

[0063] Feature selection: Select an appropriate feature subset from all features to construct a new feature vector.

[0064] In this embodiment, a feature extraction function F(x) may be further introduced, and the sample data x may be input into the feature extraction function F(x) to obtain a feature vector xi=F(x), where i is a sample index.

[0065] S104: Model training and optimization.

[0066] After feature engineering is completed, machine learning algorithms are used to train and optimize the model. The XGBoost algorithm is used to detect and predict threats. XGBoost is a powerful gradient boosting tree algorithm that can process high-dimensional sparse data with high accuracy and efficiency. In the model training phase, the preprocessed data is used as input to train and learn threats using the XGBoost algorithm. In the model optimization phase, the performance and generalization ability of the model are improved by adjusting the algorithm's hyperparameters and using cross-validation and other techniques.

[0067] Objective function:

[0068] obj(Θ)=L(Θ)+Ω(Θ);

[0069] Among them, L(Θ) represents the loss function, Ω(Θ) represents the regularization term, and Θ is the model parameter.

[0070] Loss function:

[0071]

[0072] in, represents the prediction loss of sample yi, and γ(Θ) represents the model complexity penalty term.

[0073] Model parameter update:

[0074]

[0075] Among them, Θ^(t+1) is the model parameter after the t+1th iteration, Θ^t is the model parameter after the tth iteration, and η is the learning rate.

[0076] In this embodiment, the following improvements can be further proposed:

[0077] Introduce the objective function obj(Θ) for optimization:

[0078] obj(Θ)=L(Θ)+λ*Ω(Θ);

[0079] Among them, L(Θ) represents the loss function, λ is the regularization parameter, and Ω(Θ) represents the regularization term.

[0080]

[0081] in, represents the prediction loss of sample yi, and γ(Θ) represents the model complexity penalty term.

[0082] Introducing model update function The model parameters are updated according to the gradient descent method.

[0083]

[0084] Among them, Θ^(t+1) is the model parameter after the t+1th iteration, Θ^t is the model parameter after the tth iteration, η is the learning rate, is the gradient of the objective function obj(Θ) with respect to Θ at Θ^t.

[0085] S105: Threat detection and prediction.

[0086] After completing model training and optimization, the model can be used for threat detection and prediction. By inputting real-time data, such as container logs, network traffic, etc., after preprocessing and feature engineering, the data is input into the trained XGBoost model. The model will detect and predict possible threats based on the characteristics and patterns of the input data. According to the output results of the model, corresponding security measures can be taken in time to deal with potential threats and attacks to ensure the security and stability of the environment. For example, when a new container is started, its relevant features can be input into the trained model for prediction. If the model determines that the behavior of the container is abnormal or highly threatening, it can trigger corresponding security response mechanisms, such as alarm notifications, automatic isolation, etc.

[0087] Real-time monitoring and prediction:

[0088] Feature extraction: Extract features from the new container to obtain the feature vector xnew.

[0089] Prediction probability calculation:

[0090] p = f(xnew, Θ);

[0091] Among them, f(xnew, Θ) represents the model prediction probability based on the feature vector xnew and the model parameters Θ.

[0092] Security response determination:

[0093] ifp>threshold:

[0094] Triggering security response mechanism

[0095] else:

[0096] Container behavior is normal

[0097] In this embodiment, the following improvements can be further proposed:

[0098] Introduce the prediction function P(xnew, Θ), input the new container data xnew and model parameters Θ into the prediction function P(xnew, Θ), and obtain the prediction probability p=P(xnew, Θ).

[0099] A safety judgment function R(p, threshold) is introduced to determine whether the predicted probability p exceeds the threshold threshold.

[0100] ifR(p,threshold):

[0101] Triggering security response mechanism

[0102] else:

[0103] Container behavior is normal

[0104] Next, the application of the method proposed in this embodiment in the following aspects is described.

[0105] 1. Configuration of adaptive security policy.

[0106] The XGBoost method has the following advantages and configuration points in implementing adaptive security policies and configurations:

[0107] Feature selection and importance assessment: The XGBoost algorithm can automatically identify and select features that have a critical impact on security through built-in feature selection and importance assessment functions. This makes the configuration of security policies more accurate and sophisticated, and can better adapt to dynamic changes in the environment.

[0108] Model parameter adjustment and automatic optimization: The XGBoost algorithm has a variety of adjustable model parameters, such as learning rate, number of trees, tree depth, etc. By adjusting and optimizing these parameters, the XGBoost model can be better adapted to different security environments and threat situations. This automatic optimization capability makes the configuration of security policies more flexible and adaptable.

[0109] Anomaly detection and real-time monitoring: XGBoost models can detect potential abnormal behaviors and threats by monitoring and predicting real-time data streams. By integrating XGBoost models with real-time data streams, security policies can be updated and adjusted in real time to respond to emerging threats and environmental changes in a timely manner.

[0110] Explainability and visualization: The XGBoost algorithm provides explainability and visualization capabilities for the model, which can help security teams better understand and explain the decision-making process of the model. This is crucial for the configuration and adjustment of security policies, allowing security teams to configure security policies more accurately and improve the adaptability and security of the system.

[0111] In summary, the XGBoost method has advantages in feature selection, model parameter adjustment, real-time monitoring, and interpretability in the configuration of adaptive security policies. By properly configuring the XGBoost algorithm, combined with the capabilities of real-time data analysis and automatic optimization, adaptive security policies and configurations based on machine learning can be better implemented to cope with dynamic changes in the environment and emerging threats.

[0112] When implementing adaptive security policies and configurations using the XGBoost method, the following parameter configuration points can be considered:

[0113] Learning rate (learning_rate): The learning rate controls the update amplitude of the model parameters in each iteration. A smaller learning rate can make the model more stable, but it may take more iterations to reach the optimal solution. It is generally recommended to set the learning rate to 0.1.

[0114] Number of trees (n_estimators): The number of trees indicates the number of decision trees used to construct weak learners. More trees can improve the expressiveness of the model, but may also lead to overfitting. It is recommended to select the appropriate number of trees through methods such as cross-validation. The initial value can be set to 100.

[0115] Tree depth (max_depth): The depth of the tree controls the complexity of the decision tree. A deeper tree can better fit the training data, but it is also prone to overfitting. It is recommended to set an appropriate tree depth. Generally, the initial value can be set between 3-10.

[0116] Feature subsampling rate (colsample_bytree): The feature subsampling rate controls the proportion of features used by each tree. A smaller value can improve the generalization ability of the model and prevent overfitting. It is recommended to set a value less than 1, such as 0.6 or 0.8.

[0117] Regularization parameter (1ambda): The regularization parameter controls the penalty term of model complexity and can prevent the model from overfitting. It is recommended to set a suitable regularization parameter, and the initial value can generally be set to 0.1 or 0.01.

[0118] By properly configuring these parameters, the XGBoost model can better adapt to dynamic changes in the environment and emerging threats. At the same time, the best combination of parameters can be selected through cross-validation, grid search and other techniques to improve the performance and stability of the model. Experiments and adjustments need to be conducted according to specific scenarios and data characteristics to achieve the best adaptive security strategy and configuration effect.

[0119] 2. Real-time threat response and vulnerability remediation.

[0120] Combined with an automated response system, it enables real-time threat response and vulnerability remediation, improving the security and resilience of the environment.

[0121] In an integrated testing platform, by combining an automated response system, real-time threat response and vulnerability remediation can be achieved, thereby improving the security and resilience of the environment. The following is a specific example to illustrate how to apply adaptive security policies and automated response systems.

[0122] Assume that multiple containers are deployed in an integrated test platform and sensitive financial applications are running. To protect these containers from threats, adaptive security policies and automated response systems can be used.

[0123] First, you need to establish an adaptive security strategy and use machine learning algorithms such as XGBoost for model training and optimization. This security strategy includes monitoring various indicators and features of the container, such as network traffic, CPU usage, memory utilization, etc. By collecting this data and performing feature extraction, you can build a data set for model training.

[0124] Next, in the automated response system, the operation status and related indicators of the container are monitored in real time. If the network traffic of a container is abnormally high or the CPU usage fluctuates abnormally, this information can be input into the trained model for prediction. If the model determines that the container has a potential security threat, the automated response mechanism will be triggered.

[0125] In this case, the automated response can take multiple actions. First, the network traffic of the container can be blocked immediately to prevent the further spread of the potential attack. Second, the container can be isolated from the network to prevent it from communicating with other containers to avoid the spread of the threat. At the same time, the security team can be notified and logs can be recorded for subsequent investigation and analysis.

[0126] In addition, the automated response system can also be used for vulnerability repair. Regular vulnerability scans of containers and applications are performed to identify existing vulnerabilities. Once a vulnerability is found, the automated response system can automatically download and apply relevant patches to repair the vulnerability and improve system security.

[0127] By combining adaptive security policies and automated response systems, real-time threat response and vulnerability repair can be achieved, improving the security and resilience of the environment. This approach can promptly detect potential threats and vulnerabilities, and quickly take corresponding measures to respond and repair them, effectively reducing security risks and protecting the security of key applications. At the same time, through automation, the burden on the security team is reduced, and the response speed and efficiency are improved.

[0128] 3. Security reinforcement of container orchestration system.

[0129] Provides comprehensive protection and monitoring capabilities for security reinforcement of container orchestration systems.

[0130] In the integrated testing platform, security reinforcement for the container orchestration system is an important part of ensuring the security of the entire environment. The improved XGBoost method can provide comprehensive protection and monitoring capabilities. The following is a specific example to illustrate.

[0131] Kubernetes is used as the container orchestration system in the integrated test platform. In order to strengthen its security, the improved XGBoost method can be applied for security reinforcement and monitoring.

[0132] First, the XGBoost method can be used to monitor and analyze Kubernetes logs in real time. By collecting and analyzing Kubernetes log data, security-related features can be extracted, such as container startup and destruction records, network traffic for communication between containers, etc. Using the improved XGBoost model, these features can be trained and predicted to identify potential security threats and abnormal behaviors.

[0133] For example, when a container is detected to have an abnormally high startup and destruction frequency, and an abnormal network communication pattern with other containers, the improved XGBoost model can predict that the container may have abnormal behavior or be maliciously exploited. At this time, the security response mechanism can be automatically triggered, such as immediately isolating the container, sending an alert notification to the security team, and recording the event log for subsequent investigation and analysis.

[0134] Secondly, the improved XGBoost method can also be applied to the security reinforcement of container images. Container images are the basis of containerized applications, but there are security risks. Through the improved XGBoost method, static and dynamic security analysis of container images can be performed. In the static analysis stage, the XGBoost model can analyze the components and dependencies of the container image and identify potential vulnerabilities or malicious code. In the dynamic analysis stage, the XGBoost model can monitor the behavior of the container image and detect unexpected operations or abnormal behaviors.

[0135] For example, when there are known vulnerabilities or malicious code in the container image, the improved XGBoost model can detect and warn in time by comparing with the vulnerability database or malicious code features. At the same time, when the container image exhibits abnormal behavior at runtime, such as unauthorized file access, malicious process startup, etc., the improved XGBoost model can also detect and respond in time through monitoring and prediction.

[0136] By applying the improved XGBoost method, comprehensive protection and monitoring capabilities are provided for the security reinforcement of container orchestration systems. From log monitoring of container orchestration systems to static and dynamic analysis of container images, through the training and prediction of XGBoost models, potential security threats and abnormal behaviors can be identified and corresponding security response mechanisms can be automatically triggered. This comprehensive security reinforcement and monitoring solution can improve the security and resilience of the environment and protect the security of sensitive data and applications.

[0137] (4) Security management of multi-cloud environments and edge computing.

[0138] Provide comprehensive security management solutions for complex deployments of multi-cloud environments and edge computing.

[0139] In the face of complex deployments of multi-cloud environments and edge computing, a comprehensive security management solution is key. Taking the integrated test platform as the scenario, with the help of the improved XGBoost method, a comprehensive security management solution for multi-cloud environments and edge computing can be provided.

[0140] The improved XGBoost method can be used to uniformly configure and manage security policies for environments of different cloud service providers. In a multi-cloud environment, the security policies and configurations of cloud service providers may differ. The improved XGBoost method can automatically adapt to different cloud environments and generate corresponding security policies and configurations by learning and predicting the characteristics of the cloud environment. For example, according to the network traffic characteristics and access patterns of different cloud service providers, the improved XGBoost model can automatically adjust network security policies based on historical data and real-time monitoring to ensure the secure transmission of data across cloud platforms.

[0141] The improved XGBoost method can adapt to the security management needs of edge computing deployment. Edge computing environments are usually characterized by limited resources and unstable network conditions, so security management needs to have a certain degree of flexibility and adaptability. With the improved XGBoost method, edge nodes can be monitored and predicted in real time to identify potential security threats and abnormal behaviors. For example, on edge nodes, the improved XGBoost model is used to monitor the behavior of devices in real time. If abnormal device access or illegal operation is detected, a security response mechanism can be triggered immediately, such as isolating the device or sending an alarm notification.

[0142] The improved XGBoost method can also be combined with an automated response system to achieve rapid threat response and vulnerability repair for multi-cloud environments and edge nodes. By integrating with the automated response system, when the XGBoost model detects threats or abnormal behaviors, it can automatically trigger corresponding response measures, such as blocking attack traffic, isolating infected containers, and automatically repairing vulnerabilities in containers. This comprehensive security management solution can respond to security threats in multi-cloud environments and edge computing in a timely manner, and improve the security and resilience of the integrated test platform.

[0143] In summary, through the improved XGBoost method, a comprehensive security management solution can be provided for the complex deployment of multi-cloud environments and edge computing. This solution can achieve unified security policy configuration and management, adapt to the characteristics of different cloud environments, and also cope with the challenges of limited resources and network instability in edge computing environments. Through integration with the automated response system, rapid threat response and vulnerability repair can be achieved, improving the security and resilience of the integrated test platform. This comprehensive security management solution has important significance and innovation in the field of adaptive security, and can provide comprehensive security protection and monitoring capabilities for multi-cloud environments and edge computing.

[0144] In another embodiment, the present invention proposes an adaptive security system based on an integrated test platform, the architecture of which is as follows: Figure 2 As shown, this system corresponds to the adaptive security method based on the integrated test platform proposed in Example 1, including:

[0145] A data collection module is used to collect and store sample data of containers deployed in the integrated test platform;

[0146] A data preprocessing module, used for preprocessing the collected sample data;

[0147] Feature engineering module, which is used to extract features from sample data to describe normal behaviors and potential threats in the environment, and to build models based on the extracted features to distinguish normal and abnormal behaviors of containers;

[0148] Model training and optimization module, used for model training and optimization using XGBoost method;

[0149] The threat detection and prediction module is used to apply the trained model to real-time data streams for real-time monitoring and prediction of potential threats.

[0150] In this system, the functional principles and workflow of each module are the same as those of the method in Example 1, so they will not be repeated here.

[0151] In another embodiment, the present invention provides a computer-readable storage medium storing a computer program, wherein the computer program enables a computer to execute the adaptive security method based on an integrated testing platform as described in the first embodiment.

[0152] In another embodiment, the present invention proposes an electronic device, comprising: a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, the adaptive security method based on the integrated testing platform as described in Example 1 is implemented.

[0153] In the embodiments disclosed in the present application, the computer storage medium can be a tangible medium that can contain or store a program for use by or in conjunction with an instruction execution system, device or equipment. The computer storage medium can include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices or equipment, or any suitable combination of the above. More specific examples of computer storage media can include electrical connections based on one or more lines, portable computer disks, hard disks, random access memories (RAM), read-only memories (ROM), erasable programmable read-only memories (EPROM or flash memory), optical fibers, portable compact disk read-only memories (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination of the above.

[0154] Those of ordinary skill in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed in this application can be implemented in electronic hardware or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0155] The above are only preferred embodiments of the present invention, and the protection scope of the present invention is not limited to the above embodiments. All technical solutions under the concept of the present invention belong to the protection scope of the present invention. It should be pointed out that for ordinary technicians in this technical field, some improvements and modifications without departing from the principle of the present invention should be regarded as the protection scope of the present invention.

Claims

1. An adaptive security method based on an integrated test platform, characterized in that: include: Collect and store sample data of containers deployed in the integrated test platform; Preprocess the collected sample data; Extract features from sample data to describe normal behaviors and potential threats in the environment, and build a model based on the extracted features to distinguish normal and abnormal behaviors of containers. Use XGBoost method for model training and optimization; Apply trained models to live data streams for real-time monitoring and prediction of potential threats.

2. The adaptive security method based on the integrated test platform according to claim 1, characterized in that: The sample data includes container startup and destruction log information and network traffic information of communication between containers.

3. The adaptive security method based on the integrated test platform according to claim 1, characterized in that: The extracted features include features related to container startup time, network communication frequency, CPU and memory usage.

4. The adaptive security method based on the integrated test platform according to claim 1, characterized in that: The collecting and storing of sample data of containers deployed in the integrated test platform is specifically as follows: The data acquisition function G(x) and storage function S(x) are introduced, where x represents sample data, G(x) is responsible for collecting data, S(x) is responsible for storing data, and the stored data set D = {(x1, y1), (x2, y2), ..., (xn, yn)}, where xi represents the feature vector of the i-th sample, yi represents the label of the i-th sample, i = 1, ..., n, and n is the size of the data set.

5. The adaptive security method based on the integrated test platform according to claim 4, characterized in that: The feature extraction from the sample data is specifically as follows: Introduce the feature extraction function F(x), input the sample data x into the feature extraction function F(x), and obtain the feature vector xi=F(x)=(xil, xi2, ..., xim), where i is the sample index and m is the number of features.

6. The adaptive security method based on the integrated test platform according to claim 5, characterized in that: The XGBoost method is used to train and optimize the model, specifically: Introduce the objective function obj(Θ) for optimization: obj(Θ)=L(Θ)+λ*Ω(Θ); Where L(Θ) represents the loss function, λ is the regularization parameter, Ω(Θ) represents the regularization term, and Θ is the model parameter; in, represents the prediction loss of sample yi, γ(Θ) represents the model complexity penalty term; Introducing model update function Update model parameters according to the gradient descent method: Among them, Θ^(t+1) is the model parameter after the t+1th iteration, Θ^t is the model parameter after the tth iteration, η is the learning rate, is the gradient of the objective function obj(Θ) with respect to Θ at Θ^t.

7. The adaptive security method based on the integrated test platform according to claim 1, characterized in that: The real-time monitoring and prediction of potential threats are specifically: Introduce the prediction function P(xnew, Θ), input the new container data xnew and model parameter Θ into the prediction function P(xnew, Θ), and obtain the prediction probability p = P(xnew, Θ); The safety judgment function R(p, threshold) is introduced to determine whether the predicted probability p exceeds the threshold threshold; if p>threshold, the safety response mechanism is triggered; otherwise, it indicates that the container behavior is normal.

8. Adaptive safety system based on integrated test platform, characterized in that: include: A data collection module is used to collect and store sample data of containers deployed in the integrated test platform; A data preprocessing module, used for preprocessing the collected sample data; Feature engineering module, which is used to extract features from sample data to describe normal behaviors and potential threats in the environment, and to build models based on the extracted features to distinguish normal and abnormal behaviors of containers; Model training and optimization module, used for model training and optimization using XGBoost method; The threat detection and prediction module is used to apply the trained model to real-time data streams for real-time monitoring and prediction of potential threats.

9. A computer-readable storage medium storing a computer program, characterized in that: The computer program enables a computer to execute the adaptive security method based on an integrated testing platform as described in any one of claims 1 to 8.

10. An electronic device, characterized in that: include: A memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the computer program, the adaptive security method based on the integrated test platform as described in any one of claims 1 to 8 is implemented.

Images