Active immune defense strategy generation method under cloud-side cooperation

Abstract

The invention provides a method for generating an active immune defense strategy under cloud-side cooperation, and the method comprises the steps: obtaining the state information of edge nodes in a cloud-side cooperation environment, carrying out the analysis of the node resource occupancy rate, network flow, and connection number key indexes, obtaining a node feature vector, and uploading the node feature vector to a cloud end; on the edge nodes, carrying out propagation speed evaluation and influence range analysis on potential malicious nodes, judging the diffusion trend of a high-risk threat, if the threat is in a rapid diffusion situation, executing complete isolation and network cut-off operations, and reporting the disposal situation to the cloud; in a cloud-side collaborative environment, recording historical behaviors and threat response conditions of each node, and identifying potential novel variant threats by calculating variant threat similarity; and updating the active immune rule base and the threat feature classification system of the cloud according to the result of the threat response and the newly discovered threat features by adopting a rule base dynamic updating mechanism, and synchronizing the updating to the edge node.

Description

Technical Field

[0001] The present invention relates to the field of information technology, and in particular to a method for generating an active immune defense strategy under cloud-edge collaboration. Background Art

[0002] In the cloud-edge collaborative environment, it is particularly important to build an efficient and accurate active immune system to deal with complex and ever-changing network security threats. This system not only needs to effectively combine edge computing nodes with cloud data centers to form a new network security protection system, but also needs to be able to achieve seamless collaboration between the edge side and the cloud to monitor, analyze and respond to potential security risks in real time. With the development of cloud-edge collaborative technology, more and more application scenarios rely on this architecture to provide services. However, in actual deployment, we often encounter resource-constrained edge node environments. Some existing security protection solutions often have two processing methods: one is to upload all data to the cloud for complex threat analysis, and then send the analysis results to the edge node for execution; the other is to perform local processing on the edge node as much as possible to reduce dependence on the cloud. However, these two methods have their own shortcomings, and both methods have certain limitations. The first method may lead to increased latency because all analysis work needs to be transmitted over the network; the second method is limited by the computing power and storage resources of the edge node itself, making it difficult to perform complex threat analysis. Therefore, in the cloud-edge collaborative environment, how to effectively coordinate the security policies of the cloud and edge nodes to ensure the consistency and effectiveness of the overall defense has become an urgent problem to be solved. Summary of the invention

[0003] The present invention provides a method for generating an active immune defense strategy under cloud-edge collaboration, which mainly includes:

[0004] Obtain edge node status information in a cloud-edge collaborative environment, analyze key indicators such as node resource occupancy, network traffic, and number of connections, obtain node feature vectors, and upload the node feature vectors to the cloud;

[0005] According to the preset data collection cycle, the node feature vector is analyzed in time series through the abnormal behavior pattern threshold to identify the abnormal behavior characteristics of sudden high resource usage and abnormal network connection mode. If abnormal behavior is found, the active immune mechanism is triggered and the relevant data is sent to the edge node.

[0006] On the edge node, the node behavior characteristics are compared and analyzed with the threat patterns in the active immunity rule base. If the similarity between the node behavior characteristics and a certain type of threat pattern exceeds the set threshold, the node is judged as a potential malicious node and the judgment result is fed back to the cloud.

[0007] After receiving the information of potential malicious nodes, the cloud performs in-depth threat feature analysis, determines the specific type of threat through attack vector identification method, evaluates the severity of the threat using quantitative indicators of the degree of harm, and formulates targeted response strategies based on the analysis results;

[0008] The cloud sends the response strategy to the edge node to guide it to perform corresponding defense operations, including taking corresponding response strategies for threats at different stages according to the threat life cycle stage, monitoring and behavior restriction for low-risk threats in the initial infection stage, and implementing partial functional isolation for medium-risk threats in the spread stage;

[0009] On edge nodes, the transmission speed and impact range of potential malicious nodes are evaluated to determine the diffusion trend of high-risk threats. If the threat spreads rapidly, complete isolation and network disconnection operations are performed, and the handling situation is reported to the cloud.

[0010] The cloud uses a threat tracing mechanism to conduct source analysis on identified malicious nodes, determine the affected network assets through the attack target classification system, dynamically adjust the network topology and security policies based on the analysis results, and synchronize the adjustment instructions to the edge nodes;

[0011] In a cloud-edge collaborative environment, the historical behavior and threat response of each node are recorded, and potential new variant threats are identified by calculating variant threat similarity;

[0012] A dynamic update mechanism for the rule base is adopted to update the active immunity rule base and threat feature classification system in the cloud according to the results of threat response and newly discovered threat features, and the updates are synchronized to the edge nodes.

[0013] The technical solution provided by the embodiment of the present invention may have the following beneficial effects:

[0014] The present invention discloses a method for generating active immune defense strategies under cloud-edge collaboration. The method analyzes key indicators of edge nodes through a multi-dimensional feature extraction algorithm, generates node feature vectors and uploads them to the cloud. The cloud performs time series analysis on the feature vectors, identifies abnormal behaviors and triggers active immune mechanisms. The edge nodes use rule matching methods to determine potential malicious nodes, and the cloud performs in-depth threat analysis and formulates response strategies. The edge nodes perform corresponding defense operations and evaluate the threat diffusion trend. The cloud performs threat tracing analysis and dynamically adjusts network topology and security policies. The present invention also uses a node reputation scoring system to identify new variant threats, and uses a rule base dynamic update mechanism to optimize active immune rules. The method realizes intelligent threat perception, rapid response and adaptive defense of cloud-edge collaboration, effectively improving network security protection capabilities. BRIEF DESCRIPTION OF THE DRAWINGS

[0015] Figure 1This is a flow chart of a method for generating an active immune defense strategy under cloud-edge collaboration of the present invention.

[0016] Figure 2 This is a schematic diagram of a method for generating an active immune defense strategy under cloud-edge collaboration of the present invention.

[0017] Figure 3 This is another schematic diagram of a method for generating an active immune defense strategy under cloud-edge collaboration of the present invention. DETAILED DESCRIPTION

[0018] The following will describe the technical solutions in the embodiments of the present invention in detail in conjunction with the accompanying drawings in the embodiments of the present invention. The described embodiments are only part of the embodiments of the present invention.

[0019] like Figure 1-3 In this embodiment, a method for generating an active immune defense strategy under cloud-edge collaboration may specifically include:

[0020] Step S101, obtain edge node status information in a cloud-edge collaborative environment, analyze key indicators such as node resource occupancy, network traffic, and number of connections, obtain node feature vectors, and upload the node feature vectors to the cloud.

[0021] Obtain the CPU usage rate, memory occupancy, storage space, network bandwidth resource occupancy data and inter-node communication traffic, and active connection number communication data of the edge node; standardize the resource occupancy data and communication data to obtain node status information in a unified format; normalize the node status information and use the sliding window method to calculate the statistical characteristics of the time series data; use the correlation analysis method to screen key features, and use the principal component analysis method to reduce the dimension to obtain the node feature vector; according to the preset feature weights of each dimension, perform weighted calculation on the node feature vector to obtain a comprehensive score reflecting the overall status of the node; package the node feature vector and the comprehensive score, and transmit them to the cloud through the pre-established cloud-edge data synchronization channel.

[0022] Exemplarily, a distributed resource monitoring component is used to obtain resource occupancy data such as CPU usage, memory usage, storage space, network bandwidth, etc. of edge nodes, and the communication traffic and number of active connections between nodes are recorded at the same time. The collected raw data is standardized to obtain node status information in a unified format. Feature extraction is performed on the standardized node status information. First, the raw data is normalized, and then the statistical characteristics of the time series data, including mean, variance, kurtosis, etc., are calculated using the sliding window method. Then, the key features are screened out using the correlation analysis method, and finally the principal component analysis (PCA) is used for dimensionality reduction to obtain the node feature vector after dimensionality reduction. The weight values ​​of the features of each dimension are set according to business needs, and the features of each dimension are weighted to obtain a comprehensive score to form a quantitative indicator reflecting the overall status of the node. A cloud-edge data synchronization mechanism based on Apache Kafka is established. As a producer, the edge node packages the generated feature vector and scoring index into a JSON format message and sends it to the Kafka message queue. The message content contains fields such as node ID, timestamp, feature vector, and scoring index. The cloud consumer reads messages from the Kafka queue and parses the node status data, and stores the parsed data in the InfluxDB time series database to form a historical record. Based on the node status data stored in InfluxDB, the cloud uses the moving average method to predict the node load in the future period, and calculates the predicted resource occupancy rate, network traffic, and number of connections. The prediction results are used as a reference for subsequent task scheduling and resource allocation, and are used to optimize the resource utilization efficiency in the cloud-edge collaborative environment. The distributed resource monitoring component collects resource data by deploying a lightweight agent on each edge node. The agent collects indicators such as CPU usage, memory usage, storage space, and network bandwidth every 5 seconds, and records the communication traffic and TCP connection number between nodes. The collected raw data is standardized, and the CPU usage and memory usage are converted into percentages, the storage space is converted into GB, and the network bandwidth is converted into Mbps. The feature extraction algorithm is applied to the standardized data, and the statistical features such as mean, variance, and kurtosis are calculated using a 60-second sliding window. For example, the mean of CPU usage is 75%, the variance is 5%, and the kurtosis is 2.3. Through Pearson correlation coefficient analysis, key features with correlation greater than 0.8 are selected, and then principal component analysis (PCA) is used to reduce the feature dimension from the original 20 dimensions to 8 dimensions to obtain the node feature vector after dimensionality reduction. Weights are set according to business needs, such as CPU usage weight 0.3, memory occupancy weight 0.25, storage space weight 0.2, and network bandwidth weight 0.25, and the comprehensive score of the node is calculated.The cloud-edge data synchronization mechanism is implemented based on Apache Kafka. The edge node packages the feature vector and score into a JSON format message, including the node ID, timestamp, 8-dimensional feature vector and score, and sends it to the "node_status" topic of Kafka. The cloud consumer reads the message from Kafka, stores the data in InfluxDB after parsing, and sets the data retention policy to 30 days. The cloud uses a simple moving average method with a 10-minute window to predict the node load, such as predicting that the CPU usage will be 80%, the memory usage will be 70%, the network traffic will be 50Mbps, and the number of connections will be 1000 in the next hour. The prediction results are used to optimize task scheduling and resource allocation. For example, when the CPU usage is predicted to exceed 90%, new tasks are assigned to nodes with lower loads.

[0023] Step S102: According to the preset data collection cycle, the node feature vector is analyzed in time series by the abnormal behavior pattern threshold to identify the abnormal behavior characteristics of sudden high resource usage and abnormal network connection mode. If abnormal behavior is found, the active immune mechanism is triggered to send the relevant data to the edge node.

[0024] Acquire node feature vector data, and use a preset sliding window to perform time series segmentation on the feature vector; calculate the statistical feature values ​​within each time window obtained by time series segmentation to obtain a time series feature sequence; use the exponentially weighted moving average method to implement adaptive threshold adjustment, and if the value in the time series feature sequence exceeds the adaptive threshold, it is determined to be an anomaly; use a clustering algorithm to classify the anomaly and obtain a description of the abnormal behavior characteristics; if abnormal behavior is identified, trigger the active immune mechanism, select a predefined processing rule based on the description of the abnormal behavior characteristics, and send the processing rule to the security agent program of the edge node through the message queue.

[0025] Exemplarily, node feature vector data is obtained from the time series database according to the preset data collection cycle, and a sliding window of 5 minutes and a step size of 1 minute are used to segment the feature vector into time series, and the statistical feature values ​​such as mean, variance, peak value, etc. in each time window are calculated to obtain the time series feature sequence. The exponentially weighted moving average (EWMA) method is used to realize adaptive threshold adjustment, and anomaly detection is performed on the time series feature sequence. The initial threshold is set to 3 times the standard deviation of the historical data. The anomaly judgment threshold is dynamically adjusted by the formula of new threshold = 0.2*current value + 0.8*old threshold to identify anomalies beyond the threshold range. For the detected anomalies, the K-means clustering algorithm is used to classify the abnormal features, and the number of clusters is set to 3, corresponding to high resource occupancy, network connection anomalies and other anomaly types, respectively. The Euclidean distance is used as the similarity metric to classify similar abnormal patterns to obtain abnormal behavior feature descriptions. When abnormal behavior is identified, the active immune mechanism is triggered, and predefined processing rules are selected according to the clustering results. For example, rules for limiting CPU usage are generated for high resource usage types, and rules for blocking suspicious IPs are generated for network connection anomalies. These rules and abnormal behavior feature descriptions are packaged into JSON format and sent to the security agent program of the corresponding edge node through the message queue to achieve rapid response and processing of abnormal behavior. The time series database stores node feature vectors collected every minute, including indicators such as CPU usage, memory usage, and network traffic. A 5-minute sliding window with a step size of 1 minute is used for time series segmentation. For example, the CPU usage is calculated to have a mean of 80%, a variance of 5%, and a peak of 95%. The EWMA method is used to implement adaptive thresholds, and the initial threshold is set to 3 times the standard deviation of historical data, that is, 90%. If the current CPU usage is 85%, the new threshold = 0.2*85% + 0.8*90% = 89%. After identifying the abnormal point with a CPU usage of 95%, the K-means clustering algorithm classifies it as a high resource usage type. The cluster center is set to high resource usage (CPU 90%, memory 85%, network traffic 500Mbps), network connection abnormality (CPU 60%, memory 50%, network traffic 2000Mbps), and other abnormalities (CPU 70%, memory 60%, network traffic 1000Mbps). The Euclidean distance calculation shows that the abnormal point is closest to the high resource usage type. The active immune mechanism is triggered and the JSON format rules are generated:

[0026] {"type":"high_resource_usage","action":"limit_cpu","threshold":80%}. The message queue sends the rule to the security agent program of the corresponding edge node. After receiving the rule, the security agent calls the system resource management interface to limit the process CPU usage to less than 80%, achieving rapid response and processing of abnormal behavior.

[0027] Step S103, on the edge node, compare and analyze the node behavior characteristics with the threat patterns in the active immunity rule base. If the similarity between the node behavior characteristics and a certain type of threat pattern exceeds a set threshold, the node is determined to be a potential malicious node, and the determination result is fed back to the cloud.

[0028] Acquire real-time behavior feature data in the local database of the edge node, which includes CPU usage, memory usage, and number of network connections; extract the preset threat pattern rules in the active immunity rule library, and prioritize the threat pattern rules according to their threat levels and historical matching frequencies; construct a behavior feature vector and a threat pattern rule vector, where the behavior feature vector includes normalized CPU usage, memory usage, and number of network connections, and the threat pattern rule vector includes preset thresholds for each indicator; use the cosine similarity algorithm to calculate the similarity between the behavior feature vector and the threat pattern rule vector to obtain a similarity score; if the similarity score exceeds the preset similarity threshold, mark the corresponding node as a potential malicious node, and generate a judgment result including node identification, threat type, and similarity score; send the judgment result to the cloud management platform, and update the node status mark locally at the edge node.

[0029] Exemplarily, real-time behavior feature data including CPU usage, memory usage, number of network connections and other indicators are obtained from the local database of the edge node, and the preset threat pattern rules are read from the active immunity rule library, and priority is sorted based on the threat level and historical matching frequency of the rules. A behavior feature vector is constructed, including indicators such as CPU usage, memory usage, number of network connections and other indicators after data standardization; the threat pattern rule vector contains the preset thresholds of each indicator. According to the priority sorting result, the cosine similarity algorithm is used to calculate the similarity between the node behavior feature vector and the threat pattern rule vector in turn to obtain a set of similarity scores. The calculation results are screened according to the preset similarity threshold of 0.8. If a score exceeds the threshold, the corresponding node is marked as a potential malicious node, and a judgment result including node ID, threat type and similarity score is generated. The judgment result is sent to the cloud management platform through the HTTPS protocol encrypted by TLS, and the node status mark is updated locally at the same time, triggering corresponding security protection measures, including limiting the network access rights of the node, isolating suspicious processes, and increasing the monitoring frequency. The local database of the edge node collects real-time behavior feature data every 5 seconds, including CPU usage of 90%, memory usage of 85%, and network connection number of 1000. The active immunity rule base stores 50 threat pattern rules, which are prioritized based on threat levels 1-5 and the number of matches in the past 24 hours. Constructing behavior feature vectors

[0030] [0.9, 0.85, 0.8] and threat pattern rule vector [0.85, 0.8, 0.75], where the values ​​have been normalized. In order of priority, the cosine similarity algorithm is used to calculate the similarity between vectors, such as calculating a score of 0.98 for the high priority rule. Set a threshold of 0.8, determine 0.98>0.8, mark the node as potentially malicious, and generate a judgment result of {node ID: edge001, threat type: resource abuse, similarity: 0.98}. Use the HTTPS protocol of TLS1.3 version to send the judgment result to the cloud management platform https: / / cloud.manager.com / api / threat through the RESTAPI interface using the POST request method. The node status is updated locally to "suspicious", triggering security measures: limit the node network bandwidth to 50Mbps, isolate processes with CPU usage exceeding 95%, and increase the monitoring frequency from 5 seconds to 1 second.

[0031] In step S104, after receiving the potential malicious node information, the cloud performs a deep threat feature analysis, determines the specific type of threat through the attack vector identification method, uses the hazard degree quantitative index to evaluate the severity of the threat, and formulates a targeted response strategy based on the analysis results.

[0032] The historical behavior data and current status information of potential malicious nodes are obtained, and the historical behavior data and current status information are extracted from the cloud database; based on the historical behavior data and current status information, the number of network traffic packets, system call frequency, and CPU usage of the node are analyzed to obtain the threat feature vector of the node; the threat feature vector is normalized and principal component analysis is performed to determine the optimized threat feature vector; the optimized threat feature vector is classified by a random forest classifier to determine the potential attack type, which includes denial of service attack, data leakage, and malicious code execution; if the attack type is determined, the severity score of the threat is calculated; based on the threat severity score and attack type, matching response measures are selected from a pre-established response strategy library based on a decision tree structure, and the response measures include isolating nodes, restricting network access, enhancing monitoring, and initiating emergency response processes.

[0033] Exemplarily, the historical behavior data and current status information of potential malicious nodes are extracted from the cloud database, and the multi-dimensional features such as the number of network traffic packets, system call frequency, and CPU usage of the node are analyzed using a long short-term memory network to generate a threat feature vector of the node. The generated feature vector is normalized, and the dimension is reduced by principal component analysis to extract the main features to form the optimized threat feature vector. The optimized threat feature vector is classified using a random forest classifier to identify potential attack types, including denial of service attacks, data leakage, and malicious code execution, and the probability distribution of each attack type is calculated, setting the probability threshold of denial of service attacks to 0.7, data leakage to 0.6, and malicious code execution to 0.8. According to the identified attack type, combined with the predefined hazard assessment matrix, the severity score of the threat is calculated. The matrix takes into account factors such as the impact range of the attack (1-5 points), the duration (1-3 points), and the data sensitivity (1-4 points), and a quantitative index of 0 to 100 is obtained. Based on the severity score of the threat and the type of attack, matching countermeasures are selected from the response strategy library based on the decision tree structure, such as isolating nodes, restricting network access, enhancing monitoring, and initiating emergency response processes, and a response instruction set containing specific execution steps is generated. The cloud database extracts the behavior data of the node ID NODE_001 in the last 24 hours, including the number of network traffic packets per minute, system call frequency, and CPU usage. The long short-term memory network receives an input sequence of 1440 time steps, each of which contains 3 eigenvalues, and outputs a 100-dimensional threat feature vector. The vector is normalized by the minimum and maximum normalization, and all eigenvalues ​​are scaled to the range of 0-1. The principal component analysis method reduces the 100-dimensional vector to 20 dimensions, retaining 95% of the information. The random forest classifier contains 100 decision trees, classifies the 20-dimensional feature vector, and outputs the probability of the attack type: denial of service attack 0.75, data leakage 0.55, and malicious code execution 0.85. Since the probability of malicious code execution 0.85 exceeds the preset threshold of 0.8, it is identified as the main threat type. The harm assessment matrix calculates the score as 4 points for wide impact, 2 points for medium duration, and 3 points for sensitive data. The severity score is 85 based on the weight calculation, with a full score of 100. The decision tree structure response strategy library selects the "isolate node" strategy based on the "malicious code execution" type and the severity of 85 points. The generated response instruction set includes {operation: isolate node, target: NODE_001, duration: 24 hours, network restriction: only allow communication with the security team server, monitoring level: increase to sampling every 10 seconds.

[0034] In step S105, the cloud sends the response strategy to the edge node to guide it to perform corresponding defense operations, including taking corresponding response strategies for threats at different stages according to the threat life cycle stage, monitoring and behavior restriction for low-risk threats in the initial infection stage, and implementing partial functional isolation for medium-risk threats in the spread stage.

[0035] The threat classification results are obtained according to the threat life cycle model, and the threat classification results include the initial infection stage and the lateral spread stage; a policy mapping table is generated based on the threat classification results, and the policy mapping table includes the stage, danger level, monitoring frequency, and network access restriction fields; the network traffic characteristics of the edge node are analyzed, and the data packet characteristics are extracted from the network traffic characteristics; according to the data packet characteristics, the life cycle stage of the threat is obtained in combination with the long short-term memory network algorithm; if the life cycle stage of the threat is the initial infection stage, the corresponding response strategy is obtained from the policy mapping table, and the response strategy includes restricting the external network access rights of the suspicious process; the dynamic change results of the threat are obtained by real-time evaluation of the change trend of the threat indicators; according to the dynamic change results of the threat, the monitoring frequency and isolation level in the response strategy are dynamically adjusted; a secure channel is established, and the response policy instructions are sent to the security agent program of the edge node through the secure channel; after receiving the response policy instructions, the security agent program calls the local resource management interface to perform defense operations, and the defense operations include modifying system scheduling parameters, updating firewall rules, and isolating suspicious processes.

[0036] Exemplarily, the cloud divides the threat into two main stages: initial infection and lateral spread according to the threat life cycle model, sets the corresponding danger level and response strategy for each stage, and generates a strategy mapping table, which includes fields such as stage, danger level, monitoring frequency, and network access restriction. The network traffic characteristics of the edge node are analyzed by deep packet inspection technology, and the data packets are parsed, reorganized, and feature extracted. The behavior anomaly detection based on the long short-term memory network algorithm is combined to identify the life cycle stage of the current threat and obtain the stage determination result. According to the stage determination result, the corresponding response strategy is extracted from the strategy mapping table. For the low-risk threats in the initial infection stage, the monitoring frequency is increased from once per minute to once every 10 seconds, and the external network access rights of the suspicious process are restricted. For the medium-risk threats in the spread stage, the network communication and file system access rights of the suspicious process are isolated, and the communication with the known malicious IP addresses is blocked. Based on the dynamic changes of the threat, the response strategy is adjusted in real time, and the monitoring frequency and isolation level are dynamically adjusted by evaluating the change trend of the threat indicators in real time. The cloud sends the generated response policy instructions to the security agent program of the edge node through the secure channel established by the TLS1.3 encryption protocol. After receiving the instructions, the security agent program calls the local resource management interface to perform corresponding defense operations, including modifying the system scheduling parameters to adjust the monitoring frequency, updating the firewall rules to limit network access, and using container technology to isolate suspicious processes. The cloud generates a policy mapping table. The initial infection stage sets the danger level to 2, which is low risk, the monitoring frequency is 10 seconds / time, and the network access is limited to only allow access to the whitelist IP; the horizontal spread stage danger level is 4, which is medium risk, the monitoring frequency is 5 seconds / time, and the network access is completely isolated. Deep packet inspection technology parses data packets through the Wireshark library to extract features such as source IP, destination IP, port number, and protocol type. The long short-term memory network receives network traffic data within 30 minutes, 60 time steps per minute, each step contains 10 features, and outputs the threat stage probability. When the probability of the initial infection stage exceeds 0.7, the low-risk response strategy is triggered, including adjusting the monitoring frequency of the node_exporter node monitor from 60 seconds to 10 seconds, and using the iptables firewall tool to limit suspicious processes to access only the 192.168.1.0 / 24 network segment. If the probability of the lateral spread stage exceeds 0.6, the medium-risk response is triggered, including using Docker to create an isolated container to run the suspicious process, and limiting its network communication to only allow communication with 127.0.0.1. Evaluate the system call frequency change rate in real time. If it exceeds 200%, adjust the monitoring frequency from 10 seconds to 5 seconds. The cloud establishes a TLS1.3 encrypted channel through the Nginx reverse proxy and issues response policy instructions in JSON format.The security agent program written in Go language on the edge node receives instructions, calls systemd to modify the node_exporter configuration, updates the iptables rules, and uses the containerdAPI to create an isolated container to implement defense operations.

[0037] Step S106: At the edge node, the propagation speed of the potential malicious nodes is evaluated and the impact range is analyzed to determine the diffusion trend of high-risk threats. If the threat spreads rapidly, complete isolation and network disconnection operations are performed, and the handling situation is reported to the cloud.

[0038] Receive the collected communication behavior data, which includes the number of connection requests, data transmission volume and the number of target IP addresses per unit time; calculate the propagation speed index using the exponentially weighted moving average method based on the communication behavior data; construct a network topology relationship diagram using the Dijkstra algorithm, take the potential malicious node as the starting point, calculate the shortest path between it and other nodes, and obtain the impact range index; determine whether the propagation speed index exceeds the preset propagation speed threshold, and whether the impact range index exceeds the preset impact range threshold. If so, trigger a complete isolation mechanism; generate a disposal report containing the isolation time, isolation cause and impact range, and upload the disposal report to the cloud management platform through the established secure channel.

[0039] Exemplarily, Wireshark is used to monitor the communication behavior of potential malicious nodes, record the number of connection requests, data transmission volume and target IP address number per unit time, and calculate the propagation speed index by exponential weighted moving average method. Use Dijkstra algorithm to construct network topology relationship diagram, take potential malicious nodes as starting points, calculate the shortest path between them and other nodes, obtain impact range index, and judge the diffusion trend of high-risk threats. According to the propagation speed index and impact range index, set the threshold of rapid diffusion. When the propagation speed exceeds 100 connections / minute and the impact range exceeds 10% of the total number of network nodes, trigger the complete isolation mechanism, call iptables command to block all inbound and outbound traffic, use ifconfig command to close the network interface, and realize the complete isolation of nodes and network disconnection. Generate a disposal report containing information such as isolation time, isolation reason, and impact range, upload the report to the cloud management platform through the secure channel established by TLS1.3 protocol, and archive it locally for future reference. Wireshark collects network data every 5 seconds on the edge node, recording the number of connection requests, such as 300 times / minute, the amount of data transmission, such as 500MB / minute, and the number of target IP addresses, such as 50 / minute. The exponentially weighted moving average method is used, and the weight factor α=0.3, and the propagation speed index is calculated to be 280. The Dijkstra algorithm is used to construct a network topology diagram containing 100 nodes, and the potential malicious node with ID NODE_001 is used as the starting point to calculate the shortest path, and the impact range index is 15 (that is, 15% of the nodes are affected). The propagation speed threshold is set to 250, and the impact range threshold is set to 10%. When 280>250 and 15%>10%, the complete isolation mechanism is triggered. Execute the iptables commands "iptables-AINPUT-jDROP" and "iptables-AOUTPUT-jDROP" to block all traffic, and use "ifconfigeth0down" to shut down the network interface. The generated JSON-formatted disposal report is {"isolation_time":"2024-09-1915:30:00","reason":"Fastspreaddetected","affected_nodes":15,"speed_index":280}. The TLS1.3 encrypted channel is established through the OpenSSL library, and the report is sent to https: / / cloud.management.com / report using the HTTP POST method. The report is also saved to the local / var / log / security / isolation_reports.log file.

[0040] In step S107, the cloud uses a threat tracing mechanism to perform source tracing analysis on the identified malicious nodes, determines the affected network assets through the attack target classification system, dynamically adjusts the network topology and security policies based on the analysis results, and synchronizes the adjustment instructions to the edge nodes.

[0041] Obtain the communication records, behavior characteristics and attack mode information of the identified malicious nodes in the cloud log database; use the Apriori algorithm to mine the association rules of the communication records, behavior characteristics and attack mode information; construct an attack link diagram based on the association rule mining results, and the attack link diagram includes the attack source and propagation path information. Determine the category of the assets involved in the attack link diagram; among them, the asset categories include sensitive data, critical infrastructure, and ordinary business systems; obtain the asset risk assessment results based on the asset category and the degree of impact of the attack. Receive the asset risk assessment results; use the minimum cut algorithm to analyze the existing network topology; generate a network segmentation plan and a new network topology diagram based on the analysis results of the minimum cut algorithm. Verify the new network topology diagram through the network simulation tool; if the verification result shows that the network function is operating normally, it is determined that the new network topology diagram is valid. Generate network adjustment instructions based on the new network topology diagram; among them, the network adjustment instructions include network topology adjustment information and access control policy information; send the network adjustment instructions to the edge node through a secure channel; the edge node calls the network configuration management interface according to the network adjustment instructions to perform network reconstruction and security policy update.

[0042] Exemplarily, the communication records, behavior characteristics and attack patterns of identified malicious nodes are extracted from the cloud security log database, and the Apriori algorithm is used to mine association rules, build an attack link diagram, and identify the attack source and propagation path. According to the preset attack target classification system, network assets are divided into three categories: sensitive data, critical infrastructure, and general business systems. The assets involved in the attack link diagram are classified and labeled, the importance and vulnerability of the affected assets are judged, and an asset risk assessment report is generated. Based on the asset risk assessment results, the minimum cut algorithm is used to analyze the existing network topology structure, find the optimal network segmentation solution, generate a new network topology structure diagram, and formulate a corresponding access control list based on the segmentation results. The network simulation tool is used to verify the validity of the new topology structure to ensure the normal operation of the network function. The verified network topology structure and access control policy are packaged as adjustment instructions, and sent to each edge node through the secure channel established by the TLS1.3 protocol, guiding the edge node to call the network configuration management interface to perform network reconstruction and security policy update operations. The cloud security log database extracts 1,000 communication records with the malicious node ID MAL001 in the last 24 hours, including source IP, target IP, protocol type and other information. The Apriori algorithm sets the minimum support to 0.1 and the confidence to 0.8, mines 50 association rules, constructs an attack link graph, and identifies the attack source IP as 192.168.1.100. The 100 assets in the network are labeled according to the preset classification system as 20 sensitive data nodes (importance 9 / 10, vulnerability 7 / 10), 30 critical infrastructures (importance 8 / 10, vulnerability 6 / 10), and 50 ordinary business systems (importance 5 / 10, vulnerability 4 / 10). The minimum cut algorithm calculates the minimum cut set of the network graph, obtains 3 cutting points, and generates a new network topology diagram to separate the originally interconnected sensitive data area from the ordinary business area. A new access control list is formulated to limit the direct access of ordinary business systems to sensitive data. The NS-3 network simulation tool is used to simulate the transmission of 1,000 data packets in the new topology to verify that the throughput decreases by no more than 5% and the delay increases by no more than 10ms. The verified topology and access control policy are encoded as adjustment instructions in JSON format. The instructions are sent to 50 edge nodes through the TLS1.3 secure channel implemented by the OpenSSL library. The network configuration management module of the edge node receives the instructions, calls iptables to update the firewall rules, and uses ifconfig to reconfigure the network interface to complete the network reconstruction and policy update.

[0043] Step S108, in the cloud-edge collaborative environment, record the historical behavior and threat response of each node, and identify potential new variant threats by calculating the variant threat similarity.

[0044] The real-time reputation score of the node is calculated according to the preset scoring rules, and the original behavior data is cleaned and standardized to obtain the normalized node behavior data; the reputation score and node behavior data are obtained from the edge node, and the global reputation score database is updated; the historical behavior data of the node is analyzed in time series to obtain the prediction results of the node's future reputation trend; the latest reputation score and threat intelligence are pushed to the edge node, and the edge node updates the local threat detection rule base and access control policy based on the received data.

[0045] Exemplarily, a reputation scoring agent is deployed on the edge node to record the node's resource usage (CPU usage weight 0.3, memory occupancy weight 0.3), network communication behavior (abnormal connection number weight 0.2) and security incident response results (processing time weight 0.2), and calculate the node's real-time reputation score according to the preset scoring rules. The original behavior data is cleaned and standardized, outliers are removed, and the values ​​are normalized to the range of 0-1. The cloud maintains a global reputation scoring database, regularly collects reputation scores and related behavior data from edge nodes, uses the ARIMA model to perform time series analysis on the node's historical behavior, predicts future reputation trends, and generates a long-term reputation assessment report for the node. Based on the known threat feature library, the cosine similarity algorithm is used to calculate the similarity between the newly emerging suspicious behavior and the known threat pattern, and the similarity threshold is set to 0.85 to identify potential new variant threats, and automatically generate feature descriptions and detection rules for the identified new threats. Real-time data synchronization between the cloud and edge nodes is achieved through Apache Kafka. The latest reputation scores and threat intelligence are pushed to all edge nodes every 5 minutes. After receiving the data, the edge nodes update the local threat detection rule base and access control policy. The reputation scoring agent program with the edge node ID EDGE001 collects data every 30 seconds, recording the CPU usage of 85%, the memory usage of 70%, the number of abnormal connections of 5, and the processing time of the latest security event of 120 seconds. The original data is normalized by Z-score, the outliers outside the standard deviation of 3 times are removed, and then Min-Max normalized to the range of 0-1. The real-time reputation score of 0.78 is calculated based on the preset weights. The cloud collects reputation data from 1,000 edge nodes at 60 time points every hour, and uses the ARIMA (1,1,1) model for time series analysis to predict the reputation trend of the EDGE001 node in the next 24 hours. The generated evaluation report shows that the reputation stability is 0.92. Based on a database containing 1,000 known threat features, the cosine similarity of the newly appeared suspicious behaviors on EDGE001 was calculated, and the highest similarity was 0.87, which exceeded the threshold of 0.85 and was identified as a potential new variant threat. The threat feature description "high-frequency DNS request + abnormal file operation" was automatically generated, and the detection rule "DNS request frequency > 100 times / minute and file creation rate > 50 / minute" was formulated. The ApacheKafka cluster contains 3 Brokers, sets the number of Topic partitions to 10, the replication factor to 2, and pushes the latest data packet to all edge nodes every 5 minutes, with a size of about 200KB. After receiving the data, EDGE001 updates the local Snort rule base, adds new rules, and modifies the iptables policy to limit the network access rights of low-reputation nodes.

[0046] Step S109, using the rule base dynamic update mechanism, according to the threat response results and newly discovered threat features, update the active immunity rule base and threat feature classification system in the cloud, and synchronize the update to the edge node.

[0047] Obtain the threat response results and newly discovered threat features in the cloud security log database; use the clustering algorithm to classify the new threat features based on the newly discovered threat features, and determine the optimal number of clusters through the silhouette coefficient method; use the decision tree algorithm to generate new active immunity rules for the updated threat feature classification, and calculate the confidence and support of each rule. The confidence is the ratio of the number of correct rule responses to the total number of rule triggers, and the support is the ratio of the number of rule triggers to the total number of samples; if the confidence of the rule is higher than the preset threshold, the rule is added to the active immunity rule library; simulate the attack scenario in the sandbox environment, verify and test the newly generated rules, and obtain the false alarm rate and missed alarm rate; if the false alarm rate exceeds the preset threshold, optimize and adjust the rules until the false alarm rate meets the accuracy requirements; dynamically adjust the weight or trigger threshold of the rule according to the changing trend of the false alarm rate and missed alarm rate; implement the distributed data synchronization mechanism through Apache ZooKeeper, package the updated active immunity rule library and threat feature classification system, and push them to each edge node in an incremental update manner.

[0048] Exemplarily, the threat response results and newly discovered threat features within the last 24 hours are extracted from the cloud security log database, the new threat features are classified using the K-means clustering algorithm, the optimal number of clusters is determined by the silhouette coefficient method, and the threat feature classification system is updated. Based on the updated threat feature classification, a decision tree algorithm is used to generate new active immunity rules, the confidence (number of correct rule answers / total number of rule triggers) and support (number of rule triggers / total number of samples) of each rule are calculated, and high-confidence rules are added to the active immunity rule base. The false alarm rate control threshold is set, and the newly generated rules are verified and tested by simulating attack scenarios in a sandbox environment, and the false alarm rate and false negative rate are calculated. If the false alarm rate exceeds the preset threshold, the rules are optimized and adjusted until the accuracy requirements are met. According to the changing trend of the false alarm rate and false negative rate, the weight or trigger threshold of the rule is dynamically adjusted to achieve adaptive optimization of the rule. The distributed data synchronization mechanism is implemented through Apache ZooKeeper, and the updated active immunity rule base and threat feature classification system are packaged, pushed to each edge node using the incremental update method, and the edge node is guided to update the local rule base and classification system. The edge nodes regularly provide feedback on the effect of rule application to further optimize the cloud rule base. The cloud extracts 1,000 threat response records and 500 new threat features in the last 24 hours from the security log database, and applies the K-means algorithm for clustering. The initial cluster number k=5 is set, and the optimal cluster number is determined to be 7 by calculating the silhouette coefficient (the average value is 0.72). The updated threat feature classification system contains 7 categories, such as DDoS, data leakage, and malicious code execution. Based on the new classification, 50 new active immunity rules are generated using the C4.5 decision tree algorithm, and the confidence and support of each rule are calculated. For example, the confidence of the rule "IF abnormal number of connections > 100 AND CPU usage > 90% THEN trigger DDoS defense" is 0.92 and the support is 0.15. 1,000 attack scenarios are simulated in the sandbox environment to verify the new rules, and the false alarm rate is 3.5% and the false negative rate is 1.2%, which is lower than the preset threshold of 5%. According to the test results, the threshold of abnormal connection number of DDoS rules was adjusted from 100 to 120, and the threshold of CPU usage rate was adjusted from 90% to 95%. After retesting, the false alarm rate dropped to 2.8%. Apache ZooKeeper cluster 3 nodes were used to achieve distributed data synchronization, and 10MB update packages were pushed to 1000 edge nodes. Incremental update was adopted, and only about 2MB of changed data was transmitted. The edge nodes feedback the application of rules once an hour, including indicators such as the number of rule triggers and accuracy. The cloud performs global optimization of the rule base every 24 hours based on the feedback data.

[0049] Although the embodiments of the present invention have been shown and described above, it is to be understood that the above embodiments are exemplary and are not to be construed as limitations of the present invention. A person skilled in the art may change, modify, replace and vary the above embodiments within the scope of the present invention.

Claims

1. A method for generating active immune defense strategy under cloud-edge collaboration, characterized in that: The method comprises: Obtain edge node status information in a cloud-edge collaborative environment, analyze key indicators such as node resource occupancy, network traffic, and number of connections, obtain node feature vectors, and upload the node feature vectors to the cloud; According to the preset data collection cycle, the node feature vector is analyzed in time series through the abnormal behavior pattern threshold to identify the abnormal behavior characteristics of sudden high resource usage and abnormal network connection mode. If abnormal behavior is found, the active immune mechanism is triggered and the relevant data is sent to the edge node. On the edge node, the node behavior characteristics are compared and analyzed with the threat patterns in the active immunity rule base. If the similarity between the node behavior characteristics and a certain type of threat pattern exceeds the set threshold, the node is judged as a potential malicious node and the judgment result is fed back to the cloud. After receiving the information of potential malicious nodes, the cloud performs in-depth threat feature analysis, determines the specific type of threat through attack vector identification method, evaluates the severity of the threat using quantitative indicators of the degree of harm, and formulates targeted response strategies based on the analysis results; The cloud sends the response strategy to the edge node to guide it to perform corresponding defense operations, including taking corresponding response strategies for threats at different stages according to the threat life cycle stage, monitoring and behavior restriction for low-risk threats in the initial infection stage, and implementing partial functional isolation for medium-risk threats in the spread stage; On edge nodes, the transmission speed and impact range of potential malicious nodes are evaluated to determine the diffusion trend of high-risk threats. If the threat spreads rapidly, complete isolation and network disconnection operations are performed, and the handling situation is reported to the cloud. The cloud uses a threat tracing mechanism to conduct source analysis on identified malicious nodes, determine the affected network assets through the attack target classification system, dynamically adjust the network topology and security policies based on the analysis results, and synchronize the adjustment instructions to the edge nodes; In a cloud-edge collaborative environment, the historical behavior and threat response of each node are recorded, and potential new variant threats are identified by calculating variant threat similarity; A dynamic update mechanism for the rule base is adopted to update the active immunity rule base and threat feature classification system in the cloud according to the results of threat response and newly discovered threat features, and the updates are synchronized to the edge nodes.

2. The method according to claim 1, characterized in that: The method of obtaining edge node status information in a cloud-edge collaborative environment, analyzing key indicators of node resource occupancy, network traffic, and number of connections, obtaining node feature vectors, and uploading the node feature vectors to the cloud includes: Obtain edge node CPU usage, memory usage, storage space, network bandwidth resource usage data, and inter-node communication traffic and active connection data; Standardizing the resource occupancy data and communication data to obtain node status information in a unified format; Normalizing the node status information, and using a sliding window method to calculate statistical features of the time series data; The correlation analysis method is used to screen key features, and the principal component analysis method is used to reduce the dimension to obtain the node feature vector; According to the preset feature weights of each dimension, the node feature vector is weighted and calculated to obtain a comprehensive score reflecting the overall status of the node; The node feature vector and comprehensive score are packaged and transmitted to the cloud through a pre-established cloud-edge data synchronization channel.

3. The method according to claim 1, characterized in that According to the preset data collection cycle, the node feature vector is analyzed in time series through the abnormal behavior pattern threshold to identify the abnormal behavior characteristics of sudden high resource usage and abnormal network connection mode. If abnormal behavior is found, the active immune mechanism is triggered to send relevant data to the edge node, including: Obtain node feature vector data and use a preset sliding window to perform time series segmentation on the feature vector; According to each time window obtained by time series segmentation, the statistical characteristic value in the time window is calculated to obtain the time series characteristic sequence; The exponentially weighted moving average method is used to realize the adaptive adjustment of the threshold. If the value in the time series feature sequence exceeds the adaptive threshold, it is determined as an abnormal point; For abnormal points, clustering algorithm is used to classify them and obtain the abnormal behavior feature description; If abnormal behavior is identified, the active immune mechanism is triggered, and predefined processing rules are selected according to the abnormal behavior feature description, and the processing rules are sent to the security agent program of the edge node through the message queue.

4. The method according to claim 1, characterized in that On the edge node, the node behavior characteristics are compared and analyzed with the threat patterns in the active immunity rule base. If the similarity between the node behavior characteristics and a certain type of threat pattern exceeds a set threshold, the node is determined to be a potential malicious node, and the determination result is fed back to the cloud, including: Obtain real-time behavior feature data from the local database of the edge node. The real-time behavior feature data includes CPU usage, memory usage, and number of network connections. Extract the preset threat pattern rules in the active immunity rule library, and prioritize the threat pattern rules according to their threat levels and historical matching frequencies; Constructing a behavior feature vector and a threat pattern rule vector. The behavior feature vector includes normalized CPU usage, memory usage, and network connection indicators. The threat pattern rule vector includes preset thresholds for each indicator. The cosine similarity algorithm is used to calculate the similarity between the behavior feature vector and the threat pattern rule vector to obtain a similarity score; If the similarity score exceeds the preset similarity threshold, the corresponding node is marked as a potential malicious node, and a determination result including the node identification, threat type and similarity score is generated; The judgment result is sent to the cloud management platform, and the node status mark is updated locally on the edge node.

5. The method according to claim 1, characterized in that After receiving the potential malicious node information, the cloud performs a deep threat feature analysis, determines the specific type of threat through the attack vector identification method, evaluates the severity of the threat using a quantitative indicator of the degree of harm, and formulates a targeted response strategy based on the analysis results, including: Obtaining historical behavior data and current status information of potential malicious nodes, which are extracted from the cloud database; According to the historical behavior data and current status information, the number of network traffic packets, system call frequency and CPU usage of the node are analyzed to obtain the threat feature vector of the node; Perform normalization and principal component analysis on the threat feature vector to determine the optimized threat feature vector; The optimized threat feature vectors are classified by random forest classifier to determine potential attack types, including denial of service attacks, data leakage, and malicious code execution; If the attack type is determined, the severity score of the threat is calculated; According to the severity score of the threat and the type of attack, matching countermeasures are selected from the pre-established response strategy library based on the decision tree structure. The countermeasures include isolating nodes, restricting network access, enhancing monitoring efforts, and initiating emergency response processes.

6. The method according to claim 1, characterized in that The cloud sends the response strategy to the edge node to guide it to perform corresponding defense operations, including taking corresponding response strategies for threats at different stages according to the threat life cycle stage, monitoring and behavior restriction for low-risk threats at the initial infection stage, and implementing partial functional isolation for medium-risk threats at the spread stage, including: Obtain threat classification results based on the threat lifecycle model, which include the initial infection stage and the lateral spread stage; Generate a policy mapping table based on the threat classification results. The policy mapping table contains the fields of stage, danger level, monitoring frequency and network access restriction; Analyze the network traffic characteristics of edge nodes and extract data packet features from the network traffic characteristics; Based on the characteristics of the data packet, the threat life cycle stage is obtained by combining the long short-term memory network algorithm; If the threat life cycle stage is the initial infection stage, the corresponding response policy is obtained from the policy mapping table. The response policy includes limiting the external network access rights of the suspicious process. The dynamic change results of threats are obtained by evaluating the change trends of threat indicators in real time; Dynamically adjust the monitoring frequency and isolation level in the response strategy based on the dynamic changes of threats; Establish a secure channel and send response policy instructions to the security agent program of the edge node through the secure channel; After receiving the response policy instruction, the security agent calls the local resource management interface to perform defense operations, including modifying system scheduling parameters, updating firewall rules and isolating suspicious processes.

7. The method according to claim 1, characterized in that At the edge node, the propagation speed and impact range of potential malicious nodes are evaluated to determine the diffusion trend of high-risk threats. If the threat spreads rapidly, complete isolation and network disconnection operations are performed, and the handling situation is reported to the cloud, including: Receive collected communication behavior data, which includes the number of connection requests per unit time, the amount of data transmitted, and the number of target IP addresses; The propagation speed index is calculated based on the communication behavior data using the exponentially weighted moving average method; The network topology diagram is constructed by using the Dijkstra algorithm. The potential malicious node is taken as the starting point, and the shortest path between it and other nodes is calculated to obtain the impact range index. Determine whether the propagation speed index exceeds the preset propagation speed threshold, and whether the impact range index exceeds the preset impact range threshold. If so, trigger the complete isolation mechanism; Generate a disposal report containing the isolation time, isolation cause and impact scope, and upload the disposal report to the cloud management platform through the established secure channel.

8. The method according to claim 1, characterized in that: The cloud uses a threat tracing mechanism to perform source analysis on identified malicious nodes, determine the affected network assets through the attack target classification system, dynamically adjust the network topology and security policies based on the analysis results, and synchronize the adjustment instructions to the edge nodes, including: Obtain the communication records, behavior characteristics, and attack pattern information of identified malicious nodes in the cloud log database; Apriori algorithm is used to mine association rules for communication records, behavioral characteristics, and attack pattern information; Construct an attack link graph based on the association rule mining results. The attack link graph includes the attack source and propagation path information. Determine the category of the assets involved in the attack chain diagram; Among them, asset categories include sensitive data, critical infrastructure, and general business systems; Obtain asset risk assessment results based on asset categories and the degree of impact of attacks; Receive asset risk assessment results; Use the minimum cut algorithm to analyze the existing network topology; Generate network segmentation scheme and new network topology diagram based on the minimum cut algorithm analysis results; Verify the new network topology diagram through network simulation tools; If the verification result shows that the network functions normally, the new network topology diagram is determined to be valid; Generate network adjustment instructions according to the new network topology diagram; Wherein, the network adjustment instruction includes network topology adjustment information and access control policy information; Send network adjustment instructions to edge nodes through secure channels; The edge node calls the network configuration management interface according to the network adjustment instructions to perform network reconstruction and security policy update.

9. The method according to claim 1, characterized in that: In the cloud-edge collaborative environment, the historical behavior and threat response of each node are recorded, and potential new variant threats are identified by calculating the variant threat similarity, including: Calculate the real-time reputation score of the node according to the preset scoring rules, clean and standardize the original behavior data, and obtain the normalized node behavior data; Obtain reputation scores and node behavior data from edge nodes and update the global reputation score database; Perform time series analysis on the node's historical behavior data to obtain the node's future reputation trend prediction results; The latest reputation scores and threat intelligence are pushed to edge nodes, which then update their local threat detection rule base and access control policies based on the received data.

10. The method according to claim 1, characterized in that The rule base dynamic update mechanism is used to update the active immunity rule base and threat feature classification system in the cloud according to the threat response results and newly discovered threat features, and synchronize the updates to the edge nodes, including: Obtain threat response results and newly discovered threat features from the cloud security log database; According to the newly discovered threat features, a clustering algorithm is used to classify the new threat features, and the silhouette coefficient method is used to determine the optimal number of clusters; According to the updated threat feature classification, the decision tree algorithm is used to generate new active immunity rules, and the confidence and support of each rule are calculated. The confidence is the ratio of the number of correct rule errors to the total number of rule triggers, and the support is the ratio of the number of rule triggers to the total number of samples. If the confidence of the rule is higher than the preset threshold, the rule is added to the active immunity rule base; Simulate attack scenarios in a sandbox environment, perform verification tests on newly generated rules, and obtain false positive and false negative rates; If the false alarm rate exceeds the preset threshold, the rules are optimized and adjusted until the false alarm rate meets the accuracy requirements; Dynamically adjust the weight or trigger threshold of the rule based on the changing trend of the false alarm rate and missed alarm rate; The distributed data synchronization mechanism is implemented through Apache ZooKeeper, and the updated active immunity rule library and threat feature classification system are packaged and pushed to each edge node using an incremental update method.

Images