Method and device for intercepting abnormal data of cloud resource pool and computer equipment

Abstract

The invention relates to an abnormal data interception method and device for a cloud resource pool and computer equipment. The method comprises the following steps: acquiring a current network data stream of a cloud resource pool, and performing data splitting processing on the network data stream to obtain a plurality of sub-data groups corresponding to security cores; based on the sub-data groups corresponding to the security cores, identifying local clustering centers corresponding to the security cores through a clustering algorithm, and based on the local clustering centers corresponding to the security cores, screening optimal local clustering centers corresponding to the security cores through a center index optimization algorithm; and identifying each target clustering center of the current network data flow in each optimal local clustering center through a particle swarm algorithm, and screening abnormal data information in each sub-data group based on each target clustering center to serve as intrusion suspicion data information of the network data flow. By adopting the method, the intrusion prevention effect on the cloud resource pool can be improved.

Description

Technical Field

[0001] The present application relates to the technical field of cloud resource pool and intrusion defense detection, and in particular to a method, device and computer equipment for intercepting abnormal data in a cloud resource pool. Background Art

[0002] Intrusion Prevention System (IPS) is a network security technology that monitors network traffic and system activities to detect and defend against malicious attacks and threats. With the rapid increase in the use of enterprise cloud resource pools, the wider range of popularization, and the emergence of huge network traffic data, traditional intrusion detection systems are difficult to meet the requirements of low latency, high real-time performance, and extracting effective behavioral features from high-dimensional massive data. Therefore, how to ensure the intrusion prevention effect of cloud resource pools is the current research focus.

[0003] The traditional intrusion prevention method for cloud resource pools is to control the data accessing the cloud resource pool by adding data permission verification steps and configuring permission management programs. However, since this method can only control the access address, it is impossible to control the data in a timely manner when abnormal data exists, resulting in poor intrusion prevention effect on the cloud resource pool. Summary of the invention

[0004] Based on this, it is necessary to provide a method, device, computer equipment, computer-readable storage medium and computer program product for intercepting abnormal data in a cloud resource pool in response to the above technical problems.

[0005] In a first aspect, the present application provides a method for intercepting abnormal data in a cloud resource pool, comprising:

[0006] Acquire the current network data flow of the cloud resource pool, and perform data splitting processing on the network data flow to obtain sub-data groups corresponding to multiple security cores;

[0007] Based on the sub-data groups corresponding to the safety cores, the local cluster centers corresponding to each safety core are identified by a clustering algorithm, and based on the local cluster centers corresponding to each safety core, the optimal local cluster centers corresponding to each safety core are screened by a center index optimization algorithm;

[0008] Through the particle swarm algorithm, each target cluster center of the current network data flow is identified in each optimal local cluster center, and based on each target cluster center, abnormal data information in each sub-data group is screened as suspected intrusion data information of the network data flow.

[0009] Optionally, the network data stream is subjected to data splitting processing to obtain sub-data groups corresponding to multiple security cores, including:

[0010] The network data stream is split and processed to obtain data information of each session type, and the processing type of each security core is collected;

[0011] Based on the processing type of each security core and the session type of each data information, the session type corresponding to each processing type is queried in the database, and based on the session type corresponding to each processing type, the data information of each session type is grouped and processed to obtain the sub-data group corresponding to the security core to which each processing type belongs.

[0012] Optionally, the identifying local cluster centers corresponding to each security core by a clustering algorithm based on the sub-data groups corresponding to each security core includes:

[0013] For each security core, performing feature extraction processing on each piece of data information in the sub-data group corresponding to the security core to obtain key data features of each piece of data information;

[0014] Based on the key data features of each of the data information, data clustering processing is performed on each of the data information by using a clustering algorithm to obtain each cluster data group;

[0015] The central data information in each cluster data group is extracted as each local cluster center corresponding to the security core.

[0016] Optionally, the method of screening the optimal local cluster centers corresponding to each security core by a central index optimization algorithm based on the local cluster centers corresponding to each security core includes:

[0017] For each security core, based on the key data features of each data information of each clustered data group corresponding to the security core, the distance value between each data information in each clustered data group is calculated by a feature distance algorithm, and for each clustered data group, based on the distance value between each data information in the clustered data group, the local density value of each data information is calculated by a local density algorithm;

[0018] Based on the local density value of each data information, in each of the data information, each high-density data information corresponding to each data information is screened, and based on each data information and each high-density data information corresponding to each data information, a distance optimization algorithm is used to calculate the shortest distance value between each data information and each high-density data information corresponding to each data information;

[0019] Based on each piece of data information, the nearest distance value between each piece of high-density data information corresponding to each piece of data information, and the local density value of each piece of data information, a central index value of each piece of data information is calculated by a central index algorithm;

[0020] In each data information, the data information with the maximum central index value is selected as the optimal central data information of the cluster data group, and the optimal central data information of each cluster data group is used as the optimal local cluster center corresponding to the security core.

[0021] Optionally, the identifying, in each of the optimal local cluster centers, each target cluster center of the current network data flow by using a particle swarm algorithm includes:

[0022] Obtaining the number of target cluster centers of the cloud resource pool and the objective function of the particle swarm algorithm, and for each security core, selecting the target center from the optimal local cluster centers of the security core;

[0023] Based on the data information of the target center, the target function value corresponding to the target center is calculated through the target function, and based on the target function value and the target center corresponding to the target function value, the target function is adjusted to obtain a new target function;

[0024] Reselect a new target center from each optimal local cluster center that has not been selected as the target center, and replace the target center with the new target center, and replace the target function with the new target function, and return to execute the data information based on the target center, and calculate the target function value corresponding to the target center through the target function, until the target function value corresponding to each optimal local cluster center is obtained;

[0025] Based on the number of security cores and the objective function values ​​corresponding to the optimal local clustering centers corresponding to each security core, the optimal local clustering centers corresponding to the objective function values ​​of the target number of clustering centers are selected in order from large to small as the target clustering centers of the current network data flow.

[0026] Optionally, screening abnormal data information in each sub-data group based on each of the target cluster centers includes:

[0027] Based on each data information in the sub-data group of each safety core and each of the target cluster centers, each sub-data group is clustered by a clustering algorithm to obtain discrete data information corresponding to each safety core;

[0028] The discrete data information corresponding to each of the security cores is used as abnormal data information of the sub-data group corresponding to each security core, and the abnormal data information corresponding to all the security cores is used as suspected intrusion data information of the network data flow.

[0029] In a second aspect, the present application also provides an abnormal data interception device for a cloud resource pool, comprising:

[0030] An acquisition module is used to acquire the current network data flow of the cloud resource pool, and perform data splitting processing on the network data flow to obtain sub-data groups corresponding to multiple security cores;

[0031] An optimization module, for identifying local cluster centers corresponding to each security core by a clustering algorithm based on the sub-data groups corresponding to each security core, and screening optimal local cluster centers corresponding to each security core by a center index optimization algorithm based on the local cluster centers corresponding to each security core;

[0032] The screening module is used to identify the target cluster centers of the current network data flow in the optimal local cluster centers through a particle swarm algorithm, and screen the abnormal data information in each sub-data group based on the target cluster centers as the suspected intrusion data information of the network data flow.

[0033] Optionally, the acquisition module is specifically used to:

[0034] The network data stream is split and processed to obtain data information of each session type, and the processing type of each security core is collected;

[0035] Based on the processing type of each security core and the session type of each data information, the session type corresponding to each processing type is queried in the database, and based on the session type corresponding to each processing type, the data information of each session type is grouped and processed to obtain the sub-data group corresponding to the security core to which each processing type belongs.

[0036] Optionally, the optimization module is specifically used to:

[0037] For each security core, performing feature extraction processing on each piece of data information in the sub-data group corresponding to the security core to obtain key data features of each piece of data information;

[0038] Based on the key data features of each of the data information, data clustering processing is performed on each of the data information by using a clustering algorithm to obtain each cluster data group;

[0039] The central data information in each cluster data group is extracted as each local cluster center corresponding to the security core.

[0040] Optionally, the optimization module is specifically used to:

[0041] For each security core, based on the key data features of each data information of each clustered data group corresponding to the security core, the distance value between each data information in each clustered data group is calculated by a feature distance algorithm, and for each clustered data group, based on the distance value between each data information in the clustered data group, the local density value of each data information is calculated by a local density algorithm;

[0042] Based on the local density value of each data information, in each of the data information, each high-density data information corresponding to each data information is screened, and based on each data information and each high-density data information corresponding to each data information, a distance optimization algorithm is used to calculate the shortest distance value between each data information and each high-density data information corresponding to each data information;

[0043] Based on each piece of data information, the nearest distance value between each piece of high-density data information corresponding to each piece of data information, and the local density value of each piece of data information, a central index value of each piece of data information is calculated by a central index algorithm;

[0044] In each data information, the data information with the maximum central index value is selected as the optimal central data information of the cluster data group, and the optimal central data information of each cluster data group is used as the optimal local cluster center corresponding to the security core.

[0045] Optionally, the screening module is specifically used to:

[0046] Obtaining the number of target cluster centers of the cloud resource pool and the objective function of the particle swarm algorithm, and for each security core, selecting the target center from the optimal local cluster centers of the security core;

[0047] Based on the data information of the target center, the target function value corresponding to the target center is calculated through the target function, and based on the target function value and the target center corresponding to the target function value, the target function is adjusted to obtain a new target function;

[0048] Reselect a new target center from each optimal local cluster center that has not been selected as the target center, and replace the target center with the new target center, and replace the target function with the new target function, and return to execute the data information based on the target center, and calculate the target function value corresponding to the target center through the target function, until the target function value corresponding to each optimal local cluster center is obtained;

[0049] Based on the number of security cores and the objective function values ​​corresponding to the optimal local clustering centers corresponding to each security core, the optimal local clustering centers corresponding to the objective function values ​​of the target number of clustering centers are selected in order from large to small as the target clustering centers of the current network data flow.

[0050] Optionally, the screening module is specifically used to:

[0051] Based on each data information in the sub-data group of each safety core and each of the target cluster centers, each sub-data group is clustered by a clustering algorithm to obtain discrete data information corresponding to each safety core;

[0052] The discrete data information corresponding to each of the security cores is used as abnormal data information of the sub-data group corresponding to each security core, and the abnormal data information corresponding to all the security cores is used as suspected intrusion data information of the network data flow.

[0053] In a third aspect, the present application provides a computer device, wherein the computer device comprises a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, the steps of any one of the methods in the first aspect are implemented.

[0054] In a fourth aspect, the present application provides a computer-readable storage medium having a computer program stored thereon, wherein when the computer program is executed by a processor, the steps of any one of the methods in the first aspect are implemented.

[0055] In a fifth aspect, the present application provides a computer program product. The computer program product includes a computer program, and when the computer program is executed by a processor, the steps of any one of the methods in the first aspect are implemented.

[0056] The above-mentioned abnormal data interception method, device and computer equipment of the cloud resource pool obtain the current network data flow of the cloud resource pool, and split the network data flow to obtain sub-data groups corresponding to multiple security cores; based on the sub-data groups corresponding to each security core, identify the local cluster centers corresponding to each security core through a clustering algorithm, and based on the local cluster centers corresponding to each security core, screen the optimal local cluster centers corresponding to each security core through a center index optimization algorithm; through a particle swarm algorithm, identify the target cluster centers of the current network data flow in each optimal local cluster center, and based on each target cluster center, screen the abnormal data information in each sub-data group as the suspected intrusion data information of the network data flow. This solution splits the network data flow into sub-data groups processed by each security core, thereby identifying the suspected intrusion data information by data flow, each security core only processes a part of the local data flow, and each security core calculates in parallel, thereby reducing the time length of identifying the suspected intrusion data information, reducing the complexity of the overall calculation, and improving the recognition efficiency of identifying the suspected intrusion data information. Then, when identifying suspected intrusion data information, this solution, based on the clustering algorithm, uses the center index optimization algorithm to first screen the optimal local cluster center calculated by each security core, and then uses the particle swarm algorithm to screen the target cluster center among the optimal local cluster centers, avoiding the problem of low accuracy of the cluster centers generated by each security core, thereby comprehensively improving the accuracy of the screened suspected intrusion data information. Finally, the staff can conduct accurate data interception through the screened suspected intrusion data information, which can effectively improve the intrusion defense effect of the cloud resource pool. BRIEF DESCRIPTION OF THE DRAWINGS

[0057] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the related technologies, the drawings required for use in the embodiments or the related technical descriptions are briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0058] Figure 1 A system structure diagram of an abnormal data interception system of a cloud resource pool in one embodiment;

[0059] Figure 2 It is a flowchart of a method for intercepting abnormal data in a cloud resource pool in one embodiment;

[0060] Figure 3 A comparison diagram of computing effects of an abnormal data interception method of a cloud resource pool in one embodiment;

[0061] Figure 4A flowchart of an example of intercepting abnormal data in a cloud resource pool in one embodiment;

[0062] Figure 5 It is a structural block diagram of an abnormal data interception device of a cloud resource pool in one embodiment;

[0063] Figure 6 FIG. 4 is a diagram showing the internal structure of a computer device in one embodiment. DETAILED DESCRIPTION

[0064] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0065] The abnormal data interception method of the cloud resource pool provided in the embodiment of the present application can be applied to Figure 1 In the application environment of the abnormal data interception system of the cloud resource pool shown. Among them, the system includes a forwarding core core and multiple security cores, each security core includes a flow module, an intrusion prevention module, and a log analysis module, wherein the flow module is used to receive the data information transmitted by each forwarding core, the log analysis module is used to perform cluster analysis on each data information in each security core, and the intrusion prevention module is used to identify the suspected intrusion data information in each data information. The forwarding core is used to split the network data flow into sub-data groups processed by each sub-security core, wherein the abnormal data interception method of the resource pool adapted by the system can be applied to the terminal, can also be applied to the server, can also be applied to the system including the terminal and the server, and is realized through the interaction between the terminal and the server. Among them, the terminal can be but not limited to various personal computers, laptops, medium-sized computers, etc. Among them, the terminal splits the network data flow into sub-data groups processed by each security core, thereby identifying the suspected intrusion data information by data flow, each security core only processes a part of the local data flow, and each security core calculates in parallel, thereby reducing the time length of identifying the suspected intrusion data information, reducing the complexity of the overall calculation, and improving the recognition efficiency of identifying the suspected intrusion data information. Then, when identifying suspected intrusion data information, this solution, based on the clustering algorithm, uses the center index optimization algorithm to first screen the optimal local cluster center calculated by each security core, and then uses the particle swarm algorithm to screen the target cluster center among the optimal local cluster centers, avoiding the problem of low accuracy of the cluster centers generated by each security core, thereby comprehensively improving the accuracy of the screened suspected intrusion data information. Finally, the staff can conduct accurate data interception through the screened suspected intrusion data information, which can effectively improve the intrusion defense effect of the cloud resource pool.

[0066] In an exemplary embodiment, Figure 2As shown, a method for intercepting abnormal data in a cloud resource pool is provided, which is described by taking the method applied to a terminal as an example, and includes the following steps S201 to S203.

[0067] in:

[0068] Step S201, obtain the current network data flow of the cloud resource pool, and perform data splitting processing on the network data flow to obtain sub-data groups corresponding to multiple security cores.

[0069] In this embodiment, the terminal obtains the network data flow that is about to be input into the cloud resource pool from the network card of the cloud resource pool through the forwarding core, and performs data splitting processing on the network data flow through the forwarding core to obtain sub-data groups corresponding to each security core. Among them, each security core can process data information of a session type, and the network data flow includes data information of multiple session types. The session type is used to characterize the data flow of different session characteristics, and the security core processing can not only ensure that the data flow of a specific session can be processed on a specific security core, but also improve the processing efficiency of the network data flow. Then, the terminal splits the network data flow and obtains sub-data groups corresponding to multiple security cores. Among them, the sub-data group corresponding to each security core is the session type corresponding to the processing type to which the session characteristics that the security core can process belong. The determination process will be described in detail later.

[0070] Step S202, based on the sub-data groups corresponding to each security core, identify the local cluster centers corresponding to each security core through a clustering algorithm, and based on the local cluster centers corresponding to each security core, screen the optimal local cluster centers corresponding to each security core through a center index optimization algorithm.

[0071] In this embodiment, the terminal performs clustering processing on the sub-data groups corresponding to each security core through a clustering algorithm based on the sub-data groups corresponding to each security core, thereby generating local cluster centers for each security core. Then, based on the local cluster centers corresponding to each security core, the terminal re-screens the local cluster centers corresponding to each security core through a center index optimization algorithm to obtain the optimal local cluster centers corresponding to each security core. Among them, the clustering algorithm is a K-means clustering algorithm. The specific process of identifying local cluster centers and optimal local cluster centers will be described in detail later.

[0072] Step S203, using the particle swarm algorithm, identifying the target cluster centers of the current network data flow in the optimal local cluster centers, and based on the target cluster centers, screening the abnormal data information in each sub-data group as the suspected intrusion data information of the network data flow.

[0073] In this embodiment, the terminal uses a particle swarm algorithm to identify the target cluster centers of the current network data flow in each optimal local cluster center, and based on each target cluster center, screens the abnormal data information in each sub-data group as the intrusion suspect data information of the network data flow. The particle swarm algorithm is a particle swarm optimization algorithm (PSO). The specific identification process will be described in detail later.

[0074] Based on the above scheme, by splitting the network data flow into sub-data groups processed by each security core, the suspected intrusion data information is identified by data flow. Each security core only processes a part of the local data flow, and each security core calculates in parallel, thereby reducing the length of time to identify the suspected intrusion data information, reducing the complexity of the overall calculation, and improving the efficiency of identifying the suspected intrusion data information. Then, when identifying the suspected intrusion data information, this scheme, based on the clustering algorithm, first screens the optimal local cluster center calculated by each security core through the center index optimization algorithm, and then uses the particle swarm algorithm to screen the target cluster center in each optimal local cluster center, avoiding the problem of low accuracy of the cluster center generated by each security core, thereby comprehensively improving the accuracy of the screened suspected intrusion data information. Finally, the staff can intercept the screened suspected intrusion data information accurately, which can effectively improve the intrusion defense effect of the cloud resource pool.

[0075] Optionally, the network data stream is subjected to data splitting processing to obtain sub-data groups corresponding to multiple security cores, including: performing data splitting processing on the network data stream to obtain data information of each session type, and collecting the processing type of each security core; based on the processing type of each security core and the session type of each data information, querying the session type corresponding to each processing type in the database, and based on the session type corresponding to each processing type, grouping the data information of each session type to obtain sub-data groups corresponding to the security core to which each processing type belongs.

[0076] In this embodiment, the terminal performs data splitting processing on the network data stream to obtain each data information of each session type, and collects the processing type of each security core. Among them, the processing type of each security core is the session feature that each security core can process, and each session type is the session feature to which each data information belongs. Then, the terminal screens each data information corresponding to the session feature that the security core can process as the sub-data group corresponding to the security core. Among them, each session feature is the feature identification information in the interactive session information corresponding to each network data stream, and the feature identification information is the identification information preset by the staff in each data information. The terminal identifies the session type corresponding to the processing type of each security core through the identification information.

[0077] Based on the above solution, after splitting the network data flow into session types, the security core to which each data information belongs is identified through the correspondence between the processing type and the session type of each security core, thereby determining the sub-data group corresponding to each security core, thereby improving the recognition accuracy of the sub-data group corresponding to each security core.

[0078] Optionally, based on the sub-data groups corresponding to each security core, a clustering algorithm is used to identify local cluster centers corresponding to each security core, including: for each security core, performing feature extraction processing on each data information in the sub-data group corresponding to the security core to obtain key data features of each data information; based on the key data features of each data information, performing data clustering processing on each data information through a clustering algorithm to obtain each cluster data group; extracting the central data information in each cluster data group as the local cluster centers corresponding to the security core.

[0079] In this embodiment, the terminal identifies the information features of each data information in the sub-data group corresponding to each security core, and uses each information feature as the key data feature of each data information. The information features of each data information include but are not limited to the data features of the system, port, network segment, host network request data corresponding to the data information.

[0080] Then, based on the key data features of each data information, the terminal uses a clustering algorithm to perform data clustering processing on each data information to obtain each cluster data group. The clustering process is:

[0081] 1. Initialization: The terminal generates K initial cluster centers. These centers can be random points in the sub-data group, or use initialization methods such as K-means++ to ensure better initial centroid selection.

[0082] 2. Assign data to the nearest cluster center: For each data in the sub-data group, calculate the distance between the key data features of each data and the K cluster centers. Assign each data to the nearest cluster center to form K clusters.

[0083] 3. Recalculate the cluster center: For each cluster, calculate the average value of the key data features of all data information in the cluster, and set this average value as the new cluster center.

[0084] 4. Iterative optimization: Repeat steps 2 and 3 until the location of the cluster center no longer changes significantly, or the preset number of iterations is reached.

[0085] Finally, the terminal uses the cluster centers of the last iteration as the central data information of each cluster data group. Finally, the terminal uses the central data information in each cluster data group as the local cluster centers corresponding to the security core.

[0086] Based on the above scheme, by identifying the key data features of each data information in the sub-data group and then identifying each local cluster center of each sub-data group, the recognition efficiency and accuracy of identifying each local cluster center are improved.

[0087] Optionally, based on the local cluster center corresponding to each security core, the optimal local cluster center corresponding to each security core is screened through a center index optimization algorithm, including: for each security core, based on the key data features of each data information of each cluster data group corresponding to the security core, the distance value between each data information in each cluster data group is calculated through a feature distance algorithm, and for each cluster data group, based on the distance value between each data information in the cluster data group, the local density value of each data information is calculated through a local density algorithm; based on the local density value of each data information, in each data information, each high-density data information corresponding to each data information is screened, and based on the local density value of each data information, the local density value of each data information is calculated through a local density algorithm; based on the local density value of ... each high-density data information corresponding to each data information is screened, and based on the local density value of each data information, each high-density data information corresponding to each data information is screened, and based on the local density value of each data information, each high-density data information corresponding to each data information is screened. For each data information and each high-density data information corresponding to each data information, the nearest distance value between each data information and each high-density data information corresponding to each data information is calculated through a distance optimization algorithm; based on the nearest distance value between each data information and each high-density data information corresponding to each data information, and the local density value of each data information, the center index value of each data information is calculated through a center index algorithm; in each data information, the data information with the largest center index value is selected as the optimal center data information of the cluster data group, and the optimal center data information of each cluster data group is used as the optimal local cluster center corresponding to the safety core.

[0088] In this embodiment, first, the center of each category must be the point with the largest local density in the category. The local density here is represented by ρ i To indicate the degree of local aggregation of the i-th data point; secondly, the cluster center is relatively far away from the points with higher local density, and this distance is expressed by δ i These two parameters can effectively describe the location of the data point in the data set. Specifically, we can divide the possibility of the point into four cases based on these two parameters:

[0089] 1. If ρ at a certain point i The value is larger and δ i A small value means that although the point is close to the cluster center, there are points that are closer to the cluster center and may be of the same type, so the possibility of the point becoming the cluster center is not great;

[0090] 2. If ρ at a certain point i and δ i If the values ​​are all small, it may be on the edge of its category;

[0091] 3. If ρ at a certain point i The value is small and δ i A large value means that the point is far away from the entire data set, so it is likely to be an outlier;

[0092] 4. Finally, if ρ at a certain point i and δ i The values ​​are large, then it is very likely to be the cluster center. In order to quantify the possibility of each point becoming a cluster center, a new indicator is introduced here - the center score. This index is defined based on the above characteristics to measure the potential of each point as a cluster center.

[0093] After data cleaning, feature extraction and data encoding, the terminal encodes each stream into data information: X L =[x 1 ,x 2 ,…,x L ], where x i =[x 1i ,x 2i ,…,x Ni ]T is the column vector converted from the i-th data information, and L is the total number of data information. Then, for each security core, the terminal calculates the distance value between each data information in each clustered data group based on the key data features of each data information in each clustered data group corresponding to the security core through the feature distance algorithm. Among them, the feature distance algorithm is: the Euclidean distance of two data information:

[0094] d ij =||x i -x j || 2 (1)

[0095] In the above formula, the Euclidean distance between two data information is d ij , ‖X i -X j ‖ 2 Represents the 2-norm operator. Then, the terminal controls the neighborhood range of the cluster center by setting a threshold, and generally adopts a Gaussian kernel function to adapt. Therefore, for each cluster data group, based on the distance value between each data information in the cluster data group, the local density value of each data information is calculated by the local density algorithm. i Represented, and the calculation formula of the local density algorithm is:

[0096]

[0097] Then, the terminal screens the high-density data information corresponding to each data information in each data information based on the local density value of each data information, and calculates the shortest distance value between each data information and each high-density data information corresponding to each data information through a distance optimization algorithm based on each data information and each high-density data information corresponding to each data information. The distance optimization algorithm is:

[0098]

[0099] Finally, the terminal calculates the central index value of each data information through the central index algorithm based on each data information, the nearest distance value between each high-density data information corresponding to each data information, and the local density value of each data information. The calculation formula of the central index algorithm is as follows:

[0100] CSi=ρ i * δ i (4)

[0101] To sum up, the pseudo code of the SCA (cluster center index algorithm) algorithm is as follows:

[0102] 1. Input: X = [x1, x2, …, xL].

[0103] 2. Calculate the distance d between two data information according to formula (1) ij .

[0104] 3. Calculate the local density ρ of each data information according to formula (2) i .

[0105] 4. Calculate the δ of each data information according to formula (3) i .

[0106] 5. Calculate the central index CSi of each data information according to formula (4).

[0107] 6. Sort the data information by CSi from large to small, and select the first n as needed.

[0108] In each data information, the terminal selects the data information with the maximum central index value as the optimal central data information of the cluster data group, and uses the optimal central data information of each cluster data group as the optimal local cluster center corresponding to the security core.

[0109] Based on the above scheme, the cluster center calculated for each safety core is optimized by combining the central index optimization algorithm, thereby improving the accuracy of the optimal local cluster center corresponding to each safety core.

[0110] Optionally, through the particle swarm algorithm, each target clustering center of the current network data flow is identified in each optimal local clustering center, including: obtaining the number of target clustering centers of the cloud resource pool and the objective function of the particle swarm algorithm, and for each security core, screening the target center in each optimal local clustering center of the security core; based on the data information of the target center, calculating the objective function value corresponding to the target center through the objective function, and adjusting the objective function based on the objective function value and the target center corresponding to the objective function value to obtain a new objective function; re-screening a new target center in each optimal local clustering center that has not been screened as the target center, and replacing the target center with the new target center, replacing the objective function with the new objective function, returning to execute the step of calculating the objective function value corresponding to the target center through the objective function based on the data information of the target center, until the objective function value corresponding to each optimal local clustering center is obtained; based on the number of security cores and the objective function values ​​corresponding to each optimal local clustering center corresponding to each security core, in the order of objective function values ​​from large to small, screening the optimal local clustering center corresponding to the objective function value of the number of target clustering centers as the target clustering center of the current network data flow.

[0111] In this embodiment, the terminal obtains the target number of cluster centers of the cloud resource pool and the objective function of the particle swarm algorithm, and for each security core, selects the target center from the optimal local cluster centers of the security core. Among them, since the data flow has been diverted to different security cores, the terminal regards the sub-data group of each security core as a subspace. Then, the central index optimization algorithm is used to select the cluster center for each subspace. Only the first n optimal cluster centers are selected for each subspace, then N subspaces will select n*N cluster centers, and finally the particle swarm algorithm is used to globally search for N cluster centers as a combination, that is, the optimal solution. Among them, the optimization logic of the particle swarm algorithm is:

[0112] 1. Initialization:

[0113] The terminal randomly generates a set of particles in the solution space, each particle has a random position and velocity.

[0114] The terminal sets the particle size, which is the number of particles in the particle group.

[0115] The terminal initializes the individual optimal position pbest and the global optimal position gbest of the particle.

[0116] 2. Evaluation:

[0117] The terminal calculates the fitness value of each particle, which is usually evaluated by the objective function to be optimized.

[0118] Terminal updates individual and global optimal solutions:

[0119] If the current particle’s fitness is better than its historical best fitness, update the particle’s individual best position pbest.

[0120] If the fitness of the current particle is better than the global best fitness of the group, the global optimal position gbest is updated.

[0121] 3. Update speed and location:

[0122] The terminal updates the particle's speed and position according to the individual optimal position pbest, the global optimal position gbest, and the particle's current speed and position: vi = vi + C1 × rand() × (pbest-xi) + C2 × rand() × (gbest-xi); xi = xi + vi; where rand() is a random number between 0 and 1, C1 and C2 are learning factors, usually C1 = C2 = 2;

[0123] 4. Termination inspection:

[0124] The terminal checks whether the preset maximum number of iterations has been reached or other termination conditions have been met. If so, the algorithm stops; otherwise, it returns to step 2 to continue iterating.

[0125] The optimization logic for each cluster center involved in this solution is adaptively adjusted to:

[0126] 1. N subspaces, each subspace selects n cluster centers as candidates;

[0127] 2. Initialize the particle swarm algorithm:

[0128] Set the objective function;

[0129] Determine the particle dimension as N, which is the number of cluster centers of the optimal combination;

[0130] 3. Apply the particle swarm algorithm and perform the following operations on each subspace:

[0131] Select one of the cluster centers and calculate the objective function value;

[0132] Update the particle algorithm based on the results;

[0133] 4. Finally, find the global optimal solution for the entire group;

[0134] Among them, the first step and the second step correspond to that the terminal calculates the objective function value corresponding to the target center through the objective function based on the data information of the target center, and adjusts the objective function based on the objective function value and the target center corresponding to the objective function value to obtain a new objective function.

[0135] Then, the second step corresponds to that the terminal re-screens a new target center from each optimal local clustering center that has not been screened as the target center, and replaces the target center with the new target center, replaces the target function with the new target function, returns to execute the data information based on the target center, and calculates the target function value corresponding to the target center through the target function, until the target function value corresponding to each optimal local clustering center is obtained.

[0136] Finally, the fourth step corresponds to that the terminal selects the optimal local clustering center corresponding to the objective function value of the target number of clustering centers based on the number of security cores and the objective function values ​​corresponding to the optimal local clustering centers corresponding to each security core, in order from large to small objective function values, as the target clustering center of the current network data flow.

[0137] Based on the above scheme, the target cluster center of the current network data flow is screened among the cluster centers through the optimization characteristics of the particle swarm algorithm, thereby improving the screening accuracy of the target cluster center.

[0138] Optionally, based on each target cluster center, abnormal data information in each sub-data group is screened, including: based on the data information in the sub-data group of each security core and each target cluster center, each sub-data group is clustered separately through a clustering algorithm to obtain discrete data information corresponding to each security core; the discrete data information corresponding to each security core is used as the abnormal data information of the sub-data group corresponding to each security core, and the abnormal data information corresponding to all security cores is used as suspected intrusion data information of the network data flow.

[0139] In this embodiment, the terminal performs clustering processing on each sub-data group based on each data information in the sub-data group of each security core and each target cluster center through a clustering algorithm to obtain discrete data information corresponding to each security core. Then, the terminal uses the discrete data information corresponding to each security core as the abnormal data information of the sub-data group corresponding to each security core, and uses the abnormal data information corresponding to all security cores as the suspected intrusion data information of the network data flow. Among them, the abnormal data information will be sent to the staff client, so as to guide the staff to make a manual judgment on the suspected intrusion of the abnormal data information, avoiding the situation where the data information is mistakenly intercepted due to misidentification. The accuracy of intrusion prevention and intrusion judgment of abnormal data information is improved.

[0140] Based on the above scheme, discrete data information is screened by optimizing the screened target cluster center, thereby improving the accuracy of screening discrete data information.

[0141] In one embodiment, for example, when authorized, the terminal collects 7 days of data traffic collected by the firewall of the enterprise cloud resource pool, and then completes the preliminary work such as data cleaning, sampling, feature extraction, and encoding to form a data set. The firewall runs on a bare metal device with a specification of 16 cores and 32G. There is one forwarding core and the rest are security cores.

[0142] Then, the terminal selects appropriate evaluation indicators to verify the effect of the algorithm. The evaluation indicator used in this chapter is the confusion matrix, as shown in Table 1. The confusion matrix will evaluate the algorithm proposed in this article from the following indicators: Accuracy, Recall, Precision, and F1 (F1-score).

[0143] Table 1: Confusion Matrix

[0144] state Judged as normal Judged as an attack Normal traffic TN FN Intrusion traffic FP TP

[0145] Among them, the accuracy can reflect the classifier's ability to judge samples:

[0146] AC=(TP+TN) / (TP+FN+FP+TN) (5)

[0147] Recall can reflect the proportion of correct attack samples in all attack samples:

[0148] Recall=TP / (TP+FN) (6)

[0149] Precision reflects the proportion of correct attack samples in all samples predicted to be attack samples:

[0150] Precision=TP / (TP+FP) (7)

[0151] F1 (F1-score) can reflect the overall index as well as the two indicators of Recall and Precision

[0152] F1=2TP / (2TP+FP+FN) (8)

[0153] Then, the terminal used the entire training set to tune the model parameters for multiple rounds, and then randomly split 20% of the data on the test set for 5 groups of experiments, with 30 rounds of testing for each group. The experimental results are shown in Table 2:

[0154] Table 2: Scores of each indicator in different groups

[0155]

[0156]

[0157] From the results, we can see that the accuracy of the algorithm in this scheme can reach 96% on average under the current parameters, and several other indicators are also relatively ideal. Through cross-validation experiments and repeated tests, the results obtained by the algorithm model in this paper have remained relatively stable under multiple rounds of test performance of different experimental data, indicating that the algorithm has good robustness. The significance of this is that in the face of huge and complex traffic in the real environment, the input data is also complex and the situation is changeable. The model can ensure stable operation, which is particularly important for intrusion detection systems.

[0158] The time analysis is as follows:

[0159] like Figure 3 As shown, it can be seen that the method involved in this solution (Current Algorithm) is about 3 times faster than the traditional method (Traditional Algorithm), and the performance has been greatly improved.

[0160] This application also provides an example of abnormal data interception in a cloud resource pool, such as Figure 4 As shown, the specific processing process includes the following steps:

[0161] Step S401, obtaining the current network data flow of the cloud resource pool.

[0162] Step S402, the network data stream is split and processed to obtain data information of each session type, and the processing type of each security core is collected.

[0163] Step S403, based on the processing type of each security core and the session type of each data information, query the session type corresponding to each processing type in the database, and based on the session type corresponding to each processing type, group the data information of each session type to obtain the sub-data group corresponding to the security core to which each processing type belongs.

[0164] Step S404: for each safety core, feature extraction processing is performed on each piece of data information in the sub-data group corresponding to the safety core to obtain key data features of each piece of data information.

[0165] Step S405 , based on the key data features of each piece of data information, a clustering algorithm is used to perform data clustering processing on each piece of data information to obtain each cluster data group.

[0166] Step S406: extract the central data information in each cluster data group as each local cluster center corresponding to the security core.

[0167] Step S407, for each security core, based on the key data features of each data information in each cluster data group corresponding to the security core, calculate the distance value between each data information in each cluster data group through a feature distance algorithm, and for each cluster data group, based on the distance value between each data information in the cluster data group, calculate the local density value of each data information through a local density algorithm.

[0168] Step S408, based on the local density value of each data information, in each data information, the high-density data information corresponding to each data information is screened, and based on each data information and the high-density data information corresponding to each data information, the distance optimization algorithm is used to calculate the shortest distance value between each data information and the high-density data information corresponding to each data information.

[0169] Step S409, based on each piece of data information, the shortest distance value between each piece of high-density data information corresponding to each piece of data information, and the local density value of each piece of data information, a central index value of each piece of data information is calculated by a central index algorithm.

[0170] Step S410, in each data information, the data information with the maximum central index value is selected as the optimal central data information of the cluster data group, and the optimal central data information of each cluster data group is used as each optimal local cluster center corresponding to the safety core.

[0171] Step S411, obtaining the number of target cluster centers of the cloud resource pool and the objective function of the particle swarm algorithm, and for each security core, selecting the target center from the optimal local cluster centers of the security core.

[0172] Step S412, based on the data information of the target center, the target function value corresponding to the target center is calculated through the target function, and based on the target function value and the target center corresponding to the target function value, the target function is adjusted to obtain a new target function.

[0173] Step S413, re-screen the new target center from the optimal local cluster centers that have not been screened as the target center, and replace the target center with the new target center, and replace the target function with the new target function, and return to execute the data information based on the target center, and calculate the target function value corresponding to the target center through the target function, until the target function value corresponding to each optimal local cluster center is obtained.

[0174] Step S414, based on the number of security cores and the objective function values ​​corresponding to the optimal local clustering centers corresponding to each security core, select the optimal local clustering center corresponding to the objective function value of the target number of clustering centers in order from large to small as the target clustering center of the current network data flow.

[0175] Step S415 , based on each data information in the sub-data group of each safety core and each target cluster center, clustering processing is performed on each sub-data group through a clustering algorithm to obtain discrete data information corresponding to each safety core.

[0176] Step S416, using the discrete data information corresponding to each security core as abnormal data information of the sub-data group corresponding to each security core, and using the abnormal data information corresponding to all security cores as suspected intrusion data information of the network data flow.

[0177] It should be understood that, although the various steps in the flowcharts involved in the above-mentioned embodiments are displayed in sequence according to the indication of the arrows, these steps are not necessarily executed in sequence according to the order indicated by the arrows. Unless there is a clear explanation in this article, the execution of these steps does not have a strict order restriction, and these steps can be executed in other orders. Moreover, at least a part of the steps in the flowcharts involved in the above-mentioned embodiments can include multiple steps or multiple stages, and these steps or stages are not necessarily executed at the same time, but can be executed at different times, and the execution order of these steps or stages is not necessarily to be carried out in sequence, but can be executed in turn or alternately with other steps or at least a part of the steps or stages in other steps.

[0178] Based on the same inventive concept, the embodiment of the present application also provides a cloud resource pool abnormal data interception device for implementing the above-mentioned cloud resource pool abnormal data interception method. The implementation scheme for solving the problem provided by the device is similar to the implementation scheme recorded in the above-mentioned method, so the specific limitations in the embodiments of the abnormal data interception device for one or more cloud resource pools provided below can refer to the limitations of the abnormal data interception method for the cloud resource pool above, and will not be repeated here.

[0179] In an exemplary embodiment, Figure 5 As shown, a device for intercepting abnormal data of a cloud resource pool is provided, comprising: an acquisition module 510, an optimization module 520 and a screening module 530, wherein:

[0180] The acquisition module 510 is used to acquire the current network data flow of the cloud resource pool, and perform data splitting processing on the network data flow to obtain sub-data groups corresponding to multiple security cores;

[0181] The optimization module 520 is used to identify the local cluster centers corresponding to each security core by a clustering algorithm based on the sub-data groups corresponding to each security core, and screen the optimal local cluster centers corresponding to each security core by a center index optimization algorithm based on the local cluster centers corresponding to each security core;

[0182] The screening module 530 is used to identify the target cluster centers of the current network data flow in each of the optimal local cluster centers through a particle swarm algorithm, and based on each of the target cluster centers, screen the abnormal data information in each sub-data group as the suspected intrusion data information of the network data flow.

[0183] Optionally, the acquisition module 510 is specifically configured to:

[0184] The network data stream is split and processed to obtain data information of each session type, and the processing type of each security core is collected;

[0185] Based on the processing type of each security core and the session type of each data information, the session type corresponding to each processing type is queried in the database, and based on the session type corresponding to each processing type, the data information of each session type is grouped and processed to obtain the sub-data group corresponding to the security core to which each processing type belongs.

[0186] Optionally, the optimization module 520 is specifically configured to:

[0187] For each security core, performing feature extraction processing on each piece of data information in the sub-data group corresponding to the security core to obtain key data features of each piece of data information;

[0188] Based on the key data features of each of the data information, data clustering processing is performed on each of the data information by using a clustering algorithm to obtain each cluster data group;

[0189] The central data information in each cluster data group is extracted as each local cluster center corresponding to the security core.

[0190] Optionally, the optimization module 520 is specifically configured to:

[0191] For each security core, based on the key data features of each data information of each clustered data group corresponding to the security core, the distance value between each data information in each clustered data group is calculated by a feature distance algorithm, and for each clustered data group, based on the distance value between each data information in the clustered data group, the local density value of each data information is calculated by a local density algorithm;

[0192] Based on the local density value of each data information, in each of the data information, each high-density data information corresponding to each data information is screened, and based on each data information and each high-density data information corresponding to each data information, a distance optimization algorithm is used to calculate the shortest distance value between each data information and each high-density data information corresponding to each data information;

[0193] Based on each piece of data information, the nearest distance value between each piece of high-density data information corresponding to each piece of data information, and the local density value of each piece of data information, a central index value of each piece of data information is calculated by a central index algorithm;

[0194] In each data information, the data information with the maximum central index value is selected as the optimal central data information of the cluster data group, and the optimal central data information of each cluster data group is used as the optimal local cluster center corresponding to the security core.

[0195] Optionally, the screening module 530 is specifically used to:

[0196] Obtaining the number of target cluster centers of the cloud resource pool and the objective function of the particle swarm algorithm, and for each security core, selecting the target center from the optimal local cluster centers of the security core;

[0197] Based on the data information of the target center, the target function value corresponding to the target center is calculated through the target function, and based on the target function value and the target center corresponding to the target function value, the target function is adjusted to obtain a new target function;

[0198] Reselect a new target center from each optimal local cluster center that has not been selected as the target center, and replace the target center with the new target center, and replace the target function with the new target function, and return to execute the data information based on the target center, and calculate the target function value corresponding to the target center through the target function, until the target function value corresponding to each optimal local cluster center is obtained;

[0199] Based on the number of security cores and the objective function values ​​corresponding to the optimal local clustering centers corresponding to each security core, the optimal local clustering centers corresponding to the objective function values ​​of the target number of clustering centers are selected in order from large to small as the target clustering centers of the current network data flow.

[0200] Optionally, the screening module 530 is specifically used to:

[0201] Based on each data information in the sub-data group of each safety core and each of the target cluster centers, each sub-data group is clustered by a clustering algorithm to obtain discrete data information corresponding to each safety core;

[0202] The discrete data information corresponding to each of the security cores is used as abnormal data information of the sub-data group corresponding to each security core, and the abnormal data information corresponding to all the security cores is used as suspected intrusion data information of the network data flow.

[0203] Each module in the abnormal data interception device of the cloud resource pool can be implemented in whole or in part by software, hardware and a combination thereof. Each module can be embedded in or independent of a processor in a computer device in the form of hardware, or can be stored in a memory in a computer device in the form of software, so that the processor can call and execute the operations corresponding to each module.

[0204] In an exemplary embodiment, a computer device is provided. The computer device may be a terminal, and its internal structure diagram may be as shown in FIG. Figure 6 As shown. The computer device includes a processor, a memory, an input / output interface, a communication interface, a display unit and an input device. Among them, the processor, the memory and the input / output interface are connected through a system bus, and the communication interface, the display unit and the input device are connected to the system bus through the input / output interface. Among them, the processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system and a computer program. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The input / output interface of the computer device is used to exchange information between the processor and the external device. The communication interface of the computer device is used to communicate with an external terminal in a wired or wireless manner, and the wireless manner can be implemented through WIFI, a mobile cellular network, NFC (near field communication) or other technologies. When the computer program is executed by the processor, a method for intercepting abnormal data in a cloud resource pool is implemented. The display unit of the computer device is used to form a visually visible picture, which can be a display screen, a projection device or a virtual reality imaging device. The display screen can be a liquid crystal display screen or an electronic ink display screen, and the input device of the computer device can be a touch layer covering the display screen, or a button, trackball or touchpad set on the computer device shell, or an external keyboard, touchpad or mouse.

[0205] Those skilled in the art will understand that Figure 6 The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0206] In an exemplary embodiment, a computer device is provided, including a memory and a processor, wherein a computer program is stored in the memory, and the processor executes the steps of any one of the methods in the first aspect when executing the computer program.

[0207] In one embodiment, a computer-readable storage medium is provided, on which a computer program is stored, and when the computer program is executed by a processor, the steps of any one of the methods in the first aspect are described.

[0208] In one embodiment, a computer program product is provided, comprising a computer program, which, when executed by a processor, comprises the steps of any one of the methods according to the first aspect.

[0209] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with relevant regulations.

[0210] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to the memory, database or other medium used in the embodiments provided in the present application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetoresistive random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. As an illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM). The database involved in each embodiment provided in this application may include at least one of a relational database and a non-relational database. Non-relational databases may include distributed databases based on blockchains, etc., but are not limited to this. The processor involved in each embodiment provided in this application may be a general-purpose processor, a central processing unit, a graphics processor, a digital signal processor, a programmable logic device, a data processing logic device based on quantum computing, etc., but are not limited to this.

[0211] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0212] The above-described embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the present application. It should be pointed out that, for a person of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the present application shall be subject to the attached claims.

Claims

1. A method for intercepting abnormal data in a cloud resource pool, characterized in that: The method comprises: Acquire the current network data flow of the cloud resource pool, and perform data splitting processing on the network data flow to obtain sub-data groups corresponding to multiple security cores; Based on the sub-data groups corresponding to the safety cores, the local cluster centers corresponding to each safety core are identified by a clustering algorithm, and based on the local cluster centers corresponding to each safety core, the optimal local cluster centers corresponding to each safety core are screened by a center index optimization algorithm; Through the particle swarm algorithm, each target cluster center of the current network data flow is identified in each optimal local cluster center, and based on each target cluster center, abnormal data information in each sub-data group is screened as suspected intrusion data information of the network data flow.

2. The method according to claim 1, characterized in that The network data stream is subjected to data splitting processing to obtain sub-data groups corresponding to multiple security cores, including: The network data stream is split and processed to obtain data information of each session type, and the processing type of each security core is collected; Based on the processing type of each security core and the session type of each data information, the session type corresponding to each processing type is queried in the database, and based on the session type corresponding to each processing type, the data information of each session type is grouped and processed to obtain the sub-data group corresponding to the security core to which each processing type belongs.

3. The method according to claim 1, characterized in that The identifying, based on the sub-data groups corresponding to the security cores, the local clustering centers corresponding to each security core by a clustering algorithm includes: For each security core, performing feature extraction processing on each piece of data information in the sub-data group corresponding to the security core to obtain key data features of each piece of data information; Based on the key data features of each of the data information, data clustering processing is performed on each of the data information by using a clustering algorithm to obtain each cluster data group; The central data information in each cluster data group is extracted as each local cluster center corresponding to the security core.

4. The method according to claim 3, characterized in that The local clustering center corresponding to each security core is selected based on the central index optimization algorithm to select the optimal local clustering center corresponding to each security core, including: For each security core, based on the key data features of each data information of each clustered data group corresponding to the security core, the distance value between each data information in each clustered data group is calculated by a feature distance algorithm, and for each clustered data group, based on the distance value between each data information in the clustered data group, the local density value of each data information is calculated by a local density algorithm; Based on the local density value of each data information, in each of the data information, each high-density data information corresponding to each data information is screened, and based on each data information and each high-density data information corresponding to each data information, a distance optimization algorithm is used to calculate the shortest distance value between each data information and each high-density data information corresponding to each data information; Based on each piece of data information, the nearest distance value between each piece of high-density data information corresponding to each piece of data information, and the local density value of each piece of data information, a central index value of each piece of data information is calculated by a central index algorithm; In each data information, the data information with the maximum central index value is selected as the optimal central data information of the cluster data group, and the optimal central data information of each cluster data group is used as the optimal local cluster center corresponding to the security core.

5. The method according to claim 1, characterized in that The step of identifying each target clustering center of the current network data flow in each optimal local clustering center by using a particle swarm algorithm includes: Obtaining the number of target cluster centers of the cloud resource pool and the objective function of the particle swarm algorithm, and for each security core, selecting the target center from the optimal local cluster centers of the security core; Based on the data information of the target center, the target function value corresponding to the target center is calculated through the target function, and based on the target function value and the target center corresponding to the target function value, the target function is adjusted to obtain a new target function; Reselect a new target center from each optimal local cluster center that has not been selected as the target center, and replace the target center with the new target center, and replace the target function with the new target function, and return to execute the data information based on the target center, and calculate the target function value corresponding to the target center through the target function, until the target function value corresponding to each optimal local cluster center is obtained; Based on the number of security cores and the objective function values ​​corresponding to the optimal local clustering centers corresponding to each security core, the optimal local clustering centers corresponding to the objective function values ​​of the target number of clustering centers are selected in order from large to small as the target clustering centers of the current network data flow.

6. The method according to claim 1, characterized in that The step of screening abnormal data information in each sub-data group based on each of the target cluster centers as suspected intrusion data information of the network data flow includes: Based on each data information in the sub-data group of each safety core and each of the target cluster centers, each sub-data group is clustered by a clustering algorithm to obtain discrete data information corresponding to each safety core; The discrete data information corresponding to each of the security cores is used as abnormal data information of the sub-data group corresponding to each security core, and the abnormal data information corresponding to all the security cores is used as suspected intrusion data information of the network data flow.

7. An abnormal data interception device for a cloud resource pool, characterized in that: The device comprises: An acquisition module is used to acquire the current network data flow of the cloud resource pool, and perform data splitting processing on the network data flow to obtain sub-data groups corresponding to multiple security cores; An optimization module, for identifying local cluster centers corresponding to each security core by a clustering algorithm based on the sub-data groups corresponding to each security core, and screening optimal local cluster centers corresponding to each security core by a center index optimization algorithm based on the local cluster centers corresponding to each security core; The screening module is used to identify the target cluster centers of the current network data flow in the optimal local cluster centers through a particle swarm algorithm, and screen the abnormal data information in each sub-data group based on the target cluster centers as the suspected intrusion data information of the network data flow.

8. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 6 are implemented.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

10. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

Images