Anomaly detection and response method and system based on intelligent perception drive

Abstract

The present application provides an anomaly detection and response method and system based on intelligent perception drive, which is particularly applicable to cloud service information security monitoring. The method includes real-time acquisition of multi-type data and fusion through Kalman filtering and weighted averaging; constructing an autoencoder network for feature extraction and dimensionality reduction, detecting anomalies through reconstruction errors and setting dynamic thresholds; introducing reinforcement learning optimization algorithms, designing dynamic response strategies and defining reward mechanisms to improve response effects; designing automated response processes, including alarms, isolation and repair measures; using transfer learning technology to migrate optimized autoencoder network knowledge to new scenarios; building a cloud-edge collaborative architecture to centrally analyze data and synchronize in real time. This method effectively improves the real-time and accuracy of information security monitoring, can quickly respond to potential threats, reduce security risks, and is suitable for a variety of information security monitoring scenarios.

Description

Technical Field

[0001] The present invention relates to the field of information security, and in particular to an intelligent perception driven method and system for abnormality detection and response in an information system. Background Art

[0002] With the rapid development of information technology and the widespread application of emerging technologies such as cloud computing, the Internet of Things and big data, information security issues are becoming increasingly prominent. As a new computing model, cloud services provide users with convenient resource sharing and data storage services, but they also face a variety of security threats such as data leakage, network attacks, and malware. Traditional information security monitoring methods often rely on static rules and manual intervention, which are difficult to cope with complex and changing security threats, and have a slow response speed, which easily leads to the occurrence and spread of security incidents.

[0003] However, existing anomaly detection methods still have some shortcomings. For example, existing anomaly detection systems often rely on a single data source and lack effective fusion and analysis of multi-source data, resulting in poor detection results. Many systems lack a fast and effective response mechanism after anomaly detection, resulting in the expansion of potential losses. At the same time, existing solutions lack adaptive learning capabilities when facing new attacks or anomalies, making it difficult to update models in a timely manner and resulting in a high false alarm rate. Current deep learning models lack interpretability in anomaly detection and are difficult to provide users with clear decision-making basis. Moreover, existing models have poor adaptability in different application scenarios and lack effective transfer learning mechanisms.

[0004] Therefore, there is an urgent need for a more intelligent and automated anomaly detection and response method to enhance the information security monitoring capabilities of cloud services. Summary of the invention

[0005] In order to solve the above problems, the present invention proposes an anomaly detection and response method and system based on intelligent perception drive. This method can effectively identify potential security threats and respond quickly by acquiring multiple types of data in real time and combining advanced machine learning and deep learning technologies.

[0006] The present invention specifically provides the following technical solutions:

[0007] An anomaly detection and response method based on intelligent perception drive, the method is specifically applied to cloud service information security monitoring, characterized in that the method comprises the following steps:

[0008] S1. Real-time acquisition of multiple types of data in an information system; using Kalman filtering combined with weighted averaging to fuse the multiple types of data;

[0009] S2. construct an autoencoder network, input the fused data, perform feature extraction and dimensionality reduction; detect anomalies by reconstructing errors, and set dynamic thresholds to determine the occurrence of abnormal events;

[0010] S3. Introduce the optimization algorithm of reinforcement learning and design a dynamic response strategy to adjust the response measures based on historical data and real-time feedback; define the reward mechanism to optimize the effect of the response strategy; and introduce LIME interpretability technology;

[0011] The specific reward mechanism is as follows:

[0012] When the information system identifies and responds to an abnormal event, a positive reward is given;

[0013] When the information system mistakenly identifies normal time as abnormal, a negative penalty is imposed;

[0014] The assistant combines the response time and the stability of the information system over a period of time to give additional rewards;

[0015] S4. Design an automated response process, which specifically includes alerting, isolation, and repair;

[0016] S5. Using transfer learning technology, the knowledge of the optimized autoencoder network for anomaly detection is transferred to new scenarios; the new scenarios include industrial Internet of Things information security monitoring, smart home security monitoring, financial transaction monitoring, and medical health monitoring;

[0017] S6. Design a cloud-edge collaborative architecture and deploy the autoencoding network on edge devices;

[0018] The specific construction process of the cloud-edge collaborative architecture is as follows:

[0019] Performing preliminary processing and anomaly detection on the fused data at the edge device to reduce latency;

[0020] Centrally store and analyze data from multiple edge nodes to train and learn knowledge of the autoencoder network;

[0021] Synchronize data between edge devices and cloud platforms in real time to facilitate parameter updates and response strategy optimization of the autoencoder network;

[0022] S7. Demonstrate the basis and response strategy of anomaly detection based on the developed visualization tool.

[0023] Optionally, in S1,

[0024] The multi-type data is text data, specifically including network traffic data, system logs, user behavior data, application data, device status data, security event data and threat intelligence data.

[0025] Optionally, in S2, the feature extraction is performed according to task requirements, specifically including:

[0026] When it is necessary to monitor network attacks and abnormal traffic, extract traffic size, traffic direction, protocol type, source IP and destination IP, port number, connection duration, and packet interval characteristics;

[0027] When it is necessary to identify system failures or abnormal user behavior, extract log timestamps, event types, user IDs, operation types, error codes, and execution time features;

[0028] When it is necessary to detect user account theft and abnormal access, extract user login time, operation frequency, access path, residence time, and abnormal operation characteristics;

[0029] When you need to monitor application performance and identify potential security vulnerabilities, extract application response time, error rate, CPU and memory usage, and request type characteristics;

[0030] When you need to monitor the health of the device and predict device failures, extract the device operating status, including normal and faulty, CPU and memory usage, network connection status, and temperature characteristics;

[0031] When it is necessary to identify security threats and respond to security incidents, extract the characteristics of the incident occurrence time, incident type, impact scope, and incident severity;

[0032] When it is necessary to update security policies and identify potential threats in real time, extract the threat type, attack source, attack target, attack time, and attack method characteristics.

[0033] Optionally, in S2, the reconstruction error The calculation is:

[0034] ;

[0035] Where n is the data dimension, is the original input, is the reconstructed data;

[0036] Statistics of reconstruction errors under N normal events , calculate the mean μ and standard deviation ,

[0037] ;

[0038] ;

[0039] Setting Dynamic Thresholds , where k is a dynamically adjustable parameter, and the update frequency of k is 8h;

[0040] like , the system automatically marks the current event as an abnormal event and triggers the corresponding response process.

[0041] Optionally, in S3, the current system status information, including network traffic, system logs, and user behavior, is recorded as status s; and future response measures, including marking as abnormal, ignoring, and further analysis, are recorded as action a;

[0042] The action-value function Q(s,a) used to evaluate the expected benefit of taking action a in state s is defined as: ;

[0043] in, is the immediate reward for taking action a in state s, if an abnormal event is recognized and responded to correctly, The value of +1; if a normal event is mistakenly identified as an abnormality, If the response time is less than the set threshold, +0.4; if the system continuously recognizes normal events over a period of time, Value +0.6; is the probability of transitioning to state s′ after taking action a in state s; It is the maximum expected benefit of taking the optimal action a′ in the next state s′.

[0044] Optionally, in S4, when the optimized autoencoder network detects that the reconstruction error exceeds a set dynamic threshold, the system identifies the current event as an abnormal event;

[0045] The system automatically generates an alarm, which contains detailed information about the abnormal event, including the event type, occurrence time, and impact range; if the reconstruction error is within 1σ, an alarm is triggered but no immediate response is required, an email notification is sent, the response time is set to within 24 hours, and it is marked as a low-level alarm; if the reconstruction error is between 1σ and 2σ, an alarm is triggered and further monitoring is recommended, a text message notification is sent, the response time is set to within 12 hours, and it is marked as a medium-level alarm; if the reconstruction error exceeds 2σ, an emergency alarm is triggered, the system administrator is notified immediately by phone, the response time is within 30 minutes, and it is marked as a high-level alarm;

[0046] Taking into account the type and severity of the abnormal event, the system automatically executes isolation measures by calling the API of the network device or security device to ensure a rapid response; specifically, if malicious traffic is detected, the system automatically blocks the relevant IP address or port; if abnormal user behavior is detected, the system automatically locks the relevant user account to prevent further damage;

[0047] The system also enables automated repairs, including automatically restarting services or switching to backup services; if the abnormal event is related to a known vulnerability, the system can automatically trigger the patch update process; the execution process and results of all repair measures are recorded in the corresponding documents;

[0048] After the automated response, the system will record all operations and results during the response process, and adjust the response strategy and parameters by analyzing the response effect.

[0049] Optionally, in S5, the specific process of the knowledge migration is as follows:

[0050] Determine a source domain and a target domain. Specifically, save a trained autoencoder network applied in a cloud service information security monitoring scenario and determine a specific scenario type of the new scenario;

[0051] Analyze the similarities and differences between the source domain and the target domain. Specifically, identify the source domain features that are applicable in the target domain through feature selection. Use feature mapping technology to map the feature space of the source domain to the feature space of the target domain, so as to facilitate effective anomaly detection in the target domain.

[0052] Use the data from the target domain to fine-tune the autoencoder network trained in the source domain. Specifically, keep the weight of the bottleneck layer of the source domain network unchanged. Increase the learning rate and train other layers to adapt to the characteristics and data distribution of the target domain.

[0053] By monitoring the performance of the model in the target domain, parameter adjustment and optimization are performed to improve the ability to detect abnormal events in the target domain.

[0054] Optionally, the S6 further includes:

[0055] Incremental synchronization is used to ensure timely and reliable data transmission between edge devices and cloud platforms;

[0056] Implement a distributed training strategy on the cloud platform to train and optimize the autoencoder network using data from multiple edge nodes;

[0057] Implement encryption measures during data transmission; implement access control policies on edge devices and cloud platforms to ensure that only authorized users and devices can access sensitive data and models.

[0058] Optionally, the method further includes: utilizing external threat intelligence and knowledge bases to enhance contextual understanding of anomaly detection.

[0059] The present invention also provides an abnormality detection and response system based on intelligent perception drive, the system comprising:

[0060] The data collection module is used to obtain multiple types of data in the information system in real time, including network traffic data, system logs, user behavior data, application data, device status data, security event data and threat intelligence data, and transmit the data to the data fusion module;

[0061] A data fusion module, which uses Kalman filtering combined with a weighted average algorithm to fuse the multi-type data to generate fused data;

[0062] The autoencoder network module constructs an autoencoder network, receives the fused data, performs feature extraction and dimensionality reduction, and detects abnormal events through reconstruction errors; and sets a dynamic threshold according to the mean and standard deviation of the reconstruction error to determine the occurrence of abnormal events;

[0063] Reinforcement learning module: Introduce the optimization algorithm of reinforcement learning, design dynamic response strategies, adjust response measures based on historical data and real-time feedback, and define reward mechanisms to optimize the effect of response strategies;

[0064] Automated response module, which designs automated response processes, including alerts, isolation, and remediation measures, to deal with detected abnormal events;

[0065] The transfer learning module uses transfer learning technology to transfer the knowledge of the optimized autoencoder network to new scenarios, including industrial IoT information security monitoring, smart home security monitoring, financial transaction monitoring, and medical health monitoring;

[0066] The cloud-edge collaborative architecture module deploys the autoencoder network on the edge device, performs preliminary processing and anomaly detection, centrally stores and analyzes data from multiple edge nodes, and synchronizes data between edge devices and the cloud platform in real time to facilitate the parameter update of the autoencoder network and the optimization of the response strategy;

[0067] Visualization tool module, which displays the basis and response strategy of anomaly detection, making it easier to monitor and manage information security incidents;

[0068] The data storage and management module is used to monitor the system operation status, record the handling process of abnormal events, and generate reports for corresponding storage.

[0069] The present invention has the following beneficial technical effects: the present invention provides an abnormality detection and response method and system based on intelligent perception drive. Multi-source network data is acquired in real time, and multi-type data is integrated through Kalman filtering combined with weighted average algorithm; the autoencoder network is used to enable the system to automatically extract key features, reduce data dimensions, reduce computational complexity, retain important information, and improve the accuracy of abnormality detection; by statistically analyzing the reconstruction error under normal events and setting dynamic thresholds, it can more flexibly adapt to the abnormality detection needs in different scenarios and reduce the false alarm rate; the reinforcement learning algorithm is introduced, combined with the reward mechanism, the response strategy can be continuously optimized according to historical data and real-time feedback, and the adaptive ability and response efficiency of the system can be improved; the designed automated response process includes measures such as alarm, isolation and repair, which can quickly respond to detected abnormal events, reduce manual intervention, and improve response speed; through transfer learning technology, the autoencoder network knowledge trained in cloud service information security monitoring is migrated to new scenarios to improve the abnormality detection ability of the system in different application scenarios; at the same time, a cloud-edge collaborative architecture is built to reduce latency and improve response speed, and at the same time, the intelligence level of the overall system is improved by centrally storing and analyzing data from multiple edge nodes. The intelligent perception-driven anomaly detection and response method of the present invention can effectively improve the information security monitoring capability of cloud services, reduce the risk of security incidents, and provide users with a safer and more reliable cloud service environment. BRIEF DESCRIPTION OF THE DRAWINGS

[0070] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings required for use in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0071] Figure 1 A flowchart of an abnormality detection and response method based on intelligent perception drive is provided in an embodiment of the present invention. DETAILED DESCRIPTION

[0072] By monitoring the performance of the model in the target domain, parameter adjustment and optimization are performed to improve the ability to detect abnormal events in the target domain.

[0073] Exemplarily, the source domain is cloud service security monitoring.

[0074] Scenario description: Monitor applications and services on the cloud platform to prevent data leakage and service interruption. Data types: application data, network traffic data, security event data. Identify potential security events by analyzing application operation data and network traffic.

[0075] Target Domain 1: Financial Transaction Monitoring:.

[0076] Scenario description: In a financial institution, transaction data is monitored to identify fraud.

[0077] Data types: transaction records, user behavior data, device status data.

[0078] Feasibility analysis: Existing autoencoder networks can adapt to new financial transaction data through transfer learning and use historical network traffic and user behavior data to identify abnormal transaction patterns.

[0079] Target domain 2: Industrial Internet of Things security.

[0080] Scenario description: Monitor the status and operating data of industrial equipment to prevent equipment failure or safety incidents.

[0081] Data types: device status data, application data, security event data.

[0082] Feasibility analysis: Self-encoding networks can be migrated to industrial environments to identify potential failures or security threats by analyzing device status data and system logs.

[0083] Target domain 3: Smart home security.

[0084] Scenario description: Monitor the usage of smart home devices to prevent intrusion or device abuse.

[0085] Data types: user behavior data, device status data, network traffic data.

[0086] Feasibility analysis: Through transfer learning, the autoencoder network can adapt to the smart home environment and use user behavior patterns and device status data to detect abnormal activities.

[0087] Target domain 4: medical health monitoring.

[0088] Scenario description: Monitor patients' health data to identify abnormal health conditions.

[0089] Data types: user behavior data, device status data, threat intelligence data.

[0090] In summary, the multi-type data mentioned in S1, such as network traffic data, user behavior data, device status data, etc., provide rich feature support for transfer learning. The feature extraction and dimensionality reduction capabilities of the autoencoder network enable it to adapt to changes in data distribution in different scenarios. Transfer learning can effectively utilize the knowledge of existing models and reduce training time and data requirements in new scenarios.

[0091] For example, assume that there is already an anomaly detection model trained in cloud service information management, which can effectively identify abnormal behavior in network traffic. Select an autoencoder that performs well in the financial industry and ensure that it is fully trained on a specific dataset. Collect network traffic data, system logs, etc. from the medical industry. Clean the data of the new scenario, remove noise data, and perform necessary annotations such as normal and abnormal behavior annotations. According to the characteristics of the new scenario, select features similar to the source model to ensure the compatibility of the feature space. Fine-tune the source model on the dataset of the new scenario. Freeze the first few layers of the source model, such as the feature extraction layer, to retain its learned features. Only train the last few layers, such as the classification layer or reconstruction layer, to adapt to the data distribution of the new scenario. According to the characteristics and data volume of the new scenario, adjust hyperparameters such as learning rate and batch size to optimize the training effect of the model. Use the k-fold cross-validation method to evaluate the performance of the migrated model to ensure the generalization ability of the model in the new scenario. Use indicators such as accuracy, recall, and F1-score to evaluate the performance of the model in the new scenario. Deploy the fine-tuned model to edge devices or cloud platforms to ensure that it can process data in new scenarios in real time. Establish a monitoring mechanism to track the performance of the model in real time to ensure its effectiveness in new scenarios. Collect feedback data from the model in new scenarios to further optimize and adjust the model. As new data continues to flow in, use incremental learning methods to regularly update the model to adapt to changes in new scenarios. Feedback the anomaly detection results in new scenarios to the source model to form a closed loop to continuously improve the accuracy and robustness of the model. Specific implementation scenario example Assume that in the medical industry, there may be abnormal behaviors in the network traffic data and system logs of hospitals, such as unauthorized access, data leakage, etc. Through transfer learning, the anomaly detection model in the cloud service information security scenario can be migrated to the medical industry, and the existing knowledge can be used to quickly adapt to the new data environment, thereby improving the security of the medical information system.

[0092] S6. Design a cloud-edge collaborative architecture and deploy the autoencoding network on edge devices;

[0093] The specific construction process of the cloud-edge collaborative architecture is as follows:

[0094] Performing preliminary processing and anomaly detection on the fused data at the edge device to reduce latency;

[0095] Centrally store and analyze data from multiple edge nodes to train and learn knowledge of the autoencoder network;

[0096] The data between the edge device and the cloud platform are synchronized in real time to facilitate parameter update and response strategy optimization of the autoencoder network.

[0097] Optionally, the S6 further includes:

[0098] Incremental synchronization is used to ensure timely and reliable data transmission between edge devices and cloud platforms;

[0099] Implement a distributed training strategy on the cloud platform to train and optimize the autoencoder network using data from multiple edge nodes;

[0100] Implement encryption measures during data transmission; implement access control policies on edge devices and cloud platforms to ensure that only authorized users and devices can access sensitive data and models.

[0101] Exemplarily, select suitable edge devices, such as routers, gateways, edge servers, etc., which should have sufficient computing power and storage capacity to support the operation of the autoencoder network. Ensure that the edge devices are equipped with necessary hardware resources, such as CPU, GPU, memory and storage, to meet the needs of real-time data processing and anomaly detection. Implement preprocessing steps such as data cleaning, normalization and feature extraction on the edge devices to improve data quality and detection efficiency. Use the autoencoder network to perform real-time anomaly detection on the edge devices to quickly identify potential security threats and reduce latency. Design an efficient data synchronization mechanism to ensure timely and reliable data transmission between the edge devices and the cloud platform. Incremental synchronization or batch synchronization can be used. Establish a centralized storage system on the cloud platform to store data from multiple edge nodes for subsequent analysis and model training. Implement a distributed training strategy on the cloud platform to train and optimize the autoencoder network using data from multiple edge nodes. Design an automated model update mechanism to regularly synchronize model parameters on the edge devices to the cloud platform, and push the optimized model parameters on the cloud platform to the edge devices. Implement encryption measures during data transmission to ensure data security and privacy protection. Implement strict access control policies on edge devices and cloud platforms to ensure that only authorized users and devices can access sensitive data and models. Establish a monitoring system on the cloud platform to monitor the status, data flow, and anomaly detection results of edge devices in real time. Develop visualization tools to display the basis for anomaly detection, response strategies, and system performance indicators to help operation and maintenance personnel quickly understand and handle security incidents. Design an automated response mechanism on edge devices to automatically trigger alarms, isolate affected devices or users, and initiate repair processes based on detected anomalies. Establish a feedback mechanism to feed back response results and system status to the cloud platform to optimize response strategies and models.

[0102] S7. Demonstrate the basis and response strategy of anomaly detection based on the developed visualization tool.

[0103] Preferably, the method further comprises: utilizing external threat intelligence and knowledge bases to enhance contextual understanding of anomaly detection.

[0104] An embodiment of the present application further provides an abnormality detection and response system based on intelligent perception drive, the system comprising:

[0105] The data collection module is used to obtain multiple types of data in the information system in real time, including network traffic data, system logs, user behavior data, application data, device status data, security event data and threat intelligence data, and transmit the data to the data fusion module;

[0106] A data fusion module, which uses Kalman filtering combined with a weighted average algorithm to fuse the multi-type data to generate fused data;

[0107] The autoencoder network module constructs an autoencoder network, receives the fused data, performs feature extraction and dimensionality reduction, and detects abnormal events through reconstruction errors; and sets a dynamic threshold according to the mean and standard deviation of the reconstruction error to determine the occurrence of abnormal events;

[0108] Reinforcement learning module: Introduce the optimization algorithm of reinforcement learning, design dynamic response strategies, adjust response measures based on historical data and real-time feedback, and define reward mechanisms to optimize the effect of response strategies;

[0109] Automated response module, which designs automated response processes, including alerts, isolation, and remediation measures, to deal with detected abnormal events;

[0110] The transfer learning module uses transfer learning technology to transfer the knowledge of the optimized autoencoder network to new scenarios, including industrial IoT information security monitoring, smart home security monitoring, financial transaction monitoring, and medical health monitoring;

[0111] The cloud-edge collaborative architecture module deploys the autoencoder network on the edge device, performs preliminary processing and anomaly detection, centrally stores and analyzes data from multiple edge nodes, and synchronizes data between edge devices and the cloud platform in real time to facilitate the parameter update of the autoencoder network and the optimization of the response strategy;

[0112] Visualization tool module, which displays the basis and response strategy of anomaly detection, making it easier to monitor and manage information security incidents;

[0113] The data storage and management module is used to monitor the system operation status, record the handling process of abnormal events, and generate reports for corresponding storage.

[0114] Based on the same inventive concept, according to another aspect of the present invention, an embodiment of the present invention further provides a computer device, including:

[0115] at least one processor; and

[0116] The memory stores a computer program that can be run on the processor, and the processor executes the steps of any of the above methods for testing database performance when executing the program.

[0117] Based on the same inventive concept, according to another aspect of the present invention, an embodiment of the present invention further provides a computer-readable storage medium, which stores computer program instructions. When the computer program instructions are executed by a processor, the steps of any one of the above management methods are performed.

[0118] Finally, it should be noted that a person of ordinary skill in the art can understand that all or part of the processes in the above-mentioned embodiments can be implemented by instructing the relevant hardware through a computer program, and the program can be stored in a computer-readable storage medium. When the program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, the storage medium can be a disk, an optical disk, a read-only storage memory (ROM) or a random access memory (RAM), etc. The above-mentioned computer program embodiments can achieve the same or similar effects as the corresponding above-mentioned arbitrary method embodiments.

[0119] In addition, typically, the devices and equipment disclosed in the embodiments of the present invention may be various electronic terminal devices, such as mobile phones, personal digital assistants (PDAs), tablet computers (PADs), smart TVs, etc., or large terminal devices, such as servers, etc. Therefore, the protection scope disclosed in the embodiments of the present invention should not be limited to a certain type of device or equipment. The client disclosed in the embodiments of the present invention may be applied to any of the above electronic terminal devices in the form of electronic hardware, computer software, or a combination of the two.

[0120] In addition, the method disclosed in the embodiment of the present invention can also be implemented as a computer program executed by a CPU, and the computer program can be stored in a computer-readable storage medium. When the computer program is executed by the CPU, the above functions defined in the method disclosed in the embodiment of the present invention are performed.

[0121] In addition, the above method steps and system units may also be implemented using a controller and a computer-readable storage medium for storing a computer program that enables the controller to implement the above steps or unit functions.

[0122] In addition, it should be understood that the computer-readable storage medium (e.g., memory) herein can be a volatile memory or a non-volatile memory, or can include both a volatile memory and a non-volatile memory. As an example and not by way of limitation, a non-volatile memory can include a read-only memory (ROM), a programmable ROM (PROM), an electrically programmable ROM (EPROM), an electrically erasable programmable ROM (EEPROM), or a flash memory. A volatile memory can include a random access memory (RAM), which can act as an external cache memory. As an example and not by way of limitation, RAM can be obtained in a variety of forms, such as synchronous RAM (DRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), synchronous link DRAM (SLDRAM), and direct Rambus RAM (DRRAM). The storage devices of the disclosed aspects are intended to include, but are not limited to, these and other suitable types of memory.

[0123] The above are exemplary embodiments disclosed in the present invention, but it should be noted that various changes and modifications may be made without departing from the scope disclosed in the embodiments of the present invention as defined in the claims. The functions, steps and / or actions of the method claims according to the disclosed embodiments described herein do not need to be performed in any marked order. In addition, although the elements disclosed in the embodiments of the present invention may be described or required in individual form, they may also be understood as multiple unless explicitly limited to the singular.

[0124] In this specification, the same or similar parts between the various embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the embodiments described later, the description is relatively simple, and the relevant parts can be referred to the partial description of the previous embodiments.

[0125] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any changes or substitutions that can be easily thought of by a person skilled in the art within the technical scope disclosed in the present application should be included in the protection scope of the present application. Therefore, the protection scope of the present application shall be based on the protection scope of the claims.

Claims

1. An anomaly detection and response method based on intelligent perception drive, the method is specifically applied to cloud service information security monitoring, characterized in that: The method comprises the following steps: S1. Real-time acquisition of multiple types of data in the information system; using Kalman filtering combined with weighted averaging to fuse the multiple types of data; S2. construct an autoencoder network, input the fused data, perform feature extraction and dimensionality reduction; detect anomalies by reconstructing errors, and set dynamic thresholds to determine the occurrence of abnormal events; S3. Introduce the optimization algorithm of reinforcement learning and design a dynamic response strategy to adjust the response measures based on historical data and real-time feedback; define the reward mechanism to optimize the effect of the response strategy; and introduce LIME interpretability technology; The specific reward mechanism is as follows: When the information system identifies and responds to an abnormal event, a positive reward is given; When the information system mistakenly identifies normal time as abnormal, a negative penalty is imposed; The assistant combines the response time and the stability of the information system over a period of time to give additional rewards; S4. Design an automated response process, which specifically includes alerting, isolation, and repair; S5. Using transfer learning technology, the knowledge of the optimized autoencoder network for anomaly detection is transferred to new scenarios; the new scenarios include industrial Internet of Things information security monitoring, smart home security monitoring, financial transaction monitoring, and medical health monitoring; S6. Design a cloud-edge collaborative architecture and deploy the autoencoding network on edge devices; The specific construction process of the cloud-edge collaborative architecture is as follows: Performing preliminary processing and anomaly detection on the fused data at the edge device to reduce latency; Centrally store and analyze data from multiple edge nodes to train and learn knowledge of the autoencoder network; Synchronize data between edge devices and cloud platforms in real time to facilitate parameter updates and response strategy optimization of the autoencoder network; S7. Demonstrate the basis and response strategy of anomaly detection based on the developed visualization tool.

2. According to claim 1, the method for abnormal detection and response based on intelligent perception driving is characterized in that: In said S1, The multi-type data is text data, specifically including network traffic data, system logs, user behavior data, application data, device status data, security event data and threat intelligence data.

3. According to claim 1, the method for abnormal detection and response based on intelligent perception driving is characterized in that: In S2, the feature extraction is performed according to the task requirements, specifically including: When it is necessary to monitor network attacks and abnormal traffic, extract traffic size, traffic direction, protocol type, source IP and destination IP, port number, connection duration, and packet interval characteristics; When it is necessary to identify system failures or abnormal user behavior, extract log timestamps, event types, user IDs, operation types, error codes, and execution time features; When it is necessary to detect user account theft and abnormal access, extract user login time, operation frequency, access path, residence time, and abnormal operation characteristics; When you need to monitor application performance and identify potential security vulnerabilities, extract application response time, error rate, CPU and memory usage, and request type characteristics; When you need to monitor the health of the device and predict device failures, extract the device operating status, including normal and faulty, CPU and memory usage, network connection status, and temperature characteristics; When it is necessary to identify security threats and respond to security incidents, extract the characteristics of the incident occurrence time, incident type, impact scope, and incident severity; When it is necessary to update security policies and identify potential threats in real time, extract the threat type, attack source, attack target, attack time, and attack method characteristics.

4. The method for abnormal detection and response based on intelligent perception drive according to claim 3 is characterized in that: In S2, the reconstruction error The calculation is: ； Where n is the data dimension, is the original input, is the reconstructed data; Statistics of reconstruction errors under N normal events , calculate the mean μ and standard deviation , ； ； Setting Dynamic Thresholds , where k is a dynamically adjustable parameter, and the update frequency of k is 8h; like , the system automatically marks the current event as an abnormal event and triggers the corresponding response process.

5. The method for abnormal detection and response based on intelligent perception drive according to claim 4 is characterized in that: In said S3, The current system status information, including network traffic, system logs, and user behavior, is recorded as status s; the future response measures, including marking as abnormal, ignoring, and further analysis, are recorded as actions a; The action-value function Q(s,a) used to evaluate the expected benefit of taking action a in state s is defined as: ； in, is the immediate reward for taking action a in state s, if an abnormal event is recognized and responded to correctly, The value of +1; if a normal event is mistakenly identified as an abnormality, If the response time is less than the set threshold, +0.4; if the system continuously recognizes normal events over a period of time, Value +0.6; is the probability of transitioning to state s′ after taking action a in state s; It is the maximum expected benefit of taking the optimal action a′ in the next state s′.

6. The method for abnormal detection and response based on intelligent perception drive according to claim 5 is characterized in that: In said S4, When the optimized autoencoder network detects that the reconstruction error exceeds the set dynamic threshold, the system identifies the current event as an abnormal event; The system automatically generates an alarm, which contains detailed information about the abnormal event, including the event type, occurrence time, and impact range; if the reconstruction error is within 1σ, an alarm is triggered but no immediate response is required, an email notification is sent, the response time is set to within 24 hours, and it is marked as a low-level alarm; if the reconstruction error is between 1σ and 2σ, an alarm is triggered and further monitoring is recommended, a text message notification is sent, the response time is set to within 12 hours, and it is marked as a medium-level alarm; if the reconstruction error exceeds 2σ, an emergency alarm is triggered, the system administrator is notified immediately by phone, the response time is within 30 minutes, and it is marked as a high-level alarm; Taking into account the type and severity of the abnormal event, the system automatically executes isolation measures by calling the API of the network device or security device to ensure a rapid response; specifically, if malicious traffic is detected, the system automatically blocks the relevant IP address or port; if abnormal user behavior is detected, the system automatically locks the relevant user account to prevent further damage; The system also enables automated repairs, including automatically restarting services or switching to backup services; if the abnormal event is related to a known vulnerability, the system can automatically trigger the patch update process; The implementation process and results of all repair measures are recorded in the corresponding documents; After the automated response, the system will record all operations and results during the response process; Adjust response strategies and parameters by analyzing response effects.

7. The method for abnormal detection and response based on intelligent perception drive according to claim 1 is characterized in that: In S5, the specific process of the knowledge migration is as follows: Determine a source domain and a target domain. Specifically, save a trained autoencoder network applied in a cloud service information security monitoring scenario and determine a specific scenario type of the new scenario; Analyze the similarities and differences between the source domain and the target domain. Specifically, identify the source domain features that are applicable in the target domain through feature selection. Use feature mapping technology to map the feature space of the source domain to the feature space of the target domain, so as to facilitate effective anomaly detection in the target domain. Use the data from the target domain to fine-tune the autoencoder network trained in the source domain, specifically keeping the weights of the bottleneck layer of the source domain network unchanged; Increase the learning rate and train other layers to adapt to the characteristics and data distribution of the target domain; By monitoring the performance of the model in the target domain, parameter adjustment and optimization are performed to improve the ability to detect abnormal events in the target domain.

8. The method for abnormal detection and response based on intelligent perception drive according to claim 1 is characterized in that: The S6 further includes: Incremental synchronization is used to ensure timely and reliable data transmission between edge devices and cloud platforms; Implement a distributed training strategy on the cloud platform to train and optimize the autoencoder network using data from multiple edge nodes; Implement encryption measures during data transmission; implement access control policies on edge devices and cloud platforms to ensure that only authorized users and devices can access sensitive data and models.

9. The method for abnormal detection and response based on intelligent perception drive according to claim 1, characterized in that: The method also includes: utilizing external threat intelligence and knowledge bases to enhance contextual understanding of anomaly detection.

10. An abnormality detection and response system based on intelligent perception driving, used to implement an abnormality detection and response method based on intelligent perception driving according to any one of claims 1 to 9, characterized in that: The system comprises: The data collection module is used to obtain multiple types of data in the information system in real time, including network traffic data, system logs, user behavior data, application data, device status data, security event data and threat intelligence data, and transmit the data to the data fusion module; A data fusion module, which uses Kalman filtering combined with a weighted average algorithm to fuse the multi-type data to generate fused data; The autoencoder network module constructs an autoencoder network, receives the fused data, performs feature extraction and dimensionality reduction, and detects abnormal events through reconstruction errors; and sets a dynamic threshold according to the mean and standard deviation of the reconstruction error to determine the occurrence of abnormal events; Reinforcement learning module: Introduce the optimization algorithm of reinforcement learning, design dynamic response strategies, adjust response measures based on historical data and real-time feedback, and define reward mechanisms to optimize the effect of response strategies; Automated response module, which designs automated response processes, including alerts, isolation, and remediation measures, to deal with detected abnormal events; The transfer learning module uses transfer learning technology to transfer the knowledge of the optimized autoencoder network to new scenarios, including industrial IoT information security monitoring, smart home security monitoring, financial transaction monitoring, and medical health monitoring; The cloud-edge collaborative architecture module deploys the autoencoder network on the edge device, performs preliminary processing and anomaly detection, centrally stores and analyzes data from multiple edge nodes, and synchronizes data between edge devices and the cloud platform in real time to facilitate the parameter update of the autoencoder network and the optimization of the response strategy; Visualization tool module, which displays the basis and response strategy of anomaly detection, making it easier to monitor and manage information security incidents; The data storage and management module is used to monitor the system operation status, record the handling process of abnormal events, and generate reports for corresponding storage.

Images