Network security risk control method and device based on cloud computing and electronic equipment

Abstract

The invention relates to the field of network security, and particularly discloses a network security risk control method and device based on cloud computing and electronic equipment, and the method comprises the steps: firstly obtaining historical network attack alarm information, system log data and user login behavior data collected by a cloud computing platform, and then employing a deep learning technology to obtain a network security risk control result; the method comprises the following steps: carrying out feature extraction and correlation analysis on the three, and finally obtaining a classification result through a classifier so as to obtain a network security risk level label, thereby identifying potential security threats, reducing low-risk alarms and false alarms, optimizing alarm processing efficiency, enhancing interpretability and transparency of a system, and improving real-time performance and expandability of the system.

Description

Technical Field

[0001] The present application relates to the field of network security, and more specifically, to a network security risk control method, device and electronic device based on cloud computing. Background Art

[0002] Traditionally, industrial control systems are relatively isolated from external networks, which provides basic security protection for the system. However, with the promotion of the industrial Internet, the openness of the network environment has exposed these systems to potential network attacks, causing major security risks.

[0003] In order to cope with the growing cybersecurity threats, the Industrial Internet usually deploys network security devices such as intrusion detection systems (IDS) and web application firewalls (WAF). These devices are designed to monitor network traffic, detect abnormal activities, and block potential attacks. In addition, network security analysts are responsible for monitoring, analyzing, and processing the massive amount of alarms generated by systems and devices. However, network security devices often generate a large number of low-risk alarms and false positives during the detection process. In addition, due to the large number of alarms, it is difficult for analysts to process each alarm one by one, resulting in delayed responses to potential threats.

[0004] Therefore, a network security risk control method, device and electronic device based on cloud computing is desired. Summary of the invention

[0005] In order to solve the above technical problems, this application is proposed. The embodiments of this application provide a network security risk control method, device and electronic device based on cloud computing, which first obtains historical network attack alarm information, system log data and user login behavior data collected by the cloud computing platform, and then uses deep learning technology to perform feature extraction and correlation analysis on the three, and finally obtains classification results through a classifier to obtain a network security risk level label, thereby identifying potential security threats, reducing low-risk alarms and false alarms, and then optimizing the alarm processing efficiency, enhancing the interpretability and transparency of the system, and improving the real-time and scalability of the system.

[0006] According to one aspect of the present application, a network security risk control method based on cloud computing is provided, which includes:

[0007] Obtain historical network attack warning information, system log data, and user login behavior data collected by the cloud computing platform;

[0008] Extracting attack pattern recognition associated feature vectors and user login behavior data associated feature vectors from the historical network attack alarm information collected by the cloud computing platform, the system log data, and the user login behavior data;

[0009] Based on the attack pattern recognition associated feature vector and the user login behavior data associated feature vector, a network security risk level label is obtained.

[0010] According to another aspect of the present application, there is provided a network security risk control device based on cloud computing, comprising:

[0011] The network security risk data acquisition module is used to obtain historical network attack warning information, system log data and user login behavior data collected by the cloud computing platform;

[0012] A network security risk data processing module, used to extract attack pattern recognition associated feature vectors and user login behavior data associated feature vectors from the historical network attack warning information collected by the cloud computing platform, the system log data and the user login behavior data;

[0013] The network security risk level label classification module is used to obtain a network security risk level label based on the attack pattern recognition associated feature vector and the user login behavior data associated feature vector.

[0014] According to another aspect of the present application, an electronic device is provided, comprising: a processor; and a memory, in which computer program instructions are stored, and when the computer program instructions are executed by the processor, the processor executes the cloud computing-based network security risk control device as described above.

[0015] Compared with the prior art, the present application provides a cloud computing-based network security risk control method, device and electronic device, which first obtains historical network attack alarm information, system log data and user login behavior data collected by the cloud computing platform, and then uses deep learning technology to perform feature extraction and correlation analysis on the three, and finally obtains the classification result through the classifier to obtain a network security risk level label, thereby identifying potential security threats, reducing low-risk alarms and false alarms, and then optimizing the alarm processing efficiency, enhancing the system's interpretability and transparency, and improving the system's real-time and scalability. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] By describing the embodiments of the present application in more detail in conjunction with the accompanying drawings, the above and other purposes, features and advantages of the present application will become more apparent. The accompanying drawings are used to provide a further understanding of the embodiments of the present application and constitute a part of the specification. Together with the embodiments of the present application, they are used to explain the present application and do not constitute a limitation of the present application. In the accompanying drawings, the same reference numerals generally represent the same components or steps.

[0017] Figure 1 The present invention is a flowchart of a network security risk control method based on cloud computing according to an embodiment of the present application.

[0018] Figure 2 The present invention is a flowchart of extracting features from the historical network attack warning information in a network security risk control method based on cloud computing according to an embodiment of the present application to obtain a text semantic association feature vector of the historical network attack warning information.

[0019] Figure 3 The present invention is a flowchart of performing feature extraction on the system log data to obtain a semantic understanding feature vector of the system log data segment information in a network security risk control method based on cloud computing according to an embodiment of the present application.

[0020] Figure 4 The present invention is a flowchart of extracting features from the user login behavior data in a network security risk control method based on cloud computing according to an embodiment of the present application to obtain a feature vector associated with the user login behavior data.

[0021] Figure 5 It is a block diagram of a network security risk control device based on cloud computing according to an embodiment of the present application.

[0022] Figure 6 1 is a structural diagram of an exemplary hardware architecture of a computing device according to a cloud computing-based network security risk control method and apparatus according to an embodiment of the present application. DETAILED DESCRIPTION

[0023] Various exemplary embodiments, features and aspects of the present application will be described in detail below with reference to the accompanying drawings. The same reference numerals in the accompanying drawings represent elements with the same or similar functions. Although various aspects of the embodiments are shown in the accompanying drawings, the drawings are not necessarily drawn to scale unless otherwise specified.

[0024] The word “exemplary” is used exclusively herein to mean “serving as an example, example, or illustration.” Any embodiment described herein as “exemplary” is not necessarily to be construed as preferred or advantageous over other embodiments.

[0025] In addition, in order to better illustrate the present application, numerous specific details are given in the following specific embodiments. It should be understood by those skilled in the art that the present application can also be implemented without certain specific details. In some examples, methods, means, components and circuits well known to those skilled in the art are not described in detail in order to highlight the subject matter of the present application.

[0026] In addition, the terms "first" and "second" are used for descriptive purposes only and should not be understood as indicating or implying relative importance or implicitly indicating the number of the indicated technical features. Thus, a feature defined as "first" or "second" may explicitly or implicitly include one or more of the features. In the description of this application, the meaning of "plurality" is two or more, unless otherwise clearly and specifically defined.

[0027] Figure 1 FIG. 1 is a flow chart of a network security risk control method based on cloud computing according to an embodiment of the present application. Figure 1 As shown, according to the cloud computing-based network security risk control method of the embodiment of the present application, the method includes: S110, obtaining historical network attack alarm information, system log data and user login behavior data collected by the cloud computing platform; S120, extracting attack pattern recognition associated feature vectors and user login behavior data associated feature vectors from the historical network attack alarm information collected by the cloud computing platform, the system log data and the user login behavior data; S130, obtaining a network security risk level label based on the attack pattern recognition associated feature vectors and the user login behavior data associated feature vectors.

[0028] In the above-mentioned cloud computing-based network security risk control method, the step S110 obtains historical network attack alarm information, system log data and user login behavior data collected by the cloud computing platform. It should be understood that traditionally, there is a strong isolation between the industrial control system and the external network, which provides basic security protection for the system. However, with the rapid development of the industrial Internet, this isolation state has been broken, and the network environment has become more open, causing these systems to face potential network attack risks and bring serious security risks. In order to cope with the increasing network security threats, the industrial Internet usually deploys network security devices such as intrusion detection systems (IDS) and network application firewalls (WAF). The main functions of these devices are to monitor network traffic, identify abnormal behaviors and prevent potential attacks. At the same time, network security analysts are responsible for monitoring and processing a large number of alarms generated by systems and devices. However, network security devices often generate a large number of low-risk alarms and false alarms during the detection process. Due to the large number of alarms, it is difficult for analysts to process them one by one, which leads to delayed responses to potential threats. Therefore, in the technical solution of this application, historical network attack alarm information, system log data and user login behavior data collected by the cloud computing platform are obtained, and combined with deep learning technology, network security risk level labels are generated to effectively identify potential security threats and reduce low-risk alarms and false alarms. This will optimize the efficiency of alarm processing, improve the interpretability and transparency of the system, and enhance the real-time response capability and scalability of the system.

[0029] Specifically, historical network attack alert information can understand the frequency, type and source of attacks, thereby identifying attack patterns and trends. System log data provides a detailed record of system operation status and events. These logs include information such as user operations, system errors, application exceptions, etc., which can help security teams track system activities and identify abnormal behaviors. User login behavior data is an important basis for understanding user access patterns and behaviors. By monitoring the user's login time, location and device information, the security team can identify abnormal login behaviors, such as access from unusual locations or logins during non-working hours. Such behavior may indicate account theft or internal threats. Combining this data for comprehensive analysis can improve the response speed and effectiveness of security incidents and take timely measures.

[0030] In the above-mentioned network security risk control method based on cloud computing, the step S120 extracts the attack pattern recognition associated feature vector and the user login behavior data associated feature vector from the historical network attack alarm information collected by the cloud computing platform, the system log data and the user login behavior data. In this way, the associated feature vectors of attack pattern recognition and user login behavior are extracted from the data collected by the cloud computing platform to construct a feature vector model, and a machine learning algorithm can be used to perform real-time anomaly detection and attack prediction. This intelligent analysis not only improves the efficiency of security monitoring, but also reduces the necessity of human intervention, thereby speeding up the response speed.

[0031] In a specific embodiment of the present application, the step S120 includes: performing feature extraction on the historical network attack alarm information to obtain a text semantic association feature vector of the historical network attack alarm information; performing feature extraction on the system log data to obtain a system log data segment information semantic understanding feature vector; associating the historical network attack alarm information text semantic association feature vector and the system log data segment information semantic understanding feature vector to obtain the attack pattern recognition association feature vector; performing feature extraction on the user login behavior data to obtain the user login behavior data association feature vector.

[0032] It should be understood that historical network attack alert information usually contains a large amount of text data, involving multi-dimensional information such as attack type, time, source IP, target system, etc. Through feature extraction, this information can be converted into a structured feature vector. Among them, the structured representation of the feature vector helps to improve data processing efficiency, reduce the time and resources required for manual analysis, and ensure a rapid response to potential threats. Considering that different network attack alerts may use different description methods, by extracting semantically associated feature vectors, the similarities and correlations between these alerts can be identified.

[0033] Furthermore, the amount of log data generated by modern systems is large and complex, covering a variety of events, operations, and exception information. These logs usually exist in text form, containing multi-dimensional information such as timestamps, event types, source addresses, and destination addresses. That is, system logs often contain highly technical terms and descriptions, and ordinary text analysis may not be able to capture their deep meaning. By extracting semantic feature vectors, key events in logs and their contextual relationships can be better identified. For example, when dealing with security incidents, feature vectors can help identify the relationship between a specific event and other related events, such as an operation performed by a user at a specific time may be directly related to subsequent system anomalies. This in-depth understanding helps to quickly locate problems and conduct effective troubleshooting.

[0034] Furthermore, the network security environment is complex and ever-changing, and a single data source often cannot fully reflect the security situation. Historical network attack alert information provides a detailed description of the attack event, while system log data records the operation behavior and abnormal conditions within the system. By correlating the feature vectors of these two types of data, a richer and more multidimensional security situation model can be constructed. This comprehensive analysis helps to more clearly identify potential attack patterns and vulnerabilities, and improve the ability to identify network threats.

[0035] In particular, by analyzing the user's login history, features such as login time, login location, device type, login frequency, etc. can be extracted. These features can help security teams detect situations that are inconsistent with the user's normal behavior patterns, such as a user logging in from an unfamiliar location late at night, or the same account being logged in multiple times by different devices in a very short period of time. This anomaly detection capability is key to preventing account theft and other malicious activities. By correlating feature vectors, the model can learn the difference between normal login behavior and abnormal behavior, thereby improving the accuracy of predicting future login behavior.

[0036] Figure 2 The present invention is a flowchart of extracting features from the historical network attack warning information in the network security risk control method based on cloud computing according to an embodiment of the present application to obtain a semantically associated feature vector of the historical network attack warning information text. Figure 2As shown, in a specific embodiment of the present application, feature extraction is performed on the historical network attack alarm information to obtain a semantically associated feature vector of the historical network attack alarm information text, including: S210, embedding the historical network attack alarm information through a historical network attack alarm information text word embedding model to obtain multiple historical network attack alarm information text word vectors; S220, passing the multiple historical network attack alarm information text word vectors through a historical network attack alarm information text word bidirectional long short-term memory model to obtain multiple historical network attack alarm information text feature vectors; S230, cascading the multiple historical network attack alarm information text feature vectors into the multiple historical network attack alarm information text feature vectors.

[0037] It should be understood that historical network attack warning information usually exists in the form of natural language, which makes it difficult for machines to directly understand its content. The word embedding model can convert each word or phrase in the text into a vector representation in a high-dimensional space. This conversion not only retains the semantic information of the text, but also captures the relationship between different words. For example, in a vector space, words with similar semantics will be mapped to similar positions, so that computers can better understand and process text information. By generating word vectors, the semantic analysis capability of warning information can be enhanced. Specifically, the historical network attack warning information is segmented to obtain a historical network attack word sequence; the embedding layer of the historical network attack warning information text word embedding model is used to map each historical network attack word in the historical network attack word sequence to a word embedding vector to obtain multiple historical network attack warning information text word vectors.

[0038] Furthermore, network attack warning information is usually generated in chronological order, and attack behaviors often show temporal continuity. Traditional neural network models may not be able to effectively capture long-distance dependencies when processing time series data. LSTM, through its unique gating mechanism, can maintain the validity of information when processing longer sequences. Inputting the word vectors of historical network attack warning information into the bidirectional LSTM can help the model learn long-term temporal dependencies, thereby more accurately capturing the evolution of attack behaviors. Among them, an important advantage of the bidirectional long short-term memory model is that it can simultaneously consider the forward and backward context of the text sequence. When processing historical network attack warning information, the information in the warning text is often context-dependent. For example, the meaning of an attack description may be related to the keywords before and after. Through the bidirectional LSTM, the model can capture these contextual relationships more comprehensively, thereby improving the accuracy of understanding the warning information. This deep understanding of the context enables the model to identify potential patterns and similar features of attacks, thereby improving the detection effect. The feature vector processed by the bidirectional LSTM can significantly improve the detection and classification capabilities of the network security system for different attack types, helping to timely discover and respond to potential security threats. Specifically, the historical network attack warning information text word bidirectional long short-term memory model is used to perform global context semantic encoding on the multiple historical network attack warning information text word vectors to obtain multiple historical network attack warning information text feature vectors.

[0039] Furthermore, in network attack detection, the types of attacks are diverse and complex, and a single feature vector may not be sufficient to fully describe the characteristics of a specific alarm. By cascading multiple feature vectors, more information can be provided to the model, enabling it to better distinguish different types of attacks.

[0040] Figure 3 The present invention is a flowchart of extracting features from the system log data to obtain a semantic understanding feature vector of the system log data segment information in the network security risk control method based on cloud computing according to an embodiment of the present application. Figure 3 As shown, in a specific embodiment of the present application, feature extraction is performed on the system log data to obtain a system log data segment information semantic understanding feature vector, including: S310, passing the system log data through a converter-based system log data semantic understanding model to obtain a system log data segment information sequence; S320, encoding the system log data segment information sequence through the system log data segment information context to obtain the system log data segment information semantic understanding feature vector.

[0041] It should be understood that system log data is usually a large and diversely structured information collection containing a large amount of text information. Transformer-based models, such as BERT and GPT, use a self-attention mechanism to maintain high efficiency when processing large-scale text. This mechanism allows the model to consider all the words in the log during processing and assign them corresponding weights in the context. This method avoids the limitations of traditional sequence models when processing long texts, making the extraction of information more comprehensive and accurate. Compared with traditional convolutional neural network models, transformer-based models are good at capturing complex semantic relationships and can handle problems such as synonyms, antonyms, and context changes. Specifically, the system log data is segmented to obtain a system log segment sequence; the embedding layer of the transformer-based system log data semantic understanding model is used to map each system log segment in the system log segment sequence to a segment embedding vector to obtain a system log data segment information sequence.

[0042] Furthermore, log information is often time-series, and the meaning of each record may be affected by the previous and next log entries. Through context encoding, corresponding context information can be given to each log segment, so that the feature vector contains not only the direct content of the log, but also the previous and next contexts related to it. In this way, the contextual relationship of each log data segment can be integrated into the feature vector. This method enables the model to capture complex semantic relationships, so as to understand the meaning of the log more accurately. Specifically, the system log data segment information sequence is semantically encoded based on the global context using the converter-based Bert model of the system log data segment information context encoding to obtain multiple system log feature vectors; and, the multiple system log feature vectors are cascaded to obtain the system log data segment information semantic understanding feature vector.

[0043] In a specific embodiment of the present application, the semantic association feature vector of the historical network attack alarm information text and the semantic understanding feature vector of the system log data segment information are associated to obtain the attack pattern recognition association feature vector, including: establishing a connection with a database through the DriverManager.getConnection method; preparing an SQL query statement, and using PreparedStatement to create a query statement for the semantic association feature vector of the historical network attack alarm information text and the semantic understanding feature vector of the system log data segment information; executing the query through the executeQuery method of the PreparedStatement object, and storing the result set in the ResultSet; extracting the semantic association feature vector of the historical network attack alarm information text and the semantic understanding feature vector of the system log data segment information from the ResultSet; performing element-by-element multiplication operations on the semantic association feature vector of the historical network attack alarm information text and the semantic understanding feature vector of the system log data segment information by calling the multiplyVectors method to generate an attack pattern recognition association feature vector; outputting or storing the obtained attack pattern recognition association feature vector to the database, and the storage step is implemented by calling the storeResult method.

[0044] Part of the deployment code is shown below.

[0045]

[0046]

[0047]

[0048]

[0049] Specifically, first, a connection to the database is established through the DriverManager.getConnection method. This process ensures that the program can effectively access the database that stores network attack-related data. After successfully establishing the connection, the program prepares the SQL query statement and uses PreparedStatement to construct a query for historical network attack alerts and system logs. This structured query method not only improves the security of the code and prevents SQL injection attacks, but also flexibly handles input parameters. After executing the query, the program obtains the ResultSet through the executeQuery method, which is where the query results are stored. After obtaining the result set, the program extracts the semantic association feature vector (attackInfoVector) of the historical network attack alert information text and the semantic understanding feature vector (logDataVector) of the system log data segment. These two feature vectors are the key to attack pattern recognition because they contain rich information about past network attacks. Next, the program uses the custom multiplyVectors method to perform element-by-element multiplication on these two feature vectors to generate an attack pattern recognition association feature vector. The significance of this step is that it combines data from two different sources to form a comprehensive view, which is convenient for subsequent analysis and processing. Finally, the program outputs or stores the calculated results through the storeResult method. This storage step ensures that the results can be used by subsequent data processing or analysis modules, providing valuable insights for network security experts.

[0050] This can help the network security team quickly identify potential attack patterns, thereby improving network protection capabilities. In this way, enterprises can respond to and prevent potential security threats in a dynamically changing network environment and ensure information security.

[0051] It should be understood that PreparedStatement is an important interface of JDBC API in Java, which is used to execute precompiled SQL statements. Unlike regular Statement, PreparedStatement allows developers to predefine the structure of SQL queries and dynamically bind parameters at runtime, thereby improving security and performance. By using precompiled statements, PreparedStatement can effectively prevent SQL injection attacks because the parameters entered by the user will be automatically escaped. In addition, since the SQL statement is compiled once and can be executed multiple times, the database parsing and compilation overhead is reduced, thereby improving execution efficiency. PreparedStatement provides a safe and efficient way to interact with the database.

[0052] Figure 4The present invention is a flowchart of extracting features from the user login behavior data to obtain a feature vector associated with the user login behavior data in a network security risk control method based on cloud computing according to an embodiment of the present application. Figure 4 As shown, in a specific embodiment of the present application, feature extraction is performed on the user login behavior data to obtain a feature vector associated with the user login behavior data, including: S410, passing the user login behavior data through a user login behavior data semantic understanding model to obtain a plurality of user login behavior data text feature vectors; S420, arranging the plurality of user login behavior data text feature vectors and passing them through a user login behavior data feature encoder based on a void convolutional neural network to obtain the user login behavior data associated feature vector.

[0053] It should be understood that by converting login behavior data into feature vectors, unusual login activities can be quickly identified. For example, when a user logs in at an unusual time or place, the feature vector can provide instant feedback to the system. This real-time performance can help security teams respond quickly to potential security threats and reduce risks. Specifically, the user login behavior data is converted into a login behavior embedding vector using the embedding layer of the user login behavior data semantic understanding model to obtain a sequence of login behavior embedding vectors; the sequence of login behavior embedding vectors is encoded based on global context semantics using the converter-based Bert model of the user login behavior data semantic understanding model to obtain multiple user login behavior data text feature vectors.

[0054] Furthermore, user login behavior data usually exhibits time series characteristics, strong correlation and long-term dependence. When processing time series data, traditional convolutional neural networks may not be able to effectively capture long-distance context information due to the size limit of the convolution kernel. The dilated convolution increases the interval between the convolution kernels, allowing the model to capture a wider range of context information without increasing parameters, thereby more accurately understanding the evolution of user behavior. Among them, arranging the feature vectors of multiple user login behaviors to form a continuous input sequence provides rich context information for the dilated convolutional neural network. This arrangement allows the network to capture the relationship between features during the learning process, thereby improving the ability of feature extraction. Among them, the structure of the dilated convolution can flexibly adjust the receptive field as needed, so that the model can adaptively adjust its learning ability when processing input data of different sizes. This flexibility not only improves the performance of the model, but also adapts to the diverse behavioral characteristics of different user groups, ensuring that good results can be maintained when facing various complex user behaviors. Specifically, the multiple user login behavior data text feature vectors are arranged as a login behavior input vector; each layer of the first convolutional neural network model of the user login behavior data feature encoder based on the void convolutional neural network is used to perform void convolution processing based on the first convolution kernel, pooling processing along the channel dimension and non-linear activation processing on the input data in the forward pass of the layer so that the first convolutional neural network model outputs a first feature vector from the last layer; each layer of the second convolutional neural network model of the user login behavior data feature encoder based on the void convolutional neural network is used to perform void convolution processing based on the second convolution kernel, pooling processing along the channel dimension and non-linear activation processing on the input data in the forward pass of the layer so that the second convolutional neural network model outputs a second feature vector from the last layer; the first feature vector and the second feature vector are fused to obtain the user login behavior data associated feature vector.

[0055] In the above-mentioned cloud computing-based network security risk control method, the step S130 obtains a network security risk level label based on the attack pattern recognition associated feature vector and the user login behavior data associated feature vector. It should be understood that the assessment of network security risks often needs to consider multiple factors. The attack pattern recognition feature vector provides detailed information about potential attacks, including the type, frequency, means and target characteristics of the attack. The feature vector of the user login behavior data reflects the user's normal behavior pattern, login habits and usage environment. By combining these two types of feature vectors, the security risks in the network environment can be comprehensively assessed and potential threats can be identified. Furthermore, by combining the feature vectors of the attack pattern and the user login behavior data, and analyzing them using machine learning or deep learning models, a risk level label can be quickly generated. This efficient processing capability can significantly improve the response speed of the security team and respond to potential security incidents in a timely manner.

[0056] In a specific embodiment of the present application, a network security risk level label is obtained based on the attack pattern identification associated feature vector and the user login behavior data associated feature vector, including: fusing the attack pattern identification associated feature vector and the user login behavior data associated feature vector to obtain a risk level judgment classification feature vector; performing a model overfitting adjustment based on a distance topology walk map on the risk level judgment classification feature vector to obtain a sparse optimized risk level judgment classification feature vector; passing the sparse optimized risk level judgment classification feature vector through a classifier to obtain a classification result, and the classification result is used to represent the network security risk level label.

[0057] It should be understood that the network environment is dynamic and the threats are constantly evolving. By integrating attack patterns and user behavior data, a real-time monitoring system can be established to dynamically assess the risk level based on the current feature vector. This dynamic risk assessment mechanism can ensure that security policies are updated in a timely manner and respond quickly to emerging threats.

[0058] In particular, in the technical solution of the present application, the risk level judgment classification feature vector is formed by the fusion of data from multiple sources, including feature vectors of historical network attack alarm information, system log data, and user login behavior data, with different dimensions and distribution characteristics, and they have significant differences in numerical range, feature space, and correlation. In the fusion process, different features may introduce different noises and irrelevant information, which may produce interactive effects in the risk level judgment classification feature vector, interfering with the classifier's recognition of important features. If the design of the learning parameter matrix fails to effectively distinguish this information, the classifier will be affected by noise during the training process, resulting in the classifier's adaptability to training data being enhanced, but the generalization ability to unknown data is reduced, that is, the model is overfitted, resulting in useful information being submerged by the redundant structure of the learning parameter matrix, and ultimately affecting the classification accuracy of the network security risk level label. Therefore, in the technical solution of the present application, the risk level judgment classification feature vector is adjusted based on the model overfitting of the distance topology walk map to obtain a sparse optimized risk level judgment classification feature vector.

[0059] Among them, the risk level judgment classification feature vector is subjected to model overfitting adjustment based on the distance topology walk map to obtain a sparse optimized risk level judgment classification feature vector, including: extracting each row vector of the learning parameter matrix in the classifier as a set of attack risk learning parameter row vectors; calculating the attack risk entropy degradation maximization simulation value between the risk level judgment classification feature vector and each attack risk learning parameter row vector in the set of attack risk learning parameter row vectors to obtain a set of attack risk entropy degradation maximization simulation values; based on the comparison between each attack risk entropy degradation maximization simulation value in the set of attack risk entropy degradation maximization simulation values ​​and a preset threshold, the learning parameter matrix is ​​subjected to gated pruning processing to obtain an attack risk learning parameter entropy degradation optimization matrix; the risk level judgment classification feature vector is matrix multiplied with the attack risk learning parameter entropy degradation optimization matrix to obtain the sparse optimized risk level judgment classification feature vector.

[0060] The optimization steps are specifically expressed as follows:

[0061] P = {p1, p2, ..., p i ,…,p n}

[0062]

[0063] w i =mask(D i )

[0064]

[0065] Ps ={w1·p1,w2·p2,...,w i ·p i , ..., w n ·p n}

[0066]

[0067] Among them, P is the set of row vectors of attack risk learning parameters, {…} is a set operation, p1, p2, p i 、p n are the eigenvalues ​​of the first, second, i-th, and n-th attack risk learning parameter row vectors in the set of attack risk learning parameter row vectors, respectively. i is the ith attack risk entropy degradation maximization simulation value in the set of attack risk entropy degradation maximization simulation values, max is the maximum value function, D(v1, p i ) represents the calculation of vectors v1 and p i The Euclidean distance between them, v1 is the risk level judgment classification feature vector, p i T is the transposed vector of the row vector of the i-th attack risk learning parameter, L is the length of the feature vector, is matrix multiplication, w1, w2, w i 、w n are the first, second, i-th, and n-th learning parameter mask values, respectively. Mask is the mask operation, θ represents the preset threshold, and P s is the attack risk learning parameter entropy degradation optimization matrix, and v1' is the sparse optimization risk level judgment classification feature vector.

[0068] In the technical solution of the present application, it is taken into consideration that in the process of inputting the risk level judgment classification feature vector into the learning parameter matrix of the classifier to obtain the classification result of the network security risk level label, there is a mismatch between the structure of the learning parameter matrix itself and the risk level judgment classification feature vector, that is, the learning parameter matrix has structural redundancy and information confusion relative to the risk level judgment classification feature vector, which may cause feature redundancy or noise in the classification result of the network security risk level label, resulting in model overfitting.

[0069] Based on this, in the technical solution of the present application, the risk level judgment classification feature vector is subjected to a model overfitting adjustment based on a distance topology walking map, which uses the risk level judgment classification feature vector as a walking node, and uses the feature distribution between the risk level judgment classification feature vector and each row vector in the learning parameter matrix to simulate the walking pattern, and uses the distance topology between the risk level judgment classification feature vector and each row vector in the learning parameter matrix as a walking map. In this way, the walking result of the walking node in a specific walking pattern on the walking map is used to obtain the attack risk entropy degradation maximization simulation value. Furthermore, based on the comparison between each attack risk entropy degradation maximization simulation value in the set of attack risk entropy degradation maximization simulation values ​​and a preset threshold, the part of the learning parameter matrix that does not contribute significantly to the input data representation and may even introduce noise or redundant information is screened out. Specifically, based on the comparison result, the learning parameter matrix is ​​gated and pruned to obtain the attack risk learning parameter entropy degradation optimization matrix. Finally, the risk level judgment classification feature vector is linearly modulated using the structure-optimized learning parameter matrix as a feature modulation unit to obtain the sparse optimized risk level judgment classification feature vector.

[0070] Furthermore, by processing the sparse optimization risk level judgment classification feature vector through the classifier, a network security risk level label can be generated in real time. The classifier judges the current risk status based on the combination of different features, so that the system can dynamically adjust the security policy. Different risk level labels can correspond to different response measures, such as emergency handling of high-risk events, while low-risk events can be monitored or recorded. This flexible risk classification and processing mechanism helps to improve the overall response capability of the network security protection system. This not only improves the efficiency of the network security system, but also reduces human judgment errors and improves the reliability of the overall security protection.

[0071] In summary, the embodiment of the present application first obtains historical network attack alarm information, system log data, and user login behavior data collected by the cloud computing platform, and then uses deep learning technology to perform feature extraction and correlation analysis on the three, and finally obtains the classification result through the classifier to obtain a network security risk level label, thereby identifying potential security threats, reducing low-risk alarms and false alarms, and then optimizing the alarm processing efficiency, enhancing the interpretability and transparency of the system, and improving the real-time and scalability of the system.

[0072] Figure 5 FIG. 1 is a block diagram of a network security risk control device based on cloud computing according to an embodiment of the present application. Figure 5As shown, according to the cloud computing-based network security risk control device 100 of the embodiment of the present application, it includes: a network security risk data acquisition module 110, which is used to obtain historical network attack alarm information, system log data and user login behavior data collected by the cloud computing platform; a network security risk data processing module 120, which is used to extract attack pattern recognition associated feature vectors and user login behavior data associated feature vectors from the historical network attack alarm information collected by the cloud computing platform, the system log data and the user login behavior data; a network security risk level label classification module 130, which is used to obtain a network security risk level label based on the attack pattern recognition associated feature vector and the user login behavior data associated feature vector.

[0073] Here, those skilled in the art can understand that the specific operations of each step in the above-mentioned cloud computing-based network security risk control device have been referred to above. Figures 1 to 4 The description of the cloud computing-based network security risk control method has been introduced in detail, and therefore, its repeated description will be omitted.

[0074] As described above, the network security risk control device 100 based on cloud computing according to the embodiment of the present application can be implemented in various terminal devices. In one example, the network security risk control device 100 based on cloud computing can be integrated into the terminal device as a software module and / or a hardware module. For example, the network security risk control device 100 based on cloud computing can be a software module in the operating system of the terminal device, or can be an application developed for the terminal device; of course, the network security risk control device 100 based on cloud computing can also be one of the many hardware modules of the terminal device.

[0075] Alternatively, in another example, the cloud computing-based network security risk control device 100 and the terminal device may also be separate devices, and the cloud computing-based network security risk control device 100 may be connected to the terminal device via a wired and / or wireless network and transmit interactive information in accordance with an agreed data format.

[0076] Figure 6 1 is a structural diagram of an exemplary hardware architecture of a computing device according to a cloud computing-based network security risk control method and apparatus according to an embodiment of the present application.

[0077] like Figure 6As shown, the electronic device 10 includes an input device 11, an input interface 12, a central processing unit 13, a memory 14, an output interface 15, an output device 16, and a bus 17. The input interface 12, the central processing unit 13, the memory 14, and the output interface 15 are connected to each other through the bus 17, and the input device 11 and the output device 16 are connected to the bus 17 through the input interface 12 and the output interface 15, respectively, and then connected to other components of the electronic device 10.

[0078] Specifically, the input device 11 receives input information from the outside and transmits the input information to the central processing unit 13 through the input interface 12; the central processing unit 13 processes the input information based on the computer executable instructions stored in the memory 14 to generate output information, temporarily or permanently stores the output information in the memory 14, and then transmits the output information to the output device 16 through the output interface 15; the output device 16 outputs the output information to the outside of the electronic device 10 for user use.

[0079] In one embodiment, Figure 6 The electronic device 10 shown can be implemented as a network device, which may include: a memory configured to store programs; a processor configured to run the programs stored in the memory to execute any one of the cloud computing-based network security risk control methods described in the above embodiments.

[0080] According to an embodiment of the present application, the process described above with reference to the flowchart can be implemented as a computer software program. For example, an embodiment of the present application includes a computer program product, which includes a computer program tangibly contained on a machine-readable medium, and the computer program includes a program code for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from a network, and / or installed from a removable storage medium.

[0081] It will be appreciated by those skilled in the art that all or some of the steps, systems, and functional modules / units in the methods disclosed above may be implemented as software, firmware, hardware, and appropriate combinations thereof. In hardware implementations, the division between the functional modules / units mentioned in the above description does not necessarily correspond to the division of physical components; for example, a physical component may have multiple functions, or a function or step may be performed by several physical components in cooperation. Some or all physical components may be implemented as software executed by a processor, such as a central processing unit, a digital signal processor, or a microprocessor, or implemented as hardware, or implemented as an integrated circuit, such as an application-specific integrated circuit. Such software may be distributed on a computer-readable medium, which may include a computer storage medium (or non-transitory medium) and a communication medium (or temporary medium). As known to those skilled in the art, the term computer storage medium includes volatile and non-volatile, removable and non-removable media implemented in any method or technology for storing information (such as computer-readable instructions, data structures, program modules, or other data). Computer storage media include, but are not limited to, RAM, ROM, EEPROM, flash memory or other memory technology, CD-ROM, digital versatile disks (DVD) or other optical disk storage, magnetic cassettes, magnetic tapes, magnetic disk storage or other magnetic storage devices, or any other medium that can be used to store the desired information and can be accessed by a computer. In addition, it is well known to those skilled in the art that communication media typically contain computer-readable instructions, data structures, program modules, or other data in a modulated data signal such as a carrier wave or other transport mechanism, and may include any information delivery media.

[0082] It is to be understood that the above embodiments are merely exemplary embodiments used to illustrate the principles of the present application, but the present application is not limited thereto. For those skilled in the art, various modifications and improvements can be made without departing from the spirit and substance of the present application, and these modifications and improvements are also considered to be within the scope of protection of the present application.

Claims

1. A network security risk control method based on cloud computing, characterized in that: include: Obtain historical network attack warning information, system log data, and user login behavior data collected by the cloud computing platform; Extracting attack pattern recognition associated feature vectors and user login behavior data associated feature vectors from the historical network attack alarm information collected by the cloud computing platform, the system log data, and the user login behavior data; Based on the attack pattern recognition associated feature vector and the user login behavior data associated feature vector, a network security risk level label is obtained.

2. The network security risk control method based on cloud computing according to claim 1 is characterized in that: Extracting attack pattern recognition associated feature vectors and user login behavior data associated feature vectors from the historical network attack alarm information collected by the cloud computing platform, the system log data, and the user login behavior data, including: Performing feature extraction on the historical network attack warning information to obtain a text semantic association feature vector of the historical network attack warning information; Performing feature extraction on the system log data to obtain a semantic understanding feature vector of the system log data segment information; Associating the historical network attack warning information text semantic association feature vector with the system log data segment information semantic understanding feature vector to obtain the attack pattern recognition association feature vector; Feature extraction is performed on the user login behavior data to obtain a feature vector associated with the user login behavior data.

3. The network security risk control method based on cloud computing according to claim 2 is characterized in that: Performing feature extraction on the historical network attack warning information to obtain a text semantic association feature vector of the historical network attack warning information includes: The historical network attack warning information is embedded into a historical network attack warning information text word model to obtain multiple historical network attack warning information text word vectors; Passing the multiple historical network attack warning information text word vectors through a historical network attack warning information text word bidirectional long short-term memory model to obtain multiple historical network attack warning information text feature vectors; The multiple historical network attack warning information text feature vectors are cascaded into the multiple historical network attack warning information text feature vectors.

4. The network security risk control method based on cloud computing according to claim 3 is characterized in that: Feature extraction is performed on the system log data to obtain a semantic understanding feature vector of the system log data segment information, including: The system log data is passed through a converter-based system log data semantic understanding model to obtain a system log data segment information sequence; The system log data segment information sequence is encoded through the system log data segment information context to obtain the system log data segment information semantic understanding feature vector.

5. The network security risk control method based on cloud computing according to claim 4 is characterized in that: Associating the historical network attack warning information text semantic association feature vector with the system log data segment information semantic understanding feature vector to obtain the attack pattern recognition association feature vector, including: Establish a connection with the database through the DriverManager.getConnection method; Prepare SQL query statements and use PreparedStatement to create query statements for the semantic association feature vectors of historical network attack alarm information text and the semantic understanding feature vectors of system log data segment information; Execute the query through the executeQuery method of the PreparedStatement object and store the result set in ResultSet; Extracting the semantic association feature vector of the historical network attack warning information text and the semantic understanding feature vector of the system log data segment information from the ResultSet; By calling the multiplyVectors method, the semantic association feature vector of the historical network attack alarm information text and the semantic understanding feature vector of the system log data segment information are multiplied element by element to generate an attack pattern recognition association feature vector; The obtained attack pattern recognition associated feature vector is output or stored in a database, and the storage step is implemented by calling the storeResult method.

6. The network security risk control method based on cloud computing according to claim 5 is characterized in that: Extracting features from the user login behavior data to obtain a feature vector associated with the user login behavior data includes: The user login behavior data is passed through a user login behavior data semantic understanding model to obtain a plurality of user login behavior data text feature vectors; The multiple user login behavior data text feature vectors are arranged and passed through a user login behavior data feature encoder based on a dilated convolutional neural network to obtain the user login behavior data associated feature vector.

7. The network security risk control method based on cloud computing according to claim 6 is characterized in that: Based on the attack pattern recognition associated feature vector and the user login behavior data associated feature vector, a network security risk level label is obtained, including: Fusion of the attack pattern recognition associated feature vector and the user login behavior data associated feature vector to obtain a risk level judgment classification feature vector; The risk level judgment classification feature vector is adjusted by model overfitting based on the distance topology walk map to obtain a sparse optimized risk level judgment classification feature vector; The sparse optimized risk level judgment classification feature vector is passed through a classifier to obtain a classification result, and the classification result is used to represent a network security risk level label.

8. The network security risk control method based on cloud computing according to claim 7 is characterized in that: The risk level judgment classification feature vector is adjusted by model overfitting based on the distance topology walk map to obtain a sparse optimized risk level judgment classification feature vector, including: Extracting each row vector of the learning parameter matrix in the classifier as a set of attack risk learning parameter row vectors; Calculating attack risk entropy degradation maximization simulation values ​​between the risk level judgment classification feature vector and each attack risk learning parameter row vector in the set of attack risk learning parameter row vectors to obtain a set of attack risk entropy degradation maximization simulation values; Based on the comparison between each attack risk entropy degradation maximization simulation value in the set of attack risk entropy degradation maximization simulation values ​​and a preset threshold, the learning parameter matrix is ​​gated and pruned to obtain an attack risk learning parameter entropy degradation optimization matrix; The risk level judgment classification feature vector is matrix multiplied with the attack risk learning parameter entropy degradation optimization matrix to obtain the sparse optimized risk level judgment classification feature vector.

9. A network security risk control device based on cloud computing, characterized in that: include: The network security risk data acquisition module is used to obtain historical network attack warning information, system log data and user login behavior data collected by the cloud computing platform; A network security risk data processing module, used to extract attack pattern recognition associated feature vectors and user login behavior data associated feature vectors from the historical network attack warning information collected by the cloud computing platform, the system log data and the user login behavior data; The network security risk level label classification module is used to obtain a network security risk level label based on the attack pattern recognition associated feature vector and the user login behavior data associated feature vector.

10. An electronic device, characterized in that: include: at least one processor; And, a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute the cloud computing-based network security risk control method as described in any one of claims 1 to 8.

Images