Computer risk monitoring system and method under federated architecture based on multi-model fusion

Abstract

The invention discloses a multi-model fusion-based computer risk monitoring system and method under a federated architecture, and the method comprises the steps: carrying out the local risk safety monitoring of a computer system through building the federated architecture under the condition of not sharing local data; through a built-in risk monitoring model, a plurality of models are adopted to carry out classified monitoring on different risks; performing risk decision on a risk monitoring result through a multi-attribute group decision method based on fuzzy information, and performing global training at a federal center node; and initiating early warning and recommending a defense scheme to a local computer system through a risk monitoring result. Distributed computer security system monitoring is achieved through a federated architecture, security monitoring is achieved under the condition that data are not shared, and it is guaranteed that privacy of a computer system is not leaked; the risk monitoring model performs classified risk monitoring on the data, and each piece of data is monitored for multiple times, so that the false alarm rate and the omission ratio are reduced, and comprehensive risk monitoring is realized.

Description

Technical Field

[0001] The present invention relates to the field of computer security technology, and in particular to a computer risk monitoring system and method under a federated architecture based on multi-model fusion. Background Art

[0002] Computer risk cloud monitoring refers to the use of cloud computing technology and big data analysis to monitor, identify and respond to security risks in computer systems in real time. In today's digital age, computer network attacks are becoming more rampant, malware is constantly evolving, and the network security situation is becoming increasingly severe. Therefore, it is crucial to adopt computer risk cloud monitoring technology.

[0003] Through computer risk cloud monitoring, timely and efficient monitoring and analysis of network traffic, abnormal behavior, threat intelligence and other data can be achieved to identify potential security threats and make early warnings and responses. This monitoring method can not only help organizations respond to security incidents quickly and reduce the risk of attacks, but also improve the overall network security level and protect user privacy and data security. Under the background of computer risk cloud monitoring, enterprises and organizations can better cope with complex and changing network security challenges and ensure the robustness and reliability of information systems.

[0004] Uploading system log files or monitoring data to the cloud can improve the ability to identify risks through centralized analysis of a large number of samples and behavioral judgment. However, this cloud process repeatedly involves violations of user privacy, and the types of risk monitoring are single, with a high rate of missed detection. Summary of the invention

[0005] The purpose of the present invention is to provide a computer risk monitoring system and method under a federated architecture based on multi-model fusion to solve the problems raised in the above background technology.

[0006] In order to solve the above technical problems, the present invention provides the following technical solutions: a computer risk monitoring method under a federal architecture based on multi-model fusion, comprising: step S100, performing risk security monitoring of a computer system locally without sharing local data by building a federal architecture; step S200, using a built-in risk monitoring model, using multiple models to classify and monitor different risks; step S300, making risk decisions on the risk monitoring results through a multi-attribute group decision-making method based on fuzzy information, and performing global training at the federal central node; step S400, initiating an early warning to the local computer system and recommending a defense plan based on the risk monitoring results.

[0007] As a preferred solution of the computer risk monitoring method under the federated architecture based on multi-model fusion described in the present invention, step S100 includes: Specifically, a local client is constructed, and the local client includes all business systems in the computer system to be detected; the computer cloud is used as the central server, and the risk monitoring model is used as the training model; the local client uses the risk monitoring model to monitor the risks such as security vulnerabilities, malicious codes and intrusion behaviors in the system in real time, and uploads the model parameters and training results to the cloud; The central server receives parameters and fuses the parameters using a linear analysis method to obtain global parameters; a multi-attribute group decision method based on fuzzy information is used to make decisions on multi-model results, and the central server initiates an early warning and recommends a defense plan based on the decision results.

[0008] As a preferred solution of the computer risk monitoring method under the federated architecture based on multi-model fusion described in the present invention, step S200 includes: Specifically, determining the risk categories in the computer system, including security vulnerabilities, malicious codes, and intrusion behaviors; using the risk categories as background information; determining the possible risk categories in the computer system, and using the risk categories as background information, using existing optimal parameters for training different risk categories, and uploading the parameters in groups according to the risk categories; After receiving the uploaded model parameters and risk monitoring results, the central server uses a parameter aggregation method to linearly aggregate the model parameters to obtain global model parameters of different risk categories; the global model parameters contain the characteristics of different risk categories; the central server comprehensively analyzes and integrates the risk monitoring results, sets risk thresholds based on the integrated results, and makes risk decisions.

[0009] As a preferred solution of the computer risk monitoring method under the federated architecture based on multi-model fusion described in the present invention, step S300 includes: Specifically, the multi-attribute group decision-making method based on fuzzy information includes the following steps: The risk model results received by the central server are the factors to be analyzed; Construct a relationship matrix between factors and determine the strength of the interrelationships between factors through expert opinions or data analysis; The factor relationship matrix is ​​normalized to obtain the standardized direct influence matrix, in which the sum of each row of data is 1; The comprehensive impact matrix T is calculated, and its calculation formula is: comprehensive impact matrix T = standard direct impact matrix × inverse matrix of (unit matrix-standard direct impact matrix); According to the comprehensive influence matrix T, various index values ​​are calculated, including influence degree D value, influence degree C value, centrality D+C value, and cause degree DC value.

[0010] According to the relationship between the analysis factors, the centrality D+C value is normalized to obtain the weight of each factor; Analyze the interactions between risk factors and identify key factors and dominant relationships.

[0011] As a preferred solution of the computer risk monitoring method under the federated architecture based on multi-model fusion described in the present invention, step S400 includes: Based on the values ​​of various indicators, a comprehensive risk score is determined for each business system; risk level thresholds are set to classify risks into high-risk business systems, medium-risk business systems, and low-risk business systems. The specific process is as follows: Set the comprehensive risk score calculation formula: ; Among them, CRS stands for Comprehensive Risk Score, , , and represents the weights of the preset influence D value, influence C value, centrality D+C value and cause DC value, and, .

[0012] Set the first-level risk level threshold and the second-level risk level threshold. If the comprehensive risk score CRS is greater than the first-level risk level threshold, it is judged as a high-risk business system; if the comprehensive risk score CRS is greater than the second-level risk level threshold, and less than the first-level risk level threshold, it is judged as a medium-risk business system; if the comprehensive risk score CRS is less than the second-level risk level threshold, it is judged as a low-risk business system.

[0013] For high-risk business systems: send emergency warning notifications to system administrators and relevant persons in charge; trigger automated warning systems, such as SMS, email, system internal alarms, etc.; For medium-risk business systems: send risk reminders to relevant departments; increase monitoring frequency; For low-risk business systems: send risk reports regularly; Establish defense plans for different risks: High-risk defense plan: Immediately initiate emergency response process; temporarily restrict system access rights; add additional security monitoring and logging; perform emergency security patch updates; Medium-risk defense plan: formulate a short-term reinforcement plan; increase the frequency of security audits; and perform security reinforcement on specific modules; Low-risk defense plan: Incorporate into regular security maintenance plan; perform security assessments and updates regularly.

[0014] The present invention also provides a computer risk monitoring system under a federal architecture based on multi-model fusion, including a federal architecture management module, which is used to coordinate multiple computer systems to perform distributed risk monitoring to ensure data privacy and local computing; a multi-model risk monitoring module, which is used to integrate and manage multiple risk monitoring models for different risk categories, and perform local risk detection and analysis; a central data fusion module, which is used to receive risk monitoring model parameters and results, perform parameter aggregation and global model updates, and realize comprehensive analysis of multi-source data; a fuzzy multi-attribute decision module, which is used to construct a risk factor relationship matrix, calculate various risk indicators, and perform complex risk assessment and decision-making based on fuzzy information; an intelligent early warning and defense module, which is used to generate graded early warnings based on risk assessment results, formulate and recommend corresponding defense plans, and perform dynamic monitoring and optimization.

[0015] Compared with the prior art, the beneficial effects achieved by the present invention are: distributed computer security system monitoring is achieved through a federal architecture, security monitoring is achieved without sharing data, and the privacy of the computer system is protected from being leaked; the risk analysis model classifies the data for risk monitoring, and each data is tested multiple times, reducing the false alarm rate and missed detection rate, and achieving comprehensive risk monitoring; the aggregation of federal model parameters ensures that the performance of the monitoring model is continuously enhanced; the application of the multi-decision method of the model results analyzes the risk factors existing in the data, provides targeted solutions, and saves resources. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the following briefly introduces the drawings required for describing the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative labor. Among them: Figure 1 It is a flowchart of the computer risk monitoring method under the federated architecture based on multi-model fusion of the present invention.

[0017] Figure 2 It is a structural diagram of the computer risk monitoring system under the federated architecture based on multi-model fusion of the present invention. DETAILED DESCRIPTION

[0018] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0019] Example 1: Please refer to Figure 1 The present invention provides a computer risk monitoring method under a federated architecture based on multi-model fusion, including: S1: By building a federal architecture, risk security monitoring of computer systems can be performed locally without sharing local data.

[0020] Specifically, a local client is constructed, which includes all business systems in the computer system to be detected; the computer cloud is used as the central server, and the risk monitoring model is used as the training model; the local client uses the risk monitoring model to monitor the risks such as security vulnerabilities, malicious codes and intrusion behaviors in the system in real time, and uploads the model parameters and training results to the cloud.

[0021] The central server receives parameters and fuses the parameters using a linear analysis method to obtain global parameters; a multi-attribute group decision method based on fuzzy information is used to make decisions on multi-model results, and the central server initiates an early warning and recommends a defense plan based on the decision results.

[0022] S2: By building a federal architecture, risk security monitoring of computer systems can be performed locally without sharing local data.

[0023] Specifically, determine the risk categories within the computer system, including security vulnerabilities, malicious codes, and intrusion behaviors; use the risk categories as background information; determine the possible risk categories within the computer system, and use the risk categories as background information, use existing optimal parameters to train different risk categories, and upload the parameters in groups according to risk categories.

[0024] After receiving the uploaded model parameters and risk monitoring results, the central server uses a parameter aggregation method to linearly aggregate the model parameters to obtain global model parameters of different risk categories; the global model parameters contain the characteristics of different risk categories; the central server comprehensively analyzes and integrates the risk monitoring results, sets risk thresholds based on the integrated results, and makes risk decisions.

[0025] S3: Risk decision-making is performed on the risk monitoring results through a multi-attribute group decision-making method based on fuzzy information, and global training is performed in the federated central node.

[0026] Specifically, the multi-attribute group decision-making method based on fuzzy information includes the following steps: The risk model results received by the central server are the factors to be analyzed; Construct a relationship matrix between factors and determine the strength of the interrelationships between factors through expert opinions or data analysis; The factor relationship matrix is ​​normalized to obtain the standardized direct influence matrix, in which the sum of each row of data is 1; The comprehensive impact matrix T is calculated, and its calculation formula is: comprehensive impact matrix T = standard direct impact matrix × inverse matrix of (unit matrix-standard direct impact matrix); According to the comprehensive influence matrix T, various index values ​​are calculated, including influence degree D value, influence degree C value, centrality D+C value, and cause degree DC value.

[0027] Furthermore, the influence degree D value is the sum of the elements in each row of the comprehensive influence matrix T; the influenced degree C value is the sum of the elements in each column of the comprehensive influence matrix T; the centrality D+C value is the sum of the D value and the C value; and the causality DC value is the difference between the D value and the C value.

[0028] Weight calculation: According to the relationship between factors, the centrality D+C value is normalized to obtain the weight of each factor, reflecting its importance in the overall decision.

[0029] Result analysis: Analyze the mutual influence between risk factors and identify key factors and dominant relationships.

[0030] S4: Initiate early warning to the local computer system and recommend defense plans based on risk monitoring results.

[0031] Based on the values ​​of various indicators, a comprehensive risk score is determined for each business system; risk level thresholds are set to classify risks into high-risk business systems, medium-risk business systems, and low-risk business systems. The specific process is as follows: Set the comprehensive risk score calculation formula: ; Among them, CRS stands for Comprehensive Risk Score, , , and represents the weights of the preset influence D value, influence C value, centrality D+C value and cause DC value, and, .

[0032] Set the first-level risk level threshold and the second-level risk level threshold. If the comprehensive risk score CRS is greater than the first-level risk level threshold, it is judged as a high-risk business system; if the comprehensive risk score CRS is greater than the second-level risk level threshold, and less than the first-level risk level threshold, it is judged as a medium-risk business system; if the comprehensive risk score CRS is less than the second-level risk level threshold, it is judged as a low-risk business system.

[0033] For high-risk business systems: send emergency warning notifications to system administrators and relevant persons in charge; trigger automated warning systems, such as SMS, email, system internal alarms, etc.; For medium-risk business systems: send risk reminders to relevant departments; increase monitoring frequency; For low-risk business systems: send risk reports regularly; Establish defense plans for different risks: High-risk defense plan: Immediately initiate emergency response process; temporarily restrict system access rights; add additional security monitoring and logging; perform emergency security patch updates; Medium-risk defense plan: formulate a short-term reinforcement plan; increase the frequency of security audits; and perform security reinforcement on specific modules; Low-risk defense plan: Incorporate into regular security maintenance plan; perform security assessments and updates regularly.

[0034] Example 2: Please refer to Figure 2 , this embodiment also provides a computer risk monitoring system under a federated architecture based on multi-model fusion, including: a federated architecture management module, which is used to coordinate multiple computer systems for distributed risk monitoring to ensure data privacy and local computing; a multi-model risk monitoring module, which is used to integrate and manage multiple risk monitoring models for different risk categories, and perform local risk detection and analysis; a central data fusion module, which is used to receive risk monitoring model parameters and results, perform parameter aggregation and global model updates, and realize comprehensive analysis of multi-source data; a fuzzy multi-attribute decision module, which is used to construct a risk factor relationship matrix, calculate various risk indicators, and perform complex risk assessment and decision-making based on fuzzy information; an intelligent early warning and defense module, which is used to generate graded early warnings based on risk assessment results, formulate and recommend corresponding defense plans, and perform dynamic monitoring and optimization.

[0035] Example 3: A computer-readable storage medium is applied to a computer risk monitoring system under a federal architecture based on multi-model fusion as in Example 2, wherein the readable storage medium is used to carry a computer program, and the computer program can be executed by a processor to implement the steps of a computer risk monitoring method under a federal architecture based on multi-model fusion as in Example 1.

[0036] Embodiment 4: A computer risk monitoring mechanism under a federated architecture based on multi-model fusion is applied to a computer risk monitoring system under a federated architecture based on multi-model fusion as in Embodiment 2, including: one or more processors; A system device is used to enable the computer risk monitoring mechanism under a federal architecture based on multi-model fusion to implement the steps of the computer risk monitoring method under a federal architecture based on multi-model fusion in Example 1 when one or more computer programs are executed by one or more processors.

[0037] It should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device.

[0038] Finally, it should be noted that the above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art can still modify the technical solutions described in the aforementioned embodiments or replace some of the technical features therein by equivalents. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention shall be included in the protection scope of the present invention.

Claims

1. Computer risk monitoring system based on a federated architecture with multi-model fusion, characterized by: The system includes: A federated architecture management module to coordinate multiple computer systems for distributed risk monitoring, ensuring data privacy and local computing; Multi-model risk monitoring module, which is used to integrate and manage multiple risk monitoring models for different risk categories and perform local risk detection and analysis; The central data fusion module is used to receive risk monitoring model parameters and results, perform parameter aggregation and global model update, and realize comprehensive analysis of multi-source data; Fuzzy multi-attribute decision-making module, which is used to construct the risk factor relationship matrix, calculate various risk indicators, and perform complex risk assessment and decision-making based on fuzzy information; The intelligent early warning and defense module is used to generate graded warnings based on risk assessment results, formulate and recommend corresponding defense plans, and conduct dynamic monitoring and optimization.

2. A computer risk monitoring method under a federated architecture based on multi-model fusion, executing a computer risk monitoring system under a federated architecture based on multi-model fusion as claimed in claim 1, characterized in that: The method comprises the following steps: Step S100: Conduct risk security monitoring on the computer system locally without sharing local data by building a federal architecture; Step S200: using a built-in risk monitoring model, using multiple models to classify and monitor different risks; Step S300: making risk decisions on risk monitoring results through a multi-attribute group decision-making method based on fuzzy information, and performing global training at the federation center node; Step S400: Initiate an early warning to the local computer system and recommend a defense plan based on the risk monitoring results.

3. The computer risk monitoring method under the federated architecture based on multi-model fusion according to claim 2 is characterized in that: The step S100 includes: Construct a local client, which includes all business systems in the computer system to be detected; use the computer cloud as the central server and the risk monitoring model as the training model; the local client monitors the system risk in real time through the risk monitoring model, and uploads the model parameters and training results to the cloud; The central server receives model parameters and fuses the parameters using a linear analysis method to obtain global parameters; and uses a multi-attribute group decision-making method based on fuzzy information to make decisions on multi-model results.

4. The computer risk monitoring method under the federated architecture based on multi-model fusion according to claim 3 is characterized in that: The step S200 includes: Determine the risk categories within the computer system, including security vulnerabilities, malicious code, and intrusion behaviors; use the risk categories as background information and train the different risk categories using the existing optimal parameters; After receiving the uploaded model parameters and risk monitoring results, the central server uses a parameter aggregation method to linearly aggregate the model parameters to obtain global model parameters of different risk categories; the global model parameters contain the characteristics of different risk categories; the central server comprehensively analyzes and integrates the risk monitoring results, sets risk thresholds based on the integrated results, and makes risk decisions.

5. The computer risk monitoring method under the federated architecture based on multi-model fusion according to claim 4 is characterized in that: The step S300 includes: The multi-attribute group decision-making method based on fuzzy information comprises the following steps: The risk model results received by the central server are used as analysis factors; Constructing a relationship matrix between the analysis factors to determine the strength of the relationship between the analysis factors; Normalizing the relationship matrix to obtain a standard direct influence matrix, wherein the sum of each row of data is 1; The comprehensive impact matrix T is calculated, and the formula is: comprehensive impact matrix T = standard direct impact matrix × inverse matrix of (unit matrix-standard direct impact matrix); According to the comprehensive influence matrix T, various index values ​​are calculated, including influence degree D value, influence degree C value, centrality D+C value and cause degree DC value; According to the relationship between the analysis factors, the centrality D+C value is normalized to obtain the weight of each factor; Analyze the interactions between risk factors and identify key factors and dominant relationships.

6. The computer risk monitoring method under the federated architecture based on multi-model fusion according to claim 5 is characterized in that: The step S400 includes: Based on the various indicator values, a comprehensive risk score is determined for each business system; a risk level threshold is set to classify the risks into high-risk business systems, medium-risk business systems, and low-risk business systems; For high-risk business systems: send emergency warning notifications to system administrators and relevant persons in charge; trigger the automated warning system; For medium-risk business systems: send risk reminders to relevant departments; increase monitoring frequency; For low-risk business systems: send risk reports regularly; Establish defense plans for different risks: High-risk defense plan: Immediately initiate emergency response process; temporarily restrict system access rights; add additional security monitoring and logging; perform emergency security patch updates; Medium-risk defense plan: formulate a short-term reinforcement plan; increase the frequency of security audits; and perform security reinforcement on specific modules; Low-risk defense plan: Incorporate into regular security maintenance plan; perform security assessments and updates regularly.

Images